joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487b40
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x487baa
push 0x38
lea eax, [esp + 8]
push 0
push eax
call fcn.004d1df0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x440
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], str._DTLInstTheme_Start
mov dword [esp + 0x10], 0x50b998
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x487baa
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add esp, 0x3c
ret
xor al, al
add esp, 0x3c
ret

Function at 0x487d40
Capabilities:
Check os version

Disassembly:
cmp dword [0x532770], 2
mov dword [0x53275c], 1
jne 0x487d85
cmp dword [0x532764], 5
jb 0x487d85
push 0x11c
push 0
push 0x532760
call fcn.004d1df0
add esp, 0xc
push 0x532760
mov dword [0x532760], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
ret

Function at 0x488310
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x48831d
mov eax, dword [eax + 4]
jmp 0x48831f
xor eax, eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x532884], 0
je 0x488353
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x48833d
call fcn.00488770
mov eax, dword [0x532884]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x532884], 0
mov dword [0x532880], 0
pop ecx
ret

Function at 0x4889d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ef023
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi + 4], eax
mov byte [esi + 8], al
mov dword [esp + 0x14], eax
mov dword [esi], vtable.CBasicDialog.0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
xor ecx, ecx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], eax
mov word [esi + 0x20], cx
mov byte [esp + 0x14], 1
push 0x532ba8
mov edx, str.border2.png
mov dword [esi + 0x38], eax
call fcn.00405f10
mov dword [esi + 0x10], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x488ef0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4f165b
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x30]
mov edi, ecx
mov ebp, dword [esp + 0x24]
push 0x54c
call fcn.004c8f3d
add esp, 4
mov dword [esp + 0x30], eax
xor esi, esi
mov dword [esp + 0x1c], esi
cmp eax, esi
je 0x488f41
push eax
call fcn.00411830
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x28], ebp
mov ecx, edi
mov dword [ebp + 4], esi
call fcn.00411aa0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ecx
push ebx
push edx
push edi
push eax
mov edi, esi
call fcn.00411bf0
mov ecx, dword [esi + 4]
and ebx, 0x10000000
neg ebx
sbb ebx, ebx
and ebx, 5
push ebx
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x24
Function at 0x48a680
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x4f49bb
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
call fcn.0048a820
test al, al
je 0x48a6bd
xor eax, eax
jmp 0x48a801
call fcn.00463230
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push str._hide
push esi
call fcn.004c9453
test eax, eax
push str._start
push esi
sete bl
call fcn.004c9453
add esp, 0x10
test eax, eax
setne al
test al, al
je 0x48a6f3
xor bl, bl
mov ebp, 0x80020000
test bl, bl
je 0x48a701
mov ebp, 0x90020000
push 0
lea eax, [esp + 0x28]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
sub eax, 0x367
cdq
sub eax, edx
mov esi, eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
sar esi, 1
sub eax, 0x296
cdq
sub eax, edx
mov edi, eax
sar edi, 1
call fcn.00418d60
push 0
push 0x296
push 0x367
push edi
push esi
push ebp
push 0x5048c8
mov ebx, eax
push 0xc0000
push ebx
mov ecx, str.DTL_WallPaper
call fcn.00488ef0
lea ecx, [esp + 0x38]
mov ebp, vtable.CUserDataAnalysis.0
push ecx
mov dword [esp + 0x38], ebp
call fcn.004abdf0
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0xf4], 0
call fcn.004ac480
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x14]
push eax
call esi
lea ecx, [esp + 0x14]
lea edi, [esp + 0x38]
call fcn.004acb70
push 0
lea ecx, [esp + 0x38]
push ebx
mov dword [ebx + 0x1c4], ecx
call fcn.00413780
lea edx, [esp + 0x14]
push edx
call esi
lea eax, [esp + 0x3c]
call fcn.004acbf0
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x10], ecx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x14], edx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x18], ecx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x1c], edx
mov eax, edi
push eax
call fcn.004ac0e0
call fcn.0048a890
mov ecx, edi
mov esi, eax
mov dword [esp + 0x34], ebp
call fcn.004abf50
mov eax, esi
mov ecx, dword [esp + 0xe8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe0
ret
Function at 0x48b6f0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ee0c0
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, str.DtlWallPaperServices.exe
lea ecx, [esp + 0x70]
call fcn.00460ea0
xor ebp, ebp
mov edi, str.DtlWallPaperSvr.exe
lea ecx, [esp + 0x54]
mov dword [esp + 0x98], ebp
call fcn.00460ea0
mov byte [esp + 0x98], 1
mov edx, dword [esp + 0x74]
mov ebx, 8
cmp dword [esp + 0x88], ebx
jae 0x48b768
lea edx, [esp + 0x74]
call fcn.004623e0
mov edi, edx
mov edx, dword [esp + 0x58]
mov esi, eax
cmp dword [esp + 0x6c], ebx
jae 0x48b77f
lea edx, [esp + 0x58]
call fcn.004623e0
mov ecx, esi
or ecx, edi
je 0x48b800
mov ecx, eax
or ecx, edx
je 0x48b800
cmp eax, esi
jne 0x48b798
cmp edx, edi
je 0x48b800
push 0x38
lea edx, [esp + 0x20]
push ebp
push edx
call fcn.004d1df0
add esp, 0xc
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x440
mov dword [esp + 0x30], ebp
cmp dword [esp + 0x88], ebx
jb 0x48b7cf
mov eax, dword [esp + 0x74]
mov dword [esp + 0x28], eax
jmp 0x48b7d7
lea ecx, [esp + 0x74]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0x50cd38
call fcn.00422ed0
movzx edx, al
neg edx
sbb edx, edx
lea eax, [esp + 0x18]
and edx, 0x50b998
push eax
mov dword [esp + 0x28], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [esp + 0x6c], ebx
jb 0x48b813
mov ecx, dword [esp + 0x58]
push ecx
call fcn.004c8f17
add esp, 4
xor edx, edx
mov word [esp + 0x58], dx
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], 7
cmp dword [esp + 0x88], ebx
jb 0x48b83c
mov eax, dword [esp + 0x74]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.004c8f08
add esp, 0x88
ret
Function at 0x48b870
Capabilities:
Create directory

Disassembly:
sub esp, 0x74
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
push ebx
xor ebx, ebx
mov dword [esp + 0x14], eax
mov byte [esp + 7], bl
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0x6c], bl
mov byte [esp + 0x6d], bl
mov byte [esp + 0x6e], bl
mov byte [esp + 0x6f], bl
mov byte [esp + 0x70], bl
mov byte [esp + 0x71], 1
mov byte [esp + 0x64], bl
mov byte [esp + 0x65], bl
mov byte [esp + 0x66], bl
mov byte [esp + 0x67], bl
mov byte [esp + 0x68], bl
mov byte [esp + 0x69], 5
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
cmp eax, ebx
jne 0x48b8f3
xor al, al
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004c8f08
add esp, 0x74
ret 4
push ebp
push esi
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
cmp ebp, ebx
je 0x48b9fc
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x48b9fc
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea ecx, [esp + 0x9c]
push ecx
call esi
test eax, eax
je 0x48b9fc
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [esp + 0x94]
push eax
call esi
test eax, eax
je 0x48b9fc
push 0x40
lea ecx, [esp + 0x30]
push ebx
push ecx
call fcn.004d1df0
mov edx, dword [esp + 0x1c]
mov ecx, 0x1f01ff
add esp, 0xc
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x18]
push ecx
mov eax, 3
mov dword [esp + 0x4c], edx
push ebx
lea edx, [esp + 0x34]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x1c]
push edx
push 2
mov dword [esp + 0x40], 1
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], 5
mov dword [esp + 0x60], 1
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 2
mov dword [esp + 0x78], eax
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x48b9fc
mov eax, dword [esp + 0x18]
push ebx
push eax
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x48b9fc
mov dword [esp + 0x24], ebp
mov byte [esp + 0xf], 1
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp eax, ebx
je 0x48ba1d
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x48ba28
push eax
call esi
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp eax, ebx
je 0x48ba39
push eax
call esi
cmp ebp, ebx
je 0x48ba40
push ebp
call esi
mov ecx, dword [esp + 0x7c]
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c8f08
add esp, 0x74
ret 4
Function at 0x48ba60
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4ed618
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
lea eax, [esp + 0x28]
push eax
call fcn.00493540
add esp, 4
mov dword [esp + 0x50], 0
cmp dword [esp + 0x3c], 0
mov edi, 8
je 0x48bb02
push str.DtlWallPaper_
lea ecx, [esp + 0x2c]
lea esi, [esp + 0x10]
call fcn.0041e3f0
mov eax, dword [esp + 0x14]
add esp, 4
cmp dword [esp + 0x24], edi
jae 0x48bad4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], edi
jae 0x48bae9
lea eax, [esp + 0x10]
push eax
call fcn.0048b870
cmp dword [esp + 0x24], edi
jb 0x48bb02
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004c8f17
add esp, 4
cmp dword [esp + 0x40], edi
jb 0x48bb15
mov edx, dword [esp + 0x2c]
push edx
call fcn.004c8f17
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004c8f08
add esp, 0x48
ret

Function at 0x48c090
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x532400]
push edi
test esi, esi
jne 0x48c0f0
push 4
call fcn.004c8f3d
mov esi, eax
add esp, 4
test esi, esi
je 0x48c0e8
mov dword [esi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x5340e0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
dec eax
mov dword [esi], eax
mov dword [eax*4 + 0x533ce0], edi
mov edi, esi
mov dword [0x532400], esi
call fcn.0048c4e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
mov dword [0x532400], esi
mov edi, esi
call fcn.0048c4e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48c4e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4f15e1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [edi]
mov ecx, dword [eax*4 + 0x533ce0]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48c51e
mov eax, dword [eax]
test eax, eax
jne 0x48c574
push 4
call fcn.004c9b25
add esp, 4
mov esi, eax
push 0xc
mov dword [esp + 0xc], esi
call fcn.004c8f3d
add esp, 4
test eax, eax
je 0x48c543
mov dword [eax], esi
mov dword [eax + 4], edi
jmp 0x48c545
xor eax, eax
mov dword [eax + 8], 0x48c590
mov edx, dword [edi]
push eax
mov eax, dword [edx*4 + 0x533ce0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
test esi, esi
je 0x48c572
call fcn.0048c010
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x48e110
Capabilities:
Create thread

Disassembly:
cmp dword [esi], 0
push ebx
push edi
jne 0x48e143
push 0
push 0
push 0
push 0
mov byte [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0x48e2f0
push 0
push 0
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
cmp byte [esi + 8], 0
jne 0x48e176
lea ebx, [esi + 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0xc]
push eax
lea edi, [esi + 0x10]
call fcn.00453320
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esi + 4]
pop edi
pop ebx
mov dword [esp + 4], ecx
jmp dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop ebx
ret 4
Function at 0x491840
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4f540c
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov eax, dword [edi + 0x34]
sub eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x30]
sub ecx, dword [edi + 0x28]
push eax
push ecx
xor ebp, ebp
push ebp
push ebp
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0xf
add eax, 0x14
add ecx, 0x1e
xor edx, edx
mov ebx, 7
push 0x50d79c
lea esi, [esp + 0x34]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebp
mov word [esp + 0x38], dx
call fcn.00401760
mov dword [esp + 0xc8], ebp
push 0xf
xor eax, eax
push 0x50d7bc
lea esi, [esp + 0x50]
mov dword [esp + 0x68], ebx
mov dword [esp + 0x64], ebp
mov word [esp + 0x54], ax
call fcn.00401760
mov byte [esp + 0xc8], 1
push 0xf
xor ecx, ecx
push 0x50d7dc
lea esi, [esp + 0x6c]
mov dword [esp + 0x84], ebx
mov dword [esp + 0x80], ebp
mov word [esp + 0x70], cx
call fcn.00401760
mov byte [esp + 0xc8], 2
push 0xf
xor edx, edx
push 0x50d7fc
lea esi, [esp + 0x88]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x9c], ebp
mov word [esp + 0x8c], dx
call fcn.00401760
mov byte [esp + 0xc8], 3
push 0xf
xor eax, eax
push 0x50d81c
lea esi, [esp + 0xa4]
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xb8], ebp
mov word [esp + 0xa8], ax
call fcn.00401760
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc8], 4
lea ebx, [esp + 0x30]
mov ebp, 5
cmp dword [ebx + 0x14], 8
jb 0x4919ac
mov ecx, dword [ebx]
jmp 0x4919ae
mov ecx, ebx
mov edx, dword [esp + 0x14]
push 0x16
push 0x96
push esi
push edx
push edi
call fcn.0040f890
add esp, 0x14
add ebx, 0x1c
add esi, 0x1e
sub ebp, 1
mov dword [eax + 0xb4], 0x5a5a5a
jne 0x4919a2
mov ebp, dword [esp + 0x10]
xor esi, esi
mov dword [esp + 0x18], esi
push 0x532ba8
mov edx, str.feedbackgroup_btn.png
call fcn.00405f10
push eax
push 0x16
push 0x5a
push ebp
push 0xaa
push 0x4feab8
push edi
mov ecx, 4
call fcn.004021b0
mov ebx, eax
mov eax, dword [esp + 0x34]
add esp, 0x1c
push eax
mov eax, 0x4916b0
push eax
push edi
mov edx, ebx
call fcn.00402400
mov dword [ebx + 0xc], esi
inc esi
add esp, 0xc
add ebp, 0x1e
cmp esi, 5
jb 0x4919e3
push fcn.004016f0
push 5
push 0x1c
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0xd8], 0xffffffff
call fcn.004c93f0
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.004c8f08
add esp, 0xbc
ret
Function at 0x492030
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4ee060
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esp + 0x2c]
call fcn.004924b0
push 0xffffffffffffffff
push 0
push eax
mov eax, esi
mov dword [esp + 0x5c], 0
call fcn.00401850
mov ebp, 8
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x44], ebp
jb 0x492095
mov eax, dword [esp + 0x30]
push eax
call fcn.004c8f17
add esp, 4
push 0x10
push 0x50da9c
mov eax, esi
call fcn.004088a0
lea edi, [esp + 0x10]
call fcn.004924b0
push 0xffffffffffffffff
push 0
lea edi, [esi + 0x1c]
push eax
mov eax, edi
mov dword [esp + 0x5c], 1
call fcn.00401850
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x28], ebp
jb 0x4920de
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004c8f17
add esp, 4
push 0xb
xor edx, edx
push 0x50dac0
mov eax, edi
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], dx
call fcn.004088a0
cmp dword [esi + 0x18], ebp
jb 0x49210d
mov esi, dword [esi + 4]
jmp 0x492110
add esi, 4
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x492146
cmp dword [edi + 0x18], ebp
jb 0x492127
mov edi, dword [edi + 4]
jmp 0x49212a
add edi, 4
push edi
call esi
test eax, eax
je 0x492146
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x44
ret
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x44
ret

Function at 0x492160
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x20
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, ecx
call fcn.00492410
test al, al
jne 0x49218a
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x20
ret
push edi
lea edi, [esp + 8]
call fcn.004924b0
mov eax, dword [esp + 0xc]
mov edi, 8
cmp dword [esp + 0x20], edi
jae 0x4921a7
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4921c9
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], edi
jae 0x4921c0
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
mov edx, str.DATAFILE
mov ecx, 0x81
call fcn.00492290
add esi, 0x1c
push esi
mov edx, str.DATAFILE
mov ecx, 0x82
call fcn.00492290
cmp dword [esp + 0x20], edi
pop edi
jb 0x492200
mov eax, dword [esp + 8]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x20]
pop esi
xor ecx, esp
mov al, 1
call fcn.004c8f08
add esp, 0x20
ret
Function at 0x492290
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get common file path
Move file
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [esp + 0x21c]
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x4922ed
cmp dword [ebx + 0x14], 0
je 0x4922ed
cmp dword [ebx + 0x18], 8
lea eax, [ebx + 4]
mov dword [esp + 0xc], eax
jb 0x4922cb
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4922dd
mov al, 1
jmp 0x4923e7
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4922f4
xor al, al
jmp 0x4923e7
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4922ed
push ebp
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov dword [esp + 0x14], 0xffffffff
test edi, edi
je 0x4923dd
cmp word [0x533568], 0
jne 0x492342
push 0x533568
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22]
push ecx
mov word [esp + 0x24], ax
call fcn.004d1df0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 0
push str.data
push 0x533568
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4923a2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4923e6
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx + 0x18], 8
jb 0x4923c7
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
jmp 0x4923cb
mov eax, dword [esp + 0x10]
push 2
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x49239e
xor eax, eax
cmp dword [esp + 0x14], ebp
sete al
pop ebp
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c8f08
add esp, 0x214
ret 4
Function at 0x492410
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esp + 4], eax
cmp eax, ebx
je 0x49248d
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x49247e
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
xor edx, edx
cmp eax, 1
sete dl
pop ebx
xor ecx, esp
mov al, dl
call fcn.004c8f08
add esp, 0x14
ret

Function at 0x492580
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x248
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x244], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x46]
push ecx
mov word [esp + 0x48], ax
call fcn.004d1df0
add esp, 0xc
push 0x104
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [esp + 8]
push 0
push eax
call fcn.004d1df0
add esp, 0xc
lea edx, [esp]
lea ecx, [esp + 0x3c]
push edx
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x440
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], 0x50b998
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x244]
test eax, eax
setne al
xor ecx, esp
call fcn.004c8f08
add esp, 0x248
ret