joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a830c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp + 8]
je 0x4a83a8
push 0
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 1
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 2
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x4a8441
push 0x5dcb82
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetWindowTextA
push 0
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 1
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 2
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.004013d8
add esp, 8
pop ebx
pop ebp
ret
Function at 0x4a90ac
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x549ca8], 0
jne 0x4a90c7
test byte [0x519f48], 2
jne 0x4a90c7
test byte [0x519f48], 1
je 0x4a90cd
mov eax, 1
ret
mov edx, dword [0x519085]
cmp edx, 0xebc
jne 0x4a90e1
mov eax, 1
ret
mov edx, dword [0x515328]
push edx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4a90f7
mov eax, 1
ret
mov dl, byte [0x5186a1]
test dl, dl
je 0x4a9107
mov eax, 1
ret
mov edx, dword [0x5168dc]
test edx, edx
je 0x4a9138
xor ecx, ecx
mov dword [0x5168dc], ecx
mov byte [0x5f7802], 0
mov byte [0x5f7982], 0
mov byte [0x5f79c2], 0
call fcn.004a940c
call fcn.00467594
mov eax, dword [0x5168d4]
test eax, eax
je 0x4a915d
push 0
call fcn.00441274
pop ecx
push 5
mov edx, dword [0x515334]
push edx
call sub.USER32.dll_ShowWindow
mov eax, 1
ret
mov dword [0x5168d4], 1
push 0
call fcn.00441274
pop ecx
push 0
push 0
mov edx, dword [0x515330]
push edx
push 0x599738
call fcn.0040d768
add esp, 0x10
mov eax, 1
ret

Function at 0x4a97b8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb80
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x17f
lea eax, [ebp - 0x180]
push eax
push esi
push ebx
call sub.USER32.dll_GetDlgItemTextA
push 0x17f
lea edx, [ebp - 0x300]
push edx
push edi
push ebx
call sub.USER32.dll_GetDlgItemTextA
push 0x5dcbd5
push esi
push ebx
call sub.USER32.dll_SetDlgItemTextA
push 0x5dcbd6
push edi
push ebx
call sub.USER32.dll_SetDlgItemTextA
lea ecx, [ebp - 0x480]
push ecx
lea eax, [ebp - 0x300]
push eax
lea edx, [ebp - 0x180]
push edx
call fcn.004a9474
add esp, 0xc
mov ebx, eax
mov eax, ebx
sub eax, 0xfffffffe
je 0x4a98b9
dec eax
je 0x4a9849
add eax, 0xfffffffe
sub eax, 2
jb 0x4a98fc
jmp 0x4a9901
mov byte [0x5168d8], 1
push 0x5dcbd7
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [0x515334]
push ecx
call sub.USER32.dll_SetDlgItemTextA
push 5
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [0x515334]
push edx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x88b8
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [0x515334]
push eax
call sub.USER32.dll_SetTimer
test byte [0x514ff0], 0x40
je 0x4a98b5
lea edx, [ebp - 0x180]
push edx
push 0x5dcbfd
push 0x514ff4
call fcn.00451068
add esp, 0xc
xor eax, eax
jmp 0x4a9903
mov byte [0x5168d8], 1
lea edx, [ebp - 0x480]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [0x515334]
push eax
call sub.USER32.dll_SetDlgItemTextA
test byte [0x514ff0], 0x40
je 0x4a98f8
lea edx, [ebp - 0x180]
push edx
push 0x5dcc14
push 0x514ff4
call fcn.00451068
add esp, 0xc
xor eax, eax
jmp 0x4a9903
call fcn.004a91cc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a9a28
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb58
mov eax, 0x599fd0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004cfcb8
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
mov ecx, dword [0x519085]
cmp ecx, 0xebc
jne 0x4a9a75
call fcn.00467594
call fcn.004a940c
mov al, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4a9bdf
push ebx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4a9ab5
push 0x400
lea ecx, [ebp - 0x428]
push ecx
push ebx
call sub.USER32.dll_GetWindowTextA
test byte [0x514ff0], 0x40
je 0x4a9afc
lea eax, [ebp - 0x428]
push eax
push 0x5dcc2a
push 0x514ff4
call fcn.00451068
add esp, 0xc
jmp 0x4a9afc
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [0x514ff0], 0x40
je 0x4a9afc
lea eax, [ebp - 0x428]
push eax
push 0x5dcc36
push 0x514ff4
call fcn.00451068
add esp, 0xc
lea edx, [ebp - 0x468]
lea ecx, [ebp - 0x428]
push edx
push 0x5dcc42
push ecx
call fcn.0041b8b4
add esp, 0xc
test al, al
jne 0x4a9b2c
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4a9bdf
lea ecx, [ebp - 0x4a8]
lea eax, [ebp - 0x428]
push ecx
push 0x5dcc47
push eax
call fcn.0041b8b4
add esp, 0xc
test al, al
jne 0x4a9b5c
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4a9bdf
lea ecx, [ebp - 0x428]
push ecx
lea eax, [ebp - 0x4a8]
push eax
lea edx, [ebp - 0x468]
push edx
call fcn.004a9474
add esp, 0xc
dec eax
sub eax, 2
jb 0x4a9b81
jmp 0x4a9b8f
mov al, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4a9bdf
push 0x8400
lea ecx, [ebp - 0x428]
push ecx
push 0x5dcc4c
call fcn.0046733c
add esp, 0xc
mov word [ebp - 0x14], 0
jmp 0x4a9bd3
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x4b4]
mov esi, dword [ebp - 0x4b0]
mov ebx, dword [ebp - 0x4ac]
pop ebp
ret
Function at 0x4b9500
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, dword [ebp + 8]
inc byte [0x5c5090]
movsx eax, byte [0x5c5090]
cmp eax, 4
jle 0x4b9524
mov byte [0x5c5090], 1
movsx edx, byte [0x5c5090]
push edx
push 0x5e49ca
lea ecx, [ebp - 0x20]
push ecx
call fcn.004d1ac0
add esp, 0xc
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push 1
push eax
call fcn.00401260
push eax
call sub.USER32.dll_LoadImageA
mov esi, eax
push 0
push esi
push 0x170
push 0x2d3
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
push eax
call sub.USER32.dll_DestroyIcon
push 5
push 0x2f9
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
movsx eax, byte [0x5c5091]
push 0
push eax
push 0x402
push 0x2f9
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
inc byte [0x5c5091]
movsx edx, byte [0x5c5091]
cmp edx, 0x64
jle 0x4b95c1
mov byte [0x5c5091], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bce34
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
call fcn.00401270
mov edx, eax
sub edx, dword [0x5c57d4]
cmp edx, 0x1388
jae 0x4bce58
mov eax, 1
pop ebx
pop ebp
ret
mov dword [0x5c57d4], eax
call fcn.004bcdf8
mov ecx, dword [ebp + 0xc]
dec ecx
je 0x4bce73
dec ecx
je 0x4bce9a
dec ecx
je 0x4bceaa
dec ecx
je 0x4bceb8
jmp 0x4bceb8
push ebx
call fcn.0040f228
pop ecx
push 6
push ebx
call sub.USER32.dll_ShowWindow
push 0
call sub.USER32.dll_MessageBeep
push 9
push ebx
call sub.USER32.dll_ShowWindow
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4bceb8
push ebx
call fcn.0040f228
pop ecx
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4bceb8
push ebx
call fcn.0040f228
pop ecx
push 0
call sub.USER32.dll_MessageBeep
call fcn.004bce14
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x4c0e7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
cmp byte [ebp + 8], 0
je 0x4c0f07
push 0
push 0x2001
push 0x5e67d4
lea eax, [ebp - 0x104]
push eax
call fcn.004530bc
add esp, 0x10
mov dl, byte [ebp + 0xc]
test dl, dl
je 0x4c0ec3
push 0x5e67e0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004cd308
add esp, 8
jmp 0x4c0ed7
push 0x5e67ea
lea eax, [ebp - 0x104]
push eax
call fcn.004cd308
add esp, 8
test byte [0x514ff1], 2
je 0x4c0ef9
lea edx, [ebp - 0x104]
push edx
push 0x5e67f2
push 0x514ff4
call fcn.00451068
add esp, 0xc
push 5
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.dll_WinExec
mov esp, ebp
pop ebp
ret

Function at 0x4c4a28
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4c4a31
add esp, 4
mov eax, dword [ebp - 4]
lea eax, [ebp - 0x2000]
push ebx
mov ebx, dword [ebp + 8]
push 0x2000
push eax
push 0x3e7
push ebx
call sub.USER32.dll_GetDlgItemTextA
mov dl, byte [ebp - 0x2000]
test dl, dl
je 0x4c4a7a
push 0x5e71b7
lea ecx, [ebp - 0x2000]
push ecx
call fcn.004cd308
add esp, 8
push 0x5e71ba
lea eax, [ebp - 0x2000]
push eax
call fcn.004cd308
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x2000]
push ecx
call fcn.004cd308
add esp, 8
lea eax, [ebp - 0x2000]
push eax
push 0x3e7
push ebx
call sub.USER32.dll_SetDlgItemTextA
push 0
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x3e7
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x7c8
push ebx
call sub.USER32.dll_KillTimer
push 0
push 0xbb8
push 0x7c8
push ebx
call sub.USER32.dll_SetTimer
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c5a18
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc8
mov eax, 0x5c9181
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
call fcn.004cfcb8
mov dword [ebp - 0x28], 1
mov word [ebp - 0x14], 8
test byte [ebp + 0x15], 4
je 0x4c5c81
push esi
push edi
lea edi, [ebp - 0x130]
mov esi, 0x5c8e75
mov ecx, 0x41
lea eax, [ebp - 0x234]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov word [ebp - 0x14], 8
push esi
push edi
lea edi, [ebp - 0x234]
mov esi, 0x5c8f79
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [ebp - 0x338]
mov esi, 0x5c907d
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebp - 0x28], 0x65
push eax
push edi
call fcn.004c59d4
add esp, 8
mov dword [ebp - 0x28], 0x66
test byte [0x514ff1], 4
je 0x4c5ad6
lea edx, [ebp - 0x234]
push edx
push 0x5e7202
push 0x514ff4
call fcn.00451068
add esp, 0xc
mov dword [ebp - 0x28], 0x67
mov dword [ebp - 0x28], 0x68
push ebx
push esi
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0x5e720b
lea ecx, [ebp - 0x130]
push ecx
call fcn.004d1ac0
add esp, 0x14
lea eax, [ebp - 0x130]
push eax
lea edx, [ebp - 0x338]
push edx
call fcn.00475484
add esp, 8
mov dword [ebp - 0x28], 0x69
push ebx
push esi
call fcn.0044ca1c
add esp, 8
mov dword [ebp - 0x28], 0x6b
push 0x2100
lea ecx, [ebp - 0x234]
push ecx
call fcn.00405b9c
add esp, 8
test eax, eax
jne 0x4c5b71
test byte [0x514ff1], 4
je 0x4c5c81
lea eax, [ebp - 0x234]
push eax
push 0x5e721b
push 0x514ff4
call fcn.00451068
add esp, 0xc
jmp 0x4c5c81
mov dword [ebp - 0x28], 0xc9
push pe_nt_image_headers32
lea edx, [ebp - 0x338]
push edx
call fcn.00405b9c
add esp, 8
test eax, eax
je 0x4c5bbb
test byte [0x514ff1], 4
je 0x4c5c81
lea ecx, [ebp - 0x338]
push ecx
push 0x5e722b
push 0x514ff4
call fcn.00451068
add esp, 0xc
jmp 0x4c5c81
lea eax, [ebp - 0x338]
push eax
lea edx, [ebp - 0x234]
push edx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x4c5c1e
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x338]
push ecx
lea eax, [ebp - 0x234]
push eax
push 0x5e723c
lea edx, [ebp - 0x130]
push edx
call fcn.004d1ac0
add esp, 0x14
test byte [0x514ff1], 4
je 0x4c5c81
lea ecx, [ebp - 0x130]
push ecx
push 0x5e724a
push 0x514ff4
call fcn.00451068
add esp, 0xc
jmp 0x4c5c81
push 0xb
lea eax, [ebp - 0x234]
push eax
call fcn.00403da4
add esp, 8
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x4c5c43
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00403e78
pop ecx
test byte [0x514ff1], 4
je 0x4c5c65
lea eax, [ebp - 0x338]
push eax
push 0x5e725a
push 0x514ff4
call fcn.00451068
add esp, 0xc
mov edx, dword [ebp + 0x20]
push edx
lea edx, [ebp - 0x338]
mov ecx, dword [ebp + 0x1c]
push ecx
mov eax, dword [ebp + 0x18]
push eax
push edi
push edx
call fcn.004c85d4
add esp, 0x14
push ebx
push 0x5e7268
push 0x400
call fcn.00451148
add esp, 0xc
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4c5cd4
mov esp, ebp
mov edi, dword [ebp - 0x344]
mov esi, dword [ebp - 0x340]
mov ebx, dword [ebp - 0x33c]
pop ebp
ret
Function at 0x4c7070
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0046f7dc
pop ecx
