joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480ba0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.0044e6c0
movzx eax, al
test eax, eax
jne 0x480c02
mov ecx, dword [ebp + 8]
push ecx
call fcn.004645c0
add esp, 4
movzx edx, al
test edx, edx
je 0x480c02
mov eax, dword [ebp + 8]
push eax
call fcn.004654b0
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.004645c0
add esp, 4
movzx edx, al
test edx, edx
je 0x480c02
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
call fcn.0044e6d0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret 4

Function at 0x483050
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x66e5c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x410
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.004ce740
add esp, 0xc
mov dword [ebp - 0x418], 0
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
je 0x48309d
xor al, al
jmp 0x4830f6
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x4830cf
cmp dword [ebp - 0x418], 0
je 0x4830cb
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor al, al
jmp 0x4830f6
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0044e710
cmp dword [ebp - 0x418], 0
je 0x4830f4
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ed9
mov esp, ebp
pop ebp
ret

Function at 0x483110
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push 0x3c
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.004ce740
add esp, 0xc
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
cmp dword [ebp + 0x18], 0
je 0x483142
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 8], ecx
jmp 0x48314b
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x10], 0
mov byte [ebp - 1], 0
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4831a4
cmp dword [ebp - 0x28], 0x20
jbe 0x483197
mov dword [ebp - 0xc], 1
jmp 0x48319e
mov dword [ebp - 0xc], 0
mov al, byte [ebp - 0xc]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4831c3
movzx edx, byte [ebp + 0x20]
test edx, edx
je 0x4831c3
push 0x2710
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x483f90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push 0x3c
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.004ce740
add esp, 0xc
mov dword [ebp - 0x44], 0x3c
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x40], ecx
cmp dword [ebp + 0x20], 0
je 0x483fc1
mov edx, dword [ebp + 0x20]
mov dword [ebp - 4], edx
jmp 0x483fca
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x484020
cmp dword [ebp - 0x24], 0x20
jbe 0x484012
mov dword [ebp - 8], 1
jmp 0x484019
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
jmp 0x484033
cmp dword [ebp + 0x18], 0
je 0x484031
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x485380
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x66e5c0]
xor eax, esp
mov dword [esp + 0x400], eax
push 0x400
lea eax, [esp + 4]
push 0
push eax
call fcn.004ce740
add esp, 0xc
lea eax, [esp + 0x40c]
push eax
push 0
push dword [esp + 0x410]
lea eax, [esp + 0xc]
push 0x200
push eax
call fcn.0045f4b0
push dword [eax + 4]
push dword [eax]
call fcn.004dd45e
add esp, 0x1c
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.004c3ed9
add esp, 0x404
ret
Function at 0x486a30
Capabilities:
Get session user name

Disassembly:
sub esp, 0x214
mov eax, dword [0x66e5c0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, ecx
mov dword [esi], 0
cmp dword [0x66e010], 0
jne 0x486a9b
push 0x20a
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004ce740
add esp, 0xc
mov dword [esp + 4], 0x104
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov ecx, section..data
mov word [esp + 0x20e], ax
lea eax, [esp + 8]
push eax
call fcn.0044e710
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004c3ed9
add esp, 0x214
ret
Function at 0x487040
Capabilities:
Get session user name

Disassembly:
sub esp, 0x218
mov eax, dword [0x66e5c0]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [0x675328]
push edi
mov edi, ecx
test eax, eax
jle 0x48707e
inc eax
mov dword [0x675328], eax
mov al, 1
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004c3ed9
add esp, 0x218
ret
push ebx
push esi
lea eax, [esp + 0x10]
mov byte [esp + 0xf], 0
push eax
mov dword [esp + 0x14], 0
call fcn.00486b50
test al, al
je 0x48713c
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48713c
push str.ImpersonateLoggedOnUser
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x10]
push esi
call eax
test eax, eax
je 0x487133
inc dword [0x675328]
mov eax, dword [edi]
test eax, eax
je 0x4870de
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], esi
xor esi, esi
mov byte [esp + 0xf], 1
cmp dword [0x66e028], esi
jne 0x487133
push 0x20a
lea eax, [esp + 0x18]
push esi
push eax
call fcn.004ce740
add esp, 0xc
mov dword [esp + 0x10], 0x104
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov ecx, 0x66e018
mov word [esp + 0x21a], ax
lea eax, [esp + 0x14]
push eax
call fcn.0044e710
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x487140
mov esi, dword [esp + 0x10]
test esi, esi
je 0x48714b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x220]
mov al, byte [esp + 0xf]
pop esi
pop ebx
pop edi
xor ecx, esp
call fcn.004c3ed9
add esp, 0x218
ret

Function at 0x487170
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x66e5c0]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.004ce740
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4871ed
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x4871d6
jne 0x4871ed
cmp dword [esp + 8], 0
seta al
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004c3ed9
add esp, 0x118
ret
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004c3ed9
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.004c3ed9
add esp, 0x118
ret

Function at 0x487210
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x66e5c0]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.004ce740
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x487265
xor al, al
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004c3ed9
add esp, 0x118
ret
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x114]
setae al
xor ecx, esp
call fcn.004c3ed9
add esp, 0x118
ret
Function at 0x487290
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x66e5c0]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.004ce740
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4872e5
xor al, al
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004c3ed9
add esp, 0x118
ret
cmp dword [esp + 4], 0xa
mov ecx, dword [esp + 0x114]
setae al
xor ecx, esp
call fcn.004c3ed9
add esp, 0x118
ret

Function at 0x487310
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x66e5c0]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.004ce740
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x487377
mov eax, dword [esp + 4]
cmp eax, 6
jbe 0x48736e
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004c3ed9
add esp, 0x118
ret
jb 0x487377
cmp dword [esp + 8], 2
jae 0x487357
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.004c3ed9
add esp, 0x118
ret

Function at 0x487480
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x41c
mov eax, dword [0x66e5c0]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
mov ebx, dword [esp + 0x424]
push esi
mov esi, dword [esp + 0x42c]
push edi
mov edi, ecx
test ebx, ebx
jne 0x4874af
xor al, al
jmp 0x4874e7
mov eax, dword [edi + 4]
lea ecx, [esp + 0xc]
push ecx
or eax, 0x20019
mov dword [esp + 0x10], 0
push eax
push esi
push ebx
mov ecx, edi
call fcn.00487e80
test al, al
je 0x4874e5
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi], 0
je 0x487501
mov byte [edi + 1], 1
mov al, 1
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c3ed9
add esp, 0x41c
ret 8
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x48750b
mov eax, dword [esi]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x4874e5
cmp dword [esi + 0x14], 7
jbe 0x48751f
mov esi, dword [esi]
push 0x412
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004ce740
lea ecx, [esp + 0x1c]
add esp, 0xc
mov eax, ecx
mov edx, 0x208
sub esi, eax
lea eax, [edx + 0x7ffffdf6]
test eax, eax
je 0x48755e
movzx eax, word [esi + ecx]
test ax, ax
je 0x48755e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x487540
push dword [edi + 4]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004885e0
add esp, 0xc
test eax, eax
setne al
jmp 0x4874e7
Function at 0x487590
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, ecx
test ebx, ebx
je 0x4875fa
mov eax, dword [edi + 4]
lea ecx, [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
or eax, 0x20019
push ecx
push eax
push esi
push ebx
mov ecx, edi
mov dword [esp + 0x20], 0
call fcn.00487e80
test al, al
je 0x4875d7
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi], 0
je 0x4875df
mov byte [edi + 1], 1
pop esi
pop edi
mov al, 1
pop ebx
ret 8
cmp dword [esi + 0x14], 7
jbe 0x4875e7
mov esi, dword [esi]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
test eax, eax
pop edi
sete al
pop ebx
ret 8
pop edi
xor al, al
pop ebx
ret 8
Function at 0x487c30
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccc05
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x66e5c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x487c70
xor al, al
jmp 0x487dc9
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov edx, esi
cmp dword [esi + 0x14], 7
jbe 0x487ca6
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x4c], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x487cc0
sub ecx, dword [ebp - 0x4c]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.0044eec0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push dword [ebp - 0x48]
call fcn.004882c0
mov byte [ebp - 0x41], al
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x487d34
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x487d27
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x487de6
push ecx
push edx
call fcn.004c427d
mov al, byte [ebp - 0x41]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], cx
test al, al
je 0x487d54
cmp byte [edi], cl
je 0x487d8e
mov byte [edi + 1], 1
mov al, 1
mov byte [ebp - 0x41], al
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x487db5
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x487da8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x487deb
jmp 0x487da8
cmp dword [esi + 0x14], 7
jbe 0x487d96
mov esi, dword [esi]
push esi
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x487d54
xor al, al
jmp 0x487d56
push ecx
push edx
call fcn.004c427d
mov al, byte [ebp - 0x41]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c3ed9
mov esp, ebp
pop ebp
ret 8
call fcn.004d85ca
call fcn.004d85ca
int3
Function at 0x4885e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x66e5c0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [esp + 0x228]
lea eax, [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x228]
push 0x208
push 0
push eax
call fcn.004ce740
add esp, 0xc
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x488783
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x234]
or eax, 0x20019
push eax
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x48866a
cmp eax, 2
je 0x488783
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004c3ed9
add esp, 0x21c
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebx + eax*2 - 2], 0x5c
lea edi, [ebx + eax*2]
je 0x48868d
mov eax, 0x5c
mov word [edi], ax
add edi, 2
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x48874e
push esi
lea esi, [esp + 0x20]
sub esi, edi
nop word [eax + eax]
mov edx, 0x208
mov eax, edi
nop word [eax + eax]
lea ecx, [edx + 0x7ffffdf6]
test ecx, ecx
je 0x4886fe
movzx ecx, word [esi + eax]
test cx, cx
je 0x4886fe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4886e0
push dword [esp + 0x238]
lea ecx, [eax - 2]
test edx, edx
push ebx
cmovne ecx, eax
xor eax, eax
push ebp
mov word [ecx], ax
call fcn.004885e0
add esp, 0xc
test eax, eax
je 0x48874d
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4886d0
pop esi
xor eax, eax
mov word [edi - 2], ax
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
pop edi
sbb eax, eax
pop ebp
inc eax
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004c3ed9
add esp, 0x21c
ret
mov ecx, dword [esp + 0x220]
mov eax, 1
pop ebp
pop ebx
xor ecx, esp
call fcn.004c3ed9
add esp, 0x21c
ret
Function at 0x4887c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccc6d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x66e5c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], esi
test ecx, ecx
jne 0x488809
xor al, al
jmp 0x488941
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
xor edx, edx
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], dx
mov dword [ebp - 4], edx
lea edx, [ebp - 0x28]
push edx
push esi
push ecx
mov ecx, eax
call fcn.004882c0
test al, al
je 0x4888a5
cmp byte [ebp + 0x14], 0
je 0x48885f
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.0045f5f0
add esp, 8
test al, al
jne 0x48889c
jmp 0x4888a5
cmp dword [edi + 0x14], 7
mov edx, edi
jbe 0x488869
mov edx, dword [edi]
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
cmp esi, dword [edi + 0x10]
jne 0x4888a2
test esi, esi
je 0x48889c
sub eax, edx
mov dword [ebp - 0x34], eax
movzx ecx, word [eax + edx]
movzx eax, word [edx]
cmp cx, ax
jne 0x4888a2
mov eax, dword [ebp - 0x34]
add edx, 2
sub esi, 1
jne 0x488885
mov byte [ebp - 0x29], 1
jmp 0x4888ed
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp byte [eax], 0
je 0x4888b7
mov byte [eax + 1], 1
mov byte [ebp - 0x29], 1
jmp 0x4888ed
cmp dword [edi + 0x14], 7
mov eax, dword [edi + 0x10]
lea eax, [eax*2 + 2]
jbe 0x4888c9
mov edi, dword [edi]
cmp dword [esi + 0x14], 7
jbe 0x4888d1
mov esi, dword [esi]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 0x29], 1
test eax, eax
je 0x4888ed
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x48892a
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x488920
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48895e
push ecx
push edx
call fcn.004c427d
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, byte [ebp - 0x29]
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c3ed9
mov esp, ebp
pop ebp
ret 0x10
call fcn.004d85ca
int3

Function at 0x48d286
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x48d2ad
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x48d2b0
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0048d262
pop esi
leave
ret 8
Function at 0x4a49cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.004e534e
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x4a4a0b
sub eax, 1
je 0x4a4a06
sub eax, 1
je 0x4a4a02
xor eax, eax
leave
ret
push 3
jmp 0x4a4a0d
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x4b1d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x4b1db4
cmp dword [esi + 0x30], 7
lea eax, [esi + 0x1c]
jbe 0x4b1d84
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4b1db0
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x13
ja case.0x4b1da5.4
movzx eax, byte [eax + 0x4b1dd8]
jmp dword [eax*4 + 0x4b1dd0]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
push 0
push 0x5e
push str.D:_src_rcfl_develop_vendordepends2022PocoFoundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.004a5710
lea eax, [esi + 4]
push eax
call fcn.004b1e00
lodsb al, byte [esi]
sbb eax, 499581003
dec ebx
add byte [eax], al
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add ah, cl
int3
Function at 0x4b1e00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5cfa3d
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x10b
ja 0x4b1fd8
je case.0x4b1e4e.123
lea eax, [esi - 2]
cmp eax, 0xcc
ja case.0x4b1e4e.4
movzx eax, byte [eax + 0x4b2070]
jmp dword [eax*4 + 0x4b2034]
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004a6110
push 0x6667fc
lea eax, [ebp - 0x38]
push eax
call fcn.004ce015
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004a5ff0
push 0x6668d4
lea eax, [ebp - 0x38]
push eax
call fcn.004ce015
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004a60c0
push 0x6667b4
lea eax, [ebp - 0x38]
push eax
call fcn.004ce015
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004a5c80
push 0x66691c
lea eax, [ebp - 0x38]
push eax
call fcn.004ce015
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004a5db0
push 0x6669f4
lea eax, [ebp - 0x38]
push eax
call fcn.004ce015
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004a6860
push 0x666964
lea eax, [ebp - 0x38]
push eax
call fcn.004ce015
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004a6640
push 0x6669ac
lea eax, [ebp - 0x38]
push eax
call fcn.004ce015
push str.sharing_violation
lea ecx, [ebp - 0x24]
call fcn.00458c10
mov dword [ebp - 4], 0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x64]
call fcn.004a6040
push 0x666770
lea eax, [ebp - 0x64]
push eax
call fcn.004ce015
push str.lock_violation
lea ecx, [ebp - 0x24]
call fcn.00458c10
mov dword [ebp - 4], 1
jmp 0x4b1f1f
push str.EOF_reached
lea ecx, [ebp - 0x24]
call fcn.00458c10
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.004a6610
push 0x6669ac
jmp 0x4b1f34
push str.disk_is_full
lea ecx, [ebp - 0x24]
call fcn.00458c10
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x64]
call fcn.004a6830
push 0x666964
jmp 0x4b1f34
push str.negative_seek
lea ecx, [ebp - 0x24]
call fcn.00458c10
mov dword [ebp - 4], 4
jmp 0x4b1f1f
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.004a6550
push 0x6666e8
jmp 0x4b1f34
cmp esi, 0x781
je case.0x4b1e4e.3
cmp esi, 0x1779
je 0x4b2007
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x90]
call fcn.004a6070
push 0x666770
lea eax, [ebp - 0x90]
jmp 0x4b1f37
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.004a6160
push 0x66688c
jmp 0x4b1f34
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.004a6500
push 0x666844
jmp 0x4b1f34