joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476800
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004774b8
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00476960
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x47694a
test ebx, ebx
jl 0x4768ee
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2cc64
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47690f
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x476901
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004782d0
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004782d0
add esp, 8
mov ebx, 0x80070057
jmp 0x4768ee
Function at 0x48de60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048eb18
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048dfc0
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48dfaa
test ebx, ebx
jl 0x48df4e
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd442c4
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48df6f
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48df61
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048f930
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048f930
add esp, 8
mov ebx, 0x80070057
jmp 0x48df4e
Function at 0x4a4f20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a5bd8
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a5080
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a506a
test ebx, ebx
jl 0x4a500e
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5b384
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a502f
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a5021
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a69f0
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a69f0
add esp, 8
mov ebx, 0x80070057
jmp 0x4a500e
Function at 0x41c08e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4d2363]
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], al
push 0x8000
push edi
mov esi, edx
call fcn.0042dce5
pop ecx
push eax
call fcn.0042db06
cmp dword [esi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x4590a1
lea ecx, [ebp - 0x18]
call fcn.0041c170
mov ecx, esi
call fcn.00408e70
mov ecx, dword [esi + 8]
lea edx, [ebp - 0x18]
call fcn.0041f9e2
push dword [ebp - 0x18]
push 0x49e1b8
push edi
call fcn.0041c19e
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x4590c1
lea ecx, [ebp - 0x18]
call fcn.0040bd2c
mov esi, dword [ebp - 8]
push edi
call fcn.0042e129
push edi
call fcn.0042dce5
pop ecx
pop ecx
cmp ebx, 0xffffffff
jne 0x41c11e
mov ebx, 0x4000
push ebx
push eax
call fcn.0042db06
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push edi
mov ecx, esi
call fcn.004727da
push eax
push 1
call fcn.0047276a
push eax
call fcn.0042df43
add esp, 0x10
mov esi, eax
jmp 0x41c106
mov ecx, esi
call fcn.00408e70
mov eax, dword [esi + 8]
push dword [eax]
call dword [0x49d240]
jmp 0x41c0fb
Function at 0x43960b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043948a
Function at 0x469f0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042019b
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.004211b0
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x469f68
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x469f5f
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4728da
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4d3630], ecx
inc esi
mov edx, esi
mov eax, dword [edx*4 + 0x4d362c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x4d3630], eax
inc edx
cmp edx, 0x270
jl 0x4728e6
mov dword [0x4d16e0], esi
mov dword [0x4d3ff0], esi
pop esi
ret

Function at 0x47291a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d3ff0], 0
push esi
push edi
mov esi, 0x4d3630
jne 0x47293d
push 0
call fcn.0042e878
pop ecx
mov ecx, eax
call fcn.004728da
mov dword [0x4d16e0], 0x270
mov edx, 0xe3
mov dword [0x4d3ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0x634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x472952
mov eax, dword [esi]
mov dword [ebp - 4], 0x18c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x47298c
mov eax, dword [0x4d3630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret
Function at 0x472e2b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x472e50
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.004211b0
add esp, 0xc
jmp 0x472e63
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.0042ec54
add esp, 0x10
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, eax
mov byte [ebp - 4], 0
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
push 0x4c7a8c
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
call fcn.0042ed10
neg eax
pop ecx
pop ecx
sbb eax, eax
neg eax
pop esi
leave
ret 4

Function at 0x472f67
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, 0x10000
mov ecx, dword [esi + 0x464]
test ecx, ecx
je 0x472f7d
cmp ecx, eax
jne 0x472f99
push dword [esi + 0x1c]
push eax
push 1
push dword [esi + 0x45c]
call fcn.0042ec54
add esp, 0x10
xor ecx, ecx
mov dword [esi + 0x464], ecx
mov eax, dword [esi + 0x45c]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
ret

Function at 0x472fab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x460]
mov esi, dword [edi + 0x458]
mov byte [esi + edx], al
mov eax, 0x10000
inc dword [edi + 0x460]
cmp dword [edi + 0x460], eax
jne 0x472ff2
push dword [edi + 0x20]
push eax
push 1
push dword [edi + 0x458]
call fcn.0042df43
add esp, 0x10
and dword [edi + 0x460], 0
pop edi
pop esi
pop ebp
ret 4

Function at 0x472ff8
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x460]
test eax, eax
je 0x473020
push dword [esi + 0x20]
push eax
push 1
push dword [esi + 0x458]
call fcn.0042df43
add esp, 0x10
and dword [esi + 0x460], 0
pop esi
ret

Function at 0x4731d2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
lea ecx, [ebp - 0xdc]
call fcn.00473022
push dword [ebp + 8]
lea ecx, [ebp - 0xdc]
call fcn.00473066
xor esi, esi
test ebx, ebx
je 0x473216
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.004731a6
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jb 0x473201
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b63d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
and esi, ecx
sub esi, 1
sub esi, esi
call fcn.0043b679
and ecx, esi
and esi, ecx
xor dword [edi], ebx
add esi, 0x9e733721
add edi, 1
dec esi
add esi, ecx
cmp edi, edx
jne fcn.0043b63d
add ecx, ecx
and ecx, ecx
mov ecx, esi
ret
Function at 0x40895a
Capabilities:
Encode data using xor

Disassembly:
call fcn.00408831
xor ecx, ecx
sub cx, 0xff7e
call 0x40895a
rcr byte [esi - 0x7f], 0x76
push cs
inc ebp
hlt
Function at 0x4b333c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b3507
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x40], 0
je 0x4b3377
cmp byte [ebx + 0x41], 0
jne 0x4b3377
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x4b33a3
cmp byte [ebx + 0x41], 1
jne 0x4b3391
lea eax, [ebp - 0x24]
push eax
push 0x12
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b203c
jmp 0x4b33a3
lea eax, [ebp - 0x24]
push eax
push 0x11
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b203c
xor edx, edx
push ebp
push 0x4b34e2
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x48]
mov edx, 0x104
call fcn.00404ce8
mov eax, dword [ebx + 0x48]
call fcn.00404b5c
mov dword [ebp - 0x20], eax
cmp dword [ebx + 0x44], 0
je 0x4b33dc
mov eax, dword [ebx + 0x44]
call fcn.00404b5c
mov dword [ebp - 0x1c], eax
jmp 0x4b33e1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp byte [ebx + 0x41], 1
jne 0x4b33f0
mov dword [ebp - 0x18], 0x1000
jmp 0x4b33f7
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x14], 0x4b2f64
mov dword [ebp - 0x10], ebx
mov eax, dword [0x4bfcf8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.004b3518
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4b34c7
xor eax, eax
push ebp
push 0x4b34c0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x41], 0
jne 0x4b348d
lea eax, [ebp - 0x12d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
call fcn.0040df38
lea edx, [ebp - 0x138]
lea eax, [ebp - 0x12d]
call fcn.00409934
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004b3670
mov edx, dword [ebp - 0x134]
lea eax, [ebx + 0x50]
call fcn.004046f0
jmp 0x4b3498
lea eax, [ebx + 0x50]
mov edx, dword [ebx + 0x48]
call fcn.004046f0
lea eax, [ebx + 0x4c]
mov edx, dword [ebx + 0x50]
call fcn.004046f0
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x54], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b34c7
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b34e9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4b34e1
push eax
call sub.ole32.dll_CoTaskMemFree
ret

Function at 0x4b36d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x4b3721
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b5c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4b3705
test al, 0x10
jne 0x4b3709
xor ebx, ebx
jmp 0x4b370b
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3728
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x4b3800
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x320], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b39c2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.ole32.dll_CoInitialize
xor eax, eax
push ebp
push 0x4b3992
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00405fec
push eax
mov eax, dword [0x4bfe8c]
push eax
push 5
push 0
mov eax, dword [0x4bf9e0]
push eax
call sub.ole32.dll_CoCreateInstance
call fcn.004b203c
xor eax, eax
push ebp
push 0x4b3978
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00405fec
push eax
push 0x4bf8c0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax]
call fcn.004b203c
xor eax, eax
push ebp
push 0x4b395b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push edi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b203c
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push 0x4b39d8
push esi
push 0x4b39e4
lea eax, [ebp - 0x320]
mov edx, 3
call fcn.00404a1c
mov eax, dword [ebp - 0x320]
call fcn.00404b5c
mov edx, eax
lea eax, [ebp - 0x111]
call fcn.00409808
mov eax, ebx
call fcn.00404b5c
mov esi, eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push 0
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
push 0x104
lea eax, [ebp - 0x31c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x111]
push eax
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar_1
push 0xffffffffffffffff
lea eax, [ebp - 0x31c]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004b203c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3962
lea eax, [ebp - 8]
call fcn.00405fec
ret

