joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481400
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x898
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x750]
push ecx
call fcn.00532580
add esp, 8
lea edx, [ebp - 0x750]
push edx
call fcn.00532e80
add esp, 4
test eax, eax
jbe 0x48146c
lea eax, [ebp - 0x750]
push eax
call fcn.00532e80
add esp, 4
movsx ecx, byte [ebp + eax - 0x751]
cmp ecx, 0x5c
jne 0x48146c
lea edx, [ebp - 0x750]
push edx
call fcn.00532e80
add esp, 4
mov byte [ebp + eax - 0x751], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x308]
push ecx
call fcn.00532580
add esp, 8
lea edx, [ebp - 0x308]
push edx
call fcn.00532e80
add esp, 4
test eax, eax
jbe 0x4814c5
lea eax, [ebp - 0x308]
push eax
call fcn.00532e80
add esp, 4
movsx ecx, byte [ebp + eax - 0x309]
cmp ecx, 0x5c
jne 0x4814c5
lea edx, [ebp - 0x308]
push edx
call fcn.00532e80
add esp, 4
mov byte [ebp + eax - 0x309], 0
lea eax, [ebp - 0x750]
push eax
push str._s.
lea ecx, [ebp - 0x408]
push ecx
call fcn.00532706
add esp, 0xc
lea edx, [ebp - 0x898]
push edx
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 0xffffffff
je 0x48167f
movsx ecx, byte [ebp - 0x86c]
cmp ecx, 0x2e
jne 0x481518
jmp 0x48164d
mov edx, dword [ebp - 0x898]
and edx, 0x10
je 0x481591
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x308]
push ecx
push 0x569e60
lea edx, [ebp - 0x208]
push edx
call fcn.00532706
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call fcn.00486e30
add esp, 4
lea ecx, [ebp - 0x86c]
push ecx
lea edx, [ebp - 0x750]
push edx
push 0x569e68
lea eax, [ebp - 0x108]
push eax
call fcn.00532706
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00481400
add esp, 8
jmp 0x48164d
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x648]
push ecx
call fcn.00532580
add esp, 8
lea edx, [ebp - 0x648]
push edx
call fcn.0053aa0e
add esp, 4
push str.ASRAPI.INI
lea eax, [ebp - 0x648]
push eax
call fcn.005327a0
add esp, 8
test eax, eax
jne 0x481622
lea ecx, [ebp - 0x86c]
push ecx
lea edx, [ebp - 0x308]
push edx
push 0x569e7c
lea eax, [ebp - 0x648]
push eax
call fcn.00532706
add esp, 0x10
lea ecx, [ebp - 0x548]
push ecx
lea edx, [ebp - 0x648]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 0xffffffff
je 0x481622
mov eax, dword [ebp - 0x64c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x48164d
lea ecx, [ebp - 0x308]
push ecx
lea edx, [ebp - 0x750]
push edx
lea eax, [ebp - 0x86c]
push eax
call fcn.004811c0
add esp, 0xc
test eax, eax
jne 0x48164d
mov dword [0x5f8f0c], 1
lea ecx, [ebp - 0x898]
push ecx
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x481672
cmp dword [0x5f8f0c], 0
je 0x481507
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4819e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
push str.SoftwareQualcommEudoraCommandline
lea eax, [ebp - 0x210]
push eax
call fcn.00532580
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
push str.Current
lea edx, [ebp - 0x210]
push edx
push reloc.WSOCK32.dll_accept
call fcn.00486ed0
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x481b74
mov byte [ebp - 0x310], 0
lea eax, [ebp - 0x110]
push eax
call fcn.0053aa0e
add esp, 4
push str.EUDORA.INI
lea ecx, [ebp - 0x110]
push ecx
call fcn.00532680
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x481ab1
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0x20
jne 0x481a93
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.00532580
add esp, 8
jmp 0x481ab1
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x110]
cmp ecx, edx
jne 0x481aab
jmp 0x481ab1
cmp dword [ebp - 8], 1
je 0x481a6e
movsx eax, byte [ebp - 0x310]
test eax, eax
je 0x481b74
lea ecx, [ebp - 0x310]
push ecx
push 0xff
push 0x71f9a0
push 0x5f901f
push str.ReturnAddress
push 0x56a08c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x481b18
lea edx, [ebp - 0x310]
push edx
push 0xff
push 0x71f9a0
push 0x5f9024
push str.POPAccount
push 0x56a0a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x310]
push eax
push 0xff
push 0x7200c0
push 0x5f9025
push str.AutoReceiveAttachmentsDirectory
push 0x56a0d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x310]
push ecx
push 0xff
push 0x71fba0
push 0x5f9026
push str.SMTPServer
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0xc], eax
mov dword [0x5f9020], 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x483510
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x60137c]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x5f94d4]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x10], eax
push 9
mov edx, dword [0x60137c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 9
mov eax, dword [0x60131c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x60137c], 0
jne 0x483577
push 0
push 0x56a668
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4836a6
cmp dword [0x5f94d4], 0
jne 0x4835a2
mov dword [ebp - 8], 0xff
push 0xff
call fcn.005324a9
add esp, 4
mov dword [0x5f94d4], eax
mov edx, dword [0x5f94d4]
mov byte [edx], 0
mov dword [0x71f520], 0
mov dword [0x71f980], 0
mov eax, dword [ebp + 8]
push eax
push 0x71ef00
call fcn.00532580
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
push 0x71f120
call fcn.00532580
add esp, 8
mov edx, dword [ebp + 0x10]
push edx
push 0x71ed00
call fcn.00532580
add esp, 8
mov byte [0x71f760], 0
mov eax, dword [ebp + 0x14]
push eax
push 0x71f760
call fcn.00532580
add esp, 8
call fcn.00484fa0
movsx ecx, byte [0x71f760]
test ecx, ecx
je 0x48363c
mov dword [0x71f980], 0x63
push 0
push 0x4840a0
mov edx, dword [ebp - 0x10]
push edx
push 0x56a670
mov eax, dword [0x6013e4]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [ebp - 0xc], eax
jmp 0x48365c
push 0
push 0x4840a0
mov ecx, dword [ebp - 0x10]
push ecx
push str.PROMPT_USER
mov edx, dword [0x6013e4]
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [ebp - 0xc], eax
call fcn.00484fa0
push str.Prompt_User_Dialog
mov eax, dword [ebp - 0xc]
push eax
call fcn.004834a0
add esp, 8
cmp dword [ebp - 8], 0
je 0x48369a
cmp dword [0x5f94d4], 0
je 0x48369a
mov ecx, dword [0x5f94d4]
push ecx
call fcn.00532828
add esp, 4
mov dword [0x5f94d4], 0
mov edx, dword [ebp - 4]
mov dword [0x5f94d4], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x483fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
call fcn.0048df20
add esp, 4
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jne 0x483ff6
jmp 0x48408c
push 0x56a810
lea ecx, [ebp - 0x108]
push ecx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x484051
mov edx, dword [ebp - 0x10c]
push edx
push 1
mov eax, dword [0x5f94d4]
push eax
call fcn.00532e80
add esp, 4
push eax
mov ecx, dword [0x5f94d4]
push ecx
call fcn.005337fa
add esp, 0x10
mov edx, dword [ebp - 0x10c]
push edx
call fcn.00431d50
add esp, 4
jmp 0x48408c
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x310]
push ecx
push 0x56a814
push 0
call fcn.0046ce90
add esp, 0x10
push str.MSG_Message_CannotWriteFile
push 0x5f9bf4
push 0x56a84c
lea edx, [ebp - 0x310]
push edx
call fcn.00422b80
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x485120
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 8], eax
movsx eax, byte [0x5f9c00]
test eax, eax
je 0x485157
push 0x5f9c00
mov ecx, dword [ebp + 8]
push ecx
call fcn.00532580
add esp, 8
mov eax, dword [ebp + 8]
jmp 0x48527f
push str._none_
mov edx, dword [ebp + 8]
push edx
call fcn.00532580
add esp, 8
push str.SoftwareMicrosoft.NETFramework
push 0x5f9c00
call fcn.00532580
add esp, 8
lea eax, [ebp - 0x350]
push eax
push str.InstallRoot
push 0x5f9c00
push reloc.WSOCK32.dll_bind
call fcn.00486ed0
add esp, 0x10
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x485246
push str.v.
lea ecx, [ebp - 0x350]
push ecx
call fcn.00532590
add esp, 8
lea edx, [ebp - 0x148]
push edx
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x48523c
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x248]
push edx
call fcn.00532580
add esp, 8
mov eax, dword [ebp - 0x148]
and eax, 0x10
je 0x485227
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x248]
push edx
call fcn.005327a0
add esp, 8
test eax, eax
jle 0x485227
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00532580
add esp, 8
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4851dc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 8]
push edx
push str..NET_Framework_version___s
push 0x5f9c00
call fcn.00532706
add esp, 0xc
push 0x5f9c00
push 0
call fcn.00436500
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x5f9c00
call fcn.00532580
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x485a30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
movsx eax, byte [0x5f98d8]
test eax, eax
jne 0x485b55
push 0x56ab9c
push 0x5fd3d0
push 0x56aba8
lea ecx, [ebp - 0x208]
push ecx
call fcn.00532706
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
push 0xff
lea eax, [ebp - 0x108]
push eax
push 0x5f9bf7
push 0x5c60d8
push 0x56abb0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x108]
push ecx
push 0x5f98d8
call fcn.00532580
add esp, 8
push 0x5f98d8
call fcn.00433f40
add esp, 4
push 0x56abb8
push 0x5f98d8
call fcn.00532590
add esp, 8
push 0x56abbc
push 0x5f98d8
push 0x56abc8
lea edx, [ebp - 0x108]
push edx
call fcn.00532706
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call fcn.00423310
add esp, 4
test eax, eax
je 0x485b12
push 0x56abd0
push 0x5f98d8
call fcn.005327a0
add esp, 8
test eax, eax
jne 0x485b55
push 0x200
push 0x5f98d8
mov ecx, dword [0x6013e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5f98d8
call fcn.00433f40
add esp, 4
push 0x56abd4
push 0x5f98d8
call fcn.00532590
add esp, 8
push 0x5f98d8
call fcn.00433800
add esp, 4
mov eax, 0x5f98d8
jmp 0x485b61
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x486a30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
mov dword [ebp - 4], eax
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
mov dword [ebp - 8], ecx
cmp dword [ebp - 4], 0
je 0x486a7a
cmp dword [ebp - 8], 0
je 0x486a7a
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x486ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0xff
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], eax
mov byte [ebp - 0x108], 0
lea ecx, [ebp - 0x10c]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x486fb8
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x110]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x118], eax
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x118], 0
jne 0x486fb8
cmp dword [ebp - 0x114], 0xfe
jbe 0x486f8b
mov dword [ebp - 0x114], 0xfe
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.00533040
add esp, 0xc
mov eax, dword [ebp + 0x14]
add eax, dword [ebp - 0x114]
mov byte [eax], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret

Function at 0x486fd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0xff
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0x14]
push edx
call fcn.00532e80
add esp, 4
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x487050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0xc], eax
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x487800
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5f94c4], 0
jne 0x4879b7
push 2
call fcn.004f3670
add esp, 4
lea eax, [ebp - 0x108]
push eax
call fcn.00485fc0
add esp, 4
cmp dword [0x5c6c1c], 1
jne 0x487858
push 0x56b378
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp 0x48786c
push 0x56b384
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
lea eax, [ebp - 0x108]
push eax
push 0xff
lea ecx, [ebp - 0x208]
push ecx
push 0x56b390
push str.disable_QT_accleration
push 0x56b3ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x208]
push edx
call fcn.0053aa0e
add esp, 4
cmp dword [0x55c710], 1
jne 0x4878bf
push 6
call fcn.00530c10
add esp, 4
mov word [ebp - 0x30c], ax
jmp 0x4878fb
push 0x56b3b4
lea eax, [ebp - 0x208]
push eax
call fcn.00532680
add esp, 8
test eax, eax
je 0x4878ea
push 2
call fcn.00530c10
add esp, 4
mov word [ebp - 0x30c], ax
jmp 0x4878fb
push 0
call fcn.00530c10
add esp, 4
mov word [ebp - 0x30c], ax
lea ecx, [ebp - 0x208]
push ecx
push str.disable_QT_accleration_s
lea edx, [ebp - 0x308]
push edx
call fcn.00532706
add esp, 0xc
lea eax, [ebp - 0x308]
push eax
push 1
call fcn.00436500
add esp, 8
push 1
call fcn.004f3670
add esp, 4
movsx ecx, word [ebp - 0x30c]
test ecx, ecx
je 0x48797a
push 0x56b3d4
push 0
call fcn.00436500
add esp, 8
push 0
push 0x56b3f4
push str.Cannot_initialize_QuickTime_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x5f9d13
push 0xfd4
push str.QT_Initialize
call fcn.00431ee0
add esp, 0xc
xor eax, eax
jmp 0x4879bc
call fcn.00530300
mov dword [0x5f94c4], 1
push 0x5f94c8
push 0x7174696d
call fcn.00530e70
add esp, 8
mov word [ebp - 0x310], ax
movsx edx, word [ebp - 0x310]
test edx, edx
je 0x4879b7
mov dword [0x5f94c8], 0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x488080
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00423310
add esp, 4
cmp eax, 1
jne 0x4880a1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00429360
add esp, 4
mov edx, dword [0x56df78]
mov dword [0x5f94cc], edx
mov dword [ebp + 0x10], 0
cmp dword [0x56a5e0], 1
je 0x4880ea
cmp dword [0x56a5e0], 2
je 0x4880ea
cmp dword [0x56a5e0], 3
je 0x4880ea
cmp dword [0x56a5e0], 6
je 0x4880ea
cmp dword [0x56a5e0], 7
je 0x4880ea
cmp dword [0x55c710], 1
jne 0x4880ff
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
jmp 0x48811b
push 0
push 0
push 0
push 0x487ca0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00488130
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x488130
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x488161
xor eax, eax
jmp 0x48818b
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x488186
xor eax, eax
jmp 0x48818b
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x488210
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x490]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0xffffffff
jne 0x48824a
xor eax, eax
jmp 0x488324
mov edx, dword [ebp - 0x350]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x348]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0xffffffff
je 0x488290
mov edx, dword [ebp - 0x350]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00429360
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005390c6
add esp, 8
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
je 0x4882e3
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005390c6
add esp, 8
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x4882f5
mov eax, 1
jmp 0x488324
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.Could_not_rename_file_from__s_to__s
lea eax, [ebp - 0x208]
push eax
call fcn.00532706
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
push 1
call fcn.00436500
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4894f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 1
mov eax, dword [ebp + 8]
push eax
push 3
call fcn.00436500
add esp, 8
cmp dword [0x55c710], 1
jne 0x489590
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push str.open
mov edx, dword [0x60137c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 8]
push eax
push 1
call fcn.00436500
add esp, 8
cmp dword [ebp - 0x214], 0
jne 0x489585
lea ecx, [ebp - 0x208]
push ecx
push 0x5f9d1c
push 0x56bdb8
push 0x56bdc8
call fcn.00422b80
add esp, 0x10
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
jmp 0x48966c
cmp dword [0x56bdac], 1
jne 0x4895b0
push 0x5f9150
call fcn.00489330
add esp, 4
mov dword [0x56bdac], 0
movsx edx, byte [0x5f9150]
test edx, edx
jne 0x4895e5
lea eax, [ebp - 0x208]
push eax
push 0x5f9d1d
push 0x56bdf0
push str.MSG_Message_CantFindInternetBrowser
call fcn.00422b80
add esp, 0x10
mov dword [ebp - 0x210], 0
jmp 0x48964a
mov ecx, dword [ebp + 8]
push ecx
push 0x5f9150
push 0x56be24
lea edx, [ebp - 0x108]
push edx
call fcn.00532706
add esp, 0x10
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00489080
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x48964a
lea ecx, [ebp - 0x208]
push ecx
push 0x5f9d1e
push 0x56be2c
push str.MSG_Message_CantLaunchInternetBrowser
call fcn.00422b80
add esp, 0x10
mov dword [ebp - 0x210], 0
cmp dword [0x5fdbac], 0
jne 0x489666
cmp dword [0x5fd8e0], 0
jne 0x489666
mov dword [0x5fdbac], 8
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x489ea0
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x10c], 0
push 0x56c000
lea eax, [ebp - 0x108]
push eax
call fcn.00532580
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
push str.TEMP
lea edx, [ebp - 0x108]
push edx
push reloc.WSOCK32.dll_accept
call fcn.00486ed0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x489f1c
push 0xff
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x10c], 1
jmp 0x489f73
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea edx, [ebp - 0x108]
push edx
call fcn.00532580
add esp, 8
lea eax, [ebp - 0x210]
push eax
push str.Cache
lea ecx, [ebp - 0x108]
push ecx
push reloc.WSOCK32.dll_accept
call fcn.00486ed0
add esp, 0x10
mov dword [ebp - 4], eax
push 0xff
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x10c], 1
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00427d90
add esp, 8
mov dword [ebp - 4], eax
push str.Temporary_Internet_Files
mov edx, dword [ebp + 8]
push edx
call fcn.00532680
add esp, 8
test eax, eax
je 0x489faf
mov dword [ebp - 4], 0xffffffff
push str.Reset_from_Temporary_Internet_Files
push 0
call fcn.00436500
add esp, 8
cmp dword [ebp - 4], 0xffffffff
jne 0x48a00c
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerVolumeCachesTemporary_files
lea eax, [ebp - 0x108]
push eax
call fcn.00532580
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
push str.Folder
lea edx, [ebp - 0x108]
push edx
push reloc.WSOCK32.dll_bind
call fcn.00486ed0
add esp, 0x10
mov dword [ebp - 4], eax
push 0xff
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x10c], 1
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret