joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0870
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x2000], eax
mov eax, dword [esp + 0x2008]
push esi
push edi
push 0x506a7c
push eax
mov esi, ecx
call fcn.004b4390
mov edi, eax
test edi, edi
sete al
mov byte [esi + 0x3028], al
test al, al
je 0x4a08b6
xor al, al
jmp 0x4a0971
push ebx
push ebp
push edi
push 0x2000
lea eax, [esp + 0x18]
push 1
push eax
xor ebx, ebx
call fcn.004eb477
mov ebp, eax
add esp, 0x10
cmp ebp, 0x20
jbe 0x4a0937
lea eax, [ebp - 0x20]
xor esi, esi
test eax, eax
jle 0x4a090e
nop
cmp byte [esp + esi + 0x10], 0x61
jne 0x4a0906
cmp byte [esp + esi + 0x11], 0x73
jne 0x4a0906
push 0x14
lea ecx, [esp + esi + 0x16]
push str.Invoker_
push ecx
call fcn.004e92ff
add esp, 0xc
test eax, eax
je 0x4a0944
inc esi
lea eax, [ebp - 0x20]
cmp esi, eax
jl 0x4a08e0
push 0
lea ebx, [ebx + ebp - 0x20]
push ebx
push edi
call fcn.004eb51e
push edi
push 0x2000
lea edx, [esp + 0x24]
push 1
push edx
call fcn.004eb477
mov ebp, eax
add esp, 0x1c
cmp ebp, 0x20
ja 0x4a08d6
push edi
call fcn.004eae6b
add esp, 4
xor al, al
jmp 0x4a096f
push 0
add esi, ebx
push esi
push edi
call fcn.004eb51e
push edi
push 0x15
push 1
push str.requireAdministrator_
call fcn.004eb049
cmp eax, 0x15
push edi
sete bl
call fcn.004eae6b
add esp, 0x20
mov al, bl
pop ebp
pop ebx
mov ecx, dword [esp + 0x2008]
pop edi
pop esi
xor ecx, esp
call fcn.004e6b3a
add esp, 0x2004
ret 4

Function at 0x4a1e00
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x200c
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x2008], eax
mov eax, dword [esp + 0x2010]
push ebx
push esi
push 0x5048cc
push eax
call fcn.004452a0
mov esi, eax
xor ebx, ebx
mov dword [esp + 8], esi
cmp esi, ebx
jne 0x4a1e3f
xor al, al
jmp 0x4a1ed0
push ebp
push edi
mov dword [esp + 0x14], ebx
push esi
push 0x2000
lea eax, [esp + 0x20]
push 1
push eax
call fcn.004eb477
mov edi, eax
add esp, 0x10
cmp edi, 0x20
jle 0x4a1ec3
lea ebp, [edi - 0x20]
xor esi, esi
test ebp, ebp
jle 0x4a1e9b
lea ebx, [ebx]
cmp byte [esp + esi + 0x18], 0x72
jne 0x4a1e96
cmp byte [esp + esi + 0x19], 0x65
jne 0x4a1e96
push 0x14
lea ecx, [esp + esi + 0x1e]
push str.quireAdministrator_
push ecx
call fcn.004e92ff
add esp, 0xc
test eax, eax
je 0x4a1ee9
inc esi
cmp esi, ebp
jl 0x4a1e70
mov edx, dword [esp + 0x10]
push 0
lea ebx, [ebx + edi - 0x20]
push ebx
push edx
call fcn.004eb51e
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
inc eax
add esp, 0xc
mov dword [esp + 0x14], eax
cmp eax, 0x80
jb 0x4a1e45
push esi
call fcn.004eae6b
add esp, 4
xor al, al
pop edi
pop ebp
mov ecx, dword [esp + 0x2010]
pop esi
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x200c
ret 4
mov eax, dword [esp + 0x10]
push eax
call fcn.004eae6b
add esp, 4
mov al, 1
jmp 0x4a1ece
Function at 0x4a3bb0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x130
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x12c], eax
cmp dword [0x518160], 0
push esi
mov esi, dword [esp + 0x140]
push edi
jne 0x4a3c09
push 0x64
lea eax, [esp + 0x70]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov cx, word [esp + 0x6c]
xor edx, edx
mov word [0x56be10], cx
mov word [0x56be12], dx
mov dword [0x518160], 0x56be10
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
push 0x32
lea eax, [esp + 0xc]
push eax
push ecx
push edx
call fcn.00469570
mov edi, dword [esp + 0x148]
push edi
push esi
push 0x518150
lea ecx, [esp + 0x14]
xor eax, eax
push ecx
push eax
push 0x400
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov ecx, dword [esp + 0x134]
xor edx, edx
mov word [esi + edi*2 - 2], dx
pop edi
pop esi
xor ecx, esp
call fcn.004e6b3a
add esp, 0x130
ret 0x10

Function at 0x4a4070
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebp
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x4a40d7
push esi
push edi
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e68bd
mov esi, eax
add esp, 4
test esi, esi
je 0x4a40d5
push edi
push esi
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esp + 0x18]
push 0
push 0
push eax
push esi
call fcn.004a3ee0
push esi
call fcn.004e6904
add esp, 4
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x4a58f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x30
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, ecx
cmp ebp, 0xa9
jne 0x4a5949
push 1
push str.Settings
call fcn.00481720
test eax, eax
je 0x4a593e
mov eax, dword [0x53f484]
mov ecx, dword [0x531154]
lea esi, [edi + 0x1088]
push esi
push 0x4a5520
push eax
push str.ORGTHEMES
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [esi], 0
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x30
ret 4
cmp ebp, 0xaa
jne 0x4a597a
push 1
push 0x501a20
push 0
push 0x4f9
call fcn.00463400
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x30
ret 4
mov eax, dword [0x53f484]
test eax, eax
jne 0x4a5987
xor esi, esi
jmp 0x4a59b0
push eax
call dword [sym.imp.USER32.dll_GetMenu]
test eax, eax
jne 0x4a5996
xor esi, esi
jmp 0x4a59b0
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push 4
push eax
call esi
test eax, eax
jne 0x4a59a9
xor esi, esi
jmp 0x4a59b0
push 5
push eax
call esi
mov esi, eax
cmp ebp, 0xab
jne 0x4a59c9
mov dword [edi + 0x80], 0xffffffff
push 0x501a20
jmp 0x4a5a2b
lea edx, [ebp - 0x3e8]
cmp edx, 0x7f
ja 0x4a5a71
push 0x30
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004e7df0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0
push ebp
push esi
mov dword [esp + 0x1c], 0x30
mov dword [esp + 0x20], 0x20
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x4a5a71
mov eax, dword [esp + 0x2c]
cmp eax, dword [edi + 0x74]
jae 0x4a5a71
mov dword [edi + 0x80], eax
imul eax, eax, 0x1304
add eax, dword [edi + 0x70]
push eax
call fcn.004534c0
push eax
push str.ActivePath
push str.InterfaceThemes
call fcn.0049c4c0
mov eax, dword [edi + 0x1084]
push ebx
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
cmp eax, 0xffffffff
je 0x4a5a52
push 0
push eax
push esi
call ebx
push 8
push ebp
push esi
call ebx
mov ecx, edi
mov dword [edi + 0x1084], ebp
call fcn.004a4b90
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x30
ret 4
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x30
ret 4
Function at 0x4a64b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
mov ebx, dword [sym.imp.COMCTL32.dll_CreateMappedBitmap]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetSysColor]
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
xor esi, esi
jmp 0x4a64d5
xor edi, edi
push 0xf
call ebp
mov edx, dword [0x531154]
push 1
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x518184]
push edi
push eax
push edx
mov dword [esp + 0x34], edi
call ebx
push 0xf
mov dword [esi + 0x5181a8], eax
call ebp
mov dword [esp + 0x18], edi
mov edi, dword [esi + 0x518188]
push 2
mov dword [esp + 0x20], eax
mov eax, dword [0x531154]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, dword [0x531154]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a653b
movzx eax, word [eax + 0xe]
cmp eax, 8
je 0x4a6543
mov dword [esp + 0x18], 0x800080
mov eax, dword [0x531154]
push 1
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push eax
call ebx
mov dword [esi + 0x5181ac], eax
add esi, 0x38
cmp esi, 0x460
jb 0x4a64d3
push 0xf
mov dword [esp + 0x2c], 0xc0c0c0
call ebp
mov edx, dword [0x531154]
push 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0x67
push edx
mov dword [esp + 0x40], eax
call ebx
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x18], eax
cmp byte [0x531198], 0
je 0x4a65a4
push eax
call fcn.004b3a20
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7a30
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x70
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4a7a4b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 4], 0
push 1
push str.ViewSmall
push str.GeneralToolbar
call fcn.0049c560
test eax, eax
je 0x4a7c03
mov eax, dword [0x531150]
mov ecx, dword [0x53f484]
push ebx
push ebp
push edi
push 0
push eax
push 0xd
push ecx
push 0
push 0
push 0
push 0
push 0x56000944
push 0
push str.ToolbarWindow32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x14
push 0x41e
push eax
mov dword [esi + 4], eax
call ebp
call fcn.004b5060
mov ebx, 0x10
mov byte [esp + 0x13], al
mov dword [esp + 0x14], ebx
test al, al
je 0x4a7ad2
push ebx
call fcn.004b4fc0
push 0x10
mov ebx, eax
call fcn.004b4fc0
mov dword [esp + 0x14], eax
movzx edi, word [esp + 0x14]
mov eax, dword [esi + 4]
movzx edx, bx
shl edi, 0x10
or edi, edx
push edi
push 0
push 0x41f
push eax
call ebp
mov ecx, dword [esi + 4]
push edi
push 0
push 0x420
push ecx
call ebp
push 0
push 0xf
push str.FolderUp.bmp
mov ecx, 0x54e740
call fcn.004a5400
mov edi, eax
test edi, edi
jne 0x4a7b17
mov edi, dword [esi + 0x18]
cmp byte [esp + 0x13], 0
je 0x4a7b37
mov edx, dword [esp + 0x14]
push edx
push ebx
push edi
call fcn.004b50d0
mov edi, eax
push edi
mov ecx, 0x54e740
call fcn.004a4de0
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
push 1
push 0x413
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], edi
call ebp
mov edx, dword [esi + 4]
push 0x5185e0
push 1
push 0x444
push edx
call ebp
lea eax, [esp + 0x30]
push eax
push 2
mov ecx, esi
call fcn.004a6d00
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], 0x38
mov dword [esp + 0x34], 0x173
test eax, eax
jne 0x4a7b92
mov eax, 1
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
or eax, 4
push 0x12
mov dword [esp + 0x3c], eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x68], 2
mov dword [esp + 0x58], 0
call edi
push 0xf
mov dword [esp + 0x40], eax
call edi
cmp dword [esp + 0x5c], 0
mov dword [esp + 0x40], eax
jne 0x4a7bd5
mov dword [esp + 0x5c], 0x28
mov eax, dword [0x549cb0]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x30]
push edx
push 0xffffffffffffffff
push 0x40a
push eax
mov dword [esp + 0x68], ecx
call ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x70
ret
Function at 0x4aa080
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x2000], eax
cmp dword [ecx + 0x28], 0
mov eax, dword [esp + 0x2008]
je 0x4aa222
cmp byte [ecx + 0x25], 0
je 0x4aa222
cmp dword [eax + 8], 6
jb 0x4aa222
mov edx, dword [eax]
push esi
mov esi, 0x400c
cmp word [edx + 0x50], si
jne 0x4aa221
mov edx, dword [edx + 8]
or esi, 0xffffffff
mov word [edx], si
cmp dword [ecx + 0x28], 2
mov eax, dword [eax]
mov edx, dword [eax + 0x58]
mov esi, dword [edx + 8]
mov eax, 5
jne 0x4aa0f0
call fcn.004a9860
push ebx
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 4
ja case.0x4aa101.3
jmp dword [eax*4 + 0x4aa23c]
push 1
push 0x501a20
push esi
push str.iexplore.exe
jmp 0x4aa1fe
push esi
lea eax, [esp + 0x10]
push str._new_window__s
push eax
mov edx, 0x800
call fcn.004a63e0
add esp, 0xc
push 1
push 0x501a20
lea ecx, [esp + 0x14]
push ecx
push str.firefox.exe
jmp 0x4aa1fe
push esi
lea edx, [esp + 0x10]
push str.__new_window__s
push edx
mov edx, 0x800
call fcn.004a63e0
add esp, 0xc
push 1
push esi
lea eax, [esp + 0x14]
push eax
push str.chrome.exe
jmp 0x4aa1fe
push 0x800
push 0x501a20
lea ecx, [esp + 0x14]
push ecx
push 0x501a20
push str.http_shellopencommand
push SysReAllocString
call fcn.0049bef0
cmp word [esp + 0xc], 0x22
jne case.0x4aa101.3
lea edx, [esp + 0xe]
push 0x22
push edx
call fcn.004e94f5
mov ebx, eax
add esp, 8
test ebx, ebx
je case.0x4aa101.3
push 9
push str.opera.exe
lea eax, [esp + 0x14]
push eax
call fcn.004534c0
push eax
call fcn.0046cb30
test eax, eax
jne case.0x4aa101.3
push esi
lea edx, [esp + 0x1010]
push str._newwindow__s
xor ecx, ecx
push edx
mov edx, 0x800
mov word [ebx + 2], cx
call fcn.004a63e0
add esp, 0xc
push 1
push esi
lea eax, [esp + 0x1014]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x4aa21f
push 1
push 0x501a20
push 0
push esi
push str.open
push 0
call edi
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x2004
ret 4
Function at 0x4aa2d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push esi
push edi
lea edx, [esp + 0xc]
mov edi, ecx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
call eax
mov esi, eax
test esi, esi
jl 0x4aa366
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4aa35e
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x50b070
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
jl 0x4aa34e
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push eax
call edx
mov esi, eax
test esi, esi
jl 0x4aa342
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
test esi, esi
jl 0x4aa366
test eax, eax
jne 0x4aa3c2
cmp dword [edi + 8], 0
je 0x4aa3c2
cmp dword [edi + 0x20], 0
jne 0x4aa3c2
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4aa3c2
push ebx
push eax
mov ecx, edi
call fcn.004a9dc0
mov ebx, eax
test ebx, ebx
je 0x4aa3c1
mov eax, dword [edi + 4]
push 0x204
push 0
push 0
push 0
push 0
push 1
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [edi + 8]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 8]
push ebx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
call fcn.004e7061
add esp, 4
pop ebx
xor eax, eax
test esi, esi
pop edi
setge al
pop esi
add esp, 8
ret 8
Function at 0x4aaa20
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 0x14]
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, ecx
push 0
push ebx
mov dword [esi + 8], ebx
mov byte [esi + 0x26], al
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.004aa9a0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 8]
push ecx
push ebx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea edx, [esp + 0xc]
push edx
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x4aaa89
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 8]
push ebp
push edi
mov edi, dword [esp + 0x18]
push esi
mov ebp, eax
sub edi, eax
mov eax, dword [esi]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
sub ecx, eax
push ecx
push edi
push eax
push ebp
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp dword [esi + 0x10], 0
pop edi
mov dword [esi + 4], eax
pop ebp
jne 0x4aab13
test ebx, ebx
je 0x4aab2a
cmp dword [esi + 0x20], 0
jne 0x4aab2a
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4aab2a
push eax
mov ecx, esi
call fcn.004a9dc0
mov esi, eax
test esi, esi
je 0x4aab2a
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.004e7061
add esp, 4
pop esi
pop ebx
add esp, 0x10
ret 0x14
test eax, eax
je 0x4aab2a
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebx
add esp, 0x10
ret 0x14

Function at 0x4aab40
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x4aabb9
push ebx
push 0x800
push 0x5527fe
push str.Rar_CM
call fcn.004b43c0
mov ebx, eax
test ebx, ebx
je 0x4aabb8
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aab70
sub eax, edx
sar eax, 1
push esi
mov esi, eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aab87
sub eax, edx
push ebx
sar eax, 1
push eax
push 2
push edi
call fcn.004eb049
push ebx
call fcn.004eae6b
add esp, 0x14
test esi, esi
pop esi
jbe 0x4aabb8
mov dword [0x553800], 3
pop ebx
pop edi
ret 4
Function at 0x4aaeb0
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov eax, 0x5408
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x5404], eax
push edi
call fcn.004534c0
push 0x3a
push eax
call fcn.004e94f5
add esp, 8
test eax, eax
je 0x4aaf0f
cmp byte [0x56ce28], 0
jne 0x4aaf0f
push 0x31
push 0x65
call fcn.00463400
push eax
push 0x528
call fcn.00463400
push eax
push esi
call fcn.004b53a0
cmp eax, 1
jne 0x4ab0a3
mov byte [0x56ce28], al
lea edx, [esp + 0x1004]
mov eax, edi
sub edx, edi
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4aaf20
lea eax, [esp + 0x1004]
push eax
call fcn.00453770
push 0x800
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x100c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 4]
xor eax, eax
push ecx
mov word [esp + 0x1006], ax
call fcn.004534c0
cmp word [eax], 0
je 0x4aaff5
lea edx, [esp + 4]
push edx
call fcn.00445470
test al, al
jne 0x4aaff5
push 0
lea eax, [esp + 8]
push eax
call fcn.00485430
test al, al
jne 0x4aaff5
push 0x14d
call fcn.00463400
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x400c]
push str.__s__n_s
push edx
mov edx, 0xa00
call fcn.004a63e0
add esp, 0x10
push 0x34
push 0x65
call fcn.00463400
push eax
lea eax, [esp + 0x400c]
push eax
push esi
call fcn.004b53a0
cmp eax, 6
jne 0x4ab0a3
push 0
lea ecx, [esp + 8]
push ecx
call fcn.00445960
lea edx, [esp + 4]
push edx
call fcn.00445470
test al, al
je 0x4aaf80
call fcn.00447ef0
cmp eax, 0x501
jb 0x4ab0ba
push 0x800
lea eax, [esp + 0x2008]
push eax
push edi
mov ecx, 0x549cb8
call fcn.00490060
push 0x800
lea ecx, [esp + 0x3008]
push ecx
lea edx, [esp + 0x200c]
push edx
call fcn.00453e00
push 0
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x3020]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ab0ba
test dword [esp], 0x80000
je 0x4ab0ba
lea edx, [esp + 0x3004]
push edx
push 0x65e
call fcn.00463400
push eax
lea eax, [esp + 0x400c]
push eax
mov edx, 0xa00
call fcn.004a63e0
add esp, 0xc
push 0x30
push 0x65
call fcn.00463400
push eax
lea ecx, [esp + 0x400c]
push ecx
push esi
call fcn.004b53a0
xor al, al
mov ecx, dword [esp + 0x5404]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x5408
ret
mov ecx, dword [esp + 0x5404]
xor ecx, esp
mov al, 1
call fcn.004e6b3a
add esp, 0x5408
ret
Function at 0x4b2dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1a0
mov al, byte [esp + 0x1ac]
mov edx, dword [esp + 0x1a4]
push ebx
mov bl, byte [esp + 0x1ac]
movzx ecx, bl
push esi
mov byte [0x56ce4d], al
mov eax, dword [0x531154]
mov dword [esp + 0x58], ecx
mov esi, 0x34
push 1
mov ecx, 0x54e740
mov dword [0x56ce30], 0
mov dword [0x56ce2c], 0
mov dword [esp + 0x4c], str.GETARC
mov dword [esp + 0x58], 0x4b15e0
mov dword [esp + 0x80], str.GETARCADV
mov dword [esp + 0x8c], 0x4b0960
mov dword [esp + 0xb4], str.GETARCOPT
mov dword [esp + 0xc0], 0x4abc40
mov dword [esp + 0xe8], str.GETARCFILES
mov dword [esp + 0xf4], 0x4ac0f0
mov dword [esp + 0x11c], str.GETARCBACKUP
mov dword [esp + 0x128], 0x4ac6c0
mov dword [esp + 0x150], str.GETARCTIME
mov dword [esp + 0x15c], 0x4af4d0
mov dword [esp + 0x184], str.GETARCCMT
mov dword [esp + 0x190], 0x4ac960
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x28a
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.004a4730
cmp byte [esp + 0x1b4], 0
mov dword [esp + 0x18], eax
je 0x4b2ed0
push 0x3f6
jmp 0x4b2ee8
movzx ecx, byte [0x554910]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffd08
add ecx, 0x3de
push ecx
call fcn.00463400
mov ecx, 0x20
mov dword [esp + 0x1c], eax
mov eax, dword [0x531154]
lea edx, [esp + 0x3c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x148], eax
mov dword [esp + 0x17c], eax
push 7
mov dword [esp + 0x44], ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0xac], ecx
mov dword [esp + 0xe0], ecx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x148], ecx
mov dword [esp + 0x17c], ecx
mov eax, edx
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x531178
mov dword [esp + 0x2c], 7
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0xb0], esi
mov dword [esp + 0xe4], esi
mov dword [esp + 0x118], esi
mov dword [esp + 0x14c], esi
mov dword [esp + 0x180], esi
call fcn.004631e0
test bl, bl
jne 0x4b2fd2
lea edx, [esp + 8]
push edx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
test eax, eax
jle 0x4b2fce
cmp word [0x55abfa], 0
jne 0x4b2fd2
cmp byte [esp + 0x1b4], bl
jne 0x4b2fd2
xor bl, bl
jmp 0x4b2fd4
mov bl, 1
push 7
lea eax, [esp + 0x40]
push eax
mov ecx, 0x531178
call fcn.004621d0
pop esi
mov al, bl
mov byte [0x53f4b4], 0
pop ebx
add esp, 0x1a0
ret 0xc