joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x481767
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x48176a
mov esi, dword [ebp + 8]
test esi, esi
je 0x48191d
call fcn.0047fb00
test eax, eax
je 0x481815
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 0x14]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x481911
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x4817b9
cmp eax, 2
je 0x4817b9
cmp eax, 6
je 0x4817b9
cmp eax, 7
jne 0x481911
mov ecx, dword [ebp + 0xc]
add ecx, 2
push ecx
call fcn.005b83cc
mov edx, dword [ebp + 0xc]
mov ebx, eax
xor eax, eax
mov edi, ebx
lea ecx, [edx + 2]
add esp, 4
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x4818fc
mov ecx, dword [ebp + 0x18]
call fcn.0046cf80
cmp esi, dword [ebp + 8]
je 0x4818e6
jmp 0x4818df
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x481821
mov dword [ebp + 0x10], eax
jmp 0x481856
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00454b00
mov edx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp + 0x10], edi
mov edx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 0x14]
push 0
push ecx
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x481911
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x481890
cmp eax, 2
je 0x481890
cmp eax, 6
je 0x481890
cmp eax, 7
jne 0x481911
mov eax, dword [ebp + 0xc]
add eax, 2
push eax
call fcn.005b83cc
mov ecx, dword [ebp + 0xc]
mov ebx, eax
add ecx, 2
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x4818fc
mov ecx, dword [ebp + 0x18]
call fcn.0046d050
cmp esi, dword [ebp + 8]
je 0x4818e6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.005b83f5
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.005b83f5
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x65aa38
call fcn.0046cf80
cmp esi, dword [ebp + 8]
je 0x48191d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x482330
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5da678
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x482386
lea ecx, [ebp + 0x14]
mov ebx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 0xc]
or ecx, 0x20006
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x48238b
mov esi, dword [ebp + 8]
mov ebx, esi
test esi, esi
je 0x48247a
call fcn.0047fb00
test eax, eax
je 0x4823da
mov edi, dword [ebp + 0x18]
push edi
call fcn.004538bc
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 0x10]
push edx
push edi
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x48246f
cmp esi, ebx
je 0x4823d0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x48247c
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4823e5
xor edi, edi
jmp 0x48241a
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00454b00
mov ecx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push edx
call fcn.00466d00
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x482460
cmp esi, ebx
je 0x48244a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.00467510
mov eax, 1
jmp 0x48247c
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.00467510
cmp esi, ebx
je 0x48247a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4830f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x48326d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x48324c
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x483146
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call fcn.005b83cc
mov esi, eax
add esp, 4
test esi, esi
je 0x48326d
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x483264
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x483264
mov edi, dword [esp + 0x20]
test edi, edi
je 0x483264
push ebp
push edi
call fcn.004830f0
add esp, 8
test eax, eax
je 0x483259
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x666874]
test eax, eax
je 0x4831f5
test ebp, ebp
je 0x4831f5
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x483264
jmp 0x483201
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x483264
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x483243
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x483264
mov eax, dword [esp + 0x14]
jmp 0x48319e
push esi
call fcn.005b83f5
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x483264
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.005b83f5
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x483280
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
test esi, esi
je 0x4832e9
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4832a9
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4832e9
pop edi
mov eax, 1
pop esi
ret 4
push edi
push esi
call fcn.004830f0
add esp, 8
test eax, eax
je 0x4832e9
mov eax, dword [0x666874]
test eax, eax
je 0x4832d6
test edi, edi
je 0x4832d6
push 0
push edi
push 0
push esi
call eax
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 4
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x4836c0
Capabilities:
Get user security identifier

Disassembly:
mov eax, dword [0x6668d4]
sub esp, 0x120
push ebx
xor ebx, ebx
push ebp
cmp eax, ebx
push edi
jne 0x48370c
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, 2
jne 0x483707
mov dword [0x6668d8], eax
mov dword [0x6668d4], eax
cmp dword [0x6668d8], ebx
jne 0x483720
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x120
ret
mov ebp, dword [esp + 0x130]
mov edi, dword [esp + 0x134]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x14]
push ebx
push eax
push ebx
push ebp
push ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x48376c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x48376c
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x120
ret
mov ecx, dword [esp + 0xc]
push esi
push ecx
call fcn.005b83cc
mov edx, dword [esp + 0x18]
mov dword [edi], eax
lea eax, [edx + edx]
push eax
call fcn.005b83cc
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x4837b1
test esi, esi
je 0x4837c2
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x4837be
push esi
call fcn.005b83f5
add esp, 4
test ebx, ebx
jne 0x4837d1
mov edi, dword [edi]
test edi, edi
je 0x4837d1
push edi
call fcn.005b83f5
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x120
ret
Function at 0x483ee0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da7a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
mov eax, dword [0x66687c]
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
mov dword [ebp - 0x10], esp
jne 0x4840cb
push 1
push 0x666888
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push 1
push 0x666888
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [ebp - 0x34]
mov dword [0x6668a0], 0xc
mov dword [0x6668a8], esi
mov dword [0x6668a4], 0x666888
call fcn.004739b0
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], esi
call fcn.005b69e3
mov eax, dword [0x6668dc]
mov byte [ebp - 4], 1
cmp eax, esi
mov dword [ebp - 0x24], str.S_1_1_0
mov dword [ebp - 0x20], str.S_1_15_2_1
mov dword [ebp - 0x1c], str.S_1_15_2_2
mov ebx, 3
jne 0x483fe1
mov ecx, 0x44
xor eax, eax
lea edi, [ebp - 0x158]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x15c], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x14c]
mov ecx, 2
cmp eax, ecx
jne 0x483fd7
mov eax, dword [ebp - 0x158]
cmp eax, 6
ja 0x483fcd
jne 0x483fd7
cmp dword [ebp - 0x154], ecx
jb 0x483fd7
mov dword [0x6668e0], 1
mov dword [0x6668dc], 1
cmp dword [0x6668e0], esi
jne 0x483fee
mov ebx, 1
cmp ebx, esi
jle 0x484035
lea esi, [ebp - 0x24]
mov edi, ebx
mov ecx, dword [esi]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0046c430
mov edx, dword [ebp - 0x30]
push eax
push edx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00474110
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0046cca0
mov eax, dword [ebp - 0x40]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x48]
call fcn.005b6c07
add esi, 4
dec edi
jne 0x483ff7
xor esi, esi
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x34]
push ecx
push edx
push 0x6668c0
mov byte [ebp - 4], 3
call fcn.00483aa0
add esp, 0xc
cmp eax, esi
jne 0x484089
lea eax, [ebp - 0x18]
push 0x614cd0
push eax
mov dword [ebp - 0x18], esi
call fcn.00454bde
push 1
push 0x6668c0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push 0x6668c0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, 0x484087
ret
mov eax, 1
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], eax
mov dword [0x6668b0], 0xc
mov dword [0x6668b8], esi
mov dword [0x6668b4], 0x6668c0
mov dword [0x66687c], eax
mov byte [ebp - 4], 0
call fcn.005b6a16
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.004739c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x485560
Capabilities:
Read .ini file

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x20c
push ebx
push ebp
push esi
xor esi, esi
cmp edx, esi
push edi
je 0x48568c
mov ebp, dword [esp + 0x224]
cmp ebp, esi
je 0x48568c
mov ebx, dword [esp + 0x228]
cmp ebx, esi
je 0x48568c
cmp word [edx], si
je 0x48568c
cmp word [ebp], si
je 0x48568c
cmp word [ebx], si
je 0x48568c
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
lea eax, [esp + 0x18]
push 0x104
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, esi
je 0x48568c
cmp eax, 0x103
jae 0x48560a
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x230]
call fcn.005b7e9a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret
mov dword [esp + 0x10], esi
mov esi, 0x400
cmp esi, 0xa00000
jae 0x48567d
add esi, esi
lea edx, [esi + esi]
push edx
call fcn.005b83cc
mov edi, eax
add esp, 4
test edi, edi
je 0x48567d
mov eax, dword [esp + 0x220]
push eax
push esi
push edi
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x48564e
lea ecx, [esi - 1]
cmp eax, ecx
jb 0x485659
push edi
call fcn.005b83f5
add esp, 4
jmp 0x485613
mov ecx, dword [esp + 0x22c]
push edi
mov dword [esp + 0x14], 1
mov word [edi + eax*2], 0
call fcn.005b7e9a
push edi
call fcn.005b83f5
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret
Function at 0x488200
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, 0x8000
push edi
cmp eax, esi
mov dword [esp + 0x14], esi
jbe 0x48821e
mov dword [esp + 0x14], eax
mov esi, eax
push esi
call fcn.005b83cc
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
mov ebp, dword [esp + 0x24]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
mov dword [esp + 0x10], ebx
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x24]
push 0
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
jne 0x48825d
xor ebx, ebx
jmp 0x48827a
lea eax, [esp + 0x24]
push 0
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x488276
or ebx, 0xffffffff
jmp 0x48827a
mov ebx, dword [esp + 0x24]
push 0
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4882cd
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push 0
push ecx
push eax
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4882b2
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
je 0x4882c9
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005b83f5
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x2c]
cmp ebx, esi
jae 0x4882f2
test ebx, ebx
je 0x4883c6
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2c]
push 0
push edx
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4883c6
lea ecx, [ebx + edi]
add edi, eax
push esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], edi
call fcn.005b83cc
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esp + 0x24], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x488326
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
jg 0x488365
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
je 0x488365
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push 0
push eax
push esi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48835f
or esi, 0xffffffff
jmp 0x488367
mov esi, dword [esp + 0x28]
jmp 0x488367
xor esi, esi
mov edx, dword [esp + 0x2c]
push 0
push 0
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test ebx, ebx
je 0x48838f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 0
push eax
push ebx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
add edx, ebx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x20]
add edi, esi
mov dword [esp + 0x10], edx
test esi, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
mov ebx, esi
jg 0x488322
push eax
call fcn.005b83f5
add esp, 4
mov eax, dword [esp + 0x10]
push eax
call fcn.005b83f5
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4883e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
jne 0x488403
or ebx, eax
jmp 0x488405
mov ebx, eax
push 2
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
je 0x48841f
mov dword [esp + 0x1c], eax
push 0
push ebx
push esi
call fcn.00488720
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
sub eax, ebp
sub ecx, ebp
add esp, 0xc
cmp ecx, eax
mov dword [esp + 0x20], ecx
jl 0x488447
mov dword [esp + 0x20], eax
push 0x8000
call fcn.005b83cc
mov ebx, eax
add esp, 4
mov ecx, 0x2000
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [eax + ebp]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x24]
push 0
push edx
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x488491
or eax, 0xffffffff
jmp 0x4884cd
mov edi, dword [esp + 0x24]
mov eax, edi
test edi, edi
mov dword [esp + 0x14], eax
jle 0x4884cd
push 0
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x4884c9
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4884d8
cmp dword [esp + 0x10], edi
jne 0x4884d8
mov eax, dword [esp + 0x14]
add ebp, eax
cmp eax, 0x8000
jne 0x4884eb
jmp 0x488461
push ebx
call fcn.005b83f5
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0
sub eax, ecx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call fcn.005b83f5
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x488520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5dab7b
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
mov ebx, dword [esp + 0x134]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
je 0x4886c4
push ebx
call fcn.004538bc
add esp, 4
test eax, eax
je 0x4886c4
push ebx
lea ecx, [esp + 0x18]
call fcn.005b7d77
mov esi, dword [esp + 0x144]
mov dword [esp + 0x138], ebp
cmp esi, ebp
je 0x488591
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4886b0
neg esi
sbb esi, esi
mov dword [esp + 0x18], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
and esi, 0xc0000000
add esi, 0xc0000000
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x488664
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4885c7
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x642ed4]
cmp eax, 0xffffffff
jne 0x488602
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [esp + 0x2c]
xor eax, eax
cmp ecx, 2
sete al
mov dword [0x642ed4], eax
test eax, eax
je 0x48861b
push 0
push 0x80
push 4
push 0
push 1
push esi
push ebx
call ebp
mov edi, eax
jmp 0x488649
push ebx
lea ecx, [esp + 0x14]
call fcn.00466d00
mov edx, dword [esp + 0x10]
push 0
push 0x80
push 4
push 0
push 1
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00467510
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 3
mov dword [esp + 0x18], eax
jl 0x4885ae
cmp edi, 0xffffffff
je 0x4886fa
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push edi
call esi
cmp eax, 0xffffffff
jne 0x48867c
or ebp, eax
jmp 0x48867e
mov ebp, eax
push 2
push 0
push 0
push edi
call esi
cmp eax, 0xffffffff
jne 0x488690
or ebx, eax
jmp 0x488692
mov ebx, eax
push 0
push 0
push ebp
push edi
call esi
test ebx, ebx
jne 0x4886fa
mov eax, dword [esp + 0x144]
test eax, eax
je 0x4886e0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov dword [esp + 0x138], 0xffffffff
call fcn.005b7d03
or eax, 0xffffffff
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x12c
ret
lea eax, [esp + 0x10]
push 2
push eax
push 0
push edi
mov dword [esp + 0x20], 0xfeff
call fcn.00488200
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x138], 0xffffffff
call fcn.005b7d03
mov eax, edi
jmp 0x4886c7
Function at 0x488f80
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5dac8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x5f1614]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.0046cf80
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.0046f260
mov ecx, dword [eax]
push 0x63061c
push ecx
call fcn.0045417e
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.0046cca0
test edi, edi
je 0x489000
push 0x63061c
mov ecx, esi
call fcn.0046d8e0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret

Function at 0x489160
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5daccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x5f1614]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.0046cf80
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.0046f260
mov ecx, dword [eax]
push 0x63061c
push ecx
call fcn.0045417e
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.0046cca0
test edi, edi
je 0x4891e0
push 0x63061c
mov ecx, esi
call fcn.0046d8e0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret