joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dff40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x808], ecx
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x808]
call fcn.0040d3c0
push eax
push 0x400
lea ecx, [ebp - 0x804]
push ecx
push 0x69884c
push 0x698850
push 0x69885c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x804]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4e0060
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x810], ecx
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x810]
call fcn.0040d3c0
push eax
push 0x400
lea ecx, [ebp - 0x804]
push ecx
push 0x6988c8
push 0x6988cc
push 0x6988d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x804]
push edx
lea ecx, [ebp - 0x808]
call fcn.004131e0
lea ecx, [ebp - 0x808]
call fcn.0040dd70
movzx eax, al
test eax, eax
jne 0x4e012f
push str.A9CB1D69_00FF_4efc_AA04_6D27B73FB68F
lea ecx, [ebp - 0x80c]
call fcn.004131e0
lea ecx, [ebp - 0x80c]
push ecx
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x814]
push eax
call fcn.005e08a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x808]
call fcn.0040d360
lea ecx, [ebp - 0x814]
call fcn.00413870
lea ecx, [ebp - 0x80c]
call fcn.00413870
lea ecx, [ebp - 0x808]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00421650
lea ecx, [ebp - 0x808]
call fcn.00413870
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4e01a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x808], ecx
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x808]
call fcn.0040d3c0
push eax
push 0x400
lea ecx, [ebp - 0x804]
push ecx
push 0x698940
push 0x698944
push 0x69894c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x804]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4e03a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040d3c0
push eax
push 1
push str.dyn_recomm
push 0x698a2c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret

Function at 0x4e0430
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040d3c0
push eax
push 1
push str.st_recomm
push 0x698a94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret
Function at 0x4e04c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040d3c0
push eax
push 1
push 0x698ab0
push 0x698acc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret

Function at 0x4e04f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040d3c0
push eax
push 1
push 0x698ae8
push 0x698b00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret

Function at 0x4e0770
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 1
push str.deskhelp
lea eax, [ebp - 0x10]
push eax
call fcn.004bd3f0
add esp, 4
mov ecx, eax
call fcn.00422730
test eax, eax
jne 0x4e07a5
mov dword [ebp - 8], 1
jmp 0x4e07ac
mov dword [ebp - 8], 0
mov cl, byte [ebp - 8]
mov byte [ebp - 1], cl
lea ecx, [ebp - 0x10]
call fcn.00413870
movzx edx, byte [ebp - 1]
test edx, edx
je 0x4e07c9
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.0040d3c0
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x698c88
push 0x698ca0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret

Function at 0x4e0c10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x210]
add ecx, 0xc
call fcn.0040d3c0
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x698ee4
lea ecx, [ebp + 0xc]
call fcn.0040d3c0
push eax
push str.Live_cache
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
lea ecx, [ebp + 0xc]
call fcn.00413870
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 8

Function at 0x4e0cf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20004
call fcn.00613c30
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20004], ecx
push 0x1fffc
push 0
lea eax, [ebp - 0x20000]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x20004]
add ecx, 8
call fcn.0040d3c0
push eax
push 0xfffe
lea ecx, [ebp - 0x20000]
push ecx
push 0x698f14
lea ecx, [ebp + 0xc]
call fcn.0040d3c0
push eax
push str.dyn_cache
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x20000]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
lea ecx, [ebp + 0xc]
call fcn.00413870
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 8
Function at 0x4e0df0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20004
call fcn.00613c30
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20004], ecx
push 0x1fffc
push 0
lea eax, [ebp - 0x20000]
push eax
call fcn.0063a460
add esp, 0xc
push 0x698f3c
lea ecx, [ebp + 0xc]
call fcn.004318c0
mov ecx, dword [ebp - 0x20004]
add ecx, 0xc
call fcn.0040d3c0
push eax
push 0xfffe
lea ecx, [ebp - 0x20000]
push ecx
push 0x698f4c
lea ecx, [ebp + 0x10]
call fcn.0040d3c0
push eax
lea ecx, [ebp + 0xc]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x20000]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
lea ecx, [ebp + 0xc]
call fcn.00413870
lea ecx, [ebp + 0x10]
call fcn.00413870
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4e0f20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x210]
add ecx, 0xc
call fcn.0040d3c0
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x698f60
lea ecx, [ebp + 0xc]
call fcn.0040d3c0
push eax
push 0x698f64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
lea ecx, [ebp + 0xc]
call fcn.00413870
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 8

Function at 0x4e10a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x210]
add ecx, 0xc
call fcn.0040d3c0
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x698f98
lea ecx, [ebp + 0x10]
call fcn.0040d3c0
push eax
lea ecx, [ebp + 0xc]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
lea ecx, [ebp + 0xc]
call fcn.00413870
lea ecx, [ebp + 0x10]
call fcn.00413870
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e1290
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x210]
add ecx, 4
call fcn.0040d3c0
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x698f9c
lea ecx, [ebp + 0x10]
call fcn.0040d3c0
push eax
lea ecx, [ebp + 0xc]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
lea ecx, [ebp + 0xc]
call fcn.00413870
lea ecx, [ebp + 0x10]
call fcn.00413870
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4e1380
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040d3c0
push eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004e2ab0
push eax
lea ecx, [ebp + 0x14]
call fcn.0040d3c0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040d3c0
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.004c9de0
lea ecx, [ebp + 0x14]
call fcn.00413870
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4e1420
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040d3c0
push eax
push 5
push str.time_config
push 0x698fb8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret

Function at 0x4e14d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x210]
add ecx, 4
call fcn.0040d3c0
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x699068
push str.perm_time
push str.basic_setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4e15a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x210]
add ecx, 4
call fcn.0040d3c0
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x698fd0
push str.games
push str.install_config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x4e1630
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040d3c0
push eax
push 0xffffffffffffffff
push str.loop_period_time
push str.test_config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret

Function at 0x4e18d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xd0], ecx
push 0xc8
push 0
lea eax, [ebp - 0xcc]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0xd0]
add ecx, 4
call fcn.0040d3c0
push eax
push 0x64
lea ecx, [ebp - 0xcc]
push ecx
push 0x6991b8
push 0x6991bc
push 0x6991d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0xcc]
push edx
call fcn.00643893
add esp, 4
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], edx
cmp dword [ebp - 0xd4], 0
jg 0x4e1980
jl 0x4e195b
cmp dword [ebp - 0xd8], 0
jae 0x4e1980
mov ecx, dword [ebp - 0xd0]
add ecx, 4
call fcn.0040d3c0
push eax
push 0
push str.vip_etime
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edx, edx
jmp 0x4e198c
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4e21f0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x828], ecx
mov ecx, dword [ebp - 0x828]
call fcn.0040dd70
movzx eax, al
test eax, eax
je 0x4e22ad
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0063a460
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov byte [ebp - 0x829], al
lea ecx, [ebp - 0x829]
call fcn.004e2900
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e2289
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x6987c8
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp - 0x828]
call fcn.00413a70
mov ecx, dword [ebp - 0x828]
add ecx, 4
call fcn.0040dd70
movzx eax, al
test eax, eax
je 0x4e232e
mov cx, word [0x6987e0]
mov word [ebp - 0x61c], cx
push 0x206
push 0
lea edx, [ebp - 0x61a]
push edx
call fcn.0063a460
add esp, 0xc
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x6987e4
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x61c]
push eax
mov ecx, dword [ebp - 0x828]
add ecx, 4
call fcn.00413a70
mov ecx, dword [ebp - 0x828]
add ecx, 8
call fcn.0040dd70
movzx ecx, al
test ecx, ecx
je 0x4e23d8
push 0x208
push 0
lea edx, [ebp - 0x414]
push edx
call fcn.0063a460
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor ecx, ecx
mov byte [ebp - 0x82a], cl
lea ecx, [ebp - 0x82a]
call fcn.004e2a60
push eax
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e23b1
lea ecx, [ebp - 0x414]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x6987fc
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x828]
add ecx, 8
call fcn.00413a70
mov ecx, dword [ebp - 0x828]
add ecx, 0xc
call fcn.0040dd70
movzx ecx, al
test ecx, ecx
je 0x4e2459
mov dx, word [0x698814]
mov word [ebp - 0x824], dx
push 0x206
push 0
lea eax, [ebp - 0x822]
push eax
call fcn.0063a460
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x824]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x824]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.ComputerZ.set
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x824]
push ecx
mov ecx, dword [ebp - 0x828]
add ecx, 0xc
call fcn.00413a70
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4ea070
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4ea08b
jmp 0x4ea0e7
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x4ea0aa
jmp 0x4ea0e7
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4ea0b4
jmp 0x4ea0e7
push 0
push 4
mov ecx, dword [ebp - 4]
push ecx
push 0x4ea160
push 0
push 0
call fcn.00644f69
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4ea0dc
jmp 0x4ea0e7
mov dword [ebp - 8], 1
xor ecx, ecx
jne 0x4ea080
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4f4780
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [0x6fa6d8]
test eax, eax
jne 0x4f47cf
mov byte [0x6fa6d8], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
movzx edx, cx
and edx, 0xff
movzx eax, dl
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0x80000000
jae 0x4f47cf
cmp dword [ebp - 8], 6
jb 0x4f47cf
mov byte [0x6fa6d9], 1
mov al, byte [0x6fa6d9]
mov esp, ebp
pop ebp
ret

Function at 0x4f5f50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
lea ecx, [ebp - 0x210]
call fcn.00413220
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx + 0x2c]
push edx
call fcn.004f4900
add esp, 4
mov dword [ebp - 0x218], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp - 0x218], 0
jne 0x4f5fd4
lea ecx, [ebp - 0x210]
call fcn.00413870
jmp 0x4f6050
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00413a70
lea ecx, [ebp - 0x210]
call fcn.004d9310
lea ecx, [ebp - 0x210]
call fcn.0040d3c0
push eax
call fcn.00641e0e
add esp, 4
test eax, eax
jne 0x4f6029
mov ecx, dword [ebp - 0x214]
add ecx, 0x24
call fcn.0040d3c0
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004239e0
push 1
push ecx
mov ecx, esp
lea edx, [ebp - 0x20c]
push edx
call fcn.004131e0
mov ecx, dword [ebp - 0x218]
call fcn.004f8010
lea ecx, [ebp - 0x210]
call fcn.00413870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4f6060
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
lea ecx, [ebp - 0x210]
call fcn.00413220
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 0x2c]
push ecx
call fcn.004f4900
add esp, 4
mov dword [ebp - 0x218], eax
push 0x208
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.0063a460
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp - 0x218], 0
jne 0x4f60e7
lea ecx, [ebp - 0x210]
call fcn.00413870
jmp 0x4f61b3
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00413a70
lea ecx, [ebp - 0x210]
call fcn.004d9310
lea ecx, [ebp - 0x210]
call fcn.0040d3c0
push eax
call fcn.00641e0e
add esp, 4
test eax, eax
jne 0x4f613c
mov ecx, dword [ebp - 0x214]
add ecx, 0x24
call fcn.0040d3c0
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004239e0
push 0
push 0x2e
lea ecx, [ebp - 0x210]
call fcn.004c9730
test eax, eax
jne 0x4f6176
push 0x10
push str.T_rT
push 0x699b50
mov ecx, dword [ebp - 0x214]
add ecx, 4
call fcn.00508c80
lea ecx, [ebp - 0x210]
call fcn.00413870
jmp 0x4f61b3
push 0
push 0
push 0
mov ecx, dword [ebp - 0x218]
call fcn.004f91d0
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 0x48]
push ecx
push 0x80a
mov ecx, dword [ebp - 0x218]
call fcn.004f9ae0
lea ecx, [ebp - 0x210]
call fcn.00413870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret

Function at 0x4fd630
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CDUIContainer.0
lea ecx, [ebp - 8]
push ecx
mov ecx, 0x6fa6b4
call fcn.00418b90
jmp 0x4fd660
push 0
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
call fcn.0042ed80
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x6fa6b4
call fcn.00418cd0
push eax
lea ecx, [ebp - 8]
call fcn.00413ae0
movzx ecx, al
test ecx, ecx
je 0x4fd699
lea ecx, [ebp - 8]
call fcn.00413b70
add eax, 4
mov ecx, eax
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4fd652
mov ecx, 0x6fa6b4
call fcn.00450600
mov ecx, dword [ebp - 4]
add ecx, 0x6dc
call fcn.00413930
mov ecx, dword [ebp - 4]
add ecx, 0x6bc
call fcn.00413930
mov ecx, dword [ebp - 4]
add ecx, 0x6ac
call fcn.00413870
mov ecx, dword [ebp - 4]
add ecx, 0x668
call fcn.004f51f0
mov ecx, dword [ebp - 4]
add ecx, 0x4c
call fcn.004f7300
mov ecx, dword [ebp - 4]
add ecx, 0x38
call fcn.004543d0
mov ecx, dword [ebp - 4]
call fcn.00413890
mov esp, ebp
pop ebp
ret
Function at 0x50ef10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x50ef3b
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
jne 0x50ef3b
mov edx, dword [ebp - 4]
cmp dword [edx + 0x20], 0
jne 0x50ef3b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x50ef3d
jmp 0x50ef5c
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x50ef80
push 0
push 0
call fcn.00644f69
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov esp, ebp
pop ebp
ret