joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f730
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push eax
call fcn.004ecf28
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x46f751
cmp dword [ebp - 8], 0
jne 0x46f758
xor eax, eax
jmp 0x46f874
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46f770
mov eax, 1
jmp 0x46f874
lea ecx, [ebp - 4]
call fcn.0043ca60
lea ecx, [ebp - 0xc]
call fcn.0043ca60
mov edx, dword [ebp + 8]
push edx
push 0x543de0
lea eax, [ebp - 4]
push eax
call fcn.0043dc90
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.0043cc80
sub eax, 1
push eax
lea ecx, [ebp - 4]
call fcn.00475610
movzx ecx, ax
cmp ecx, 0x5c
je 0x46f7be
push 0x52b638
lea ecx, [ebp - 4]
call fcn.0043e6d0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
push edx
push 0x5c
lea ecx, [ebp - 4]
call fcn.004754f0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x46f85a
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 4]
call fcn.00475580
push eax
lea ecx, [ebp - 0xc]
call fcn.0043cb00
lea ecx, [ebp - 0x14]
call fcn.0043cae0
lea ecx, [ebp - 0xc]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46f841
push 0
lea ecx, [ebp - 0xc]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46f841
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0xc]
call fcn.0043cae0
lea ecx, [ebp - 4]
call fcn.0043cae0
mov eax, dword [ebp - 0x18]
jmp 0x46f874
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0x5c
lea ecx, [ebp - 4]
call fcn.004754f0
mov dword [ebp - 0x10], eax
jmp 0x46f7d6
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0xc]
call fcn.0043cae0
lea ecx, [ebp - 4]
call fcn.0043cae0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x46f8d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov eax, dword [0x55b48c]
and eax, 1
jne 0x46f913
mov ecx, dword [0x55b48c]
or ecx, 1
mov dword [0x55b48c], ecx
mov ecx, 0x55b470
call fcn.004752b0
push 0x5255b0
call fcn.004ed5bf
add esp, 4
mov ecx, 0x55b470
call fcn.00475370
movzx edx, al
test edx, edx
jne 0x46f938
push 0x55b470
mov ecx, dword [ebp + 8]
call fcn.00475300
xor eax, eax
jmp 0x46fac9
xor eax, eax
mov word [ebp - 0x248], ax
push 0x206
push 0
lea ecx, [ebp - 0x246]
push ecx
call fcn.004ed5e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x248]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x248]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x46f994
mov eax, 0xfffffffe
jmp 0x46fac9
mov edx, dword [ebp - 0x24c]
push edx
call fcn.004e68e6
add esp, 4
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46f9c2
mov eax, 0xfffffffd
jmp 0x46fac9
mov ecx, dword [ebp - 0x24c]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.004ed5e0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
push 0
lea edx, [ebp - 0x248]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
push 0x52b638
mov edx, dword [ebp - 0xc]
push edx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 4], cx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0xc]
and eax, 0xffff
mov word [ebp - 0x40], ax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
mov word [ebp - 0x10], dx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 8]
and ecx, 0xffff
mov word [ebp - 8], cx
lea ecx, [ebp - 0x34]
call fcn.004759e0
movzx edx, word [ebp - 0x40]
push edx
movzx eax, word [ebp - 4]
push eax
movzx ecx, word [ebp - 8]
push ecx
movzx edx, word [ebp - 0x10]
push edx
push 0x52b6b8
lea eax, [ebp - 0x34]
push eax
call fcn.00475a00
add esp, 0x18
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00475300
lea edx, [ebp - 0x34]
push edx
mov ecx, 0x55b470
call fcn.00475300
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x254]
push ecx
call fcn.004ecc45
add esp, 4
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x258], 0
lea ecx, [ebp - 0x34]
call fcn.0046fae0
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x46fb00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x46fb2d
cmp dword [ebp + 0x10], 0
jne 0x46fb39
mov dword [ebp - 8], 0xfffffffd
jmp 0x46fbf1
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46fb67
mov dword [ebp - 8], 0xffffffff
jmp 0x46fbf1
mov dword [ebp - 0x10], 0x200
mov byte [ebp - 0x218], 0
push 0x1ff
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.004ed5e0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46fbba
mov dword [ebp - 8], 0xfffffffe
jmp 0x46fbf1
lea edx, [ebp - 0x218]
push edx
call fcn.004ee2e0
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 4
jne 0x46fbe9
cmp dword [ebp - 0x14], 0
jb 0x46fbe9
cmp dword [ebp - 0x14], 4
ja 0x46fbe9
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x218]
mov dword [eax], ecx
xor edx, edx
jne 0x46fb21
cmp dword [ebp - 4], 0
je 0x46fc01
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret

Function at 0x46fc20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x46fc4d
cmp dword [ebp + 0x10], 0
jne 0x46fc59
mov dword [ebp - 8], 0xfffffffd
jmp 0x46fcee
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46fc84
mov dword [ebp - 8], 0xffffffff
jmp 0x46fcee
mov dword [ebp - 0x10], 0x400
mov byte [ebp - 0x418], 0
push 0x3ff
push 0
lea eax, [ebp - 0x417]
push eax
call fcn.004ed5e0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x418]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46fcd7
mov dword [ebp - 8], 0xfffffffe
jmp 0x46fcee
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.00475320
xor eax, eax
jne 0x46fc41
cmp dword [ebp - 4], 0
je 0x46fcfe
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x46fd10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x46fd30
cmp dword [ebp + 0x10], 0
jne 0x46fd3c
mov dword [ebp - 8], 0xfffffffd
jmp 0x46fdc3
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46fd91
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46fd91
mov dword [ebp - 8], 0xffffffff
jmp 0x46fdc3
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46fdbb
mov dword [ebp - 8], 0xfffffffe
jmp 0x46fdc3
xor eax, eax
jne 0x46fd24
cmp dword [ebp - 4], 0
je 0x46fdd3
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x46fde0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x46fdfd
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x46fe04
xor eax, eax
jmp 0x46ff01
cmp dword [ebp + 0x10], 0
jne 0x46fe11
xor eax, eax
jmp 0x46ff01
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x46fe3a
xor eax, eax
jmp 0x46ff01
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa00000
jb 0x46fe59
xor eax, eax
jmp 0x46ff01
mov dword [ebp - 0x14], str.D5812D5A_29E3_4499_AAFB_8CB37748B969_safeid3.0
cmp dword [ebp + 0xc], 0
je 0x46fe6c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004ee2e0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
push eax
call fcn.004e68e6
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x46fef4
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.004eeb20
add esp, 8
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0046efc0
add esp, 0xc
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.004ecc45
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x46ffc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 0x1000
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop ebp
ret 4

Function at 0x46fff0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
shr ecx, 8
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0x80000000
jae 0x470043
cmp dword [ebp - 0xc], 6
jb 0x470043
mov al, 1
jmp 0x470045
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x473500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x18

Function at 0x4750d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x47518d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x475103
xor eax, eax
jmp 0x4751bb
push str.HttpInit
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push str.HttpUninit
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
push str.zlib_uncompress
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
push str.zlib_compress
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
push str.zlib_compressBound
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x47518d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
call ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x4751b1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x4751b1
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x4751b1
mov dword [ebp - 8], 1
jmp 0x4751b8
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x480f30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x78], ecx
push 0
mov ecx, dword [ebp - 0x78]
call fcn.00481130
push 0
mov ecx, dword [ebp - 0x78]
add ecx, 4
call fcn.00481130
push 0
mov ecx, dword [ebp - 0x78]
add ecx, 8
call fcn.00481130
push 0
mov ecx, dword [ebp - 0x78]
add ecx, 0xc
call fcn.00481130
push 0
mov ecx, dword [ebp - 0x78]
add ecx, 0x10
call fcn.00481130
push 0
mov ecx, dword [ebp - 0x78]
add ecx, 0x14
call fcn.00481130
push 0
mov ecx, dword [ebp - 0x78]
add ecx, 0x18
call fcn.00481130
push 0
mov ecx, dword [ebp - 0x78]
add ecx, 0x1c
call fcn.00481130
mov eax, dword [ebp - 0x78]
mov dword [0x55b46c], eax
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea ecx, [ebp - 0x70]
call fcn.00474fc0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
movzx edx, cx
and edx, 0xff
movzx eax, dl
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
movzx edx, cx
shr edx, 8
and edx, 0xff
movzx eax, dl
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0x80000000
jae 0x481048
cmp dword [ebp - 0x74], 5
jne 0x48101e
push 0x52b354
push 0x40
lea ecx, [ebp - 0x54]
push ecx
call fcn.00467950
jmp 0x481046
cmp dword [ebp - 0x74], 6
jne 0x481036
push 0x52b364
push 0x40
lea edx, [ebp - 0x54]
push edx
call fcn.00467950
jmp 0x481046
push 0x52b354
push 0x40
lea eax, [ebp - 0x54]
push eax
call fcn.00467950
jmp 0x481058
push 0x52b354
push 0x40
lea ecx, [ebp - 0x54]
push ecx
call fcn.00467950
mov dword [ebp - 0x70], 0xfffffff5
lea edx, [ebp - 0x70]
push edx
mov ecx, dword [ebp - 0x78]
call fcn.004759b0
lea ecx, [ebp - 0x70]
call fcn.00474fe0
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x78]
add ecx, 4
call fcn.004759b0
mov dword [ebp - 0x60], 0x190
mov dword [ebp - 0x70], 0xfffffff4
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [ebp - 0x78]
add ecx, 8
call fcn.004759b0
lea ecx, [ebp - 0x70]
call fcn.00474fe0
lea edx, [ebp - 0x70]
push edx
mov ecx, dword [ebp - 0x78]
add ecx, 0xc
call fcn.004759b0
mov dword [ebp - 0x60], 0x190
mov dword [ebp - 0x70], 0xfffffff3
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x78]
add ecx, 0x10
call fcn.004759b0
lea ecx, [ebp - 0x70]
call fcn.00474fe0
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [ebp - 0x78]
add ecx, 0x14
call fcn.004759b0
mov dword [ebp - 0x60], 0x190
mov dword [ebp - 0x70], 0xfffffff0
lea edx, [ebp - 0x70]
push edx
mov ecx, dword [ebp - 0x78]
add ecx, 0x18
call fcn.004759b0
lea ecx, [ebp - 0x70]
call fcn.00474fe0
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x78]
add ecx, 0x1c
call fcn.004759b0
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x481c60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.MUTEX_NEWCENTERSOM
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x481c80
xor eax, eax
jmp 0x481c96
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x481c91
xor eax, eax
jmp 0x481c96
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x483680
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00483a30
add esp, 4
test eax, eax
je 0x48369b
mov eax, 1
jmp 0x4836db
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4836ad
xor eax, eax
jmp 0x4836db
push 1
call fcn.004836e0
push eax
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 4]
call fcn.00451b10
mov ecx, eax
call fcn.00451b40
push eax
call fcn.004836f0
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.00451b30
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x483900
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x820], 0x400
xor eax, eax
mov word [ebp - 0x808], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.004ed5e0
add esp, 0xc
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x814], 0x800
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x80c]
push ecx
push 0x527060
push 0x526fe0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
je 0x483993
mov eax, 1
jmp 0x483a1a
push 0x52c37c
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4839c4
mov eax, 1
jmp 0x483a1a
lea edx, [ebp - 0x808]
push edx
call fcn.00483b50
add esp, 4
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jne 0x4839e9
mov eax, 1
jmp 0x483a1a
push str.IsBetaVersion
mov eax, dword [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
call dword [ebp - 4]
mov dword [ebp - 0x818], eax
mov ecx, dword [ebp - 0x81c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x818]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x483ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x483eb8
cmp dword [ebp + 0x10], 0
je 0x483eb8
cmp dword [ebp + 0x14], 0
jne 0x483ecd
push 0x543764
mov ecx, dword [ebp + 8]
call fcn.0043caa0
mov eax, dword [ebp + 8]
jmp 0x483f81
push 0x543764
lea ecx, [ebp - 0x10]
call fcn.0043caa0
mov dword [ebp - 0xc], 0x800
mov dword [ebp - 8], 1
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e68e6
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x483f6a
mov ecx, dword [ebp - 0xc]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.004ed5e0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043cb20
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004e9596
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.0043ca80
lea ecx, [ebp - 0x10]
call fcn.0043cae0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x486ec0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
lea ecx, [ebp + 8]
call fcn.0043cc80
test eax, eax
jle 0x486edb
cmp dword [ebp + 0x10], 0
jge 0x486efa
mov dword [ebp - 0x18], 0
lea ecx, [ebp + 8]
call fcn.0043cae0
lea ecx, [ebp + 0xc]
call fcn.0043cae0
mov eax, dword [ebp - 0x18]
jmp 0x4870f0
lea ecx, [ebp - 8]
call fcn.0043ca60
lea ecx, [ebp - 4]
call fcn.0043ca60
mov eax, dword [ebp + 0x10]
push eax
push str.look_
push 0x52c4b8
lea ecx, [ebp - 4]
push ecx
call fcn.0043dc90
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.0043ca60
mov edx, dword [ebp + 0x10]
push edx
push str.show_
push str._s_d
lea eax, [ebp - 0xc]
push eax
call fcn.0043dc90
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.0043ca60
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x52c4dc
lea eax, [ebp - 0x10]
push eax
call fcn.0043dc90
add esp, 0x10
push ecx
mov ecx, esp
push str..ini
call fcn.0043caa0
push ecx
mov ecx, esp
push str.taskprivstatus
call fcn.0043caa0
push ecx
mov ecx, esp
lea edx, [ebp - 0x10]
push edx
call fcn.0043ca80
lea eax, [ebp - 8]
push eax
call fcn.0046f030
add esp, 0x10
test eax, eax
je 0x4870b6
lea ecx, [ebp - 8]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x486fea
lea ecx, [ebp - 8]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
and ecx, 1
je 0x486fea
mov edx, dword [ebp - 0x14]
and edx, 0xfffffffe
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp + 0x14], 0
je 0x487036
lea ecx, [ebp - 8]
call fcn.0043cc50
push eax
push 0x52c514
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
push 0x52c518
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 8]
call fcn.0043cc50
push eax
push 0x52c520
lea ecx, [ebp - 0xc]
call fcn.0043cc50
push eax
push 0x52c524
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x48707a
lea ecx, [ebp - 8]
call fcn.0043cc50
push eax
push 0x52c52c
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
push 0x52c530
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 8]
call fcn.0043cc50
push eax
push 0x52c538
lea ecx, [ebp - 0xc]
call fcn.0043cc50
push eax
push 0x52c53c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x28], 1
lea ecx, [ebp - 0x10]
call fcn.0043cae0
lea ecx, [ebp - 0xc]
call fcn.0043cae0
lea ecx, [ebp - 4]
call fcn.0043cae0
lea ecx, [ebp - 8]
call fcn.0043cae0
lea ecx, [ebp + 8]
call fcn.0043cae0
lea ecx, [ebp + 0xc]
call fcn.0043cae0
mov eax, dword [ebp - 0x28]
jmp 0x4870f0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x10]
call fcn.0043cae0
lea ecx, [ebp - 0xc]
call fcn.0043cae0
lea ecx, [ebp - 4]
call fcn.0043cae0
lea ecx, [ebp - 8]
call fcn.0043cae0
lea ecx, [ebp + 8]
call fcn.0043cae0
lea ecx, [ebp + 0xc]
call fcn.0043cae0
mov eax, dword [ebp - 0x2c]
mov esp, ebp
pop ebp
ret 0x10