joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7dc4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x4a7de0
cmp dword [esi + 4], 0
je 0x4a7e0d
test byte [ebx + 0x45], 1
jne 0x4a7dff
mov eax, ebx
call fcn.004a6cfc
test eax, eax
jne 0x4a7dff
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4a7f1d
mov edx, esi
mov eax, ebx
call fcn.004a7a3c
jmp 0x4a7f1d
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a7f16
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004a9d94
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004a4c60
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004a7dc4
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004a9d94
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7f1d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b32c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b33a0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x530b14], 0
jne 0x4b3384
lea eax, [ebp - 4]
mov edx, 0x4b33b8
call fcn.004de1bc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004de568
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4b3384
mov eax, ebx
call fcn.004dcd90
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b337d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x4b3367
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b33c8
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4b3367
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x530b14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3384
mov eax, dword [ebp - 0xc]
call fcn.004dcda8
ret
mov ebx, dword [0x530b14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b33a7
lea eax, [ebp - 4]
call fcn.004de124
ret

Function at 0x4c45e4
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x530b38], 0
jne 0x4c4607
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x4c4568
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x530b38], eax
ret

Function at 0x4c4f34
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x4c4f88
mov eax, dword [0x50c624]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x4c4f60
push ebx
push 0x4c4f90
call fcn.0048fae4
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.USER32.DLL_OpenClipboard
test eax, eax
jne 0x4c4f84
mov ecx, dword [0x50c784]
mov dl, 1
mov eax, dword [0x4d4fa0]
call fcn.004d8dc0
call fcn.004dddec
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret

Function at 0x4c4fb0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004c4f34
xor edx, edx
push ebp
push 0x4c5082
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4c5054
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
xor edx, edx
push ebp
push 0x4c5043
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004dcf60
mov eax, dword [ebp - 4]
call fcn.004c4eec
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c504a
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
Function at 0x4c5094
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c4f34
push 1
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c5106
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4c50da
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.004de2dc
jmp 0x4c50e1
mov eax, ebx
call fcn.004de124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c510d
cmp dword [ebp - 8], 0
je 0x4c50fd
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.004c4f08
ret

Function at 0x4c513c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c4f34
xor edx, edx
push ebp
push 0x4c51de
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x4c51b1
mov edx, ebx
mov eax, dword [0x4846bc]
call fcn.0048889c
test al, al
je 0x4c51a1
movzx eax, bx
push eax
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.004887ac
call fcn.004dde8c
jmp 0x4c51e5
movzx eax, bx
push eax
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x4c516c
mov ecx, dword [0x50c788]
mov dl, 1
mov eax, dword [0x4d4fa0]
call fcn.004d8dc0
call fcn.004dddec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c51e5
mov eax, dword [ebp - 4]
call fcn.004c4f08
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4c51ec
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c4f34
xor eax, eax
push ebp
push 0x4c5244
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c524b
mov eax, dword [ebp - 4]
call fcn.004c4f08
ret

Function at 0x4c5254
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c4f34
xor edx, edx
push ebp
push 0x4c52a9
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c52b0
mov eax, dword [ebp - 4]
call fcn.004c4f08
ret
Function at 0x4c5320
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c4f34
xor eax, eax
push ebp
push 0x4c5395
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c4eec
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00488870
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4c537f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c539c
mov eax, dword [ebp - 4]
call fcn.004c4f08
ret

Function at 0x4c53a4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c4f34
xor eax, eax
push ebp
push 0x4c5419
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c4eec
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4c5403
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5420
mov eax, dword [ebp - 4]
call fcn.004c4f08
ret
Function at 0x4d666c
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d68b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004de178
cmp dword [0x507968], 1
jne 0x4d66b7
cmp dword [0x50796c], 4
jle 0x4d66f6
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.004de568
push eax
call sub.MPR.DLL_WNetGetUniversalNameA
test eax, eax
jne 0x4d689b
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x420]
mov edx, dword [edx]
call fcn.004de2dc
jmp 0x4d689b
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.004dd0ec
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0x41
jb 0x4d689b
cmp byte [ebp - 0x15], 0x5a
ja 0x4d689b
mov eax, dword [ebp - 4]
call fcn.004de3a4
cmp eax, 3
jl 0x4d689b
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x3a
jne 0x4d689b
mov eax, dword [ebp - 4]
cmp byte [eax + 2], 0x5c
jne 0x4d689b
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 1
push 1
call sub.MPR.DLL_WNetOpenEnumA
test eax, eax
jne 0x4d689b
xor edx, edx
push ebp
push 0x4d6894
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0xc], 0x640
mov eax, dword [ebp - 0xc]
call fcn.004dcd90
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x4d6876
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.MPR.DLL_WNetEnumResourceA
cmp eax, 0xea
jne 0x4d67c5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.004dcdc0
jmp 0x4d6789
test eax, eax
je 0x4d67d8
call fcn.004dde8c
call fcn.004dde8c
jmp 0x4d689b
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x4d6789
inc esi
xor edi, edi
mov eax, edi
shl eax, 2
mov edx, dword [ebp - 0x20]
lea ebx, [edx + eax*8]
cmp dword [ebx + 0x10], 0
je 0x4d6854
mov eax, dword [ebx + 0x10]
mov al, byte [eax]
call fcn.004dd0ec
cmp al, byte [ebp - 0x15]
jne 0x4d6854
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 4]
call fcn.004de3a4
mov ecx, eax
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.004de5ac
mov eax, dword [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
mov edx, dword [ebx + 0x14]
call fcn.004de2dc
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 8]
pop ecx
call fcn.004de3f0
call fcn.004dde8c
call fcn.004dde8c
jmp 0x4d689b
inc edi
dec esi
jne 0x4d67e3
jmp 0x4d6789
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d68c0
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.004de148
ret

Function at 0x4d6ac0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004de20c
add esp, 0x104
pop ebx
ret
Function at 0x4d8570
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4d85a9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004de20c
jmp 0x4d85b2
mov eax, ebx
mov edx, esi
call fcn.004de178
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d85bc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4d85dd
mov al, byte [esp]
jmp 0x4d85df
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4dd018
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4dd047
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004de20c
jmp 0x4dd065
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004dcfa0
mov edi, eax
test ebx, ebx
je 0x4dd065
cmp dword [esi], 0
je 0x4dd065
dec ebx
jmp 0x4dd04e
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4dd2e8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x530de0], 0x8088405
inc edx
mov dword [0x530de0], edx
mul edx
mov eax, edx
ret

Function at 0x4dd4e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x507bd0]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4dd57c
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4dd55c
xor eax, eax
push ebp
push 0x4dd555
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4dd598
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd55c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x507bd0]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x507bd0], ax
mov esp, ebp
pop ebp
ret
Function at 0x4dfab8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4dfc74
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4dfb19
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4dfc90
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4dfb8b
xor eax, eax
push ebp
push 0x4dfb84
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004df910
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4dfb6d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4dfcb0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfb8b
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4dfc6c
cmp byte [ebp - 0xd], 0
jne 0x4dfbcd
cmp byte [ebp - 0x12], 0
je 0x4dfc6c
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4dfbe6
dec ebx
cmp byte [ebx], 0x2e
je 0x4dfbf5
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4dfbe5
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4dfc6c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4dfc22
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4dfc6c
cmp byte [ebp - 0xd], 0
je 0x4dfc6c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4dfc6c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e0060
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x4e0148
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x5311c8], 1
jae 0x4e013a
xor eax, eax
mov dword [0x530dd4], eax
xor eax, eax
mov dword [0x530ddc], eax
xor eax, eax
mov dword [0x530de0], eax
mov byte [0x530de6], 2
mov byte [0x530de7], 2
mov byte [0x530de8], 3
mov word [0x531190], 0
mov word [0x5311a0], 1
mov word [0x5311b0], 0xa
mov dword [0x5311b8], 0x80020004
mov dword [0x531184], 0x4dee48
mov dword [0x531188], 0x4dee40
mov dword [0x53118c], 0x4dee48
call fcn.004dd4b4
test al, al
je 0x4e00f9
call fcn.004dd4e4
call fcn.004dd5a8
mov eax, 0x530dec
mov edx, 0x4e0154
call fcn.004daa8e
mov eax, 0x530fb8
mov edx, 0x4e0154
call fcn.004daa8e
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x530dcc], eax
call fcn.004dba4c
mov dword [0x530dc8], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x530dc0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e014f
ret

Function at 0x4e2194
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4e21b0
call fcn.004e3bf4
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4e21cc
test bl, 1
je 0x4e21cc
call fcn.004ea9c0
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4e23b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004e3790
test byte [ebp + 0xd], 0xc0
jne 0x4e23d4
mov eax, dword [0x508ae4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4e23e1
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4e240e
je 0x4e2420
sub ecx, 0x100
je 0x4e242e
sub ecx, 0x100
je 0x4e2435
sub ecx, 0x100
je 0x4e2427
jmp 0x4e243c
sub ecx, 0x600
je 0x4e2435
sub ecx, 0x100
je 0x4e2420
jmp 0x4e243c
mov edi, 1
jmp 0x4e2441
mov edi, 2
jmp 0x4e2441
mov edi, 4
jmp 0x4e2441
mov edi, 5
jmp 0x4e2441
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4e2468
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x508540]
test al, 0x80
je 0x4e2461
mov ebx, 0x80
jmp 0x4e247a
mov ebx, 1
jmp 0x4e247a
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4e247a
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4e248c
je 0x4e2495
dec eax
je 0x4e249e
jmp 0x4e24a7
mov dword [ebp - 4], 0x80000000
jmp 0x4e24b6
mov dword [ebp - 4], 0x40000000
jmp 0x4e24b6
mov dword [ebp - 4], 0xc0000000
jmp 0x4e24b6
push 1
call fcn.004e3b88
pop ecx
mov ebx, eax
jmp 0x4e25a6
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4e24d2
sub eax, 0x10
je 0x4e24d9
sub eax, 0x10
je 0x4e24e2
sub eax, 0x10
je 0x4e24eb
jmp 0x4e24eb
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4e24f2
mov dword [ebp - 8], 1
jmp 0x4e24f2
mov dword [ebp - 8], 2
jmp 0x4e24f2
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4e255f
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4e2554
test byte [ebp + 0xd], 1
je 0x4e254f
mov ebx, 0x50
jmp 0x4e2554
mov ebx, 2
push ebx
call fcn.004e3b88
pop ecx
mov ebx, eax
jmp 0x4e25a6
mov edi, esi
push edi
call fcn.004e2314
pop ecx
test eax, eax
je 0x4e2573
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4e257f
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004e38b0
add esp, 8
mov ebx, eax
inc eax
jne 0x4e25a6
push 4
call fcn.004e3b88
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004e37c4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e28b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x4e28db
lea eax, [ebp + 0x10]
add eax, 4
mov ebx, dword [eax - 4]
push ebx
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jne 0x4e28ef
call fcn.004e3bf4
jmp 0x4e28f1
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4e28ef
call fcn.004e3bf4
jmp 0x4e28f1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x4e2adc
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4e2af8
call fcn.004e3bf4
jmp 0x4e2b19
test byte [ebp + 0xc], 0x80
jne 0x4e2b03
or ebx, 1
jmp 0x4e2b06
and ebx, 0xfffffffe
push ebx
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
dec eax
je 0x4e2b17
call fcn.004e3bf4
jmp 0x4e2b19
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x4e2d58
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x531884
call fcn.004e3674
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x531884
call fcn.004e3070
add esp, 0x14
push 0x508adc
lea ecx, [ebp - 8]
push ecx
call fcn.004e0f20
add esp, 8
mov byte [0x531884], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x531884
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4e2dcb
mov eax, 0x531884
jmp 0x4e2dcd
xor eax, eax
pop ecx
pop ecx
pop ebp
ret