joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ccea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push edi
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x10c], 0
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + eax - 0x108]
mov dword [ebp - 4], ecx
jmp 0x47cd4a
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x10c], edx
cmp dword [ebp - 0x10c], 2
jae 0x47ce01
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax*8 + 0x53e2e8]
push ecx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x108]
sub edx, eax
mov ecx, 0x104
sub ecx, edx
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00415480
lea eax, [ebp - 0x108]
push eax
call fcn.0042f17a
add esp, 4
test eax, eax
je 0x47cdfc
push 0
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.0042e663
add esp, 0xc
test eax, eax
je 0x47cdfc
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0048cca6
add esp, 8
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx*8 + 0x53e2ec]
push eax
lea ecx, [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x47cdfc
mov edx, dword [ebp + 0xc]
push edx
push 0x78
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call dword [ebp + 8]
jmp 0x47cd3b
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x47d13f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d8
push edi
mov dword [ebp - 0x4d8], ecx
mov byte [ebp - 0x118], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x4c8], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x4c7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x14], 0x53e3a0
mov dword [ebp - 0x10], 0x53e3b0
mov dword [ebp - 0xc], 0x53e3c0
mov dword [ebp - 8], 0x53e3cc
mov dword [ebp - 4], 0x53e3dc
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [ebp - 0x4c8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5c
mov edx, dword [ebp + 8]
push edx
call fcn.0040a210
add esp, 8
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0
jne 0x47d1ec
xor eax, eax
jmp 0x47d3a0
mov eax, dword [ebp - 0x3c4]
sub eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x47d39e
push 0x53e3ec
mov eax, dword [ebp - 0x3c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x47d2c2
cmp dword [ebp + 0xc], 0
jne 0x47d239
mov eax, 0xfffffffe
jmp 0x47d3a0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4d8]
call fcn.0047d00a
test eax, eax
je 0x47d2bd
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x258], 2
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x120], 0
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x3c0]
push edx
call fcn.00415480
mov dword [ebp - 0x4d0], 0
lea eax, [ebp - 0x4d0]
push eax
lea ecx, [ebp - 0x3c0]
push ecx
mov ecx, 0x5634c0
call fcn.00416eb0
mov eax, 0x44c
jmp 0x47d3a0
jmp 0x47d39e
mov dword [ebp - 0x4cc], 0
mov dword [ebp - 0x4cc], 0
jmp 0x47d2e7
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
cmp dword [ebp - 0x4cc], 5
jae 0x47d310
mov eax, dword [ebp - 0x3c4]
push eax
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ebp + ecx*4 - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x47d30e
jmp 0x47d310
jmp 0x47d2d8
cmp dword [ebp - 0x4cc], 5
jae 0x47d39e
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4d8]
call fcn.0047d0fe
test eax, eax
je 0x47d39e
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x258], 2
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x120], 0
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x3c0]
push edx
call fcn.00415480
mov dword [ebp - 0x4d4], 0
lea eax, [ebp - 0x4d4]
push eax
lea ecx, [ebp - 0x3c0]
push ecx
mov ecx, 0x5634c0
call fcn.00416eb0
mov eax, 0x44c
jmp 0x47d3a0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47d84e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7120
push 0x4a8984
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffc34
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x3dc], ecx
mov byte [ebp - 0x124], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + eax - 0x124]
mov dword [ebp - 0x128], ecx
push 0x53e498
push 0x104
mov edx, dword [ebp - 0x128]
push edx
call fcn.00415480
lea eax, [ebp - 0x124]
push eax
call fcn.0042f17a
add esp, 4
test eax, eax
jne 0x47d8e5
xor eax, eax
jmp 0x47d9ff
push 1
push 0
lea ecx, [ebp - 0x124]
push ecx
call fcn.0042f41c
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x47d908
xor eax, eax
jmp 0x47d9ff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x20]
add edx, 0xc64
mov dword [ebp - 0x12c], edx
push 7
push str.reg.exe
mov eax, dword [ebp - 0x12c]
push eax
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
je 0x47d948
mov dword [ebp - 4], 0xffffffff
jmp 0x47d96e
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x47d968
xor ecx, ecx
test ecx, ecx
jne 0x47d90f
mov edx, dword [ebp - 0x20]
push edx
call fcn.0042f4e1
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x47d9fc
mov eax, dword [ebp + 0xc]
push eax
push 0x44c
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x3dc]
push edx
call dword [ebp + 8]
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x26c], 2
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x134], 0
lea eax, [ebp - 0x124]
push eax
push 0x104
lea ecx, [ebp - 0x3d4]
push ecx
call fcn.00415480
mov dword [ebp - 0x3d8], 0
lea edx, [ebp - 0x3d8]
push edx
lea eax, [ebp - 0x3d4]
push eax
mov ecx, 0x5634c0
call fcn.00416eb0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47ef5b
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push edi
mov dword [ebp - 0x110], ecx
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x47efa1
xor eax, eax
jmp 0x47f023
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a210
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47efbc
xor eax, eax
jmp 0x47f023
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
je 0x47efdc
xor eax, eax
jmp 0x47f023
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x47eff1
xor eax, eax
jmp 0x47f023
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044fae0
mov ecx, eax
call fcn.0044ff04
test eax, eax
je 0x47f009
xor eax, eax
jmp 0x47f023
push 0x53f274
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x47f02a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push edi
mov dword [ebp - 0x324], ecx
mov byte [ebp - 0x320], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x31f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x21c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x118], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x47f0a2
xor eax, eax
jmp 0x47f242
lea ecx, [ebp - 0x320]
push ecx
push str._s_appwinproc.dll
push 0x104
lea edx, [ebp - 0x21c]
push edx
call fcn.00403f10
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x324]
call fcn.0047f294
test eax, eax
je 0x47f0fd
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
push 0x6f
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x324]
push eax
call dword [ebp + 8]
lea ecx, [ebp - 0x320]
push ecx
push 0x104
lea edx, [ebp - 0x118]
push edx
call fcn.00415480
lea eax, [ebp - 0x118]
push eax
call sub.ntdll.dll_strlen
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
lea edx, [ebp + ecx - 0x118]
mov dword [ebp - 0xc], edx
push str.Nskhelper0.sys
mov eax, 0x104
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00415480
mov edx, dword [ebp - 0xc]
add edx, 0xa
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
jmp 0x47f16a
mov eax, dword [ebp - 8]
mov cl, byte [eax]
add cl, 1
mov edx, dword [ebp - 8]
mov byte [edx], cl
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x39
jg 0x47f1ab
lea edx, [ebp - 0x118]
push edx
mov ecx, dword [ebp - 0x324]
call fcn.0047f249
test eax, eax
je 0x47f1a9
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0xc]
push eax
push 0x6f
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x324]
push edx
call dword [ebp + 8]
jmp 0x47f15d
cmp dword [ebp - 0x10], 0
je 0x47f21a
push str.NsPass0.sys
mov eax, 0x104
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00415480
mov edx, dword [ebp - 0xc]
add edx, 7
mov dword [ebp - 8], edx
jmp 0x47f1e0
mov eax, dword [ebp - 8]
mov cl, byte [eax]
add cl, 1
mov edx, dword [ebp - 8]
mov byte [edx], cl
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x39
jg 0x47f21a
lea edx, [ebp - 0x118]
push edx
mov ecx, dword [ebp - 0x324]
call fcn.0047f249
test eax, eax
je 0x47f218
mov eax, dword [ebp + 0xc]
push eax
push 0x6f
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x324]
push edx
call dword [ebp + 8]
jmp 0x47f1d3
cmp dword [ebp - 4], 0
jne 0x47f232
cmp dword [ebp - 0x10], 0
jne 0x47f232
mov dword [ebp - 0x328], 0
jmp 0x47f23c
mov dword [ebp - 0x328], 1
mov eax, dword [ebp - 0x328]
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x47f46e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + eax - 0x108]
mov dword [ebp - 4], ecx
push str.Comie.exe
push 0x104
mov edx, dword [ebp - 4]
push edx
call fcn.00415480
lea eax, [ebp - 0x108]
push eax
call fcn.0042f17a
add esp, 4
test eax, eax
je 0x47f4f7
mov ecx, dword [ebp + 0xc]
push ecx
push 0x6d
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [ebp + 8]
mov eax, 1
jmp 0x47f4f9
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x47f8a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x47f8ec
xor eax, eax
jmp 0x47f92c
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a210
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47f907
xor eax, eax
jmp 0x47f92c
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x47f92a
mov eax, 1
jmp 0x47f92c
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x47fcc5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7390
push 0x4a8984
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp - 0x2c]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov dx, word [ecx + 6]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], 0
jmp 0x47fd45
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x28]
jge 0x47fd89
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 0x24]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 0xc], ecx
jae 0x47fd87
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x14]
jbe 0x47fd87
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 0xc]
sub eax, dword [edx + 0x14]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
jmp 0x47fdaf
jmp 0x47fd33
xor edx, edx
test edx, edx
jne 0x47fcf9
mov dword [ebp - 4], 0xffffffff
jmp 0x47fdac
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4802fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push edi
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x110], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x114], 0
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp + eax - 0x104]
mov dword [ebp - 0x108], ecx
push str._temp_
push 0x104
mov edx, dword [ebp - 0x108]
push edx
call fcn.00415480
mov eax, dword [ebp - 0x108]
add eax, 6
mov dword [ebp - 0x114], eax
push 0x53f3e4
push 0x104
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.00415480
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [0x54b4e8]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x4803c6
xor eax, eax
jmp 0x48048c
mov ecx, dword [ebp - 0x254]
and ecx, 0x10
test ecx, ecx
je 0x4803d8
jmp 0x48045d
lea edx, [ebp - 0x228]
push edx
push 0x104
mov eax, dword [ebp - 0x114]
push eax
call fcn.00415480
lea ecx, [ebp - 0x104]
push ecx
call fcn.0044fae0
mov ecx, eax
call fcn.0044ff04
test eax, eax
je 0x480409
jmp 0x48045d
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x104]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x480422
jmp 0x48045d
lea ecx, [ebp - 0x104]
push ecx
call fcn.0042ee93
add esp, 4
test eax, eax
jne 0x480437
jmp 0x48045d
mov edx, dword [ebp + 0xc]
push edx
push 0x6b
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [ebp + 8]
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [0x54b4b4]
test eax, eax
jne 0x4803c6
mov edx, dword [ebp - 0x10c]
push edx
call dword [0x54b4c8]
mov eax, dword [ebp - 0x110]
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x480493
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x4804ab
mov eax, dword [ebp - 8]
jmp 0x480502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4804be
mov eax, dword [ebp - 8]
jmp 0x480502
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocStringLen
mov ecx, dword [ebp + 8]
push ecx
call dword [0x54b4dc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4804f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x4804f5
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4809ad
Capabilities:
Get common file path
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x53f4ec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f434
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x480bf3
mov dword [ebp - 0x224], 0x208
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
push 0x53f524
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f45b
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x480a9c
mov edx, dword [ebp - 0x224]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x32c], eax
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp - 0x32c]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
push 0x53f534
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f45b
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
cmp dword [ebp - 0xc], 0
jne 0x480bcf
push 0x104
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + eax - 0x328]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov byte [edx], 0x5c
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0
cmp dword [ebp - 0x32c], 0
jne 0x480afe
lea edx, [ebp - 0x21c]
mov dword [ebp - 0x340], edx
jmp 0x480b0a
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp - 0x340]
mov dword [ebp - 0x330], ecx
cmp dword [ebp - 0x330], 0
je 0x480bcf
mov edx, dword [ebp - 0x330]
movsx eax, byte [edx]
test eax, eax
je 0x480bcf
push 0x2c
mov ecx, dword [ebp - 0x330]
push ecx
call fcn.00422930
add esp, 8
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
je 0x480b6c
mov edx, dword [ebp - 0x334]
mov byte [edx], 0
mov eax, dword [ebp - 0x334]
add eax, 1
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x330]
push ecx
push 0x104
mov edx, dword [ebp - 0x14]
push edx
call fcn.00415480
lea eax, [ebp - 0x328]
push eax
call fcn.0042f17a
add esp, 4
test eax, eax
je 0x480bb5
push 2
push 0x53f544
mov ecx, dword [ebp - 0x330]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x480bb5
mov dword [ebp - 4], 1
jmp 0x480bcf
mov edx, dword [ebp - 0x334]
mov dword [ebp - 0x330], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x480b16
cmp dword [ebp - 0x32c], 0
je 0x480bf3
mov ecx, dword [ebp - 0x32c]
mov dword [ebp - 0x33c], ecx
mov edx, dword [ebp - 0x33c]
push edx
call fcn.004aa2c8
add esp, 4
cmp dword [ebp - 8], 2
jle 0x480c00
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x480c07
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
mov dword [ebp - 0x118], ecx
mov dword [ebp - 8], 0
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + eax - 0x10c]
mov dword [ebp - 4], ecx
push str._system.exe
push 0x104
mov edx, dword [ebp - 4]
push edx
call fcn.00415480
lea eax, [ebp - 0x10c]
push eax
call fcn.0042f17a
add esp, 4
test eax, eax
je 0x480c9c
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0044fae0
mov ecx, eax
call fcn.0044ff04
test eax, eax
jne 0x480c9c
mov dword [ebp - 0x11c], 1
jmp 0x480ca6
mov dword [ebp - 0x11c], 0
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x114], edx
call fcn.004809ad
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x114], 0
je 0x480cef
mov eax, dword [ebp + 0xc]
push eax
push 0x6b
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [ebp + 8]
cmp dword [ebp - 0x110], 0
je 0x480cef
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x480edd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0046e650
mov eax, dword [ebp - 4]
mov dword [eax], 0x4b75f8
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x114], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x110], 0
push 0x104
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x480f6b
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax + 0xb]
cmp edx, 0x5c
je 0x480f6b
push 0x53ff08
push 0x104
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call fcn.00408000
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret