joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e680
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2666
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], edi
mov eax, dword [ebx + 0x548]
mov dword [ebp - 0x14], edi
cmp edi, eax
jge 0x49e74b
mov eax, dword [ebx + 0x544]
push 0
push 0x1442
push 0x111
mov ecx, dword [eax + edi*8 + 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebx + 0x544]
mov esi, dword [eax + edi*8 + 4]
test esi, esi
mov dword [ebp - 0x1c], esi
je 0x49e73e
mov al, byte [esi + 0x26]
mov byte [ebp - 4], 2
test al, al
je 0x49e708
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x49e701
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x10]
call fcn.00401070
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.005a584d
push esi
call fcn.005a1c12
add esp, 4
mov dword [ebp - 4], 0
inc edi
jmp 0x49e6ab
mov dword [ebp - 4], 0
inc edi
jmp 0x49e6ab
push 0xffffffffffffffff
push 0
lea ecx, [ebx + 0x540]
call fcn.004a6e20
mov ecx, ebx
call fcn.004a3870
mov esi, dword [ebx + 0x554]
test esi, esi
je 0x49e7b1
mov dword [ebp - 0x1c], esi
mov al, byte [esi + 0x26]
mov byte [ebp - 4], 4
test al, al
je 0x49e78a
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x49e783
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x10]
call fcn.00401070
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 0
call fcn.005a584d
push esi
call fcn.005a1c12
add esp, 4
mov dword [ebx + 0x554], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a04e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c26fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], ebx
xor edi, edi
cmp edi, dword [esi + 0xb0]
jge 0x4a05fc
mov eax, dword [0x682f9c]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
mov word [ebp - 0x78], bx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
mov word [ebp - 0x6c], bx
call fcn.00415090
mov eax, dword [0x682f9c]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
call fcn.00415090
mov eax, dword [0x682f9c]
mov dword [ebp - 0xd8], 0x5dc51c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0xd8]
push ebx
push eax
push edi
lea ecx, [esi + 8]
mov byte [ebp - 4], 1
call fcn.0057a250
cmp al, bl
je 0x4a05cc
cmp byte [ebp - 0x90], bl
je 0x4a05cc
mov eax, dword [ebp - 0x40]
cmp eax, ebx
jne 0x4a05ae
lea eax, [ebp - 0x3c]
push eax
call fcn.00589432
add esp, 4
test eax, eax
jbe 0x4a05cc
mov eax, dword [ebp - 0x40]
cmp eax, ebx
jne 0x4a05c5
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], bl
call fcn.0045ac50
inc edi
jmp 0x4a050d
mov eax, dword [esi + 0x434]
cmp eax, ebx
jne 0x4a060c
lea eax, [esi + 0x438]
push eax
call fcn.00589432
add esp, 4
test eax, eax
je 0x4a0632
mov eax, dword [esi + 0x434]
cmp eax, ebx
jne 0x4a0629
lea eax, [esi + 0x438]
push eax
call fcn.0058badb
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2580
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5c291b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov al, byte [esi + 0x26]
mov dword [esp + 0x10], 0
test al, al
je 0x4a25bd
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4a25b6
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x10]
call fcn.00401070
lea ecx, [esi + 0xc]
mov dword [esp + 0x10], 0xffffffff
call fcn.005a584d
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a3870
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2a4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov eax, dword [edi + 0x554]
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4a391b
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a38c9
mov ecx, dword [edi + 0x554]
push ebx
push 0x1442
push 0x111
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, edi
call fcn.0049d140
mov esi, dword [edi + 0x554]
cmp esi, ebx
mov dword [ebp - 0x14], esi
je 0x4a3915
mov al, byte [esi + 0x26]
mov byte [ebp - 4], 1
cmp al, bl
je 0x4a38f9
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x4a38f2
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x10]
call fcn.00401070
lea ecx, [esi + 0xc]
mov byte [ebp - 4], bl
call fcn.005a584d
push esi
call fcn.005a1c12
add esp, 4
mov dword [edi + 0x554], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aa400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c3868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x1c], si
mov bl, 1
lea ecx, [edi + 0x8b0]
mov byte [ebp - 4], bl
call fcn.004db1d0
mov ecx, dword [ebp + 8]
cmp ecx, eax
jge 0x4aa49c
mov edx, dword [edi + ecx*4 + 0x8b4]
mov esi, dword [0x687ae0]
mov byte [ebp - 0x11], bl
mov ebx, dword [0x687ae4]
xor eax, eax
cmp eax, ebx
jge 0x4aa492
lea ecx, [eax + eax*2]
cmp edx, dword [esi + ecx*4]
lea ecx, [esi + ecx*4]
jne 0x4aa4c7
mov ecx, dword [ecx + 8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00401ee0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4aa486
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4aa4ca
mov al, byte [ebp - 0x11]
test al, al
je 0x4aa4ca
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [edi + 0x8b0]
call fcn.004db3e0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc eax
jmp 0x4aa461
lea ecx, [edi + 0x738]
call fcn.00490560
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4aa4df
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.004ac0b0
jmp 0x4aa4a8
Function at 0x4ad850
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5c3e4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
cmp eax, edi
jne 0x4ad938
add edi, 0x64
mov dword [esi + 0x38], edi
lea eax, [edi*8 + 4]
push eax
call fcn.005a1be9
add esp, 4
mov dword [esp + 0x10], eax
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], ebp
je 0x4ad8bc
push fcn.00409460
push fcn.00448810
lea ebx, [eax + 4]
push edi
push 8
push ebx
mov dword [eax], edi
call fcn.00589fa3
mov dword [esp + 0x10], ebx
jmp 0x4ad8c2
mov dword [esp + 0x10], ebp
mov ebx, ebp
cmp ebx, ebp
mov dword [esp + 0x1c], 0xffffffff
jne 0x4ad8e5
lea ecx, [esp + 0x24]
push 0x62f3d0
push ecx
mov dword [esp + 0x2c], 0xc0000017
call fcn.0058aea2
mov eax, dword [esi + 0x34]
xor edi, edi
cmp eax, ebp
jle 0x4ad911
mov edx, dword [esi + 0x30]
mov ecx, ebx
lea ebp, [edx + edi*8]
push ebp
call fcn.005a5986
mov eax, dword [ebp + 4]
inc edi
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x34]
add ebx, 8
cmp edi, eax
jl 0x4ad8ee
mov ebx, dword [esp + 0x10]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4ad935
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push fcn.00409460
push ecx
push 8
push eax
call fcn.00588eb7
push edi
call fcn.005a1c12
add esp, 4
mov dword [esi + 0x30], ebx
mov edx, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
mov ebx, dword [esp + 0x24]
lea edi, [eax + edx*8]
push ebx
mov ecx, edi
call fcn.005a5986
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x34]
mov ecx, dword [esp + 0x14]
inc eax
mov dword [esi + 0x34], eax
mov esi, eax
pop edi
mov dword fs:[0], ecx
lea eax, [esi - 1]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x4adb50
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x6874e8
push 0
push str.SoftwareDownloadManagermenuExt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4adc86
mov edx, dword [0x6881d8]
push esi
push edi
mov edi, edx
or ecx, 0xffffffff
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x10]
push 1
push eax
push str.ffdownl1_str
push edx
call esi
mov edx, dword [0x6881c0]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push str.ffdownlAll_str
push eax
call esi
mov edx, dword [0x6881d0]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
push str.ffdownlFLV_str
push ecx
call esi
mov edx, dword [0x6881cc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x10]
push 1
push eax
push str.ffdownl10FLV_str
push edx
call esi
mov edx, dword [0x6881d4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push str.ffdownlppFLV_str
push eax
call esi
mov edx, dword [0x6881c8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
mov ecx, dword [esp + 0x14]
push eax
push str.ffdownlFLVa_str
push ecx
call esi
mov edx, dword [0x6881c4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x10]
push 1
push eax
push str.ffdownl10FLVa_str
push edx
call esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 8
ret
Function at 0x4b1610
Capabilities:
Identify system language via api
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5c3eb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa0
push esi
push edi
mov esi, ecx
call fcn.004358e0
mov ecx, esi
call fcn.004b73d0
mov ecx, esi
call fcn.004acb80
mov edx, dword [0x687b54]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0
push str.LanguageID
push edx
mov dword [esp + 0x24], 4
call edi
test eax, eax
jne 0x4b1694
push eax
mov eax, dword [esp + 0xc]
push eax
mov ecx, esi
call fcn.004ad980
pop edi
pop esi
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
add esp, 0xac
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0xffff
push 0
push eax
mov ecx, esi
call fcn.004b15d0
push eax
mov ecx, esi
call fcn.004ad980
cmp word [esi + 0x28], 9
je 0x4b1757
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4b1757
mov eax, dword [0x687b54]
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push edx
push 0
push 0
push str.LIDwa
push eax
mov dword [esp + 0x24], 4
call edi
test eax, eax
je 0x4b1757
push 0
lea ecx, [esp + 0x14]
call fcn.004e6920
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0
call fcn.005a17e3
mov edx, dword [0x687b54]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0
mov esi, 1
push str.LIDwa
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x6c]
mov dword [esp + 0xb0], esi
call fcn.005ad3f7
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0xffffffff
call fcn.005a1424
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0xac
ret
Function at 0x4b78a0
Capabilities:
Identify system language via api

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0xffff
mov ecx, esi
push eax
call fcn.004b15d0
cmp ax, 9
jne 0x4b78c1
xor ax, ax
pop esi
ret
push ebx
push edi
mov edi, dword [esi + 0x58]
xor edx, edx
test edi, edi
jle 0x4b78e6
mov ecx, dword [esi + 0x54]
mov ebx, eax
and ebx, 0xffff
add ecx, 8
cmp dword [ecx], ebx
je 0x4b78ef
inc edx
add ecx, 0x20
cmp edx, edi
jl 0x4b78da
pop edi
pop ebx
and eax, 0xffff
pop esi
ret
pop edi
pop ebx
xor eax, eax
pop esi
ret
Function at 0x4b9840
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x5c4326
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x174
push ebp
push edi
mov edi, ecx
push 0
mov dword [esp + 0xc], edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [0x682f9c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov ebp, dword [edi + 0x14]
mov dword [esp + 0x184], 0
neg ebp
sbb ebp, ebp
test ebp, ebp
je 0x4b99c2
push ebx
push esi
cmp ebp, 0xffffffff
mov ecx, ebp
jne 0x4b98b5
mov esi, dword [edi + 0x10]
xor eax, eax
test esi, esi
jbe 0x4b98b5
mov edx, dword [edi + 0xc]
mov ecx, dword [edx]
test ecx, ecx
jne 0x4b98b5
inc eax
add edx, 4
cmp eax, esi
jb 0x4b98a7
mov ebp, dword [ecx]
test ebp, ebp
jne 0x4b98dd
mov eax, dword [ecx + 4]
mov esi, dword [edi + 0x10]
lea edx, [edi + 8]
inc eax
cmp eax, esi
jae 0x4b98dd
mov edx, dword [edx + 4]
lea edx, [edx + eax*4]
mov ebp, dword [edx]
test ebp, ebp
jne 0x4b98dd
inc eax
add edx, 4
cmp eax, esi
jb 0x4b98cf
mov ebx, dword [ecx + 8]
lea esi, [ecx + 0xc]
push esi
lea ecx, [esp + 0x18]
call fcn.005a5986
lea eax, [esi + 4]
lea ecx, [esp + 0x18]
push eax
call fcn.005a5986
mov esi, dword [esi + 8]
cmp esi, 0xffffffff
mov dword [esp + 0x1c], esi
jne 0x4b99b4
mov edx, dword [esp + 0x14]
mov ecx, 0x58
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
push 0x4411
lea ecx, [esp + 0x28]
push 0x160
push ecx
push 0x80
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
lea esi, [edx + 8]
push ecx
push ebx
mov ecx, esi
call fcn.004fbf80
test eax, eax
jne 0x4b9991
mov eax, dword [esi + 4]
test eax, eax
jne 0x4b996a
mov eax, dword [esi + 8]
push 1
push eax
mov ecx, esi
call fcn.00478350
mov ecx, esi
call fcn.004ba260
mov ecx, dword [esp + 0x20]
mov dword [eax + 8], ebx
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x20]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x20]
mov dword [ecx + edx*4], eax
lea esi, [eax + 0xc]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.005a5986
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 4]
call fcn.005a5986
mov edx, dword [esp + 0x1c]
mov dword [esi + 8], edx
mov edi, dword [esp + 0x10]
test ebp, ebp
jne 0x4b9894
pop esi
pop ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edi, dword [edi + 4]
test edi, edi
je 0x4b99e2
push 0
push 0x1446
push 0x111
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x184], 1
call fcn.005a584d
lea ecx, [esp + 0xc]
mov dword [esp + 0x184], 0xffffffff
call fcn.005a584d
mov ecx, dword [esp + 0x17c]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x180
ret
Function at 0x4bb460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c4519
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x5e7410
lea ebx, [esi + 8]
push 0xffffffffffffffff
push 0
mov ecx, ebx
mov dword [esp + 0x24], 2
call fcn.00417d90
lea edi, [esi + 0x1c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.00417d90
add esi, 0x30
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00417d90
mov dword [esp + 0x10], esi
mov dword [esi], method.CCommandLineInfo.virtual_0
mov esi, dword [esi + 4]
mov byte [esp + 0x1c], 3
test esi, esi
je 0x4bb4d8
push esi
call fcn.005a1c12
add esp, 4
mov dword [esp + 0x10], edi
mov dword [edi], method.CCommandLineInfo.virtual_0
mov edi, dword [edi + 4]
mov byte [esp + 0x1c], 4
test edi, edi
je 0x4bb4f7
push edi
call fcn.005a1c12
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [ebx], method.CCommandLineInfo.virtual_0
mov ebx, dword [ebx + 4]
mov dword [esp + 0x1c], 5
test ebx, ebx
je 0x4bb519
push ebx
call fcn.005a1c12
add esp, 4
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4bb8d0
Capabilities:
Access peb ldr_data
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5c4540
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
xor ebx, ebx
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov word [esp + 0x18], bx
lea eax, [esp + 0x14]
mov dword [esp + 0x34], ebx
push eax
call fcn.004bba00
mov ecx, dword [0x682f9c]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x20]
mov byte [esp + 0x34], 1
push edx
call fcn.0058acfc
mov eax, dword [esp + 0x24]
add esp, 4
lea ecx, [esp + 0xc]
push eax
push str._ld_n
push ecx
call fcn.0059e618
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jne 0x4bb949
lea eax, [esp + 0x18]
push ebx
push ebx
push 2
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4bb98f
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], bl
call fcn.005a584d
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], esi
call fcn.00401070
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0x14]
mov ecx, dword [eax - 8]
push ebx
push edx
push ecx
push eax
push esi
call edi
lea eax, [esp + 0x14]
push ebx
push eax
add ebp, 0x44
push 0x1684
push ebp
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.005a584d
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.00401070
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4bcfc0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov eax, dword [esp + 0x10]
push ebp
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push closesocket
mov dword [esp + 0x2c], ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4bd0dc
lea ecx, [esp + 0x1c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4bd020
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4bd020
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x4bd03b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
test ebp, ebp
jne 0x4bd052
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
lea edi, [ebp + 1]
push edi
call fcn.005a1be9
mov esi, eax
add esp, 4
test esi, esi
jne 0x4bd077
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4bd0d3
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x4bd0d3
mov ecx, dword [esp + 0x14]
push eax
push esi
call fcn.004bc3d0
push esi
call fcn.005a1c12
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push esi
call fcn.005a1c12
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x4be1a0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5c4920
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x682f9c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], ebp
call fcn.005a59d6
mov edi, dword [esi + 8]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x1c], ecx
push 0xffffffffffffffff
lea edx, [edi + 1]
mov ecx, esi
push edx
call fcn.004bea40
mov ecx, dword [esi + 4]
lea eax, [edi + edi*2]
lea edx, [esp + 0x14]
lea esi, [ecx + eax*4]
push edx
mov ecx, esi
call fcn.005a5986
mov eax, dword [esp + 0x18]
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov edx, dword [0x682f9c]
mov dword [esp + 0x30], edx
cmp ebp, 1
mov byte [esp + 0x28], 1
jne 0x4be23b
mov eax, 0x65bfd8
jmp 0x4be26d
cmp ebp, 4
jne 0x4be247
mov eax, 0x65bfc4
jmp 0x4be26d
cmp ebp, 5
jne 0x4be253
mov eax, str.rtmpt:__
jmp 0x4be26d
cmp ebp, 2
jne 0x4be25f
mov eax, 0x65bfcc
jmp 0x4be26d
test ebp, ebp
mov eax, 0x65bfb4
je 0x4be26d
mov eax, 0x65bfbc
push ebx
push eax
lea eax, [esp + 0x38]
push str.SoftwareDownloadManagerMCN_s_s
push eax
call fcn.0059e618
add esp, 0x10
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0x6874e8
push 0
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x4be2d8
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x28]
push 4
push ecx
push 4
push eax
push str.number
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.005a584d
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.005a584d
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc