joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x5a7eb0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00562b47
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4b53db
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.005629e5
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.005628ed
add esp, 4
mov dword [ebp - 4], eax
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.005629e5
add esp, 0xc
cmp dword [ebp - 4], 0x6400000
ja 0x4b53cf
mov edx, dword [ebp - 4]
push edx
call fcn.00562686
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b53cf
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
call fcn.005625a0
add esp, 0x10
cmp dword [ebp - 4], eax
je 0x4b53c7
mov eax, dword [ebp - 0xc]
push eax
call fcn.00562255
add esp, 4
mov dword [ebp - 0xc], 0
jmp 0x4b53cf
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
push eax
call fcn.005621d9
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4b53f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x5a7eb8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b5438
mov eax, dword [ebp - 0x10]
jmp 0x4b543b
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4b5440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
push 4
lea eax, [ebp + 0xc]
push eax
push 4
mov ecx, dword [ebp + 8]
push ecx
push 0x5a7eec
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b5480
mov eax, 1
jmp 0x4b5482
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4b5490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x5a7f20
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b54db
mov eax, 1
jmp 0x4b54dd
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4b59c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.0055e2a0
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x4b5a12
mov eax, 1
jmp 0x4b5a14
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret

Function at 0x4b5bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push str.EnableUE
push str.Software360Safe
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b5c1a
mov eax, dword [ebp - 0x10]
jmp 0x4b5c1f
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4b5c30
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0055e2a0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x420], dx
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.0055e2a0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x4b5d53
mov eax, dword [ebp - 0x214]
push eax
push 0x208
lea ecx, [ebp - 0x420]
push ecx
call fcn.004b8620
push str.....DumpUper.ini
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b5d53
xor ecx, ecx
mov word [ebp - 0x628], cx
push 0x206
push 0
lea edx, [ebp - 0x626]
push edx
call fcn.0055e2a0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
lea ecx, [ebp - 0x628]
push ecx
push 0x5a80a8
push 0x5a80ac
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x628]
push eax
call fcn.0055e532
add esp, 4
test eax, eax
je 0x4b5d53
mov eax, 1
jmp 0x4b5d55
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret

Function at 0x4b5d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push str.netCheck
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b5dba
mov eax, dword [ebp - 0x10]
jmp 0x4b5dbc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4b5dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0055e2a0
add esp, 0xc
mov dword [ebp - 8], 0x208
mov dword [ebp - 4], 1
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x5a80fc
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b5e3f
push 0x5a8184
mov ecx, dword [ebp + 8]
call fcn.00426f30
mov eax, dword [ebp + 8]
jmp 0x4b5e51
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 8]
call fcn.00426f30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret

Function at 0x4b5ed0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 0x18], eax
cmp dword [ebp + 8], 0
je 0x4b5eef
cmp dword [ebp + 0xc], 0
jne 0x4b5ef6
xor eax, eax
jmp 0x4b5fc4
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.0055e2a0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.00429540
test eax, eax
jge 0x4b5f35
xor eax, eax
jmp 0x4b5fc4
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0055e2a0
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x268]
push edx
call fcn.0055e2a0
add esp, 0xc
mov dword [ebp - 0x268], 0x44
mov eax, 5
mov word [ebp - 0x238], ax
mov dword [ebp - 4], 0
call fcn.004b5e60
test eax, eax
je 0x4b5f85
mov dword [ebp - 4], 0x2000000
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x268]
push edx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4b5fb7
xor eax, eax
jmp 0x4b5fc4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret
Function at 0x4b5fe0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x620], ax
push 0x206
push 0
lea ecx, [ebp - 0x61e]
push ecx
call fcn.0055e2a0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0055e2a0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x418], cx
push 0x206
push 0
lea edx, [ebp - 0x416]
push edx
call fcn.0055e2a0
add esp, 0xc
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x208
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jne 0x4b6092
jmp 0x4b6174
mov eax, dword [ebp - 0x624]
push eax
push 0x208
lea ecx, [ebp - 0x418]
push ecx
call fcn.004b8620
lea edx, [ebp - 0x418]
push edx
movzx eax, word [ebp - 0x628]
push eax
movzx ecx, word [ebp - 0x62a]
push ecx
movzx edx, word [ebp - 0x62c]
push edx
movzx eax, word [ebp - 0x62e]
push eax
movzx ecx, word [ebp - 0x632]
push ecx
movzx edx, word [ebp - 0x634]
push edx
push str._4d__02d__02d__02d__02d__02d__s_.dmp
push 0x208
lea eax, [ebp - 0x620]
push eax
call fcn.00424750
add esp, 0x28
push str...Error
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b6151
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4b6151
push 0x208
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0x5a81e8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00424750
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret
Function at 0x4b6190
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0055e2a0
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4b626e
push str.360safe
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b620f
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.360Down
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b6241
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.FullDump.dmp
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004b8620
mov eax, 1
jmp 0x4b6270
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret
Function at 0x4b6280
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x434], 0
xor eax, eax
mov word [ebp - 0x430], ax
push 0x206
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.0055e2a0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0055e2a0
add esp, 0xc
mov dword [ebp - 4], 0
push str.DBGHELP.DLL
call fcn.004b8690
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4b630f
xor eax, eax
jmp 0x4b64a1
push str.MiniDumpWriteDump
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b6331
xor eax, eax
jmp 0x4b64a1
push 0x208
lea edx, [ebp - 0x430]
push edx
call fcn.004b5fe0
add esp, 8
mov dword [ebp - 0x224], 0
xor eax, eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffff
je 0x4b63f8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x224], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x21c], 0
push 0
push 0
lea eax, [ebp - 0x224]
push eax
push 0
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 4]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jne 0x4b63e9
mov eax, dword [ebp - 0x434]
jmp 0x4b64a1
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b6403
push str._Error_:Cant_create_MiniDump_file__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x208
lea eax, [ebp - 0x210]
push eax
call fcn.004b6190
add esp, 8
test eax, eax
je 0x4b647b
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0xffffffff
je 0x4b647b
push 0
push 0
lea edx, [ebp - 0x224]
push edx
push 2
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 4]
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004b5bd0
test eax, eax
je 0x4b649c
call fcn.004b5c30
test eax, eax
je 0x4b649c
lea edx, [ebp - 0x430]
push edx
call fcn.004b64d0
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret
Function at 0x4b64d0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc70
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0055e2a0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....DumpUper.exe
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b654c
lea edx, [ebp - 0x210]
push edx
call fcn.004b64b0
add esp, 4
test eax, eax
jne 0x4b6553
xor eax, eax
jmp 0x4b664a
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.0055e2a0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x418]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [ebp - 0xc18], ax
push 0x7fe
push 0
lea ecx, [ebp - 0xc16]
push ecx
call fcn.0055e2a0
add esp, 0xc
push 1
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
push str.__s____s____s____d_
push 0x800
lea edx, [ebp - 0xc18]
push edx
call fcn.00424750
add esp, 0x1c
push 0x44
push 0
lea eax, [ebp - 0xc70]
push eax
call fcn.0055e2a0
add esp, 0xc
mov dword [ebp - 0xc70], 0x44
push 0x10
push 0
lea ecx, [ebp - 0xc28]
push ecx
call fcn.0055e2a0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b6614
xor eax, eax
jmp 0x4b664a
lea eax, [ebp - 0xc28]
push eax
lea ecx, [ebp - 0xc70]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xc18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4b6645
xor eax, eax
jmp 0x4b664a
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret
Function at 0x4b66b0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x4b66d8
mov eax, dword [ebp - 8]
jmp 0x4b6791
mov eax, dword [ebp + 8]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b678e
xor ecx, ecx
mov word [ebp - 0x220], cx
push 0x208
push 0
lea edx, [ebp - 0x21e]
push edx
call fcn.0055e2a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b6760
push 0x104
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.PSAPI.DLL_GetProcessImageFileNameW
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x220]
push edx
call fcn.004b7f00
add esp, 8
lea eax, [ebp - 0x220]
test eax, eax
je 0x4b6784
movzx ecx, word [ebp - 0x220]
test ecx, ecx
je 0x4b6784
lea edx, [ebp - 0x220]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00427020
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret
Function at 0x4b67a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x418], 0
je 0x4b67ba
jmp 0x4b68fe
mov ecx, dword [ebp - 8]
add ecx, 0x41c
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp - 8]
cmp dword [edx + 0x418], 0
je 0x4b67ea
mov eax, dword [ebp - 8]
add eax, 0x41c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4b68fe
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x208], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x414], 0
xor eax, eax
mov ecx, dword [ebp - 8]
mov word [ecx], ax
xor edx, edx
mov eax, dword [ebp - 8]
mov word [eax + 0x20c], dx
push 0
push 0x28
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4b684d
mov edx, dword [ebp - 8]
mov dword [edx + 0x418], 1
mov eax, dword [ebp - 8]
add eax, 0x41c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4b68fe
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edx, dword [ebp - 8]
push edx
call fcn.0055e532
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x208], eax
push 0x104
mov edx, dword [ebp - 8]
add edx, 0x20c
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b6897
cmp dword [ebp - 4], 0x104
jb 0x4b68a3
xor ecx, ecx
mov edx, dword [ebp - 8]
mov word [edx + 0x20c], cx
mov eax, dword [ebp - 8]
add eax, 0x20c
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4b68c6
xor edx, edx
mov eax, dword [ebp - 8]
mov word [eax + 0x20c], dx
mov ecx, dword [ebp - 8]
add ecx, 0x20c
push ecx
call fcn.0055e532
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 0x414], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x418], 1
mov ecx, dword [ebp - 8]
add ecx, 0x41c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret
Function at 0x4b7190
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4b71ad
xor eax, eax
jmp 0x4b7218
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0055e2a0
add esp, 0xc
push 0x208
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.00562ba0
add esp, 0xc
push 0x5a8344
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x4b71fe
xor eax, eax
jmp 0x4b7218
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b7213
xor eax, eax
jmp 0x4b7218
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret

Function at 0x4b7230
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.004b5dc0
add esp, 4
lea ecx, [ebp - 4]
call fcn.004273e0
movzx ecx, al
test ecx, ecx
je 0x4b727b
mov dword [ebp - 0x214], 0
lea ecx, [ebp - 4]
call fcn.00426fe0
mov eax, dword [ebp - 0x214]
jmp 0x4b7317
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0055e2a0
add esp, 0xc
push 0x5a8374
lea ecx, [ebp - 4]
call fcn.004273c0
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b72ff
push 5
push 0
push 0x5a8388
lea eax, [ebp - 0x210]
push eax
push 0x5a83a0
push 0
call fcn.004be3e0
add esp, 0x18
mov dword [ebp - 0x218], 1
lea ecx, [ebp - 4]
call fcn.00426fe0
mov eax, dword [ebp - 0x218]
jmp 0x4b7317
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 4]
call fcn.00426fe0
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret