joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4889e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a85c
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5522c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0x23
lea eax, [ebp - 0x218]
push eax
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x218]
call fcn.004595b0
push eax
lea edx, [ebp - 0x230]
push edx
mov ebx, str.BaofengStormPlayerProfilesConfig.ini
mov dword [ebp - 4], 0
call fcn.0045ce00
add esp, 8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x488a77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esi + 0xb4]
push ecx
lea edx, [ebp - 0x234]
push edx
mov ebx, str.crt.dll
call fcn.0045ce00
add esp, 8
mov bl, 3
mov byte [ebp - 4], bl
cmp dword [esi + 0x4c], 0
jne 0x488ab1
mov eax, dword [ebp - 0x234]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esi + 0x4c], eax
mov edx, dword [0x551f18]
mov eax, dword [edx + 0xc]
mov ecx, 0x551f18
call eax
add eax, 0x10
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x228]
push ecx
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x222]
movzx eax, word [ebp - 0x226]
movzx ecx, word [ebp - 0x228]
push edx
push eax
push ecx
push str._4d_.2d_.2d
lea edi, [ebp - 0x22c]
call fcn.004597f0
mov edx, dword [ebp - 0x230]
mov edi, dword [ebp - 0x22c]
add esp, 0x10
push edx
push edi
push 0x51cf6c
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, dword [esi + 0x4c]
test esi, esi
je 0x488b5f
push str.CrtSetInstallDate
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x488b5f
cmp dword [edi - 4], 1
jle 0x488b59
mov eax, dword [edi - 0xc]
push eax
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00459650
mov edi, dword [ebp - 0x22c]
push edi
call esi
add esp, 4
lea eax, [edi - 0x10]
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x488b7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x488ba4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x488bcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e4840
mov esp, ebp
pop ebp
ret
Function at 0x488bf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff6d8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5522c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x488c6d
mov dword [ebp - 0x54], vtable.CAccessRight.0
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x4e]
mov dword [ebp - 4], 0
push ecx
mov word [ebp - 0x50], ax
call fcn.004e9520
add esp, 0xc
push 0x20
push 0x51d5f4
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0045b530
add esp, 0xc
mov eax, 1
jmp 0x488c6f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e4840
mov esp, ebp
pop ebp
ret

Function at 0x488e70
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b91b
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x5522c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
jne 0x488eb1
xor eax, eax
jmp 0x488f6e
push 0x51d674
push esi
push 0x51d648
lea eax, [ebp - 0x428]
push 0x104
push eax
mov edi, 1
call fcn.004e76a1
add esp, 0x14
lea ecx, [ebp - 0x678]
push ecx
lea edx, [ebp - 0x428]
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x680], eax
cmp eax, 0xffffffff
je 0x488eaa
cmp word [ebp - 0x64c], 0x2e
je 0x488f47
test byte [ebp - 0x678], 0x10
je 0x488f8c
lea eax, [ebp - 0x64c]
push eax
push esi
push str._s_s_
lea ecx, [ebp - 0x220]
push 0x104
push ecx
call fcn.004e76a1
add esp, 0x14
push 1
lea eax, [ebp - 0x220]
xor edx, edx
push eax
mov ecx, ebx
mov word [ebp - 0x1a], dx
call fcn.00488e70
mov edi, eax
mov edx, dword [ebp - 0x680]
lea ecx, [ebp - 0x678]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x488efb
mov eax, dword [ebp - 0x680]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e4840
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0
je 0x488f47
lea ecx, [ebp - 0x67c]
push ecx
lea ecx, [ebp - 0x64c]
call fcn.004595b0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x67c]
push str.ASBarBroker.exe
push edx
call fcn.004e7407
add esp, 8
test eax, eax
jne 0x488fcc
push eax
push esi
call fcn.0045c770
add esp, 8
mov edi, eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x67c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x488f47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x488f47
Function at 0x48b400
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d7a0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x10]
call fcn.0048b600
mov esi, dword [ebp + 8]
add esi, 0x5c
mov edi, esi
mov dword [ebp - 4], 0
call fcn.0045cee0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48b46a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x10]
push esi
push ecx
mov ebx, str.Archive.7z
call fcn.0045ce00
add esp, 8
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x58]
mov dword [ebp - 4], 1
call fcn.0045cee0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48b4b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
call fcn.0048b590
test eax, eax
je 0x48b53b
mov eax, dword [0x55ad80]
mov edi, dword [ebx + 0x58]
push str.RESOURCE_DATA
push 0x8a
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48b53b
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00458970
add esp, 4
test al, al
je 0x48b53b
mov ecx, dword [esi]
push 2
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebx + 0x58]
mov eax, ebx
add eax, 0x60
push eax
push ecx
mov dword [eax], 0
call fcn.0045b190
add esp, 8
test eax, eax
jne 0x48b53b
mov ecx, dword [ebx + 0x58]
mov edi, dword [esi]
call fcn.0045b080
test eax, eax
je 0x48b551
mov edi, ebx
add edi, 0xb8
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x3e9
call fcn.0048d490
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x58]
push ecx
lea eax, [eax - 0x10]
mov dword [ebp + 8], esp
mov esi, esp
call fcn.0045cfd0
add eax, 0x10
mov dword [esi], eax
call fcn.0045c380
xor edx, edx
add esp, 4
test eax, eax
setne dl
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48b600
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5522c0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
mov dword [ebp - 0x210], 0
push ecx
mov word [ebp - 0x20c], ax
call fcn.004e9520
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0x51a1b4
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsStormPlayer.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0x102
mov dword [ebp - 0x210], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x48b6a2
push 0x51a1b4
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x48b6a2
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
jmp 0x48b6cb
push 0x104
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.004e9520
add esp, 0xc
push 1
push 0x1a
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.BaofengTemp_
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
lea ecx, [ebp - 0x20c]
call fcn.004595b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.004e4840
mov esp, ebp
pop ebp
ret
Function at 0x48b710
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502970
mov eax, dword fs:[0]
push eax
sub esp, 0xc88
mov eax, dword [0x5522c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc90], ecx
test esi, esi
je 0x48b908
test edi, edi
je 0x48b908
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x48b76f
mov ecx, edi
call fcn.0045bdf0
push 0x51d674
push esi
push 0x51d648
lea eax, [ebp - 0xa3c]
push 0x104
push eax
mov ebx, 1
call fcn.004e76a1
add esp, 0x14
lea ecx, [ebp - 0xc8c]
push ecx
lea edx, [ebp - 0xa3c]
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc94], eax
cmp eax, 0xffffffff
je 0x48b908
cmp word [ebp - 0xc60], 0x2e
je 0x48b8db
test byte [ebp - 0xc8c], 0x10
je 0x48b873
lea eax, [ebp - 0xc60]
push eax
push esi
push str._s_s_
lea ecx, [ebp - 0x21c]
push 0x104
push ecx
call fcn.004e76a1
lea eax, [ebp - 0xc60]
push eax
push edi
push str._s_s_
lea ecx, [ebp - 0x62c]
xor edx, edx
push 0x104
push ecx
mov word [ebp - 0x16], dx
call fcn.004e76a1
add esp, 0x28
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x21c]
xor edx, edx
push ecx
mov ecx, dword [ebp - 0xc90]
mov word [ebp - 0x426], dx
call fcn.0048b710
jmp 0x48b8d9
lea edx, [ebp - 0xc60]
push edx
push esi
push 0x51d648
lea eax, [ebp - 0x834]
push 0x104
push eax
call fcn.004e76a1
lea edx, [ebp - 0xc60]
push edx
push edi
push 0x51d648
lea eax, [ebp - 0x424]
xor ecx, ecx
push 0x104
push eax
mov word [ebp - 0x62e], cx
call fcn.004e76a1
add esp, 0x28
xor ecx, ecx
push ecx
lea edx, [ebp - 0x424]
push edx
lea eax, [ebp - 0x834]
push eax
mov word [ebp - 0x21e], cx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
mov edx, dword [ebp - 0xc94]
lea ecx, [ebp - 0xc8c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x48b7bd
mov eax, dword [ebp - 0xc94]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x48b90a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e4840
mov esp, ebp
pop ebp
ret 8
Function at 0x48b930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff6a6
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x5522c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x62c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x630], ebx
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
mov byte [ebp - 4], 1
push ecx
mov word [ebp - 0x218], ax
call fcn.004e9520
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push ebx
push ebx
push 0x19
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x525990
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x62c]
push ecx
push 0x50f8bc
push 1
push ebx
push 0x50f8fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x62c]
cmp eax, ebx
je 0x48bb18
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [ebp - 0x630]
push ecx
push 0x50f90c
push eax
call edx
mov esi, dword [ebp - 0x630]
cmp esi, ebx
je 0x48bb63
push 0x206
lea ecx, [ebp - 0x41e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x420], ax
call fcn.004e9520
add esp, 0xc
push 2
lea eax, [ebp - 0x218]
mov dword [ebp - 0x634], ebx
mov edx, dword [esi]
mov ecx, dword [edx + 0x14]
push eax
push esi
call ecx
test eax, eax
setns al
cmp al, bl
je 0x48bb12
push 0x206
lea eax, [ebp - 0x626]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x628], dx
call fcn.004e9520
mov eax, dword [ebp - 0x62c]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
push 0x104
lea edx, [ebp - 0x628]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov eax, dword [ebp - 0x62c]
mov ecx, dword [eax]
lea edx, [ebp - 0x634]
push edx
push 0x104
lea edx, [ebp - 0x420]
push edx
push eax
mov eax, dword [ecx + 0x40]
call eax
mov eax, dword [ebp - 0x62c]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x420]
cmp word [ebp - 0x420], bx
jne 0x48bab9
lea edx, [ebp - 0x628]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [ebp - 0x630]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x218]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setns cl
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x630]
mov esi, ecx
cmp eax, ebx
je 0x48baf5
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x62c]
cmp eax, ebx
je 0x48bb0e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
jmp 0x48bb48
mov eax, dword [ebp - 0x62c]
mov esi, dword [ebp - 0x630]
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x48bb33
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x48bb46
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e4840
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x62c]
jmp 0x48bb1e
Function at 0x48d120
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
push esi
je 0x48d1a1
push eax
call fcn.004e7cef
mov esi, eax
mov eax, dword [ebp + 8]
push 0x2e
push eax
call fcn.004e764c
add esp, 0xc
test eax, eax
je 0x48d19e
add eax, 2
push eax
call fcn.004e7cef
add esp, 4
cmp esi, 5
jg 0x48d193
jne 0x48d15f
cmp eax, 0x20
jge 0x48d193
push str.MediaLibrary:_old_version_is_less_than_5.32_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d189
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop esi
pop ebp
ret 4
push str.MediaLibrary:_Not_need_restart_explorer__version_is_greater_than_5.32_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d1bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x48d9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push esi
add eax, eax
lea edx, [ebp + 8]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0
mov dword [edi], 0
mov ecx, dword [eax]
push str.UninstallString
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48da4f
mov eax, dword [ebp + 8]
cmp eax, 1
je 0x48da1e
cmp eax, 2
jne 0x48da39
mov eax, dword [ebp - 4]
test esi, esi
je 0x48da49
test eax, eax
je 0x48da44
test al, 1
jne 0x48da39
mov edx, eax
shr edx, 1
cmp word [esi + edx*2 - 2], 0
je 0x48da49
mov eax, 0xd
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov word [esi], cx
shr eax, 1
mov dword [edi], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x48db90
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x28]
push 1
push eax
mov dword [esi], vtable.CInstallPageManager.0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x48dbbd
push eax
call edi
mov dword [esi + 0x28], 0
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x48dbce
push eax
call edi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x20], vtable.CSHManage.0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x48dbe5
push esi
call fcn.004e4d61
add esp, 4
pop edi
pop esi
ret
Function at 0x48dbf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, dword [ebp + 8]
mov dword [esi + 0x2c], eax
call fcn.0048dfa0
test eax, eax
je 0x48dc28
push edi
push edi
push esi
push 0x48f650
push edi
push edi
call fcn.004e5b19
add esp, 0x18
mov dword [esi + 0x28], eax
jmp 0x48dc35
mov eax, dword [esi + 0x2c]
push eax
mov dword [esi + 0x24], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0xc]
add esi, 0xc
cmp eax, edi
je 0x48dc4a
push eax
call fcn.004e4d61
add esp, 4
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
cmp edi, edi
jb 0x48dc6a
lea eax, [edi + 1]
call fcn.0048f740
test al, al
jne 0x48dc6a
push 0x8007000e
call fcn.0045a440
mov ecx, dword [esi]
lea eax, [ecx + edi*4]
mov ebx, 1
test eax, eax
je 0x48dc7a
mov dword [eax], ebx
add dword [esi + 4], ebx
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jb 0x48dc9b
lea eax, [edi + 1]
call fcn.0048f740
test al, al
jne 0x48dc9b
push 0x8007000e
call fcn.0045a440
mov edx, dword [esi]
lea eax, [edx + edi*4]
test eax, eax
je 0x48dcaa
mov dword [eax], 2
add dword [esi + 4], ebx
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jb 0x48dccb
lea eax, [edi + 1]
call fcn.0048f740
test al, al
jne 0x48dccb
push 0x8007000e
call fcn.0045a440
mov eax, dword [esi]
lea eax, [eax + edi*4]
test eax, eax
je 0x48dcda
mov dword [eax], 3
add dword [esi + 4], ebx
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jb 0x48dcfb
lea eax, [edi + 1]
call fcn.0048f740
test al, al
jne 0x48dcfb
push 0x8007000e
call fcn.0045a440
mov ecx, dword [esi]
lea eax, [ecx + edi*4]
test eax, eax
je 0x48dd0a
mov dword [eax], 4
add dword [esi + 4], ebx
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jb 0x48dd2b
lea eax, [edi + 1]
call fcn.0048f740
test al, al
jne 0x48dd2b
push 0x8007000e
call fcn.0045a440
mov edx, dword [esi]
lea eax, [edx + edi*4]
test eax, eax
je 0x48dd3a
mov dword [eax], 5
add dword [esi + 4], ebx
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 4], 0
pop esi
mov al, bl
pop ebx
pop ebp
ret 4

Function at 0x48dfa0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.SensApi.dll_IsNetworkAlive]
test eax, eax
jne 0x48dfe4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x48dfde
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x48dfde
mov al, byte [ebp - 4]
test al, 0x20
jne 0x48dfde
test al, 7
jne 0x48dfe4
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.0048e020
mov esi, eax
call fcn.0048e690
mov edi, eax
call fcn.0048ed10
test esi, esi
jne 0x48e00e
test edi, edi
jne 0x48e00e
test eax, eax
jne 0x48e00e
pop edi
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48f7e0
Capabilities:
Check if file exists
Create directory
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50945f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [edi], vtable.CLogEncryption.0
lea eax, [edi + 0x84]
mov dword [edi + 0xc4], eax
mov dword [edi + 4], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
mov dword [edi + 0x14], 0xc3d2e1f0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc8], vtable.CBase64.0
mov dword [edi + 0xd0], vtable.CRSA.0
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00490760
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
mov esi, 1
cmp dword [eax - 4], esi
jle 0x48f893
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00459650
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48f8c1
mov eax, dword [ebp - 0x10]
cmp dword [eax - 4], esi
jle 0x48f8b6
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00459650
mov eax, dword [ebp - 0x10]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48f8e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x48f900
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword [esi], vtable.CLogEncryption.0
mov dword [esi + 0xd0], vtable.CRSA.0
mov dword [esi + 0xc8], vtable.CBase64.0
xor eax, eax
test byte [ebp + 8], 1
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov dword [esi + 0x14], 0xc3d2e1f0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
je 0x48f95a
push esi
call fcn.004e4d61
add esp, 4
mov eax, esi
pop esi
pop ebp
ret 4