test eax, eax
je 0x4c708a
mov eax, 1
pop ebx
pop ebp
ret
mov byte [0x5c9568], bl
xor edx, edx
mov dword [0x5c956c], edx
xor ecx, ecx
mov dword [0x5c9570], ecx
mov eax, dword [0x5c9564]
push eax
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4c70dd
push 5
mov edx, dword [0x5c9564]
push edx
call sub.USER32.dll_ShowWindow
push 0
push 0x12c
push 0x7c6
mov ecx, dword [0x5c9564]
push ecx
call sub.USER32.dll_SetTimer
mov eax, 1
pop ebx
pop ebp
ret
push 0
mov edx, dword [0x515310]
push 0
push edx
push 0x5c9574
call fcn.0040d768
add esp, 0x10
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x4c7c94
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4c7caf
push 0
call fcn.004c715c
pop ecx
push edi
call fcn.00475318
pop ecx
push edi
push 0x5e75ea
mov edx, dword [ebp + 0x10]
push edx
call fcn.004d1ac0
add esp, 0xc
push 0
push esi
call sub.USER32.dll_ShowWindow
xor ebx, ebx
push 0
push 0
push ebx
push esi
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4c7cfd
push 1
push edi
push ebx
call fcn.00452204
add esp, 0xc
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x4c7cd2
push 0x1c0001
push 0xd
push pe_nt_image_headers32
push esi
call sub.USER32.dll_SendMessageA
push 0x1c0001
push 0xd
push 0x102
push esi
call sub.USER32.dll_SendMessageA
push 0xc01c0001
push 0xd
push 0x101
push esi
call sub.USER32.dll_SendMessageA
push 1
push 1
push 0x111
push esi
call sub.USER32.dll_SendMessageA
push 2
call fcn.004d934c
pop ecx
push esi
call fcn.004c7bd4
pop ecx
push esi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4c7d7a
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4c7d67
call fcn.004c719c
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x4c7d76
push 0
call fcn.004c7510
pop ecx
xor eax, eax
jmp 0x4c7d7f
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c868c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call sub.USER32.dll_GetParent
mov ebx, eax
test ebx, ebx
jne 0x4c86aa
xor eax, eax
jmp 0x4c8754
push 0x40
lea edx, [ebp - 0x40]
push edx
push ebx
call sub.USER32.dll_GetClassNameA
test eax, eax
je 0x4c8724
lea eax, [ebp - 0x40]
mov edx, 0x5e7643
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4c8724
test cl, cl
je 0x4c86de
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4c8724
add eax, 2
add edx, 2
test cl, cl
jne 0x4c86c2
jne 0x4c8724
push 0x5e7658
push 0x5e764c
call sub.USER32.dll_FindWindowA
mov esi, eax
push esi
call sub.USER32.dll_GetParent
cmp ebx, eax
jne 0x4c8702
mov eax, 1
jmp 0x4c8754
push 0x5e766d
push 0x5e7661
call sub.USER32.dll_FindWindowA
mov esi, eax
push esi
call sub.USER32.dll_GetParent
cmp ebx, eax
jne 0x4c8724
mov eax, 1
jmp 0x4c8754
mov byte [ebp - 0x40], 0
push 0x3f
lea edx, [ebp - 0x40]
push edx
push ebx
call sub.USER32.dll_GetWindowTextA
push 0xb
push 0x5e7682
lea ecx, [ebp - 0x40]
push ecx
call fcn.004cd600
add esp, 0xc
test eax, eax
jne 0x4c8752
mov eax, 1
jmp 0x4c8754
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d35e4
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x4d3600
call fcn.004d3c24
jmp 0x4d366f
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x4d361c
call fcn.004d3c24
jmp 0x4d366f
cmp dword [0x62a618], 1
je 0x4d366d
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.004d76d8
pop ecx
cmp al, 0x41
jl 0x4d366d
cmp al, 0x5a
jg 0x4d366d
cmp byte [ebp - 0x107], 0x3a
jne 0x4d366d
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x4d366d
call fcn.004d3c24
jmp 0x4d366f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4d36b4
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4d36fa
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
je 0x4d36e8
cmp eax, dword [ebp + 0x10]
jle 0x4d3783
call fcn.004d8720
mov dword [eax], 8
xor eax, eax
jmp 0x4d37f0
cmp dword [0x62a618], 1
jne 0x4d373f
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x4d3783
xor eax, eax
jmp 0x4d37f0
call sub.KERNEL32.dll_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x4d377f
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.dll_GetFullPathNameA
jmp 0x4d3783
xor eax, eax
jmp 0x4d37f0
lea edx, [ebp - 0x10c]
push edx
call fcn.004cd3e4
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x4d37a4
call fcn.004d8720
mov dword [eax], 0x22
xor eax, eax
jmp 0x4d37f0
test edi, edi
jne 0x4d37c7
mov edx, dword [ebp + 0x10]
push edx
call fcn.004d7ff0
pop ecx
mov edi, eax
test eax, eax
jne 0x4d37c7
call fcn.004d8720
mov dword [eax], 8
xor eax, eax
jmp 0x4d37f0
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d3ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004d37f8
test byte [ebp + 0xd], 0xc0
jne 0x4d3ee4
mov eax, dword [0x5e9150]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4d3ef1
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4d3f1e
je 0x4d3f30
sub ecx, 0x100
je 0x4d3f3e
sub ecx, 0x100
je 0x4d3f45
sub ecx, 0x100
je 0x4d3f37
jmp 0x4d3f4c
sub ecx, 0x600
je 0x4d3f45
sub ecx, 0x100
je 0x4d3f30
jmp 0x4d3f4c
mov edi, 1
jmp 0x4d3f51
mov edi, 2
jmp 0x4d3f51
mov edi, 4
jmp 0x4d3f51
mov edi, 5
jmp 0x4d3f51
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4d3f78
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5e9728]
test al, 0x80
je 0x4d3f71
mov ebx, 0x80
jmp 0x4d3f8a
mov ebx, 1
jmp 0x4d3f8a
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4d3f8a
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4d3f9c
je 0x4d3fa5
dec eax
je 0x4d3fae
jmp 0x4d3fb7
mov dword [ebp - 4], 0x80000000
jmp 0x4d3fc6
mov dword [ebp - 4], 0x40000000
jmp 0x4d3fc6
mov dword [ebp - 4], 0xc0000000
jmp 0x4d3fc6
push 1
call fcn.004d3bb8
pop ecx
mov ebx, eax
jmp 0x4d40b2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4d3fe2
sub eax, 0x10
je 0x4d3fe9
sub eax, 0x10
je 0x4d3ff2
sub eax, 0x10
je 0x4d3ffb
jmp 0x4d3ffb
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4d4002
mov dword [ebp - 8], 1
jmp 0x4d4002
mov dword [ebp - 8], 2
jmp 0x4d4002
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4d406b
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4d4060
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x4d4060
add ebx, 0xffffffb2
push ebx
call fcn.004d3bb8
pop ecx
mov ebx, eax
jmp 0x4d40b2
mov edi, esi
push edi
call fcn.004d3e24
pop ecx
test eax, eax
je 0x4d407f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4d408b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004d38f8
add esp, 8
mov ebx, eax
inc eax
jne 0x4d40b2
push 4
call fcn.004d3bb8
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.004d382c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d82f0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x4d8788
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x5ea140], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4d8840
cmp byte [0x4dc062], 0
je 0x4d87fa
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.004d7680
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d87e3
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.004d7680
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d87e3
lea ebx, [ebp - 0x54]
jmp 0x4d87e4
inc ebx
call fcn.004d8740
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x4d8861
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5ea144
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004cd3e4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5ea147
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x4d8861
cmp dword [0x5ea140], 0xffffffff
je 0x4d8861
mov eax, dword [0x5ea140]
test eax, eax
je 0x4d8861
cmp byte [eax], 0
je 0x4d8861
push esi
push eax
call fcn.004d88f0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret