joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489c2b
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a066f
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x4d2a20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4d719c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
je 0x489c66
jmp 0x489df4
cmp dword [ebp + 0xc], 0
jne 0x489c73
mov dword [ebp + 0xc], 0xc800000
mov eax, dword [ebp + 0xc]
mov dword [0x4d3780], eax
mov byte [ebp - 0x19], 0
lea ecx, [ebp - 0x10]
call fcn.00401d20
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x489ccd
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00489b82
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x10]
call fcn.00401000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00406df8
lea ecx, [ebp - 0x10]
call fcn.00413706
mov dword [ebp + 8], eax
push dword [ebp + 8]
push 0x4b3dfc
push 0x104
push 0x4d6f88
call sub.MSVCR80.dll_swprintf_s
add esp, 0x10
cmp dword [ebp + 0xc], 0xffffffff
je 0x489d66
push dword [ebp + 8]
call fcn.00489036
pop ecx
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x38]
jb 0x489d66
ja 0x489d19
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x3c]
jb 0x489d66
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.004018ae
mov byte [ebp - 4], 2
push str..old
lea ecx, [ebp - 0x20]
call fcn.00420d08
lea ecx, [ebp - 0x20]
call fcn.00413706
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x20]
call fcn.00413706
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov byte [ebp - 0x19], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00406df8
lea ecx, [ebp - 0x14]
call fcn.0042e2c0
mov byte [ebp - 4], 3
push 0
push 0
push 0x80
movzx eax, byte [ebp - 0x19]
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 4
push eax
push 1
push 0x40000000
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.0043576c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x489ddc
push 2
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.0043592d
lea ecx, [ebp - 0x14]
call fcn.00420e85
mov dword [0x4d7190], eax
movzx eax, byte [0x4d6f80]
test eax, eax
je 0x489ddc
push str.BEGAIN_n
push 0
push 0
call fcn.00489ffc
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004357b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406df8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x48a47a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x48a4ad
mov eax, dword [ebp - 4]
and eax, 1
je 0x48a4ad
mov eax, dword [ebp - 4]
and eax, 0xfffffffe
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
leave
ret

Function at 0x48a4af
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x218], eax
cmp dword [ebp + 8], 0
je 0x48a4f9
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test eax, eax
jne 0x48a500
xor eax, eax
jmp 0x48a5a5
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp eax, 0x5c
jne 0x48a51e
mov eax, dword [ebp + 8]
movzx eax, word [eax + 2]
cmp eax, 0x5c
je 0x48a51e
xor eax, eax
jmp 0x48a5a5
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp eax, 0x2f
jne 0x48a52d
xor eax, eax
jmp 0x48a5a5
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x48a53e
xor eax, eax
jmp 0x48a5a5
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x48a576
push 0x103
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR80.dll__wfullpath
add esp, 0xc
test eax, eax
jne 0x48a56a
xor eax, eax
jmp 0x48a5a5
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], eax
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x48a5a2
mov eax, dword [ebp - 0x214]
and eax, 0x400
je 0x48a5a2
xor eax, eax
jmp 0x48a5a5
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047676d
leave
ret
Function at 0x48b231
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 1
push 0
push 0
push dword [ebp + 8]
push 0x4b4f74
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret

Function at 0x48b24c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [ebp + 8]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48b26e
xor eax, eax
jmp 0x48b288
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x48b28a
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
and dword [ebp - 0x240], 0
and dword [ebp - 0x244], 0
and dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
or dword [ebp - 0x23c], 0xffffffff
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x48b2f7
jmp 0x48b405
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x48b312
jmp 0x48b405
and word [ebp - 0x850], 0
xor eax, eax
lea edi, [ebp - 0x84e]
stosd dword es:[edi], eax
and word [ebp - 0x848], 0
push 0x1fe
push 0
lea eax, [ebp - 0x846]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
and word [ebp - 0x648], 0
push 0x1fe
push 0
lea eax, [ebp - 0x646]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
and word [ebp - 0x448], 0
push 0x1fe
push 0
lea eax, [ebp - 0x446]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x100
lea eax, [ebp - 0x448]
push eax
push 0x100
lea eax, [ebp - 0x648]
push eax
push 0x100
lea eax, [ebp - 0x848]
push eax
push 3
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCR80.dll__wsplitpath_s
add esp, 0x24
lea eax, [ebp - 0x648]
push eax
push dword [ebp + 8]
call sub.MSVCR80.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x48b3e7
push dword [ebp - 0x230]
call fcn.0048b24c
pop ecx
test eax, eax
jne 0x48b3e5
and dword [ebp - 0x240], 0
jmp 0x48b3fd
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48b37d
xor eax, eax
jne 0x48b2da
cmp dword [ebp - 0x23c], 0xffffffff
je 0x48b421
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x23c], 0xffffffff
mov eax, dword [ebp - 0x240]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047676d
leave
ret
Function at 0x48b47c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48b4e8
mov dword [ebp - 0x128], 0x114
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x48b4e8
xor eax, eax
jmp 0x48b503
cmp dword [ebp - 0x124], 6
jne 0x48b501
cmp dword [ebp - 0x120], 0
jb 0x48b501
xor eax, eax
inc eax
jmp 0x48b503
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047676d
leave
ret

Function at 0x48b50f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x11c
push 0
lea eax, [ebp - 0x228]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x228], 0x11c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48b594
mov dword [ebp - 0x228], 0x114
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x48b594
xor eax, eax
jmp 0x48b5af
cmp dword [ebp - 0x224], 6
jne 0x48b5ad
cmp dword [ebp - 0x220], 0
jne 0x48b5ad
xor eax, eax
inc eax
jmp 0x48b5af
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047676d
leave
ret

Function at 0x48b5bb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x11c
push 0
lea eax, [ebp - 0x228]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x228], 0x11c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48b640
mov dword [ebp - 0x228], 0x114
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x48b640
xor eax, eax
jmp 0x48b65b
cmp dword [ebp - 0x224], 6
jne 0x48b659
cmp dword [ebp - 0x220], 1
jb 0x48b659
xor eax, eax
inc eax
jmp 0x48b65b
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047676d
leave
ret
Function at 0x48b6f8
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x48b70c
cmp dword [ebp + 0xc], 0
jne 0x48b70e
jmp 0x48b747
push dword [ebp + 0xc]
call fcn.0040808d
pop ecx
test eax, eax
je 0x48b732
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
xor eax, eax
jne 0x48b700
mov eax, dword [ebp - 4]
leave
ret

Function at 0x48b8da
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f2a5
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x22c], 0
and word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x102
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x48b971
push 0x4b4dcc
mov ecx, dword [ebp + 8]
call fcn.004018ae
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 8]
jmp 0x48ba73
cmp dword [ebp - 0x10], 0x102
jb 0x48ba52
lea ecx, [ebp - 0x220]
call fcn.00401d20
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
inc eax
inc eax
mov dword [ebp - 0x228], eax
push dword [ebp - 0x228]
mov eax, dword [ebp - 0x228]
inc eax
inc eax
push eax
lea ecx, [ebp - 0x220]
call fcn.004283fa
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x224], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
call fcn.0040d47b
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x228]
jae 0x48ba11
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401c6b
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00406df8
mov eax, dword [ebp + 8]
jmp 0x48ba73
push 0x4b4dd0
mov ecx, dword [ebp + 8]
call fcn.004018ae
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00406df8
mov eax, dword [ebp + 8]
jmp 0x48ba73
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004018ae
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047676d
leave
ret
Function at 0x48c3a9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a02ad
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 0x70], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x24], 0
cmp dword [ebp + 8], 0
jne 0x48c3ed
cmp dword [ebp + 0xc], 0
jne 0x48c3ed
mov eax, dword [ebp - 0x24]
jmp 0x48c51a
and dword [ebp - 0x6c], 0
push 0x40
push 0
lea eax, [ebp - 0x68]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
and dword [ebp - 0x1c], 0
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 0x81
mov eax, dword [ebp + 0x14]
neg eax
sbb eax, eax
and eax, 5
mov word [ebp - 0x3c], ax
lea ecx, [ebp - 0x8c]
call fcn.00402f21
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x48c48c
push 0x4b4e90
lea ecx, [ebp - 0x8c]
call fcn.00414777
push dword [ebp + 8]
lea ecx, [ebp - 0x8c]
call fcn.004284bf
push 0x4b4e94
lea ecx, [ebp - 0x8c]
call fcn.004284bf
push 0x4b4e98
lea ecx, [ebp - 0x8c]
call fcn.004284bf
push dword [ebp + 0xc]
lea ecx, [ebp - 0x8c]
call fcn.004284bf
jmp 0x48c49a
push dword [ebp + 8]
lea ecx, [ebp - 0x8c]
call fcn.00414777
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x10]
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x8c]
call fcn.0041478d
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x48c4fc
cmp dword [ebp + 0x18], 0
je 0x48c4dd
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x90], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00402f4a
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x70]
xor ecx, ebp
call fcn.0047676d
leave
ret
Function at 0x48c955
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1455
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4d2a20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x48c989
jmp 0x48ca55
push 0xf003f
push dword [ebp + 8]
push 4
call fcn.0048c8e0
add esp, 0xc
mov dword [ebp - 0x14], eax
and dword [ebp - 0x18], 0
jmp 0x48c9ab
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
call fcn.00401d20
and dword [ebp - 4], 0
push 0x104
push 0x105
lea ecx, [ebp - 0x24]
call fcn.004283fa
push eax
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x20], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.0040d47b
cmp dword [ebp - 0x20], 0
je 0x48c9f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00406df8
jmp 0x48ca46
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
push 0
lea ecx, [ebp - 0x24]
call fcn.00413706
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x28], 0
je 0x48ca35
push dword [ebp + 0xc]
push dword [ebp - 0x28]
call fcn.0048c955
pop ecx
pop ecx
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00406df8
jmp 0x48c9a4
mov dword [ebp - 0x10], 1
xor eax, eax
jne 0x48c97e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret
Function at 0x48ee1f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 8], eax
and word [ebp - 0x640], 0
push 0x208
push 0
lea eax, [ebp - 0x63e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x640]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
and word [ebp - 0x858], 0
push 0x208
push 0
lea eax, [ebp - 0x856]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
and word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
and word [ebp - 0x428], 0
push 0x208
push 0
lea eax, [ebp - 0x426]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x640]
push eax
call fcn.0048e213
add esp, 0x10
mov word [ebp - 0x644], 1
and word [ebp - 4], 0
and dword [ebp - 0x42c], 0
movzx eax, word [ebp - 0x858]
test eax, eax
je 0x48ef3c
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x858]
push eax
call fcn.0048e12d
add esp, 0x10
test eax, eax
jne 0x48ef3c
mov word [ebp - 0x644], 1
and word [ebp - 4], 0
and dword [ebp - 0x42c], 0
push 0xffffffffffffffff
push 0
push 0x804
push 1
push 1
push dword [ebp - 0x42c]
push dword [ebp - 4]
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x218]
push eax
push str.QQPCMgr
call fcn.0048ea54
add esp, 0x30
push 0x4b61bc
push 0x2710
call fcn.0048edcd
pop ecx
pop ecx
call fcn.0048e9f8
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047676d
leave
ret

Function at 0x49509d
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x20
call fcn.00413706
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4950db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4950db
xor eax, eax
inc eax
jmp 0x4950dd
xor eax, eax
leave
ret

Function at 0x4950df
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
call fcn.0049500c
and dword [ebp - 8], 0
mov dword [ebp - 8], 6
cmp dword [ebp - 8], 0
je 0x495113
push 0
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x495bc4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a15b3
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4d2a20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
push 1
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0048bd93
add esp, 0xc
and dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x20]
push eax
call fcn.0048cc61
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x10]
call fcn.00413706
push eax
mov ecx, dword [ebp - 0x28]
call fcn.00401019
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x20]
call fcn.00406df8
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x495cc4
push str.bugreport.exe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402e88
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00413706
push eax
call fcn.0040808d
pop ecx
test eax, eax
je 0x495c79
lea ecx, [ebp - 0x14]
call fcn.00413706
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.BugReportRule.dat
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00402e88
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00413706
push eax
call fcn.0040808d
pop ecx
test eax, eax
je 0x495cb0
lea ecx, [ebp - 0x18]
call fcn.00413706
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x18]
call fcn.00406df8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00406df8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406df8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret
Function at 0x49807c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0c4f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4d2a20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x10]
call fcn.00401d20
and dword [ebp - 4], 0
push dword [ebp + 0x10]
lea ecx, [ebp - 0x14]
call fcn.00401c6b
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
call fcn.0048e0f5
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00420cd9
movzx eax, al
test eax, eax
je 0x4980ed
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00406df8
jmp 0x49817a
push str.CpuVulFixKbs.ini
lea ecx, [ebp - 0x14]
call fcn.00420d08
lea ecx, [ebp - 0x14]
call fcn.00413706
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49811b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00406df8
jmp 0x49817a
lea ecx, [ebp - 0x14]
call fcn.00413706
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00413706
push eax
push str.SecKBTYPE
lea eax, [ebp - 0x18]
push eax
call fcn.0048e025
add esp, 0x14
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
call fcn.00401000
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00406df8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00406df8
xor eax, eax
jne 0x4980b4
movzx eax, byte [0x4d376e]
test eax, eax
je 0x4981a8
push dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
push dword [eax]
push str.CpuVul::GetKbidDesc
push 0x4b5468
push str.__s__Func:_s_strKbid:_s_strType:_s
push 0
push 0
call fcn.00489ffc
add esp, 0x1c
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401c6b
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406df8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 0xc