joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c044
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe94
mov ebp, edx
mov ebx, eax
mov byte [esp], 1
mov eax, dword [ebx + 0x1b8]
test eax, eax
jle 0x46c232
mov dword [esp + 4], eax
mov edi, 1
mov eax, edi
mov dword [ebx + 0x1cc], eax
push 3
mov edx, eax
mov eax, dword [ebx + 0x1a8]
mov ecx, 3
call fcn.0040b488
mov edx, dword [ebx + 0x1cc]
mov eax, dword [ebx + 0x1a8]
xor ecx, ecx
call fcn.0040b3dc
call fcn.0040f494
mov dword [esp + 0xc], edi
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], 4
lea eax, [esp + 8]
push eax
push 0
push 0x1005
mov eax, dword [ebx + 0x1a8]
push eax
call sub.user32.dll_SendMessageA
test eax, eax
je 0x46c232
mov eax, dword [esp + 0x28]
push edi
mov esi, eax
lea edi, [esp + 0x30]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
cmp byte [esp + 0x5a], 0
jne 0x46c227
cmp byte [esp + 0x58], 0
je 0x46c204
xor eax, eax
mov al, byte [ebx + 0x3d0]
mov eax, dword [ebx + eax*4 + 0x3d4]
cmp eax, dword [esp + 0x5b]
je 0x46c227
lea eax, [esp + 0x67]
mov edx, ebp
call fcn.00405c48
lea eax, [esp + 0x67]
call fcn.0040fb40
mov eax, dword [esp + 0x30]
push eax
lea eax, [esp + 0x6b]
push eax
call sub.kernel32.dll_lstrcatA
xor esi, esi
jmp 0x46c197
lea eax, [esp + 0x67]
mov edx, ebp
call fcn.00405c48
lea eax, [esp + 0x67]
call fcn.0040fb40
mov dword [esp + 0x168], esi
fild dword [esp + 0x168]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004123c0
push eax
lea eax, [esp + 0x6b]
push eax
call sub.kernel32.dll_lstrcatA
push 0x46c240
lea eax, [esp + 0x6b]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [esp + 0x30]
push eax
lea eax, [esp + 0x6b]
push eax
call sub.kernel32.dll_lstrcatA
inc esi
lea eax, [esp + 0x67]
call fcn.004125bc
test al, al
jne 0x46c13f
push 0
lea eax, [esp + 0x6b]
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x46c1c9
lea edx, [esp + 0x67]
mov ax, 3
call fcn.0040de10
jmp 0x46c232
mov eax, dword [0x48db5c]
inc dword [eax]
mov dword [ebx + 0x1cc], edi
mov eax, ebx
mov dx, 0x26fa
call fcn.0046c2e4
lea edx, [esp + 0x67]
mov eax, ebx
call fcn.0046c044
mov byte [esp], al
xor eax, eax
mov dword [ebx + 0x1cc], eax
mov eax, ebx
mov dx, 0x26fa
call fcn.0046c2e4
jmp 0x46c213
push 0
mov eax, ebx
mov ecx, ebp
mov edx, dword [esp + 0x5f]
call fcn.00471898
mov eax, dword [0x48d9fc]
cmp byte [eax], 0
je 0x46c221
mov byte [esp], 0
cmp byte [esp], 0
je 0x46c232
inc edi
dec dword [esp + 4]
jne 0x46c06d
mov al, byte [esp]
add esp, 0x16c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46cdc0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 0
push 0
mov eax, dword [0x48d7e4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll__lcreat
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x46cdfd
mov edx, dword [0x48d7e4]
mov edx, dword [edx]
mov ax, 3
call fcn.0040de10
jmp 0x46cfa3
lea eax, [esi + 0xc]
call fcn.00428760
test al, al
je 0x46cfa3
mov ax, 0xfc
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
mov eax, dword [esi + 0x14]
call fcn.0040fb28
mov edx, eax
mov eax, dword [0x48d948]
mov cx, 0x3c
call fcn.00405c80
mov eax, dword [0x48d550]
movzx eax, byte [eax + 0x188c]
lea eax, [eax + eax*4]
mov edx, dword [0x48d4f8]
lea eax, [edx + eax]
push eax
mov eax, dword [0x48d948]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d948]
xor edx, edx
call fcn.0040e810
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, 0xe000
call fcn.004024e8
mov edi, eax
mov eax, dword [0x48d5f4]
mov byte [eax], 1
push 0xe000
lea edx, [ebp - 0x18]
lea eax, [esi + 0xc]
mov ecx, edi
call fcn.004254a8
mov ebx, eax
push ebx
push edi
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll__hwrite
mov dword [ebp - 0x20], eax
cmp ebx, dword [ebp - 0x20]
je 0x46ceca
mov edx, dword [0x48d7e4]
mov edx, dword [edx]
mov ax, 5
call fcn.0040de10
mov eax, dword [0x48d9fc]
cmp byte [eax], 0
jne 0x46ced9
cmp ebx, dword [ebp - 0x20]
je 0x46cf08
mov eax, edi
call fcn.00402508
lea eax, [esi + 0xc]
call fcn.00428820
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x48d7e4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_DeleteFileA_1
call fcn.0040eb04
jmp 0x46cfa3
mov dword [ebp - 0x28], ebx
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fild qword [ebp - 0x10]
faddp st(1)
fistp qword [ebp - 0x10]
wait
fild qword [esi + 0x18]
fild qword [ebp + 8]
fsubp st(1)
fadd dword [0x46cfb0]
fild qword [ebp - 0x10]
fdivrp st(1)
fmul dword [0x46cfb4]
call fcn.004028a0
mov edx, dword [0x48d1d8]
mov byte [edx], al
mov eax, dword [0x48d1d8]
mov al, byte [eax]
mov edx, dword [0x48d668]
cmp al, byte [edx]
je 0x46cf58
call fcn.00414c64
mov eax, dword [0x48d1e8]
inc word [eax]
mov eax, dword [0x48d1e8]
movzx eax, word [eax]
mov ecx, 0xa
xor edx, edx
div ecx
test edx, edx
jne 0x46cf7a
call fcn.0040f494
test ebx, ebx
jne 0x46ce8a
mov eax, edi
call fcn.00402508
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [esi + 0xc]
call fcn.00428820
call fcn.0040eb04
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4704f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x48d798]
mov eax, dword [eax]
push eax
call sub.user32.dll_IsWindow
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4705d2
push 0
mov eax, dword [0x48e700]
push eax
push 0
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
mov eax, dword [0x48d870]
mov eax, dword [eax]
mov ecx, 5
cdq
idiv ecx
mov ebx, eax
push ebx
mov eax, dword [0x48d724]
mov eax, dword [eax]
sar eax, 1
jns 0x470541
adc eax, 0
push eax
mov eax, dword [0x48d870]
push ebx
mov eax, dword [0x48d724]
mov eax, dword [eax]
test eax, eax
jns 0x470556
add eax, 3
sar eax, 2
push eax
push 0x80fc0040
mov ax, 0x339
call fcn.0040bc04
push eax
mov eax, dword [0x48d704]
mov eax, dword [eax + 0xc]
push eax
push 0x280
call sub.user32.dll_CreateWindowExA
mov edx, dword [0x48d798]
mov dword [edx], eax
mov eax, dword [0x48d798]
cmp dword [eax], 0
jne 0x4705aa
call sub.kernel32.dll_GetLastError_1
call fcn.0040f5f0
mov eax, dword [0x48da44]
mov edx, 1
call fcn.00411d74
pop esi
pop ebx
ret
push 0
push 0x11
call sub.gdi32.dll_GetStockObject
push eax
push 0x30
mov eax, dword [0x48d798]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 4
mov eax, dword [0x48d798]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
push 0x180
mov eax, dword [0x48d798]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret

Function at 0x4705ec
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
mov ebx, edx
mov esi, eax
push esp
lea eax, [ebx + 0xe]
mov ax, word [eax]
push eax
lea eax, [ebx + 0x10]
mov ax, word [eax]
push eax
call sub.kernel32.dll_DosDateTimeToFileTime
lea eax, [esp + 8]
push eax
push 0
lea eax, [ebx + 0x12]
mov ax, word [eax]
push eax
call sub.kernel32.dll_DosDateTimeToFileTime
lea eax, [esp + 0x10]
push eax
lea eax, [ebx + 0x16]
mov ax, word [eax]
push eax
lea eax, [ebx + 0x18]
mov ax, word [eax]
push eax
call sub.kernel32.dll_DosDateTimeToFileTime
push esp
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x14]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 8]
mov edx, esi
mov al, 1
call fcn.004147cc
add ebx, 0xb
xor eax, eax
mov al, byte [ebx]
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
add esp, 0x18
pop esi
pop ebx
ret
Function at 0x472d48
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdb8
mov byte [esp + 5], cl
mov byte [esp + 4], dl
mov dword [esp], eax
lea esi, [esp + 0x108]
mov ebp, dword [0x48da44]
xor edi, edi
lea eax, [esp + 6]
mov edx, dword [esp]
call fcn.00405c48
lea edx, [esp + 6]
mov eax, ebp
call fcn.00405c48
mov eax, dword [0x48d84c]
push eax
push ebp
call sub.kernel32.dll_lstrcatA
mov byte [esi + 0x2c], 0
push esi
push ebp
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x472de2
test byte [esi], 0x10
jne 0x472dd1
inc edi
cmp byte [esp + 5], 0
je 0x472dd1
lea edx, [esp + 6]
mov eax, ebp
call fcn.00405c48
lea eax, [esi + 0x2c]
push eax
push ebp
call sub.kernel32.dll_lstrcatA
mov edx, ebp
mov eax, 0x49bee8
call fcn.00403250
call fcn.004032bc
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x472de8
cmp byte [esi + 0x2c], 0
jne 0x472d9e
push ebx
call sub.kernel32.dll_FindClose
lea edx, [esp + 6]
mov eax, ebp
call fcn.00405c48
mov eax, dword [0x48d84c]
push eax
push ebp
call sub.kernel32.dll_lstrcatA
mov byte [esi + 0x2c], 0
push esi
push ebp
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x472e75
test byte [esi], 0x10
je 0x472e64
cmp al, 0x2e
je 0x472e64
lea edx, [esp + 6]
mov eax, ebp
call fcn.00405c48
lea eax, [esi + 0x2c]
push eax
push ebp
call sub.kernel32.dll_lstrcatA
push 0x472e90
push ebp
call sub.kernel32.dll_lstrcatA
mov eax, ebp
mov cl, byte [esp + 5]
mov dl, byte [esp + 4]
call fcn.00472d48
add edi, eax
cmp byte [esp + 4], 0
je 0x472e64
call fcn.0040f494
mov eax, dword [0x48d9fc]
cmp byte [eax], 0
jne 0x472e7c
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x472e7c
mov al, byte [esi + 0x2c]
test al, al
jne 0x472e14
push ebx
call sub.kernel32.dll_FindClose
mov eax, edi
add esp, 0x248
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x473628
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcb4
push ebx
push esi
push edi
mov bl, 1
lea edx, [ebp - 0x100]
xchg edx, eax
call fcn.00405c48
lea edx, [ebp - 0x100]
mov eax, dword [0x48da44]
call fcn.00405c48
mov eax, dword [0x48d84c]
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov byte [ebp - 0x314], 0
lea eax, [ebp - 0x340]
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
jmp 0x4737c6
test byte [ebp - 0x340], 0x10
jne 0x4736e2
lea edx, [ebp - 0x100]
lea eax, [ebp - 0x200]
call fcn.00405c48
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_lstrcatA
inc dword [0x49c9b0]
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x324]
mov eax, dword [ebp - 0x320]
call fcn.0040fdbc
add esp, 0xfffffff8
fistp qword [esp]
wait
lea eax, [ebp - 0x200]
call fcn.004735b8
pop ecx
mov ebx, eax
jmp 0x473741
cmp byte [ebp - 0x314], 0x2e
je 0x473741
lea edx, [ebp - 0x100]
mov eax, dword [0x48da44]
call fcn.00405c48
lea eax, [ebp - 0x314]
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4737e4
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x48da44]
call fcn.00473628
pop ecx
mov ebx, eax
call fcn.0040f494
mov eax, dword [0x48d9fc]
cmp byte [eax], 0
jne 0x4737d3
test bl, bl
je 0x4737d3
lea eax, [ebp - 0x340]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4737d3
mov eax, dword [ebp + 8]
mov edi, dword [eax - 4]
mov edi, dword [edi + 0x4c0]
test edi, edi
jle 0x4737c6
mov eax, dword [0x49c9b0]
mov dword [ebp - 0x348], eax
xor eax, eax
mov dword [ebp - 0x344], eax
fild qword [ebp - 0x348]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x34c], edi
fild dword [ebp - 0x34c]
fdivp st(1)
fmul dword [0x4737e8]
call fcn.004028a0
mov edx, dword [0x48d1d8]
mov byte [edx], al
mov eax, dword [0x48d1d8]
mov al, byte [eax]
mov edx, dword [0x48d668]
cmp al, byte [edx]
je 0x4737c6
call fcn.00414c64
cmp byte [ebp - 0x314], 0
jne 0x473683
push esi
call sub.kernel32.dll_FindClose
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477284
Capabilities:
Get disk information
Log keystrokes via polling

Disassembly:
push ebx
push esi
push ecx
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
mov eax, dword [0x48db2c]
cmp byte [eax], 0
jne 0x4774af
mov bl, 1
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl byte [esp + 2]
mov eax, dword [0x48d9a4]
push eax
push esi
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x4772c4
xor ebx, ebx
jmp 0x4774af
push 0x4774b8
push esi
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x477317
mov eax, dword [0x48d9fc]
cmp byte [eax], 0
jne 0x47749b
mov eax, dword [0x48d8b8]
cmp byte [eax], 0
jne 0x4772f0
call fcn.0044a85c
mov eax, dword [0x48d720]
mov byte [eax], 1
call fcn.0044b0d8
mov eax, dword [0x48d720]
mov byte [eax], 0
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_DestroyWindow
jmp 0x47749b
cmp byte [esp], 0
je 0x47732a
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [0x48d370]
mov edx, esi
call fcn.00405c48
mov eax, dword [0x48d370]
cmp byte [eax], 0x3a
jne 0x477403
mov edx, dword [0x48d390]
mov eax, dword [0x48d370]
inc eax
call fcn.0041af78
test al, al
je 0x477403
mov eax, dword [0x48d390]
cmp byte [eax], 0
jle 0x4773eb
mov eax, dword [0x48d390]
mov al, byte [eax]
call fcn.0040cdd0
push eax
call sub.kernel32.dll_GetDriveTypeA
mov edx, dword [0x48db3c]
mov word [edx], ax
mov eax, dword [0x48db3c]
cmp word [eax], 4
jne 0x4773a5
mov edx, dword [0x48da44]
mov ax, 0xa
call fcn.0040de10
jmp 0x4774af
cmp byte [esp + 2], 0
je 0x4773f0
push 1
lea edx, [esp + 5]
mov eax, dword [0x48d390]
mov al, byte [eax]
xor ecx, ecx
call fcn.0041b02c
test al, al
je 0x4773f0
mov dx, 0xfffa
mov eax, dword [0x48d7d0]
mov cl, byte [eax]
cmp cl, byte [esp + 1]
jne 0x4773dd
mov ecx, dword [0x48d390]
mov byte [ecx], dl
inc edx
inc eax
test dx, dx
jne 0x4773cd
call fcn.0041b45c
jmp 0x4773f0
call fcn.0041b45c
mov eax, dword [0x48d370]
mov byte [eax + 1], 0
call fcn.0046096c
jmp 0x47749b
mov eax, dword [0x48d370]
mov dl, 0x5c
call fcn.00405e00
mov esi, eax
test esi, esi
je 0x477464
mov dl, 0x2a
mov eax, esi
call fcn.00405cf8
test eax, eax
jne 0x47742f
mov dl, 0x3f
mov eax, esi
call fcn.00405cf8
test eax, eax
je 0x477464
inc esi
mov eax, dword [0x48d550]
add eax, 0x1a5a
mov cx, 0xd
mov edx, esi
call fcn.00405c70
mov byte [esi], 0
mov eax, dword [0x48d550]
mov byte [eax + 0x18a7], 0
mov eax, dword [0x48d370]
xor edx, edx
call fcn.00461a48
mov bl, 1
jmp 0x47749b
mov eax, dword [0x48d370]
call fcn.00412584
test al, al
jne 0x477489
mov eax, dword [0x48d370]
call fcn.00412614
test al, al
je 0x477489
mov al, 1
call fcn.00461db4
jmp 0x47749b
xor ecx, ecx
mov dl, 1
xor eax, eax
call fcn.004616f8
test ax, ax
jg 0x47749b
xor ebx, ebx
cmp byte [esp + 2], 0
je 0x4774af
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x4774c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x477679
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x48db2c]
cmp byte [eax], 0
jne 0x477663
mov eax, dword [0x48d688]
cmp word [eax], 0x2bc
jbe 0x477553
mov eax, dword [0x48d998]
mov al, byte [eax + 0xb7]
mov edx, dword [0x48d550]
cmp al, byte [edx + 0x1860]
je 0x477553
call fcn.00402738
test eax, eax
jne 0x477553
mov eax, dword [0x48d5a8]
cmp byte [eax], 0
jne 0x477553
call fcn.00410bf0
test al, al
jne 0x477553
mov eax, dword [0x48dad8]
cmp byte [eax], 5
je 0x477553
call fcn.00412194
mov eax, dword [0x48d998]
mov al, byte [eax + 0xb7]
mov edx, dword [0x48d550]
mov byte [edx + 0x1860], al
mov eax, dword [0x48d5a8]
cmp byte [eax], 0
jne 0x477572
mov eax, dword [0x48d550]
cmp byte [eax + 0x185e], 0
je 0x477572
xor eax, eax
call fcn.00441e60
call fcn.00402738
mov ebx, eax
test bx, bx
jle 0x4775a6
mov si, 1
lea edx, [ebp - 4]
movsx eax, si
call fcn.00402798
lea eax, [ebp - 4]
call fcn.004048ac
xor edx, edx
call fcn.00477284
test al, al
je 0x4775a6
inc esi
dec bx
jne 0x477582
mov eax, dword [0x48d5a8]
cmp byte [eax], 0
jne 0x4775d3
mov eax, dword [0x48dad8]
cmp byte [eax], 5
jne 0x4775d3
mov eax, dword [0x48d5a8]
mov byte [eax], 1
call fcn.00412194
push 0
call sub.user32.dll_PostQuitMessage
jmp 0x477663
call fcn.00402738
test eax, eax
jne 0x477663
mov eax, dword [0x48d5a8]
cmp byte [eax], 0
jne 0x477663
mov eax, dword [0x48d550]
cmp byte [eax + 0x1932], 1
jne 0x47760b
mov eax, dword [0x48d550]
cmp dword [eax + 0x176c], 1
jle 0x47760b
call fcn.00486018
mov eax, dword [0x48d550]
cmp byte [eax + 0x1932], 2
jne 0x477663
mov eax, dword [0x48d550]
cmp byte [eax + 0x1883], 0
je 0x477663
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x477663
mov ax, 0x2f1
call fcn.0040bc04
mov edx, eax
lea eax, [ebp - 0x104]
call fcn.00405c48
lea eax, [ebp - 0x104]
mov dl, 1
call fcn.00412714
lea eax, [ebp - 0x104]
mov dl, 1
call fcn.0048568c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477680
lea eax, [ebp - 4]
call fcn.00404410
ret
Function at 0x4817d4
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
xor ebx, ebx
cmp byte [esi + 0x556], 0
je 0x4817f2
mov eax, esi
xor edx, edx
call fcn.00481530
jmp 0x481a07
cmp byte [esi + 0x557], 0
jne 0x481a07
cmp byte [esi + 0x55d], 0
jne 0x48181d
push dword [esi + 0x1c]
push dword [esi + 0x18]
mov al, 1
call fcn.0040f3c4
test al, al
je 0x481a07
mov eax, dword [0x48daa4]
cmp byte [eax], 2
jne 0x481834
cmp byte [esi + 0x55e], 0
je 0x481a07
mov eax, esi
call fcn.00464bb4
test al, al
je 0x481a07
cmp dword [esi + 0x4c], 0
jne 0x48187d
cmp byte [esi + 0x55d], 0
jne 0x48187d
mov eax, dword [esi + 0x14]
call fcn.00412584
mov byte [esp], al
cmp byte [esi + 0x82], 3
je 0x48187d
cmp byte [esp], 0
jne 0x48187d
mov edx, dword [esi + 0x14]
mov ax, 0xa
call fcn.0040de10
jmp 0x481a07
cmp byte [esi + 0x82], 4
jne 0x48188d
mov bl, 1
jmp 0x481a07
cmp byte [esi + 0x55d], 0
je 0x4818c4
call fcn.0041b380
test al, al
je 0x481a07
lea eax, [esi + 0xc]
call fcn.004262ac
test al, al
je 0x4818bd
mov bl, 1
mov eax, esi
call fcn.004646c4
jmp 0x481a07
xor ebx, ebx
jmp 0x481a07
fild qword [esi + 0x18]
fcomp dword [0x481a10]
fnstsw ax
sahf
jbe 0x4818e0
mov eax, dword [0x48d8b8]
cmp byte [eax], 0
je 0x481a07
mov eax, dword [0x48daa4]
cmp byte [eax], 0
jne 0x481902
cmp byte [esp], 0
je 0x481902
mov eax, dword [esi + 0x14]
mov dl, 1
call fcn.00411180
test al, al
je 0x481a07
fild qword [esi + 0x18]
fcomp dword [0x481a14]
fnstsw ax
sahf
jbe 0x48191e
mov eax, dword [0x48d8b8]
cmp byte [eax], 0
je 0x481a07
push 2
mov ax, word [esi + 0x534]
call fcn.00412944
mov edx, eax
mov ecx, dword [esi + 0x14]
lea eax, [esi + 0xc]
call fcn.004245b8
test al, al
je 0x481a07
cmp byte [esi + 0x82], 3
jne 0x48195d
mov eax, dword [0x48d550]
mov al, byte [eax + 0x18f1]
mov byte [esi + 0x8f], al
jmp 0x48198f
cmp byte [esi + 0x8c], 0
je 0x48197f
mov ax, word [esi + 0x534]
call fcn.00412944
push eax
call sub.kernel32.dll_DeleteFileA_1
mov byte [esi + 0x8c], 0
mov word [esi + 0x80], 0
mov byte [esi + 0x82], 1
mov byte [esi + 0x55e], 0
lea eax, [esi + 0xc]
mov dl, 1
call fcn.00423b80
mov bl, 1
cmp byte [esi + 0x544], 0x3f
jne 0x4819d8
push 0xff
mov eax, dword [0x48da44]
push eax
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_GetShortPathNameA
mov eax, dword [0x48da44]
call fcn.0040fb28
mov edx, eax
lea eax, [esi + 0x544]
call fcn.00405c48
mov eax, esi
xor edx, edx
call fcn.0048145c
mov eax, dword [0x48daa4]
cmp byte [eax], 0
jbe 0x481a07
mov eax, dword [0x48d9c0]
inc word [eax]
mov eax, dword [0x48db80]
fild qword [eax]
fild qword [esi + 0x18]
faddp st(1)
mov eax, dword [0x48db80]
fistp qword [eax]
wait
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x481d20
Capabilities:
Delete file

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, eax
mov si, word [ebx + 0x538]
mov eax, dword [0x48d6b4]
cmp si, word [eax]
jne 0x481d80
mov ecx, esp
mov edx, dword [ebx + 0x17c]
mov eax, esi
dec eax
call fcn.0044f120
test al, al
je 0x481d67
push esp
call sub.kernel32.dll_DeleteFileA_1
mov eax, esp
call fcn.0040ebbc
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.00412668
dec word [ebx + 0x538]
mov eax, dword [0x48db68]
mov al, byte [eax]
mov byte [ebx + 0x551], al
call fcn.00444994
mov eax, dword [0x48d6b4]
mov word [eax], 0xffff
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x485058
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
push 0
mov eax, dword [0x48e700]
push eax
push 0x4d2
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
push 0
push 0
push 0
push 0
push 0x44008020
push 0
push 0x485194
push 0
call sub.user32.dll_CreateWindowExA
mov edx, dword [0x48d67c]
mov dword [edx], eax
mov eax, dword [0x48d67c]
cmp dword [eax], 0
jne 0x4850be
call sub.kernel32.dll_GetLastError_1
call fcn.0040f5f0
mov eax, dword [0x48da44]
mov edx, 1
call fcn.00411d74
jmp 0x48518d
push 0
push 0x11
call sub.gdi32.dll_GetStockObject
push eax
push 0x30
mov eax, dword [0x48d67c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 0x484f60
push 0xfffffffffffffffc
mov eax, dword [0x48d67c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowLongA
mov edx, dword [0x48d2b8]
mov dword [edx], eax
mov eax, dword [0x48d510]
cmp dword [eax], 0
jle 0x48518d
mov esi, dword [0x48d330]
movsx esi, word [esi]
test esi, esi
jle 0x48516c
mov edi, 1
mov ebx, dword [0x48d524]
mov eax, dword [ebx]
test eax, eax
je 0x485165
push 0xff
mov edx, dword [0x48da44]
push edx
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [esp], 9
mov eax, dword [0x48da44]
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], edi
mov eax, esp
push eax
mov eax, dword [0x48d510]
mov eax, dword [eax]
dec eax
push eax
push 0x1307
mov eax, dword [0x48d67c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
inc edi
add ebx, 4
dec esi
jne 0x485119
push 0
mov eax, dword [0x48d930]
mov eax, dword [eax]
call fcn.00480b78
push eax
push 0x130c
mov eax, dword [0x48d67c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
add esp, 0x1c
pop edi
pop esi
pop ebx
ret