joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453be0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x453c15
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403e28
jmp 0x453c1f
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403d94
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454b78
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x454bb0
mov eax, esi
call fcn.0043bab0
test al, al
je 0x454bb0
mov eax, dword [ebx + 0x74]
call fcn.0043b7b4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x454bb0
push 0
mov eax, dword [ebx + 0x74]
call fcn.0043b7b4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x462500
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4625d8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5c286c], 0
jne 0x4625bc
lea eax, [ebp - 4]
mov edx, 0x4625f0
call fcn.00403dd8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404184
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4625bc
mov eax, ebx
call fcn.0040273c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4625b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46259f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x462600
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46259f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x5c286c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4625bc
mov eax, dword [ebp - 0xc]
call fcn.00402754
ret
mov ebx, dword [0x5c286c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4625df
lea eax, [ebp - 4]
call fcn.00403d40
ret
Function at 0x477dbc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00477904
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404184
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x477e1a
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5c1908]
mov dl, 1
mov eax, dword [0x477790]
call fcn.0040b394
call fcn.0040378c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x477e24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404184
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x477e7c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5c1b90]
mov dl, 1
mov eax, dword [0x477790]
call fcn.0040b394
call fcn.0040378c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00477934
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4788a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x478a8b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetDesktopFolder
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [0x5c1998]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
xor eax, eax
push ebp
push 0x478a51
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x478aa4
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x59af44]
call fcn.00479924
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
call fcn.004794c4
lea eax, [ebp - 0x10]
call fcn.00405b34
push eax
push 0xe0
mov eax, dword [0x5c1998]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
jmp 0x478a1b
mov ecx, 0x478aa4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x59af44]
call fcn.00479924
xor eax, eax
push ebp
push 0x478a14
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x478aa4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x59af44]
call fcn.00479a50
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4789f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.004794c4
cmp dword [ebp - 0x20], 0
je 0x4789d7
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
call fcn.00478810
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 4]
call fcn.00408750
test eax, eax
jne 0x4789d7
mov ecx, 0x478aa4
mov edx, dword [ebp - 0x18]
mov eax, dword [0x59af44]
call fcn.00479988
mov dword [ebp - 8], eax
call fcn.0040382c
call fcn.0040382c
jmp 0x478a36
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4789f9
mov edx, dword [ebp - 0x18]
mov eax, dword [0x59af44]
call fcn.0047994c
ret
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x478942
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478a58
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x59af44]
call fcn.0047994c
ret
Function at 0x478be0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x478cad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetDesktopFolder
lea eax, [ebp - 0x10]
push eax
push 0x11
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
xor eax, eax
push ebp
push 0x478c85
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x478cc0
mov edx, dword [ebp - 0x10]
mov eax, dword [0x59af44]
call fcn.00479924
lea eax, [ebp - 8]
push eax
mov eax, dword [0x5c19e4]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0x1000000
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478c8c
mov edx, dword [ebp - 0x10]
mov eax, dword [0x59af44]
call fcn.0047994c
ret

Function at 0x478ee8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404184
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x478f01
test al, 0x10
jne 0x478f05
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x478fe8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404174
xor eax, eax
push ebp
push 0x479194
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00403fc0
test eax, eax
jne 0x479042
lea eax, [ebp - 8]
push eax
xor eax, eax
call fcn.00478ccc
push eax
mov eax, dword [0x5c1998]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x47914f
lea eax, [ebp - 0x14]
push eax
call sub.shell32.dll_SHGetMalloc
xor edi, edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00403fc0
mov ebx, eax
test ebx, ebx
jle 0x479076
mov esi, 1
mov eax, dword [ebp - 4]
cmp byte [eax + esi - 1], 0x23
jne 0x479072
inc dword [ebp - 0xc]
inc esi
dec ebx
jne 0x479065
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004042f4
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
call fcn.00403fc0
mov ebx, eax
test ebx, ebx
jle 0x4790df
mov esi, 1
mov eax, dword [ebp - 4]
cmp byte [eax + esi - 1], 0x23
jne 0x4790db
test edi, edi
jle 0x4790d9
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
sub ecx, edi
dec ecx
lea edx, [edi + 1]
mov eax, dword [ebp - 4]
call fcn.004041c8
mov eax, dword [ebp - 0x18]
call fcn.00408aac
push eax
lea eax, [ebp - 0x10]
call fcn.00404190
mov edx, dword [ebp - 0xc]
pop ecx
mov byte [eax + edx - 1], cl
inc dword [ebp - 0xc]
mov edi, esi
inc esi
dec ebx
jne 0x47909b
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00403fc0
mov ecx, eax
sub ecx, edi
lea edx, [edi + 1]
mov eax, dword [ebp - 4]
call fcn.004041c8
mov eax, dword [ebp - 0x1c]
call fcn.00408aac
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.00403fc0
mov esi, eax
lea eax, [ebp - 0x10]
call fcn.00404190
mov byte [eax + esi - 1], bl
mov eax, dword [ebp - 0x10]
call fcn.00403fc0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x47914f
mov eax, dword [ebp - 0x10]
call fcn.00403fc0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404184
mov edx, dword [ebp - 8]
pop ecx
call fcn.00402880
mov ecx, 0x4791b0
mov edx, dword [ebp - 8]
mov eax, dword [0x59af44]
call fcn.00479924
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47919b
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403d64
lea eax, [ebp - 0x14]
call fcn.00405b34
lea eax, [ebp - 0x10]
call fcn.00403d40
lea eax, [ebp - 4]
call fcn.00403d40
ret

Function at 0x479344
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
movzx eax, dx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x47938c
call sub.shell32.dll_SHGetFileInfo
test eax, eax
je 0x479381
mov edx, eax
mov eax, ebx
call fcn.00441324
mov byte [ebx + 0x36], 1
mov dl, 3
mov eax, ebx
call fcn.004420f0
add esp, 0x160
pop ebx
ret
Function at 0x47935b
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
movzx eax, dx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x47938c
call sub.shell32.dll_SHGetFileInfo
test eax, eax
je 0x479381
mov edx, eax
mov eax, ebx
call fcn.00441324
mov byte [ebx + 0x36], 1
mov dl, 3
mov eax, ebx
call fcn.004420f0
add esp, 0x160
pop ebx
ret

Function at 0x479390
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x479413
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
call fcn.004794c4
mov eax, dword [ebp - 4]
call fcn.00403fc0
test eax, eax
jle 0x4793fd
mov eax, dword [ebp - 4]
call fcn.00404184
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
seta bl
test bl, bl
je 0x4793f5
mov edx, dword [ebp - 4]
mov eax, 0x47942c
call fcn.004042ac
cmp eax, 2
jne 0x4793f5
mov eax, dword [ebp - 4]
call fcn.00403fc0
cmp eax, 3
je 0x4793f9
xor eax, eax
jmp 0x4793fb
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47941a
lea eax, [ebp - 4]
call fcn.00403d40
ret

Function at 0x479438
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0xa
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
xor eax, eax
push ebp
push 0x47949c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4794b4
mov edx, dword [ebp - 8]
mov eax, dword [0x59af44]
call fcn.00479924
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_ILIsEqual
