joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6540
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [esi + 0x100ac], ebx
push edi
mov dword [esp + 8], ebx
je 0x4a65f9
cmp dword [esi + 0x7c], ebx
jbe 0x4a65f9
mov ebx, 0xffffff5c
lea edi, [esi + 0xa4]
sub ebx, esi
push ebp
lea esp, [esp]
movzx ecx, byte [edi]
mov eax, dword [esi + 0x100d0]
mov ebp, dword [esi + 0x100dc]
xor ecx, eax
mov edx, dword [esi + 0x100d8]
shr eax, 8
and ecx, 0xff
mov ecx, dword [ebp + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x100d4]
mov dword [esi + 0x100d0], ecx
mov ecx, dword [esi + 0x100d8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [esi + 0x100d4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
and edx, 0xfffd
shr ecx, 8
xor ecx, dword [ebp + eax*4]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
mov dword [esi + 0x100d8], ecx
shr eax, 8
xor byte [edi], al
add edi, 1
lea ecx, [ebx + edi]
cmp ecx, dword [esi + 0x7c]
jb 0x4a6570
xor ebx, ebx
pop ebp
mov edi, dword [esi + 0x7c]
mov ecx, dword [esi + 0x2c]
mov edx, edi
push edx
mov edx, dword [esi + 0x1c]
lea eax, [esi + 0xa4]
push eax
mov eax, dword [esi + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, edi
je 0x4a6622
mov dword [esp + 8], 0xffffffff
add dword [esi + 0x100c0], edi
mov ecx, dword [esi + 0x48]
mov eax, dword [esp + 8]
adc dword [esi + 0x100c4], ebx
add dword [esi + 0x100c8], ecx
pop edi
mov dword [esi + 0x48], ebx
adc dword [esi + 0x100cc], ebx
mov dword [esi + 0x7c], ebx
pop ebx
pop ecx
ret
Function at 0x4a9fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
cmp eax, edx
mov dword [esp + 0xc], edi
jb 0x4aa060
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.004fde30
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x4aa02f
sub eax, ebp
jmp 0x4aa031
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4aa020
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x4aa050
sub eax, ebp
jmp 0x4aa052
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4aa041
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4aa192
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [esp + 0xc]
mov ebx, eax
cmp ebx, ecx
mov dword [esp + 0x10], edx
jbe 0x4aa088
mov ebx, ecx
test ebx, ebx
je 0x4aa0dc
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4aa0aa
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.004ae150
jmp 0x4aa0c3
cmp eax, 2
jne 0x4aa0ca
mov ecx, dword [edi]
test ecx, ecx
mov eax, dword [edi + 0x30]
jne 0x4aa0bc
xor eax, eax
jmp 0x4aa0c7
mov edx, ebx
call fcn.004aae90
mov edx, dword [esp + 0x10]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.004fde30
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x4aa106
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x4aa11a
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x4a9fe0
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x4aa192
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x4aa161
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x4aa141
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.004fd670
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x4aa192
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x4aa17b
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.004fd670
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4aae80
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x4aae87
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.004aae90
Function at 0x4aae90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x4aaec2
lea esp, [esp]
test cl, 3
je 0x4aaec2
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x56c070]
add ecx, 1
sub esi, 1
jne 0x4aaea0
cmp esi, 0x20
push ebx
push edi
jb 0x4ab0ac
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x56c470]
xor edx, dword [ebx*4 + 0x56c870]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x56c070]
add ecx, 4
xor edx, dword [eax*4 + 0x56cc70]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x56c470]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x56c870]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x56c070]
add ecx, 4
xor eax, dword [edx*4 + 0x56cc70]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x56c470]
xor edx, dword [ebx*4 + 0x56c870]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x56c070]
xor edx, dword [eax*4 + 0x56cc70]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x56c470]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x56c870]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x56c070]
xor eax, dword [edx*4 + 0x56cc70]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x56c470]
xor edx, dword [ebx*4 + 0x56c870]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x56c070]
xor edx, dword [eax*4 + 0x56cc70]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x56c470]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x56c870]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x56c070]
and edx, 0xff
xor eax, dword [edx*4 + 0x56cc70]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x56c470]
xor edx, dword [ebx*4 + 0x56c870]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x56c070]
add ecx, 4
xor edx, dword [eax*4 + 0x56cc70]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x56c470]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x56c870]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x56c070]
and edx, 0xff
xor eax, dword [edx*4 + 0x56cc70]
sub edi, 1
jne 0x4aaed2
cmp esi, 4
jb 0x4ab0f9
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x56c470]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x56c870]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x56c070]
and eax, 0xff
xor edi, dword [eax*4 + 0x56cc70]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x4ab0b6
test esi, esi
pop edi
pop ebx
je 0x4ab11d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x56c070]
add ecx, 1
sub esi, 1
jne 0x4ab100
not eax
pop esi
ret
Function at 0x4af2a0
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
call ebx
push str.________Search_Component________________
mov ecx, 0x649e50
mov ebp, eax
call fcn.004918f0
add esp, 4
test edi, edi
mov dword [esi + 0x10574], 1
jne 0x4af346
mov edi, dword [esi + 0xfd64]
test edi, edi
jne 0x4af346
mov edi, 0x57
mov dword [esi + 0x10574], 0
call ebx
mov ecx, eax
sub ecx, ebp
mov eax, 0x45e7b273
mul ecx
mov esi, edx
mov eax, 0x10624dd3
mul ecx
shr edx, 6
imul edx, edx, 0x3e8
mov eax, ecx
sub eax, edx
shr esi, 0xe
mov edx, esi
imul edx, edx, 0xea60
push eax
mov ebx, ecx
sub ebx, edx
mov eax, 0x10624dd3
mul ebx
shr edx, 6
push edx
push esi
push ecx
push str.Total_spending_time___d____d_min__d_sec__d_msec
mov ecx, 0x649e50
call fcn.004918f0
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov eax, dword [edi + 0xe230]
mov ecx, edi
mov edx, esi
mov dword [esi], eax
call fcn.004b4470
mov edi, eax
test edi, edi
jne 0x4af2e1
mov ecx, dword [esi]
push str.InstallingComponents
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, esi
call fcn.004af650
mov edi, eax
test edi, edi
jne 0x4af2e1
mov edx, dword [esp + 0x14]
push edx
mov ecx, esi
call fcn.004afbe0
mov edi, eax
test edi, edi
jne 0x4af2e1
xor edx, edx
mov ecx, esi
call fcn.004b1980
mov edi, eax
test edi, edi
jne 0x4af2e1
mov ecx, esi
call fcn.004b5200
mov dword [esi + 0x10574], 2
jmp 0x4af2eb
Function at 0x4b9000
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51be90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5a4aa8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x4b9075
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b9040
sub eax, edx
sar eax, 1
je 0x4b9075
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b906c
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4b906c
mov bl, 1
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], 0xffffffff
jmp 0x4b90b5
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b95f0
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.004fe1a0
push 0xffffffffffffffff
push 0x51be60
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5a4aa8]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x14], 2
xor edi, edi
cmp esi, edi
je 0x4b9769
cmp ebx, edi
je 0x4b9769
mov dword [ebp - 4], edi
push 0x800
push edi
lea eax, [ebp + 0x800]
push eax
call fcn.004fd670
push 0x3ff
push esi
push 0x400
lea ecx, [ebp + 0x800]
push ecx
call fcn.004fa71b
add esp, 0x1c
lea eax, [ebp + 0x800]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4b9685
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 + 0x7fe], 0x5c
jne 0x4b96c7
lea eax, [ebp + 0x800]
lea edx, [eax + 2]
jmp 0x4b96b0
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4b96b0
sub eax, edx
sar eax, 1
mov word [ebp + eax*2 + 0x7fe], di
push 0x800
push edi
lea edx, [ebp]
push edx
call fcn.004fd670
lea eax, [ebp + 0x800]
push eax
push str._s_setup.exe
lea edx, [ebp]
call fcn.00404380
add esp, 0x14
lea eax, [ebp]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4b96f3
sub eax, edx
sar eax, 1
je 0x4b973e
lea ecx, [ebp]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b973e
push 0x3ff
lea edx, [ebp]
push edx
push 0x400
push ebx
call fcn.004fa71b
push 0x200
push edi
add ebx, 0xa00
push ebx
call fcn.004fd670
add esp, 0x1c
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
jmp 0x4b976e
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.004fa103
add ebp, 0x1004
mov esp, ebp
pop ebp
ret
Function at 0x4bb3e0
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1014
call fcn.004fe1a0
mov eax, dword [0x5a4aa8]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
lea ebx, [edi + 0x1224]
mov eax, ebx
push esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bb405
sub eax, edx
sar eax, 1
jne 0x4bb515
push 0x800
lea eax, [esp + 0x814]
push 0
push eax
call fcn.004fd670
add esp, 0xc
push 0x800
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.004fd670
add esp, 0xc
push 0x3ff
lea edx, [edi + 0xa24]
push edx
lea eax, [esp + 0x18]
push 0x400
push eax
call fcn.004fa71b
lea ecx, [esp + 0x20]
push 0x5c
push ecx
call fcn.004fa6eb
add esp, 0x18
test eax, eax
je 0x4bb515
lea esi, [edi + 0x824]
mov word [eax + 2], 0
mov eax, esi
lea edx, [eax + 2]
jmp 0x4bb490
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bb490
sub eax, edx
sar eax, 1
jne 0x4bb4a8
mov ecx, edi
call fcn.004bae10
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bb4b0
sub eax, edx
sar eax, 1
je 0x4bb515
mov ecx, edi
call fcn.004bb3b0
push eax
lea edx, [esp + 0x14]
push edx
push str._s_sc.xml
lea eax, [esp + 0x81c]
push 0x400
push eax
call fcn.004fa51d
add esp, 0x14
lea ecx, [esp + 0x810]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bb515
push 0x3ff
lea edx, [esp + 0x814]
push edx
push 0x400
push ebx
call fcn.004fa71b
add esp, 0x10
mov ecx, dword [esp + 0x1014]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004fa103
add esp, 0x1014
ret

Function at 0x4bb530
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1014
call fcn.004fe1a0
mov eax, dword [0x5a4aa8]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
lea ebx, [edi + 0x1a24]
mov eax, ebx
push esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bb555
sub eax, edx
sar eax, 1
jne 0x4bb665
push 0x800
lea eax, [esp + 0x814]
push 0
push eax
call fcn.004fd670
add esp, 0xc
push 0x800
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.004fd670
add esp, 0xc
push 0x3ff
lea edx, [edi + 0xa24]
push edx
lea eax, [esp + 0x18]
push 0x400
push eax
call fcn.004fa71b
lea ecx, [esp + 0x20]
push 0x5c
push ecx
call fcn.004fa6eb
add esp, 0x18
test eax, eax
je 0x4bb665
lea esi, [edi + 0x824]
mov word [eax + 2], 0
mov eax, esi
lea edx, [eax + 2]
jmp 0x4bb5e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bb5e0
sub eax, edx
sar eax, 1
jne 0x4bb5f8
mov ecx, edi
call fcn.004bae10
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bb600
sub eax, edx
sar eax, 1
je 0x4bb665
mov ecx, edi
call fcn.004bb3b0
push eax
lea edx, [esp + 0x14]
push edx
push str._s_sp.xml
lea eax, [esp + 0x81c]
push 0x400
push eax
call fcn.004fa51d
add esp, 0x14
lea ecx, [esp + 0x810]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bb665
push 0x3ff
lea edx, [esp + 0x814]
push edx
push 0x400
push ebx
call fcn.004fa71b
add esp, 0x10
mov ecx, dword [esp + 0x1014]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004fa103
add esp, 0x1014
ret
Function at 0x4bb850
Capabilities:
Enumerate files on windows
Read .ini file

Disassembly:
mov eax, 0x1a68
call fcn.004fe1a0
mov eax, dword [0x5a4aa8]
xor eax, esp
mov dword [esp + 0x1a60], eax
test edi, edi
push ebx
push ebp
mov ebx, ecx
push esi
mov dword [esp + 0x10], ebx
je 0x4bb9dc
lea esi, [ebx + 0xa24]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bb884
sub eax, edx
sar eax, 1
je 0x4bb9dc
push 0x800
lea eax, [esp + 0x26c]
push 0
push eax
call fcn.004fd670
push 0x800
lea ecx, [esp + 0xa78]
push 0
push ecx
call fcn.004fd670
push 0x3ff
push esi
lea edx, [esp + 0x288]
push 0x400
push edx
call fcn.004fa71b
lea eax, [esp + 0x290]
push 0x5c
push eax
call fcn.004fa6eb
add esp, 0x30
test eax, eax
je 0x4bb8f4
mov word [eax], 0
lea ecx, [esp + 0x268]
push ecx
push str._s.ver
lea edx, [esp + 0xa70]
call fcn.00404380
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xa6c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4bb9a8
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x4bb940
push 0x800
lea ecx, [esp + 0x126c]
push 0
push ecx
call fcn.004fd670
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x278]
push eax
push 0x535a74
lea edx, [esp + 0x1280]
call fcn.00404380
add esp, 0x18
lea ecx, [esp + 0x1268]
push ecx
push pe_nt_image_headers32
push edi
push 0x535a4c
push str.MainVersion
push str.Version
call esi
test eax, eax
jne 0x4bb9d8
lea edx, [esp + 0x18]
push edx
push ebp
call ebx
test eax, eax
jne 0x4bb940
mov ebx, dword [esp + 0x10]
push ebx
mov ecx, edi
call fcn.004bba00
mov bl, al
cmp ebp, 0xffffffff
je 0x4bb9be
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a60]
xor ecx, esp
call fcn.004fa103
add esp, 0x1a68
ret
mov bl, 1
jmp 0x4bb9b2
mov ecx, dword [esp + 0x1a6c]
pop esi
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.004fa103
add esp, 0x1a68
ret
Function at 0x4bd5b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
lea esi, [ebx + 0x6ee4]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bd5c1
sub eax, edx
sar eax, 1
jne 0x4bd625
mov eax, dword [ebx + 0x6ee0]
test eax, eax
je 0x4bd625
mov eax, dword [eax + 0xe230]
push 1
push 0x800
push esi
push str.Image_temp_Dir
push eax
mov edx, str.InstallingSetupProgram
call fcn.004920e0
add esp, 0x14
test eax, eax
je 0x4bd658
push 0x800
push 0
push esi
call fcn.004fd670
push str.Get_Image_Path_Fail__
mov ecx, 0x649e50
call fcn.004918f0
add esp, 0x10
pop esi
pop ebp
ret 4
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bd630
sub eax, edx
sar eax, 1
jne 0x4bd658
push str.Get_Image_Path_Fail__
mov ecx, 0x649e50
call fcn.004918f0
add esp, 4
pop esi
pop ebp
ret 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd682
mov eax, dword [ebx + 0x6ee0]
xor ecx, ecx
test eax, eax
je 0x4bd675
mov ecx, dword [eax + 0xe230]
push 0
push ecx
mov edx, esi
call fcn.0049d3f0
add esp, 8
push edi
lea edi, [ebp + 6]
push 0x53e208
push edi
call fcn.004f9f1e
add esp, 8
test eax, eax
jne 0x4bd6b1
mov edx, dword [ebx + 0x6ec0]
mov eax, dword [edx + 0xc]
lea ecx, [ebx + 0x6ec0]
push esi
push ebp
call eax
pop edi
pop esi
pop ebp
ret 4
push str.Network
push edi
call fcn.004f9f1e
add esp, 8
test eax, eax
jne 0x4bd6d6
mov edx, dword [ebx + 0x6e44]
mov eax, dword [edx + 0xc]
lea ecx, [ebx + 0x6e44]
push esi
push ebp
call eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x4c5b40
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51bb00
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x5a4aa8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x81c], edi
push 0x800
push edi
lea eax, [ebp - 0x818]
push eax
call fcn.004fd670
add esp, 0xc
mov ebx, 2
mov dword [ebp - 0x83c], ebx
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x830], 1
mov dword [ebp - 0x834], 3
mov dword [ebp - 0x824], edi
mov dword [ebp - 0x82c], edi
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x820], edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x4c5c8c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
cmp cx, di
jne 0x4c5be3
sub eax, edx
sar eax, 1
je 0x4c5c8c
push 0x3ff
push esi
push 0x400
lea edx, [ebp - 0x818]
push edx
call fcn.004fa71b
push esi
push str.connect_UNC___s_
mov ecx, 0x649e50
call fcn.004918f0
add esp, 0x18
push 9
push edi
push edi
lea eax, [ebp - 0x83c]
push eax
push edi
call sub.MPR.dll_WNetAddConnection3W
cmp eax, edi
jne 0x4c5c3e
mov dword [ebp - 0x81c], ebx
jmp 0x4c5c63
cmp eax, 0x55
jne 0x4c5c4f
mov dword [ebp - 0x81c], 1
jmp 0x4c5c63
push str.Add_Network_Connection
mov ecx, eax
mov edx, 0x649e50
call fcn.004917b0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x81c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x4c5c70
Function at 0x4c7e10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51b9b0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1004
call fcn.004fe1a0
mov eax, dword [0x5a4aa8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x800
xor ebx, ebx
push ebx
lea eax, [ebp - 0x814]
push eax
call fcn.004fd670
push 0x800
push ebx
lea ecx, [ebp - 0x1014]
push ecx
call fcn.004fd670
add esp, 0x18
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x4810]
cmp eax, ebx
je 0x4c7ea3
cmp dword [esi + 0x4814], ebx
je 0x4c7e92
cmp dword [esi + 0x4818], ebx
jne 0x4c7f85
cmp eax, ebx
je 0x4c7ea3
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x4810], ebx
push 0x400
lea edx, [ebp - 0x1014]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4c7eda
push str.ssdevm.dll
lea eax, [ebp - 0x1014]
push eax
push 0x535a74
lea edx, [ebp - 0x814]
call fcn.00404380
add esp, 0xc
jmp 0x4c7ef8
push 0x3ff
push str.ssdevm.dll
push 0x400
lea ecx, [ebp - 0x814]
push ecx
call fcn.004fa71b
add esp, 0x10
lea edx, [ebp - 0x814]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x4810], eax
cmp eax, ebx
je 0x4c7f7e
push str.PortAcquire
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [esi + 0x4814], eax
push str.PortRelease
mov eax, dword [esi + 0x4810]
push eax
call edi
mov dword [esi + 0x4818], eax
push str.Load_Device_Monitor_Success__
mov ecx, 0x649e50
call fcn.004918f0
add esp, 4
cmp dword [esi + 0x4814], ebx
je 0x4c7f60
cmp dword [esi + 0x4818], ebx
je 0x4c7f60
push str.Get_Port_Acquire_function_and_release_function_Success__
jmp 0x4c7f71
mov dword [esi + 0x4814], ebx
mov dword [esi + 0x4818], ebx
push str.Get_Port_Acquire_function_and_release_function_fail__
mov ecx, 0x649e50
call fcn.004918f0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret