joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e1e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4c81e7
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x24c], eax
push esi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x48e36d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48e36d
push 0x208
lea eax, [esp + 0x4e]
push 0
push eax
mov word [esp + 0x54], 0
call fcn.004a1e50
push 0x104
lea ecx, [esp + 0x58]
push esi
push ecx
call fcn.004a4f54
add esp, 0x18
test eax, eax
jne 0x48e292
push esi
lea ecx, [esp + 0x14]
call fcn.004093c0
mov dword [esp + 0x260], 0
lea edx, [esp + 0x10]
push edx
mov ecx, 0x4f8998
call fcn.00451ca0
lea ecx, [esp + 0x10]
call fcn.00406930
jmp 0x48e36d
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x400
je 0x48e2bf
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x14]
call fcn.004093c0
mov dword [esp + 0x260], 1
jmp 0x48e275
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x10]
call fcn.00402f90
lea ecx, [esp + 0xc]
mov dword [esp + 0x260], 2
call fcn.0043b0b0
xor esi, esi
mov ecx, dword [esi + 0x4f4750]
push ecx
lea ecx, [esp + 0xc]
call fcn.00402f90
lea ecx, [esp + 8]
mov byte [esp + 0x260], 3
call fcn.0043b0b0
push 0
lea ecx, [esp + 0xc]
call fcn.0042cd20
push eax
lea ecx, [esp + 0x14]
call fcn.0043b010
test eax, eax
lea ecx, [esp + 8]
jg 0x48e394
mov byte [esp + 0x260], 2
call fcn.00418010
add esi, 4
cmp esi, 0x44
jb 0x48e2e3
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x30]
call fcn.004093c0
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x4f8998
mov byte [esp + 0x264], 4
call fcn.00451ca0
lea ecx, [esp + 0x2c]
call fcn.00406930
lea ecx, [esp + 0xc]
call fcn.00418010
xor al, al
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.004a1873
add esp, 0x25c
ret
call fcn.00418010
lea ecx, [esp + 0xc]
call fcn.00418010
mov al, 1
jmp 0x48e36f

Function at 0x48e3b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x208
push eax
mov dword [esp + 8], eax
mov word [esp + 0xc], ax
lea eax, [esp + 0xe]
push eax
call fcn.004a1e50
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.004093c0
mov ecx, dword [esp + 0x210]
xor ecx, esp
mov eax, esi
call fcn.004a1873
add esp, 0x214
ret
Function at 0x48e440
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x40c], eax
lea eax, [esp]
push eax
push 1
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48e524
push 0x400
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004a1e50
mov ecx, dword [esp + 0xc]
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4e1d04
push ecx
mov dword [esp + 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48e51a
lea edx, [esp + 8]
push edx
push edi
push esi
call fcn.004a4ecc
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48e4d0
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
je 0x48e4f6
push 0x4e1cf8
push edi
push esi
call fcn.004a6ba9
add esp, 0xc
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.004a1873
add esp, 0x410
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40c]
xor ecx, esp
xor eax, eax
call fcn.004a1873
add esp, 0x410
ret

Function at 0x48e540
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x40c], eax
lea eax, [esp]
push eax
push 1
push 0
push str.SOFTWARETencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48e5fb
push 0x400
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004a1e50
mov ecx, dword [esp + 0xc]
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push str.Version
push ecx
mov dword [esp + 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48e5f1
mov eax, dword [esp + 0x414]
lea edx, [esp + 8]
push edx
push eax
push esi
call fcn.004a4ecc
mov ecx, dword [esp + 0xc]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.004a1873
add esp, 0x410
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40c]
xor ecx, esp
xor eax, eax
call fcn.004a1873
add esp, 0x410
ret
Function at 0x48e620
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8188
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push esi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
push 0x40
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004a1e50
xor eax, eax
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 0x181
call fcn.00418110
push edi
push ebx
lea ecx, [esp + 0x10]
push str.__s___s
push ecx
mov dword [esp + 0x88], 0
call fcn.0041b480
add esp, 0x10
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
mov edx, esi
neg edx
push 0
sbb edx, edx
push 0
and edx, 0xa
push 0
lea ecx, [esp + 0x28]
mov word [esp + 0x74], dx
call fcn.0042cd20
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x48e71d
mov edx, dword [ebp + 8]
push edi
push ebx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QMTFunction::RunApp_CreateProcessW_error:_d__wait:_d__show:_d__path:_ws__cmd:_s
mov esi, 0x4f8948
call fcn.0048aa50
add esp, 0x18
lea ecx, [esp + 8]
call fcn.00418010
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.004431f0
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call fcn.004431f0
mov eax, dword [ebp + 8]
test eax, eax
mov byte [esp + 0x78], 2
je 0x48e77d
mov edx, dword [esp + 0x14]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x48e76a
push str.CQMTProcess::RunApp_WAIT_TIMEOUT
mov esi, 0x4f8948
call fcn.0048aa50
add esp, 4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48e77d
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea ecx, [esp + 0xc]
call fcn.0043c090
lea ecx, [esp + 0x10]
call fcn.0043c090
lea ecx, [esp + 8]
call fcn.00418010
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48e7b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8148
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push esi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
push 0x40
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004a1e50
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 0x181
call fcn.00418110
push edi
push ebx
lea ecx, [esp + 0x14]
push str.__s___s
push ecx
mov dword [esp + 0x88], 0
call fcn.0041b480
add esp, 0x10
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
mov edx, esi
neg edx
push 0
sbb edx, edx
push 0
and edx, 0xa
push 0
lea ecx, [esp + 0x2c]
mov word [esp + 0x74], dx
call fcn.0042cd20
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x48e8a9
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QMTFunction::RunApp_CreateProcessW_error:_d__show:_d__path:_ws__cmd:_s
mov esi, 0x4f8948
call fcn.0048aa50
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.00418010
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
call fcn.004431f0
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x10]
call fcn.0043c090
lea ecx, [esp + 0xc]
call fcn.00418010
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48e8e0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x23c]
push esi
xor ebx, ebx
push ebx
push 2
mov dword [edi], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x48e92f
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x48e950
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.004a1873
add esp, 0x230
ret
cmp dword [esp + 0x14], ebx
jbe 0x48e968
lea ecx, [esp + 0x30]
push ebp
push ecx
call fcn.004a3704
add esp, 8
test eax, eax
je 0x48e979
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48e950
jmp 0x48e984
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004a1873
add esp, 0x230
ret
Function at 0x48e9b0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, 1
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x1c]
push eax
lea edi, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.0048e8e0
mov ebp, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x48ea3b
push ebp
xor edi, edi
push edi
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x48ea39
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1f4
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x48ea39
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x48ea39
push ebp
push str.QMTProcess::CloseProcessByID___d
mov ebx, 0x4f8948
call fcn.0048a860
add esp, 8
mov esi, edi
add dword [esp + 0x10], 1
test ebp, ebp
je 0x48ea4f
cmp dword [esp + 0x10], 0xa
jl 0x48e9c4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x48ede0
Capabilities:
Delete service

Disassembly:
sub esp, 8
push esi
mov esi, eax
test esi, esi
je 0x48ee66
cmp word [esi], 0
je 0x48ee66
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
mov dword [esp + 0xc], edi
jne 0x48ee10
pop edi
pop esi
add esp, 8
ret
push ebx
push 0x10020
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x48ee57
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x48ee54
lea esi, [esp + 0xc]
call fcn.0048efd0
lea esi, [esp + 0x10]
call fcn.0048efd0
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret
push esi
call ebx
push edi
call ebx
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 8
ret
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x48ee70
Capabilities:
Query service status

Disassembly:
sub esp, 0x24
test edi, edi
je 0x48ef25
cmp word [edi], 0
je 0x48ef25
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
xor eax, eax
test esi, esi
mov dword [esp + 8], esi
je 0x48eed8
push 4
push edi
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
mov dword [esp + 4], eax
jne 0x48eedd
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop esi
add esp, 0x24
ret
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
lea esi, [esp + 4]
jne 0x48ef06
call fcn.0048efd0
lea esi, [esp + 8]
call fcn.0048efd0
xor eax, eax
pop esi
add esp, 0x24
ret
cmp dword [esp + 0x10], 1
je 0x48eef1
call fcn.0048efd0
lea esi, [esp + 8]
call fcn.0048efd0
mov eax, 1
pop esi
add esp, 0x24
ret
xor eax, eax
add esp, 0x24
ret
Function at 0x48f510
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ca3d1
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x60], eax
push ebp
push esi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ebp
call fcn.004323f0
mov dword [esp + 0x78], ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 1
call fcn.00451ba0
push ebp
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x80], 1
call fcn.00403570
push eax
call fcn.0048d660
add esp, 0xc
test eax, eax
je 0x48f6e8
lea ecx, [esp + 0xc]
call fcn.0042c0b0
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call fcn.00451c20
mov edx, dword [eax]
lea ecx, [esp + 0x28]
mov dword [esp + 0xc], edx
mov eax, dword [eax + 4]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], eax
call fcn.00451c60
push eax
lea ecx, [esp + 0x10]
call fcn.00451de0
test al, al
je 0x48f6dc
lea ebp, [ebx + 0x40]
lea ecx, [esp + 0xc]
call fcn.00451cf0
push eax
lea ecx, [esp + 0x38]
call fcn.00409680
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x54]
mov byte [esp + 0x7c], 2
call fcn.0048b780
mov ecx, ebp
mov byte [esp + 0x78], 3
call fcn.0042cd20
mov esi, eax
push esi
call fcn.00401be0
add esp, 4
push eax
push esi
lea eax, [esp + 0x58]
push eax
call fcn.00482c00
test eax, eax
jne 0x48f695
add dword [esp + 0x14], 1
mov ecx, edi
call fcn.00470f10
test al, al
je 0x48f644
lea ecx, [esp + 0x34]
push ecx
jmp 0x48f65b
lea edx, [esp + 0x34]
push edi
push edx
call fcn.00443bd0
add esp, 8
test al, al
je 0x48f662
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.00432420
lea esi, [ebx + 0x24]
mov ecx, esi
call fcn.00470f10
test al, al
je 0x48f677
lea ecx, [esp + 0x34]
push ecx
jmp 0x48f68e
lea edx, [esp + 0x34]
push edx
push esi
call fcn.00443bd0
add esp, 8
test al, al
je 0x48f695
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.00432420
lea ecx, [esp + 0x50]
call fcn.00406930
lea ecx, [esp + 0x34]
mov byte [esp + 0x78], 1
call fcn.00406930
lea ecx, [esp + 0xc]
call fcn.00451d20
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00451c60
push eax
lea ecx, [esp + 0x10]
call fcn.00451de0
test al, al
jne 0x48f5e0
cmp dword [esp + 0x14], 3
jge 0x48f6e8
push 0x4dfaac
mov ecx, edi
call fcn.00432450
lea ecx, [esp + 0x18]
call fcn.00451bf0
mov eax, edi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004a1873
add esp, 0x70
ret
Function at 0x48f900
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4ca370
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x60]
cmp dword [ebp + 4], 0
je 0x48f9d0
lea esi, [esp + 0x30]
call fcn.0048e3b0
mov edi, esi
mov dword [esp + 0x58], 0
call fcn.0048c000
lea edi, [ebp + 8]
push edi
lea ecx, [esp + 0x18]
call fcn.0048b780
mov ecx, esi
push ecx
mov ebx, eax
mov byte [esp + 0x5c], 1
call fcn.0048c0c0
xor ebx, ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], bl
call fcn.00406930
mov ecx, esi
call fcn.00403570
push eax
mov ecx, edi
call fcn.00403570
push eax
push str.Copy_File___s______s_
mov esi, 0x4f8948
call fcn.0048aa50
add esp, 0xc
call fcn.0048a800
push 1
lea ecx, [esp + 0x34]
call fcn.00403570
push eax
mov ecx, edi
call fcn.00403570
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x30]
mov dword [ebp + 4], ebx
call fcn.00406930
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004a1873
add esp, 0x48
ret 4

Function at 0x48fab0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0
push 0x80
mov esi, edx
push esi
push eax
push 0xc0000000
push ecx
mov ecx, ebx
call fcn.00477140
xor ecx, ecx
cmp eax, ecx
jl 0x48fbf4
cmp edi, 0xffffffff
jne 0x48fb83
cmp esi, 4
jne 0x48fb7e
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea esi, [esp + 0x10]
mov ecx, ebx
xor edi, edi
call fcn.0048fdb0
cmp dword [esp + 0x14], edi
ja 0x48fb1a
cmp dword [esp + 0x10], 2
jb 0x48fb83
lea ecx, [esp + 0x18]
call fcn.0040f810
mov eax, dword [ebx]
lea esi, [esp + 0x18]
call fcn.0048fd10
test eax, eax
jl 0x48fb73
mov ecx, esi
call fcn.0042cd20
test eax, eax
je 0x48fb73
mov ecx, esi
call fcn.0042cd20
movzx eax, word [eax]
cmp eax, 0xfeff
je 0x48fb6e
cmp eax, 0xfffe
je 0x48fb6e
mov ecx, esi
call fcn.0042cd20
mov ebx, dword [esp + 0x1c]
mov ecx, eax
call fcn.0048fa00
test eax, eax
mov ebx, dword [ebp + 8]
je 0x48fb73
mov edi, 1
lea ecx, [esp + 0x18]
call fcn.0040f840
jmp 0x48fb83
mov edi, 1
cmp edi, 1
mov dword [ebx + 4], edi
jne 0x48fbcd
mov eax, dword [ebx]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x48fbaf
call fcn.0040a0d0
test eax, eax
jl 0x48fbb5
mov eax, dword [esp + 0x10]
or eax, dword [esp + 0x14]
jne 0x48fbcd
push 0
push 2
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x1c], 0xfeff
call fcn.004771c0
push 2
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x48fbf2
call fcn.0040a0d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48fd10
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x48fd4a
call fcn.0040a0d0
pop edi
add esp, 0x10
ret
mov ecx, dword [esp + 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x48fd9f
call fcn.0040a0d0
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
add esp, 0x10
ret
xor eax, eax
pop edi
add esp, 0x10
ret

Function at 0x48fdb0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
mov edx, dword [ecx]
lea eax, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x48fdd5
call fcn.0040a0d0
test eax, eax
jl 0x48fde0
mov eax, dword [esp]
mov dword [esi], eax
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
xor eax, eax
add esp, 0xc
ret

Function at 0x4901e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x20c], eax
cmp dword [0x4f8a14], 0
jne 0x490273
push esi
push 0x208
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.004a1e50
add esp, 0xc
push 0x104
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
push 0x4e29a4
lea edx, [esp + 0xc]
push 0x104
push edx
call fcn.004a178d
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x490272
push str.GetLocaleInfoEx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
add eax, 2
push esi
mov dword [0x4f8a14], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov ecx, dword [esp + 0x20c]
xor eax, eax
cmp dword [0x4f8a14], 1
sete al
xor ecx, esp
call fcn.004a1873
add esp, 0x210
ret
Function at 0x4902a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x118
mov esi, eax
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004a1e50
add esp, 0xc
test esi, esi
mov dword [esp + 4], 0x11c
je 0x4902f9
lea ecx, [esp + 4]
push ecx
call esi
test eax, eax
je 0x490319
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [esp + 4]
push edx
call esi
test eax, eax
jne 0x490319
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x114
call esi
cmp dword [esp + 8], 0xa
pop esi
jne 0x490342
cmp dword [esp + 8], 0
jne 0x490342
mov eax, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004a1873
add esp, 0x120
ret
mov ecx, dword [esp + 0x11c]
xor ecx, esp
xor eax, eax
call fcn.004a1873
add esp, 0x120
ret