joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f8a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov esi, eax
xor eax, eax
push ebp
push 0x47fa39
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x11], 0
je 0x47f8e0
call fcn.0046d150
mov dword [ebp - 0x18], eax
mov eax, esi
test eax, eax
je 0x47f8eb
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x47f8f6
xor ebx, ebx
jmp 0x47fa11
cmp byte [ebp - 0x12], 0
je 0x47f9fa
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00408058
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00426844
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00408058
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00420288
mov eax, dword [ebp - 8]
test eax, eax
je 0x47f937
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x47f964
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00408ef0
mov eax, dword [ebp - 0x1c]
mov edx, 0x47fa54
call fcn.00408eb8
sete al
jmp 0x47f966
xor eax, eax
test al, al
je 0x47f96e
mov al, 1
jmp 0x47f978
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041fb94
test al, al
je 0x47f980
mov al, 1
jmp 0x47f98e
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408eb8
sete al
test al, al
jne 0x47fa11
cmp dword [ebp - 4], 0
jne 0x47f9b2
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x47fa11
mov eax, dword [ebp - 4]
call fcn.00408ac4
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00408b1c
mov eax, dword [ebp - 0x20]
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.0047f8a0
mov ebx, eax
test bl, bl
je 0x47f9f0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x47f9f4
xor eax, eax
jmp 0x47f9f6
mov al, 1
mov ebx, eax
jmp 0x47fa11
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fa40
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407c90
ret

Function at 0x47fa58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00408ac4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x47fa71
test al, 0x10
jne 0x47fa75
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x480648
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004806f8
test al, al
je 0x480688
mov eax, esi
call fcn.00420078
mov ebx, eax
test bl, bl
jne 0x480688
mov eax, esi
call fcn.0048052c
push 0x80
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.00420078
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x480690
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push ecx
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004806f8
test al, al
je 0x4806f0
mov eax, esi
call fcn.00420078
mov ebx, eax
test bl, bl
jne 0x4806f0
mov eax, esi
call fcn.0048052c
push 0x80
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.00420078
mov ebx, eax
test bl, bl
jne 0x4806f0
cmp byte [esp], 0
je 0x4806f0
call fcn.0046c8d8
test al, al
je 0x4806f0
mov eax, esi
call fcn.00480c6c
mov ebx, eax
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x4806f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00408ac4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x480711
test al, 0x10
je 0x480715
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x48071c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00408ac4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x480735
test al, 0x10
je 0x480739
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x480880
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4808e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00408058
lea eax, [ebp - 8]
mov edx, esi
call fcn.00408058
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4808f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x488498
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x4884fc
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00408ac4
push eax
mov eax, esi
call fcn.00408ac4
push eax
mov eax, ebx
call fcn.00408ac4
push eax
push 0x48850c
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488503
lea eax, [ebp + 8]
call fcn.00407c30
ret

Function at 0x488518
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x4885b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov eax, 0x4885cc
mov dword [ebp - 0x30], eax
mov eax, ebx
call fcn.00408ac4
mov dword [ebp - 0x2c], eax
mov eax, esi
call fcn.00408ac4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edi
mov eax, dword [ebp + 8]
call fcn.00408ac4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
lea ebx, [ebp - 0x3c]
push ebx
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x4885a1
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4885be
lea eax, [ebp + 8]
call fcn.00407c30
ret

Function at 0x4885d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x48863c
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00408ac4
push eax
mov eax, esi
call fcn.00408ac4
push eax
mov eax, ebx
call fcn.00408ac4
push eax
push 0x48864c
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488643
lea eax, [ebp + 8]
call fcn.00407c30
ret
Function at 0x488c68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407d14
xor eax, eax
push ebp
push 0x488d1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x488cf3
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0041e9a4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00408058
cmp dword [ebp - 4], 0
jne 0x488cc7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x488cfd
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
push 0x488d30
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
setg byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x488cfd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488d22
lea eax, [ebp - 0xc]
call fcn.00407c30
lea eax, [ebp - 4]
call fcn.00407c30
ret

Function at 0x48d6a4
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.0040502c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x497524
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x497600
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00408aec
mov eax, dword [ebp - 0x18]
push eax
call fcn.00499b10
pop edx
call fcn.00496954
test al, al
je 0x49756c
mov ebx, 1
jmp 0x4975ea
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x497599
call sub.kernel32.dll_GetLastError_2
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor ebx, ebx
jmp 0x4975ea
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x4975cd
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x4975cd
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle_1
movzx eax, word [ebp + 0xc]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497607
lea eax, [ebp - 0x18]
call fcn.00407c30
ret
Function at 0x497614
Capabilities:
Delete file
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x49765f
lea eax, [esp + 0x105]
push eax
push 0
push 0x497690
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x49765f
lea eax, [esp + 0x105]
call fcn.00408138
cmp ebx, eax
setg al
jmp 0x497661
xor eax, eax
mov ebx, eax
test bl, bl
je 0x49767b
lea edx, [esp + 0x105]
mov eax, esi
call fcn.0042072c
push esi
call sub.kernel32.dll_DeleteFileA
movzx eax, bl
mov edx, dword [0x535c3c]
mov eax, dword [edx + eax*4]
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x49805c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x498065
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4981e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
inc dword [ebx + 0x18]
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00497edc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040877c
lea eax, [ebx + 0x22]
mov edx, dword [ebp - 4]
call fcn.0042080c
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 0x14]
mov eax, esi
call fcn.00497d3c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040877c
lea eax, [ebx + 0x122]
mov edx, dword [ebp - 4]
call fcn.0042080c
lea ecx, [ebp - 0x18]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00497e20
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040877c
lea eax, [ebx + 0x222]
mov edx, dword [ebp - 4]
call fcn.0042080c
cmp word [esi + 0x4a], 0
je 0x498122
push edi
lea eax, [ebp - 9]
push eax
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x4c]
call dword [esi + 0x48]
cmp byte [ebp - 9], 0
jne 0x498193
lea eax, [ebp - 8]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00408b58
mov eax, dword [ebp - 8]
call fcn.0041fc64
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00408b58
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x122]
mov ecx, pe_nt_image_headers32
call fcn.00408b58
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 8]
mov edx, 1
call fcn.00496efc
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
mov dword [esi + 0x3ac], eax
xor eax, eax
mov dword [esi + 0x3b0], eax
movzx ebx, byte [ebp - 9]
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4981e9
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00407c90
lea eax, [ebp - 8]
call fcn.00407c30
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x49b1cc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407d14
xor eax, eax
push ebp
push 0x49b413
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00408010
mov byte [ebp - 0xd], 0
test ebx, ebx
je 0x49b3eb
cmp dword [0x5353c4], 0
jne 0x49b231
call fcn.0049dacc
cmp dword [0x5353c4], 0
je 0x49b3eb
xor eax, eax
push ebp
push 0x49b3e1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49b3d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x49b434
call fcn.00408058
mov edx, dword [ebp - 4]
mov eax, 0x49b44c
call fcn.0040909c
mov esi, eax
test esi, esi
jle 0x49b290
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408ef0
lea eax, [ebp - 4]
mov ecx, esi
mov edx, 1
call fcn.00408f38
cmp dword [ebp - 4], 0
jne 0x49b2b0
mov dl, 1
mov eax, ebx
call fcn.00472274
xor edx, edx
push edx
push eax
lea edx, [ebp - 4]
mov eax, 8
call fcn.0041f440
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x5353c4]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004905d4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00408010
mov eax, dword [0x5353c4]
cmp byte [eax + 0x13], 0
je 0x49b31d
push 0x49b45c
push dword [ebp - 4]
push 0x49b480
push ebx
push 0x49b480
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00408da8
mov eax, dword [ebp - 0x1c]
call fcn.00408ac4
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x49b36a
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00408010
mov eax, dword [0x5353c4]
cmp byte [eax + 0x11], 0
je 0x49b354
push dword [ebp - 4]
push 0x49b494
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00408da8
mov byte [ebp - 0xd], 0
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b3eb
mov byte [ebp - 0xd], 1
mov eax, dword [0x5353c4]
cmp byte [eax + 0x11], 0
je 0x49b393
push dword [ebp - 4]
push 0x49b4a4
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00408da8
lea eax, [ebp - 8]
call fcn.00407c30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b3d7
mov eax, dword [0x5353c4]
cmp dword [eax + 0x18], 0
je 0x49b3cf
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ebx, dword [0x5353c4]
call dword [ebx + 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00408010
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b41a
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00407c90
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x49c8e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49c9e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x49c9fc
call fcn.00408058
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
sete bl
test bl, bl
je 0x49c946
push 0xa
lea eax, [ebp - 0xe]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
je 0x49c94a
xor eax, eax
jmp 0x49c94c
mov al, 1
mov ebx, eax
test bl, bl
je 0x49c967
lea eax, [ebp - 4]
lea edx, [ebp - 0x18]
call fcn.00408b1c
mov eax, esi
lea edx, [ebp - 0xe]
call fcn.00408b1c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0041e618
mov eax, dword [ebp - 0x1c]
mov edx, 0x49ca10
call fcn.00408eb8
jne 0x49c9ae
lea edx, [ebp - 0x20]
mov eax, dword [esi]
call fcn.0041e618
mov eax, dword [ebp - 0x20]
mov edx, 0x49ca24
call fcn.00408eb8
jne 0x49c9ae
mov eax, edi
mov edx, dword [0x5353c8]
mov ecx, 0
call fcn.0040877c
jmp 0x49c9bd
mov eax, edi
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040877c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c9e7
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x4b33a8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b34eb
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4b33ff
push 0x20a
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [0x539c50]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20e]
mov eax, dword [ebp - 4]
call fcn.00407db8
jmp 0x4b34d2
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
mov eax, ebx
call fcn.004b3344
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.004b336c
mov ebx, eax
test esi, esi
je 0x4b3427
dec esi
test esi, esi
jl 0x4b3427
cmp edi, ebx
jne 0x4b3406
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x214]
mov edx, edi
call fcn.00408b1c
mov eax, dword [ebp - 0x214]
mov ecx, ebx
sub ecx, edi
sar ecx, 1
jns 0x4b3449
adc ecx, 0
mov edx, 1
call fcn.00408ef0
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4b346f
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x4b34d2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp word [eax], 0x22
jne 0x4b34d2
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4b3496
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp word [ecx + eax*2 - 2], 0x22
jne 0x4b34d2
mov eax, edx
mov dword [ebp - 0x218], eax
mov ebx, dword [ebp - 0x218]
test ebx, ebx
je 0x4b34ba
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00408ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b34f2
lea eax, [ebp - 0x214]
call fcn.00407c30
ret
Function at 0x4b7f88
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4b8168
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x4b7fe5
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_BeginPaint
mov ebx, eax
jmp 0x4b7ff8
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WindowFromDC
test eax, eax
jne 0x4b7ff8
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b8048
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf5], 0
jne 0x4b8048
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
jmp 0x4b8058
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf5]
test eax, eax
je 0x4b8058
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4b8157
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xf5], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call fcn.004bd8c4
cmp dword [0x53c268], 0
je 0x4b809a
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call dword [0x53c268]
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call fcn.004bd8c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x45b]
test eax, eax
je 0x4b80bf
xor edx, edx
call fcn.004b2b4c
push 0
push ebx
call sub.gdi32.dll_SelectClipRgn
cmp ebx, dword [ebp - 0xc]
je 0x4b80eb
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
cmp dword [ebp - 8], 0
jne 0x4b8104
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b815e
cmp dword [ebp - 0x10], 0
je 0x4b8143
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
jmp 0x4b8156
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x4b8156
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
ret
Function at 0x4b8e50
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x423]
test eax, eax
je 0x4b8eab
cmp byte [ebx + 0x44d], 0
jne 0x4b8eab
push eax
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
jne 0x4b8e79
xor esi, esi
jmp 0x4b8e95
inc eax
mov ebp, eax
add ebp, ebp
mov eax, ebp
call fcn.004045e8
mov esi, eax
push ebp
push esi
mov eax, dword [ebx + 0x423]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, edi
mov edx, esi
call fcn.00408b1c
test esi, esi
je 0x4b8eb8
mov eax, esi
call fcn.00404604
jmp 0x4b8eb8
mov eax, edi
mov edx, dword [ebx + 0x441]
call fcn.00408b1c
pop ebp
pop edi
pop esi
pop ebx
ret