joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489538
Capabilities:
Read file on windows

Disassembly:
push 0x24
mov eax, 0x50a3da
call fcn.004cea03
mov edi, ecx
xor eax, eax
cmp dword [edi + 0x9c], eax
jg 0x4896ed
mov ecx, dword [edi + 0xc]
add ecx, dword [edi + 0x58]
mov dword [ebp - 0x30], ecx
adc eax, dword [edi + 0x5c]
xor ebx, ebx
push ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push ecx
push dword [edi + 0x84]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x48959b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [edi + 0x60]
mov ecx, edi
push eax
push 0x103
call fcn.00489edd
push 2
pop eax
jmp 0x4896ed
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
cmp dword [edi + 8], 0
mov dword [ebp - 0x18], ebx
jbe 0x4896dc
push 2
pop ebx
push 0
lea eax, [ebp - 0x14]
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push dword [edi + 0x84]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4896c5
cmp dword [ebp - 0x14], 0
je 0x4896c5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00406bd2
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
test esi, esi
je 0x489607
push esi
call fcn.004ce497
and dword [ebp - 0x10], 0
pop ecx
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
inc eax
push eax
call fcn.004822c3
mov esi, dword [ebp - 0x10]
test al, al
je 0x4896b0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push esi
push dword [edi + 0x84]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x489697
cmp dword [ebp - 0x14], 0
je 0x489697
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov word [esi + eax*2], cx
test esi, esi
jne 0x489653
xor eax, eax
jmp 0x48965a
push esi
call fcn.004d3ded
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00409e0a
lea eax, [ebp - 0x28]
push eax
lea ecx, [edi + 0x98]
call fcn.0048a628
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.004068c3
mov eax, dword [ebp - 0x18]
inc eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x18], eax
cmp eax, dword [edi + 8]
jb 0x4895b9
xor ebx, ebx
jmp 0x4896dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [edi + 0x60]
mov ecx, edi
push eax
push 0x103
call fcn.00489edd
jmp 0x4896b3
push 3
pop ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.004068c3
mov byte [ebp - 4], 0
jmp 0x4896dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [edi + 0x60]
mov ecx, edi
push eax
push 0x103
call fcn.00489edd
or dword [ebp - 4], 0xffffffff
push esi
call fcn.004ce497
and dword [ebp - 0x10], 0
mov eax, ebx
pop ecx
call fcn.004ce9cc
ret

Function at 0x48a5d0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0xe4], edi
jle 0x48a5fd
push ebx
push edi
lea ecx, [esi + 0xe0]
call fcn.00406560
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0xe4]
jl 0x48a5df
pop ebx
pop edi
lea ecx, [esi + 0xe0]
pop esi
jmp fcn.00454aaf
Function at 0x48a9ae
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a682
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x56d078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x2c], 0
je 0x48a9e6
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esi + 0xc]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x48aa3d
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ebx, str.SoftwareCaphyonSetups
push ebx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp dword [ebp - 0x10], 0
je 0x48aa3d
push dword [edi]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea ecx, [ebp - 0x14]
call fcn.00409ea5
lea edx, [ebp - 0x14]
call fcn.00490015
lea ecx, [ebp - 0x14]
call fcn.004068c3
lea ecx, [esi + 0x1c]
call fcn.00406cdf
lea ecx, [esi + 0x10]
call fcn.00406cdf
mov ecx, edi
call fcn.004068c3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48aca6
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x56d078]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
cmp dword [eax - 0xc], 0
je 0x48ad38
push 0x104
lea eax, [ebp - 0x7c]
push eax
push dword [0x5723f0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x48ad38
push esi
lea esi, [eax + eax]
cmp esi, 0x208
jae 0x48ad4e
xor eax, eax
and dword [ebp - 0x80], eax
mov word [ebp + esi - 0x7c], ax
lea eax, [ebp - 0x80]
push eax
push str.SoftwareCaphyonSetups
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp dword [ebp - 0x80], 0
je 0x48ad37
lea eax, [esi + 2]
push eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push dword [edi + 0xc]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop edi
call fcn.004cde67
lea esp, [ebp + 0x190]
pop ebp
ret
call fcn.004ce683
int3
Function at 0x48ae7b
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x4c
mov eax, dword [0x56d078]
xor eax, esp
mov dword [esp + 0x48], eax
movaps xmm0, xmmword [0x53c7a0]
and dword [esp + 8], 0
and dword [esp + 4], 0
push ebx
push ebp
push esi
movups xmmword [esp + 0x34], xmm0
mov ebx, ecx
mov byte [esp + 0xf], dl
movaps xmm0, xmmword [0x53c7a0]
push edi
movups xmmword [esp + 0x48], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push str.kernel32.dll
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetSystemDefaultUILanguage
push esi
call edi
test eax, eax
je 0x48aef7
call eax
movzx eax, ax
mov dword [esp + 0x14], eax
push str.GetUserDefaultUILanguage
push esi
call edi
test eax, eax
je 0x48af0c
call eax
movzx eax, ax
mov dword [esp + 0x18], eax
mov edi, dword [ebx + 4]
xor esi, esi
push 8
pop ebp
test edi, edi
jle 0x48b010
mov dword [esp + 0x34], 4
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x2c], 0x14
mov dword [esp + 0x28], 0x1c
mov dword [esp + 0x30], 0x18
push esi
mov ecx, ebx
call fcn.00406cb8
mov dl, byte [esp + 0x13]
movzx ecx, word [eax]
mov eax, dword [esp + 0x1c]
cmp cx, ax
jne 0x48af6e
push 4
test dl, dl
pop eax
cmovne eax, dword [esp + 0x24]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x1c]
cmp cl, al
jne 0x48af80
push 0x14
test dl, dl
pop eax
cmovne eax, dword [esp + 0x28]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x20]
cmp cx, ax
jne 0x48af9e
push 0xc
xor ebp, ebp
test dl, dl
pop eax
cmovne eax, ebp
push 8
pop ebp
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x20]
cmp cl, al
jne 0x48afb0
push 0x1c
test dl, dl
pop eax
cmovne eax, dword [esp + 0x2c]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x14]
cmp cx, ax
jne 0x48afc8
xor eax, eax
test dl, dl
cmovne eax, ebp
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x14]
cmp cl, al
jne 0x48afda
push 0x10
test dl, dl
pop eax
cmovne eax, dword [esp + 0x30]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x18]
cmp cx, ax
jne 0x48aff4
test dl, dl
mov eax, ebp
cmovne eax, dword [esp + 0x34]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x18]
cmp cl, al
jne 0x48b007
push 0x18
pop eax
push 0x10
test dl, dl
pop ecx
cmovne eax, ecx
mov dword [esp + eax + 0x38], esi
inc esi
cmp esi, edi
jl 0x48af44
xor eax, eax
mov edx, dword [esp + eax*4 + 0x38]
test edx, edx
jns 0x48b023
inc eax
cmp eax, ebp
jb 0x48b012
push 0
jmp 0x48b024
push edx
mov ecx, ebx
call fcn.00406cb8
mov ecx, dword [esp + 0x58]
pop edi
pop esi
mov ax, word [eax]
pop ebp
pop ebx
xor ecx, esp
call fcn.004cde67
add esp, 0x4c
ret
Function at 0x48b0cf
Capabilities:
Get geographical location

Disassembly:
push 0x14
mov eax, 0x50a764
call fcn.004cea03
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.00406bd2
push 0
push 0x524ee8
mov dword [ebp - 4], ebx
push 2
movzx ebx, di
push ebx
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x18], eax
lea ecx, [eax - 1]
push ecx
push 0x78
lea ecx, [ebp - 0x10]
call fcn.0044637b
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx - 4], eax
jle 0x48b139
push dword [ecx - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00406708
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x18]
push ecx
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push dword [ebp - 0x10]
push edi
push str._d__s
push esi
call fcn.00407aa5
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004068c3
mov eax, esi
call fcn.004ce9cc
ret

Function at 0x48b406
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
mov eax, dword [0x56d078]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
push esi
mov ebp, ecx
push 2
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
xorps xmm0, xmm0
lea eax, [esp + 0x1c]
push eax
push esi
movups xmmword [esp + 0x24], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
cmp byte [ebp + 0x2c], al
push 5
pop ecx
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x3e9
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0xc]
mov dword [esp + 8], eax
push ecx
xorps xmm0, xmm0
push eax
movups xmmword [esp + 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp + 0x30], 0
jne 0x48b48a
mov eax, dword [esp + 0x14]
mov dword [ebp + 0x30], eax
cmp byte [ebp + 0x2c], 0
je 0x48b495
mov eax, dword [ebp + 0x30]
jmp 0x48b499
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 0x206
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.004062bc
mov ecx, dword [esp + 0x2c]
pop esi
pop ebp
xor ecx, esp
call fcn.004cde67
add esp, 0x2c
ret
Function at 0x48b6a3
Capabilities:
Terminate thread

Disassembly:
push 0x18
mov eax, 0x50a7f0
call fcn.004cea03
mov eax, dword [ebp + 8]
xor edi, edi
or dword [ebp - 0x1c], 0xffffffff
mov esi, 0x535be0
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
push edi
push edi
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.0049a61d
mov ecx, dword [ebp - 0x20]
call fcn.0048b514
mov dword [ebp - 4], 1
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x20], edi
je 0x48b733
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x1c], 0xffffffff
je 0x48b72a
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x48b72a
cmp dword [ebp + 8], 0x103
jne 0x48b72a
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004ce9cc
ret 4
Function at 0x48c61a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x56d078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.0048fcc8
test al, al
jne 0x48c6fd
push str.ProgramFilesFolder
mov ecx, edi
call fcn.0044808a
mov esi, str.AppDataFolder
test eax, eax
je 0x48c673
mov edx, str.ProgramFiles
mov ecx, edi
call fcn.0048c715
test al, al
jne 0x48c673
push esi
mov ecx, edi
call fcn.0044808a
test eax, eax
jne 0x48c6fd
push esi
mov ecx, edi
call fcn.0044808a
neg eax
mov ecx, str.PROGRAMFILES
push 0
sbb al, al
add al, 1
pop eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
mov eax, str.APPDATA
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x48c6bd
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x210], ax
inc esi
lea eax, [esi + esi]
cmp eax, 0x208
jae 0x48c70f
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
cmp word [ebp - 0x210], cx
je 0x48c6f6
lea eax, [ebp - 0x210]
push eax
call fcn.004d3ded
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.00409e0a
test esi, esi
setne al
jmp 0x48c6ff
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004cde67
mov esp, ebp
pop ebp
ret
call fcn.004ce683
int3

Function at 0x48c75e
Capabilities:
Read file on windows

Disassembly:
push 0x18
mov eax, 0x50aa04
call fcn.004cea03
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x48c77f
xor eax, eax
jmp 0x48c848
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
and dword [ebp - 0x20], 0
mov edi, eax
mov dword [ebp - 0x24], edi
and dword [ebp - 4], 0
push 2
pop esi
cmp edi, 0xffffffff
je 0x48c833
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
add eax, esi
and dword [ebp - 0x18], 0
sub ebx, esi
push 0
push ecx
push eax
push edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x48c833
mov eax, ebx
lea ecx, [ebp + 8]
shr eax, 1
push eax
push 0x78
call fcn.0044637b
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x48c7ff
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00406708
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48c827
cmp dword [ebp - 0x10], 0
je 0x48c827
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
call fcn.00495add
movzx esi, al
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.004068c3
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x48c846
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x24], 0
mov eax, esi
call fcn.004ce9cc
ret 0xc
Function at 0x48eab6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov edi, edx
push eax
lea eax, [ebp - 8]
mov ebx, ecx
push eax
push 0
push dword [edi]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x48eb1c
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
call fcn.00406807
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
mov esi, dword [edi]
push eax
call fcn.00407a8e
push eax
lea eax, [ebp - 8]
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0xffffffffffffffff
call fcn.00406864
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48eb2a
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x294
mov eax, 0x50b139
call fcn.004cea37
mov esi, ecx
mov dword [ebp - 0x294], esi
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x290], edi
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004737f0
lea ecx, [ebp - 0x288]
call fcn.00406bd2
lea eax, [ebp - 0x288]
xor ebx, ebx
push eax
push dword [ebp - 0x28c]
inc ebx
lea eax, [ebp + 8]
push ecx
mov byte [ebp - 4], bl
mov ecx, esp
mov dword [ebp - 0x27c], esp
push eax
call fcn.004071c5
mov byte [ebp - 4], 2
mov byte [ebp - 4], bl
call fcn.0048ed85
test al, al
je 0x48ebec
push ecx
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x24]
call fcn.00469a90
push ecx
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00469d20
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00471ac0
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], bl
call fcn.004068c3
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.0048ee8b
test al, al
je 0x48ebec
xor ebx, ebx
jmp 0x48ebf3
mov esi, dword [ebp + 0xc]
cmp esi, ebx
jge 0x48ebfa
mov esi, ebx
jmp 0x48ed2e
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x280]
call fcn.004071c5
push 0x52f428
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 4
call fcn.004070ba
mov eax, dword [ebp - 0x280]
cmp dword [eax - 4], ebx
jle 0x48ec3c
push dword [eax - 0xc]
lea ecx, [ebp - 0x280]
call fcn.00406708
mov eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x278]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
and dword [ebp - 0x298], 0
mov edi, eax
mov dword [ebp - 0x29c], edi
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp edi, 0xffffffff
setne al
test al, al
je 0x48ed08
lea ecx, [ebp - 0x278]
call fcn.0048ed5c
test al, al
je 0x48eced
lea eax, [ebp - 0x24c]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x27c]
call fcn.00452644
pop ecx
push dword [ebp - 0x290]
lea eax, [esi - 1]
mov byte [ebp - 4], 6
push dword [ebp - 0x28c]
push eax
push ecx
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x2a0], esp
mov ecx, esp
push eax
call fcn.004071c5
mov ecx, dword [ebp - 0x294]
mov byte [ebp - 4], 7
mov byte [ebp - 4], 6
call fcn.0048eb2a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x27c]
test eax, eax
je 0x48ed53
call fcn.004068c3
lea eax, [ebp - 0x278]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
dec eax
neg eax
sbb al, al
add al, 1
jne 0x48ec79
mov esi, ebx
mov byte [ebp - 4], 4
test edi, edi
je 0x48ed20
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [ebp - 0x29c], 0
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], bl
call fcn.004068c3
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0
call fcn.004068c3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004068c3
mov eax, esi
call fcn.004ce9e1
ret 0x10
call fcn.004068c3
xor esi, esi
jmp 0x48ed0a
Function at 0x48efbb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x50b21e
call fcn.004cea03
cmp byte [ebp + 0x10], 0
mov ecx, dword [ebp + 8]
jne 0x48f00e
mov dl, byte [ebp + 0xc]
call fcn.0048ef39
xor esi, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
cmp byte [ebp + 0x14], 0
mov dword [ebp - 4], esi
je 0x48eff0
test eax, eax
setne bl
jmp 0x48eff5
test eax, eax
sete bl
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x48f007
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], esi
mov al, bl
jmp 0x48f0c6
push 0x5c
push dword [ecx]
call fcn.004d18c5
pop ecx
pop ecx
mov edi, eax
push 3
pop ebx
test edi, edi
je 0x48f0b4
mov eax, dword [ebp + 8]
sub edi, dword [eax]
sar edi, 1
js 0x48f0b4
push edi
xor esi, esi
lea ecx, [ebp + 0x10]
push esi
push ecx
mov ecx, eax
call fcn.00447ff5
mov dword [ebp - 4], 1
lea ecx, [ebp + 0x10]
mov dl, byte [ebp + 0xc]
call fcn.0048ef39
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 2
test eax, eax
je 0x48f096
mov ecx, dword [ebp + 8]
lea edx, [edi + 1]
push edx
lea eax, [ebp + 0xc]
push eax
call fcn.00447e2c
push esi
push esi
push esi
push esi
mov byte [ebp - 4], bl
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
mov ebx, eax
call fcn.004068c3
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
test eax, eax
je 0x48f0a8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004068c3
cmp byte [ebp + 0x14], 0
je 0x48f0c1
test ebx, ebx
sete al
jmp 0x48f0c6
test ebx, ebx
setne al
call fcn.004ce9cc
ret 0x10
Function at 0x48f5a0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x424
mov eax, dword [0x56d078]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push ebp
push esi
push edi
test ecx, ecx
jne 0x48f5c3
xor al, al
jmp 0x48f6cb
movzx edx, word [ecx]
lea esi, [esp + 0x28]
push 2
pop ebp
test dx, dx
je 0x48f5e6
mov eax, esi
sub ecx, eax
mov word [esi], dx
add esi, ebp
movzx eax, word [ecx + esi]
mov edx, eax
test ax, ax
jne 0x48f5d6
xor eax, eax
xor cl, cl
mov word [esi], ax
sub esi, ebp
push 0x5c
xor al, al
pop edx
mov byte [esp + 0x17], al
cmp word [esp + 0x28], dx
jne 0x48f615
cmp word [esp + 0x2a], dx
jne 0x48f615
xor ebx, ebx
inc ebx
cmp word [esi], dx
mov byte [esp + 0x17], bl
setne cl
jmp 0x48f621
xor ebx, ebx
movzx eax, al
inc ebx
cmp word [esi], dx
cmove eax, ebx
lea edi, [esp + 0x2c]
cmp word [esp + 0x2c], dx
je 0x48f633
add edi, ebp
cmp word [edi], dx
jne 0x48f62c
test cl, cl
jne 0x48f63d
test al, al
je 0x48f64b
jmp 0x48f644
add esi, ebp
mov word [esi], dx
add esi, ebp
xor eax, eax
mov word [esi], ax
sub esi, ebp
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
lea eax, [esp + 0x20]
push eax
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x48f6ab
push 0x5c
pop ecx
cmp word [esi], cx
lea eax, [esi - 2]
cmovne eax, esi
mov esi, eax
jmp 0x48f685
cmp word [esi], cx
je 0x48f68d
sub esi, ebp
lea eax, [esp + 0x28]
cmp esi, eax
ja 0x48f67e
cmp esi, edi
jb 0x48f5bc
cmp byte [esp + 0x17], 0
jne 0x48f6a0
cmp esi, edi
jne 0x48f6a2
add esi, ebp
xor eax, eax
mov word [esi], ax
sub esi, ebp
jmp 0x48f654
mov eax, dword [esp + 0x43c]
cmp eax, dword [esp + 0x1c]
ja 0x48f6c7
jb 0x48f6c9
mov eax, dword [esp + 0x438]
cmp eax, dword [esp + 0x18]
jb 0x48f6c9
xor ebx, ebx
mov al, bl
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cde67
add esp, 0x424
ret