joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4edb20
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x534448
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edx, ebx
mov byte [ebp - 0xd], 0
call fcn.004ee930
mov edx, dword [ebp + 0x10]
mov edi, eax
call fcn.004ee930
mov esi, eax
test edi, edi
je 0x4edc5b
test esi, esi
je 0x4edc5b
cmp dword [edi + 4], 0
jne 0x4edb8e
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004edd00
cmp dword [edi + 4], 0
je 0x4edc5b
cmp dword [esi + 4], 0
jne 0x4edc5b
mov edi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 0x34]
push eax
mov esi, ebx
call fcn.004ef7f0
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0x10]
push ecx
call fcn.004ef7f0
push esi
push edi
lea edx, [ebp - 0x1c]
push edx
mov byte [ebp - 4], 1
call fcn.004ef640
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4edbda
mov eax, 0x538640
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.004415d0
test al, al
je 0x4edc10
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x4edbf4
mov ecx, 0x538640
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4edc00
mov eax, 0x538640
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov bl, 1
test eax, eax
jne 0x4edc13
mov bl, byte [ebp - 0xd]
mov ecx, dword [ebp + 8]
push esi
push edi
push ecx
call fcn.004eda10
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004fc190
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004fc190
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.004fc190
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4edc80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, edi
mov esi, eax
xor bl, bl
call fcn.004ee930
mov esi, eax
test esi, esi
je 0x4edceb
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4edceb
push edi
call fcn.004ef510
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
push ecx
mov esi, edi
call fcn.004ef7f0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4edcce
mov eax, 0x538640
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4edcdb
mov bl, 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4edceb
push eax
call fcn.005134a7
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4f2660
Capabilities:
Get common file path

Disassembly:
mov eax, dword [edi + 0xd5c]
test eax, eax
je 0x4f26af
cmp dword [eax + 0x1c], 0xa0
push esi
jne 0x4f2686
mov al, 1
cmp byte [edi + 0x4e9], al
je 0x4f26ae
mov byte [edi + 0x4e9], al
jmp 0x4f2696
cmp byte [edi + 0x4e9], 0
je 0x4f26ae
mov byte [edi + 0x4e9], 0
push 0
lea ecx, [edi + 0xc8]
call fcn.00478110
lea eax, [edi + 0xc8]
call fcn.00476590
pop esi
cmp dword [edi + 0xd60], 0
je 0x4f26bf
mov ecx, edi
jmp fcn.004f2c60
ret
Function at 0x4f8f70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push esi
test ebx, ebx
jne 0x4f8f7e
mov ebx, dword [ebp + 0xc]
push edi
mov ecx, 0x53b7a8
call fcn.00466b30
push 0x5435b4
lea eax, [edi + 0x10]
call fcn.004fcf00
mov esi, dword [edi + 0x10]
test esi, esi
jne 0x4f8fa2
mov esi, 0x538640
xor edx, edx
cmp dword [edi + 8], edx
jle 0x4f8fcf
test esi, esi
je 0x4f8fcf
cmp word [esi], dx
je 0x4f8fcf
mov eax, dword [edi + 4]
test eax, eax
jne 0x4f8fbe
mov eax, 0x538640
push eax
push 0
push str.Height
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, eax
mov ecx, dword [ebp + 0x10]
mov eax, ecx
sub eax, edx
sub eax, dword [ebp + 0x14]
push ebx
cdq
sub eax, edx
mov esi, eax
mov eax, dword [ebp + 0xc]
sar esi, 1
add esi, dword [ebp + 0x14]
sub ecx, esi
push esi
mov dword [edi + 0x260], ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
push edi
call fcn.004f9610
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edx
push eax
push edi
call fcn.004f9890
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
push ecx
push edx
push edi
call fcn.004f9b20
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push eax
push ecx
push edi
call fcn.004f9db0
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4f90a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52be90
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x50]
xor ebx, ebx
cmp dword [ebp + 8], ebx
jl 0x4f91a9
cmp eax, ebx
je 0x4f90e6
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4f90f4
jmp 0x4f9114
mov eax, dword [edi + 0x4c]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x4c], 6
mov eax, dword [edi + 0x50]
cmp eax, ebx
je 0x4f9106
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4f9114
mov ecx, dword [edi + 0x4c]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0x4c], 6
push 0x753b
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x55a400
call fcn.00467b90
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x4f9143
mov eax, 0x538640
mov ecx, dword [ebp + 8]
push ecx
push eax
lea edx, [ebp - 0x18]
push str._s__d
push edx
call fcn.004fc310
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
cmp esi, ebx
jne 0x4f9167
mov eax, 0x538640
lea ecx, [edi + 0x20]
call fcn.004fe030
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x4f917f
push esi
call fcn.005134a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x4f91d6
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x4f91c8
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x4c]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0x4c], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f91f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52be90
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0xe0]
xor ebx, ebx
cmp dword [ebp + 8], ebx
jl 0x4f930e
cmp eax, ebx
je 0x4f9239
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4f924d
jmp 0x4f9276
mov eax, dword [edi + 0xdc]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0xdc], 6
mov eax, dword [edi + 0xe0]
cmp eax, ebx
je 0x4f9262
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4f9276
mov ecx, dword [edi + 0xdc]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0xdc], 6
push 0x754b
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x55a400
call fcn.00467b90
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x4f92a5
mov eax, 0x538640
mov ecx, dword [ebp + 8]
push ecx
push eax
lea edx, [ebp - 0x18]
push str._s__d
push edx
call fcn.004fc310
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
cmp esi, ebx
jne 0x4f92c9
mov eax, 0x538640
lea ecx, [edi + 0xb0]
call fcn.004fe030
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x4f92e4
push esi
call fcn.005134a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x4f9341
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x4f932d
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0xdc]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0xdc], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f9360
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52be90
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x170]
xor ebx, ebx
cmp dword [ebp + 8], ebx
jle 0x4f947e
cmp eax, ebx
je 0x4f93a9
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4f93bd
jmp 0x4f93e6
mov eax, dword [edi + 0x16c]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x16c], 6
mov eax, dword [edi + 0x170]
cmp eax, ebx
je 0x4f93d2
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4f93e6
mov ecx, dword [edi + 0x16c]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0x16c], 6
push 0x753d
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x55a400
call fcn.00467b90
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x4f9415
mov eax, 0x538640
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
push 0x5409d4
push ecx
call fcn.004fc310
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
cmp esi, ebx
jne 0x4f9439
mov eax, 0x538640
lea ecx, [edi + 0x140]
call fcn.004fe030
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x4f9454
push esi
call fcn.005134a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x4f94b1
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x4f949d
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [edi + 0x16c]
mov eax, dword [edx + 4]
mov dword [edi + eax + 0x16c], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f94d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528ce8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 1
mov eax, dword [edi + 0x200]
jle 0x4f95c8
test eax, eax
je 0x4f9517
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4f952b
jmp 0x4f9554
mov eax, dword [edi + 0x1fc]
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x1fc], 6
mov eax, dword [edi + 0x200]
test eax, eax
je 0x4f9540
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4f9554
mov ecx, dword [edi + 0x1fc]
mov eax, dword [ecx + 4]
mov dword [eax + edi + 0x1fc], 6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
lea ecx, [ebp - 0x18]
push str._d__d
push ecx
mov dword [ebp - 4], 0
call fcn.004fc310
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov eax, esi
test esi, esi
jne 0x4f9597
mov eax, 0x538640
lea ecx, [edi + 0x1d0]
call fcn.004fe030
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4f95fb
push esi
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x4f95e7
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [edi + 0x1fc]
mov eax, dword [edx + 4]
mov dword [edi + eax + 0x1fc], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4fae70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e1f4
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x70], eax
lea ecx, [eax + 0x23]
lea esi, [ebp - 0x28]
lea ebx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.004fd370
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004fce50
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
xor ebx, ebx
cmp eax, ebx
je 0x4faf01
push eax
call fcn.005134a7
add esp, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5388e8
call esi
push 0x5388e8
lea edi, [ebp - 0x1c]
call fcn.004fcc10
push 0x538f78
call esi
push 0x538f78
call fcn.004fcc10
xor ecx, ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
je 0x4faf79
cmp word [edi], bx
je 0x4faf79
push edi
lea eax, [ebp - 0x44]
call fcn.004fcf00
push 0x5c
lea esi, [ebp - 0x44]
call fcn.004fccc0
mov esi, str.BrCcDefSet.dat
lea eax, [ebp - 0x44]
call fcn.004fcfb0
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
jle 0x4faf9f
cmp ecx, ebx
jne 0x4faf89
mov ecx, 0x538640
push ecx
push 0x1388
push str.DevStatInterval
push str.TimeParam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x48]
push edx
mov dword [ecx + 0x43c], eax
mov byte [ebp - 4], 1
call fcn.00466a90
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], bl
call fcn.004fd2d0
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x4fafd5
push edi
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fb290
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e1b0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esi + 0x4c]
cmp edi, 2
jne 0x4fb2c8
push str.AdvDevStatus_Text
jmp 0x4fb2cd
push str.HomeDevStatus_Text
call fcn.004fcf00
push 0x2af8
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x55a400
call fcn.00467b90
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x4fb2fb
mov dword [ebp - 0x24], 0x538640
mov eax, dword [esi + 0x4c]
mov ecx, eax
cmp eax, ebx
jne 0x4fb309
mov ecx, 0x538640
xor eax, eax
cmp dword [esi + 0x44], ebx
jle 0x4fb333
cmp ecx, ebx
je 0x4fb333
cmp word [ecx], bx
je 0x4fb333
mov eax, dword [esi + 0x40]
cmp eax, ebx
jne 0x4fb325
mov eax, 0x538640
push eax
push ebx
push str.FontPoint
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov byte [ebp - 0x40], bl
mov ecx, 1
cmp edi, 2
jne 0x4fb34a
mov byte [ebp - 0x48], cl
mov edi, 0xffffff
jmp 0x4fb350
mov edi, dword [ebp - 0x44]
mov byte [ebp - 0x48], bl
push ebx
push ebx
mov ebx, dword [ebp + 8]
mov byte [esi + 0x248], cl
mov dword [esi + 0x11c], ecx
mov ecx, dword [ebp - 0x24]
push eax
push ecx
lea edx, [esi + 0xfc]
push edx
mov dword [esi + 0x120], 0x40024
call fcn.0046a1f0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [esi + 0x130], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x134], edi
mov dword [esi + 0x138], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esi + 0x13c], edx
mov dword [esi + 0x140], eax
push 0x7534
lea edx, [ebp - 0x18]
mov dword [esi + 0x144], ecx
push edx
mov ecx, 0x55a400
call fcn.00467b90
mov cl, 1
mov byte [ebp - 4], cl
mov eax, dword [ebp - 0x18]
xor ebx, ebx
cmp eax, ebx
jne 0x4fb3d5
mov eax, 0x538640
push eax
lea eax, [esi + 0x124]
mov byte [esi + 0x248], cl
call fcn.004fcf00
mov eax, dword [esi + 0x3d0]
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x4fb412
push eax
call fcn.005134a7
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x4fb429
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fd370
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528cb2
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x428], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea eax, [ebp - 0x420]
push eax
push edi
push edi
push ecx
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x424], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jl 0x4fd3e4
lea edx, [ebp - 0x420]
push edx
mov eax, esi
call fcn.004fcf00
jmp 0x4fd40d
cmp eax, 0x80070057
jne 0x4fd3f3
mov dword [ebx], 0x57
jmp 0x4fd40d
cmp eax, 1
je 0x4fd407
cmp eax, 0x80004005
je 0x4fd407
mov dword [ebx], 0x54f
jmp 0x4fd40d
mov dword [ebx], 3
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
Function at 0x5018f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
mov ecx, 0x18
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
dec ecx
jne 0x501902
mov eax, dword [0x55a3f8]
xor esi, esi
test eax, eax
je 0x50193b
push 0x80
push esi
push esi
push esi
push 0xc994
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
test esi, esi
jne 0x501945
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x55a3ec], eax
jmp 0x501945
mov dword [0x55a3ec], 0x57
lea eax, [ebp - 0x18]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp + 0xc]
push esi
mov dword [ecx], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [0x55a3f8]
test esi, esi
je 0x5019a0
push 2
push 0xc994
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x5019a0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5019a0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5036f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
cmp eax, 0x1811
jne 0x503749
mov eax, dword [esi + 0xb4]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x503715
push 0
push eax
call edi
jmp 0x503729
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0xb0], 6
mov eax, dword [esi + 0x360]
test eax, eax
jne 0x503785
mov edx, dword [esi + 0x35c]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x35c], 6
jmp 0x5037a0
cmp eax, 0x1812
jne 0x5037a0
mov eax, dword [esi + 0x360]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x503767
push 0
push eax
call edi
jmp 0x50377b
mov ecx, dword [esi + 0x35c]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x35c], 6
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x50378c
push 5
push eax
call edi
jmp 0x5037a0
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0xb0], 6
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 8]
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [esi + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebp
ret 0xc
Function at 0x5098f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x414]
mov esi, ebx
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x509933
movzx ecx, word [esi + eax]
test cx, cx
je 0x509933
mov word [eax], cx
add eax, 2
dec edx
jne 0x509915
jmp 0x509937
test edx, edx
jne 0x50993a
sub eax, 2
xor edx, edx
mov word [eax], dx
pop esi
cmp word [ebp - 0x414], dx
je 0x509995
push edi
lea edi, [ebp - 0x414]
call fcn.00509a30
mov eax, edi
push 0
push eax
call fcn.00515273
add esp, 8
pop edi
test eax, eax
jne 0x5099a8
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x509995
push ebx
call fcn.00509c30
test al, al
jne 0x5099c4
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.00509ab0
neg eax
sbb eax, eax
add eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00513498
mov esp, ebp
pop ebp
ret