joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ae90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46b0f0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x46aef3
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0046a9a8
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040cc08
cmp al, 1
jne 0x46aef3
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0046ac70
test al, al
je 0x46b07f
cmp dword [ebp - 8], 0
jge 0x46af11
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0046a9a8
mov eax, dword [ebp - 0x210]
call fcn.00404388
cmp ebx, eax
jge 0x46af5b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0046a9a8
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x514ecc]
and eax, 0xff
bt dword [edx], eax
jae 0x46af5b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x46af6f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046ae6c
cmp ebx, dword [ebp - 8]
je 0x46b071
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x46af9b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004034d0
and eax, 0x7f
movzx eax, word [eax*2 + 0x513ddc]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x46b05e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004034d0
and eax, 0x7f
movzx eax, word [eax*2 + 0x513ddc]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00444370
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004034d0
and eax, 0x7f
movzx eax, word [eax*2 + 0x513ddc]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00444370
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b065
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x46b0d2
cmp dword [ebp - 8], 0
jge 0x46b08a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0046a9a8
mov eax, dword [ebp - 0x218]
call fcn.00404388
cmp eax, dword [ebp - 8]
jg 0x46b0c4
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0046a9a8
mov eax, dword [ebp - 0x21c]
call fcn.00404388
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0046ae6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b0f7
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004040ec
ret
Function at 0x46cfe0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x46d018]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x46cff6
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x46d005
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x46d014
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x46d954
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x439968]
call fcn.00403460
test al, al
je 0x46d996
mov eax, dword [0x514d08]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x46d996
mov edx, dword [0x514d08]
xor edx, edx
call fcn.00456b4c
push 0
mov eax, dword [0x514d08]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x476218
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor ebx, ebx
call fcn.004cdf00
test al, al
je 0x47631f
mov eax, dword [esi + 4]
mov edx, dword [0x470a04]
call fcn.00403460
test al, al
je 0x47631f
mov ebx, dword [esi + 4]
cmp byte [ebx + 0x2f9], 0
je 0x476288
cmp byte [esi + 0x540], 0
jne 0x476288
push 0xffffffffffffffec
mov eax, esi
call fcn.00444370
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00444370
push eax
call sub.user32.dll_SetWindowLongA
jmp 0x4762be
cmp byte [ebx + 0x2f9], 0
jne 0x4762be
cmp byte [esi + 0x540], 0
je 0x4762be
push 0xffffffffffffffec
mov eax, esi
call fcn.00444370
push eax
call sub.user32.dll_GetWindowLongA
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00444370
push eax
call sub.user32.dll_SetWindowLongA
mov al, byte [ebx + 0x2f9]
mov byte [esi + 0x540], al
mov al, byte [esi + 0x541]
cmp al, byte [ebx + 0x2fb]
je 0x47631f
cmp byte [ebx + 0x2f9], 0
je 0x47631f
cmp byte [ebx + 0x2fa], 0
je 0x476301
mov eax, esi
call fcn.00444370
xor edx, edx
call fcn.004cdf3c
mov byte [esi + 0x541], 0
jmp 0x47631f
mov eax, esi
call fcn.00444370
mov dl, byte [ebx + 0x2fb]
call fcn.004cdf3c
mov al, byte [ebx + 0x2fb]
mov byte [esi + 0x541], al
push 0x51
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov eax, esi
call fcn.00444370
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, esi
call fcn.0043daa8
call fcn.004cdf00
test al, al
je 0x4763df
test ebx, ebx
je 0x4763df
cmp byte [ebx + 0x2fa], 0
je 0x4763df
cmp byte [ebx + 0x2f9], 0
je 0x4763df
mov eax, dword [0x514d08]
mov eax, dword [eax]
call fcn.0045d3bc
xor edi, edi
xor ebp, ebp
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebp
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x47639f
cmp eax, 5
jbe 0x4763c7
jmp 0x4763a1
jle 0x4763c7
call sub.kernel32.dll_GetTickCount_1
mov ebp, eax
add edi, 0xa
xor eax, eax
mov al, byte [ebx + 0x2fb]
cmp edi, eax
jle 0x4763b9
mov edi, eax
mov eax, esi
call fcn.00444370
mov edx, edi
call fcn.004cdf3c
mov eax, dword [0x514d08]
mov eax, dword [eax]
call fcn.0045d3bc
xor eax, eax
mov al, byte [ebx + 0x2fb]
cmp edi, eax
jl 0x47637e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47b55c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b781
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x3d4], 0
jne 0x47b5ea
mov eax, dword [ebx + 0x3d8]
mov edx, dword [eax + 0x3e8]
mov dword [ebx + 0x3e8], edx
mov edx, dword [eax + 0x3ec]
mov dword [ebx + 0x3ec], edx
mov eax, dword [ebx + 0x3d8]
fld qword [eax + 0x3e8]
fcomp dword [0x47b790]
fnstsw ax
sahf
jne 0x47b5ea
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0046a9bc
mov edx, dword [ebp - 0xc]
mov eax, 0x47b79c
call fcn.004046cc
test eax, eax
je 0x47b5ea
call fcn.0040a3ec
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebx + 0x3d8]
call fcn.00469b54
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x40]
call fcn.0041680c
lea edx, [ebp - 0x14]
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x30]
call fcn.0043d6a0
mov edi, dword [ebp - 4]
mov esi, edi
add esi, dword [ebx + 0x4c]
mov eax, dword [0x514eb0]
mov eax, dword [eax]
call fcn.0045b0b4
mov edx, dword [ebx + 0x3d8]
mov edx, dword [edx + 0x4c]
add edx, esi
cmp eax, edx
jge 0x47b634
mov eax, dword [ebx + 0x3d8]
mov esi, edi
sub esi, dword [eax + 0x4c]
call fcn.004cdf00
test al, al
je 0x47b680
cmp byte [ebx + 0x3d1], 0
je 0x47b680
push 0xffffffffffffffec
mov eax, ebx
call fcn.00444370
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x3d8]
call fcn.00444370
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [ebx + 0x3d8]
call fcn.00444370
xor edx, edx
call fcn.004cdf3c
mov edx, dword [ebx + 0x2d8]
mov eax, dword [ebx + 0x3d8]
mov ecx, dword [eax]
call dword [ecx + 0xd4]
push 0x51
push 0
push 0
push esi
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebx + 0x3d8]
call fcn.00444370
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [ebx + 0x3d8]
call fcn.0043daa8
cmp byte [ebx + 0x3d1], 0
je 0x47b6fe
cmp byte [ebx + 0x3d3], 0
jne 0x47b6fe
call fcn.004cdf00
test al, al
je 0x47b6fe
mov eax, dword [0x514d08]
mov eax, dword [eax]
call fcn.0045d3bc
mov eax, dword [ebx + 0x3d8]
call fcn.00444370
mov dl, byte [ebx + 0x3d2]
call fcn.004cdf3c
jmp 0x47b76b
cmp byte [ebx + 0x3d3], 0
je 0x47b76b
cmp byte [ebx + 0x3d1], 0
je 0x47b76b
call fcn.004cdf00
test al, al
je 0x47b76b
mov eax, dword [0x514d08]
mov eax, dword [eax]
call fcn.0045d3bc
xor esi, esi
xor edi, edi
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 5
jbe 0x47b75f
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
add esi, 0xa
xor eax, eax
mov al, byte [ebx + 0x3d2]
cmp esi, eax
jle 0x47b74d
mov esi, eax
mov eax, dword [ebx + 0x3d8]
call fcn.00444370
mov edx, esi
call fcn.004cdf3c
xor eax, eax
mov al, byte [ebx + 0x3d2]
cmp esi, eax
jl 0x47b729
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b788
lea eax, [ebp - 0xc]
call fcn.004040c8
ret
Function at 0x482c1c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x482d6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x482d44
cmp dword [eax + 0x3f8], 0
je 0x482d44
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2f0]
cmp eax, 0xc8
jbe 0x482d44
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2f0], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0043db88
mov eax, dword [ebp - 0xc]
call fcn.00404388
dec eax
jne 0x482cc4
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0043db88
mov eax, dword [ebp - 0x10]
call fcn.00404588
push eax
mov eax, ebx
call fcn.0048386c
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00444370
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x482cf7
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0043db88
mov eax, dword [ebp - 0x14]
call fcn.00404588
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00444370
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x482d44
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0043db88
mov edx, esi
mov eax, ebx
call fcn.00483878
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0043db88
mov eax, dword [ebp - 4]
call fcn.00404388
mov edx, eax
mov eax, ebx
call fcn.00482efc
mov eax, dword [ebp - 8]
call fcn.00404388
push eax
mov eax, dword [ebp - 4]
call fcn.00404388
pop edx
sub edx, eax
mov eax, ebx
call fcn.00482f18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482d73
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004040ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004040ec
ret
Function at 0x482d7c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404578
xor eax, eax
push ebp
push 0x482e99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x482e83
cmp dword [eax + 0x3f8], 0
je 0x482e83
cmp byte [ebx + 0x2f8], 0
je 0x482e04
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2f0]
cmp eax, 0x1f4
jb 0x482ddd
lea eax, [ebx + 0x2f4]
call fcn.004040c8
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2f0], eax
lea eax, [ebx + 0x2f4]
mov edx, dword [ebp - 4]
call fcn.00404390
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x2f4]
call fcn.00404160
mov eax, dword [ebp - 4]
call fcn.00404388
test eax, eax
jle 0x482e73
mov eax, dword [ebp - 4]
call fcn.00404388
dec eax
jne 0x482e4a
mov eax, dword [ebp - 4]
call fcn.00404588
push eax
mov eax, ebx
call fcn.0048386c
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00444370
push eax
call sub.user32.dll_SendMessageA
jmp 0x482e76
mov eax, dword [ebp - 4]
call fcn.00404588
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00444370
push eax
call sub.user32.dll_SendMessageA
jmp 0x482e76
or eax, 0xffffffff
test eax, eax
jl 0x482e83
mov edx, eax
mov eax, ebx
call fcn.00483878
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482ea0
lea eax, [ebp - 4]
call fcn.004040c8
ret
Function at 0x4aa11c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov eax, dword [edi]
call fcn.004aadf4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push ebp
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.004aa03c
pop ecx
call fcn.004cdf00
test al, al
je 0x4aa1c4
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x60], 0
je 0x4aa1c4
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.00444370
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.00444370
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x61], 0
je 0x4aa1ad
mov eax, dword [edi]
call fcn.00444370
xor edx, edx
call fcn.004cdf3c
jmp 0x4aa1c4
mov eax, dword [edi]
call fcn.00444370
mov edx, dword [edi]
mov edx, dword [edx + 0x220]
mov dl, byte [edx + 0x62]
call fcn.004cdf3c
push 0x51
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [edi]
call fcn.00444370
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [edi]
call fcn.0043daa8
mov eax, dword [edi]
mov ebx, dword [eax + 0x220]
cmp byte [ebx + 0x61], 0
je 0x4aa25d
cmp byte [ebx + 0x60], 0
je 0x4aa25d
call fcn.004cdf00
test al, al
je 0x4aa25d
mov eax, dword [0x514d08]
mov eax, dword [eax]
call fcn.0045d3bc
xor ebx, ebx
xor esi, esi
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 5
jbe 0x4aa24d
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
add ebx, 0xa
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jle 0x4aa23f
mov ebx, eax
mov eax, dword [edi]
call fcn.00444370
mov edx, ebx
call fcn.004cdf3c
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jl 0x4aa217
mov eax, dword [edi]
call fcn.004ab328
mov eax, dword [edi]
call fcn.00444370
push eax
call sub.user32.dll_SetCapture
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4daa7c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x4daa91
add esp, 0xfffffff0
call fcn.004035f8
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404578
xor eax, eax
push ebp
push 0x4dab6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004d5c58
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041680c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041680c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041680c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041680c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00416834
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x52], 0
mov byte [esi + 0x53], 0
mov byte [esi + 0x54], 0
mov byte [esi + 0x55], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x51], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dab73
lea eax, [ebp - 4]
call fcn.004040c8
ret
Function at 0x4e09c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e0b3f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4e0b58
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.0040411c
push 0xffffffffffffffff
mov ecx, 0x4e0b68
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x4e0b84
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x34], eax
mov ecx, 0x4e0ba4
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004ce494
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4e0bc0
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004ce380
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4e0bd4
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004ce380
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4e0bec
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004ce380
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x4e0c08
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004ce494
mov byte [ebx + 0x48], al
mov ecx, 0x4e0c1c
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004d57a4
mov byte [ebx + 0x49], al
push 0xffffffffffffffff
mov ecx, 0x4e0c30
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x4c], eax
push 0xffffffffffffffff
mov ecx, 0x4e0c50
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x50], eax
push 0
mov ecx, 0x4e0c74
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x54], eax
push 0
mov ecx, 0x4e0c90
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x58], eax
push 0xff
mov ecx, 0x4e0cac
mov edx, dword [ebx + 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 8]
mov dword [ebx + 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0b46
lea eax, [ebp - 4]
call fcn.004040c8
ret

Function at 0x4e9b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404588
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4e9b69
test al, 0x10
jne 0x4e9b6d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4e9dc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e9f31
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e9f0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004042b0
lea eax, [ebp - 0x118]
mov edx, 0x4e9f48
call fcn.00404390
mov eax, dword [ebp - 0x118]
call fcn.00404588
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4e9e7e
lea eax, [ebp - 0x111]
call fcn.0040903c
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004041b8
jmp 0x4e9e85
mov eax, esi
call fcn.004040c8
cmp bl, 0x61
jae 0x4e9ea6
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040cfe4
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.0040411c
jmp 0x4e9ec0
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040cf58
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.0040411c
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4e9f54
call fcn.00409704
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.0040411c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9f13
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4ed9c4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4eda15
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4ed9fc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4ed9ec
jmp 0x4eda15
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4ed9fd
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fc3a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4fc411
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x513fec]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4fc3fb
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004fc398
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4fc1a0]
call fcn.004fc438
mov dword [0x514050], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc418
lea eax, [ebp - 8]
call fcn.00405b8c
ret