joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498f80
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push eax
push 0
mov dword [esp + 0xc], 0
call fcn.004cfc90
mov esi, eax
add esp, 8
test esi, esi
je 0x498fcf
push edi
push esi
call fcn.004cf9f0
push esi
mov edi, eax
call fcn.004cf9d0
mov edx, dword [esp + 0x1c]
add esp, 8
push 0
lea ecx, [esp + 0xc]
push ecx
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.004cf770
add esp, 4
pop edi
mov eax, dword [esp + 4]
pop esi
pop ecx
ret

Function at 0x499060
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
push str.kCFAllocatorDefault
mov dword [esp + 0xc], 1
call fcn.004d0400
mov eax, dword [eax]
push 0
push eax
call fcn.004cf9b0
push 0x1fa0
mov edi, eax
call fcn.005169c0
add esp, 0x10
cmp dword [esp + 8], 0
mov esi, eax
jbe 0x4990d1
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x1fa0
push esi
push ebx
call ebp
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x4990cf
push eax
push esi
push edi
call fcn.004cfa50
add esp, 0xc
cmp dword [esp + 0x10], 0
ja 0x4990a5
pop ebp
pop ebx
test esi, esi
je 0x4990de
push esi
call fcn.005168e3
add esp, 4
push str.kCFAllocatorDefault
mov dword [esp + 0x10], 0
call fcn.004d0400
mov eax, dword [eax]
lea edx, [esp + 0x10]
push edx
push 2
push edi
push eax
call fcn.004cfc70
add esp, 0x14
test edi, edi
mov esi, eax
je 0x499112
push edi
call fcn.004cf770
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x499120
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x540621
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebp
push esi
push edi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x4c]
cmp edx, edi
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], 0x126
mov dword [esp + 0x1c], 0x127
mov dword [esp + 0x20], 0x128
mov dword [esp + 0x24], 0x129
mov dword [esp + 0x28], 0x12a
mov dword [esp + 0x2c], 0x12b
mov dword [esp + 0x30], 0x12c
jl 0x4991bc
jg 0x499199
cmp eax, 0x100000
jbe 0x4991bc
cmp edi, 5
jge 0x4991bc
push 0
push 0x400
push edx
push eax
add edi, 1
call fcn.004e6bb0
test edx, edx
jg 0x499199
jl 0x4991bc
cmp eax, 0x100000
ja 0x499199
test edx, edx
jl 0x4991e0
jg 0x4991c9
cmp eax, 0x3e8
jb 0x4991e0
mov esi, eax
and eax, 0x3ff
imul eax, eax, 0x64
add edi, 1
shr esi, 0xa
shr eax, 0xa
mov ebp, eax
jmp 0x4991e4
mov esi, eax
xor ebp, ebp
mov eax, dword [esp + edi*4 + 0x18]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.00488dc0
add esp, 8
push ebp
push esi
push ecx
lea edx, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov dword [esp + 0x4c], 1
call fcn.004886b0
mov esi, dword [esp + 0x50]
push esi
call fcn.00489080
add esp, 0x10
lea ecx, [esp + 0x48]
mov dword [esp + 0x10], 1
mov byte [esp + 0x3c], 0
call fcn.004884e0
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x30
ret
Function at 0x499250
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x540661
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
fld qword [esp + 0x24]
mov dword [esp + 0xc], 0
fmul qword [0x55ed70]
xor ecx, ecx
fst qword [esp + 0x24]
fld qword [0x55ed68]
fcom st(1)
fnstsw ax
test ah, 0x41
jp 0x4992b6
cmp ecx, 0x1c
jge 0x4992ae
fdiv st(1), st(0)
add ecx, 1
fcom st(1)
fnstsw ax
test ah, 0x41
jnp 0x49929b
fstp st(0)
fstp qword [esp + 0x24]
jmp 0x4992ba
fstp st(1)
fstp st(0)
mov eax, dword [ecx*4 + 0x596020]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00488dc0
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call fcn.00488510
fld qword [esp + 0x24]
push eax
sub esp, 0xc
fstp qword [esp + 4]
mov ecx, esp
mov dword [esp + 0x34], esp
push str._.2f__S
call fcn.00488980
mov esi, dword [esp + 0x30]
push esi
call fcn.00489080
add esp, 0x14
lea ecx, [esp + 8]
mov dword [esp + 0xc], 1
mov byte [esp + 0x18], 0
call fcn.004884e0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x499340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x540661
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
fld qword [0x55ed68]
fld qword [esp + 0x24]
xor ecx, ecx
fcom st(1)
fnstsw ax
test ah, 1
jne 0x49939c
cmp ecx, 0x1c
jge 0x499394
fdiv st(1)
add ecx, 1
fcom st(1)
fnstsw ax
test ah, 1
je 0x499381
fstp st(1)
fstp qword [esp + 0x24]
jmp 0x4993a0
fstp st(0)
fstp st(0)
mov eax, dword [ecx*4 + 0x59603c]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00488dc0
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call fcn.00488510
fld qword [esp + 0x24]
push eax
sub esp, 0xc
fstp qword [esp + 4]
mov ecx, esp
mov dword [esp + 0x34], esp
push str._.3f__S
call fcn.00488980
mov esi, dword [esp + 0x30]
push esi
call fcn.00489080
add esp, 0x14
lea ecx, [esp + 8]
mov dword [esp + 0xc], 1
mov byte [esp + 0x18], 0
call fcn.004884e0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x499af0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x5406f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0
call fcn.00488510
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x10], 1
mov esi, eax
mov dword [0x5ac30c], 0
jle 0x499c66
mov ecx, dword [esi + 4]
push ecx
lea ecx, [esp + 0x10]
call fcn.00488980
push 0x55edb8
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 1
call fcn.00488980
mov ecx, eax
mov byte [esp + 0x20], 2
call fcn.00488530
push eax
lea ecx, [esp + 0x10]
call fcn.00488530
push eax
call fcn.004cfff0
add esp, 8
lea ecx, [esp + 0x14]
mov bl, al
mov byte [esp + 0x20], 1
call fcn.004884e0
test bl, bl
je 0x499bb3
mov dword [0x5ac30c], 2
jmp 0x499c58
push 0x55eda0
lea ecx, [esp + 0x18]
call fcn.00488980
push 1
mov ecx, eax
mov byte [esp + 0x24], 3
call fcn.00488530
push eax
lea ecx, [esp + 0x14]
call fcn.00488530
push eax
call fcn.004cff60
add esp, 0xc
test eax, eax
lea ecx, [esp + 0x14]
sete bl
mov byte [esp + 0x20], 1
call fcn.004884e0
test bl, bl
je 0x499c05
mov dword [0x5ac30c], 1
jmp 0x499c58
push 0x55ed88
lea ecx, [esp + 0x18]
call fcn.00488980
push 1
mov ecx, eax
mov byte [esp + 0x24], 4
call fcn.00488530
push eax
lea ecx, [esp + 0x14]
call fcn.00488530
push eax
call fcn.004cff60
add esp, 0xc
test eax, eax
lea ecx, [esp + 0x14]
sete bl
mov byte [esp + 0x20], 1
call fcn.004884e0
xor edx, edx
test bl, bl
sete dl
lea edx, [edx + edx + 1]
mov dword [0x5ac30c], edx
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.004884e0
test esi, esi
je 0x499c71
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.004884e0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x49ab30
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x540989
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov ebx, 1
push 0x104
lea ecx, [esp + 0x14]
mov dword [esp + 0x60], ebx
call fcn.00489720
push 0x38
lea eax, [esp + 0x20]
push 0
push eax
mov byte [esp + 0x68], 2
call fcn.00516810
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x48], 0x104
call fcn.00489670
lea ecx, [esp + 0x18]
push ecx
push 0x10000000
push 0
lea ecx, [esp + 0x74]
mov dword [esp + 0x50], eax
call fcn.00488510
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x49abda
call fcn.004888c0
mov esi, dword [esp + 0x64]
push eax
mov ecx, esi
call fcn.004886b0
jmp 0x49ac16
lea ecx, [esp + 0x10]
call fcn.00489670
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
cmp dword [esp + 0x6c], 0
je 0x49ac01
lea ecx, [esp + 0x10]
call fcn.00489670
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [esp + 0x10]
call fcn.00489670
mov esi, dword [esp + 0x64]
push eax
mov ecx, esi
call fcn.00488980
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x5c], bl
call fcn.00489940
lea ecx, [esp + 0x68]
mov byte [esp + 0x5c], 0
call fcn.004884e0
mov eax, esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x54
ret
Function at 0x49ac50
Capabilities:
Access peb ldr_data
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x5409e9
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov esi, 0x104
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x68], 1
call fcn.00489720
push esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x68], 2
call fcn.00489720
lea ecx, [esp + 8]
mov byte [esp + 0x64], 3
call fcn.00488940
push 0x38
lea eax, [esp + 0x28]
push 0
push eax
mov byte [esp + 0x70], 4
call fcn.00516810
add esp, 0xc
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x50], esi
call fcn.00489670
lea ecx, [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x28], esi
call fcn.00489670
lea ecx, [esp + 0x20]
push ecx
push 0x10000000
push 0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.00488510
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x49ad23
call fcn.004888c0
mov esi, dword [esp + 0x6c]
push eax
mov ecx, esi
call fcn.004886b0
jmp 0x49ad93
lea ecx, [esp + 0x10]
mov esi, str.file
call fcn.00489670
mov cx, word [eax]
cmp cx, word [esi]
jne 0x49ad57
test cx, cx
je 0x49ad53
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x49ad57
add eax, 4
add esi, 4
test cx, cx
jne 0x49ad31
xor eax, eax
jmp 0x49ad5c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x49ad75
lea ecx, [esp + 0x18]
call fcn.00489670
push eax
lea ecx, [esp + 0xc]
call fcn.004020d0
jmp 0x49ad83
lea edx, [esp + 0x70]
push edx
lea ecx, [esp + 0xc]
call fcn.00488590
mov esi, dword [esp + 0x6c]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004886b0
lea ecx, [esp + 8]
mov dword [esp + 0xc], 1
mov byte [esp + 0x64], 3
call fcn.004884e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x64], 2
call fcn.00489940
lea ecx, [esp + 0x18]
mov byte [esp + 0x64], 1
call fcn.00489940
lea ecx, [esp + 0x70]
mov byte [esp + 0x64], 0
call fcn.004884e0
mov eax, esi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x60
ret
Function at 0x49b490
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x540d98
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call fcn.00488510
push eax
push 0x55c31c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.004884e0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret

Function at 0x49b730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53fdf8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 2
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0
call fcn.00488680
push eax
lea ecx, [esp + 0x30]
call fcn.00488510
push eax
call fcn.004cf370
movzx eax, ax
add esp, 0x18
test ax, ax
je 0x49b7b8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.004884e0
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x49b7e1
mov edx, dword [esp + 0x20]
push 0x616c6973
push eax
push 0
push 1
push edx
call fcn.004cee00
mov eax, dword [esp + 0x18]
push eax
call fcn.004cdf00
add esp, 0x18
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.004884e0
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret
Function at 0x49bc50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x540b89
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x2c]
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x40000
mov ebx, 1
mov dword [esp + 0x20], ebx
jne 0x49bca6
mov edx, eax
sar edx, 0x1f
test bl, dl
je 0x49bca6
movsx eax, ax
test eax, eax
jge 0x49bcac
neg eax
lea ecx, [eax - 0x23]
cmp ecx, 0xd
ja 0x49bcbb
add eax, 0x258
jmp 0x49bcd2
lea edx, [eax - 0x7d0]
cmp edx, 0x35
ja 0x49bccd
sub eax, 0x5dc
jmp 0x49bcd2
mov eax, 0x258
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00488dc0
add esp, 8
push 0
push 0x55ee60
mov byte [esp + 0x28], 2
call fcn.004d0230
add esp, 4
push eax
lea ecx, [esp + 0x34]
call fcn.00488530
push eax
call fcn.004cffd0
add esp, 0xc
cmp eax, 0xffffffff
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x30]
je 0x49bd3a
call fcn.00488510
push eax
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.004886b0
mov esi, dword [esp + 0x30]
push esi
call fcn.00489080
add esp, 0xc
jmp 0x49bd6c
call fcn.00488510
push eax
lea ecx, [esp + 0x30]
call fcn.00488510
push eax
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push 0x1c3
push eax
call fcn.00488dc0
mov esi, dword [esp + 0x3c]
add esp, 8
push esi
call fcn.00489080
add esp, 0x10
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x20], bl
call fcn.004884e0
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 0
call fcn.004884e0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x49c160
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x540c08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x50]
mov dword [esp + 0x44], 0
call fcn.00488510
mov edi, dword [esp + 0x4c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x49c328
lea ecx, [esp + 0x18]
call fcn.00488940
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 1
call fcn.00488940
push esi
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 2
mov dword [esp + 0x28], 0x104
call fcn.0040d490
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea edx, [esp + 0x2c]
push edx
push esi
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov byte [esp + 0x60], 3
call fcn.00489670
mov edx, dword [esp + 0x3c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [esp + 0x28]
mov esi, eax
mov byte [esp + 0x38], 2
call fcn.00489940
test esi, esi
jne 0x49c2ec
sub dword [esp + 0x10], 1
push 0x104
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
call fcn.0040d490
push 0x104
mov ecx, eax
mov byte [esp + 0x3c], 4
call fcn.00489670
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
push ecx
push edx
call esi
test eax, eax
lea ecx, [esp + 0x28]
sete bl
mov byte [esp + 0x38], 2
call fcn.00489940
test bl, bl
je 0x49c2ec
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004886b0
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0049c160
sub dword [esp + 0x18], 1
add esp, 8
push 0x104
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x20]
call fcn.0040d490
push 0x104
mov ecx, eax
mov byte [esp + 0x3c], 4
call fcn.00489670
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
call esi
test eax, eax
lea ecx, [esp + 0x28]
sete bl
mov byte [esp + 0x38], 2
call fcn.00489940
test bl, bl
jne 0x49c281
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x44]
call fcn.00488510
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [esp + 0x1c]
mov esi, eax
mov byte [esp + 0x38], 1
call fcn.004884e0
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.004884e0
test esi, esi
lea ecx, [esp + 0x44]
sete bl
mov dword [esp + 0x38], 0xffffffff
call fcn.004884e0
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x49c6b0
Capabilities:
Check os version
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x540c73
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x5a8cf0]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push esi
push edi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x14c]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], ebx
call fcn.004888c0
push eax
mov ecx, esi
call fcn.004886b0
push 0x110
lea eax, [esp + 0x2c]
push ebx
push eax
mov dword [esp + 0x150], ebx
mov dword [esp + 0x28], 1
call fcn.00516810
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x28], 6
jb 0x49c7d9
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x49c7d9
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x49c782
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push 0x55ec78
call eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x49c7d2
push eax
mov ecx, esi
call fcn.004020d0
push str.Apple_ComputerQuickTime
lea ecx, [esp + 0x18]
call fcn.00488980
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x148], 1
call fcn.00488d00
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], bl
call fcn.004884e0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, esi
call fcn.00488680
test eax, eax
ja 0x49c85e
push 0x104
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.0040d490
mov ecx, eax
mov dword [esp + 0x144], 2
call fcn.00489670
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x14]
mov edi, eax
mov byte [esp + 0x144], bl
call fcn.00489940
cmp edi, ebx
jne 0x49c85e
push str.Apple_ComputerQuickTime
lea ecx, [esp + 0x18]
call fcn.00488980
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x148], 3
call fcn.00488d00
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], bl
call fcn.004884e0
mov eax, esi
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0051674d
add esp, 0x138
ret
Function at 0x49c890
Capabilities:
Check os version
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x540cdd
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x5a8cf0]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push esi
push edi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x14c]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
call fcn.004888c0
push eax
mov ecx, esi
call fcn.004886b0
push 0x110
lea eax, [esp + 0x2c]
push ebx
push eax
mov dword [esp + 0x150], ebx
mov dword [esp + 0x20], 1
call fcn.00516810
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x28], 6
jb 0x49c980
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x49c980
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x49c95e
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push 0x55ec68
call eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x49c979
push eax
mov ecx, esi
call fcn.004020d0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, esi
call fcn.00488680
test eax, eax
ja 0x49c9e0
push 0x104
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040d490
push 1
push 0x10
mov ecx, eax
mov dword [esp + 0x14c], 1
call fcn.00489670
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
lea ecx, [esp + 0x1c]
setl bl
mov byte [esp + 0x144], 0
call fcn.00489940
test bl, bl
je 0x49c9e0
push 0x55eec8
mov ecx, esi
call fcn.004020d0
mov eax, esi
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0051674d
add esp, 0x138
ret

Function at 0x49cb90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x540258
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5a8cf0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
push esi
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [esp + 0x10]
push 0x420
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], ecx
push edx
lea ecx, [esp + 0x38]
call fcn.00488680
push eax
lea ecx, [esp + 0x3c]
call fcn.00488510
push eax
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
mov ecx, dword [esi + 8]
sub ecx, dword [esi]
cdq
idiv ecx
mov edi, dword [esp + 0x18]
sub edi, dword [esp + 0x10]
test edx, edx
jle 0x49cc1d
add eax, 1
imul eax, edi
add eax, dword [esi + 4]
lea ecx, [esp + 0x30]
mov dword [esi + 0xc], eax
mov dword [esp + 0x24], 0xffffffff
call fcn.004884e0
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret