joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479de0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0040cedc
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.00479d08
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4a
mov eax, dword [0x49f0e8]
push eax
call sub.user32.dll_SendMessageA
mov ebx, eax
mov eax, esi
call fcn.0042e814
cmp ebx, 0x6c840001
jne 0x479e30
call fcn.00409090
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x6c830000
je 0x479e54
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x479f04
call fcn.00453b9c
mov word [ebp - 6], bx
xor esi, esi
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x479eac
mov ebx, eax
mov edx, 1
mov ax, word [ebp - 6]
call fcn.00479d64
mov esi, eax
mov eax, esi
sub ax, 2
je 0x479eac
dec eax
sub ax, 2
jb 0x479ec0
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x479f38
call fcn.00453b9c
push 0xff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x479e61
mov edx, 2
mov ax, word [ebp - 6]
call fcn.00479d64
movzx ebx, ax
mov edx, 3
mov ax, word [ebp - 6]
call fcn.00479d64
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x47a4e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
mov edi, edx
mov esi, eax
push 0x47a590
push 0x47a5ac
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x47a57a
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x47a57a
test al, 0x10
je 0x47a52b
mov ebp, 0x2000000
jmp 0x47a52d
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebp, eax
cmp ebp, 0xffffffff
je 0x47a57a
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
jle 0x47a57a
cmp ebx, 0xff0
jge 0x47a57a
mov edx, edi
mov eax, esp
call fcn.0047a40c
jmp 0x47a583
mov eax, edi
mov edx, esi
call fcn.00403494
add esp, 0x1000
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47a5bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47a64e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ebx, eax
test ebx, ebx
jle 0x47a624
cmp ebx, 0x104
jge 0x47a624
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.0040355c
mov eax, dword [ebp - 0x108]
mov edx, esi
call fcn.0047a4e4
jmp 0x47a635
mov eax, 0x47a664
call fcn.00453d50
mov eax, esi
call fcn.00403400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a655
lea eax, [ebp - 0x108]
call fcn.00403400
ret

Function at 0x47a678
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47a7c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0047a4e4
lea eax, [ebp - 0xc]
call fcn.0047a5bc
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x47a7d4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00403738
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
call fcn.00403738
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x47a724
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x4c7
jne 0x47a71a
call fcn.00409070
mov eax, 0x47a7e4
call fcn.00453c98
cmp dword [ebp - 0x10], 0
jne 0x47a734
mov eax, 0x47a7fc
call fcn.00453b40
xor edx, edx
push ebp
push 0x47a7a4
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0047a204
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x47a742
inc eax
jne 0x47a76d
mov eax, 0x47a828
call fcn.00453c98
call fcn.0047a204
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x47a78d
mov eax, 0x47a84c
call fcn.00453c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a7ab
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x47a860
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47a92b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x47a1f4
call fcn.0047a94c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47a904
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x47a944
call fcn.00407d84
mov edx, dword [ebp - 8]
mov eax, dword [0x49e62c]
call fcn.00424754
call fcn.0047a204
call sub.user32.dll_GetFocus
mov edx, dword [0x49e62c]
cmp eax, dword [edx + 0x20]
jne 0x47a8e7
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x47a8ee
call sub.user32.dll_WaitMessage
jmp 0x47a8c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a90b
mov eax, dword [ebp - 4]
call fcn.00402b58
ret

Function at 0x47edd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x47edd8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47ef26
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00454220
mov edx, dword [ebp - 0x10]
mov eax, 0x49f190
call fcn.00403450
mov edx, 0x47ef3c
lea eax, [ebp - 0x10]
call fcn.00403494
lea eax, [ebp - 0x10]
mov edx, dword [0x49f190]
call fcn.0040357c
mov eax, dword [ebp - 0x10]
call fcn.004585a0
cmp byte [0x49f010], 0
je 0x47ee3b
mov eax, dword [0x49f190]
call fcn.00457d98
lea edx, [ebp - 0x10]
mov eax, dword [0x49f190]
call fcn.0042c88c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x47ef64
call fcn.004035c0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x47eecd
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.00451c30
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004071f8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0042ed58
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
mov al, 0x68
call fcn.00451c00
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, 0x406890
call fcn.0040909c
call fcn.0040311c
lea eax, [ebp - 8]
call fcn.00458ca0
cmp dword [ebp - 8], 0
je 0x47eefe
lea eax, [ebp - 0xc]
mov ecx, 0x47ef74
mov edx, dword [ebp - 4]
call fcn.004035c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0047ed78
mov eax, dword [ebp - 0xc]
call fcn.00458ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ef2d
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403420
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403420
ret
Function at 0x481308
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x49f48d], 1
call fcn.00455e14
test al, al
jne 0x48134a
push 5
mov eax, dword [0x49e62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x49e62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov cl, 2
xor edx, edx
mov eax, dword [0x49ed78]
call fcn.00481214
ret

Function at 0x485810
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x48583c
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x485845
call fcn.00484868
mov eax, 0xa
call fcn.0042f104
call fcn.00484868
call fcn.004857dc
test al, al
jne 0x48581a
pop ebx
ret

Function at 0x485cfc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x49f0ac], 0
je 0x485d93
mov eax, dword [0x49f0ac]
call fcn.00418808
test al, al
je 0x485d93
mov eax, dword [0x49f0ac]
cmp byte [eax + 0xc7], 0
je 0x485d43
cmp byte [ebx + 0x1b9], 0
jne 0x485d43
mov eax, dword [0x49e62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x485d47
xor eax, eax
jmp 0x485d49
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x49f0ac]
call fcn.00418670
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0x10000000
setne al
cmp bl, al
je 0x485d93
test bl, bl
je 0x485d81
push 5
mov eax, dword [0x49f0ac]
call fcn.00418670
push eax
call sub.user32.dll_ShowWindow
jmp 0x485d93
push 0
mov eax, dword [0x49f0ac]
call fcn.00418670
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x485e3c
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x49f446], 0
push 0x485f24
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x485f34
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x485ec8
lea edx, [esp + 4]
push edx
call eax
push 0x485f48
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x485ed2
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x485ed2
cmp dword [esp], 0
je 0x485ed2
call fcn.00452ef4
test al, al
je 0x485ed2
push 0x485f58
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x485ed2
push 0x485f74
push 0x485f84
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x485ed2
mov byte [0x49f446], 1
jmp 0x485ed2
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ax, word [esp + 4]
sub ax, 1
jb 0x485ef1
sub ax, 5
je 0x485efa
sub ax, 3
je 0x485f03
sub ax, 3
je 0x485f0c
jmp 0x485f15
mov byte [0x49cc98], 1
jmp 0x485f1c
mov byte [0x49cc98], 3
jmp 0x485f1c
mov byte [0x49cc98], 2
jmp 0x485f1c
mov byte [0x49cc98], 4
jmp 0x485f1c
mov byte [0x49cc98], 0
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x485f94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x486004
mov edx, 0x80000002
xor eax, eax
call fcn.0042e2ac
test eax, eax
jne 0x485ffd
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x486030
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x485ff4
cmp dword [ebp - 0xc], 4
jne 0x485ff4
cmp dword [ebp - 8], 4
jne 0x485ff4
mov ax, word [ebp - 0x10]
mov word [0x49f45c], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret

Function at 0x486178
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffed0
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x48622a
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x49f458], eax
cmp byte [0x49f445], 0
je 0x48622a
mov eax, dword [esp + 4]
cmp eax, 5
jl 0x48621b
mov dword [esp + 0x94], 0x9c
lea eax, [esp + 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x48622a
xor eax, eax
mov al, byte [esp + 0x128]
shl eax, 8
xor edx, edx
mov dl, byte [esp + 0x12a]
or ax, dx
mov word [0x49f45c], ax
mov al, byte [esp + 0x12e]
mov byte [0x49f45e], al
mov ax, word [esp + 0x12c]
mov word [0x49f460], ax
jmp 0x48622a
cmp eax, 4
jne 0x48622a
call fcn.00485f94
call fcn.0048603c
add esp, 0x130
ret
Function at 0x49067c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x49081d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
mov ecx, 0x200
xor edx, edx
call fcn.004034e0
push 0
xor eax, eax
mov al, byte [ebp + 8]
mov eax, dword [eax*4 + 0x49d120]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.0042e2ac
test eax, eax
jne 0x490802
xor edx, edx
push ebp
push 0x4907f7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
xor ecx, ecx
mov edx, dword [esi + 4]
call fcn.00436fcc
xor ebx, ebx
mov eax, dword [ebp - 0x10]
call fcn.00403574
mov dword [ebp - 0x18], eax
cmp byte [ebp + 8], 0
je 0x490734
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
jmp 0x490753
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumValueA
sub eax, 1
jb 0x4907a1
sub eax, 0xe9
je 0x490766
sub eax, 0x19
je 0x4907e0
jmp 0x49079a
mov eax, dword [ebp - 0x10]
call fcn.00403574
cmp eax, 0x10000
jl 0x49077f
call fcn.004031bc
jmp 0x490802
mov eax, dword [ebp - 0x10]
call fcn.00403574
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.004034e0
jmp 0x490702
call fcn.004031bc
jmp 0x490802
lea ecx, [ebx + 1]
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.00436fcc
lea eax, [ebp - 0x10]
call fcn.00403744
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.004034e0
lea ecx, [ebp - 0x24]
mov eax, esi
mov edx, ebx
call fcn.004439ec
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
call fcn.00435f1c
inc ebx
jmp 0x490702
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4907fe
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490824
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403420
ret
Function at 0x49920c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4992af
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4992c8
push ebx
push 0x4992d4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403634
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402934
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x49928d
mov eax, dword [0x49edfc]
call fcn.00499164
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4992b6
lea eax, [ebp - 4]
call fcn.00403400
ret
Function at 0x499abc
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x499c8d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0042dea8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004540b8
test al, al
jne 0x499b23
xor eax, eax
push ebp
push 0x499b19
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.0045452c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x499b23
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
mov eax, dword [0x49f540]
call fcn.00403738
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x499b4c
mov eax, dword [0x49edf8]
call fcn.00499164
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
mov eax, dword [0x49e014]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x499c9c
push 0x499ca0
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 8], eax
push 0x499314
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongA
mov dword [0x49f56c], eax
xor eax, eax
push ebp
push 0x499c60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x49e62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0042d8dc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x499cb0
call fcn.00407d84
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
call fcn.0042d7bc
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0040357c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0049920c
mov dword [ebp - 0xc], eax
call fcn.004992d8
test al, al
jne 0x499c40
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x499c20
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499c67
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x499e98
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], eax
mov ecx, 7
lea eax, [ebp - 0x2c]
mov edx, 0x40107c
call fcn.00403980
xor eax, eax
push ebp
push 0x49a784
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x49f558], 0
je 0x499edc
xor eax, eax
call fcn.0048099c
mov byte [ebp - 1], 0
mov eax, dword [0x49f458]
shr eax, 0x10
cmp eax, 0x600
setge byte [0x49f44f]
xor edx, edx
push ebp
push 0x49a6e1
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x49f568], 0
je 0x499f17
mov dl, 1
mov eax, dword [0x49f568]
call fcn.004579e4
cmp byte [0x49f556], 0
je 0x499f84
xor eax, eax
push ebp
push 0x499f57
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49f55c], 0
jne 0x499f43
mov eax, 0x49a79c
call fcn.0045838c
jmp 0x499f4d
mov eax, dword [0x49f55c]
call fcn.00458544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x499f84
mov eax, 0x49a7d8
call fcn.004585a0
mov edx, 0x49a80c
lea eax, [ebp - 0x30]
call fcn.00403494
lea eax, [ebp - 0x30]
mov edx, dword [0x49f540]
call fcn.0040357c
mov eax, dword [ebp - 0x30]
call fcn.004585a0
mov edx, 0x49a830
lea eax, [ebp - 0x30]
call fcn.00403494
lea eax, [ebp - 0x30]
mov edx, dword [0x49f544]
call fcn.0040357c
mov eax, dword [ebp - 0x30]
call fcn.004585a0
mov edx, 0x49a848
lea eax, [ebp - 0x30]
call fcn.00403494
lea eax, [ebp - 0x34]
call fcn.0042d7bc
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
call fcn.0040357c
mov eax, dword [ebp - 0x30]
call fcn.004585a0
call fcn.00480a38
xor eax, eax
call fcn.00499870
mov dword [0x49f54c], eax
mov dl, 1
mov eax, 0x498e0c
call fcn.0045a9d8
mov dword [0x49d134], eax
mov ecx, dword [0x49f544]
mov edx, dword [0x49f54c]
mov eax, dword [0x49d134]
call fcn.0045cfd8
lea ecx, [ebp - 0x30]
mov eax, dword [0x49d134]
mov edx, dword [eax + 0x18]
mov al, 0xb7
call fcn.00451c30
mov edx, dword [ebp - 0x30]
mov eax, 0x49f550
call fcn.00403450
mov eax, dword [0x49d134]
test byte [eax + 0x1d], 0x20
je 0x49a090
cmp byte [0x49f446], 0
jne 0x49a090
push 1
push 1
mov eax, dword [0x49f550]
call fcn.00403738
push eax
mov eax, dword [0x49ef50]
call fcn.00403738
mov ecx, 0x30
pop edx
call fcn.00481128
call fcn.00409070
mov eax, dword [0x49d134]
test byte [eax + 0x1d], 1
je 0x49a0cd
call fcn.0042e748
test al, al
jne 0x49a0cd
push 1
push 1
mov eax, dword [0x49f550]
call fcn.00403738
push eax
mov eax, dword [0x49ee30]
call fcn.00403738
mov ecx, 0x30
pop edx
call fcn.00481128
call fcn.00409070
invalid
dec esp
cmc
Function at 0x49abe0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49ae45
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x49ae5c
mov eax, dword [0x49e62c]
call fcn.00424754
push 5
mov eax, dword [0x49e62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x49ae11
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00481550
lea eax, [ebp - 0x10]
call fcn.0042dd54
mov eax, dword [ebp - 0x10]
call fcn.00407738
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0042d8dc
mov edx, dword [ebp - 0x10]
mov eax, 0x49f540
call fcn.00403450
call fcn.004994b4
lea ecx, [ebp - 0x10]
mov edx, 0x49ae70
mov eax, dword [0x49f540]
call fcn.0042c988
mov edx, dword [ebp - 0x10]
mov eax, 0x49f544
call fcn.00403450
lea ecx, [ebp - 0x10]
mov edx, 0x49ae80
mov eax, dword [0x49f540]
call fcn.0042c988
mov edx, dword [ebp - 0x10]
mov eax, 0x49f548
call fcn.00403450
push 2
push 0
push 1
mov ecx, dword [0x49f540]
mov dl, 1
mov eax, 0x450ca8
call fcn.00450f04
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ad28
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x18]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.00450ec8
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.00450ea0
cmp dword [ebp - 0xc], 0x67734d49
je 0x49ad03
mov cl, 1
xor edx, edx
mov eax, dword [0x49f548]
call fcn.00451d88
jmp 0x49ad12
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x49f540]
call fcn.00451d88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ad2f
mov eax, dword [ebp - 4]
call fcn.00402b58
ret