joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4ad6cb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ae730
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4ad6ed
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4ad6ef
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x4ad78e
jg 0x4ad70c
test esi, esi
je 0x4ad78e
test ecx, ecx
jl 0x4ad759
jg 0x4ad716
test eax, eax
je 0x4ad759
cmp ebx, ecx
jg 0x4ad72a
jl 0x4ad720
cmp esi, eax
jae 0x4ad72a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.0053f530
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4ad760
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x4ad78e
jg 0x4ad76a
test esi, esi
je 0x4ad78e
cmp dword [edi + 0x4c], 0
je 0x4ad78e
mov ecx, edi
call fcn.004af120
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0055c8df
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4adaa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x60a070]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4adad0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053c439
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4adb0d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4adb0d
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053c439
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x4adbfd
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4adb35
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4adb69
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.005605f3
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053c439
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4adbfd
cmp eax, 1
jle 0x4adbcc
cmp eax, 3
jne 0x4adbfd
mov edx, dword [esi + 0x4c]
mov cl, byte [esp + 0x17]
call fcn.004abe10
or ecx, 0xffffffff
test al, al
pop edi
cmovne ecx, ebx
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053c439
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x4adbeb
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0055c69e
add esp, 0x10
cmp edi, eax
jne 0x4adbfd
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
jne 0x4adaf7
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0053c439
add esp, 0x30
ret 4
Function at 0x4b5860
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aba4b
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x60a070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x4b5899
call fcn.004b5ab0
cmp byte [0x60db34], 0
jne 0x4b58ac
mov eax, 0x80000001
jmp 0x4b59dc
mov eax, dword [esi]
test eax, eax
jne 0x4b592c
push 8
call fcn.0053c458
mov edi, eax
add esp, 4
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], 0
push 1
call fcn.0053c458
add esp, 4
mov dword [edi + 4], eax
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0x118
push 0
push eax
call fcn.00540030
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4b591b
cmp dword [ebp - 0x130], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x4b59cb
call fcn.004ce320
test al, al
jne 0x4b5966
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.004cf520
test al, al
je 0x4b59cb
mov ecx, dword [esi]
add ecx, 4
call fcn.004cdc60
call fcn.004ce320
test al, al
je 0x4b59cb
push str.Advapi32.dll
lea ecx, [ebp - 0x150]
call fcn.00403c00
mov dword [ebp - 4], 2
lea eax, [ebp - 0x150]
push eax
call fcn.004b8560
mov ecx, eax
call fcn.004b8630
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.00403bb0
test edi, edi
je 0x4b59cb
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b59cb
push dword [esi]
push dword [ebp + 8]
call eax
test eax, eax
je 0x4b59cb
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x4b59da
mov dword [eax], SysStringLen
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053c439
mov esp, ebp
pop ebp
ret 4
Function at 0x4b5e00
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x628]
sub esp, 0x628
push 0xffffffffffffffff
push 0x5abbe0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x60a070]
xor eax, ebp
mov dword [ebp + 0x624], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x630]
lea ecx, [ebp - 0x24]
mov ebx, dword [ebp + 0x634]
call fcn.00403c50
mov dword [ebp - 4], 0
mov eax, dword [0x60dc28]
mov dword [ebp], 0
mov dword [ebp], 0x60dc28
test eax, eax
je 0x4b5e74
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x60dc38
call fcn.0040d260
test eax, eax
je 0x4b5eb8
mov ecx, 0x60dc38
call fcn.00404970
lea ecx, [ebp - 0x24]
cmp ecx, eax
je 0x4b5f6d
mov ecx, 0x60dc38
call fcn.00403fa0
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x4b5eaf
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x4b5f65
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.00540030
add esp, 0xc
lea eax, [ebp + 0x418]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4b6009
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 4]
push eax
call fcn.00540030
add esp, 0xc
lea eax, [ebp + 4]
push 0x208
push eax
lea eax, [ebp + 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4b5f4e
test eax, eax
je 0x4b5f4e
add eax, eax
cmp eax, 0x412
jae 0x4b605c
xor ecx, ecx
mov word [ebp + eax + 4], cx
lea eax, [ebp + 4]
push eax
call fcn.00404680
add esp, 4
push eax
lea eax, [ebp + 4]
jmp 0x4b5f64
lea eax, [ebp + 0x418]
push eax
call fcn.00404680
add esp, 4
push eax
lea eax, [ebp + 0x418]
push eax
lea ecx, [ebp - 0x24]
call fcn.004040c0
mov byte [ebp - 4], 0
mov eax, dword [0x60dc28]
test eax, eax
je 0x4b5f81
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp - 0x24]
mov dword [ebp], 0
push eax
mov ecx, esi
call fcn.004b5d80
test al, al
je 0x4b5fa0
mov bl, 1
jmp 0x4b6026
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.00540030
add esp, 0xc
lea eax, [ebp + 0x418]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x4b6024
xor eax, eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 0x418]
push eax
call fcn.00404680
add esp, 4
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp + 0x418]
push eax
call fcn.004040c0
push ebx
push edi
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.004b5d80
mov bl, al
jmp 0x4b6026
mov byte [ebp - 4], 0
mov eax, dword [0x60dc28]
test eax, eax
je 0x4b601d
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00403bb0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x624]
xor ecx, ebp
call fcn.0053c439
lea esp, [ebp + 0x628]
pop ebp
ret 8
call fcn.0053cada
int3
Function at 0x4bd250
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5acaaf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x60a070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00403bb0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00403bb0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00403bb0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00403bb0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00403bb0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00403bb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4bd2e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5acb0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x60a070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00403bb0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00403bb0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00403bb0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00403bb0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00403bb0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00403bb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4bf780
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aceaf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x60a070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0040df40
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.0040df40
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.0040df40
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.0040df40
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.0040df40
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.0040df40
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c28f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad5ef
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x60a070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00403c70
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00403c70
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00403c70
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00403c70
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00403c70
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00403c70
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c4f60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5adcef
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x60a070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00403c50
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00403c50
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00403c50
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00403c50
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00403c50
mov byte [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00403c50
mov byte [ebp - 4], 5
mov byte [esi + 0x60], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c5c80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x60a070]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x4c5d02
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x4c5d02
test ecx, ecx
je 0x4c5cfe
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x4c5cc0
xor eax, eax
jmp 0x4c5d07
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4c5d11
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0053c439
add esp, 0xc
ret 0xc
Function at 0x4ca5a0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x20
mov eax, dword [0x60a070]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x18], ebx
mov eax, dword [esi]
mov byte [esp + 0x13], 0
mov eax, dword [eax + 4]
test eax, eax
je 0x4ca769
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegQueryValueExW
push eax
call ebp
mov dword [esp + 0x28], eax
test eax, eax
je 0x4ca769
mov ecx, dword [esi]
mov dword [esp + 0x1c], 0
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x4ca769
push 0x5d6a8c
push ecx
call ebp
mov dword [esp + 0x20], eax
test eax, eax
je 0x4ca769
test edi, edi
je 0x4ca769
mov ecx, dword [esi]
lea eax, [esp + 0x1c]
push eax
mov ecx, dword [ecx]
or ecx, 0x20019
push ecx
mov ecx, dword [esp + 0x1c]
push 0
call fcn.00403b40
push eax
push edi
call dword [esp + 0x34]
test eax, eax
jne 0x4ca769
mov dword [esp + 0x20], eax
mov ecx, ebx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.00403b40
push eax
push dword [esp + 0x30]
call dword [esp + 0x40]
movzx ebx, byte [esp + 0x13]
test eax, eax
mov ecx, 1
lea eax, [esp + 0x1c]
cmove ebx, ecx
mov ecx, esi
push eax
call fcn.004ca490
test bl, bl
je 0x4ca769
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push dword [esp + 0x18]
mov ecx, esi
push edi
call fcn.004ca0a0
test al, al
je 0x4ca769
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4ca734
mov eax, dword [esi]
mov eax, dword [eax + 4]
test eax, eax
je 0x4ca734
push str.RegQueryValueExW
push eax
call ebp
mov ecx, dword [esi]
push 0x5d6e94
mov dword [esp + 0x24], eax
push dword [ecx + 4]
call ebp
cmp dword [esp + 0x20], 0
mov ebx, eax
je 0x4ca734
test ebx, ebx
je 0x4ca734
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
push 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], 0
push eax
push 0
mov dword [esp + 0x34], 0
call fcn.00403b40
push eax
push edi
call dword [esp + 0x38]
cmp eax, 2
je 0x4ca734
mov ecx, dword [esp + 0x18]
call fcn.00403b40
push eax
push edi
call ebx
test eax, eax
sete bl
jmp 0x4ca736
xor bl, bl
mov eax, dword [esi]
mov eax, dword [eax + 4]
test eax, eax
je 0x4ca752
push 0x5d6ab0
push eax
call ebp
test eax, eax
je 0x4ca752
test edi, edi
je 0x4ca752
push edi
call eax
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0053c439
add esp, 0x20
ret 0xc
mov ecx, dword [esp + 0x2c]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0053c439
add esp, 0x20
ret 0xc
Function at 0x4cd290
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x60a070]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 1
mov esi, ecx
call fcn.0053c458
mov dword [esi], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call fcn.00540030
add esp, 0x10
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4cd2ec
cmp dword [esp + 8], 6
mov ecx, dword [esi]
setae dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.0053c439
add esp, 0x120
ret
Function at 0x4d3520
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x60a070]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4d3583
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4d3583
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d355e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4d3583
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0053c439
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0053c439
add esp, 8
ret 4
Function at 0x4d4110
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5afbd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x60a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
and esi, 0xffffb1af
push esi
call fcn.00403b40
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4d4159
mov al, 1
jmp 0x4d41a1
lea ecx, [ebp - 0x28]
call fcn.00403c50
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004d53c0
test al, al
je 0x4d418e
push esi
lea ecx, [ebp - 0x28]
call fcn.00403b40
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4d418e
mov bl, 1
jmp 0x4d4190
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403bb0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c439
mov esp, ebp
pop ebp
ret

Function at 0x4d41c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5afc08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x60a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00403b40
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d423e
lea ecx, [ebp - 0x28]
call fcn.00403c50
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004d53c0
test al, al
je 0x4d422d
lea ecx, [ebp - 0x28]
call fcn.00403b40
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403bb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c439
mov esp, ebp
pop ebp
ret
Function at 0x4d4840
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5afdb8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x60a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403b40
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x4d4886
mov al, 1
jmp 0x4d49d8
mov ecx, esi
call fcn.00403b40
push eax
lea ecx, [ebp - 0x28]
call fcn.00403c00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004d41c0
mov ebx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403bb0
cmp ebx, 0xffffffff
jne 0x4d48c5
xor al, al
jmp 0x4d49d8
mov ecx, esi
call fcn.00403b40
push eax
lea ecx, [ebp - 0x28]
call fcn.00403c00
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0
call fcn.00403b40
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call ebx
test eax, eax
je 0x4d48f7
xor bl, bl
jmp 0x4d4941
lea ecx, [ebp - 0x40]
call fcn.00403c50
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.004d53c0
test al, al
je 0x4d4933
push 0
lea ecx, [ebp - 0x40]
call fcn.00403b40
push eax
call ebx
test eax, eax
je 0x4d4933
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00403bb0
xor bl, bl
jmp 0x4d4941
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00403bb0
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403bb0
test bl, bl
jne 0x4d48be
mov ecx, esi
call fcn.00403b40
push eax
call edi
test eax, eax
jne 0x4d487f
lea ecx, [ebp - 0x28]
call fcn.00403c50
mov dword [ebp - 4], 3
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004d53c0
test al, al
je 0x4d499a
lea ecx, [ebp - 0x28]
call fcn.00403b40
push eax
call edi
test eax, eax
je 0x4d499a
mov bl, 1
jmp 0x4d49c7
mov ecx, esi
call fcn.00403b40
push eax
lea ecx, [ebp - 0x40]
call fcn.00403c00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
mov edx, dword [ebp - 0x44]
call fcn.004d4110
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00403bb0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403bb0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c439
mov esp, ebp
pop ebp
ret
Function at 0x4d4bd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x60a070]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.00540030
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0
call fcn.00403b40
push eax
mov ecx, edi
call fcn.00403b40
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4d4c65
xor eax, eax
mov word [esp + 0x216], ax
lea eax, [esp + 0xc]
push eax
call fcn.00404680
add esp, 4
mov ecx, ebx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004040c0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0053c439
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0053c439
add esp, 0x210
ret