Function at 0x4b3a24
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x4b3ae4
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x4b3a96
dec ecx
jne 0x4b3add
cmp eax, 4
jg 0x4b3a64
mov eax, dword [0x4bf8e4]
jmp 0x4b3ae9
cmp eax, 5
jne 0x4b3a74
test edx, edx
jne 0x4b3a74
mov eax, dword [0x4bf8e8]
jmp 0x4b3ae9
cmp eax, 5
jne 0x4b3a83
dec edx
jne 0x4b3a83
mov eax, dword [0x4bf8ec]
jmp 0x4b3ae9
cmp eax, 6
jne 0x4b3a8f
mov eax, dword [0x4bf8f0]
jmp 0x4b3ae9
mov eax, dword [0x4bf8d0]
jmp 0x4b3ae9
cmp eax, 4
jne 0x4b3aa6
test edx, edx
jne 0x4b3aa6
mov eax, dword [0x4bf8d4]
jmp 0x4b3ae9
cmp eax, 4
jne 0x4b3ac5
cmp edx, 0xa
jne 0x4b3ac5
cmp byte [esp + 0x15], 0x41
jne 0x4b3abe
mov eax, dword [0x4bf8dc]
jmp 0x4b3ae9
mov eax, dword [0x4bf8d8]
jmp 0x4b3ae9
cmp eax, 4
jne 0x4b3ad6
cmp edx, 0x5a
jne 0x4b3ad6
mov eax, dword [0x4bf8e0]
jmp 0x4b3ae9
mov eax, dword [0x4bf8d0]
jmp 0x4b3ae9
mov eax, dword [0x4bf8d0]
jmp 0x4b3ae9
mov eax, dword [0x4bf8d0]
add esp, 0x94
ret
Function at 0x4b40b4
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
push esp
push 0x26
mov eax, dword [0x4e2a28]
call fcn.00448a78
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, 0xff
call fcn.00402734
mov ebx, eax
push ebx
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, esi
mov edx, ebx
call fcn.00404894
mov eax, ebx
call fcn.00402754
pop edx
pop esi
pop ebx
ret

Function at 0x4b40f8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00409934
add esp, 0x108
pop ebx
ret

Function at 0x4b4124
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409934
add esp, 0x108
pop ebx
ret

Function at 0x4b45a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x4b469c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b203c
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.0040490c
cmp dword [ebp - 0xc], 0
je 0x4b466e
mov eax, dword [ebp - 0xc]
call fcn.0040495c
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
je 0x4b462d
lea eax, [ebp - 0xc]
mov edx, 0x4b46b0
call fcn.00404964
push dword [ebp - 0xc]
lea edx, [ebp - 0x11c]
mov eax, 0x4b46bc
call fcn.004ac5f4
push dword [ebp - 0x11c]
push 0x4b46cc
push dword [ebp - 4]
push 0x4b46d8
lea eax, [ebp - 0x118]
mov edx, 5
call fcn.00404a1c
mov eax, dword [ebp - 0x118]
call fcn.00409348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b46a3
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.004046c0
lea eax, [ebp - 0xc]
call fcn.0040469c
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x4b4a18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x4b4be1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 2
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004b203c
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.0040490c
cmp dword [ebp - 0xc], 0
je 0x4b4bb3
mov eax, dword [ebp - 0xc]
call fcn.0040495c
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
je 0x4b4ac7
lea eax, [ebp - 0xc]
mov edx, 0x4b4bf4
call fcn.00404964
push dword [ebp - 0xc]
push dword [ebp - 4]
push 0x4b4bf4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a1c
push dword [ebp - 0xc]
lea edx, [ebp - 0x11c]
mov eax, 0x4b4c00
call fcn.004ac5f4
push dword [ebp - 0x11c]
push 0x4b4c10
push dword [ebp - 4]
push 0x4b4c1c
lea eax, [ebp - 0x118]
mov edx, 5
call fcn.00404a1c
mov eax, dword [ebp - 0x118]
call fcn.00409348
push dword [ebp - 0xc]
lea edx, [ebp - 0x124]
mov eax, 0x4b4c2c
call fcn.004ac5f4
push dword [ebp - 0x124]
push 0x4b4c1c
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.00404a1c
mov eax, dword [ebp - 0x120]
call fcn.00409348
push dword [ebp - 0xc]
lea edx, [ebp - 0x12c]
mov eax, 0x4b4c3c
call fcn.004ac5f4
push dword [ebp - 0x12c]
push 0x4b4c10
push dword [ebp - 4]
push 0x4b4c1c
lea eax, [ebp - 0x128]
mov edx, 5
call fcn.00404a1c
mov eax, dword [ebp - 0x128]
call fcn.00409348
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 0xc]
call fcn.004094a8
mov eax, dword [ebp - 0x130]
call fcn.00409714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4be8
lea eax, [ebp - 0x130]
mov edx, 7
call fcn.004046c0
lea eax, [ebp - 0xc]
call fcn.0040469c
lea eax, [ebp - 4]
call fcn.0040469c
ret