joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5ecc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4c5fc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402730
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c5f95
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004043d8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x4c5fd8
call fcn.004044ec
call fcn.0040ae54
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x18]
mov eax, 0x4c5ff0
call fcn.0040bafc
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
mov edx, 0x4c6004
call fcn.004c508c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5f9c
mov eax, dword [ebp - 0x10]
call fcn.004033ac
mov eax, dword [ebp - 4]
call fcn.00402750
ret

Function at 0x4c7a58
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4c7aa9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4c7a90
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4c7a80
jmp 0x4c7aa9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4c7a91
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d8120
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d81ba
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
push 0x4d81c8
call sub.kernel32.dll_GetEnvironmentVariableA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404450
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 4]
mov ecx, 0x4d81e0
call fcn.004044ec
cmp dword [ebp - 4], 0
je 0x4d8199
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0053fd54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d81c1
lea eax, [ebp - 0x108]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x4db5cc
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4db648
mov eax, 0x4db65c
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4db67c
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret

Function at 0x4def84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df037
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x110]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x110]
call fcn.00409938
lea eax, [ebp - 0x10]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404700
lea eax, [ebp - 4]
mov ecx, 0x4df04c
mov edx, dword [ebp - 0x10]
call fcn.004044ec
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0053fd54
lea eax, [ebp - 8]
mov ecx, 0x4df078
mov edx, dword [ebp - 0xc]
call fcn.004044ec
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0053fd54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df03e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404204
ret

Function at 0x4e0498
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e0514
mov eax, 0x4e0528
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4e0544
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret
Function at 0x4e0790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e0881
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0053e738
push 1
push 0x4e0898
push dword [ebp - 4]
push 0x4e08ac
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4e0898
push dword [ebp - 4]
push 0x4e08c8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e08e4
mov eax, 0x4e08f8
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0888
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4e1be8
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e1c94
mov eax, 0x4e1ca8
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4e1cc4
call sub.kernel32.dll_WinExec
push 0x4e1ce8
mov ecx, 0x4e1d1c
mov edx, 0x4e1d34
mov eax, 0x80000000
call fcn.004e2084
push 0x4e1d6c
xor ecx, ecx
mov edx, 0x4e1d34
mov eax, 0x80000000
call fcn.004e2084
pop edi
pop esi
pop ebx
ret

Function at 0x4e23cc
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e2458
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x10c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10c]
call fcn.00409938
lea eax, [ebp - 0xc]
mov ecx, 0x4e246c
mov edx, dword [ebp - 4]
call fcn.004044ec
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4e2484
call fcn.004044ec
push 0
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e245f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret
Function at 0x4e620c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e6288
mov eax, 0x4e629c
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4e62ac
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret

Function at 0x4e6494
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e6510
mov eax, 0x4e6524
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4e6534
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret

Function at 0x4e6a14
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e6a90
mov eax, 0x4e6aa4
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4e6ab4
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret

Function at 0x4e6c8c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e6d08
mov eax, 0x4e6d1c
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4e6d2c
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret
Function at 0x4e7188
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e72a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e72bc
mov eax, 0x4e72d0
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 4]
call fcn.0053e738
push 1
push 0x4e72f8
push dword [ebp - 4]
push 0x4e730c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4e72f8
push dword [ebp - 4]
push 0x4e7324
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4e72f8
push dword [ebp - 4]
push 0x4e7340
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x10]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e72aa
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404204
ret

Function at 0x4e90e0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e915c
mov eax, 0x4e9170
call fcn.00541a04
mov eax, esi
call fcn.00541fac
mov eax, ebx
call fcn.0054201c
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4e9180
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret
Function at 0x4e9418
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, eax
xor eax, eax
push ebp
push 0x4e9538
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409938
lea eax, [ebp - 0x110]
mov ecx, 0x4e9550
mov edx, dword [ebp - 4]
call fcn.004044ec
mov edx, dword [ebp - 0x110]
mov eax, esi
call fcn.004711a8
lea edx, [ebp - 0x114]
mov eax, esi
call fcn.00471178
mov eax, dword [ebp - 0x114]
call fcn.00409288
test al, al
je 0x4e950c
mov eax, ebx
call fcn.00493c50
mov esi, eax
mov edx, esi
mov eax, ebx
call fcn.00493c64
add eax, 0xc
call fcn.004041e0
mov edx, esi
mov eax, ebx
call fcn.00493c64
add eax, 0x10
call fcn.004041e0
mov edx, esi
mov eax, ebx
call fcn.00493c64
add eax, 0x14
call fcn.004041e0
mov edx, esi
mov eax, ebx
call fcn.00493c64
add eax, 0x28
mov ecx, 0x4e9550
mov edx, dword [ebp - 4]
call fcn.004044ec
mov edx, esi
mov eax, ebx
call fcn.00493c64
add eax, 0x1c
mov edx, 0x4e9568
call fcn.00404234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e953f
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 0x110]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x501914
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
xor eax, eax
push ebp
push 0x501abf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5597ec]
cmp byte [eax], 0
je 0x50194f
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x4a71f4]
call fcn.004a73c8
mov dword [ebp - 4], eax
jmp 0x50195e
mov dl, 1
mov eax, dword [0x4a71f4]
call fcn.004a7384
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x501a9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [ebp - 8]
mov edx, 0x501ad4
call fcn.00404278
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.004a7478
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0
push 1
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a74e0
test al, al
je 0x5019fd
mov edx, dword [0x5013d4]
mov eax, 0x14
call fcn.004050dc
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.00404234
lea eax, [ebx + 8]
mov edx, 0x501b20
call fcn.00404234
lea ecx, [ebp - 0xc]
mov edx, 0x501b20
mov eax, dword [ebp - 4]
call fcn.004a7cb8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404234
mov edx, ebx
mov eax, esi
call fcn.00419ec8
lea eax, [ebp - 8]
mov edx, 0x501ad4
call fcn.00404278
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.004a7478
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0
push 1
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a74e0
test al, al
je 0x501a87
mov edx, dword [0x5013d4]
mov eax, 0x14
call fcn.004050dc
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.00404234
lea eax, [ebx + 8]
mov edx, 0x501b38
call fcn.00404234
lea ecx, [ebp - 0x10]
mov edx, 0x501b38
mov eax, dword [ebp - 4]
call fcn.004a7cb8
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0xc]
call fcn.00404234
mov edx, ebx
mov eax, esi
call fcn.00419ec8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501aa4
mov eax, dword [ebp - 4]
call fcn.004033ac
ret
Function at 0x502090
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404690
lea eax, [ebp - 0x15c]
mov edx, dword [0x407950]
call fcn.00404b98
xor eax, eax
push ebp
push 0x5021d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004046a0
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea ecx, [ebp - 0x15c]
mov edx, 0x10
mov eax, 0x5021f0
call fcn.00409348
jmp 0x50218a
mov eax, dword [0x559800]
mov eax, dword [eax]
call fcn.00490fec
mov eax, dword [ebp - 0x150]
mov edx, 0x5021fc
call fcn.004045ec
je 0x50218a
mov eax, dword [ebp - 0x150]
mov edx, 0x502208
call fcn.004045ec
je 0x50218a
mov eax, dword [esi + 0x22c]
call fcn.00451df0
mov ebx, eax
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.00451890
push dword [ebp - 4]
push 0x502214
push dword [ebp - 0x150]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404560
mov edx, dword [ebp - 0x160]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x502220
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x502230
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x15c]
call fcn.00409398
test eax, eax
je 0x5020fa
mov edx, esi
mov eax, edi
call fcn.00506ad8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5021df
lea eax, [ebp - 0x160]
call fcn.004041e0
lea eax, [ebp - 0x15c]
mov edx, dword [0x407950]
call fcn.00404c68
lea eax, [ebp - 4]
call fcn.004041e0
ret

Function at 0x502398
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x502476
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409938
mov edx, dword [ebp - 4]
mov eax, 0x50248c
call fcn.004047e4
dec eax
jl 0x50241d
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404700
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x50249c
call fcn.004044ec
jmp 0x502446
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404700
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x5024b0
call fcn.004044ec
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50247d
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00404204
lea eax, [ebp - 4]
call fcn.004041e0
ret
Function at 0x5046ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5046b4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x504871
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402730
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004043d8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x504888
call fcn.004044ec
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43d634]
call fcn.0043d6e4
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x504847
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x50489c
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x504829
inc eax
mov dword [ebp - 0x14], eax
xor esi, esi
mov edx, dword [0x501410]
mov eax, 8
call fcn.004050dc
mov ebx, eax
mov eax, ebx
mov edx, 0x50489c
call fcn.00404234
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 4]
call fcn.00404234
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov edx, ebx
call fcn.00419ec8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov eax, dword [eax + 0x22c]
call fcn.00451df0
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.00451890
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x50489c
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 8]
mov edx, 0x5048ac
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00451a48
mov ecx, 2
mov edx, 2
mov eax, ebx
call fcn.00451a48
inc esi
dec dword [ebp - 0x14]
jne 0x504756
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50484e
mov eax, dword [ebp - 0xc]
call fcn.004033ac
mov eax, dword [ebp - 0x10]
call fcn.004033ac
ret
Function at 0x5048b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5048bc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x504a5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402730
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004043d8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x504a74
call fcn.004044ec
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43d634]
call fcn.0043d6e4
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x504a33
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x504a88
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x504a15
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov edx, dword [0x501410]
mov eax, 8
call fcn.004050dc
mov esi, eax
mov eax, esi
mov edx, 0x504a88
call fcn.00404234
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 4]
call fcn.00404234
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov edx, esi
call fcn.00419ec8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov eax, dword [eax + 0x22c]
call fcn.00451df0
mov esi, eax
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.00451890
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x504a88
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 8]
mov edx, 0x504a94
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x14]
jne 0x50495e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504a3a
mov eax, dword [ebp - 0xc]
call fcn.004033ac
mov eax, dword [ebp - 0x10]
call fcn.004033ac
ret