joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfab8
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
or edi, 0xffffffff
mov eax, dword [0x50be4c]
cmp eax, edi
jne 0x4911a6
push ecx
call fcn.0040fe00
add esp, 4
test al, al
je 0x49119a
mov dword [0x50be4c], 1
jmp 0x4911aa
mov dword [0x50be4c], 0
jmp 0x4911bc
test eax, eax
je 0x4911bc
push dword [ebp + 8]
call fcn.004922e0
mov ebx, eax
test ebx, ebx
jne 0x4912d1
mov ebx, dword [ebp + 8]
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x491310
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x42c], eax
push 0x4f6538
push str.Windows
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 1
push str.SoftwareMicrosoft_sCurrentVersion_s
push eax
call fcn.004248c0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a8730
mov esi, dword [ebp - 0x42c]
lea eax, [ebp - 0x424]
add esp, 0x1c
mov dword [ebp - 0x424], 0x104
mov dword [ebp - 0x428], 1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x49125e
mov ebx, 1
jmp 0x4912b6
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004a8730
add esp, 0xc
mov dword [ebp - 0x424], 0x104
lea eax, [ebp - 0x424]
mov dword [ebp - 0x428], 1
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ebx, ebx
cmp word [ebp - 0x420], bx
setne bl
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4912d1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4912f0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00409e30
int3
Function at 0x4925c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfd86
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x228], eax
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x4927ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push 0x4f6538
push str.Windows
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push str.SoftwareMicrosoft_sCurrentVersion_s
push eax
call fcn.004248c0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
add esp, 0xc
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x21c]
lea ecx, [ebp - 0x234]
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00463b10
or ebx, 0xffffffff
test eax, eax
mov eax, dword [ebp - 0x234]
jne 0x4927a6
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x4927f9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x224]
push dword [esi + 8]
push dword [esi]
push str.__s___s
push eax
call fcn.004248c0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a8730
add esp, 0x1c
mov dword [ebp - 0x220], 0x208
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x238]
push eax
push 0
push dword [ebp - 0x228]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49272c
mov eax, dword [ebp - 0x238]
cmp eax, 1
je 0x49271a
cmp eax, 2
jne 0x49272c
cmp dword [ebp - 0x220], 0
jne 0x49272c
xor eax, eax
mov word [ebp - 0x218], ax
mov esi, dword [ebp - 0x224]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.004bcdb3
add esp, 8
test eax, eax
je 0x49277e
test esi, esi
je 0x49277e
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x492750
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp - 0x228]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x492799
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x234]
mov esi, 1
jmp 0x4927a8
xor esi, esi
test eax, eax
je 0x4927b3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4927cf
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00409e30
push 0x80004005
call fcn.00409e30
int3
Function at 0x492810
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfdbd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x50b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [0x520950], 0
jne 0x492856
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x520950
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x4928c0
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x520950
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004099b0
test al, al
jne 0x4928ac
mov ecx, 0x520950
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x492890
sub ecx, edx
sar ecx, 1
push ecx
push 0x520950
mov ecx, esi
call fcn.00409c60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00409e30
int3
Function at 0x4950d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x49516e
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi + 0x30]
mov ecx, edi
push 0
call fcn.004952a0
mov esi, dword [edi + 0xc]
sub esi, 1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
js 0x49514c
nop word [eax + eax]
test esi, esi
js 0x495177
cmp esi, dword [edi + 0xc]
jge 0x495177
mov eax, dword [edi + 8]
mov ebx, dword [eax + esi*4]
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0x103
jne 0x49513e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
sub esi, 1
jns 0x495110
push dword [edi + 0x40]
call ebx
lea esi, [edi + 0x14]
mov dword [edi + 0x40], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi + 0x3c]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x8000000b
call fcn.00409e30
int3
Function at 0x495800
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x83c
mov eax, dword [0x50b0c0]
xor eax, esp
mov dword [esp + 0x838], eax
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4958ee
push 0x800
push eax
mov dword [esp + 0x14], eax
xorps xmm0, xmm0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x40]
push eax
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
mov dword [esp + 0x14], 0x30
mov dword [esp + 0x28], 0x400000
call fcn.004a8730
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4f6640
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.0046c6d0
add esp, 0x10
mov dword [esp + 0x10], 0x495920
lea eax, [esp + 0x38]
mov dword [esp + 0x30], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x20]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x495906
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x83c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret

Function at 0x495b90
Capabilities:
Hash data with md5

Disassembly:
push esi
push edi
mov edi, ecx
push 0x40
push 0
lea esi, [edi + 0x5c]
mov dword [edi], vtable.MD5_CTX.0
push esi
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
call fcn.004a8730
add esp, 0xc
mov byte [esi], 0x80
mov eax, edi
pop edi
pop esi
ret
Function at 0x495cf0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov edi, dword [ebp + 8]
lea edx, [esi + 0x16]
nop dword [eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ebp + eax - 0xc], cl
movzx ecx, byte [edx - 5]
mov byte [ebp + eax - 0xb], cl
movzx ecx, byte [edx - 4]
mov byte [ebp + eax - 0xa], cl
movzx ecx, byte [edx - 3]
mov byte [ebp + eax - 9], cl
add eax, 4
cmp eax, 8
jb 0x495d10
mov edx, dword [esi + 0x14]
lea ebx, [esi + 0x5c]
shr edx, 3
mov ecx, 0x78
and edx, 0x3f
mov eax, 0x38
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
mov ecx, esi
push eax
push ebx
call fcn.00495c10
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00495c10
lea ecx, [edi + 2]
mov edi, 4
lea edx, [esi + 6]
nop dword [eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 2], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 5], al
movzx eax, byte [edx - 4]
mov byte [ecx - 4], al
movzx eax, byte [edx - 3]
mov byte [ecx - 3], al
sub edi, 1
jne 0x495d80
push 0x9c
push edi
push esi
call fcn.004a8730
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 4], 0x67452301
xor ecx, ebp
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
pop edi
mov dword [esi + 0x10], 0x10325476
pop esi
mov byte [ebx], 0x80
pop ebx
call fcn.004a69a0
mov esp, ebp
pop ebp
ret 4
Function at 0x4995b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x4995e7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret 0x14
push ecx
call fcn.0040fe00
add esp, 4
test al, al
je 0x4996ca
push str.runas
xorps xmm0, xmm0
lea eax, [ebp - 0x24]
push 0x10
push eax
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call fcn.004bd337
add esp, 0xc
mov dword [ebp - 0x858], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x848], 0
xorps xmm0, xmm0
mov dword [ebp - 0x854], eax
lea eax, [ebp - 0x860]
movlpd qword [ebp - 0x840], xmm0
push eax
movlpd qword [ebp - 0x838], xmm0
movlpd qword [ebp - 0x830], xmm0
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x860], 0x3c
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x84c], edi
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x85c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4995d2
cmp dword [ebp + 0x10], 0
je 0x4996b9
push dword [ebp + 0x14]
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4997ce
push 0x800
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004a8730
add esp, 0xc
lea eax, [ebp - 0x824]
test edi, edi
je 0x4996fd
push edi
push esi
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x49970d
push esi
push 0x4f1270
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x868], 0x44
mov word [ebp - 0x826], ax
xorps xmm0, xmm0
mov ax, word [ebp + 0x18]
mov word [ebp - 0x838], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x868]
movlpd qword [ebp - 0x864], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x824]
movlpd qword [ebp - 0x85c], xmm0
push eax
push 0
movlpd qword [ebp - 0x854], xmm0
movlpd qword [ebp - 0x84c], xmm0
movlpd qword [ebp - 0x844], xmm0
movlpd qword [ebp - 0x836], xmm0
movlpd qword [ebp - 0x82e], xmm0
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x83c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4995d2
cmp dword [ebp + 0x10], 0
je 0x4997be
push dword [ebp + 0x14]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69a0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x49b960
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
mov esi, ecx
jne 0x49bae5
mov eax, dword [ebp + 0xc]
mov ebx, 1
cmp eax, 0x464
jne 0x49b9e5
cmp dword [ebp + 0x14], 0xa
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x48], eax
jne 0x49bad4
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x49b9b2
push ecx
mov dword [esp], 0x3f800000
call fcn.00425030
call fcn.0049b820
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0xa
push 0x3ea
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp + 0x18]
mov eax, ebx
pop esi
pop ebx
mov dword [ecx], 0
pop ebp
ret 0x18
cmp eax, 0x113
jne 0x49bae5
mov eax, dword [ebp + 0x10]
cmp eax, 0x3e9
jne 0x49baab
mov ecx, dword [esi + 0x50]
push edi
mov eax, dword [ecx]
call dword [eax + 0x6c]
mov edi, dword [esi + 0x4c]
mov ecx, 0xa
movsd xmm3, qword [0x4e2b90]
mov edx, dword [esi + 0x48]
movd xmm2, eax
movd xmm0, edi
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm2, xmm2
divsd xmm0, xmm2
mulsd xmm0, xmm3
cvttsd2si eax, xmm0
sub edx, eax
cmp edx, ecx
jle 0x49ba43
mov ecx, 4
jmp 0x49ba5d
cmp edx, 5
jle 0x49ba4f
mov ecx, 3
jmp 0x49ba5d
test edx, edx
jle 0x49ba5a
mov ecx, 2
jmp 0x49ba5d
cmovs ecx, ebx
lea eax, [edi + ecx]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov dword [esi + 0x4c], eax
pop edi
divsd xmm1, xmm2
