joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9a3c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x411390]
call fcn.00406194
xor eax, eax
push ebp
push 0x4a9bdd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5e4c9c], 0
jne 0x4a9a97
mov ecx, dword [0x5e7800]
mov dl, 1
mov eax, dword [0x40905c]
call fcn.0040f118
call fcn.00404f68
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b74
mov eax, ebx
call fcn.00405fe4
mov dword [ebp - 0x24], eax
mov esi, 0x4a9bec
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004073bc
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405ff4
test eax, eax
jle 0x4a9b80
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a9b6c
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004058a4
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4a9b12
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004058bc
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4a9b28
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004058bc
mov eax, dword [ebp - 0x54]
call fcn.00405ac4
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004058a4
mov eax, dword [ebp - 0x58]
call fcn.00405ac4
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4a9b6e
xor eax, eax
test al, al
je 0x4a9b79
mov ebx, 0x15
jmp 0x4a9b85
mov ebx, 0x10
jmp 0x4a9b85
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x5e4c9c]
call fcn.004a9860
mov eax, dword [ebp - 4]
call fcn.004a9860
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004073d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9be4
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405658
lea eax, [ebp - 0xc]
mov edx, dword [0x411390]
call fcn.00406264
ret
Function at 0x4bef1c
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4bef34
add esp, 0xfffffff0
call fcn.00404a18
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4bf0bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [edi + 4]
mov edx, esi
call fcn.00405688
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040b0b8
mov edx, dword [ebp - 4]
lea eax, [edi + 8]
mov ecx, 0x4bf0ec
call fcn.0040594c
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040b0b8
mov edx, dword [ebp - 8]
lea eax, [edi + 0xc]
mov ecx, 0x4bf100
call fcn.0040594c
mov dl, 1
mov eax, dword [0x41ac9c]
call fcn.00404684
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x41ac9c]
call fcn.00404684
mov dword [edi + 0x1c], eax
mov dl, 1
mov eax, dword [0x41ac9c]
call fcn.00404684
mov dword [edi + 0x18], eax
mov dl, 1
mov eax, dword [0x41ac9c]
call fcn.00404684
mov dword [edi + 0x20], eax
mov dl, 1
mov eax, dword [0x41ac9c]
call fcn.00404684
mov dword [edi + 0x24], eax
mov dl, 1
mov eax, dword [0x41ac9c]
call fcn.00404684
mov dword [edi + 0x28], eax
mov dl, 1
mov eax, dword [0x41ac9c]
call fcn.00404684
mov dword [edi + 0x2c], eax
mov byte [edi + 0x44], 0
xor eax, eax
mov dword [edi + 0x40], eax
mov eax, dword [0x5e78fc]
mov eax, dword [eax]
call fcn.00405ac4
push eax
push 0
push 0x4bf10c
push 0x4bf114
call sub.kernel32.dll_GetPrivateProfileIntA
mov esi, eax
mov eax, esi
cdq
push edx
push eax
call fcn.0040cffc
call fcn.004035bc
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
test edx, edx
jge 0x4bf03b
neg eax
adc edx, 0
neg edx
cmp edx, 0
jne 0x4bf047
cmp eax, 0xf
jb 0x4bf09e
jmp 0x4bf049
jl 0x4bf09e
mov eax, dword [edi + 8]
call fcn.00405ac4
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [edi + 0xc]
call fcn.00405ac4
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x5e78fc]
mov eax, dword [eax]
call fcn.00405ac4
push eax
call fcn.0040cffc
call fcn.004035bc
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0040a9c8
mov eax, dword [ebp - 0xc]
call fcn.00405ac4
push eax
push 0x4bf10c
push 0x4bf114
call sub.kernel32.dll_WritePrivateProfileStringA
mov eax, edi
mov edx, dword [eax]
call dword [edx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf0c6
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405658
ret

Function at 0x4c0bf4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403b74
ret
Function at 0x4d7df0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00462b30
test al, al
je 0x4d7e52
cmp bl, 7
jne 0x4d7e27
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x4d7e2c
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xe0]
test eax, eax
je 0x4d7e52
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xe0]
push edi
push 0
push 0x100f
push eax
call sub.user32.dll_SendMessageA
mov byte [esi + 0x268], bl
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4ddab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405ac4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4ddac9
test al, 0x10
jne 0x4ddacd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4ddad4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00405ab4
xor eax, eax
push ebp
push 0x4ddcc1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00403de0
mov edi, eax
lea eax, [ebp - 0x178]
xor ecx, ecx
mov edx, 0x160
call fcn.00403b74
cmp dword [ebp + 0x20], 0
je 0x4ddb8f
cmp dword [ebp - 0x10], 0
je 0x4ddb8f
mov eax, dword [ebp + 0x20]
call fcn.0040ae1c
test al, al
jne 0x4ddb45
mov eax, dword [ebp + 0x20]
call fcn.004ddab0
test al, al
je 0x4ddb68
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405ac4
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x4ddb89
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405ac4
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x4ddbb6
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x4ddcd4
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x4ddbd5
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x4ddcd4
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0041b908
test bl, bl
je 0x4ddc15
cmp byte [ebp + 0x14], 0
jne 0x4ddc15
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00432068
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x4ddcab
mov dl, 1
mov eax, dword [0x42f834]
call fcn.0043686c
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.00436e40
call fcn.00432068
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.004035b0
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.004035b0
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.004dd9d4
mov eax, ebx
call fcn.004046b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddcc8
lea eax, [ebp + 0x20]
call fcn.00405634
ret

Function at 0x4e7004
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405ac4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4e701d
test al, 0x10
jne 0x4e7021
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4e7028
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00405ab4
xor eax, eax
push ebp
push 0x4e7215
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00403de0
mov edi, eax
lea eax, [ebp - 0x178]
xor ecx, ecx
mov edx, 0x160
call fcn.00403b74
cmp dword [ebp + 0x20], 0
je 0x4e70e3
cmp dword [ebp - 0x10], 0
je 0x4e70e3
mov eax, dword [ebp + 0x20]
call fcn.0040ae1c
test al, al
jne 0x4e7099
mov eax, dword [ebp + 0x20]
call fcn.004e7004
test al, al
je 0x4e70bc
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405ac4
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x4e70dd
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405ac4
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x4e710a
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x4e7228
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x4e7129
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x4e7228
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0041b908
test bl, bl
je 0x4e7169
cmp byte [ebp + 0x14], 0
jne 0x4e7169
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00432068
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x4e71ff
mov dl, 1
mov eax, dword [0x42f834]
call fcn.0043686c
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.00436e40
call fcn.00432068
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.004035b0
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.004035b0
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.004e6f28
mov eax, ebx
call fcn.004046b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e721c
lea eax, [ebp + 0x20]
call fcn.00405634
ret
Function at 0x4eeac0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x4eeadc
cmp dword [esi + 4], 0
je 0x4eeb09
test byte [ebx + 0x55], 1
jne 0x4eeafb
mov eax, ebx
call fcn.0045e664
test eax, eax
jne 0x4eeafb
mov edx, esi
mov eax, ebx
call fcn.00444dc0
jmp 0x4eec19
mov edx, esi
mov eax, ebx
call fcn.0045fe28
jmp 0x4eec19
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4eec12
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00462790
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0045b938
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004eeac0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00462790
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eec19
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f2f54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00431b4c
cmp ebx, dword [ebp - 8]
jge 0x4f2fb7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00431fcc
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00431fcc
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00431ff8
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4f2f7d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4f2fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00431b4c
cmp ebx, dword [ebp - 8]
jge 0x4f3023
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00431fcc
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00431fcc
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00431ff8
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4f2fe9
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4f5444
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f54fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405ac4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4f5486
call fcn.00405014
jmp 0x4f5502
mov eax, ebx
call fcn.00402fc4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00405ac4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4f54af
call fcn.00405014
jmp 0x4f5502
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4f5510
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4f54d0
call fcn.00405014
jmp 0x4f5502
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5502
mov eax, dword [ebp - 8]
call fcn.00402fe0
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f575c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f57c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00403b74
test ebx, ebx
jne 0x4f5799
mov word [ebp - 2], 0
lea ebx, [ebp - 2]
or esi, 0x4008
push esi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f57d0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f5ab0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
push 0x4f5c5c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4f5c54
xor eax, eax
push ebp
push 0x4f5c4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 6], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x4f5c68
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
test esi, esi
jne 0x4f5b28
push 0x4009
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x4f5c68
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
test edi, edi
jne 0x4f5b69
push 0x4008
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.00429ddc
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.00429ddc
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.00429ddc
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.00429ddc
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x5e5a10], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5c54
cmp dword [ebp - 4], 0
je 0x4f5c4c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f5c6c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov ebx, eax
call fcn.004f5438
test al, al
je 0x4f5c99
cmp dword [0x5efeb4], 0x40047
jl 0x4f5c99
cmp byte [0x5e5a10], 0
jne 0x4f5c99
call fcn.004f5ab0
mov esi, ebx
and esi, 0x7f
mov eax, dword [esi*4 + 0x5e5a14]
or eax, 0x4000
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
push 0x4f5cfc
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
jne 0x4f5cf1
mov word [esp], 0
mov eax, dword [esi*4 + 0x5e5a14]
or eax, 0x4000
or eax, 8
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x4fdbdc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4fdbe4
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fdd31
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x4fdc3a
lea edx, [ebp - 4]
mov eax, dword [0x5e78e0]
call fcn.004078b8
cmp ebx, 1
jbe 0x4fdc71
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4fdd48
call fcn.0040beb0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405900
jmp 0x4fdc71
lea eax, [ebp - 4]
mov edx, 0x4fdd58
call fcn.004056cc
cmp ebx, 1
jbe 0x4fdc71
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4fdd68
call fcn.0040beb0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00405900
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.0040594c
mov eax, dword [ebp - 0x18]
call fcn.00405ac4
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4fdcf9
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
jne 0x4fdca9
mov bl, 1
jmp 0x4fdd09
push 0
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0040e818
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x5e7e50]
call fcn.004078b8
mov eax, dword [ebp - 0x24]
mov ecx, 1
pop edx
call fcn.004f6a98
mov eax, dword [ebp - 0x1c]
movzx ecx, word [0x4fdd6c]
xor edx, edx
call fcn.0044aef4
mov bl, 2
jmp 0x4fdd09
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 4]
call fcn.00405688
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdd38
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00405658
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405658
ret

Function at 0x4fe3ac
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, ecx
mov esi, eax
test edx, 0x40000000
jne 0x4fe3ce
mov edx, ebx
mov eax, dword [0x5e7e4c]
call fcn.004078b8
jmp 0x4fe405
push 0x408
push 0x160
lea eax, [esp + 8]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4fe3fe
mov eax, ebx
lea edx, [esp + 0x110]
mov ecx, 0x50
call fcn.004058a4
jmp 0x4fe405
mov eax, ebx
call fcn.00405634
add esp, 0x160
pop esi
pop ebx
ret