joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7e50
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004d9060
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4a7eae
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a7eb7
sub ecx, edx
sar ecx, 1
je 0x4a7e9b
push ecx
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
call fcn.0043b750
push 1
push 0x511fec
mov ecx, esi
call fcn.00452320
push 3
push 0x511fe4
mov ecx, esi
call fcn.00452320
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a7f0c
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4a7e9b
push 1
push 0x511fec
mov ecx, esi
call fcn.00452320
push 0x11
push 0x511ff0
mov ecx, esi
call fcn.00452320
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004d89fb
mov esp, ebp
pop ebp
ret 4

Function at 0x4a8470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
jne 0x4a8486
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4a84a8
push dword [esi + 0x20]
push eax
call fcn.00490380
push dword [esi + 0x1c]
call fcn.004d92bb
add esp, 0xc
mov dword [esi + 0x1c], 0
push 0
push 0
push 0
push 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, esi
mov dword [esi + 0x40], eax
call fcn.004a8150
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0
push esi
push 0x4a7f40
push 0
push 0
call fcn.004da73c
add esp, 0x18
mov dword [esi + 0x3c], edi
xor ecx, ecx
mov dword [esi + 0x2c], eax
test eax, eax
setne cl
pop edi
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x4a8940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5011c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x4a8a65
cmp byte [ebx + 0x45], 0
je 0x4a8a65
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4a8994
xor al, al
jmp 0x4a8a67
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4a89fe
dec eax
je 0x4a8a02
sub eax, 2
je 0x4a8a4e
xor bl, bl
jmp 0x4a8a50
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x4a8a34
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004deb8b
add esp, 0x10
cmp esi, eax
jne 0x4a89fa
cmp byte [ebx + 0x45], 0
je 0x4a8a4e
test esi, esi
jne 0x4a89c4
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.004a9410
jmp 0x4a89c4
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x4a8a61
push dword [ebp - 0x28]
call fcn.004d89f1
add esp, 4
mov al, bl
jmp 0x4a8a67
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
Function at 0x4a9e30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501378
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
cmp ecx, 0xffffffff
jne 0x4a9e6c
xor eax, eax
jmp 0x4a9ffc
mov eax, dword [ebx + 0x20]
mov edx, dword [eax]
test edx, edx
je 0x4a9e9a
mov esi, dword [ebx + 0x30]
mov edi, dword [esi]
lea eax, [edi + edx]
cmp edx, eax
jae 0x4a9e9a
lea eax, [edi - 1]
mov dword [esi], eax
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov byte [edx], al
jmp 0x4a9ffc
cmp dword [ebx + 0x50], 0
jne 0x4a9ea8
or eax, 0xffffffff
jmp 0x4a9ffc
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x44]
cmp dword [esi], eax
jne 0x4a9ec9
mov ecx, dword [ebx + 0x38]
mov edx, dword [ebx + 0x3c]
mov dword [esi], ecx
sub edx, ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebp + 8]
mov dword [eax], edx
cmp dword [ebx + 0x40], 0
jne 0x4a9eee
push dword [ebx + 0x50]
movsx eax, cl
push eax
call fcn.004de127
or ecx, 0xffffffff
add esp, 8
cmp eax, ecx
cmovne ecx, dword [ebp + 8]
mov eax, ecx
jmp 0x4a9ffc
mov byte [ebp - 0x2c], cl
lea eax, [ebp - 0x28]
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x30]
mov esi, dword [ebx + 0x40]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edi, dword [esi]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebx + 0x48]
push eax
call dword [edi + 0x1c]
test eax, eax
js 0x4a9fe6
cmp eax, 1
jg 0x4a9fc6
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub esi, eax
je 0x4a9f97
push dword [ebx + 0x50]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call fcn.004deb8b
add esp, 0x10
cmp esi, eax
jne 0x4a9fe6
lea eax, [ebp - 0x2c]
mov byte [ebx + 0x45], 1
cmp dword [ebp - 0x34], eax
jne 0x4a9fc1
test esi, esi
jne 0x4a9f21
cmp dword [ebp - 0x18], 0x20
jae 0x4a9fe6
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.004a9410
jmp 0x4a9f21
mov ebx, dword [ebp + 8]
jmp 0x4a9fe9
cmp eax, 3
jne 0x4a9fe6
push dword [ebx + 0x50]
push dword [ebp - 0x2c]
call fcn.004a6ba0
or ecx, 0xffffffff
add esp, 8
test al, al
cmovne ecx, dword [ebp + 8]
mov ebx, ecx
jmp 0x4a9fe9
or ebx, 0xffffffff
cmp dword [ebp - 0x14], 0x10
jb 0x4a9ffa
push dword [ebp - 0x28]
call fcn.004d89f1
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret 4
Function at 0x4acb50
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov word [ebp - 0x20], ax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x140]
push eax
movdqu xmmword [ebp - 0x1e], xmm0
movq qword [ebp - 0xe], xmm0
movdqu xmmword [ebp - 0x160], xmm0
movdqu xmmword [ebp - 0x150], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x140], 0
mov ecx, esi
push 2
je 0x4acbd4
push 0x5125a0
call fcn.0043b750
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
jmp 0x4acbeb
push 0x5125a8
call fcn.0043b750
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x164]
cmp eax, 0xa
ja case.default.0x4acbf7
jmp dword [eax*4 + 0x4accfc]
push 0x5125b0
jmp 0x4acc50
push str.mips
jmp 0x4acc50
push str.alpha32
jmp 0x4acc50
push 0x5125d4
jmp 0x4acc50
push 0x5125dc
jmp 0x4acc50
push 0x5125e4
jmp 0x4acc50
push str.ia64
jmp 0x4acc50
push str.alpha64
jmp 0x4acc50
push str.msil
jmp 0x4acc50
push 0x512614
jmp 0x4acc50
push str.ia32onWin64
jmp 0x4acc50
push 0x512634
lea eax, [ebp - 0x20]
push 0xd
push eax
call fcn.004dab36
add esp, 0xc
lea eax, [ebp - 0x138]
push pe_nt_image_headers32
push 0
push eax
call fcn.004d9060
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4accc7
lea eax, [ebp - 0x20]
push eax
movzx eax, word [ebp - 0x28]
push eax
movzx eax, byte [ebp - 0x22]
push eax
push dword [ebp - 0x134]
push dword [ebp - 0x138]
push str._d._d._d.sp_d._s
push edi
call fcn.0043ad30
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x20]
lea esi, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4accd0
sub edx, esi
lea eax, [ebp - 0x20]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.0043b750
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
Function at 0x4ad840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5018e0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
call fcn.0043ae40
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x4ad887
push 0x80004005
call fcn.0043a9b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [0x53eb08]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push dword [0x53e7d4]
push dword [0x53e7c8]
push 0x508008
push eax
call fcn.0043ad30
add esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x30]
push 1
push esi
push reloc.WS2_32.dll_accept
mov byte [ebp - 4], 1
call fcn.0043b290
or ebx, 0xffffffff
test eax, eax
mov eax, dword [ebp - 0x30]
jne 0x4ad9b7
mov esi, dword [ebp - 0x18]
mov edi, 0x53dc90
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], 4
push ecx
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [edi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ad9a2
cmp dword [ebp - 0x20], 4
jne 0x4ad9a2
push dword [edi]
lea ecx, [ebp - 0x18]
call fcn.0043a420
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
call fcn.004b6e70
add esp, 8
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
lea ecx, [esi + 0x70]
call fcn.004a6850
mov edx, dword [ebp - 0x24]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ad982
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ad9a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x30]
add edi, 4
cmp edi, 0x53dcec
jl 0x4ad905
mov esi, dword [ebp - 0x14]
test eax, eax
je 0x4ad9c2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4ad9e0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6c60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0043b290
mov esi, dword [ebp - 0xc]
mov edi, eax
test edi, edi
jne 0x4b6cac
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x4b6cb7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b6cd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push ebx
push esi
push edi
mov ebx, dword [eax]
push 2
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0043b290
mov esi, dword [ebp - 0xc]
mov edi, eax
test edi, edi
jne 0x4b6d27
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x4b6d32
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b7d90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502ad0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4b7dd4
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov ecx, 0xffffffff
mov dword [ebp - 4], 0
sub eax, 0
je 0x4b7e14
dec eax
je 0x4b7e0b
dec eax
je 0x4b7e02
xor ebx, ebx
jmp 0x4b7f76
push 5
push str.cr_tb
jmp 0x4b7e1b
push 5
push str.ff_tb
jmp 0x4b7e1b
push 5
push str.ie_tb
lea ecx, [ebp - 0x10]
call fcn.0043b750
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4b7e3f
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp + 8], edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp dword [eax + 4], 0
je 0x4b7f50
mov ecx, dword [eax + 8]
xor ebx, ebx
test ecx, ecx
je 0x4b7e81
mov edx, dword [eax]
mov eax, edx
lea ecx, [ecx]
cmp dword [eax], 0
jne 0x4b7faa
inc ebx
add eax, 4
cmp ebx, ecx
jb 0x4b7e70
xor ebx, ebx
test ebx, ebx
je 0x4b7f50
jmp 0x4b7e90
test ebx, ebx
je 0x4b7f50
push dword [ebx]
lea eax, [ebp + 8]
push dword [0x53e7d4]
push dword [0x53e7c8]
push 0x508008
push eax
call fcn.0043ad30
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x20]
mov eax, dword [ebx + 4]
add esp, 0x14
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 2
push edi
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x18], 0
call fcn.0043b290
test eax, eax
mov eax, dword [ebp - 0x20]
jne 0x4b7f01
push 4
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4b7f13
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x20], 0
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x1c], 0
test ecx, ecx
jne 0x4b7f46
mov esi, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebx + 0xc]
mov ebx, dword [esi + 8]
div ebx
inc edx
nop
cmp edx, ebx
jae 0x4b7f43
mov eax, dword [esi]
mov eax, dword [eax + edx*4]
test eax, eax
cmovne ecx, eax
inc edx
test ecx, ecx
je 0x4b7f30
mov esi, dword [ebp - 0x10]
mov ebx, ecx
test ecx, ecx
jne 0x4b7e90
add edi, 0xfffffff0
mov byte [ebp - 4], 0
mov ebx, 1
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4b7f73
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
or ecx, 0xffffffff
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4b7f94
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [edx + ebx*4]
jmp 0x4b7e83
Function at 0x4ba0c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502d20
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov edx, dword [edi]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x4ba1d5
jle 0x4ba1d5
push 0x3b
push edx
call fcn.004d94a2
mov esi, eax
add esp, 8
test esi, esi
je 0x4ba1d5
sub esi, dword [edi]
sar esi, 1
test esi, esi
jle 0x4ba1d5
push esi
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0043b0a0
push eax
lea ecx, [ebx + 8]
mov dword [ebp - 4], 0
call fcn.0043a620
mov edx, dword [ebp + 8]
or eax, 0xffffffff
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4ba164
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax - 0xc]
sub eax, esi
dec eax
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0043b1e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
mov dword [ebp - 4], 1
push eax
call fcn.0043a620
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ba1b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4bb6e0
Capabilities:
Check if file exists
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
lea esi, [edi + 8]
cmp dword [eax - 0xc], 0
jne 0x4bb6f5
pop edi
xor eax, eax
pop esi
ret
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bb708
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push 0
mov ecx, edi
call fcn.004bb300
test eax, eax
je 0x4bb6f0
push esi
push 1
mov ecx, edi
call fcn.004bb300
test eax, eax
je 0x4bb6f0
push esi
push 2
mov ecx, edi
call fcn.004bb300
test eax, eax
je 0x4bb6f0
push dword [esi]
push dword [edi + 4]
push dword [0x53eae0]
push dword [0x53eadc]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
neg eax
pop edi
sbb eax, eax
neg eax
pop esi
ret
Function at 0x4bb950
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x210], ebx
test edi, edi
je 0x4bba50
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4bba50
lea eax, [ebp - 0x208]
push eax
push 0x10008
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bba55
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
lea ecx, [ecx]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0xff
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x208]
call ebx
mov esi, eax
cmp esi, 0x103
je 0x4bba22
test esi, esi
jne 0x4bba31
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
call fcn.004bb950
mov esi, eax
add esp, 8
test esi, esi
je 0x4bb9b0
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
mov eax, 0x3f2
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
Function at 0x4bd7e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x84]
push 0xfde9
mov dword [ebp - 0x88], ecx
lea ecx, [ebp - 0x88]
push eax
call fcn.00465ce0
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x84]
cmp eax, ecx
je 0x4bd838
push eax
call fcn.004d92bb
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret 8
Function at 0x4c06f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbf08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
call fcn.0043ae40
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4c0736
push 0x80004005
call fcn.0043a9b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.004c0660
mov esi, dword [ebp - 0x10]
add esp, 4
test eax, eax
je 0x4c07e9
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4c07e4
push ebx
call fcn.004d7faf
push ebx
mov edi, eax
push 0
push edi
call fcn.004d9060
add esp, 0x10
test edi, edi
je 0x4c07db
push edi
push ebx
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4c07db
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x509c8c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4c07db
cmp dword [ebp - 0x14], 0
je 0x4c07db
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
push edx
push str._d._d._d._d
push dword [ebp + 8]
call fcn.0043ad30
add esp, 0x18
push edi
call fcn.004d89f6
add esp, 4
mov edi, 1
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4c080a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c0870
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov dword [0x544128], esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push esi
push 0
push 0
push 0x32
push 0x64
push 0
push SysReAllocStringLen
push 0x80000
push 0x544130
push 0x5441f8
push 0xa8
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push 0
test esi, esi
jne 0x4c08ef
push eax
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x40
push str.Error
push dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
pop ebp
ret
push esi
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push esi
mov ecx, 0x5443f4
call fcn.004d2820
push esi
mov ecx, 0x5442c8
call fcn.004ccb40
mov eax, esi
pop esi
pop ebp
ret