joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490074
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea edi, [ebp - 0xd]
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x490224
inc esi
mov eax, dword [ebp + 8]
push eax
mov eax, edi
mov edx, 5
call fcn.0048ec88
pop ecx
test al, al
jne 0x4900bb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00490358
xor ebx, ebx
jmp 0x490224
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [edi]
ja 0x4900d9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00490358
xor ebx, ebx
jmp 0x490224
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [edi]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.004a6fec
test eax, eax
jne 0x490110
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00490358
xor ebx, ebx
jmp 0x490224
test byte [edi + 4], 1
je 0x49021d
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.0048ec88
pop ecx
test al, al
jne 0x490144
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00490358
xor ebx, ebx
jmp 0x490224
mov edx, dword [0x48c2c0]
mov eax, 0xc
call fcn.0040766c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4901ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00405d30
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00405ac4
mov edx, dword [ebp - 4]
call fcn.0048ec88
pop ecx
test al, al
jne 0x4901b2
mov edx, dword [0x48c2c0]
mov eax, dword [ebp - 8]
call fcn.00407680
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00490358
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x490224
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00489988
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.00489da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49021d
dec esi
jne 0x490092
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4abda0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4abdec
cmp dword [ebp - 0x104], 2
jne 0x4abdec
cmp dword [ebp - 0x110], 5
ja 0x4abdea
cmp dword [ebp - 0x110], 5
jne 0x4abdec
cmp dword [ebp - 0x10c], 1
jb 0x4abdec
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4abdf4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.0040e604
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ad3e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.0040e604
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b0d18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.0040e604
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b1394
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.0040e604
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b13c4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x4b14e0
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [0x50dc18]
cmp dword [0x50dc14], 0
jne 0x4b14bb
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jb 0x4b14bb
lea eax, [ebp - 8]
call fcn.004b1394
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0047f044
lea eax, [ebp - 4]
mov edx, 0x4b14fc
call fcn.00406854
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x50dc14], eax
cmp dword [0x50dc14], 0
je 0x4b14bb
push 0x4b1518
mov eax, dword [0x50dc14]
push eax
call fcn.00409620
mov dword [0x50dbf8], eax
push 0x4b1538
mov eax, dword [0x50dc14]
push eax
call fcn.00409620
mov dword [0x50dbfc], eax
push 0x4b1560
mov eax, dword [0x50dc14]
push eax
call fcn.00409620
mov dword [0x50dc00], eax
push 0x4b1574
mov eax, dword [0x50dc14]
push eax
call fcn.00409620
mov dword [0x50dc04], eax
push 0x4b158c
mov eax, dword [0x50dc14]
push eax
call fcn.00409620
mov dword [0x50dc08], eax
push 0x4b15a0
mov eax, dword [0x50dc14]
push eax
call fcn.00409620
mov dword [0x50dc0c], eax
cmp dword [0x50dc14], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b14e7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x4b340c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x4b34e6
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4b34f8
call fcn.004b2620
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b3464
mov eax, 0x4b3558
call fcn.004b239c
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4b344f
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4b34b7
cmp dword [esp], 0
jne 0x4b3499
mov eax, 0x4b35b0
call fcn.004b239c
jmp 0x4b34c1
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4b35ec
call fcn.004b2620
jmp 0x4b34c1
mov eax, 0x4b3654
call fcn.004b239c
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x4b34e6
push 0xfa
call sub.kernel32.dll_Sleep_1
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x4b36bc
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b38fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x4b389f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b3731
mov eax, 0x4b3918
call fcn.004859fc
xor edx, edx
push ebp
push 0x4b3834
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00403540
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x4b381d
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x4b3799
mov eax, 0x4b393c
call fcn.004859fc
xor edx, edx
push ebp
push 0x4b3806
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x4b37d9
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x4b37d9
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4b37b7
pop dword fs:[0]
add esp, 8
push 0x4b380d
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b383b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x4b7e78
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1200], ebx
mov dword [ebp - 0x1204], ebx
mov dword [ebp - 0x11f8], ebx
mov dword [ebp - 0x11fc], ebx
mov dword [ebp - 0x11f4], ebx
mov dword [ebp - 0x1004], ecx
mov dword [ebp - 0x11d8], edx
mov dword [ebp - 0x11dc], eax
lea esi, [ebp - 0x11ea]
lea edi, [ebp - 0x11dc]
xor eax, eax
push ebp
push 0x4b80a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11e0], eax
xor eax, eax
mov dword [ebp - 0x11d4], eax
mov eax, dword [edi]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11ce]
mov edx, dword [ebp - 0x1004]
mov eax, dword [ebp - 0x11d8]
call fcn.004b4b0c
cmp dword [ebp - 0x1084], 0x418
jle 0x4b7f3a
lea ecx, [ebp - 0x11f4]
mov edx, dword [ebp - 0x1004]
mov al, 0xc3
call fcn.00483130
mov ecx, dword [ebp - 0x11f4]
mov dl, 1
mov eax, dword [0x40b010]
call fcn.00411e44
call fcn.00404a74
lea eax, [ebp - 0x11fc]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
push 0
call fcn.004055f4
mov edx, dword [ebp - 0x11fc]
lea ecx, [ebp - 0x11f8]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.004b77d8
mov edx, dword [ebp - 0x11f8]
mov eax, dword [edi]
add eax, 0x14
call fcn.00406448
lea eax, [ebp - 0x1204]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
push 0
call fcn.004055f4
mov edx, dword [ebp - 0x1204]
lea ecx, [ebp - 0x1200]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.004b77d8
mov edx, dword [ebp - 0x1200]
mov eax, dword [edi]
add eax, 0x18
call fcn.00406448
lea eax, [ebp - 0x1078]
movzx eax, byte [eax]
mov edx, dword [edi]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x4b8066
push ebp
mov eax, esi
mov edx, 0xa
call fcn.004b7e00
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
movzx edx, word [esi]
call fcn.004b52c0
mov dword [ebp - 0x11f0], eax
cmp dword [ebp - 0x11f0], 0
jne 0x4b8007
push ebp
call fcn.004b7c58
pop ecx
xor eax, eax
push ebp
push 0x4b8038
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11f0]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x11f0]
add eax, 0x12
call fcn.004b7e00
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8052
mov edx, dword [ebp - 0x11f0]
mov eax, dword [edi]
call fcn.004b52fc
dec ebx
jne 0x4b7fd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b80ac
lea eax, [ebp - 0x1204]
call fcn.0040527c
lea eax, [ebp - 0x1200]
call fcn.00406438
lea eax, [ebp - 0x11fc]
call fcn.0040527c
lea eax, [ebp - 0x11f8]
mov edx, 2
call fcn.00406440
ret
Function at 0x4b8248
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x507070]
cmp dword [eax], 2
jne 0x4b8273
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jae 0x4b827f
mov dword [ebp - 0xc], 1
jmp 0x4b848a
push 0x4b8498
call sub.kernel32.dll_GetModuleHandleW_2
mov esi, eax
push 0x4b84b4
push esi
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
push 0x4b84cc
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x10], eax
push 0x4b84e4
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x14], eax
test edi, edi
je 0x4b82c4
cmp dword [ebp - 0x10], 0
je 0x4b82c4
cmp dword [ebp - 0x14], 0
jne 0x4b82d0
mov dword [ebp - 0xc], 0x7f
jmp 0x4b848a
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b848a
xor edx, edx
push ebp
push 0x4b8483
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 0xc]
shl eax, 5
call fcn.00403000
mov dword [ebp - 0x24], eax
mov esi, ebx
mov edi, dword [ebp + 0xc]
dec edi
test edi, edi
jl 0x4b83bf
inc edi
xor ebx, ebx
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
movzx eax, byte [esi + 6]
push eax
push esi
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
jne 0x4b8374
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b836a
mov dword [ebp - 0xc], 0x57
call fcn.00404b68
jmp 0x4b848a
mov eax, ebx
add eax, eax
add eax, eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [esi + 0x10]
mov dword [edx + eax*8], ecx
mov edx, dword [ebp - 0x24]
mov dword [edx + eax*8 + 4], 1
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [edx + eax*8 + 8], ecx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [edx + eax*8 + 0x18], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [edx + eax*8 + 0x1c], ecx
add esi, 0x14
inc ebx
dec edi
jne 0x4b832e
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b83e5
call fcn.00404b68
jmp 0x4b848a
xor eax, eax
push ebp
push 0x4b8429
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8430
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_LocalFree
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bec0c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
xor edx, edx
mov dword [ebp - 0x25c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4becde
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, ebx
call fcn.0047f044
lea eax, [ebp - 0x25c]
mov edx, 0x4becfc
call fcn.00406854
mov eax, dword [ebp - 0x25c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4becc5
xor eax, eax
push ebp
push 0x4becbe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
call fcn.004bebbc
test al, al
je 0x4bec93
mov byte [ebp - 1], 1
jmp 0x4beca7
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4bec7e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4becc5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bece5
lea eax, [ebp - 0x25c]
call fcn.00406438
ret

Function at 0x4bed00
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4bed40
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00406640
jmp 0x4bed49
mov eax, ebx
xor edx, edx
call fcn.00406448
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x4bed54
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x506350]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4bed93
mov eax, dword [esp + 4]
jmp 0x4bed95
xor eax, eax
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x4beda0
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x506358]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x4bede4
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4bedd9
mov eax, dword [esp + 4]
jmp 0x4beddb
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x4bedc3
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x506358]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x4bede4
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4bedd9
mov eax, dword [esp + 4]
jmp 0x4beddb
xor eax, eax
add esp, 0x2b4
pop ebx
ret
Function at 0x4bf23c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
test dl, dl
je 0x4bf250
add esp, 0xfffffff0
call fcn.004044d0
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0045e5dc
mov eax, dword [0x4bf2f4]
not eax
and eax, dword [esi + 0x50]
mov dword [esi + 0x50], eax
mov edx, 0x79
mov eax, esi
call fcn.0045ac6c
mov edx, 0x61
mov eax, esi
call fcn.0045aca0
xor edx, edx
mov eax, esi
call fcn.0045b7e8
mov dl, 1
mov eax, esi
call fcn.00464200
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jae 0x4bf2af
mov dx, 0xfffe
mov eax, esi
call fcn.0045b830
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x5c
push 0x1f
call sub.user32.dll_SystemParametersInfoW
test eax, eax
je 0x4bf2d5
lea eax, [ebp - 0x5c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [esi + 0x64]
call fcn.004314b8
mov eax, esi
test bl, bl
je 0x4bf2ea
call fcn.00404528
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c0390
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c055c
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4c052f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
test eax, eax
je 0x4c03ed
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x4c042b
mov eax, ebx
call fcn.004bf040
test al, al
jne 0x4c040b
mov byte [ebp - 5], 0
call fcn.00404b68
jmp 0x4c0536
lea edx, [ebp - 0x264]
mov eax, ebx
call fcn.004bed00
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004c07bc
mov byte [ebp - 5], 1
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.0047f044
lea eax, [ebp - 0x268]
mov edx, 0x4c057c
call fcn.00406854
mov eax, dword [ebp - 0x268]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4c0518
xor eax, eax
push ebp
push 0x4c0511
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.004bebbc
test al, al
je 0x4c04e6
lea eax, [ebp - 4]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00406640
lea edx, [ebp - 0x270]
mov eax, ebx
call fcn.0047f044
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 4]
call fcn.00406854
mov eax, dword [ebp - 0x270]
lea edx, [ebp - 0x26c]
call fcn.004bed00
mov eax, dword [ebp - 0x26c]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, esi
call fcn.004bfdac
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4c047f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0518
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0536
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0563
lea eax, [ebp - 0x270]
mov edx, 4
call fcn.00406440
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4c084c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c0a42
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4c08d1
lea edx, [ebp - 0x264]
mov eax, edi
call fcn.0047f5d8
mov eax, dword [ebp - 0x264]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.0047f044
mov eax, dword [ebp - 0x268]
pop edx
call fcn.0047f25c
test eax, eax
jne 0x4c08d1
lea edx, [ebp - 4]
mov eax, edi
call fcn.0047f5b0
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c0a10
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x26c]
mov eax, ebx
call fcn.0047f044
lea eax, [ebp - 0x26c]
mov edx, 0x4c0a5c
call fcn.00406854
mov eax, dword [ebp - 0x26c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4c09f9
xor eax, eax
push ebp
push 0x4c09f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.004bebbc
test al, al
je 0x4c09c3
lea eax, [ebp - 8]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00406640
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0047f25c
test eax, eax
je 0x4c09c3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.004bfea0
test eax, eax
jne 0x4c09c3
lea edx, [ebp - 0x274]
mov eax, ebx
call fcn.0047f044
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 8]
call fcn.00406854
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 0x270]
call fcn.004bed00
mov eax, dword [ebp - 0x270]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.004bfdac
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4c0939
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c09f9
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0a17
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4c0d14
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0040e604
add esp, 0x208
pop ebx
ret