joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f7d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
push 0
mov ecx, dword [ebp - 4]
call fcn.00442ad0
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3ac]
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CListHeaderUI____thiscall_DuiLib::CVListUI::GetHeader_void_const]
mov ecx, eax
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CListHeaderUI::SetSortColumn_int_]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x3c4]
or edx, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c4], edx
mov ecx, dword [ebp - 4]
call fcn.00442580
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x3b8]
call fcn.00433bb0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x3ac]
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CListHeaderUI____thiscall_DuiLib::CVListUI::GetHeader_void_const]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43f863
mov ecx, dword [ebp - 8]
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CListHeaderUI::GetSortColumn_void_]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3dc], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CListHeaderUI::IsSortAsc_void_]
mov edx, dword [ebp - 4]
mov dword [edx + 0x3e0], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x43f7a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43f88d
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4
Function at 0x4476b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3ac]
call fcn.00433bb0
push 0
mov ecx, dword [ebp - 4]
call fcn.00445560
mov ecx, dword [ebp - 4]
call fcn.00445310
mov dword [ebp - 8], 0
jmp 0x4476ec
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 2
jae 0x447799
imul edx, dword [ebp - 8], 0x30
mov eax, dword [ebp - 4]
lea ecx, [eax + edx + 0x3b4]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00449630
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00449740
push eax
mov ecx, dword [ebp - 4]
call fcn.00445670
imul eax, dword [ebp - 8], 0x30
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + eax + 0x3b4]
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CListHeaderUI____thiscall_DuiLib::CVListUI::GetHeader_void_const]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x447794
push 1
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CListHeaderUI::SetSortColumn_int_]
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CListHeaderUI::GetSortColumn_void_]
imul edx, dword [ebp - 8], 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + edx + 0x41c], eax
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CListHeaderUI::IsSortAsc_void_]
imul edx, dword [ebp - 8], 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + edx + 0x420], eax
imul edx, dword [ebp - 8], 0x30
imul eax, dword [ebp - 8], 0x18
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 4]
mov edx, dword [esi + edx + 0x3c4]
mov dword [ecx + eax + 0x414], edx
jmp 0x4476e3
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x447680
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4477c3
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44a540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
push 0x517edc
mov eax, dword [ebp + 8]
push eax
call fcn.004dd95f
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44a56e
xor eax, eax
jmp 0x44a605
mov ecx, dword [ebp - 8]
push ecx
push 3
push 1
lea edx, [ebp - 4]
push edx
call fcn.004de262
add esp, 0x10
cmp eax, 3
je 0x44a597
mov eax, dword [ebp - 8]
push eax
call fcn.004ddc7c
add esp, 4
xor eax, eax
jmp 0x44a605
push 3
push 0x517ee4
lea ecx, [ebp - 4]
push ecx
call fcn.004d4ed4
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44a5c3
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.004de5cc
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0x44a520
call dword [sym.imp.jansson.dll_json_load_callback]
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
call fcn.004ddc7c
add esp, 4
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x44a5fb
mov dword [ebp - 0xc], 1
jmp 0x44a602
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x469760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe0bb
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x220]
call fcn.004050b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.00403ae0
mov dword [ebp - 0x238], eax
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.004d43c0
add esp, 0xc
mov dword [ebp - 0x23c], 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
test eax, eax
jne 0x469809
mov dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0
je 0x469946
push 0
mov eax, dword [ebp - 0x228]
push eax
lea ecx, [ebp - 0x220]
call fcn.0041f810
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffff
jle 0x469946
lea ecx, [ebp - 0x220]
push ecx
call fcn.00469980
add esp, 4
movzx edx, al
test edx, edx
jne 0x469946
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
add ecx, 2
mov dword [ebp - 0x244], ecx
mov edx, dword [ebp - 0x224]
mov ax, word [edx]
mov word [ebp - 0x22a], ax
add dword [ebp - 0x224], 2
cmp word [ebp - 0x22a], 0
jne 0x469872
mov ecx, dword [ebp - 0x224]
sub ecx, dword [ebp - 0x244]
sar ecx, 1
mov dword [ebp - 0x248], ecx
mov edx, dword [ebp - 0x248]
push edx
push 0x5c
lea ecx, [ebp - 0x220]
call fcn.004510b0
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x219], 0
cmp dword [ebp - 0x230], 0
jle 0x469920
mov eax, dword [ebp - 0x230]
add eax, 1
cmp dword [ebp - 0x238], eax
jle 0x469920
mov ecx, dword [ebp - 0x230]
add ecx, 1
push ecx
push 0x5c
lea ecx, [ebp - 0x220]
call fcn.004510b0
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jle 0x469919
mov edx, dword [ebp - 0x234]
add edx, 1
cmp dword [ebp - 0x238], edx
jg 0x469920
mov byte [ebp - 0x219], 1
mov al, byte [ebp - 0x219]
mov byte [ebp - 0x21a], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.004036f0
mov al, byte [ebp - 0x21a]
jmp 0x469965
mov byte [ebp - 0x21b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.004036f0
mov al, byte [ebp - 0x21b]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret
Function at 0x46a050
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x51b1b8]
mov dword [ebp - 0xc], eax
mov cx, word [0x51b1bc]
mov word [ebp - 8], cx
mov edx, dword [ebp + 8]
add edx, 0x41
mov eax, 2
imul ecx, eax, 0
mov word [ebp + ecx - 0xc], dx
push 0x400
lea edx, [ebp - 0x80c]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x46a0a7
xor eax, eax
jmp 0x46a0dd
push 0xe
push 0x51b1c0
lea ecx, [ebp - 0x80c]
push ecx
call fcn.004de740
add esp, 0xc
test eax, eax
jne 0x46a0cd
mov dword [ebp - 0x810], 1
jmp 0x46a0d7
mov dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret
Function at 0x46ce60
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c0], ecx
lea eax, [ebp - 0x2bc]
push eax
push 0x11
mov ecx, dword [ebp - 0x2c0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jl 0x46cf03
push 0x2b4
push 0
lea eax, [ebp - 0x2b8]
push eax
call fcn.004d43c0
add esp, 0xc
push 0x4009
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
mov edx, dword [ebp - 0x2bc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
push eax
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
add ecx, 0xe0c
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::ITreeInfo::SetImageList_struct__IMAGELIST__]
mov edx, dword [ebp - 0x2bc]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret 4

Function at 0x46cf20
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2bc], 0
lea eax, [ebp - 0x2bc]
push eax
push 0x24
mov ecx, dword [ebp - 0x2c0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x46cf9d
push 0x4008
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov ecx, dword [ebp - 0x2bc]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x46cf90
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2b4]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x2bc]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret 4
Function at 0x4792e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
xor eax, eax
jne 0x4792e9
cmp dword [ebp + 0xc], 0
je 0x4792fc
mov dword [ebp - 0xc], 1
jmp 0x479303
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x479316
mov eax, 0xd
jmp 0x47936b
xor edx, edx
jne 0x4792ed
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
mov ax, word [edx]
mov word [ebp - 2], ax
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x479329
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x482bf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004d43c0
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x220], edx
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x21c], 0
jmp 0x482c7d
mov ecx, dword [ebp - 0x21c]
add ecx, 1
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0x21c]
cmp edx, dword [ebp - 0x228]
jae 0x482d05
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea ecx, [ebp - 0x230]
call fcn.00473ab0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x482cee
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x224]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x224]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edx + 0x2c]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00473a60
jmp 0x482c6e
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.SHELL32.dll_DragFinish]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x48e280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x108]
cmp edx, dword [ecx + 0xad8]
jne 0x48e37f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xad8]
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CTabLayoutUI::GetCurSel_void_const]
cmp eax, 1
jne 0x48e353
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xae4], 0
je 0x48e2f0
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xae8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xae4]
push edx
push 0
push 0
call fcn.004dd348
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xaec], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xaec], 0
jne 0x48e311
push 1
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xad8]
call dword [sym.imp.DuiLib.dll_public:_bool___thiscall_DuiLib::CTabLayoutUI::SelectItem_int__bool_]
jmp 0x48e37f
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0xadc]
call fcn.0048f070
push 0
push 0x64
push 0x12c
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004313d0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xae0]
mov ecx, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ecx + 0xae0]
mov eax, dword [edx + 0xd8]
call eax
jmp 0x48e37f
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0xadc]
call fcn.0048f020
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xae0]
mov ecx, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ecx + 0xae0]
mov eax, dword [edx + 0xd8]
call eax
mov esp, ebp
pop ebp
ret 4

Function at 0x492a50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.004929c0
test eax, eax
je 0x492a6f
mov eax, 1
jmp 0x492b10
push 1
mov ecx, dword [ebp - 4]
call fcn.00492cb0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
cmp dword [ebp - 8], 0
jne 0x492aa7
push 1
mov ecx, dword [ebp - 4]
call fcn.00492cb0
xor eax, eax
jmp 0x492b10
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
cmp dword [ebp - 0xc], 0
jne 0x492ad5
push 1
mov ecx, dword [ebp - 4]
call fcn.00492cb0
xor eax, eax
jmp 0x492b10
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x492a00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
cmp dword [ebp - 0x10], 0
jne 0x492b0b
push 1
mov ecx, dword [ebp - 4]
call fcn.00492cb0
xor eax, eax
jmp 0x492b10
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x492cb0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x492d0b
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x492ce5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x492cf6
push 0xdeaddead
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x492d2b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x492d4b
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
cmp dword [ebp + 8], 0
je 0x492d59
mov ecx, dword [ebp - 4]
call fcn.00492c20
mov esp, ebp
pop ebp
ret 4

Function at 0x4933b0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x804], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x802]
push ecx
call fcn.004d43c0
add esp, 0xc
mov dword [ebp - 0x808], 0
push 0x400
lea edx, [ebp - 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x493406
jmp 0x493440
push 0x5c
lea eax, [ebp - 0x804]
push eax
call fcn.0040d340
add esp, 8
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
jne 0x493428
jmp 0x493440
xor ecx, ecx
mov edx, dword [ebp - 0x808]
mov word [edx], cx
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret
Function at 0x493480
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.selfprot.dll_disable_msg_inject]
call fcn.00493450
call fcn.004933b0
mov ecx, 0x55add0
call fcn.0049ebf0
test eax, eax
jne 0x4934ab
xor eax, eax
jmp 0x4935b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4934f3
push 0
push 0x51dcc0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x4934e2
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
jmp 0x4935b1
push str.SeDebugPrivilege
call fcn.00492e80
add esp, 4
test eax, eax
jne 0x49350b
xor eax, eax
jmp 0x4935b1
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x49352f
or eax, 0xffffffff
jmp 0x4935b1
push str..ACP
push 0
call fcn.004dec01
add esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.004935c0
add esp, 4
push str.HRConfig.ui
push str.HRConfigUI
mov eax, dword [ebp + 8]
push eax
call fcn.004931e0
add esp, 0xc
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov ecx, 0x55add0
call fcn.0049ea50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x4935a9
mov edx, dword [ebp + 0x10]
push edx
mov ecx, 0x55add0
call fcn.0049eaf0
mov ecx, 0x55add0
call fcn.0049ec20
mov ecx, 0x55add0
call fcn.0049eac0
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4935f0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9688
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x550070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea ecx, [ebp - 0x28]
call fcn.004057b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x104
xor eax, eax
mov word [ebp - 0x10], ax
push 0x20119
push 0x525d60
push reloc.upgrade.dll_Ordinal_1
lea ecx, [ebp - 0x28]
call fcn.004056a0
test eax, eax
jne 0x4936a0
lea ecx, [ebp - 0x14]
push ecx
push 0x104
mov ecx, dword [ebp + 8]
call fcn.00405e80
push eax
push 0x52b594
lea ecx, [ebp - 0x28]
call fcn.00405540
test eax, eax
jne 0x493696
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.004054f0
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405790
mov eax, dword [ebp - 0x18]
jmp 0x493709
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.004054f0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [ebp - 0x10], ax
movzx edx, word [ebp - 0x10]
and edx, 0x3ff
cmp edx, 4
jne 0x4936e3
movzx eax, word [ebp - 0x10]
sar eax, 0xa
cmp eax, 2
jne 0x4936d4
push str.zh_CN
mov ecx, dword [ebp + 8]
call fcn.00406270
jmp 0x4936e1
push str.zh_TW
mov ecx, dword [ebp + 8]
call fcn.00406270
jmp 0x4936f0
push 0x52b5c0
mov ecx, dword [ebp + 8]
call fcn.00406270
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405790
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x493750
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x550070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4937b6
jmp 0x4937d5
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4937d1
mov dword [ebp - 0x14], 0
xor ecx, ecx
jne 0x49378d
cmp dword [ebp - 0x10], 0
je 0x4937ec
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d181f
mov esp, ebp
pop ebp
ret