joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8040
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [ebp - 8], ecx
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0
je 0x4a806f
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 4], eax
jmp 0x4a807a
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 4], eax
movsx eax, word [ebp - 4]
test eax, 0x8000
je 0x4a8089
mov al, 1
jmp 0x4a808b
mov al, 0
leave
ret

Function at 0x4a9060
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0xc
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [ebp - 0x10], ecx
push 1
mov edx, dword [ebp - 0x10]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0xf4]
call fcn.00480490
cmp dword [ebp - 0x10], eax
sete dl
mov byte [ebp - 5], dl
cmp byte [ebp + 8], 0
jne 0x4a90aa
cmp byte [ebp - 5], 0
je 0x4a90aa
call fcn.004a7270
cmp byte [ebp + 8], 0
je 0x4a90c0
push 5
mov eax, dword [ebp - 0x10]
push dword [eax + 0x68]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4a90ce
push 0
mov eax, dword [ebp - 0x10]
push dword [eax + 0x68]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x10]
call fcn.004a7200
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a90e8
mov ecx, dword [ebp - 0xc]
call fcn.00410830
lea esp, [ebp - 4]
pop esi
pop ebp
ret 4
Function at 0x4b61f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
cmp dword [ebp + 8], 0x70
jl 0x4b621f
cmp dword [ebp + 8], 0x87
jg 0x4b621f
mov eax, dword [ebp + 8]
add eax, 0x58
leave
ret
cmp dword [ebp + 8], 0x60
jl 0x4b6233
cmp dword [ebp + 8], 0x69
jg 0x4b6233
mov eax, dword [ebp + 8]
add eax, 0xffffffd0
leave
ret
call fcn.004bc070
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b6258
cmp dword [ebp + 8], 0xa6
jl 0x4b6258
cmp dword [ebp + 8], 0xb7
jg 0x4b6258
mov eax, dword [ebp + 8]
leave
ret
mov edx, dword [ebp + 8]
sub edx, 0x21
cmp edx, 0x76
ja case.0x4b6263.41
jmp dword [edx*4 + 0x595534]
mov eax, 3
leave
ret
mov eax, 0x1c
leave
ret
mov eax, 0x1d
leave
ret
mov eax, 0x1e
leave
ret
mov eax, 0x1f
leave
ret
mov eax, 1
leave
ret
mov eax, 4
leave
ret
mov eax, 0xb
leave
ret
mov eax, 0xc
leave
ret
mov eax, 5
leave
ret
mov eax, 0x7f
leave
ret
mov eax, 0x2a
leave
ret
mov eax, 0x2b
leave
ret
mov eax, 0x2d
leave
ret
mov eax, 0x2e
leave
ret
mov eax, 0x2f
leave
ret
mov dl, 0
test dword [ebp - 4], 0x1000
je 0x4b62f0
test dword [ebp - 4], 0x800
je 0x4b62f0
mov dl, 1
mov byte [ebp - 5], dl
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, 1
setne dl
mov byte [ebp - 6], dl
cmp byte [ebp - 6], 0
je 0x4b632e
cmp dword [ebp + 8], 0x41
jl 0x4b632e
cmp dword [ebp + 8], 0x5a
jg 0x4b632e
cmp byte [ebp + 0xc], 0
je 0x4b6329
mov eax, dword [ebp + 8]
add eax, 0x20
leave
ret
mov eax, dword [ebp + 8]
leave
ret
cmp dword [ebp + 8], 0x1f
jle 0x4b63ca
mov dword [ebp - 0xc], 0x20
jmp 0x4b63bd
movsx eax, byte [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov dword [ebp - 0x10], eax
mov dl, byte [ebp - 0x10]
and dl, 0xff
mov byte [ebp - 0x11], dl
movsx edx, word [ebp - 0x10]
and edx, 0xff00
sar edx, 8
mov byte [ebp - 0x12], dl
movzx edx, byte [ebp - 0x11]
cmp edx, dword [ebp + 8]
jne 0x4b63ba
movsx eax, byte [ebp - 0x12]
test eax, 1
je 0x4b6382
cmp byte [ebp + 0xc], 0
jne 0x4b6393
movsx eax, byte [ebp - 0x12]
test eax, 1
jne 0x4b63ba
cmp byte [ebp + 0xc], 0
jne 0x4b63ba
movsx eax, byte [ebp - 0x12]
test eax, 6
je 0x4b63a4
cmp byte [ebp - 5], 0
jne 0x4b63b5
movsx eax, byte [ebp - 0x12]
test eax, 6
jne 0x4b63ba
cmp byte [ebp - 5], 0
jne 0x4b63ba
mov eax, dword [ebp - 0xc]
leave
ret
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jl 0x4b6341
call fcn.0056d420
cmp al, 0
je case.default.0x4b63e1
mov edx, dword [ebp + 8]
sub edx, 0xbb
cmp edx, 3
ja case.default.0x4b63e1
jmp dword [edx*4 + 0x595524]
mov eax, 0x2b
leave
ret
mov eax, 0x2d
leave
ret
mov eax, 0x2c
leave
ret
mov eax, 0x2e
leave
ret
mov eax, dword [ebp + 8]
leave
ret
Function at 0x4bc490
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0xa0
push ecx
lea edi, [esp + 4]
mov eax, 0xcccccccc
mov ecx, 0x28
rep stosd dword es:[edi], eax
pop ecx
cmp byte [0x5e3494], 0
je 0x4bc548
lea edi, [ebp - 0xa0]
mov eax, 0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov byte [0x5e3494], 0
mov dword [ebp - 0xa0], 0x9c
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x4bc526
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, 0
jne 0x4bc526
mov byte [0x650690], 0
mov eax, 0
lea esp, [ebp - 4]
pop edi
pop ebp
ret
cmp dword [ebp - 0x90], 2
jne 0x4bc548
cmp dword [ebp - 0x9c], 5
jne 0x4bc548
cmp dword [ebp - 0x98], 1
jb 0x4bc548
mov byte [0x650690], 1
movzx eax, byte [0x650690]
lea esp, [ebp - 4]
pop edi
pop ebp
ret
Function at 0x4c1b70
Capabilities:
Get common file path
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 9
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x98]
mov eax, dword [edx + 0x9c]
mov dword [ebp - 0x10], eax
jmp 0x4c1cd4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 4]
cmp edx, 4
ja case.default.0x4c1bb4
jmp dword [edx*4 + 0x595808]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
push 0x5e44a2
call fcn.0040d340
pop ecx
push eax
push 0x5e44a2
lea ecx, [ebp - 8]
call fcn.00589f70
cmp dword [ebp - 8], 0
je 0x4c1bf5
mov ebx, dword [ebp - 8]
mov edx, dword [0x63df30]
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 8]
call fcn.0058a350
push eax
push 0
push dword [ebp - 0x14]
call sym.X86RunHoudini.exe_editTextSetter
add esp, 0xc
cmp dword [ebp - 8], 0
je case.default.0x4c1bb4
mov ecx, dword [ebp - 8]
call fcn.00589d70
jmp case.default.0x4c1bb4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], 0
push 0x5e44a2
call fcn.0040d340
pop ecx
push eax
push 0x5e44a2
lea ecx, [ebp - 0xc]
call fcn.00589f70
cmp dword [ebp - 0xc], 0
je 0x4c1c5c
mov ebx, dword [ebp - 0xc]
mov edx, dword [0x63df30]
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0xc]
call fcn.0058a350
push eax
push 0
push dword [ebp - 0x20]
call sym.X86RunHoudini.exe_staticCaptionSetter
add esp, 0xc
cmp dword [ebp - 0xc], 0
je case.default.0x4c1bb4
mov ecx, dword [ebp - 0xc]
call fcn.00589d70
jmp case.default.0x4c1bb4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
push 0xffffffffffffffff
push 0
push dword [ebp - 0x18]
call sym.X86RunHoudini.exe_RuntimeComboBoxSelectionSetter
add esp, 0xc
jmp case.default.0x4c1bb4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
push 0
push dword [ebp - 0x1c]
call sym.X86RunHoudini.exe_listSelectionSetter
add esp, 0xc
jmp case.default.0x4c1bb4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
push 0
push 0
push dword [ebp - 0x24]
call sym.X86RunHoudini.exe_checkBoxValueSetter
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x4c1ba5
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x4ceee0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
mov edx, dword [ebp + 8]
add edx, 0x18
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0xc]
cmp edx, 3
ja case.default.0x4ceeff
jmp dword [edx*4 + 0x5958f4]
mov eax, dword [ebp - 4]
movsx eax, word [eax + 2]
leave
ret
mov eax, dword [ebp - 4]
movsx eax, word [eax]
leave
ret
mov eax, dword [ebp - 4]
movsx edx, word [eax + 2]
mov eax, dword [ebp - 4]
movsx eax, word [eax + 6]
sub eax, edx
leave
ret
mov eax, dword [ebp - 4]
movsx edx, word [eax]
mov eax, dword [ebp - 4]
movsx eax, word [eax + 4]
sub eax, edx
leave
ret
mov eax, 0
leave
ret

Function at 0x4cef50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x14
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
mov edx, dword [ebp + 8]
add edx, 0x18
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 0xc]
cmp edx, 3
ja case.default.0x4cef7b
jmp dword [edx*4 + 0x595904]
push 0
mov eax, dword [ebp - 0xc]
movsx ecx, word [eax + 2]
mov edx, dword [ebp + 0x10]
sub edx, ecx
push edx
push dword [ebp - 0xc]
call fcn.0055bf60
add esp, 0xc
jmp case.default.0x4cef7b
mov eax, dword [ebp - 0xc]
movsx ecx, word [eax]
mov edx, dword [ebp + 0x10]
sub edx, ecx
push edx
push 0
push dword [ebp - 0xc]
call fcn.0055bf60
add esp, 0xc
jmp case.default.0x4cef7b
mov eax, dword [ebp - 0xc]
movzx edx, word [eax + 2]
add edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
mov word [eax + 6], dx
jmp case.default.0x4cef7b
mov eax, dword [ebp - 0xc]
movzx edx, word [eax]
add edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
mov word [eax + 4], dx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x34], 0
je 0x4cf08d
push 0x20
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 0x21
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x14], eax
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
push 0xf
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_GetMenu]
cmp eax, 0
jne 0x4cf02d
mov dword [ebp - 0x1c], 0
push 1
mov esi, dword [ebp - 0x14]
lea esi, [esi + esi]
mov eax, dword [ebp - 0xc]
movsx ebx, word [eax]
mov eax, dword [ebp - 0xc]
movsx edx, word [eax + 4]
sub edx, ebx
add edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
add esi, edx
push esi
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx]
mov eax, dword [ebp - 0xc]
movsx esi, word [eax + 2]
mov eax, dword [ebp - 0xc]
movsx edx, word [eax + 6]
sub edx, esi
add ebx, edx
push ebx
mov eax, dword [ebp - 0xc]
movsx edx, word [eax]
sub edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
movsx edx, word [eax + 2]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_MoveWindow]
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x4cf1d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x18
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x34], 0
je 0x4cf2dc
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 0x10], 0
je 0x4cf2a2
call fcn.0056d3b0
cmp al, 0
je 0x4cf265
mov edx, dword [ebp - 0x10]
add edx, 1
lea edx, [edx + edx]
push edx
call fcn.0058bbb0
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push dword [ebp - 0x14]
lea ecx, [ebp - 8]
call fcn.0058a000
push dword [ebp - 0x14]
call fcn.0058bbc0
pop ecx
jmp 0x4cf2a2
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
call fcn.0058bbb0
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
lea ecx, [ebp - 8]
call fcn.00589f70
push dword [ebp - 0x1c]
call fcn.0058bbc0
pop ecx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.0058a3a0
lea ecx, [ebp - 0xc]
call fcn.0058a350
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0x4cf2c6
mov ecx, dword [ebp - 0xc]
call fcn.00589d70
cmp dword [ebp - 8], 0
je 0x4cf2d4
mov ecx, dword [ebp - 8]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
mov eax, 0
lea esp, [ebp - 4]
pop ebx
pop ebp
ret

Function at 0x4cf2f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0x10]
mov byte [eax + 0x30], cl
mov eax, dword [ebp + 8]
cmp dword [eax + 0x34], 0
je 0x4cf329
cmp byte [ebp + 0x10], 0
je 0x4cf31b
push 5
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4cf329
push 0
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x4f31b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc10
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x304
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 8], 0
call fcn.0056d3b0
cmp al, 0
je 0x4f3210
push 0x400
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 0xc14], eax
push dword [ebp - 0xc14]
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 8]
call fcn.0058a000
jmp 0x4f329e
push 0x400
lea eax, [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0xc0c], 0
lea edx, [ebp - 0xc08]
lea eax, [ebp - 0xc08]
push eax
call fcn.0040d340
pop ecx
push eax
lea eax, [ebp - 0xc08]
push eax
lea ecx, [ebp - 0xc0c]
call fcn.00589f70
cmp dword [ebp - 0xc0c], 0
je 0x4f326a
mov ebx, dword [ebp - 0xc0c]
mov edx, dword [0x63df30]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0xc0c]
push eax
lea ecx, [ebp - 8]
call fcn.0058a7b0
cmp dword [ebp - 0xc0c], 0
je 0x4f328d
mov ecx, dword [ebp - 0xc0c]
call fcn.00589d70
call fcn.00546dd0
cmp dword [ebp - 8], 0
je 0x4f329e
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 8]
call fcn.0058a3a0
lea eax, [ebp - 0xc10]
push eax
call fcn.004f3120
pop ecx
mov ebx, eax
cmp dword [ebp - 0xc10], 0
je 0x4f32d0
mov ecx, dword [ebp - 0xc10]
call fcn.00589d70
cmp dword [ebp - 8], 0
je 0x4f32de
mov ecx, dword [ebp - 8]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x4f32f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 8
rep stosd dword es:[edi], eax
pop edi
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 2
jmp 0x4f33e3
mov edx, 1
mov ecx, dword [ebp - 0x20]
shl edx, cl
test dword [ebp - 0x1c], edx
je 0x4f33e0
mov eax, dword [ebp - 0x24]
cmp dword [ebp + 8], eax
jne 0x4f33dd
mov dl, byte [ebp - 0x20]
add dl, 0x41
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0
mov dword [ebp - 0xc], 0
lea edx, [ebp - 8]
lea eax, [ebp - 8]
push eax
call fcn.0040d340
pop ecx
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.00589f70
cmp dword [ebp - 0xc], 0
je 0x4f338a
mov ebx, dword [ebp - 0xc]
mov edx, dword [0x63df30]
mov dword [ebx + 0x10], edx
cmp dword [ebp - 0xc], 0
je 0x4f339c
mov ebx, dword [ebp - 0xc]
mov edx, dword [0x63df34]
mov dword [ebx + 0x10], edx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x4f33ad
mov edx, dword [ebp - 0x14]
inc dword [edx]
lea eax, [ebp - 0x14]
push eax
call fcn.004f3120
pop ecx
mov ebx, eax
cmp dword [ebp - 0x14], 0
je 0x4f33c7
mov ecx, dword [ebp - 0x14]
call fcn.00589d70
cmp dword [ebp - 0xc], 0
je 0x4f33d5
mov ecx, dword [ebp - 0xc]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
inc dword [ebp - 0x24]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x20
jl 0x4f3327
mov dword [ebp - 0x20], 0
jmp 0x4f34b5
mov edx, 1
mov ecx, dword [ebp - 0x20]
shl edx, cl
test dword [ebp - 0x1c], edx
je 0x4f34b2
mov eax, dword [ebp - 0x24]
cmp dword [ebp + 8], eax
jne 0x4f34af
mov dl, byte [ebp - 0x20]
add dl, 0x41
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0
mov dword [ebp - 0x10], 0
lea edx, [ebp - 8]
lea eax, [ebp - 8]
push eax
call fcn.0040d340
pop ecx
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00589f70
cmp dword [ebp - 0x10], 0
je 0x4f345c
mov ebx, dword [ebp - 0x10]
mov edx, dword [0x63df30]
mov dword [ebx + 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x4f346e
mov ebx, dword [ebp - 0x10]
mov edx, dword [0x63df34]
mov dword [ebx + 0x10], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x4f347f
mov edx, dword [ebp - 0x18]
inc dword [edx]
lea eax, [ebp - 0x18]
push eax
call fcn.004f3120
pop ecx
mov ebx, eax
cmp dword [ebp - 0x18], 0
je 0x4f3499
mov ecx, dword [ebp - 0x18]
call fcn.00589d70
cmp dword [ebp - 0x10], 0
je 0x4f34a7
mov ecx, dword [ebp - 0x10]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
inc dword [ebp - 0x24]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x4f33f9
mov eax, 0
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x4f3850
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc10
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x304
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 8], 0
call fcn.0056d3b0
cmp al, 0
je 0x4f38b0
push 0x400
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0xc14], eax
push dword [ebp - 0xc14]
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 8]
call fcn.0058a000
jmp 0x4f393e
push 0x400
lea eax, [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0xc0c], 0
lea edx, [ebp - 0xc08]
lea eax, [ebp - 0xc08]
push eax
call fcn.0040d340
pop ecx
push eax
lea eax, [ebp - 0xc08]
push eax
lea ecx, [ebp - 0xc0c]
call fcn.00589f70
cmp dword [ebp - 0xc0c], 0
je 0x4f390a
mov ebx, dword [ebp - 0xc0c]
mov edx, dword [0x63df30]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0xc0c]
push eax
lea ecx, [ebp - 8]
call fcn.0058a7b0
cmp dword [ebp - 0xc0c], 0
je 0x4f392d
mov ecx, dword [ebp - 0xc0c]
call fcn.00589d70
call fcn.00546dd0
cmp dword [ebp - 8], 0
je 0x4f393e
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 8]
call fcn.0058a3a0
lea eax, [ebp - 0xc10]
push eax
call fcn.004f3120
pop ecx
mov ebx, eax
cmp dword [ebp - 0xc10], 0
je 0x4f3970
mov ecx, dword [ebp - 0xc10]
call fcn.00589d70
cmp dword [ebp - 8], 0
je 0x4f397e
mov ecx, dword [ebp - 8]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x4f3990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc14
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x305
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 8], 0
call fcn.0056d3b0
cmp al, 0
je 0x4f3a00
lea eax, [ebp - 0x808]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xc14]
mov word [ebp + eax*2 - 0x808], 0
push dword [ebp - 0xc14]
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 8]
call fcn.0058a000
jmp 0x4f3aa2
lea eax, [ebp - 0xc08]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0xc18]
mov byte [ebp + eax - 0xc08], 0
mov dword [ebp - 0xc0c], 0
lea edx, [ebp - 0xc08]
lea eax, [ebp - 0xc08]
push eax
call fcn.0040d340
pop ecx
push eax
lea eax, [ebp - 0xc08]
push eax
lea ecx, [ebp - 0xc0c]
call fcn.00589f70
cmp dword [ebp - 0xc0c], 0
je 0x4f3a6e
mov ebx, dword [ebp - 0xc0c]
mov edx, dword [0x63df30]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0xc0c]
push eax
lea ecx, [ebp - 8]
call fcn.0058a7b0
cmp dword [ebp - 0xc0c], 0
je 0x4f3a91
mov ecx, dword [ebp - 0xc0c]
call fcn.00589d70
call fcn.00546dd0
cmp dword [ebp - 8], 0
je 0x4f3aa2
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 8]
call fcn.0058a3a0
lea eax, [ebp - 0xc10]
push eax
call fcn.004f3120
pop ecx
mov ebx, eax
cmp dword [ebp - 0xc10], 0
je 0x4f3ad4
mov ecx, dword [ebp - 0xc10]
call fcn.00589d70
cmp dword [ebp - 8], 0
je 0x4f3ae2
mov ecx, dword [ebp - 8]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x4f3af0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0x181c
call fcn.00590de0
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x607
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0xc], 0
call fcn.0056d3b0
cmp al, 0
je 0x4f3b8b
lea eax, [ebp - 0x80c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x181c], eax
mov edx, dword [ebp - 0x181c]
add edx, 0xffffffff
mov word [ebp + edx*2 - 0x80c], 0
lea eax, [ebp - 0x100c]
push eax
push 0
push 0x5f740c
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x100c]
push eax
call fcn.0058d600
pop ecx
push eax
lea eax, [ebp - 0x100c]
push eax
lea ecx, [ebp - 0xc]
call fcn.0058a000
jmp 0x4f3c48
lea eax, [ebp - 0x140c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x1820], eax
mov eax, dword [ebp - 0x1820]
mov byte [ebp + eax - 0x140d], 0
lea eax, [ebp - 0x180c]
push eax
push 0
push 0x5f73e8
lea eax, [ebp - 0x140c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x1810], 0
lea edx, [ebp - 0x180c]
lea eax, [ebp - 0x180c]
push eax
call fcn.0040d340
pop ecx
push eax
lea eax, [ebp - 0x180c]
push eax
lea ecx, [ebp - 0x1810]
call fcn.00589f70
cmp dword [ebp - 0x1810], 0
je 0x4f3c14
mov ebx, dword [ebp - 0x1810]
mov edx, dword [0x63df30]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x1810]
push eax
lea ecx, [ebp - 0xc]
call fcn.0058a7b0
cmp dword [ebp - 0x1810], 0
je 0x4f3c37
mov ecx, dword [ebp - 0x1810]
call fcn.00589d70
call fcn.00546dd0
cmp dword [ebp - 0xc], 0
je 0x4f3c48
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
lea eax, [ebp - 0x1814]
push eax
lea ecx, [ebp - 0xc]
call fcn.0058a3a0
lea eax, [ebp - 0x1814]
push eax
call fcn.004f3120
pop ecx
mov dword [ebp - 0x1824], eax
cmp dword [ebp - 0x1814], 0
je 0x4f3c7e
mov ecx, dword [ebp - 0x1814]
call fcn.00589d70
cmp dword [ebp - 0x1824], 0
je 0x4f3d74
mov eax, dword [ebp - 0x1824]
cmp dword [eax + 0x18], 0
jne 0x4f3cb7
push 0
push str.ret__mImp
push 0x17d
push str.win32Folderitem.cpp
push 4
push 0x83
call fcn.004a4f70
add esp, 0x18
cmp dword [0x5f7068], 0
jne 0x4f3d60
push 0x18
call fcn.00494950
pop ecx
cmp eax, 0
je 0x4f3d5b
mov esi, eax
mov dword [ebp - 0x1818], 0
push 0x5f740a
call fcn.0040d340
pop ecx
push eax
push 0x5f740a
lea ecx, [ebp - 0x1818]
call fcn.00589f70
cmp dword [ebp - 0x1818], 0
je 0x4f3d15
mov ebx, dword [ebp - 0x1818]
mov edx, dword [0x63df30]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x1818]
push eax
mov ecx, esi
call fcn.004413f0
cmp dword [ebp - 0x1818], 0
je 0x4f3d37
mov ecx, dword [ebp - 0x1818]
call fcn.00589d70
mov dword [esi], 0x5f741c
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, esi
mov dword [0x5f7068], eax
mov eax, dword [ebp - 0x1824]
push dword [eax + 0x18]
mov ecx, dword [0x5f7068]
call fcn.00542680
mov ebx, dword [ebp - 0x1824]
cmp dword [ebp - 0xc], 0
je 0x4f3d88
mov ecx, dword [ebp - 0xc]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret