joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49931c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040b248
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00493354
test ebx, ebx
jne 0x49936f
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00499198
mov ebx, eax
test ebx, ebx
je 0x499465
cmp esi, ebx
je 0x499398
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4993ad
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4993e5
add eax, 0xffffff5f
sub eax, 2
jb 0x4993fd
dec eax
sub eax, 2
jb 0x499411
dec eax
sub eax, 2
jb 0x499407
jmp 0x49941b
add eax, 0xfffffdff
sub eax, 2
jb 0x4993fd
dec eax
sub eax, 2
jb 0x499411
dec eax
sub eax, 2
jb 0x499407
jmp 0x49941b
mov byte [esp + 0x120], 0
jmp 0x499423
mov byte [esp + 0x120], 2
jmp 0x499423
mov byte [esp + 0x120], 1
jmp 0x499423
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004b734c
mov esi, eax
call fcn.0048fb90
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00494d14
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x499467
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4b6e54
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x4b6e75
test edi, 0x40000
je 0x4b6e8f
test bl, bl
jne 0x4b6f10
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x4b6f10
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x4b6ec2
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x4b6ed7
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x4b6ee6
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x4b6ef7
cmp byte [esp + 2], 0
je 0x4b6f10
cmp byte [esp + 2], 0
je 0x4b6f08
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x4b6f10
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4b71bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x4b71e2
mov eax, esp
push eax
push 0x4b7184
call sub.user32.dll_EnumWindows
jmp 0x4b71f5
mov eax, esp
push eax
push 0x4b7164
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x4b72b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x4b7308]
test bl, 4
je 0x4b72cc
or si, 1
test bl, 8
je 0x4b72d5
or si, 4
test bl, 1
je 0x4b72de
or si, 8
test bl, 2
je 0x4b72e7
or si, 0x10
test bl, 0x10
je 0x4b72f0
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b7300
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4b730c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x4b7348]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b7327
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b7337
or bx, 4
test esi, 0x20000000
je 0x4b7343
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4bff0c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4bff1e
add esp, 0xfffffff0
call fcn.00405ab0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004435e0
mov eax, dword [0x584c5c]
mov dword [eax + 4], ebx
mov dword [eax], 0x4c0368
mov eax, dword [0x584c6c]
mov dword [eax + 4], ebx
mov dword [eax], 0x4c0374
mov eax, ebx
call fcn.004c0380
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x42be1c]
call fcn.0040554c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x42be1c]
call fcn.0040554c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x42be1c]
call fcn.0040554c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x42be1c]
call fcn.0040554c
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x42be1c]
call fcn.0040554c
mov dword [ebx + 0x78], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x44], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x4bacb4
push eax
push 0
push 0
mov eax, dword [0x584fcc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x452690]
call fcn.00458964
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x452690]
call fcn.00458964
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x452690]
call fcn.00458964
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x452690]
call fcn.00458964
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x452690]
call fcn.00458964
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.004c08d8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c0748
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c0748
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c0748
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c0748
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c0748
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4c0099
call fcn.00405b08
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c04e8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c0695
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4c0676
mov dl, 1
mov eax, dword [0x42e51c]
call fcn.0043aacc
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.00407534
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4c0665
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004a2c10
test al, al
je 0x4c0658
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4c06a4
lea eax, [ebp - 0x394]
call fcn.00415788
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4c0658
xor eax, eax
push ebp
push 0x4c0651
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4c0714
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4c063a
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040772c
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4c063a
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040772c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0658
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4c055b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.0043aa08
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c069c
lea eax, [ebp - 0x3a0]
call fcn.00407524
ret

Function at 0x4c11f4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x58b2bc]
cmp byte [eax + 0xad], 0
jne 0x4c1266
cmp dword [0x58b2d4], 0
jne 0x4c1226
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x581154]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x58b2d4], eax
cmp dword [0x58b2d0], 0
jne 0x4c1241
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x58b2d0], eax
cmp dword [0x58b2d8], 0
jne 0x4c1266
push esp
push 0
push 0
mov eax, dword [0x581150]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x58b2d8], eax
pop edx
ret
Function at 0x4c158c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4c15a3
add esp, 0xfffffff0
call fcn.00405ab0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004435e0
mov eax, dword [0x584a28]
cmp byte [eax], 0
jne 0x4c15d0
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x584f7c]
cmp word [eax + 2], 0
jne 0x4c15ea
mov eax, dword [0x584f7c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004c3684
mov eax, dword [0x585168]
cmp word [eax + 2], 0
jne 0x4c1604
mov eax, dword [0x585168]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004c3894
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x452690]
call fcn.00458964
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4c3e44
mov dl, 1
mov eax, dword [0x42be1c]
call fcn.0040554c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x42be1c]
call fcn.0040554c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x456b28]
call fcn.00461dd4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4c17e4
mov eax, dword [0x584d64]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00462268
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4c412c
mov dl, 1
mov eax, dword [0x42be1c]
call fcn.0040554c
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x584d64]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004151b8
test eax, eax
je 0x4c1715
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00414f48
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0041519c
test eax, eax
je 0x4c172d
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040772c
push ebx
push 0x4c3054
call fcn.004b729c
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x584a28]
cmp byte [eax], 0
jne 0x4c177e
mov eax, ebx
call fcn.004c1958
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004c4358
mov eax, ebx
call fcn.004c4f8c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4c17db
call fcn.00405b08
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1c2c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4c1cce
cmp dword [ebx + 0x94], 0
jne 0x4c1cc8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4c1b78
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4c1cc8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4c1c8e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4c1cc8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00437218
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4c1c9d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4c1eec
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x58b2bc]
cmp dword [eax + 0x170], 0
je 0x4c2051
test bl, bl
jne 0x4c1f9f
cmp dword [esi + 0x9c], 0
jne 0x4c1f94
mov eax, esi
call fcn.004c4ddc
push eax
push 0x4c1df8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4c1f65
mov eax, dword [0x58b2bc]
cmp byte [eax + 0xd3], 0
je 0x4c1f65
mov eax, dword [esi + 0xd8]
call fcn.00408c1c
mov edi, eax
cmp edi, 0
jl 0x4c1f65
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4c1f4e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4c1f94
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00437218
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4c1f74
inc dword [esi + 0x9c]
jmp 0x4c2051
cmp dword [esi + 0x9c], 0
jle 0x4c2051
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4c2051
cmp dword [esi + 0x44], 0
je 0x4c1ffc
mov eax, dword [0x58b2bc]
cmp byte [eax + 0xd3], 0
je 0x4c1ffc
mov eax, dword [esi + 0xd8]
call fcn.00408c1c
mov edi, eax
cmp edi, 0
jl 0x4c1ffc
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4c1fe5
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4c202b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00437218
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4c200b
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4b5174]
call fcn.00408ddc
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4c2ca0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4c2d0b
cmp byte [ebx + 0xd3], 0
jne 0x4c2d0b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00407670
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4c2cf8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4c2d18
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407534
jmp 0x4c2d18
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407534
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4c4540
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4c45ae
mov eax, esi
call fcn.0049cb1c
test al, al
je 0x4c45ae
mov eax, dword [ebx + 0x84]
call fcn.0049c770
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4c45ae
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4c45a2
push 0
mov eax, dword [ebx + 0x84]
call fcn.0049c770
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00493744
jmp 0x4c45ae
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004c4378
pop esi
pop ebx
ret
Function at 0x4c5de0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x4c5de8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040751c
mov eax, dword [ebp - 8]
call fcn.0040751c
xor eax, eax
push ebp
push 0x4c5fe3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4c5fa9
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.004045ec
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00414c78
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov ecx, 0x4c6000
call fcn.00407a00
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.004045ec
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00414c78
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
mov ecx, 0x4c6018
call fcn.00407a00
mov eax, dword [ebp - 0xc]
call fcn.004148b0
test al, al
jne 0x4c5e8a
push 0
mov eax, dword [ebp - 0xc]
call fcn.004075c0
push eax
call sub.kernel32.dll_CreateDirectoryW
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00407a00
mov eax, dword [ebp - 0x34]
call fcn.00414868
test al, al
jne 0x4c5f86
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00407a00
mov eax, dword [ebp - 0x38]
call fcn.004c6048
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00407a00
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
call fcn.004c60e4
mov dl, 1
mov eax, dword [0x42e51c]
call fcn.0043aacc
mov esi, eax
call fcn.00417984
fsub dword [0x4c6024]
fstp qword [ebp - 0x20]
wait
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 0x4c6034
call fcn.00418644
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00407588
lea ecx, [ebp - 0x40]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004c5930
mov edx, dword [ebp - 0x40]
mov eax, esi
call fcn.00439d34
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4c5f7d
lea ecx, [ebp - 0x44]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x44]
call fcn.00414868
test al, al
je 0x4c5f77
lea ecx, [ebp - 0x48]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edi, dword [ebp - 0x48]
mov dword [ebp - 0x4c], edi
mov eax, dword [ebp - 0x4c]
call fcn.004075c0
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
dec ebx
cmp ebx, 0xffffffff
jne 0x4c5f39
mov eax, esi
call fcn.0040557c
jmp 0x4c5f9f
lea eax, [ebp - 0x50]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00407a00
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 8]
call fcn.004c60e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c5fb3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5fea
lea eax, [ebp - 0x50]
call fcn.00407524
lea eax, [ebp - 0x48]
mov edx, 0xa
call fcn.0040752c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040752c
ret
Function at 0x504a3c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x504a4f
add esp, 0xfffffff0
call fcn.00405ab0
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x504ac8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.0040554c
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x14], 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.00504de8
mov edx, dword [ebp - 4]
lea eax, [esi + 8]
call fcn.00407534
mov ecx, dword [esi + 8]
lea eax, [esi + 0xc]
mov edx, 0x504af8
call fcn.00407a00
mov ecx, esi
mov dl, 1
mov eax, dword [0x504400]
call fcn.005053b4
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504acf
lea eax, [ebp - 4]
call fcn.00407524
ret

Function at 0x504b68
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040751c
xor eax, eax
push ebp
push 0x504c3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x30]
call fcn.005053a8
mov ebx, eax
lea eax, [ebx + 0x18]
mov edx, edi
call fcn.00407534
lea eax, [ebx + 0x10]
mov edx, dword [ebp + 8]
call fcn.00407534
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 4]
call fcn.00406a58
call fcn.0040789c
test eax, eax
jle 0x504bd6
lea eax, [ebx + 0x14]
mov edx, dword [ebp - 4]
call fcn.00407534
jmp 0x504c07
mov eax, dword [ebx + 0x10]
call fcn.0040789c
test eax, eax
jle 0x504bfa
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x10]
call fcn.004e4ef4
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x14]
call fcn.00407534
jmp 0x504c07
lea eax, [ebx + 0x14]
mov edx, 0x504c5c
call fcn.00407534
mov eax, ebx
call fcn.005056ac
cdq
add eax, dword [esi + 0x28]
adc edx, dword [esi + 0x2c]
jno 0x504c1c
call fcn.00405444
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504c44
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040752c
ret