joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451280
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x51baa4]
cmp byte [eax + 0xc], 0
je 0x4513ed
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4513e6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [fcn.0051cbf0], 0
jne 0x4512d4
push 0x4513f4
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4513fc
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [fcn.0051cbf0], eax
cmp dword [0x518be8], 0
jne 0x4513cf
push 0x45140c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x518be8], eax
cmp dword [0x518be8], 0
je 0x4513cf
push 0x451418
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51cbf4], eax
push 0x451428
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51cbf8], eax
push 0x45143c
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51cbfc], eax
push 0x451454
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51cc00], eax
push 0x45146c
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51cc04], eax
push 0x451480
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51cc08], eax
push 0x451498
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51cc0c], eax
push 0x4514b0
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51cc10], eax
push 0x4514cc
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [fcn.0051cc14], eax
push 0x4514d8
mov eax, dword [0x518be8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51cc18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4513ed
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4555c8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040482c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x455617
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404a94
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45d4b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45d504]
test si, 4
je 0x45d4c8
or bl, 1
test si, 8
je 0x45d4d2
or bl, 4
test si, 1
je 0x45d4dc
or bl, 8
test si, 2
je 0x45d4e6
or bl, 0x10
test si, 0x10
je 0x45d4f0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45d4ff
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45d508
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45d540]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45d521
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45d530
or bl, 4
test esi, 0x20000000
je 0x45d53b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x463b44
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x463b56
add esp, 0xfffffff0
call fcn.00403de4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f30c
mov eax, dword [0x51b660]
mov dword [eax + 4], ebx
mov dword [eax], 0x463ee8
mov eax, dword [0x51b66c]
mov dword [eax + 4], ebx
mov dword [eax], 0x463ef4
mov eax, ebx
call fcn.00463f00
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x414cf4]
call fcn.00403a50
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x414cf4]
call fcn.00403a50
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x414cf4]
call fcn.00403a50
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x414cf4]
call fcn.00403a50
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x414cf4]
call fcn.00403a50
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4603c8
push eax
push 0
push 0
mov eax, dword [0x51b80c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x420dd4]
call fcn.004224a8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x420dd4]
call fcn.004224a8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x420dd4]
call fcn.004224a8
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004643f8
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46428c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46428c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46428c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x463c93
call fcn.00403e3c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x464070
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46421b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4641fc
mov dl, 1
mov eax, dword [0x415358]
call fcn.00403a50
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040482c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4641eb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004515e0
test al, al
je 0x4641de
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x46422c
lea eax, [ebp - 0x254]
call fcn.0040a57c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4641de
xor eax, eax
push ebp
push 0x4641d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x464264
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4641c0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a94
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4641c0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4641de
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4640e1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041990c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464222
lea eax, [ebp - 0x260]
call fcn.0040482c
ret

Function at 0x464b98
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x51cc34]
cmp byte [eax + 0xa5], 0
jne 0x464c09
cmp dword [0x51cc4c], 0
jne 0x464bca
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x464b54
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x51cc4c], eax
cmp dword [0x51cc48], 0
jne 0x464be5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x51cc48], eax
cmp dword [0x51cc50], 0
jne 0x464c09
push esp
push 0
push 0
push 0x464af8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x51cc50], eax
pop edx
ret
Function at 0x464d30
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x464d47
add esp, 0xfffffff0
call fcn.00403de4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f30c
mov eax, dword [0x51b7ec]
cmp word [eax + 2], 0
jne 0x464d6f
mov eax, dword [0x51b7ec]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046640c
mov eax, dword [0x51b8e0]
cmp word [eax + 2], 0
jne 0x464d89
mov eax, dword [0x51b8e0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00466604
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x414cf4]
call fcn.00403a50
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x414cf4]
call fcn.00403a50
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x421854]
call fcn.004294a8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x464f10
mov eax, dword [0x51b6cc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004298b4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x466b84
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x51b6cc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040de04
test eax, eax
je 0x464e7e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409e5c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040de2c
test eax, eax
je 0x464e92
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404a94
mov eax, dword [0x51b554]
cmp byte [eax], 0
jne 0x464ec6
mov eax, ebx
call fcn.00465038
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00466d60
mov eax, ebx
call fcn.004676a0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x464f06
call fcn.00403e3c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4652ac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x51cc34]
cmp dword [eax + 0x30], 0
je 0x465356
cmp dword [ebx + 0x94], 0
jne 0x465350
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46523c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x465350
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x465316
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x465350
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417548
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x465325
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x465e34
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x465e69
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040491c
jmp 0x465e76
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404880
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x466f3c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x466f7d
mov eax, esi
call fcn.0044ccd4
test al, al
je 0x466f7d
mov eax, dword [ebx + 0x84]
call fcn.0044c9d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x466f7d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044c9d0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x48f6f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x48f755
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x48f738
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00492030
mov eax, dword [ebp - 8]
call fcn.00491f94
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x48f73a
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f75c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404850
ret

Function at 0x48f764
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x48f830
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48f80b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x60]
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x48f7f0
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00492030
mov eax, dword [ebp - 0x10]
call fcn.00491f94
push eax
call sub.kernel32.dll_GetVolumeInformationA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x48f7f4
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f812
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x48fb8c
Capabilities:
Get file size

