joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4db000
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4db05c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffff
jne 0x4db052
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4dd7a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4edf99
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x522464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x270], 0
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
call fcn.004019c5
mov dword [ebp - 4], 0
mov dword [ebp - 0x274], 0xffffffff
lea ecx, [ebp - 0x26c]
push ecx
call fcn.004ddf60
add esp, 4
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x26c]
lea ecx, [ebp - 0x278]
call fcn.0041e85e
add esp, 4
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x264]
push ecx
mov eax, dword [ebp - 0x2d0]
call fcn.004391a5
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0x274], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x278]
call fcn.00401b7d
cmp dword [ebp - 0x274], 0xffffffff
jne 0x4dd87b
jmp 0x4dd8f4
mov edx, dword [ebp - 0x264]
and edx, 0x10
jne 0x4dd8ba
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x27c]
call fcn.004019c5
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x27c]
push ecx
mov eax, dword [ebp + 0x10]
call fcn.0044b86c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x27c]
call fcn.00401b7d
lea edx, [ebp - 0x264]
push edx
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jne 0x4dd87b
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov dword [ebp - 0x268], 1
mov edx, dword [ebp - 0x268]
mov dword [ebp - 0x280], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.00401b7d
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a079b
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4dd940
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop ebp
ret
Function at 0x4dd960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0xffffffff
push 0
push 0
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4dd9a1
jmp 0x4dd9dc
mov dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4dd9d1
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0x10]
je 0x4dd9d5
jmp 0x4dd9dc
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 0xffffffff
je 0x4dd9ec
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4dda20
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4dda52
cmp dword [ebp - 8], 0x800
jbe 0x4dda56
jmp 0x4ddab6
mov ecx, dword [ebp - 8]
push ecx
call fcn.004963f3
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4dda9b
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
je 0x4dda9f
jmp 0x4ddab6
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4dddf0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed7f3
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x522464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
call fcn.004019c5
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4dde5c
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401b7d
mov eax, dword [ebp - 0x18]
jmp 0x4ddf4a
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ddf31
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x4ddf31
lea eax, [ebp - 0x14]
push eax
call fcn.004ddd50
add esp, 4
lea eax, [ebp - 0x14]
call fcn.0041e176
movzx ecx, al
test ecx, ecx
je 0x4ddebf
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401b7d
mov eax, dword [ebp - 0x1c]
jmp 0x4ddf4a
lea eax, [ebp - 0x14]
call fcn.004391a5
push eax
call fcn.004dddf0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ddef4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401b7d
mov eax, dword [ebp - 0x20]
jmp 0x4ddf4a
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ddf31
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x4ddf31
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401b7d
mov eax, dword [ebp - 0x24]
jmp 0x4ddf4a
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401b7d
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4ddfc0
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4edfed
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x522464]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x270], 0
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
call fcn.004019c5
mov dword [ebp - 4], 0
mov dword [ebp - 0x274], 0xffffffff
lea ecx, [ebp - 0x26c]
push ecx
call fcn.004ddf60
add esp, 4
push 0x5001f0
lea eax, [ebp - 0x26c]
lea ecx, [ebp - 0x278]
call fcn.0041e85e
add esp, 4
mov dword [ebp - 0x2d0], eax
mov edx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2d4], edx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x2d4]
call fcn.004391a5
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0x274], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x278]
call fcn.00401b7d
cmp dword [ebp - 0x274], 0xffffffff
jne 0x4de0a0
jmp 0x4de1a3
mov ecx, dword [ebp - 0x264]
and ecx, 0x10
jne 0x4de16f
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x26c]
lea ecx, [ebp - 0x27c]
call fcn.0041e85e
add esp, 4
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 4], 2
push 0
mov eax, dword [ebp - 0x2dc]
call fcn.004391a5
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x27c]
call fcn.00401b7d
lea ecx, [ebp - 0x238]
push ecx
lea eax, [ebp - 0x26c]
lea ecx, [ebp - 0x280]
call fcn.0041e85e
add esp, 4
mov dword [ebp - 0x2e0], eax
mov edx, dword [ebp - 0x2e0]
mov dword [ebp - 0x2e4], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2e4]
call fcn.004391a5
push eax
call fcn.004dd940
add esp, 4
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x280]
call fcn.00401b7d
cmp dword [ebp - 0x268], 0
jne 0x4de16f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x264]
push ecx
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jne 0x4de0a0
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor ecx, ecx
cmp dword [ebp - 0x10], 0
sete cl
mov dword [ebp - 0x284], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.00401b7d
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a079b
mov esp, ebp
pop ebp
ret
Function at 0x4def40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x522464]
xor eax, ebp
mov dword [ebp - 0x34], eax
push esi
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0xffffffff
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4def99
jmp 0x4df0ae
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0xc], 0
jne 0x4defc7
cmp dword [ebp - 0x1c], 0x200000
jbe 0x4defd1
jmp 0x4df0ae
mov eax, dword [ebp - 0x1c]
add eax, 2
push eax
call fcn.004963f3
add esp, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], 0
push 0
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4df019
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
je 0x4df023
jmp 0x4df0ae
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
mov byte [ecx], 0
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x1c]
mov byte [edx + 1], 0
call fcn.00401e62
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4df053
mov dword [ebp - 0x44], 0
jmp 0x4df09f
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3fffffff
jle 0x4df075
mov dword [ebp - 0x48], 0
jmp 0x4df099
mov eax, dword [ebp - 8]
shl eax, 1
call fcn.004aa020
mov dword [ebp - 0x4c], esp
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov esi, dword [ebp - 0x4c]
call fcn.0043be0c
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.004ded40
mov byte [ebp - 0xd], al
cmp dword [ebp - 4], 0
je 0x4df0c6
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
push edx
call fcn.0049750a
add esp, 4
cmp dword [ebp - 0x18], 0xffffffff
je 0x4df0d6
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [ebp - 0xd]
lea esp, [ebp - 0x50]
pop esi
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.004a079b
mov esp, ebp
pop ebp
ret 4
Function at 0x4df290
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x522464]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00497490
add esp, 0xc
mov byte [ebp - 1], 0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
ja 0x4df2e6
jmp 0x4df393
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 0x21c], 0
jmp 0x4df30e
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jae 0x4df393
mov word [ebp - 0x430], 0
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.00497490
add esp, 0xc
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.0049aba1
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*4 + 0x52858c]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004d2b98
add esp, 0x10
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4df38e
mov byte [ebp - 1], 1
jmp 0x4df393
jmp 0x4df2ff
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a079b
mov esp, ebp
pop ebp
ret

Function at 0x4df3b0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0xd], 0
push 0x288
call fcn.00498fc5
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4df3d7
xor al, al
jmp 0x4df4c1
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x288
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x6f
jne 0x4df43a
mov edx, dword [ebp - 0x14]
push edx
call fcn.00497b0f
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00498fc5
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4df42a
xor al, al
jmp 0x4df4c1
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x4df49e
cmp dword [ebp - 0x14], 0
je 0x4df49e
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x190], 3
ja 0x4df462
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
jmp 0x4df446
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x194]
cmp edx, 0x52
jne 0x4df494
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x195]
cmp ecx, 0x54
jne 0x4df494
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x196]
test eax, eax
jne 0x4df494
mov byte [ebp - 0xd], 1
jmp 0x4df49e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
jmp 0x4df446
cmp dword [ebp - 8], 0
je 0x4df4be
mov eax, dword [ebp - 8]
push eax
call fcn.00497b0f
add esp, 4
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x4df4d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4df510
mov byte [ebp - 9], 0
jmp 0x4df58d
push 0x80
call fcn.00498fc5
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0x50
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4df559
mov byte [ebp - 9], 0
jmp 0x4df571
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0044fa13
add esp, 8
test eax, eax
je 0x4df571
mov byte [ebp - 9], 1
cmp dword [ebp - 0x18], 0
je 0x4df583
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00497b0f
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4df650
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x522464]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00497490
add esp, 0xc
mov byte [ebp - 1], 0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
ja 0x4df6a6
jmp 0x4df753
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 0x21c], 0
jmp 0x4df6ce
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 5
jae 0x4df753
mov word [ebp - 0x430], 0
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.00497490
add esp, 0xc
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.0049aba1
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*4 + 0x528564]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004d2b98
add esp, 0x10
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4df74e
mov byte [ebp - 1], 1
jmp 0x4df753
jmp 0x4df6bf
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a079b
mov esp, ebp
pop ebp
ret
Function at 0x4df770
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x522464]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x23d], 0
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.00497490
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x4df7da
jmp 0x4df829
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x4df829
lea eax, [ebp - 0x214]
push eax
push str.vmusrvc.exe
call fcn.00498ba9
add esp, 8
test eax, eax
jne 0x4df812
mov byte [ebp - 0x23d], 1
jmp 0x4df829
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x4df7f1
cmp dword [ebp - 0x23c], 0
je 0x4df849
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x23c], 0
mov al, byte [ebp - 0x23d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a079b
mov esp, ebp
pop ebp
ret
Function at 0x4e1cc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x522464]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00497490
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x4e1d0a
jmp 0x4e1d91
push 1
push 0x23
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4e1d57
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4e1d43
jmp 0x4e1d91
push 0x5013ec
lea eax, [ebp - 0x210]
push eax
call fcn.0049e801
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0049e801
add esp, 8
lea eax, [ebp - 0x210]
push eax
call fcn.00497791
add esp, 4
cmp eax, dword [ebp + 0x10]
jae 0x4e1d91
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0049e801
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a079b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e2500
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee1f2
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x522464]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x10], 0
mov word [ebp - 0x224], 0
push 0x206
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.00497490
add esp, 0xc
lea eax, [ebp - 0x18]
call fcn.0048a738
mov dword [ebp - 4], 0
push 1
push 0x501210
push SysReAllocStringLen
lea esi, [ebp - 0x18]
call fcn.00402281
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e258e
mov dword [ebp - 0x10], 1
jmp 0x4e25ae
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
call fcn.004391a5
push eax
lea ebx, [ebp - 0x18]
call fcn.00443344
test eax, eax
je 0x4e25ae
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x228]
call fcn.00401b87
mov byte [ebp - 4], 1
lea edx, [ebp - 0x228]
push edx
mov ecx, dword [ebp - 0x26c]
call fcn.004e1e50
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e261d
lea eax, [ebp - 0x228]
call fcn.004391a5
push eax
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
mov eax, dword [ebp + 8]
call fcn.004391a5
push eax
push 0x5012e8
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x10], 0
je 0x4e267f
cmp dword [ebp - 0x22c], 0
ja 0x4e2653
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x26c]
call fcn.004e1fe0
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.00401b7d
jmp 0x4e26b2
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401b43
mov dword [ebp - 0x14], 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x26c]
call fcn.004e1f00
jmp 0x4e269b
cmp dword [ebp - 0x22c], 0
ja 0x4e269b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x26c]
call fcn.004e1f00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.00401b7d
xor eax, eax
jne 0x4e25b5
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x230], ecx
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x18]
call fcn.0040d044
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a079b
mov esp, ebp
pop ebp
ret 8