joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e223b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebx], esi
je 0x4e2308
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 7
mov dword [ebx + 4], eax
jne 0x4e2308
mov eax, dword [ebp - 4]
xor ecx, ecx
push edi
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f3b58
mov edi, eax
pop ecx
test edi, edi
je 0x4e229a
xor eax, eax
mov word [edi], ax
jmp 0x4e229c
mov edi, esi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x4e22fc
push edi
call fcn.004f353f
mov ebx, eax
mov eax, edi
pop ecx
push eax
lea ecx, [ebp + 8]
call fcn.004c6681
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
call fcn.004e6720
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004c77e2
inc ebx
add esi, ebx
lea eax, [edi + esi*2]
push eax
call fcn.004f353f
mov ebx, eax
lea eax, [edi + esi*2]
pop ecx
test ebx, ebx
jg 0x4e22c3
xor esi, esi
inc esi
test edi, edi
je 0x4e2307
push edi
call fcn.004f3b61
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4e2312
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [edi], ebx
cmp dword [esi], ebx
je 0x4e23ab
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 4], eax
test eax, eax
jne 0x4e23ab
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], bl
push eax
push dword [ebp - 4]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.004e40f7
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.004dc536
lea ecx, [ebp - 0x20]
call fcn.0048f410
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 4], eax
test eax, eax
jne 0x4e23ab
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x14]
push dword [ebp + 0x10]
mov dword [edi], eax
call fcn.0048f2a0
inc ebx
lea ecx, [ebp - 0x14]
call fcn.0048f410
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e2a37
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x57a120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x254], 0
push ebx
push esi
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp + 0x18]
push 0x24c
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x250]
push 0
push eax
mov dword [ebp - 0x268], edi
call fcn.004f3a90
add esp, 0xc
lea ecx, [ebp - 0x260]
push edi
call fcn.004c6681
call fcn.004c5a90
push eax
lea ecx, [ebp - 0x258]
call fcn.004c65c1
push 0x54f8dc
mov esi, 0x104
lea ecx, [ebp - 0x260]
push esi
call fcn.004c7772
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x260]
call fcn.004cd175
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4e2b23
mov esi, dword [ebp - 0x258]
lea ecx, [esi - 0x10]
call fcn.004c77e2
mov ecx, dword [ebp - 0x260]
lea ecx, [ecx - 0x10]
call fcn.004c77e2
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f3b66
mov esp, ebp
pop ebp
ret
mov esi, 0x104
push edi
lea ecx, [ebp - 0x258]
call fcn.004c791f
lea eax, [ebp - 0x228]
push eax
push esi
lea ecx, [ebp - 0x258]
call fcn.004c7772
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x258]
call fcn.004cd175
push dword [ebp - 0x264]
lea ecx, [ebp - 0x25c]
call fcn.004c6681
lea eax, [ebp - 0x228]
push eax
push esi
lea ecx, [ebp - 0x25c]
call fcn.004c7772
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x25c]
call fcn.004cd175
test byte [ebp - 0x254], 0x10
mov esi, dword [ebp - 0x258]
mov edi, dword [ebp - 0x25c]
je 0x4e2c20
lea eax, [ebp - 0x228]
push 0x5631a0
push eax
call fcn.004f3501
pop ecx
pop ecx
test eax, eax
je 0x4e2be2
lea eax, [ebp - 0x228]
push 0x5631a4
push eax
call fcn.004f3501
pop ecx
pop ecx
test eax, eax
je 0x4e2be2
mov eax, dword [ebp - 0x254]
mov ecx, 0x410
and eax, ecx
cmp eax, ecx
jne 0x4e2bed
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
jmp 0x4e2c3b
cmp dword [ebp + 0x10], 0
je 0x4e2c38
push edi
call fcn.004dd59b
pop ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4e2c38
push dword [ebp - 0x270]
push dword [ebp - 0x26c]
push dword [ebp + 0x10]
push edi
push esi
call fcn.004e2a37
add esp, 0x14
jmp 0x4e2c38
push 3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4e2c38
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [edi - 0x10]
call fcn.004c77e2
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [ebp - 0x268]
test eax, eax
jne 0x4e2b1e
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4e2af5
Function at 0x4e2c68
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x54]
push 0x40
push edi
push eax
mov ebx, edi
call fcn.004f3a90
add esp, 0xc
mov dword [ebp - 0x58], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 1
movdqu xmmword [ebp - 0x14], xmm0
call fcn.004c5a90
push eax
lea ecx, [ebp - 4]
call fcn.004c65c1
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push 0x54f270
push eax
call fcn.004c6f31
add esp, 0x10
cmp dword [ebp + 0x14], ebx
je 0x4e2cc9
push 0xa
pop eax
jmp 0x4e2ccb
xor eax, eax
mov esi, dword [ebp - 4]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4e2d13
cmp dword [ebp + 0x10], ebx
je 0x4e2d10
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4e2d10
cmp dword [ebp + 0x18], ebx
je 0x4e2d10
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x14], edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4e2d27
push dword [ebp - 0x14]
call edi
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
je 0x4e2d36
push dword [ebp - 0x10]
call edi
and dword [ebp - 0x10], 0
lea ecx, [esi - 0x10]
call fcn.004c77e2
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e44b8
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x57a120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x258]
push ebx
push esi
push edi
push eax
xor edi, edi
call fcn.004c6681
push 0x563188
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004dca78
add esp, 0xc
lea ecx, [ebp - 0x254]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x270]
mov ebx, eax
add ecx, 0xfffffff0
mov dword [ebp - 0x25c], ebx
call fcn.004c77e2
cmp ebx, 0xffffffff
jne 0x4e452a
inc edi
jmp 0x4e4675
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
test byte [ebp - 0x254], 0x10
lea eax, [ebp - 0x228]
je 0x4e45e6
push 0x5631a0
push eax
call ebx
test eax, eax
je 0x4e464b
push 0x5631a4
lea eax, [ebp - 0x228]
push eax
call ebx
test eax, eax
je 0x4e464b
push str.Config
lea eax, [ebp - 0x228]
push eax
call ebx
test eax, eax
je 0x4e464b
push 0x561a58
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.004dca78
add esp, 0xc
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004dca78
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call fcn.004e44b8
mov ecx, dword [ebp - 0x260]
add esp, 0x18
add ecx, 0xfffffff0
mov esi, eax
call fcn.004c77e2
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.004c77e2
test esi, esi
je 0x4e4669
jmp 0x4e464b
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.004dca78
add esp, 0xc
push 0x80
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.004c77e2
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.004dca78
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x268]
lea ecx, [ecx - 0x10]
call fcn.004c77e2
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4e4530
xor edi, edi
inc edi
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x258]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esi - 0x10]
call fcn.004c77e2
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f3b66
mov esp, ebp
pop ebp
ret
Function at 0x4e612c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x57a120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
xor ebx, ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x4e61b4
push 0x110
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.004f3a90
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4e61ae
cmp dword [ebp - 0x114], 6
jne 0x4e61ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4e61f2
mov dword [edi], ebx
xor eax, eax
jmp 0x4e61f2
mov ecx, dword [ebp - 0x120]
mov eax, ebx
push esi
mov esi, 0x490
cmp dword [ebp - 0x11c], eax
jbe 0x4e61e9
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x4e61df
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x11c]
jb 0x4e61cd
jmp 0x4e61e9
imul eax, eax, 0xc
mov esi, ebx
mov eax, dword [eax + ecx]
mov dword [edi], eax
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004f3b66
mov esp, ebp
pop ebp
ret

Function at 0x4e6202
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x57a120]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4e6222
or eax, 0xffffffff
jmp 0x4e627b
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004f3a90
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4e6265
cmp dword [ebp - 0x114], 5
jne 0x4e6265
cmp dword [ebp - 0x110], 0
je 0x4e6270
push esi
call fcn.004e65b2
pop ecx
test eax, eax
je 0x4e6279
push esi
call fcn.004e63c9
pop ecx
jmp 0x4e627b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f3b66
mov esp, ebp
pop ebp
ret
Function at 0x4e63c9
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x57a120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0x238], eax
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4e6403
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4e64cb
push esi
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x234], ebx
push ebx
push eax
mov esi, 0x490
call fcn.004f3a90
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4e647f
lea eax, [ebp - 0x20c]
push str.explorer.exe
push eax
call fcn.004f5a84
pop ecx
pop ecx
test eax, eax
je 0x4e646f
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4e6445
jmp 0x4e6483
mov eax, dword [ebp - 0x228]
xor esi, esi
mov dword [ebp - 0x234], eax
jmp 0x4e6483
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x234]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4e64a7
call ebx
jmp 0x4e64ca
push dword [ebp - 0x238]
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4e64c1
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004f3b66
mov esp, ebp
pop ebp
ret

Function at 0x4e6d7a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4e6da5
xor eax, eax
jmp 0x4e6dc0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
push edi
cmove esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x4e6dc6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x57a120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov ebx, ecx
lea edi, [ebp - 0xeb]
xor ecx, ecx
mov byte [ebp - 0xec], cl
stosd dword es:[edi], eax
push 0xc6
push ecx
mov dword [ebp - 0xd8], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xd0], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push eax
call fcn.004f3a90
add esp, 0xc
lea ecx, [ebx + 0x14]
push esi
call fcn.004c791f
mov ecx, ebx
call fcn.004e6d0b
xor edi, edi
lea eax, [ebp - 0xec]
inc edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push edi
lea eax, [ebp - 0xec]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0xec]
mov dword [ebp - 0xd8], 0xc
mov dword [ebp - 0xd4], eax
lea eax, [ebx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0xcc]
push str.Global74062311_19C1_4F50_82B0_5339ABB259F7__d
push eax
call fcn.004fbc06
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
lea eax, [ebp - 0xcc]
add esp, 0xc
push eax
push edi
push edi
lea eax, [ebp - 0xd8]
push eax
call esi
push 0
push 0
push edi
xor edi, edi
mov dword [ebx + 8], eax
push edi
call esi
mov dword [ebx + 0xc], eax
cmp dword [ebx + 8], edi
je 0x4e6ee5
test eax, eax
je 0x4e6ee5
push edi
push edi
push ebx
push 0x4e6efd
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [ebx + 0x10], eax
test eax, eax
setne cl
mov eax, ecx
jmp 0x4e6ee7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f3b66
mov esp, ebp
pop ebp
ret 4

Function at 0x4e6f0c
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop ebp
ret 8

Function at 0x4e70de
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x4e7116
push dword [esi + 4]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.004fca24
push dword [esi + 4]
push 2
push 1
push 0x563030
call fcn.004fca24
push dword [esi + 4]
call fcn.004fc78e
add esp, 0x24
pop esi
pop ebp
ret 8
Function at 0x4e78fb
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0
mov dword [esi], vtable.TTUninstall.0
je 0x4e7928
push 0x3e8
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4e7928
push 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x48]
push 0x10
pop edi
sub ecx, edi
call fcn.004c77e2
mov ecx, dword [esi + 0x40]
sub ecx, edi
call fcn.004c77e2
mov ecx, dword [esi + 0x3c]
sub ecx, edi
call fcn.004c77e2
mov ecx, dword [esi + 0x38]
sub ecx, edi
call fcn.004c77e2
lea ecx, [esi + 0x2c]
call fcn.004e9798
mov ecx, dword [esi + 0x28]
sub ecx, edi
call fcn.004c77e2
mov ecx, dword [esi + 0x24]
sub ecx, edi
call fcn.004c77e2
mov ecx, dword [esi + 0xc]
sub ecx, edi
call fcn.004c77e2
mov ecx, dword [esi + 8]
sub ecx, edi
pop edi
pop esi
jmp fcn.004c77e2
Function at 0x4e7d8e
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x57a120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
call fcn.004de1dd
pop ecx
call fcn.004c5a90
push eax
lea ecx, [ebp - 0x24c]
call fcn.004c65c1
mov eax, dword [esi + 8]
sub eax, 0x10
push eax
call fcn.004c69bb
add eax, 0x10
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x248]
push eax
call fcn.004e20f3
mov eax, dword [ebp - 0x248]
xor edi, edi
pop ecx
inc edi
pop ecx
cmp dword [eax - 0xc], ebx
je 0x4e7ed4
add eax, 0xfffffff0
push eax
call fcn.004c69bb
add eax, 0x10
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x240]
push eax
call fcn.004e20f3
pop ecx
pop ecx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x24c]
call fcn.004c66f6
mov esi, 0x54f42c
lea ecx, [ebp - 0x240]
push esi
call fcn.004c67ff
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.004f3a90
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x244]
call fcn.004c6681
lea eax, [ebp - 0x244]
push eax
call fcn.004e20f3
pop ecx
push esi
lea ecx, [ebp - 0x244]
call fcn.004c67ff
push dword [ebp - 0x244]
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, dword [ebp - 0x24c]
push edi
push edi
push esi
call fcn.004ddc3c
mov ecx, dword [ebp - 0x244]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.004c77e2
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
call fcn.004c77e2
jmp 0x4e7eda
mov esi, dword [ebp - 0x24c]
xor eax, eax
mov dword [ebp - 0x210], 7
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x224]
push eax
mov dword [ebp - 0x214], ebx
call fcn.004df08f
lea eax, [ebp - 0x224]
mov dword [esp], str.CEF
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.004d9e85
cmp dword [ebp - 0x228], 8
lea eax, [ebp - 0x23c]
push edi
cmovae eax, dword [ebp - 0x23c]
push edi
push eax
call fcn.004ddbee
add esp, 0x18
cmp dword [ebp + 8], ebx
je 0x4e7f5c
cmp dword [ebp - 0x210], 8
lea eax, [ebp - 0x224]
push edi
cmovae eax, dword [ebp - 0x224]
push edi
push eax
call fcn.004ddbee
add esp, 0xc
push edi
call fcn.004de1dd
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x23c]
call fcn.00406930
push ebx
push edi
lea ecx, [ebp - 0x224]
call fcn.00406930
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.004c77e2
lea ecx, [esi - 0x10]
call fcn.004c77e2
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f3b66
mov esp, ebp
pop ebp
ret 4
Function at 0x4e7fa8
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x57a120]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
xor eax, eax
push ebx
push esi
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push edi
push eax
mov dword [ebp - 8], 7
call fcn.004df08f
lea eax, [ebp - 0x1c]
push eax
call fcn.004e2128
mov esi, str.uninstall_file.json
push esi
call fcn.004f353f
add esp, 0xc
lea ecx, [ebp - 0x1c]
push eax
push esi
call fcn.0040d7d0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push ecx
cmovae eax, dword [ebp - 0x1c]
push ecx
mov ecx, esp
push eax
call fcn.00405460
lea ecx, [ebp - 0x4c]
call fcn.0040ea10
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e80db
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00419710
push 0
push 0
lea ecx, [ebp - 0x70]
call fcn.004198e0
mov esi, eax
test esi, esi
je 0x4e80d1
mov edi, dword [esi + 0xc]
xor ebx, ebx
sub edi, dword [esi + 8]
sar edi, 2
test edi, edi
jle 0x4e80b4
and dword [ebp - 0x24], 0
xor eax, eax
mov word [ebp - 0x34], ax
mov ecx, esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x20], 7
push eax
push ebx
call fcn.00414b50
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e80a3
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00406930
inc ebx
cmp ebx, edi
jl 0x4e805e
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
inc esi
lea ecx, [ebp - 0x70]
call fcn.004197b0
jmp 0x4e80de
xor esi, esi
inc esi
lea ecx, [ebp - 0x4c]
call fcn.0040ea90
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00406930
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f3b66
mov esp, ebp
pop ebp
ret
Function at 0x4e8105
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x57a120]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
xor eax, eax
push ebx
push esi
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push edi
push eax
mov dword [ebp - 8], 7
call fcn.004df025
lea eax, [ebp - 0x1c]
push eax
call fcn.004e2128
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
pop ecx
cmovae eax, dword [ebp - 0x1c]
pop ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.004c6681
push 0x54f3d8
push 0x561a58
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004dca78
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004dca78
mov ecx, dword [ebp - 0x28]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.004c77e2
lea eax, [ebp - 0x20]
push eax
call fcn.004e20f3
pop ecx
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [ebp - 0x24]
xor ebx, ebx
inc ebx
test eax, eax
je 0x4e81c7
push ebx
push ebx
push dword [ebp - 0x20]
call fcn.004ddc3c
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
je 0x4e81c3
push ebx
push ebx
push esi
call fcn.004ddc3c
add esp, 0xc
mov edi, ebx
jmp 0x4e81c9
xor edi, edi
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.004c77e2
lea ecx, [esi - 0x10]
call fcn.004c77e2
push 0
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00406930
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f3b66
mov esp, ebp
pop ebp
ret