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4794a3
mov edx, dword [ebp - 8]
mov eax, dword [0x59af44]
call fcn.0047994c
ret

Function at 0x47950c
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
xor ecx, ecx
test dl, dl
je 0x47951b
or ecx, 2
xor edx, edx
or ecx, 0x4009
push ecx
push 0x160
lea ecx, [esp + 8]
push ecx
push edx
mov eax, dword [eax]
push eax
call sub.shell32.dll_SHGetFileInfo
mov eax, dword [esp + 4]
add esp, 0x160
ret

Function at 0x4795ec
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x160
call fcn.00402bfc
push 0x4010
push 0x160
lea eax, [esp + 8]
push eax
push esi
mov eax, ebx
call fcn.00404184
push eax
call sub.shell32.dll_SHGetFileInfo
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x479630
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov esi, eax
mov ebx, 0x4000
test dl, dl
je 0x479646
or ebx, 2
push ebx
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00404184
push eax
call sub.shell32.dll_SHGetFileInfo
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
pop ebx
ret
Function at 0x479740
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x208
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, dword [esi]
push eax
call sub.shell32.dll_SHGetFileInfo
test eax, eax
jne 0x479772
mov eax, ebx
call fcn.00403d40
jmp 0x479792
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00403f70
mov eax, dword [ebx]
call fcn.00403fc0
mov edx, eax
mov eax, ebx
call fcn.004042f4
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x47a67c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404174
xor eax, eax
push ebp
push 0x47a74a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x47a72f
lea eax, [ebp - 8]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004041c8
mov eax, dword [ebp - 8]
mov edx, 0x47a760
call fcn.004040d0
je 0x47a72f
lea eax, [ebp - 0xc]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004041c8
mov eax, dword [ebp - 0xc]
call fcn.00404184
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 4
je 0x47a72f
mov ecx, ebx
mov dl, 1
mov eax, dword [0x479c28]
call fcn.0047a3a0
mov esi, eax
lea eax, [esi + 0x30]
mov edx, dword [ebp - 4]
call fcn.00403d94
mov dl, 1
mov eax, esi
call fcn.0041747c
mov edx, esi
mov eax, dword [ebx + 0x24]
call fcn.00410560
mov eax, esi
call fcn.004174d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a751
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403d64
ret
Function at 0x47b8dc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x47baaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x164]
cmp byte [eax + 0x26c], 0
je 0x47b927
push 0x308
push 0x160
mov eax, dword [ebp + 8]
add eax, 0xfffffea0
push eax
push 0
push edi
call sub.shell32.dll_SHGetFileInfo
jmp 0x47b945
push 0xb08
push 0x160
mov eax, dword [ebp + 8]
add eax, 0xfffffea0
push eax
push 0x40000000
push edi
call sub.shell32.dll_SHGetFileInfo
cmp bl, 1
jne 0x47b969
mov eax, dword [ebp + 8]
test byte [eax - 0x155], 0x40
jne 0x47b969
mov eax, dword [0x5c1a5c]
mov eax, dword [eax]
mov edx, edi
call fcn.0047994c
jmp 0x47ba99
lea edx, [ebp - 4]
mov eax, edi
call fcn.004794c4
test esi, esi
jne 0x47b98d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x164]
add eax, 0x258
mov edx, dword [ebp - 4]
call fcn.00403d94
mov dl, 1
mov eax, dword [0x47b534]
call fcn.00402fc4
mov ebx, eax
mov dword [ebx + 0x20], edi
test esi, esi
jne 0x47b9aa
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x1c], eax
jmp 0x47b9b6
mov eax, dword [ebx + 0x20]
push eax
call sub.shell32.dll_ILFindLastID
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 4]
mov edx, dword [ebp + 8]
add edx, 0xfffffeac
mov ecx, 0x104
call fcn.00403f70
cmp dword [ebp - 4], 0
je 0x47b9ff
mov byte [ebx + 0x11], 0
cmp esi, 1
jne 0x47b9ed
lea eax, [ebx + 8]
mov ecx, dword [ebp - 4]
mov edx, 0x47bac4
call fcn.0040400c
jmp 0x47ba2a
lea eax, [ebx + 8]
mov ecx, dword [ebp - 4]
mov edx, 0x47bad0
call fcn.0040400c
jmp 0x47ba2a
mov byte [ebx + 0x11], 1
cmp esi, 1
jne 0x47ba1a
lea eax, [ebx + 8]
mov ecx, dword [ebx + 4]
mov edx, 0x47bad0
call fcn.0040400c
jmp 0x47ba2a
lea eax, [ebx + 8]
mov ecx, dword [ebx + 4]
mov edx, 0x47bac4
call fcn.0040400c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x15c]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x15c]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0xc], esi
mov byte [ebx + 0x10], 1
cmp byte [ebx + 0x11], 0
jne 0x47ba53
test esi, esi
jne 0x47ba6c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x164]
mov eax, dword [eax + 0x1f0]
mov edx, dword [ebx + 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x47ba83
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x164]
mov eax, dword [eax + 0x1f0]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x164]
mov eax, dword [eax + 0x278]
mov edx, ebx
call fcn.00410560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bab6
lea eax, [ebp - 4]
call fcn.00403d40
ret
Function at 0x47e3bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47e519
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x5c1998]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040d6c8
test al, al
jne 0x47e4fb
xor eax, eax
push ebp
push 0x47e4f4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDList
test eax, eax
je 0x47e441
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403f70
clc
invalid
jmp 0x47e449
lea eax, [ebp - 0xc]
call fcn.00403d40
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetDesktopFolder
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040d6c8
test al, al
je 0x47e479
call fcn.0040382c
jmp 0x47e4fb
lea edx, [ebp - 0x324]
mov ecx, 0x208
mov eax, dword [ebp - 0xc]
call fcn.00404a04
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x324]
push eax
push 0
mov eax, dword [0x5c1998]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040d6c8
test al, al
je 0x47e4cb
call fcn.0040382c
jmp 0x47e4fb
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0047de20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e4fb
cmp dword [ebp - 8], 0
je 0x47e4f3
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e520
lea eax, [ebp - 0x10]
call fcn.00405b34
lea eax, [ebp - 0xc]
call fcn.00403d40
ret
Function at 0x47e7e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ScreenToClient
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClientRect
xor ebx, ebx
cmp dword [esi], 0
je 0x47e89a
call sub.kernel32.dll_GetTickCount
mov edx, dword [esi]
add edx, 0x1e
cmp eax, edx
jbe 0x47e89a
mov eax, dword [ebp - 0xc]
cmp eax, 0x1a
jge 0x47e843
push ebp
xor edx, edx
xor eax, eax
call fcn.0047e784
pop ecx
mov bl, 1
jmp 0x47e860
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
sub edx, 0x1a
cmp eax, edx
jle 0x47e860
push ebp
mov edx, 1
xor eax, eax
call fcn.0047e784
pop ecx
mov bl, 1
mov eax, dword [ebp - 8]
cmp eax, 0x14
jge 0x47e87a
push ebp
xor edx, edx
mov eax, 1
call fcn.0047e784
pop ecx
mov bl, 1
jmp 0x47e89a
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x18]
sub edx, 0x14
cmp eax, edx
jle 0x47e89a
push ebp
mov edx, 1
mov eax, 1
call fcn.0047e784
pop ecx
mov bl, 1
call sub.kernel32.dll_GetTickCount
mov dword [esi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x488c18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x488c3d
inc ecx
xor esi, esi
mov bl, byte [eax + esi]
xor bl, byte [edx + esi]
mov edi, dword [ebp - 4]
mov byte [edi + esi], bl
inc esi
dec ecx
jne 0x488c2d
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x489588
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
lea edi, [esp + 8]
mov edx, edi
mov eax, dword [esp]
mov ecx, 8
call fcn.00402880
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x4895b2
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x50]
mov eax, edi
call fcn.004894a0
mov ax, word [esi + ebp*2 + 0x52]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x54]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x56]
lea eax, [edi + 6]
call fcn.004894a0
mov ax, word [edi + 4]
mov word [esp + 0x10], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x58]
lea eax, [edi + 4]
call fcn.004894a0
mov ax, word [edi + 2]
mov word [esp + 0x12], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x5a]
lea eax, [edi + 2]
call fcn.004894a0
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0x10]
xor word [edi + 2], ax
mov ax, word [esp + 0x12]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x4895ce
mov dx, word [esi + 0xb0]
mov eax, edi
call fcn.004894a0
mov ax, word [esi + 0xb2]
add word [edi + 4], ax
mov ax, word [esi + 0xb4]
add word [edi + 2], ax
mov dx, word [esi + 0xb6]
lea eax, [edi + 6]
call fcn.004894a0
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0x12], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0x12]
mov word [edi + 2], ax
mov edx, dword [esp + 4]
mov eax, edi
mov ecx, 8
call fcn.00402880
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret