joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f41ec
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f430d
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4f4243
push 0x20a
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [0x55cc50]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20e]
mov eax, dword [ebp - 4]
call fcn.00409344
jmp 0x4f42f4
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
mov eax, ebx
call fcn.004f4188
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.004f41b0
mov ebx, eax
test esi, esi
je 0x4f426b
dec esi
test esi, esi
jl 0x4f426b
cmp edi, ebx
jne 0x4f424a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x214]
mov edx, edi
call fcn.00409edc
mov eax, dword [ebp - 0x214]
mov ecx, ebx
sub ecx, edi
sar ecx, 1
jns 0x4f428d
adc ecx, 0
mov edx, 1
call fcn.0040a2b0
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, edx
test eax, eax
je 0x4f42a7
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x4f42f4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp word [eax], 0x22
jne 0x4f42f4
mov eax, edx
test eax, eax
je 0x4f42c2
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp word [ecx + eax*2 - 2], 0x22
jne 0x4f42f4
mov eax, edx
mov ebx, eax
test ebx, ebx
je 0x4f42dc
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.0040a2b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4314
lea eax, [ebp - 0x214]
call fcn.004091bc
ret
Function at 0x4f6708
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4f68e8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x4f6765
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_BeginPaint
mov ebx, eax
jmp 0x4f6778
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WindowFromDC
test eax, eax
jne 0x4f6778
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4f67c8
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf5], 0
jne 0x4f67c8
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
jmp 0x4f67d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf5]
test eax, eax
je 0x4f67d8
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4f68d7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xf5], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call fcn.004fc064
cmp dword [0x55f198], 0
je 0x4f681a
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call dword [0x55f198]
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call fcn.004fc064
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x45b]
test eax, eax
je 0x4f683f
xor edx, edx
call fcn.004f3990
push 0
push ebx
call sub.gdi32.dll_SelectClipRgn
cmp ebx, dword [ebp - 0xc]
je 0x4f686b
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
cmp dword [ebp - 8], 0
jne 0x4f6884
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f68de
cmp dword [ebp - 0x10], 0
je 0x4f68c3
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
jmp 0x4f68d6
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x4f68d6
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
ret
Function at 0x4f75d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x423]
test eax, eax
je 0x4f762b
cmp byte [ebx + 0x44d], 0
jne 0x4f762b
push eax
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
jne 0x4f75f9
xor esi, esi
jmp 0x4f7615
inc eax
mov ebp, eax
add ebp, ebp
mov eax, ebp
call fcn.00406410
mov esi, eax
push ebp
push esi
mov eax, dword [ebx + 0x423]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, edi
mov edx, esi
call fcn.00409edc
test esi, esi
je 0x4f7638
mov eax, esi
call fcn.0040642c
jmp 0x4f7638
mov eax, edi
mov edx, dword [ebx + 0x441]
call fcn.00409edc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x504010
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffee4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x50404d
mov al, 4
mov edx, dword [esp + 4]
cmp edx, 6
jne 0x50403b
mov al, 7
jmp 0x504086
cmp edx, 5
jb 0x504086
mov al, 5
cmp dword [esp + 8], 1
jb 0x504086
mov al, 6
jmp 0x504086
cmp eax, 1
jne 0x504084
mov al, 1
cmp dword [esp + 4], 4
ja 0x504069
cmp dword [esp + 4], 4
jne 0x50406b
cmp dword [esp + 8], 0xa
jb 0x50406b
mov al, 2
cmp dword [esp + 4], 4
ja 0x504080
cmp dword [esp + 4], 4
jne 0x504086
cmp dword [esp + 8], 0x5a
jb 0x504086
mov al, 3
jmp 0x504086
xor eax, eax
add esp, 0x11c
ret

Function at 0x5093f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x50941e
mov eax, ebx
call fcn.00509e94
cmp dword [ebx + 0x3c], 0
je 0x509417
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x50948f
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x509481
cmp dword [ebx + 8], 0
je 0x509440
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x509452
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x509481
cmp dword [ebx + 8], 0
je 0x509433
cmp eax, 3
je 0x509465
dec eax
jne 0x509433
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x509433
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x509433
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x5094ad
cmp dword [ebx + 0x10], 0xcc
je 0x5094ad
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005094b8
pop ebx
ret
Function at 0x51afe4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004092a0
mov eax, dword [ebp - 8]
call fcn.004092a0
xor eax, eax
push ebp
push 0x51b0f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x5596dc]
cmp byte [eax], 0
je 0x51b04a
call fcn.0040e034
cmp byte [eax + 0x1d], 0
je 0x51b037
mov ebx, pe_nt_image_headers32
jmp 0x51b04a
call fcn.0040e034
cmp byte [eax + 0x1c], 0
je 0x51b04a
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00409e74
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x51b0dc
cmp dword [ebp - 8], 0
jne 0x51b0a5
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x51b0cd
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00409e74
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b0fe
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040921c
ret
Function at 0x51b10c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004092a0
mov eax, dword [ebp - 8]
call fcn.004092a0
xor eax, eax
push ebp
push 0x51b24c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x5596dc]
cmp byte [eax], 0
je 0x51b182
call fcn.0040e034
cmp byte [eax + 0x1d], 0
je 0x51b16f
mov ebx, pe_nt_image_headers32
jmp 0x51b182
call fcn.0040e034
cmp byte [eax + 0x1c], 0
je 0x51b182
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00409e74
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x51b231
cmp dword [ebp - 8], 0
jne 0x51b1b3
xor ebx, ebx
jmp 0x51b1bd
mov eax, dword [ebp - 8]
call fcn.00409e74
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x51b228
mov eax, dword [ebp - 0x20]
call fcn.00406410
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x51b220
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x51b216
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x51b228
mov eax, dword [ebp - 0x1c]
call fcn.0040642c
jmp 0x51b228
mov eax, dword [ebp - 0x1c]
call fcn.0040642c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b253
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040921c
ret

Function at 0x51b430
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 8]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
xor eax, eax
push ebp
push 0x51b47e
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x51b49c
mov eax, dword [ebp - 8]
call fcn.0051b38c
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b485
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x51b558
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov edi, 0x55f228
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x51b6d1
push dword fs:[edx]
mov dword fs:[edx], esp
test esi, esi
jne 0x51b58d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b6db
call fcn.0051b430
push esi
push 0
push 0x100001
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x51b5b5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b6db
xor edx, edx
push ebp
push 0x51b6c0
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x51b68e
push 0x64
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitForInputIdle
push 0
mov eax, edi
mov ecx, 1
mov edx, dword [0x51b4c0]
call fcn.0040b418
add esp, 4
push esi
push 0x51b4e8
call sub.user32.dll_EnumWindows
mov dword [ebp - 0xc], 0x79
mov eax, dword [edi]
call fcn.0040b1fc
test eax, eax
je 0x51b68e
mov eax, dword [edi]
call fcn.0040b1fc
mov esi, eax
dec esi
test esi, esi
jl 0x51b656
inc esi
xor ebx, ebx
push 0
push 0
push 0x10
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push eax
call sub.user32.dll_PostMessageW
push 0
push 0
push 0x11
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push eax
call sub.user32.dll_PostMessageW
push 0
push 1
push 0x16
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push eax
call sub.user32.dll_PostMessageW
inc ebx
dec esi
jne 0x51b61f
push 0x19
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WaitForSingleObject
push 1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x51b685
mov byte [ebp - 1], 1
call fcn.004089ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b6db
dec dword [ebp - 0xc]
jne 0x51b5ff
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b6c7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51bbe4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov byte [ebp - 1], 7
xor edx, edx
push ebp
push 0x51bd08
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x51bcc3
mov byte [ebp - 1], 5
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x51bc9f
mov byte [ebp - 1], 0xa
cmp byte [ebp - 6], 1
jne 0x51bc74
mov eax, dword [ebp - 0x118]
cmp eax, 3
jb 0x51bc54
mov byte [ebp - 1], 0x10
jmp 0x51bcfe
cmp eax, 2
jb 0x51bc62
mov byte [ebp - 1], 0xe
jmp 0x51bcfe
cmp eax, 1
jb 0x51bcfe
mov byte [ebp - 1], 0xd
jmp 0x51bcfe
mov byte [ebp - 1], 0xb
mov eax, dword [ebp - 0x118]
cmp eax, 3
jb 0x51bc89
mov byte [ebp - 1], 0x11
jmp 0x51bcfe
cmp eax, 2
jb 0x51bc94
mov byte [ebp - 1], 0xf
jmp 0x51bcfe
cmp eax, 1
jb 0x51bcfe
mov byte [ebp - 1], 0xc
jmp 0x51bcfe
cmp eax, 5
jb 0x51bcfe
mov byte [ebp - 1], 6
cmp dword [ebp - 0x118], 1
jb 0x51bcfe
cmp byte [ebp - 6], 1
jne 0x51bcbd
mov byte [ebp - 1], 7
jmp 0x51bcfe
mov byte [ebp - 1], 9
jmp 0x51bcfe
cmp eax, 1
jne 0x51bcfa
mov byte [ebp - 1], 1
cmp dword [ebp - 0x11c], 4
jne 0x51bce2
cmp dword [ebp - 0x118], 0xa
jne 0x51bce2
mov byte [ebp - 1], 2
cmp dword [ebp - 0x11c], 4
jne 0x51bcfe
cmp dword [ebp - 0x118], 0x5a
jne 0x51bcfe
mov byte [ebp - 1], 3
jmp 0x51bcfe
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51bd12
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51ca18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51cb99
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x51cb6c
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0051bd20
cmp al, 0xa
jb 0x51caf0
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.0040a008
xor edx, edx
push ebp
push 0x51cae9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00409e74
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x51cad1
mov eax, dword [ebp - 4]
call fcn.00409e74
mov edx, dword [ebp - 8]
call fcn.00423658
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
je 0x51caa3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x51cabf
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004294e4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040959c
call fcn.004089ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51cb76
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51caf0
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a008
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x559870]
mov eax, dword [eax]
mov ecx, 0x51cbb4
mov edx, 0x51cbd0
call fcn.0051b2fc
test al, al
je 0x51cb62
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0051c9cc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040959c
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
test eax, eax
je 0x51cb36
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x51cb62
mov eax, edx
test eax, eax
je 0x51cb45
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x51cb62
mov eax, dword [ebp - 8]
mov edx, 0x51cc60
call fcn.0040a088
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51cb76
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51cba0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040921c
lea eax, [ebp - 4]
call fcn.004091bc
ret
Function at 0x51cc64
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51cde5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x51cdb8
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0051bd20
cmp al, 0xa
jb 0x51cd3c
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.0040a008
xor edx, edx
push ebp
push 0x51cd35
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00409e74
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x51cd1d
mov eax, dword [ebp - 4]
call fcn.00409e74
mov edx, dword [ebp - 8]
call fcn.00423658
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
je 0x51ccef
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x51cd0b
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004294e4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040959c
call fcn.004089ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51cdc2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51cd3c
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a008
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x559870]
mov eax, dword [eax]
mov ecx, 0x51ce00
mov edx, 0x51ce28
call fcn.0051b2fc
test al, al
je 0x51cdae
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0051c9cc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040959c
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
test eax, eax
je 0x51cd82
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x51cdae
mov eax, edx
test eax, eax
je 0x51cd91
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x51cdae
mov eax, dword [ebp - 8]
mov edx, 0x51ceb8
call fcn.0040a088
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51cdc2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51cdec
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040921c
lea eax, [ebp - 4]
call fcn.004091bc
ret
Function at 0x51d58c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov esi, eax
xor eax, eax
push ebp
push 0x51d725
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x11], 0
je 0x51d5cc
call fcn.0051c6b0
mov dword [ebp - 0x18], eax
mov eax, esi
test eax, eax
je 0x51d5d7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x51d5e2
xor ebx, ebx
jmp 0x51d6fd
cmp byte [ebp - 0x12], 0
je 0x51d6e6
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.004095e4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0042952c
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004095e4
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00422fe8
mov eax, dword [ebp - 8]
test eax, eax
je 0x51d623
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x51d650
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0040a2b0
mov eax, dword [ebp - 0x1c]
mov edx, 0x51d740
call fcn.0040a278
sete al
jmp 0x51d652
xor eax, eax
test al, al
je 0x51d65a
mov al, 1
jmp 0x51d664
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00422a18
test al, al
je 0x51d66c
mov al, 1
jmp 0x51d67a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a278
sete al
test al, al
jne 0x51d6fd
cmp dword [ebp - 4], 0
jne 0x51d69e
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00409e74
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x51d6fd
mov eax, dword [ebp - 4]
call fcn.00409e74
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00409edc
mov eax, dword [ebp - 0x20]
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.0051d58c
mov ebx, eax
test bl, bl
je 0x51d6dc
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00409e74
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x51d6e0
xor eax, eax
jmp 0x51d6e2
mov al, 1
mov ebx, eax
jmp 0x51d6fd
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.00409e74
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51d72c
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0040921c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040921c
ret

Function at 0x51d744
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00409e74
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x51d75d
test al, 0x10
jne 0x51d761
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x51dc30
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0051dc78
test al, al
je 0x51dc70
mov eax, esi
call fcn.00422ea4
mov ebx, eax
test bl, bl
jne 0x51dc70
mov eax, esi
call fcn.0051db14
push 0x80
mov eax, esi
call fcn.00409e74
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.00422ea4
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x51dc78
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00409e74
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x51dc91
test al, 0x10
je 0x51dc95
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret