joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b3ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, edx
call fcn.004a1533
mov edx, eax
mov dword [ebp - 0xc], edx
test edx, edx
js 0x49b57d
mov ebx, dword [ebp + 0x18]
mov eax, 0xff
dec ebx
and ebx, 7
mov ecx, ebx
mov dword [ebp - 0x10], ebx
shl eax, cl
test byte [esi], al
jne 0x49b578
test ebx, ebx
lea ecx, [esi + 1]
lea eax, [edi - 1]
cmovne eax, edi
cmovne ecx, esi
mov esi, eax
mov dword [ebp - 4], ecx
sub esi, edx
mov dword [ebp - 8], eax
sub esi, 1
jns 0x49b452
mov eax, 0xffffff16
jmp 0x49b57d
mov edi, dword [ebp + 0x14]
cmp edi, 0xffffffff
jne 0x49b46f
cmp dword [ebp + 0x18], 0x400
mov edi, edx
jne 0x49b480
cmp edx, 0x40
jne 0x49b480
push 0x3e
pop edi
jmp 0x49b480
cmp edi, edx
jg 0x49b571
cmp edi, 0xffffffff
jl 0x49b571
lea eax, [edi + 1]
cmp esi, eax
jl 0x49b571
mov eax, dword [ebp - 8]
cmp byte [eax + ecx - 1], 0xbc
jne 0x49b578
mov ecx, esi
call fcn.004993e8
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x49b4b1
push 0xffffffffffffff83
pop eax
jmp 0x49b57d
mov edx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 0x10]
push esi
push ebx
push dword [ebp - 0xc]
lea edx, [edx + esi]
call fcn.0049ad27
add esp, 0x10
mov dword [ebp + 0x18], eax
test eax, eax
je 0x49b4d3
mov esi, eax
jmp 0x49b52b
mov ecx, dword [ebp - 0x10]
mov al, 1
mov edx, dword [ebp - 4]
shl al, cl
xor ecx, ecx
dec al
and byte [ebx], al
and byte [edx], al
mov eax, esi
sub eax, edi
mov dword [ebp - 0x18], eax
dec eax
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x49b51c
mov eax, edx
mov dword [ebp + 0x18], ebx
sub dword [ebp + 0x18], edx
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x18]
mov al, byte [edx + eax]
mov edx, dword [ebp - 8]
cmp al, byte [edx]
mov edx, dword [ebp - 4]
jne 0x49b526
mov eax, dword [ebp - 8]
inc ecx
inc eax
mov dword [ebp - 8], eax
cmp ecx, dword [ebp - 0x10]
jl 0x49b4ff
mov al, byte [edx + ecx]
xor al, 1
cmp byte [ecx + ebx], al
je 0x49b536
mov esi, 0xffffff06
mov ecx, ebx
call fcn.004993fd
mov eax, esi
jmp 0x49b57d
inc ecx
cmp ecx, esi
jge 0x49b558
lea eax, [edx + ecx]
mov dword [ebp + 0x18], ebx
sub ebx, edx
mov dword [ebp - 0x10], eax
sub esi, ecx
mov ecx, eax
mov al, byte [ecx + ebx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x49b54a
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.004993fd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
add eax, edi
jmp 0x49b57d
mov eax, 0xffffff06
jmp 0x49b57d
mov eax, 0xffffff3f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49d2c5
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x49d2d6
mov eax, 0xffffff53
pop ebp
ret
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], ecx
mov dword [eax + 0xc8], ecx
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], ecx
xor eax, eax
pop ebp
ret
Function at 0x4a0993
Capabilities:
Hash data using sha224

Disassembly:
test ecx, ecx
jne 0x4a099d
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [ecx], 0xc1059ed8
mov dword [ecx + 4], 0xcbbb9d5d
mov dword [ecx + 8], 0x367cd507
mov dword [ecx + 0xc], 0x629a292a
mov dword [ecx + 0x10], 0x3070dd17
mov dword [ecx + 0x14], 0x9159015a
mov dword [ecx + 0x18], 0xf70e5939
mov dword [ecx + 0x1c], 0x152fecd8
mov dword [ecx + 0x20], 0xffc00b31
mov dword [ecx + 0x24], 0x67332667
mov dword [ecx + 0x28], 0x68581511
mov dword [ecx + 0x2c], 0x8eb44a87
mov dword [ecx + 0x30], 0x64f98fa7
mov dword [ecx + 0x34], 0xdb0c2e0d
mov dword [ecx + 0x38], 0xbefa4fa4
mov dword [ecx + 0x3c], 0x47b5481d
mov dword [ecx + 0xc0], eax
mov dword [ecx + 0xc8], eax
mov dword [ecx + 0xcc], eax
mov dword [ecx + 0xd0], eax
mov dword [ecx + 0xd4], eax
ret

Function at 0x4a0a2d
Capabilities:
Hash data using sha224

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x4a0a56
test edi, edi
je 0x4a0a56
call fcn.004a07c4
test eax, eax
jne 0x4a0a5b
push 0xc
pop ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
pop edi
pop esi
pop ebx
jmp fcn.004a0993
mov eax, 0xffffff53
pop edi
pop esi
pop ebx
ret

Function at 0x4a10de
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
mov dword [ebp - 4], esi
push edi
mov edi, ecx
test ebx, ebx
je 0x4a10f6
and dword [ebx], 0
test edi, edi
je 0x4a1206
test esi, esi
je 0x4a1206
push 0x278
push 0
push edi
call fcn.004cd440
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4a1119
sub esi, ecx
mov ecx, 0xfd
cmp esi, ecx
jg 0x4a11ff
push ecx
push dword [ebp - 4]
lea eax, [edi + 0x178]
push eax
call fcn.004dbc00
mov eax, 0x100
lea ecx, [edi + 0x178]
sub eax, esi
add ecx, esi
push eax
push 0x526914
push ecx
call fcn.004dbc00
add esp, 0x18
lea eax, [edi + 0x178]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [edi + 0x140], eax
cmp eax, 0xffffffff
je 0x4a11ff
test byte [edi], 0x10
je 0x4a119c
push edi
push dword [edi + 0x140]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4a117a
mov ecx, edi
call fcn.004a12f2
or eax, 0xffffffff
jmp 0x4a120b
lea ecx, [edi + 0x2c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a11a2
sub ecx, edx
lea eax, [esi + 2]
add eax, ecx
cmp eax, 0x100
jg 0x4a11ff
lea eax, [esi + 1]
push eax
push dword [ebp - 4]
lea eax, [edi + 0x178]
push eax
call fcn.004dbc00
mov eax, 0xff
mov byte [esi + edi + 0x178], 0x5c
sub eax, esi
push eax
lea eax, [edi + 0x2c]
push eax
lea eax, [edi + 0x179]
add eax, esi
push eax
call fcn.004dbc00
add esp, 0x18
test ebx, ebx
je 0x4a11fb
lea eax, [edi + 0x178]
mov dword [ebx], eax
xor eax, eax
jmp 0x4a120b
mov eax, 0xffffff0c
jmp 0x4a120b
mov eax, 0xffffff53
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a137c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, edx
mov esi, ecx
neg eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
test esi, esi
je 0x4a1433
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4a1433
mov edx, dword [esi]
mov ecx, ebx
inc edx
call fcn.00494998
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4a1438
push edi
mov edi, dword [esi]
xor edx, edx
test edi, edi
jle 0x4a13ea
mov edi, dword [ebx + 0xc]
mov ecx, esi
call fcn.004a1366
mov ecx, ebx
mov esi, eax
call fcn.004a1366
mov ecx, dword [ebp - 4]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
mov esi, dword [ebp - 8]
mov edi, dword [esi]
cmp edx, edi
jl 0x4a13c1
jmp 0x4a13ed
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
cmp edx, eax
jge 0x4a141c
mov edi, dword [ebx + 0xc]
mov ecx, esi
call fcn.004a1366
mov ecx, ebx
mov esi, eax
call fcn.004a1366
mov ecx, dword [ebp - 4]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
mov eax, dword [ebx]
mov esi, dword [ebp - 8]
cmp edx, eax
jl 0x4a13f3
mov edi, dword [esi]
xor eax, edi
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esi + 8]
xor eax, dword [ebx + 8]
and eax, ecx
xor dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
pop edi
jmp 0x4a1438
mov eax, 0xffffff53
pop esi
pop ebx
leave
ret
Function at 0x4a1c11
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
push ebx
push esi
push edi
test ecx, ecx
je 0x4a1e4b
cmp dword [ebp + 8], 0
mov esi, dword [ebp + 0xc]
jne 0x4a1c36
test esi, esi
jne 0x4a1e4b
cmp edx, 3
je 0x4a1c6c
cmp edx, 4
je 0x4a1c6c
cmp edx, 5
je 0x4a1c6c
cmp edx, 6
je 0x4a1c6c
cmp edx, 7
je 0x4a1c6c
cmp edx, 8
je 0x4a1c6c
cmp edx, 0xa
je 0x4a1c6c
cmp edx, 0xb
je 0x4a1c6c
cmp edx, 0xc
je 0x4a1c6c
cmp edx, 0xd
jne 0x4a1e4b
push ecx
mov byte [ecx + 0x225], 0
mov byte [ecx + 0x224], dl
call fcn.004a1b9f
mov ebx, eax
mov dword [ebp - 0xc], ebx
pop ecx
test ebx, ebx
jne 0x4a1e50
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x224]
lea edi, [eax + 0xe0]
sub ecx, 3
je 0x4a1de0
sub ecx, 1
je 0x4a1da9
dec ecx
sub ecx, 1
je 0x4a1d66
sub ecx, 1
je 0x4a1d29
sub ecx, 1
jne 0x4a1e4b
mov edx, 0x80
mov dword [ebp - 4], edx
cmp esi, edx
ja 0x4a1cef
cmp dword [ebp + 8], 0
je 0x4a1e16
push esi
push dword [ebp + 8]
push edi
call fcn.004cc940
add esp, 0xc
jmp 0x4a1e16
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.004a07a7
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1e47
mov ecx, dword [ebp - 8]
push edi
push ecx
call fcn.004a097a
mov ebx, eax
mov dword [ebp - 0xc], ebx
pop ecx
pop ecx
test ebx, ebx
jne 0x4a1e47
push 0x40
mov eax, dword [ebp - 4]
pop esi
jmp 0x4a1e1d
mov edx, 0x80
mov dword [ebp - 4], edx
cmp esi, edx
jbe 0x4a1cd3
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.004a07a7
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1e47
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.004a0a2d
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0x4a1e47
push 0x30
jmp 0x4a1d20
push 0x40
pop ecx
mov dword [ebp - 4], ecx
cmp esi, ecx
jbe 0x4a1cd3
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.004a37d7
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1e47
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.004a38a8
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0x4a1e47
push 0x20
pop esi
push 0x40
pop eax
jmp 0x4a1e1d
push 0x40
pop ecx
mov dword [ebp - 4], ecx
cmp esi, ecx
jbe 0x4a1cd3
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.0049d006
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1e47
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0049d121
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0x4a1e47
push 0x14
jmp 0x4a1da3
push 0x40
pop ecx
mov dword [ebp - 4], ecx
cmp esi, ecx
jbe 0x4a1cd3
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.004a2ef5
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4a1e47
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.004a2ffb
mov ebx, eax
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4a1e47
push 0x10
pop esi
mov eax, dword [ebp - 4]
cmp esi, eax
jae 0x4a1e2e
sub eax, esi
push eax
lea eax, [edi + esi]
push 0
push eax
call fcn.004cd440
add esp, 0xc
mov ebx, dword [ebp - 4]
mov al, byte [edi]
xor al, 0x5c
mov byte [edi + 0x80], al
xor byte [edi], 0x36
inc edi
sub ebx, 1
jne 0x4a1e31
mov ebx, dword [ebp - 0xc]
mov eax, ebx
jmp 0x4a1e50
mov eax, 0xffffff53
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a3112
Capabilities:
Hash data using sha256

Disassembly:
test ecx, ecx
jne 0x4a311c
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x60], eax
mov dword [ecx + 0x64], eax
mov dword [ecx + 0x68], eax
ret

Function at 0x4a37fb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x4a3809
mov eax, 0xffffff53
pop esi
ret
mov eax, dword [esi + 0x60]
push ebx
push edi
lea edi, [esi + 0x20]
mov byte [edi + eax], 0x80
inc dword [esi + 0x60]
mov ecx, dword [esi + 0x60]
push 0x38
pop ebx
cmp ecx, ebx
jbe 0x4a3858
push 0x40
pop eax
sub eax, ecx
push eax
lea eax, [ecx + edi]
push 0
push eax
call fcn.004cd440
push 0x40
pop eax
push eax
mov edx, edi
mov dword [esi + 0x60], eax
mov ecx, edi
call fcn.0049c015
add esp, 0x10
mov edx, edi
mov ecx, esi
call fcn.004a3176
test eax, eax
jne 0x4a38a4
and dword [esi + 0x60], eax
xor ecx, ecx
sub ebx, ecx
lea eax, [ecx + edi]
push ebx
push 0
push eax
call fcn.004cd440
mov eax, dword [esi + 0x64]
mov edx, edi
mov ecx, dword [esi + 0x68]
shr eax, 0x1d
push 0x40
lea eax, [eax + ecx*8]
mov ecx, edi
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x64]
shl eax, 3
mov dword [esi + 0x64], eax
call fcn.0049c015
mov eax, dword [esi + 0x68]
add esp, 0x10
mov dword [edi + 0x38], eax
mov edx, edi
mov eax, dword [esi + 0x64]
mov ecx, esi
mov dword [edi + 0x3c], eax
pop edi
pop ebx
pop esi
jmp fcn.004a3176
pop edi
pop ebx
pop esi
ret

Function at 0x4a38a8
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x4a38dd
test edi, edi
je 0x4a38dd
call fcn.004a37fb
test eax, eax
jne 0x4a38e2
push esi
push 0x20
mov edx, ebx
mov ecx, ebx
call fcn.0049c015
pop ecx
push 8
pop ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
mov ecx, ebx
pop ebx
jmp fcn.004a3112
mov eax, 0xffffff53
pop edi
pop ebx
ret
Function at 0x4add43
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x80], 0
jne 0x4ade91
cmp dword [esi + 8], 0
je 0x4ade91
push dword [ebp + 8]
lea ecx, [esi + 0x14]
call fcn.0043b58c
lea edi, [esi + 0x2c]
push 0x51f46c
mov ecx, edi
call fcn.0043b58c
lea ebx, [esi + 0x44]
push 0x51f46c
mov ecx, ebx
call fcn.0043b58c
cmp dword [ebp + 0xc], 0
je 0x4add9e
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0043b58c
jmp 0x4addaa
mov ecx, dword [ebp + 8]
mov edx, edi
push ebx
call fcn.004adf88
pop ecx
mov eax, dword [esi + 0xc]
xor edi, edi
inc edi
xor ebx, ebx
test eax, eax
jne 0x4addcb
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc], eax
test eax, eax
je 0x4ade91
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x7c]
test ecx, ecx
je 0x4adde1
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [esi + 0x7c], ebx
call fcn.004ae570
test eax, eax
je 0x4ade03
cmp dword [esi + 4], edi
jne 0x4ade03
push 0x54
call fcn.004caa10
pop ecx
mov ecx, eax
mov dword [ebp + 0xc], eax
call fcn.004b6342
jmp 0x4ade30
push 0x2c
call fcn.004caa10
pop ecx
xor ecx, ecx
mov dword [ebp + 0xc], eax
mov dword [eax], vtable.CWininetFile.0
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], 7
mov word [eax + 0xc], cx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0x24], ebx
mov dword [eax + 0x28], ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffd
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.STATIC
push ebx
mov dword [esi + 0x7c], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x4ae4ed
push 0xfffffffffffffffc
push eax
mov dword [esi + 0x5c], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 4]
mov dword [esi + 0x80], edi
push eax
push ebx
push esi
push 0x4ae0a7
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.004d7d30
mov ecx, eax
add esp, 0x18
mov dword [esi + 0x10], ecx
test ecx, ecx
jne 0x4ade88
mov dword [esi + 0x80], ebx
xor eax, eax
test ecx, ecx
setne al
jmp 0x4ade93
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4adf88
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x53b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push esi
push edi
push 0x20a
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.004cd440
push 0x412
lea eax, [ebp - 0x624]
push 0
push eax
call fcn.004cd440
push 0x2f
push esi
call fcn.004cc827
add esp, 0x20
mov esi, 0x105
test eax, eax
je 0x4ae004
push 0xffffffffffffffff
add eax, 2
push eax
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004e0313
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_PathCleanupSpec]
cmp word [ebp - 0x210], 0
jne 0x4ae025
push 0xffffffffffffffff
push str.unknown
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004e0313
add esp, 0x10
lea eax, [ebp - 0x624]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x624]
push str.Download
push eax
call esi
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ae06c
push eax
lea eax, [ebp - 0x624]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x624]
push eax
call esi
lea eax, [ebp - 0x624]
mov ecx, edi
push eax
call fcn.0043b58c
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.0043b58c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ca9ff
leave
ret

Function at 0x4ae43d
Capabilities:
Check if file exists
Copy file
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x53b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.004cd440
push edi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.004dd693
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ae4ae
push ebx
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esi, 0x2c
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4ae4bb
mov eax, dword [esi]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
cmp dword [ebp + 0xc], ebx
je 0x4ae4da
cmp dword [esi + 0x14], 8
jb 0x4ae4d3
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ca9ff
leave
ret 8
Function at 0x4ae570
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x53b070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004cd440
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x4ae5e2
cmp dword [ebp - 0x11c], 5
jne 0x4ae5dc
cmp dword [ebp - 0x118], ecx
jne 0x4ae5ce
cmp word [ebp - 0xc], cx
jmp 0x4ae5dc
cmp dword [ebp - 0x118], 0
jne 0x4ae5e2
cmp word [ebp - 0xc], 3
jae 0x4ae5e2
xor eax, eax
jmp 0x4ae5e4
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9ff
leave
ret
Function at 0x4b0157
Capabilities:
Identify system language via api

Disassembly:
push 0x44
mov eax, 0x4fc7fa
call fcn.004cb654
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov bl, byte [0x5411e3]
mov bh, byte [0x5411e2]
movsx edi, ax
shr eax, 0x10
cwde
push eax
push edi
push 0x5414c0
mov byte [0x5411e3], 0
mov byte [0x5411e2], 0
mov dword [ebp - 0x4c], eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4b024a
mov byte [0x5414ad], 0
mov byte [0x5414ac], 1
test bl, bl
je 0x4b0290
lea ecx, [ebp - 0x2c]
call fcn.004402d1
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x804
movzx eax, ax
cmp ax, cx
lea ecx, [ebp - 0x48]
jne 0x4b01ea
push 0x528030
call fcn.004408e0
mov byte [ebp - 4], 1
jmp 0x4b01f8
push str.Setup_is_harding_work_it_maybe_make_you_cannt_connect_to_internet_if_you_quit_now._Do_you_sure_to_exit_
call fcn.004408e0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044341f
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.00440d86
mov ecx, esi
call fcn.004b0296
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x34
cmovae eax, dword [ebp - 0x28]
push str.Warning
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4b0240
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x2c]
call fcn.00440d86
jmp 0x4b0290
push dword [ebp - 0x4c]
push edi
push 0x541488
call dword [sym.imp.USER32.dll_PtInRect]
mov byte [0x5414ac], 0
test eax, eax
je 0x4b027a
mov byte [0x5414ad], 1
test bh, bh
je 0x4b0290
push 6
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4b0290
mov byte [0x5414ad], 0
test bh, bh
jne 0x4b0289
test bl, bl
je 0x4b0290
mov ecx, esi
call fcn.004b0296
call fcn.004cb5fe
ret
Function at 0x4b6e40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x28
call fcn.004caa10
mov esi, eax
xor eax, eax
pop ecx
push dword [ebp + 0xc]
mov ecx, esi
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.0043b58c
lea ebx, [esi + 0x18]
mov dword [esi + 0x24], 2
xor eax, eax
mov edi, ebx
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push ecx
push esi
push 0x4b6daa
push ecx
push ecx
mov dword [ebp - 4], ecx
call fcn.004d7d30
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x4b6ea5
mov ecx, esi
call fcn.004b6153
jmp 0x4b6ed8
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4b6eca
cmp dword [ebx], 3
jne 0x4b6eca
mov ecx, dword [ebp + 8]
push 0xc
push ebx
push 0x26
pop edx
call fcn.004b7174
pop ecx
pop ecx
mov ecx, esi
call fcn.004b6153
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4b6edf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x53b070]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x541504], 0
jne 0x4b6f52
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004cd440
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winhttp.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
mov dword [0x541504], eax
test eax, eax
setne cl
mov eax, ecx
jmp 0x4b6f55
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9ff
leave
ret