joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4759e0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ecx
call fcn.00475830
cmp eax, 1
je 0x4759f4
mov eax, 1
pop ecx
ret 4
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetServicesPerfOSPerformance
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x475a94
push esi
mov esi, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebp
push edi
xor ecx, ecx
cmp dword [esp + 0x18], ecx
push 4
lea edx, [esp + 0x1c]
push edx
sete cl
push 4
push eax
push str.Disable_Performance_Counters
push esi
mov dword [esp + 0x28], esi
mov edi, ecx
mov dword [esp + 0x30], edi
call ebx
test esi, esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x475a63
push esi
call ebp
mov dword [esp + 0x10], 0
push 0x2001f
push 0x4be198
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
call fcn.00401df0
test eax, eax
je 0x475a9a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x475a8a
push eax
call ebp
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 4
xor eax, eax
pop ecx
ret 4
mov esi, dword [esp + 0x10]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.Disable_Performance_Counters
push esi
mov dword [esp + 0x30], edi
call ebx
test esi, esi
je 0x475abc
push esi
call ebp
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x475ad0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x48
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
mov ebx, dword [esp + 0x50]
mov eax, 1
test byte [0x500838], al
push esi
jne 0x475b1e
or dword [0x500838], eax
push 0x19000
mov dword [0x500834], 0x19000
call dword [sym.imp.MSVCR80.dll_malloc]
push 0x4b1bf0
mov dword [0x500830], eax
call fcn.0048e7d9
add esp, 8
mov ecx, dword [esp + 0x58]
mov eax, dword [0x500834]
push ecx
lea edx, [esp + 0x10]
push 0x4b97f0
push edx
mov dword [esp + 0x14], eax
call fcn.004758f0
mov eax, dword [0x500834]
mov ecx, dword [0x500830]
push eax
push 0
push ecx
call sub.MSVCR80.dll_memset
mov eax, dword [0x500830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x18
lea edx, [esp + 8]
push edx
push eax
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocStringLen
call esi
cmp eax, 0xea
jne 0x475bdd
push edi
mov edi, dword [sym.imp.MSVCR80.dll_realloc]
mov eax, dword [esp + 0xc]
mov edx, dword [0x500830]
add eax, 0x2800
push eax
push edx
mov dword [esp + 0x14], eax
mov dword [0x500834], eax
call edi
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push eax
push 0
push 0
lea edx, [esp + 0x20]
push edx
push reloc.OLEAUT32.dll_SysReAllocStringLen
mov dword [0x500830], eax
call esi
cmp eax, 0xea
je 0x475b81
mov eax, dword [0x500830]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0048e5b2
add esp, 0x48
ret 0xc
mov ecx, dword [0x500830]
mov dword [ebx], ecx
mov ecx, dword [esp + 0x4c]
pop esi
pop ebx
xor ecx, esp
call fcn.0048e5b2
add esp, 0x48
ret 0xc
Function at 0x476260
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ebp
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x14]
push edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebp, ebp
cmp dword [esi], ebp
je 0x476297
cmp dword [esi + 4], ebp
je 0x476297
cmp dword [esi + 8], ebp
je 0x476297
cmp dword [esi + 0xc], ebp
je 0x476297
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x4762a8
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebp
mov eax, dword [esi]
cmp eax, ebp
je 0x4762b7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebp
mov eax, dword [esi + 0xc]
cmp eax, ebp
je 0x4762c8
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0xc], ebp
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x4762d9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebp
push ebx
push str.GlobalA7B1CAE3_3722_4357_894E_FAAEC406F7D9
push ebp
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
cmp ebx, ebp
jne 0x476318
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenFileMapping_failed:__d_n
call dword [sym.imp.MSVCR80.dll_printf]
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
pop esi
mov eax, 0x80004005
pop ebp
pop ecx
ret
push ebp
push ebp
push ebp
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x47636b
push str.0D0E6E32_68D7_4072_9B4F_F73CF34B78F2_flow
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [esi], ebx
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x476358
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileMapping_failed:__d_n
jmp 0x476377
push 0
push 0
push 0
push 6
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x4763b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MapViewOfFile_failed:__d_n
call dword [sym.imp.MSVCR80.dll_printf]
add esp, 8
test edi, edi
je 0x47638b
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
test ebp, ebp
je 0x47639b
push ebp
call esi
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
pop esi
mov eax, 0x80004005
pop ebp
pop ecx
ret
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x10]
push eax
mov dword [esi + 8], ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x477ad0
Capabilities:
Get memory capacity

Disassembly:
push esi
push 0x40
lea esi, [ecx + 8]
push 0
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
mov dword [esi], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor eax, eax
pop esi
ret
Function at 0x47e970
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4abc38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
push edi
lea ecx, [esp + 0x18]
call fcn.004079b0
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47ea89
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push edi
call ebx
test eax, eax
jne 0x47ea89
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0xb7
je 0x47ea89
mov eax, dword [esp + 0x14]
cmp dword [eax - 4], 1
jle 0x47e9fc
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x18]
call fcn.00402eb0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edx, dword [esp + 0x14]
test edx, edx
jne 0x47ea0f
xor eax, eax
jmp 0x47ea25
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47ea14
sub eax, esi
sar eax, 1
js 0x47ea7f
cmp eax, dword [edx - 8]
jg 0x47ea7f
mov dword [edx - 0xc], eax
mov edx, dword [esp + 0x14]
mov word [edx + eax*2], 0
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x47ea60
push eax
call fcn.0047e970
add esp, 4
test eax, eax
je 0x47ea60
push 0
push edi
call ebx
test eax, eax
jne 0x47ea89
call ebp
cmp eax, 0xb7
je 0x47ea89
lea ecx, [esp + 0x14]
call fcn.00404930
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x80070057
call fcn.004011d0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x20], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47eaad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x47f5e0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4af8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x30]
mov ecx, edi
xor ebx, ebx
call fcn.00404810
push str.cloudctrl.config
add esi, 0x58
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00405d30
add esp, 0xc
mov ecx, dword [esp + 0x30]
push ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47f6a6
lea ecx, [esp + 0x10]
call fcn.00442b70
mov edx, dword [esp + 0x30]
push 2
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00442c00
push str.http:__cu005.www.duba.net_duba_2013_krcmdmon_pop_
push str.Addr
push str.CloudRcmdPop
lea ecx, [esp + 0x1c]
call fcn.00441800
cmp eax, ebx
jne 0x47f67c
xor ecx, ecx
jmp 0x47f690
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x47f681
sub ecx, esi
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00405620
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.004429f0
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
je 0x47f6b2
mov ebx, 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47f6da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x47fc10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4af9a8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
xor ebp, ebp
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
mov dword [esp + 0x24], ebp
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
mov byte [esp + 0x24], 1
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x58]
push eax
lea ecx, [esp + 0x18]
push str._sksearchindex.xml
push ecx
mov byte [esp + 0x30], 2
call fcn.00405e90
mov edx, dword [esi + 0x58]
push edx
lea eax, [esp + 0x28]
push str._sksearch_
push eax
call fcn.00405e90
mov edi, dword [esp + 0x30]
push edi
call fcn.0043a3b0
add esp, 0x1c
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0047f700
test eax, eax
je 0x47fcfa
lea edx, [esp + 0x10]
push str.ksearch_index.xml
push edx
call fcn.00405eb0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add esp, 8
push ebp
push esi
push eax
push ecx
lea ecx, [esi + 0x28]
call fcn.0047f580
test eax, eax
jne 0x47fcfa
lea ebp, [eax + 1]
lea eax, [edi - 0x10]
mov byte [esp + 0x24], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x47fd1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47fd40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47fd68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x480030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4afa72
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
lea ebp, [esi + 4]
xor ebx, ebx
mov dword [ebp], ebx
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
call edx
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add eax, 0x10
mov dword [ebp + 4], eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 8], ebx
call edi
lea eax, [esi + 0x30]
push eax
mov dword [esp + 0x28], ebx
mov dword [esi], vtable.KSearchUpdater.0
call edi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x2c], ebx
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
mov byte [esp + 0x24], 1
call edx
add eax, 0x10
mov dword [esi + 0x58], eax
lea ecx, [esi + 0x5c]
mov byte [esp + 0x24], 2
call fcn.0043b270
lea edi, [esi + 0xa8]
mov ecx, edi
mov byte [esp + 0x24], 3
call fcn.00410670
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea eax, [esp + 0x14]
push ebx
push eax
mov byte [esp + 0x2c], 4
call fcn.0043a320
add esp, 8
push eax
lea ecx, [esi + 0x58]
mov byte [esp + 0x28], 5
call fcn.00405e10
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x480145
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.KSearchUpdater
mov ecx, ebp
call fcn.00472910
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x480ad0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xc
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
xor ecx, ecx
lea eax, [esi + 0x12]
lea esp, [esp]
movzx edx, byte [eax - 2]
mov byte [esp + ecx + 0xc], dl
movzx edx, byte [eax - 1]
mov byte [esp + ecx + 0xd], dl
movzx edx, byte [eax]
mov byte [esp + ecx + 0xe], dl
movzx edx, byte [eax + 1]
mov byte [esp + ecx + 0xf], dl
add ecx, 4
add eax, 4
cmp ecx, 8
jb 0x480af0
mov ecx, dword [esi + 0x10]
shr ecx, 3
and ecx, 0x3f
cmp ecx, 0x38
mov eax, 0x38
jb 0x480b32
mov eax, 0x78
sub eax, ecx
push eax
lea ebp, [esi + 0x58]
push ebp
mov ecx, esi
call fcn.00480a20
push 8
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00480a20
lea ecx, [edi + 1]
lea eax, [esi + 2]
mov edi, 4
lea esp, [esp]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x480b60
push 0x98
push edi
push esi
call sub.MSVCR80.dll_memset
push 0x40
push edi
push ebp
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x2c]
add esp, 0x18
pop edi
pop esi
mov byte [ebp], 0x80
pop ebp
xor ecx, esp
call fcn.0048e5b2
add esp, 0xc
ret 4
Function at 0x480c30
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x58], ebx
push edi
jne 0x480c98
push 0x98
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x480c86
push 0x40
lea ebp, [edi + 0x58]
push ebx
push ebp
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], ebx
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
call sub.MSVCR80.dll_memset
add esp, 0xc
mov byte [ebp], 0x80
jmp 0x480c88
xor edi, edi
cmp edi, ebx
mov dword [esi + 0x58], edi
jne 0x480c98
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [esp + 0x14]
push 0x4c29cc
push eax
call dword [sym.imp.MSVCR80.dll__wfopen]
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x480c8f
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
jne 0x480d14
cmp dword [esi + 0x5c], ebx
jne 0x480cce
push 0xff
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov dword [esi + 0x5c], eax
mov ecx, dword [esi + 0x5c]
mov ebx, dword [sym.imp.MSVCR80.dll_fread]
push edi
push 0xff
push 1
push ecx
call ebx
add esp, 0x10
test eax, eax
je 0x480d81
lea ecx, [ecx]
mov edx, dword [esi + 0x5c]
mov ecx, dword [esi + 0x58]
push eax
push edx
call fcn.00480a20
mov eax, dword [esi + 0x5c]
push edi
push 0xff
push 1
push eax
call ebx
add esp, 0x10
test eax, eax
jne 0x480cf0
jmp 0x480d81
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x480d27
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x5c], ebx
lea ebx, [ebp + 1]
push ebx
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
push ebx
push 0
push eax
mov dword [esi + 0x5c], eax
call sub.MSVCR80.dll_memset
mov ecx, dword [esi + 0x5c]
push edi
push ebp
push 1
push ecx
mov dword [esp + 0x34], 0
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x20
test eax, eax
mov dword [esp + 0x14], eax
je 0x480d81
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x480d74
mov eax, dword [esi + 0x5c]
lea edx, [esp + 0x14]
push edx
push eax
call ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x5c]
push eax
push ecx
mov ecx, dword [esi + 0x58]
call fcn.00480a20
push edi
call dword [sym.imp.MSVCR80.dll_fclose]
mov ecx, dword [esi + 0x58]
add esp, 4
lea edi, [esi + 4]
push edi
call fcn.00480ad0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x481940
Capabilities:
Get common file path

Disassembly:
sub esp, 0x4c4
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x4c0], eax
push esi
mov esi, ecx
test esi, esi
push edi
mov edi, dword [esp + 0x4d0]
je 0x48196c
lea eax, [esi + 0x24]
mov dword [esp + 8], eax
jmp 0x481974
mov dword [esp + 8], 0
lea ecx, [esp + 8]
push ecx
mov ecx, 0x4dc9b4
call fcn.00431270
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x20]
push edi
push 0
push 1
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
cmp dword [esi + 4], 0
je 0x481a78
push 0x2b4
lea ecx, [esp + 0x10]
push 0
push ecx
call sub.MSVCR80.dll_memset
push 0x206
lea edx, [esp + 0x2d2]
push 0
push edx
mov word [esp + 0x2d8], 0
call sub.MSVCR80.dll_memset
add esp, 0x18
push 0x103
lea eax, [esp + 0x2c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4101
push 0x2b4
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x2d0]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x481a1c
push eax
mov eax, dword [esi + 4]
push 1
push 0x1003
push eax
call edi
mov ecx, dword [esi + 4]
push 0x20
push 0
push 0x1036
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push 0
push 0x101f
push edx
call edi
push eax
lea ecx, [esi + 0x2c]
call fcn.004810e0
mov eax, dword [esi + 0x30]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 2
cmp eax, ecx
je 0x481a65
push ecx
mov ecx, dword [esi + 0x30]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 4]
push 0
push 0
push 0x7f2
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x4c8]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0048e5b2
add esp, 0x4c4
ret 4
Function at 0x481954
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4c4
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x4c0], eax
push esi
mov esi, ecx
test esi, esi
push edi
mov edi, dword [esp + 0x4d0]
je 0x48196c
lea eax, [esi + 0x24]
mov dword [esp + 8], eax
jmp 0x481974
mov dword [esp + 8], 0
lea ecx, [esp + 8]
push ecx
mov ecx, 0x4dc9b4
call fcn.00431270
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x20]
push edi
push 0
push 1
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
cmp dword [esi + 4], 0
je 0x481a78
push 0x2b4
lea ecx, [esp + 0x10]
push 0
push ecx
call sub.MSVCR80.dll_memset
push 0x206
lea edx, [esp + 0x2d2]
push 0
push edx
mov word [esp + 0x2d8], 0
call sub.MSVCR80.dll_memset
add esp, 0x18
push 0x103
lea eax, [esp + 0x2c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4101
push 0x2b4
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x2d0]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x481a1c
push eax
mov eax, dword [esi + 4]
push 1
push 0x1003
push eax
call edi
mov ecx, dword [esi + 4]
push 0x20
push 0
push 0x1036
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push 0
push 0x101f
push edx
call edi
push eax
lea ecx, [esi + 0x2c]
call fcn.004810e0
mov eax, dword [esi + 0x30]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 2
cmp eax, ecx
je 0x481a65
push ecx
mov ecx, dword [esi + 0x30]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 4]
push 0
push 0
push 0x7f2
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x4c8]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0048e5b2
add esp, 0x4c4
ret 4

Function at 0x481d60
Capabilities:
Create thread

Disassembly:
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x481d6f
ret
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov dword [eax + 8], edx
mov edx, dword [esp + 0xc]
push edx
push 0
push eax
push 0x481cd0
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
push 0
push 0
mov dword [eax + 4], ecx
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
ret
Function at 0x482717
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x4e0270], 0
push esi
mov esi, ecx
je 0x4827cc
cmp dword [esi + 4], 0
jne 0x4827cc
push edi
lea edi, [esi + 0x48]
push edi
push 0x4b760c
push 1
push 0
push 0x4c30f4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4827cb
mov edi, dword [edi]
test edi, edi
je 0x4827cb
mov edx, dword [0x4e0270]
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
lea ecx, [esi + 0x4c]
push ecx
push 0x4c30a4
push edx
push edi
call eax
test eax, eax
jl 0x4827cb
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0xc], eax
call edi
push 0
push 0
push 0x482150
push esi
mov dword [esi + 0x10], eax
call fcn.00481d60
add esp, 0x10
cmp dword [esi + 0xc], 0
mov dword [esi + 8], eax
je 0x4827b9
cmp dword [esi + 0x10], 0
je 0x4827b9
test eax, eax
je 0x4827b9
mov eax, 1
jmp 0x4827bb
xor eax, eax
test eax, eax
mov dword [esi + 4], eax
jne 0x4827cb
pop edi
mov ecx, esi
pop esi
jmp fcn.00481c60
pop edi
pop esi
ret

Function at 0x482d31
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x3a0]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x482d52
mov ecx, dword [esi + 0x3a0]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [esi + 0x398]
push edx
call dword [sym.imp.USER32.dll_IsMenu]
test eax, eax
je 0x482d82
mov eax, dword [esi + 0x398]
test eax, eax
je 0x482d82
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
test eax, eax
je 0x482d82
mov dword [esi + 0x398], 0
lea ecx, [esp + 4]
lea eax, [esi + 0x384]
push ecx
mov ecx, 0x4dc9b4
mov dword [esp + 8], eax
call fcn.004312f0
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0x420]
call fcn.0048cba0
mov dword [esi + 0x390], 0
pop esi
pop ecx
ret