joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488780
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00456880
add esp, 0xc
push 0
push 0x1c
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.hfinstall_nscomponent_setup.exe
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48887b
cmp dword [ebp + 8], 0
je 0x488830
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x488816
push 0
push 1
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call sym.Install_silent.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
jmp 0x48882e
push 0
push 1
push 0x4c50ec
lea ecx, [ebp - 0x210]
push ecx
call sym.Install_silent.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
jmp 0x48886e
mov edx, dword [ebp - 0x214]
cmp dword [edx + 0x1614], 0xfffffffe
jne 0x488856
push 5
push 1
push 0
lea eax, [ebp - 0x210]
push eax
call sym.Install_silent.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
jmp 0x48886e
push 0
push 1
push 0x4c50f4
lea ecx, [ebp - 0x210]
push ecx
call sym.Install_silent.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret 4
Function at 0x488cb0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
mov ecx, dword [ebp - 0x210]
add ecx, 0x16b0
call fcn.004053a0
test eax, eax
jle 0x488ce3
jmp 0x488dd0
mov eax, dword [ebp + 8]
add eax, 0x10cc
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x488d82
mov ecx, dword [ebp + 8]
add ecx, 0x10cc
push ecx
mov ecx, dword [ebp - 0x210]
add ecx, 0x16b0
call fcn.00405250
mov ecx, dword [ebp - 0x210]
add ecx, 0x16b0
call fcn.004053a0
sub eax, 1
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0x210]
add ecx, 0x16b0
call fcn.004174d0
movzx eax, ax
cmp eax, 0x5c
jne 0x488d68
movzx ecx, word [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x210]
add ecx, 0x16b0
call fcn.00417360
mov edx, dword [ebp - 0x210]
add edx, 0x16b0
push edx
mov ecx, dword [ebp - 0x210]
call sym.Install_silent.exe_private:_void___thiscall_CNsInstaller::ReplaceSysPath_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
jmp 0x488dd0
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00456880
add esp, 0xc
push 0
push 0x26
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0x4c4ee8
mov ecx, dword [ebp - 0x210]
add ecx, 0x16b0
push ecx
call fcn.00405800
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret 4
Function at 0x488de0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x620], ecx
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.00456880
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4c4ed8
lea edx, [ebp - 0x414]
push edx
call fcn.0045f83a
add esp, 8
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jne 0x488e4d
xor al, al
jmp 0x488fb4
lea eax, [ebp - 0x62c]
push eax
push 0x4c4ee0
push 0x1f41
call sym.Install_silent.exe_int___cdecl_NsResGetBuff_int__wchar_t_const___void__
add esp, 0xc
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0
jne 0x488ed0
push 0x15c8
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00456880
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x61c]
push edx
call fcn.00456880
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x61c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x61c]
push ecx
mov ecx, dword [ebp - 0x620]
add ecx, 0x16b0
call fcn.00405250
xor al, al
jmp 0x488fb4
push 0
mov edx, dword [ebp - 0x62c]
push edx
mov eax, dword [ebp - 0x624]
push eax
call fcn.00460268
add esp, 0xc
push 0x15c8
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00456880
add esp, 0xc
mov edx, dword [ebp - 0x624]
push edx
push 1
push 0x15c8
mov eax, dword [ebp + 8]
push eax
call fcn.0045fa86
add esp, 0x10
mov ecx, dword [ebp - 0x624]
push ecx
call fcn.0045febd
add esp, 4
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x620]
call sym.Install_silent.exe_private:_void___thiscall_CNsInstaller::InitPath_struct_tagSetupInfo__
mov eax, dword [ebp - 0x620]
add eax, 0x1638
push eax
mov ecx, dword [ebp - 0x620]
call sym.Install_silent.exe_public:_bool___thiscall_CNsInstaller::GetMoreInfo_struct_tagMorePacketInfo__
movzx ecx, al
test ecx, ecx
je 0x488fb2
mov edx, dword [ebp - 0x620]
cmp dword [edx + 0x1640], 0
je 0x488fb2
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00456880
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.Install_silent.exe_int___cdecl_GetInstallPath_wchar_t_const___wchar_t__
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x488fb2
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x620]
add ecx, 0x16b0
call fcn.00405250
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret 4
Function at 0x489980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x48999b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0x190]
jge 0x4899e1
push 8
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00456880
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 8
lea edx, [ebp - 0x10]
push edx
call fcn.0045fa86
add esp, 0x10
push 1
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00460268
add esp, 0xc
jmp 0x489992
mov esp, ebp
pop ebp
ret 8
Function at 0x489a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa9f1
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp - 0x21c]
add ecx, 0x15ec
call fcn.00405120
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
add ecx, 0x15f0
call fcn.004166f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x21c]
add ecx, 0x15fc
call fcn.004166f0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x21c]
add ecx, 0x16ac
call fcn.00405120
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x21c]
add ecx, 0x16b0
call fcn.00405120
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x21c]
add ecx, 0x16b4
call fcn.00405120
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x21c]
add ecx, 0x1784
call fcn.00416d30
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x21c]
mov byte [eax + 8], 0
mov ecx, dword [ebp - 0x21c]
mov byte [ecx + 0x16b8], 0
push 0x4c4e60
mov ecx, dword [ebp - 0x21c]
add ecx, 0x15ec
call fcn.00405250
push 0x4c4e64
mov ecx, dword [ebp - 0x21c]
add ecx, 0x16b4
call fcn.00405250
mov edx, dword [ebp - 0x21c]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x21c]
mov byte [eax + 0x1608], 0
mov ecx, dword [ebp - 0x21c]
mov byte [ecx + 0x1609], 0
mov edx, dword [ebp - 0x21c]
mov byte [edx + 0x160a], 0
mov eax, dword [ebp - 0x21c]
mov byte [eax + 0x160b], 0
mov ecx, dword [ebp - 0x21c]
mov byte [ecx + 0x160c], 0
mov edx, dword [ebp - 0x21c]
mov byte [edx + 0x160d], 0
mov eax, dword [ebp - 0x21c]
mov byte [eax + 0x160e], 0
mov ecx, dword [ebp - 0x21c]
mov byte [ecx + 0x1618], 0
mov edx, dword [ebp - 0x21c]
mov dword [edx + 0x1620], 0
push 0xc8
push 0
mov eax, dword [ebp - 0x21c]
add eax, 0x16ba
push eax
call fcn.00456880
add esp, 0xc
push 0x15c8
push 0
mov ecx, dword [ebp - 0x21c]
add ecx, 0x24
push ecx
call fcn.00456880
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.00456880
add esp, 0xc
push 0
push 0x1c
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4c4e68
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x218]
push edx
call sym.Install_silent.exe_int___cdecl_CreateDirTree_wchar_t_const__
add esp, 4
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x21c]
add ecx, 0x16ac
call fcn.00405250
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret
Function at 0x489ce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call sym.Install_silent.exe_public:_bool___thiscall_CNsInstaller::CheckEVIP_void_
movzx eax, al
test eax, eax
jne 0x489d13
push 0
push 0
push 0x7ed
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
call sym.Install_silent.exe_public:_bool___thiscall_CNsInstaller::CheckSafeMsg_void_
cmp dword [ebp + 8], 0
je 0x489d33
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x16b0
call fcn.00405250
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 4], ecx
cmp dword [ebp + 0x10], 0
je 0x489d63
push 1
mov edx, dword [ebp - 4]
push edx
push sym.Install_silent.exe_private:_static_unsigned_int___stdcall_CNsInstaller::InstallThread_void__
call sym.Install_silent.exe_public:_static_class_CNsThread____cdecl_CNsThread::Instance_void_
mov ecx, eax
call sym.Install_silent.exe_public:_void____thiscall_CNsThread::StartThread_unsigned_int____stdcall___void____void___int_
jmp 0x489d6b
mov ecx, dword [ebp - 4]
call sym.Install_silent.exe_private:_bool___thiscall_CNsInstaller::InstallFunc_void_
mov esp, ebp
pop ebp
ret 0x10

Function at 0x489d80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aaa21
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4e3074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x15ac], 0
je 0x489e21
lea ecx, [ebp - 0x10]
call fcn.00405120
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x920
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x16b0]
push eax
push 0x4c5688
lea ecx, [ebp - 0x10]
push ecx
call fcn.00405800
add esp, 0x10
lea ecx, [ebp - 0x10]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x489e12
push 5
push 0
push 0
lea ecx, [ebp - 0x10]
call sym.Install_silent.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call sym.Install_silent.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x489fe0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp - 8]
call sym.Install_silent.exe_private:_struct_tagNsTimer____thiscall_CNsThread::AddTimer_struct_tagNsTimer__
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48a025
jmp 0x48a04a
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push sym.Install_silent.exe_private:_static_unsigned_int___stdcall_CNsThread::TimerThread_void__
push 0
push 0
call fcn.0046087a
add esp, 0x18
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x14], edx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x48a180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call fcn.0046087a
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x48a1be
cmp dword [ebp - 4], 0
je 0x48a1be
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x48a1c1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x48a1d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x48a1ff
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 8
Function at 0x48a370
Capabilities:
Get http response content encoding

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aaa9b
mov eax, dword fs:[0]
push eax
sub esp, 0x614
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x620], ecx
push 0x200
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00456880
add esp, 0xc
mov dword [ebp - 0x618], 0x200
push 0
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x1d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x48a486
push 0x200
lea ecx, [ebp - 0x610]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x210]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x614]
call fcn.00405080
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x614]
call fcn.004097b0
push 0x4c7904
lea ecx, [ebp - 0x614]
call fcn.00409c50
test eax, eax
je 0x48a450
push 0x4c7910
lea ecx, [ebp - 0x614]
call fcn.00409c50
test eax, eax
jne 0x48a474
mov dword [ebp - 0x61c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.00405060
mov eax, dword [ebp - 0x61c]
jmp 0x48a488
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.00405060
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret 4
Function at 0x48aad0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x1ac
push 0
mov eax, dword [ebp - 0x214]
push eax
call fcn.00456880
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call sym.Install_silent.exe_void___cdecl_GetCurPath_wchar_t__
add esp, 4
push 0x4c7858
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4c786c
lea eax, [ebp - 0x20c]
push eax
call fcn.0045f83a
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x48ab60
mov ecx, dword [ebp - 0x210]
push ecx
push 1
push 0x1ac
mov edx, dword [ebp - 0x214]
push edx
call fcn.0045fa86
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret
Function at 0x48e3e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x10325476
mov esp, ebp
pop ebp
ret 4
Function at 0x48eae0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x124], ecx
push 0x11c
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.00456880
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x48eb55
cmp dword [ebp - 0x118], 1
je 0x48eb41
cmp dword [ebp - 0x118], 2
jne 0x48eb55
push str.Windows_XP
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x48ebfc
cmp dword [ebp - 0x11c], 6
jne 0x48eb7b
cmp dword [ebp - 0x118], 0
jne 0x48eb7b
push str.Windows_Vista
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x48ebfc
cmp dword [ebp - 0x11c], 6
jne 0x48eb9e
cmp dword [ebp - 0x118], 1
jne 0x48eb9e
push str.Windows_7
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x48ebfc
cmp dword [ebp - 0x11c], 6
jne 0x48ebc1
cmp dword [ebp - 0x118], 2
jne 0x48ebc1
push str.Windows_8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x48ebfc
cmp dword [ebp - 0x11c], 6
jne 0x48ebe4
cmp dword [ebp - 0x118], 3
jne 0x48ebe4
push str.Windows_8.1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x48ebfc
cmp dword [ebp - 0x11c], 0xa
jne 0x48ebfc
push str.Windows_10
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret 4
Function at 0x48ec10
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x814], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x814]
call sym.Install_silent.exe_public:_int___thiscall_CNsProcess::GetProcId_wchar_t_const__
mov dword [ebp - 0x818], eax
mov ecx, dword [ebp - 0x818]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
jne 0x48ec68
xor al, al
jmp 0x48ed4e
mov byte [ebp - 0x805], 0
mov dword [ebp - 0x80c], 0x400
mov edx, dword [ebp - 0x80c]
push edx
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.00456880
add esp, 0xc
mov ecx, dword [ebp - 0x80c]
push ecx
lea edx, [ebp - 0x804]
push edx
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x48ecb9
mov byte [ebp - 0x806], 1
jmp 0x48ecc0
mov byte [ebp - 0x806], 0
mov cl, byte [ebp - 0x806]
mov byte [ebp - 0x805], cl
lea edx, [ebp - 0x804]
push edx
mov ecx, dword [ebp - 0x814]
call sym.Install_silent.exe_public:_bool___thiscall_CNsProcess::DosToDrivePath_wchar_t__
mov byte [ebp - 0x805], al
movzx eax, byte [ebp - 0x805]
test eax, eax
jne 0x48ed2c
mov ecx, dword [ebp - 0x80c]
push ecx
lea edx, [ebp - 0x804]
push edx
push 0
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x48ed19
mov byte [ebp - 0x807], 1
jmp 0x48ed20
mov byte [ebp - 0x807], 0
mov cl, byte [ebp - 0x807]
mov byte [ebp - 0x805], cl
movzx edx, byte [ebp - 0x805]
test edx, edx
je 0x48ed48
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov al, byte [ebp - 0x805]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret 8
Function at 0x48ed60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x238], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x48eda7
mov eax, dword [ebp - 0x238]
jmp 0x48ee6f
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.00456880
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x48ee5c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x48ee20
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x238], edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
jmp 0x48ee6f
push 0x22c
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.00456880
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x23c], eax
jmp 0x48ede1
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret 4

Function at 0x48eed0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x4e3074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x48ef09
xor al, al
jmp 0x48efa4
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.00456880
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x48ef95
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
jne 0x48ef79
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x48efa4
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x238], eax
jmp 0x48ef43
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fc0d
mov esp, ebp
pop ebp
ret 8