joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x519c80
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor esi, esi
push str.EnableFirewall
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], esi
call fcn.00401f50
push str.SYSTEMCurrentControlSet_servicesSharedAccessParametersFirewallPolicyStandardProfile
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], esi
call fcn.00401f50
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, 1
push 3
mov byte [esp + 0x3c], bl
call fcn.0049d2b0
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x4a34c6
sub eax, 8
push eax
mov dword [esp + 0x10], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x14]
cmp eax, esi
mov dword [esp + 0x2c], 0xffffffff
je 0x4a34e6
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
call fcn.004a6360
cmp eax, 8
jle 0x4a359f
push str.EnableFirewall
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], esi
call fcn.00401f50
push str.SYSTEMCurrentControlSet_servicesSharedAccessParametersFirewallPolicyPublicProfile
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 2
call fcn.00401f50
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 3
mov byte [esp + 0x3c], 3
call fcn.0049d2b0
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4a3553
sub eax, 8
push eax
mov dword [esp + 0x14], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x4a356b
sub eax, 8
push eax
mov dword [esp + 0x1c], eax
call fcn.004d37ab
add esp, 4
cmp dword [esp + 0x1c], ebx
jne 0x4a358b
cmp dword [esp + 0x20], ebx
jne 0x4a358b
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret
xor eax, eax
cmp dword [esp + 0x1c], ebx
sete al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x4a4cb0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x519fa8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
call fcn.004a6360
cmp eax, 8
jle 0x4a4d20
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x1c]
push str._change__monitor_timeout_ac__d
push ecx
call fcn.0040f1d0
mov edx, dword [eax]
add esp, 0xc
push 0
push 0
push edx
push 0x532024
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4a4da3
sub eax, 8
mov dword [esp + 0x18], eax
jmp 0x4a4d9a
push 0
push 0
push str._CREATE__
push str.POWERCFG
push str.open
push 0
call fcn.004a4440
push 0
push 0
push str._SETACTIVE__
push str.POWERCFG
push str.open
push 0
call fcn.004a4440
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 8]
push 0x532520
push ecx
call fcn.0040f1d0
add esp, 0xc
mov edx, dword [eax]
push 0
push 0
push edx
push str.POWERCFG
push str.open
push 0
mov dword [esp + 0x28], 0
call fcn.004a4440
mov eax, dword [esp + 4]
test eax, eax
je 0x4a4da3
sub eax, 8
mov dword [esp + 4], eax
push eax
call fcn.004d37ab
add esp, 4
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret 4

Function at 0x4a4dc0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x519fa8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
call fcn.004a6360
cmp eax, 8
jle 0x4a4e30
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x1c]
push str._change__standby_timeout_ac__d
push ecx
call fcn.0040f1d0
mov edx, dword [eax]
add esp, 0xc
push 0
push 0
push edx
push 0x532024
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4a4eb3
sub eax, 8
mov dword [esp + 0x18], eax
jmp 0x4a4eaa
push 0
push 0
push str._CREATE__
push str.POWERCFG
push str.open
push 0
call fcn.004a4440
push 0
push 0
push str._SETACTIVE__
push str.POWERCFG
push str.open
push 0
call fcn.004a4440
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 8]
push 0x5325b0
push ecx
call fcn.0040f1d0
add esp, 0xc
mov edx, dword [eax]
push 0
push 0
push edx
push str.POWERCFG
push str.open
push 0
mov dword [esp + 0x28], 0
call fcn.004a4440
mov eax, dword [esp + 4]
test eax, eax
je 0x4a4eb3
sub eax, 8
mov dword [esp + 4], eax
push eax
call fcn.004d37ab
add esp, 4
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret 4
Function at 0x4a4ed0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x519fe0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
call fcn.004a6360
cmp eax, 8
jle 0x4a4f99
mov edi, dword [esp + 0x20]
push edi
lea eax, [esp + 0x24]
push str._change_hibernate_timeout_ac__d
push eax
call fcn.0040f1d0
mov ecx, dword [eax]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esp, 0xc
push 0
push 0
push ecx
push 0x532024
push str.open
push 0
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a4f4b
sub eax, 8
push eax
mov dword [esp + 0x24], eax
call fcn.004d37ab
add esp, 4
test edi, edi
mov eax, 0x53250c
je 0x4a4f59
mov eax, 0x532514
push eax
lea edx, [esp + 0x24]
push str._change__hibernate__s
push edx
call fcn.0040f1d0
mov eax, dword [eax]
add esp, 0xc
push 0
push 0
push eax
push 0x532024
push str.open
push 0
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a507d
sub eax, 8
mov dword [esp + 0x20], eax
jmp 0x4a5074
push 0
push 0
push str._CREATE__
push str.POWERCFG
push str.open
push 0
call fcn.004a4440
push 0
push 0
push str._SETACTIVE__
push str.POWERCFG
push str.open
push 0
call fcn.004a4440
mov esi, dword [esp + 0x20]
push esi
lea ecx, [esp + 0x24]
push str._CHANGE__
push ecx
call fcn.0040f1d0
add esp, 0xc
mov eax, dword [eax]
push 0
push 0
push eax
push str.POWERCFG
push str.open
push 0
mov dword [esp + 0x30], 0
call fcn.004a4440
mov eax, dword [esp + 0x20]
test eax, eax
mov dword [esp + 0x18], 0xffffffff
je 0x4a5024
sub eax, 8
push eax
mov dword [esp + 0x24], eax
call fcn.004d37ab
add esp, 4
test esi, esi
mov eax, 0x53250c
je 0x4a5032
mov eax, 0x532514
push eax
lea edx, [esp + 0x10]
push str._HIBERNATE__s
push edx
call fcn.0040f1d0
add esp, 0xc
mov eax, dword [eax]
push 0
push 0
push eax
push str.POWERCFG
push str.open
push 0
mov dword [esp + 0x30], 1
call fcn.004a4440
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a507d
sub eax, 8
mov dword [esp + 0xc], eax
push eax
call fcn.004d37ab
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4a5fb0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
jne 0x4a5fe3
call fcn.0042fd50
cmp dword [eax], 1
jl 0x4a5fdc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push ecx
push str.CFileEx::hRead_pBuffer_x__nLength_d__....m_fd___1..._error_n
push 0
call fcn.00430060
add esp, 0x10
or eax, 0xffffffff
pop esi
ret 8
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x1c]
cmp edx, eax
mov ecx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x10]
jl 0x4a6030
jg 0x4a5ffa
cmp edi, ecx
jb 0x4a6030
call fcn.0042fd50
cmp dword [eax], 1
jl 0x4a6028
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x1c]
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
push str.CFileEx::hRead_m_llFileSize___I64d__m_llPosition___I64d__nLength___d__EOF_n
push 0
call fcn.00430060
add esp, 0x1c
pop edi
or eax, 0xffffffff
pop esi
ret 8
sub ecx, edi
sbb eax, edx
push ebx
mov ebx, dword [esp + 0x14]
xor edx, edx
cmp eax, edx
push ebp
jg 0x4a604b
jl 0x4a6046
cmp ecx, ebx
jae 0x4a604b
mov ebx, dword [esi + 0x18]
sub ebx, edi
xor ebp, ebp
test ebx, ebx
jle 0x4a60b5
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 8]
mov ecx, ebx
sub ecx, ebp
push ecx
push edx
push eax
call fcn.004f69d0
mov edi, eax
add esp, 0xc
test edi, edi
jle 0x4a6083
cdq
add ebp, edi
add dword [esi + 0x10], eax
adc dword [esi + 0x14], edx
cmp ebp, ebx
jl 0x4a6051
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
ret 8
call fcn.0042fd50
cmp dword [eax], 1
jl 0x4a60ae
call fcn.004f7d19
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 8]
push ecx
push ebx
push edx
push eax
push str.CFileEx::_read_m_fd___d__pBuffer__0x_x__nLength_d__..._error___d_n
push 0
call fcn.00430060
add esp, 0x18
cmp edi, 0xffffffff
jne 0x4a60b5
or ebp, edi
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
ret 8
Function at 0x4a7920
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51a251
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea edi, [esi + 0x10]
mov ecx, edi
mov dword [esi], vtable.CNetAdapterInfo.0
call fcn.004a6ab0
xor ebp, ebp
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
lea ebx, [esi + 0x68]
push ebp
mov ecx, ebx
mov dword [esp + 0x24], ebp
mov dword [ebx], ebp
call fcn.00402700
cmp eax, 1
jne 0x4a797e
mov eax, dword [ebx]
mov dword [eax - 4], ebp
lea edi, [esi + 0x6c]
mov ecx, edi
mov byte [esp + 0x20], 1
call fcn.0040e2a0
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
mov dword [0x56c790], ebp
push 0x543e10
mov ecx, ebx
mov byte [esp + 0x24], 2
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
call fcn.00402060
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x64], ebp
mov dword [esi + 0x60], ebp
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4a7a40
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push 0xffffffffffffffff
push 0x51a280
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x56a260]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
xor ebx, ebx
mov dword [esp + 0x24], eax
xor esi, esi
mov dword [esp + 0x20], 0x3a98
jmp 0x4a7a90
mov ecx, dword [esp + 0x20]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ecx
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x28], edi
je 0x4a7c45
lea edx, [esp + 0x20]
push edx
push edi
push ebx
push 0x10
push ebx
call sub.iphlpapi.dll_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x4a7adf
push edi
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esi, 1
cmp esi, 3
jb 0x4a7a90
jmp 0x4a7c45
cmp eax, ebx
jne 0x4a7c3a
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + 0x10]
xor ecx, ecx
mov eax, 5
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d37a6
mov ebp, eax
add ebp, 8
mov dword [ebp - 8], 1
mov word [ebp], bx
mov dword [esp + 0x18], ebp
mov dword [ebp - 4], ebx
xor ecx, ecx
mov eax, 5
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x70], ebx
neg ecx
or ecx, eax
push ecx
call fcn.004d37a6
mov edi, eax
add edi, 8
mov dword [edi - 8], 1
mov word [edi], bx
add esp, 8
mov dword [esp + 0x18], edi
mov dword [edi - 4], ebx
cmp esi, ebx
mov byte [esp + 0x6c], 1
je 0x4a7bdb
push 0x2d
lea eax, [esp + 0x35]
push ebx
push eax
mov byte [esp + 0x3c], bl
call fcn.004f5b00
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x34], 0x2e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
push ebx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAAddressToStringA]
mov edx, dword [esi + 0xc]
cmp word [edx], 2
jne 0x4a7bb3
push 0xffffffffffffffff
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040efb0
mov ecx, dword [esi + 0xc]
cmp word [ecx], 0x17
jne 0x4a7bcc
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x20]
call fcn.0040efb0
mov esi, dword [esi + 8]
cmp esi, ebx
jne 0x4a7b65
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.0040c400
mov ecx, eax
call fcn.00401fe0
cmp edi, ebx
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 8]
mov dword [esp + 0x1c], esi
je 0x4a7c10
add edi, 0xfffffff8
push edi
call fcn.004d37ab
add esp, 4
cmp ebp, ebx
mov dword [esp + 0x6c], 0xffffffff
je 0x4a7c28
add ebp, 0xfffffff8
push ebp
call fcn.004d37ab
add esp, 4
cmp esi, ebx
jne 0x4a7aeb
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [esp + 0x28]
push edi
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.004f2ac1
add esp, 0x5c
ret 4
Function at 0x4aae30
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x51a6da
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov esi, dword [esp + 0x28]
push 1
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004aacb0
mov eax, dword [eax]
mov dword [esp + 0x20], ebx
mov ecx, 0x54e4a8
jmp 0x4aae80
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4aaea6
test dx, dx
je 0x4aaea2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4aaea6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4aae80
xor eax, eax
jmp 0x4aaeab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4aaeb3
mov eax, esi
jmp 0x4aaed4
push 0x54e4a8
lea ecx, [esp + 0x2c]
push esi
push ecx
call fcn.0040bf20
add esp, 0xc
mov ebx, 1
mov byte [esp + 0x20], 1
mov dword [esp + 0x10], ebx
lea esi, [edi + 0xd4]
push eax
mov ecx, esi
call fcn.00401fe0
test bl, 1
je 0x4aaf0e
mov eax, dword [esp + 0x28]
and ebx, 0xfffffffe
test eax, eax
mov dword [esp + 0x10], ebx
je 0x4aaf0e
sub eax, 8
push eax
mov dword [esp + 0x2c], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x20], 0xffffffff
je 0x4aaf2e
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
push esi
call fcn.0049d8e0
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
add esp, 4
test eax, eax
je 0x4aaf4b
cmp dword [eax - 4], 0
jle 0x4aaf4b
mov eax, ecx
jmp 0x4aaf6d
push str.__ReceiveTemp
lea edx, [esp + 0x30]
push esi
push edx
call fcn.0040bf20
add esp, 0xc
or ebx, 2
mov dword [esp + 0x20], 2
mov dword [esp + 0x10], ebx
lea esi, [edi + 0xd8]
push eax
mov ecx, esi
call fcn.00401fe0
test bl, 2
mov dword [esp + 0x20], 0xffffffff
je 0x4aafa8
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4aafa8
sub eax, 8
push eax
mov dword [esp + 0x30], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x2c], 0
push esi
call fcn.0049d8e0
mov eax, dword [esi]
add esp, 4
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x4b0760
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51ac21
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], vtable.CNsPacketBase.0
lea edi, [esi + 0x34]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x1c], 2
mov dword [esi + 0x4c], ebx
call fcn.00434be0
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov ecx, esi
call fcn.004b05c0
mov ecx, esi
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.004b0690
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.004afeb0
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x4b07e0
push eax
call fcn.004d37ab
add esp, 4
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4b07f9
push eax
call fcn.004d37ab
add esp, 4
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4b0840
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51ac56
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi], vtable.CNsPacketBase.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 1
call fcn.004afe90
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x50], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4b9090
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x51afb0
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x2c]
mov al, byte [esp + 0x38]
push ebx
lea ecx, [esi + 0x368]
push ecx
lea edx, [esp + 0x34]
push edx
mov byte [esi + 0x370], al
call fcn.0040bfd0
push 0x54e4a8
push eax
lea eax, [esp + 0x4c]
xor ebp, ebp
push eax
mov dword [esp + 0x34], ebp
call fcn.0040bf20
add esp, 0x18
lea edi, [esi + 0x36c]
push eax
mov ecx, edi
mov byte [esp + 0x20], 1
call fcn.00401fe0
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x4b911e
sub eax, 8
push eax
mov dword [esp + 0x3c], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x38], ebp
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov dword [esp + 0x1c], 0xffffffff
je 0x4b9142
sub eax, 8
push eax
mov dword [esp + 0x30], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x2c], ebp
mov ecx, dword [edi]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push edi
push ebp
push ebx
push edx
push eax
mov ecx, esi
call fcn.004b8de0
cmp eax, 1
jne 0x4b9181
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push edi
push ebp
push ebx
push ecx
push edx
mov ecx, esi
call fcn.004b8680
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
Function at 0x4b9a20
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x51b13e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
xor ebx, ebx
push ebx
call fcn.00434600
mov dword [esi + 0xc8], vtable.IASyncEventNotify.0
lea edi, [esi + 0xcc]
mov dword [esi], vtable.CUpdateCheck.1.0
mov dword [esi + 0xc8], vtable.CUpdateCheck.0
push ebx
mov ecx, edi
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call fcn.00402700
cmp eax, 1
jne 0x4b9a8d
mov edi, dword [edi]
mov dword [edi - 4], ebx
lea edi, [esi + 0xd4]
push ebx
mov ecx, edi
mov byte [esp + 0x28], 1
mov dword [edi], ebx
call fcn.00402700
cmp eax, 1
jne 0x4b9aac
mov edi, dword [edi]
mov dword [edi - 4], ebx
lea ecx, [esi + 0xd8]
mov byte [esp + 0x24], 2
call fcn.004ba9c0
lea ebp, [esi + 0x364]
push ebx
mov ecx, ebp
mov byte [esp + 0x28], 3
mov dword [ebp], ebx
call fcn.00402700
cmp eax, 1
jne 0x4b9add
mov eax, dword [ebp]
mov dword [eax - 4], ebx
lea edi, [esi + 0x36c]
push ebx
mov ecx, edi
mov byte [esp + 0x28], 4
mov dword [edi], ebx
call fcn.00402700
cmp eax, 1
jne 0x4b9afc
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [esp + 0x24], 5
call fcn.0042fd50
cmp dword [eax], 1
jl 0x4b9b19
push str.CUpdateCheck_Last_Compile_Date__Apr__1_2019__11:17:31__n
push ebx
call fcn.00430060
add esp, 8
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x358], eax
mov dword [esi + 0x35c], ebx
mov word [esi + 0xd0], bx
mov dword [esi + 0x360], ebx
call fcn.0042fd50
cmp dword [eax], 1
jl 0x4b9b4f
push esi
push str.UpdateCheck::CUpdateCheck_0x_08x_n
push ebx
call fcn.0042ff90
add esp, 0xc
push ebx
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.0049db30
push str.__UpdateClient_
push eax
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0x3c], 6
call fcn.0040bf20
add esp, 0x18
push eax
mov ecx, ebp
mov byte [esp + 0x28], 7
call fcn.00401fe0
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x4b9b9c
sub eax, 8
push eax
mov dword [esp + 0x30], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4b9bb4
sub eax, 8
push eax
mov dword [esp + 0x18], eax
call fcn.004d37ab
add esp, 4
mov eax, dword [ebp]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [esi + 0x368], bl
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x4b9be0
Capabilities:
Access peb ldr_data
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x51b168
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esi + 0xcc]
call fcn.00401fe0
mov cx, word [esp + 0x20]
mov edi, dword [esp + 0x24]
mov word [esi + 0xd0], cx
push edi
lea ecx, [esi + 0xd4]
call fcn.00401fe0
mov edx, dword [esp + 0x28]
push edx
lea ecx, [esi + 0x36c]
mov dword [esi + 0x360], 0
call fcn.00401fe0
mov al, byte [esp + 0x2c]
push 0x54e4a8
lea ecx, [esp + 0x30]
push edi
push ecx
mov byte [esi + 0x368], al
call fcn.0040bf20
add esp, 0xc
lea edi, [esi + 0x364]
push eax
mov ecx, edi
mov dword [esp + 0x18], 0
call fcn.0040e610
mov eax, dword [esp + 0x2c]
test eax, eax
mov dword [esp + 0x14], 0xffffffff
je 0x4b9ca5
sub eax, 8
push eax
mov dword [esp + 0x30], eax
call fcn.004d37ab
add esp, 4
mov dword [esp + 0x2c], 0
mov edx, dword [edi]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x14
Function at 0x4be1f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x56a260]
xor eax, esp
mov dword [esp + 0x210], eax
mov ecx, dword [esp + 0x21c]
mov eax, dword [esp + 0x218]
push esi
push edi
mov edi, dword [esp + 0x228]
lea edx, [esp + 8]
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4be269
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
xor ecx, esp
call fcn.004f2ac1
add esp, 0x214
ret 0xc