movaps xmm0, xmm1
mulsd xmm0, xmm3
cvttsd2si eax, xmm0
cmp eax, 0x64
jle 0x49ba88
movsd xmm1, qword [0x4f6950]
cvtpd2ps xmm0, xmm1
push ecx
mov ecx, dword [esi + 0x50]
movss dword [esp], xmm0
call fcn.00425030
mov ecx, dword [ebp + 0x18]
mov eax, ebx
pop esi
pop ebx
mov dword [ecx], 0
pop ebp
ret 0x18
cmp eax, 0x3ea
jne 0x49bad4
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0049b7a0
mov ecx, eax
call fcn.004599d0
call fcn.0049b820
mov ecx, eax
call fcn.0049cc90
mov ecx, dword [ebp + 0x18]
mov eax, ebx
pop esi
pop ebx
mov dword [ecx], 0
pop ebp
ret 0x18
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18
Function at 0x49ca80
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0ac7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x50b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 0x10], 1
jne 0x49cc35
mov esi, dword [ebp + 0xc]
cmp esi, 1
jne 0x49cc01
push 0x6b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, eax
mov eax, dword [ebp - 0x14]
push edi
add eax, 4
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x80
push dword [eax]
mov dword [ebp + 0x1c], eax
call esi
mov eax, dword [ebp + 0x1c]
push edi
push 0
push 0x80
push dword [eax]
call esi
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
add esi, 0xffffffcc
push dword [ebp + 0x10]
mov ecx, esi
push 1
call fcn.004119d0
sub esp, 0x10
xorps xmm0, xmm0
mov eax, esp
mov ecx, esi
movups xmmword [eax], xmm0
call fcn.00412ad0
push 0x168
call fcn.004a6623
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x49cb54
mov ecx, eax
call fcn.0041a090
mov edi, eax
jmp 0x49cb56
xor edi, edi
mov dword [ebp - 4], 0xffffffff
cmp dword [esi + 0x118], edi
je 0x49cb85
test edi, edi
je 0x49cb6f
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov eax, dword [esi + 0x118]
mov dword [esi + 0x118], edi
test eax, eax
je 0x49cb85
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0x118]
push esi
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x118]
push 4
call fcn.0040bc80
mov ecx, dword [esi + 0x118]
push 2
call fcn.0040bca0
push 0
mov ecx, esi
call fcn.0049cf30
mov ecx, dword [ebp + 0x1c]
push 0
call fcn.00415070
cmp dword [ebp - 0x10], 0
mov esi, dword [ebp + 0x18]
mov dword [esi], 0
jne 0x49cc1d
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x14]
push 0
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call fcn.0040ffc0
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp esi, 2
jne 0x49cbd0
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
je 0x49cbd3
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x49d440
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0c0b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0xc8]
call eax
mov dword [ebp - 0x248], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x244], 0
push eax
push 0x11
movups xmmword [ebp - 0x240], xmm0
push 0
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x238], 0x51
mov dword [ebp - 0x23c], 0x4e2fc4
mov dword [ebp - 0x21c], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
mov ecx, dword [ebp - 0x244]
test eax, eax
lea eax, [ebp - 0x248]
cmovns ecx, dword [ebp - 0x21c]
push eax
mov dword [ebp - 0x244], ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x49d5ae
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x49d5ae
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00409d80
mov eax, dword [ebp - 0x220]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x24c], esp
mov esi, esp
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x228], esi
call fcn.00409760
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [ebp - 4], 1
call fcn.0049b7a0
mov byte [ebp - 4], 0
lea ecx, [eax + 4]
call fcn.0045f960
push ecx
push esp
call fcn.0049b7a0
lea ecx, [eax + 4]
call fcn.0045f590
mov ecx, dword [ebp - 0x224]
mov ecx, dword [ecx + 0x18c]
call fcn.00427ea0
mov edx, dword [ebp - 0x220]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49d5ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x49d5bf
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1130
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x210], 0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x218]
push edi
push edx
mov edi, dword [eax + 4]
or edi, 0x2001f
mov dword [ebp - 0x220], eax
push edi
push 0
push ecx
push dword [eax]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0x210]
test esi, esi
jne 0x4a1291
xor esi, esi
test eax, eax
je 0x4a11bc
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x218]
and edi, 0x300
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], edi
test esi, esi
jne 0x4a1291
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x228]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], 0x100
push ecx
lea ecx, [ebp - 0x204]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x4a1257
nop dword [eax]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x210]
call fcn.004a1130
mov esi, eax
test esi, esi
jne 0x4a128b
lea eax, [ebp - 0x228]
mov dword [ebp - 0x214], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x210]
call edi
test eax, eax
je 0x4a1210
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4a126e
push eax
call ebx
mov dword [ebp - 0x210], 0
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x20c], 0
call fcn.0046c5f0
mov esi, eax
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4a1298
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69a0
mov esp, ebp
pop ebp
ret 4