Disassembly:
push ebx
push ecx
push esp
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x48fba9
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x48fba9
xor ebx, ebx
jmp 0x48fbb2
mov eax, dword [esp]
mov edx, eax
neg eax
add ebx, eax
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x48fc68
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x51dea4
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x51b7e0]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x51b7e0]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x48fd88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x48fdb1
call fcn.0048fd68
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.0048fc68
inc dword [esi]
dec ebx
jne 0x48fd9a
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x49c6e8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
xor ebx, ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x168], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x49c7da
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4410
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x80
mov eax, dword [ebp - 4]
call fcn.00404cdc
push eax
call sub.shell32.dll_SHGetFileInfoA
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x54]
mov ecx, 0x50
call fcn.00404a94
cmp dword [ebp - 0x168], 0
jne 0x49c7a5
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 4]
call fcn.00409b3c
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.00408d40
mov edx, dword [ebp - 0x16c]
mov eax, ebx
mov ecx, 0x49c7f0
call fcn.00404b30
mov eax, ebx
mov ecx, 1
mov edx, 1
call fcn.00404d7c
jmp 0x49c7b4
mov eax, ebx
lea edx, [ebp - 0x54]
mov ecx, 0x50
call fcn.00404a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c7e1
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00404850
lea eax, [ebp - 4]
call fcn.0040482c
ret

Function at 0x49f3c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x49f488
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
test al, al
jne 0x49f3f7
cmp byte [esi + 0x45c], 0
je 0x49f3fd
mov byte [ebp - 5], 0
jmp 0x49f472
mov eax, dword [ebp - 4]
call fcn.004928dc
test al, al
jne 0x49f46e
mov byte [ebp - 5], 0
cmp word [esi + 0x3202], 0
je 0x49f450
lea eax, [ebp - 5]
push eax
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [esi + 0x3204]
call dword [esi + 0x3200]
cmp byte [ebp - 5], 0
je 0x49f472
push 0x80
mov eax, dword [ebp - 4]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x49f472
push 0x49f4a0
push 0x62b6
mov ecx, 0x49f4ac
mov edx, dword [ebp - 4]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x98]
jmp 0x49f472
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f48f
lea eax, [ebp - 4]
call fcn.0040482c
ret
Function at 0x4b927c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x140]
mov edx, 0x140
call fcn.00407ae0
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], 0x1ffff
mov dword [ebp - 0x138], 0x2ffff
mov dword [ebp - 0x130], 0x1fff
mov dword [ebp - 0x134], 0x52e5d0
lea eax, [ebp - 0x240]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x240]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x140]
push eax
call dword [fcn.005305d0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b94b8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b96e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
sub eax, 0x340
je 0x4b94ed
sub eax, 3
je 0x4b9520
jmp 0x4b96c1
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x45c], 0
jne 0x4b9516
push 0x80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SetFileAttributesA
xor ebx, ebx
jmp 0x4b96c6
mov ebx, 1
jmp 0x4b96c6
xor eax, eax
push ebp
push 0x4b96a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52e5c4]
cmp word [eax + 0x3ca], 0
je 0x4b9664
mov byte [ebp - 5], 1
mov eax, dword [0x52e5c4]
mov ebx, dword [eax + 0x438]
dec ebx
test ebx, ebx
jl 0x4b9693
inc ebx
xor esi, esi
mov eax, dword [0x52e5c4]
add eax, 0x460
push eax
lea eax, [ebp - 5]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx]
call fcn.00404a1c
mov ecx, dword [ebp - 0xc]
mov edi, dword [0x52e5c4]
mov edx, dword [0x52e5c4]
mov eax, dword [edi + 0x3cc]
call dword [edi + 0x3c8]
cmp byte [ebp - 5], 0
je 0x4b95aa
mov eax, dword [0x52e5c4]
mov edx, dword [eax]
call dword [edx + 0x40]
test al, al
je 0x4b95db
push 0x4b96fc
push 0x6795
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx]
call fcn.00404a1c
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [0x52e5c4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
jmp 0x4b9693
mov eax, dword [0x52e5c4]
cmp dword [eax + 0x460], 0
jne 0x4b9627
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x438]
dec eax
cmp esi, eax
jne 0x4b9627
push 0x4b96fc
push 0x679a
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx]
call fcn.00404a1c
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [0x52e5c4]
mov edi, dword [eax]
call dword [edi + 0x98]
jmp 0x4b965a
mov eax, dword [0x52e5c4]
cmp dword [eax + 0x460], 0
je 0x4b965a
xor ebx, ebx
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x460]
call fcn.00404cdc
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dword [edx + 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b96c6
inc esi
dec ebx
jne 0x4b955c
jmp 0x4b9693
push 0x4b96fc
push 0x62b6
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx]
call fcn.00404a1c
mov edx, dword [ebp - 0x18]
mov ecx, 0x4b9708
mov eax, dword [0x52e5c4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov ebx, 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b96c6
mov ebx, 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b96e8
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404850
ret
Function at 0x4b9e14
Capabilities:
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x18]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
dec eax
je 0x4b9e39
dec eax
je 0x4b9e66
dec eax
je 0x4b9e6f
jmp 0x4b9f66
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x31f9], 0
je 0x4b9f66
cmp dword [ebp - 4], 1
sbb edx, edx
inc edx
mov ecx, 0x80
mov eax, dword [0x52e5c4]
call fcn.004ba308
jmp 0x4b9f66
cmp dword [ebp - 0x18], 0
jmp 0x4b9f66
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x31f8], 0
je 0x4b9f07
push 3
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x3200]
call fcn.00404cdc
push eax
call sub.kernel32.dll_MoveFileExA
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x3210], 0
jne 0x4b9ebd
call fcn.004b9d7c
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x31d8], 0
jne 0x4b9ee8
push 0x80
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4b9f4f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4b9f4f
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x31d8], 0
jne 0x4b9f32
push 0x80
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4b9f4f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp dword [ebp - 4], 1
sbb edx, edx
inc edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
mov eax, dword [0x52e5c4]
call fcn.004ba308
pop edi
pop esi
mov esp, ebp
pop ebp
ret