joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df5c0
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x4df5c8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040685c
xor eax, eax
push ebp
push 0x4df81e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4df7b4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi + 0x6b8]
call fcn.004128e0
push 7
mov eax, dword [esi + 0x6b8]
call fcn.00406900
push eax
call fcn.0040b4fc
lea edx, [ebp - 0xc]
mov ebx, dword [esi + 0x410]
mov eax, ebx
call fcn.004a27d4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0041122c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a280c
mov eax, dword [esi + 0x418]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x4df666
push 0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov dl, 1
mov eax, esi
call fcn.004db0b4
mov ebx, eax
jmp 0x4df679
push 0
mov eax, dword [ebp - 4]
push eax
mov cl, 1
mov dl, 1
mov eax, esi
call fcn.004db0b4
mov ebx, eax
test bl, bl
je 0x4df7aa
lea edx, [ebp - 0x20]
mov eax, dword [esi + 0x410]
call fcn.004a27d4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.0042145c
lea eax, [ebp - 0x1c]
push eax
push 2
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
mov ecx, 0x4df83c
mov edx, 0x4df85c
call fcn.004d6694
lea edx, [ebp - 0x34]
mov eax, dword [esi + 0x414]
call fcn.004a27d4
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
call fcn.0042145c
lea eax, [ebp - 0x30]
push eax
push 2
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
mov ecx, 0x4df87c
mov edx, 0x4df85c
call fcn.004d6694
mov eax, dword [esi + 0x418]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x4df72a
lea eax, [ebp - 0x44]
mov edx, 1
mov cl, 1
call fcn.00421198
lea eax, [ebp - 0x44]
push eax
push 0
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
mov ecx, 0x4df89c
mov edx, 0x4df85c
call fcn.004d6694
jmp 0x4df755
lea eax, [ebp - 0x54]
mov edx, 2
mov cl, 1
call fcn.00421198
lea eax, [ebp - 0x54]
push eax
push 0
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
mov ecx, 0x4df89c
mov edx, 0x4df85c
call fcn.004d6694
push 0
mov edx, dword [esi + 0x6b8]
lea eax, [ebp - 0x58]
mov ecx, 0x4df8b4
call fcn.00406d58
mov eax, dword [ebp - 0x58]
call fcn.00406900
push eax
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
call fcn.00406900
push eax
call fcn.0040b1d0
cmp eax, 1
sbb ebx, ebx
inc ebx
mov esi, dword [0x4ee59c]
mov esi, dword [esi]
mov dword [ebp - 0x5c], esi
mov eax, dword [ebp - 0x5c]
call fcn.00406900
push eax
call fcn.0040b210
cmp eax, 1
sbb eax, eax
inc eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4df7c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df825
lea eax, [ebp - 0x58]
call fcn.00406864
lea eax, [ebp - 0x54]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
lea eax, [ebp - 0x34]
call fcn.00406864
lea eax, [ebp - 0x30]
call fcn.0041c1d8
lea eax, [ebp - 0x20]
call fcn.00406864
lea eax, [ebp - 0x1c]
call fcn.0041c1d8
lea eax, [ebp - 0xc]
call fcn.00406864
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040686c
ret
Function at 0x4dfc48
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0040685c
xor eax, eax
push ebp
push 0x4dfe75
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0041122c
mov eax, dword [ebp - 0x10]
call fcn.004d44a4
test al, al
jne 0x4dfcc5
push 0x40
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004a27d4
mov eax, dword [ebp - 0x14]
call fcn.00406900
push eax
push 0x4dfe88
mov eax, dword [ebp - 8]
call fcn.004ab300
push eax
call fcn.0040bc5c
jmp 0x4dfe42
mov eax, 0x4dfebc
call fcn.004da308
test al, al
jne 0x4dfcdb
mov eax, dword [ebp - 8]
call fcn.004df8cc
mov eax, 0x4dfebc
call fcn.004da358
test al, al
jne 0x4dfd17
push 0x40
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004a27d4
mov eax, dword [ebp - 0x18]
call fcn.00406900
push eax
push 0x4dfed0
mov eax, dword [ebp - 8]
call fcn.004ab300
push eax
call fcn.0040bc5c
jmp 0x4dfe42
mov eax, dword [ebp - 8]
cmp byte [eax + 0x498], 0
je 0x4dfd2b
mov eax, dword [ebp - 8]
call fcn.004e170c
mov eax, dword [ebp - 8]
cmp byte [eax + 0x498], 0
je 0x4dfd65
push 0x40
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004a27d4
mov eax, dword [ebp - 0x1c]
call fcn.00406900
push eax
push 0x4dfef4
mov eax, dword [ebp - 8]
call fcn.004ab300
push eax
call fcn.0040bc5c
jmp 0x4dfe42
mov eax, 0x4dfebc
call fcn.004da308
test al, al
je 0x4dfe42
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4a0]
mov edx, 0x4dff34
mov eax, 0x4dff50
call fcn.004d503c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4a0]
call fcn.00411e78
test al, al
je 0x4dfe42
xor eax, eax
push ebp
push 0x4dfe3b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4a0]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0x11
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4a4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0x11
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x11
lea edx, [ebp - 0x38]
mov ecx, 2
mov eax, 0x4dff6c
call fcn.00412dfc
mov eax, dword [ebp - 0x20]
xor edx, edx
call fcn.004d3640
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4a4]
call fcn.004d4ab4
mov ebx, eax
mov eax, dword [ebp - 8]
mov byte [eax + 0x498], bl
mov byte [ebp - 9], bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfe42
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4a0]
call fcn.00406900
push eax
call fcn.0040b210
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfe7c
lea eax, [ebp - 0x20]
call fcn.00406864
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040686c
lea eax, [ebp - 0x10]
call fcn.00406864
lea eax, [ebp - 4]
call fcn.00406864
ret
Function at 0x4dff90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e0067
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x478]
mov edx, 0x4e0084
mov eax, 0x4e009c
call fcn.004d503c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x478]
call fcn.00411e78
test al, al
je 0x4e0051
xor eax, eax
push ebp
push 0x4e004a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x478]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
movzx eax, bl
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x4e00b8
call fcn.00412dfc
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004d3640
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0051
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x478]
call fcn.00406900
push eax
call fcn.0040b210
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e006e
lea eax, [ebp - 0xc]
call fcn.00406864
ret
Function at 0x4e00e4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd
push 0
push 0
dec ecx
jne 0x4e00ec
push ebx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e032a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x2c]
xor edx, edx
mov cl, 1
call fcn.00421198
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x6b8]
lea eax, [ebp - 0x30]
mov ecx, 0x4e0344
call fcn.00406d58
mov eax, dword [ebp - 0x30]
mov ecx, 0x4e0368
mov edx, 0x4e0380
call fcn.004d642c
lea eax, [ebp - 0x1c]
call fcn.0041cc30
dec eax
je 0x4e0156
dec eax
je 0x4e016d
jmp 0x4e02d2
push 1
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.004db0b4
mov ebx, eax
jmp 0x4e02d4
push 2
lea eax, [ebp - 0x50]
mov edx, 0x4e03a0
call fcn.0042145c
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x6b8]
lea eax, [ebp - 0x54]
mov ecx, 0x4e0344
call fcn.00406d58
mov eax, dword [ebp - 0x54]
mov ecx, 0x4e03b0
mov edx, 0x4e0380
call fcn.004d642c
lea edx, [ebp - 0x40]
lea eax, [ebp - 4]
call fcn.004209a0
push 0x4e03d0
push dword [ebp - 4]
push 0x4e0410
lea ecx, [ebp - 0x60]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e21b8
mov edx, dword [ebp - 0x60]
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp - 0xc]
call fcn.004e29c4
mov eax, dword [ebp - 0x5c]
mov edx, 1
call fcn.00411ab8
dec eax
lea edx, [ebp - 0x58]
call fcn.00411820
push dword [ebp - 0x58]
push 0x4e0468
lea eax, [ebp - 8]
mov edx, 5
call fcn.00406e3c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x6b8]
lea eax, [ebp - 0x64]
mov ecx, 0x4e0478
call fcn.00406d58
mov eax, dword [ebp - 0x64]
call fcn.00411e78
test al, al
jne 0x4e024f
push 0x4e0494
mov eax, dword [ebp - 0xc]
push dword [eax + 0x6b8]
push 0x4e0478
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00406e3c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x47c]
mov edx, 0x4e04ac
mov eax, 0x4e04cc
call fcn.004d503c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x47c]
call fcn.00411e78
test al, al
je 0x4e02ce
xor eax, eax
push ebp
push 0x4e02c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x47c]
lea eax, [ebp - 0x68]
mov ecx, dword [ebp - 8]
call fcn.00406d58
mov eax, dword [ebp - 0x68]
xor edx, edx
call fcn.004d3640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e02ce
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x47c]
call fcn.00406900
push eax
call fcn.0040b210
ret
mov bl, 1
jmp 0x4e02d4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0331
lea eax, [ebp - 0x68]
mov edx, 6
call fcn.0040686c
lea eax, [ebp - 0x50]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
lea eax, [ebp - 0x30]
call fcn.00406864
lea eax, [ebp - 0x2c]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040686c
ret
Function at 0x4e15a8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e168d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, 0x4e16a8
call fcn.004da308
test al, al
je 0x4e1677
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4a0]
mov edx, 0x4e16c8
mov eax, 0x4e16e4
call fcn.004d503c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4a0]
call fcn.00411e78
test al, al
je 0x4e1677
xor eax, eax
push ebp
push 0x4e1670
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4a0]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4e1700
call fcn.00412dfc
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004d3640
mov eax, 0x4e16a8
call fcn.004da308
xor al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1677
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4a0]
call fcn.00406900
push eax
call fcn.0040b210
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1694
lea eax, [ebp - 0xc]
call fcn.00406864
ret

Function at 0x4e170c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e180a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x498], 0
je 0x4e17f4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4a0]
mov edx, 0x4e1828
mov eax, 0x4e1844
call fcn.004d503c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4a0]
call fcn.00411e78
test al, al
je 0x4e17f4
xor eax, eax
push ebp
push 0x4e17ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4a0]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4a4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x4e1860
call fcn.00412dfc
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004d3640
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4e17cb
mov eax, dword [ebp - 4]
mov byte [eax + 0x498], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e17f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4a0]
call fcn.00406900
push eax
call fcn.0040b210
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1811
lea eax, [ebp - 0xc]
call fcn.00406864
ret
Function at 0x4e2790
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4e2799
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040685c
xor eax, eax
push ebp
push 0x4e2918
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4f450c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4e28c1
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [0x4f450c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00406b00
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov edx, 2
call fcn.0040d088
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00406aec
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00406f5c
je 0x4e28b7
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00417da8
mov eax, dword [ebp - 0x1c]
call fcn.00406900
push eax
call fcn.0040b2f0
cmp eax, 3
jne 0x4e28b7
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004e241c
cmp al, 1
jbe 0x4e286b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, esi
call fcn.004e325c
test al, al
je 0x4e28b7
cmp byte [ebp - 9], 0
je 0x4e28aa
cmp dword [ebp + 0x10], 0
jne 0x4e2894
cmp dword [ebp + 0xc], 0
jne 0x4e2894
push 0
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004dec00
test al, al
je 0x4e28b7
jmp 0x4e28aa
mov eax, dword [ebp - 8]
call fcn.004d3a50
cmp edx, dword [ebp + 0x10]
jne 0x4e28a8
cmp eax, dword [ebp + 0xc]
jae 0x4e28aa
jmp 0x4e28b7
jl 0x4e28b7
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00406874
jmp 0x4e28c1
dec ebx
cmp ebx, 0xffffffff
jne 0x4e27da
mov eax, dword [ebp + 8]
cmp dword [eax], 0
sete al
and al, byte [ebp - 9]
je 0x4e28e3
push 0
push 0
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004e2790
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e291f
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040686c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406524
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040686c
ret
Function at 0x4e30d8
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e31ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
call fcn.00406900
push eax
lea eax, [ebp - 4]
mov ecx, 0x4e31cc
mov edx, dword [ebx + 0x6b8]
call fcn.00406d58
mov eax, dword [ebp - 4]
call fcn.00406900
push eax
call fcn.0040b1d0
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
mov ecx, 0x4e31f0
mov edx, 0x4e3210
call fcn.004d6828
test al, al
je 0x4e3173
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
mov ecx, 0x4e3230
mov edx, 0x4e3210
call fcn.004d6828
test al, al
je 0x4e3173
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
mov ecx, 0x4e3250
mov edx, 0x4e3210
call fcn.004d6828
test al, al
jne 0x4e3177
xor ebx, ebx
jmp 0x4e3179
mov bl, 1
mov esi, dword [0x4ee59c]
mov esi, dword [esi]
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
call fcn.00406900
push eax
call fcn.0040b210
cmp eax, 1
sbb eax, eax
inc eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e31b5
lea eax, [ebp - 4]
call fcn.00406864
ret

Function at 0x4e3338
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e348c
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov eax, dword [ebx + 0x474]
xor edx, edx
call fcn.00412210
mov eax, dword [ebx + 0x474]
call fcn.00411e78
test al, al
je 0x4e3417
mov dl, 1
mov eax, dword [0x4277e4]
call fcn.00433160
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4e3410
push dword fs:[edx]
mov dword fs:[edx], esp
push dword [ebx + 0x474]
push 0x4e34a8
push dword [ebp - 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00406e3c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x4ee59c]
mov edx, dword [edx]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
mov eax, dword [0x4ee59c]
mov eax, dword [eax]
xor edx, edx
call fcn.004d3640
mov ebx, dword [0x4ee59c]
mov ebx, dword [ebx]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
call fcn.00406900
push eax
call fcn.0040b210
cmp eax, 1
sbb eax, eax
inc eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3417
mov eax, dword [ebp - 0xc]
call fcn.00404da0
ret
mov dl, 1
mov eax, dword [0x4277e4]
call fcn.00433160
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e3467
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00411e78
test al, al
je 0x4e344b
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e346e
mov eax, dword [ebp - 4]
call fcn.00406900
push eax
call fcn.0040b210
ret
Function at 0x4e3e30
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040685c
xor eax, eax
push ebp
push 0x4e3f3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x474]
call fcn.00411e78
test al, al
je 0x4e3f21
test bl, bl
je 0x4e3eac
push dword [esi + 0x474]
push 0x4e3f58
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406e3c
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004d3640
push 7
mov eax, dword [ebp - 4]
call fcn.00406900
push eax
call fcn.0040b4fc
jmp 0x4e3ed9
push dword [esi + 0x474]
push 0x4e3f78
push dword [ebp - 4]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406e3c
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004d3640
mov eax, dword [ebp - 4]
call fcn.004d341c
lea eax, [ebp - 0x10]
mov ecx, 0x4e3f98
mov edx, dword [ebp - 4]
call fcn.00406d58
mov eax, dword [ebp - 0x10]
call fcn.004d341c
lea eax, [ebp - 0x14]
mov ecx, 0x4e3fb0
mov edx, dword [ebp - 4]
call fcn.00406d58
mov eax, dword [ebp - 0x14]
call fcn.004d341c
lea eax, [ebp - 0x18]
mov ecx, 0x4e3fc8
mov edx, dword [ebp - 4]
call fcn.00406d58
mov eax, dword [ebp - 0x18]
call fcn.004d341c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3f43
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040686c
ret

Function at 0x4e4438
Capabilities:
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040685c
mov eax, dword [ebp - 8]
call fcn.0040685c
xor eax, eax
push ebp
push 0x4e44ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004d341c
mov eax, dword [ebp - 8]
call fcn.00406900
push eax
mov eax, dword [ebp - 4]
call fcn.00406900
push eax
call fcn.0040b49c
push 7
mov eax, dword [ebp - 8]
call fcn.00406900
push eax
call fcn.0040b4fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e44b3
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040686c
ret
Function at 0x401901
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
and dword [ebp - 0x404], 0
push esi
lea eax, [ebp - 0x404]
push eax
push 0x40102d
call dword [0x4112d8]
xor esi, esi
cmp dword [ebp - 0x404], esi
jle 0x401950
push 0
push 0xf020
push 0x112
push dword [ebp + esi*4 - 0x400]
call dword [0x4112d4]
inc esi
cmp esi, dword [ebp - 0x404]
jl 0x40192e
pop esi
leave
ret

Function at 0x4019a8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
push esi
xor ebx, ebx
mov esi, 0x1500
push edi
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], esi
jne 0x401acd
lea eax, [ebp - 0x418]
push eax
push 0x40102d
mov dword [ebp - 0x418], ebx
call dword [0x4112d8]
cmp dword [ebp - 0x418], ebx
jle 0x401ab8
push ebx
mov edi, esi
push esi
mov esi, dword [0x4112c4]
jmp 0x4019fd
inc edi
dec dword [ebp - 4]
push ebx
push edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4019f7
cmp dword [ebp - 0x418], ebx
mov dword [ebp - 0xc], ebx
jle 0x401acd
mov edi, dword [0x4112c8]
mov ebx, 0x8028
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x414]
push 0xffffffffffffffff
push 0
push ebx
push eax
mov dword [ebp - 0x10], eax
call edi
mov dword [ebp - 0x14], eax
test eax, eax
je 0x401aa4
and dword [ebp - 8], 0
test eax, eax
jle 0x401aa4
push dword [ebp - 8]
push 0
push ebx
push dword [ebp - 0x10]
call edi
movzx esi, ax
test si, si
je 0x401a94
push 0x104
lea eax, [ebp - 0x620]
push eax
push esi
call dword [0x41105c]
push esi
call dword [0x411058]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x620]
push eax
push dword [ebp + 0xc]
push dword [esi]
push dword [ebp + 8]
call fcn.00401953
inc dword [ebp + 0xc]
test eax, eax
je 0x401a97
inc dword [ebp - 4]
jmp 0x401a97
mov esi, dword [ebp + 0x10]
inc dword [esi]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jl 0x401a44
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x418]
jl 0x401a20
jmp 0x401acd
mov esi, dword [ebp + 0x10]
push 0x401
push dword [esi]
push dword [ebp + 8]
call dword [0x4112cc]
inc dword [esi]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40205f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov word [edi], ax
mov esi, ecx
cmp byte [0x4191e0], bl
je 0x4020aa
mov eax, dword [esi + 8]
cmp eax, ebx
jne 0x402086
xor eax, eax
jmp 0x4020d9
push eax
push 0x104
push edi
call fcn.004010f8
push edi
call dword [0x411060]
lea eax, [eax + eax + 2]
add dword [esi + 8], eax
xor eax, eax
cmp word [edi], bx
setne al
jmp 0x4020d9
mov ecx, dword [esi]
cmp ecx, ebx
je 0x402082
mov eax, dword [esi + 0xc]
lea edx, [eax + 1]
mov dword [esi + 0xc], edx
lea edx, [ebp - 8]
push edx
push ebx
push ebx
push ebx
lea edx, [ebp + 8]
push edx
push edi
push eax
push ecx
mov dword [ebp + 8], 0x104
call dword [0x411004]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4