joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486a18
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x486c11
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x486a9d
lea edx, [ebp - 0x154]
mov eax, edi
call fcn.0044c3d0
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0044bec0
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0044c088
test eax, eax
jne 0x486a9d
lea edx, [ebp - 4]
mov eax, edi
call fcn.0044c3a8
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x486bdc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x15c]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x15c]
mov edx, 0x486c28
call fcn.00403d40
mov eax, dword [ebp - 0x15c]
call fcn.00403efc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x486bc5
xor eax, eax
push ebp
push 0x486bbe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00484f9c
test al, al
je 0x486b8f
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403ce8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0044c088
test eax, eax
je 0x486b8f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.004860f8
test eax, eax
jne 0x486b8f
lea edx, [ebp - 0x164]
mov eax, ebx
call fcn.0044bec0
lea eax, [ebp - 0x164]
mov edx, dword [ebp - 0x10]
call fcn.00403d40
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.004850d8
mov eax, dword [ebp - 0x160]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0048600c
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x486b05
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486bc5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486be3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x489d48
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x489f3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x408]
mov edx, 0x20
call fcn.0042c7d4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x408]
mov edx, 0x20
call fcn.0042c7f4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0x20
call fcn.0042c7d4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0x20
call fcn.0042c7f4
xor eax, eax
push ebp
push 0x489f11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x10
push 0x489f4c
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x489e27
cmp byte [ebp - 0x158], 0
je 0x489e27
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x4bf4dc]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x408]
call fcn.00489c88
xor edx, edx
mov al, 6
call fcn.0049bb00
test al, al
je 0x489e85
push 0x27
lea edx, [ebp - 0x168]
mov eax, dword [0x4bec08]
mov eax, dword [eax]
call fcn.0044bec0
lea eax, [ebp - 0x168]
mov edx, 0x489f64
call fcn.00403d40
mov eax, dword [ebp - 0x168]
call fcn.00403efc
push eax
mov eax, dword [0x4bf4dc]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x40c]
call fcn.00489c88
jmp 0x489f07
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.004a0034
cmp dword [ebp - 4], 0
jne 0x489ea9
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.004a0034
cmp dword [ebp - 4], 0
je 0x489f07
push 0x1000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x489f07
cmp byte [ebp - 0x158], 0
je 0x489f07
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x4bf4dc]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x40c]
call fcn.00489c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489f1b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489f43
lea eax, [ebp - 0x168]
call fcn.00403ab8
lea eax, [ebp - 4]
call fcn.00403ab8
ret
Function at 0x492f70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x493074
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4be91c]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x4be1ac]
mov edx, 0x80000002
xor eax, eax
call fcn.0044d8c4
test eax, eax
jne 0x492ff6
mov eax, esi
call fcn.00403d38
inc eax
push eax
mov eax, esi
call fcn.00403efc
push eax
push 1
push 0
mov eax, edi
call fcn.00403efc
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x492feb
mov eax, 0x49308c
call fcn.00479788
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x493000
mov eax, 0x4930c0
call fcn.00479788
test bl, bl
je 0x493059
mov eax, esi
call fcn.00403efc
push eax
call sub.gdi32.dll_AddFontResourceA
test eax, eax
je 0x493027
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
jmp 0x493059
lea ecx, [ebp - 0xc]
mov edx, 0x4930ec
mov al, 0x33
call fcn.004731d0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0044e0b0
mov eax, dword [ebp - 8]
mov edx, dword [0x4bea70]
mov edx, dword [edx + 0xb0]
call fcn.0049124c
test al, al
je 0x493004
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49307b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403adc
ret

Function at 0x49576c
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x49582d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x495812
test bl, 0x10
je 0x495812
lea ecx, [ebp - 4]
mov edx, 0x495844
mov eax, esi
call fcn.0044bffc
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x495858
mov eax, 0x495868
call fcn.0044c8f4
mov edx, 0x495880
mov eax, dword [ebp - 8]
call fcn.004096f8
test eax, eax
jne 0x495812
mov eax, dword [ebp - 4]
call fcn.00409e00
lea ecx, [ebp - 0xc]
mov edx, 0x4958b0
mov eax, esi
call fcn.0044bffc
mov eax, dword [ebp - 0xc]
call fcn.00409e00
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.00403efc
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesA
push edi
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495834
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403adc
ret
Function at 0x496370
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x496447
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
je 0x496431
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00475470
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x496460
call fcn.004799a8
mov eax, dword [0x4be7b4]
mov eax, dword [eax + 8]
mov edx, ebx
call fcn.00410da4
mov ebx, eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebx]
call fcn.00403d38
mov ecx, 0x14
cdq
idiv ecx
push eax
mov ecx, edi
mov edx, esi
mov al, byte [ebp - 1]
call fcn.0047f1fc
test al, al
jne 0x496431
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x496416
mov eax, 0x496494
call fcn.00479788
jmp 0x496431
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4964f0
call fcn.004799a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49644e
lea eax, [ebp - 0x18]
call fcn.00403ab8
ret
Function at 0x497d54
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x497ecd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044bec0
lea eax, [ebp - 0x148]
mov edx, 0x497ee4
call fcn.00403d40
mov eax, dword [ebp - 0x148]
call fcn.00403efc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x497ea7
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00403ce8
mov eax, dword [ebp - 4]
call fcn.00403d38
cmp eax, 9
jl 0x497e8c
lea eax, [ebp - 0x14c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403f40
mov eax, dword [ebp - 0x14c]
mov edx, 0x497ef8
call fcn.004096f8
test eax, eax
jne 0x497e8c
mov edx, 0x497f00
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
call fcn.0044e3cc
test al, al
je 0x497e8c
mov edx, 0x497f00
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
call fcn.0044e3cc
test al, al
je 0x497e8c
mov edx, 0x497f00
mov eax, dword [ebp - 4]
mov al, byte [eax + 7]
call fcn.0044e3cc
test al, al
je 0x497e8c
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0x2e
jne 0x497e8c
lea eax, [ebp - 0x150]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00403f40
mov eax, dword [ebp - 0x150]
call fcn.00409cdc
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x497dc7
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497ed4
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00403adc
lea eax, [ebp - 4]
call fcn.00403ab8
ret
Function at 0x49a844
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x12], eax
mov eax, dword [esi]
call fcn.004129f0
mov dword [ebp - 0xe], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa], eax
call fcn.0049a76c
lea eax, [ebp - 0x12]
push eax
push 0
push 0x4a
mov eax, dword [0x4c038c]
push eax
call sub.user32.dll_SendMessageA
mov ebx, eax
mov eax, esi
call fcn.0040d728
cmp ebx, 0x6c840001
jne 0x49a894
call fcn.0040c3e8
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x6c830000
je 0x49a8b8
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x49a968
call fcn.00475268
mov word [ebp - 6], bx
xor esi, esi
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x49a910
mov ebx, eax
mov edx, 1
mov ax, word [ebp - 6]
call fcn.0049a7c8
mov esi, eax
mov eax, esi
sub ax, 2
je 0x49a910
dec eax
sub ax, 2
jb 0x49a924
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x49a99c
call fcn.00475268
push 0xff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x49a8c5
mov edx, 2
mov ax, word [ebp - 6]
call fcn.0049a7c8
movzx ebx, ax
mov edx, 3
mov ax, word [ebp - 6]
call fcn.0049a7c8
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x49af98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
mov edi, edx
mov esi, eax
push 0x49b044
push 0x49b060
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x49b02e
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x49b02e
test al, 0x10
je 0x49afdf
mov ebp, 0x2000000
jmp 0x49afe1
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.00403efc
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebp, eax
cmp ebp, 0xffffffff
je 0x49b02e
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
jle 0x49b02e
cmp ebx, 0xff0
jge 0x49b02e
mov edx, edi
mov eax, esp
call fcn.0049aec4
jmp 0x49b037
mov eax, edi
mov edx, esi
call fcn.00403b0c
add esp, 0x1000
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49b070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x49b101
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ebx, eax
test ebx, ebx
jle 0x49b0d7
cmp ebx, 0x104
jge 0x49b0d7
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00403ce8
mov eax, dword [ebp - 0x108]
mov edx, esi
call fcn.0049af98
jmp 0x49b0e8
mov eax, 0x49b118
call fcn.00475418
mov eax, esi
call fcn.00403ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b108
lea eax, [ebp - 0x108]
call fcn.00403ab8
ret

Function at 0x49b12c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49b27b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0049af98
lea eax, [ebp - 0xc]
call fcn.0049b070
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402acc
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x49b288
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00403efc
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.00403efc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
call fcn.00403efc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x49b1d7
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x4c7
jne 0x49b1cd
call fcn.0040c38c
mov eax, 0x49b298
call fcn.00475364
cmp dword [ebp - 0x10], 0
jne 0x49b1e7
mov eax, 0x49b2b0
call fcn.00475210
xor edx, edx
push ebp
push 0x49b259
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0049acb8
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x49b1f5
cmp eax, 0xffffffff
jne 0x49b222
mov eax, 0x49b2dc
call fcn.00475364
call fcn.0049acb8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x49b242
mov eax, 0x49b300
call fcn.00475364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b260
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x49b314
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49b3e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x49ac5c]
call fcn.0049b3fc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49b3b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x49b3f4
call fcn.0040aa18
mov edx, dword [ebp - 8]
mov eax, dword [0x4bea64]
mov eax, dword [eax]
call fcn.0044a864
call fcn.0049acb8
call sub.user32.dll_GetFocus
mov edx, dword [0x4bea64]
mov edx, dword [edx]
cmp eax, dword [edx + 0x24]
jne 0x49b39c
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x49b3a3
call sub.user32.dll_WaitMessage
jmp 0x49b379
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b3c0
mov eax, dword [ebp - 4]
call fcn.00402e48
ret

Function at 0x49f854
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x49f85c
push ecx
push ebx
xor eax, eax
push ebp
push 0x49f9c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004758e4
mov edx, dword [ebp - 0x10]
mov eax, 0x4c0434
call fcn.00403b0c
lea eax, [ebp - 0x14]
mov ecx, dword [0x4c0434]
mov edx, 0x49f9d8
call fcn.00403d84
mov eax, dword [ebp - 0x14]
call fcn.00479788
mov eax, dword [0x4beb04]
cmp byte [eax], 0
je 0x49f8b7
mov eax, dword [0x4c0434]
call fcn.00478f38
lea edx, [ebp - 0x18]
mov eax, dword [0x4c0434]
call fcn.0044bec0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x49fa00
call fcn.00403d84
push 0
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x49f94d
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004731d0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00409ca8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.0044e218
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x60
call fcn.004731a0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x408a18]
call fcn.0040c3f4
call fcn.00403588
lea eax, [ebp - 0xc]
mov ecx, 0x49fa10
mov edx, dword [ebp - 4]
call fcn.00403d84
mov edx, dword [ebp - 0xc]
mov eax, 0x49fa28
call fcn.0049f7fc
lea eax, [ebp - 8]
call fcn.0047a490
cmp dword [ebp - 8], 0
je 0x49f99b
lea eax, [ebp - 0xc]
mov ecx, 0x49fa3c
mov edx, dword [ebp - 4]
call fcn.00403d84
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0049f7fc
mov eax, dword [ebp - 0xc]
call fcn.0047a4d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f9ca
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403adc
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403adc
ret
Function at 0x4a18c4
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x4c06c9], 1
call fcn.0047736c
test al, al
jne 0x4a1910
push 5
mov eax, dword [0x4bea64]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4bea64]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x4bea70]
mov eax, dword [eax + 0x108]
mov cl, 2
xor edx, edx
call fcn.004a17d0
ret

Function at 0x4a5b74
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x4a5ba0
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x4a5ba9
call fcn.004a4d94
mov eax, 0xa
call fcn.0044e5a4
call fcn.004a4d94
call fcn.004a5b40
test al, al
jne 0x4a5b7e
pop ebx
ret

Function at 0x4a6074
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x4be6e0]
cmp dword [eax], 0
je 0x4a611c
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
call fcn.0043338c
test al, al
je 0x4a611c
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
cmp byte [eax + 0x168], 0
je 0x4a60c6
cmp byte [ebx + 0x2e1], 0
jne 0x4a60c6
mov eax, dword [0x4bea64]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4a60ca
xor eax, eax
jmp 0x4a60cc
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
call fcn.00433090
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0x10000000
setne al
cmp bl, al
je 0x4a611c
test bl, bl
je 0x4a6108
push 5
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
call fcn.00433090
push eax
call sub.user32.dll_ShowWindow
jmp 0x4a611c
push 0
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
call fcn.00433090
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4a61cc
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x4c0684], 0
push 0x4a62a4
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4a62b4
push ebx
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x4a6258
lea edx, [esp + 4]
push edx
call eax
push 0x4a62c8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
test esi, esi
je 0x4a6262
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x4a6262
cmp dword [esp], 0
je 0x4a6262
call fcn.00474588
test al, al
je 0x4a6262
push 0x4a62d8
push ebx
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x4a6262
push 0x4a62f4
push 0x4a6304
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x4a6262
mov byte [0x4c0684], 1
jmp 0x4a6262
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ax, word [esp + 4]
sub ax, 1
jb 0x4a627b
sub ax, 5
je 0x4a6284
sub ax, 3
je 0x4a628d
jmp 0x4a6296
mov byte [0x4be24c], 1
jmp 0x4a629d
mov byte [0x4be24c], 3
jmp 0x4a629d
mov byte [0x4be24c], 2
jmp 0x4a629d
mov byte [0x4be24c], 0
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x4a6314
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x4a6384
mov edx, 0x80000002
xor eax, eax
call fcn.0044d8c4
test eax, eax
jne 0x4a637d
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4a63b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4a6374
cmp dword [ebp - 0xc], 4
jne 0x4a6374
cmp dword [ebp - 8], 4
jne 0x4a6374
mov ax, word [ebp - 0x10]
mov word [0x4c0698], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret

Function at 0x4a64f0
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffed0
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4a65a2
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x4c0694], eax
cmp byte [0x4c0683], 0
je 0x4a65a2
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4a6593
mov dword [esp + 0x94], 0x9c
lea eax, [esp + 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4a65a2
xor eax, eax
mov al, byte [esp + 0x128]
shl eax, 8
xor edx, edx
mov dl, byte [esp + 0x12a]
or ax, dx
mov word [0x4c0698], ax
mov al, byte [esp + 0x12e]
mov byte [0x4c069a], al
mov ax, word [esp + 0x12c]
mov word [0x4c069c], ax
jmp 0x4a65a2
cmp eax, 4
jne 0x4a65a2
call fcn.004a6314
call fcn.004a63bc
add esp, 0x130
ret