joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af590
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
push ebp
push edi
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push 1
push 0x80000000
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
call edx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4af5d0
pop edi
xor eax, eax
pop ebp
add esp, 0x10
ret
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4af5f0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x10
ret
push esi
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
cmp esi, ebp
jne 0x4af611
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x10
ret
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
cmp eax, ebp
jne 0x4af634
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x10
ret
push ebp
lea ecx, [esp + 0x20]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
test eax, eax
je 0x4af61d
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
lea edx, [esp + 0x10]
push edx
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4af623
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0x4dda34
push ebp
push ebx
push ecx
call dword [0x4d739c]
test eax, eax
je 0x4af69f
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x4af6dd
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
push 4
push ebp
push ebp
push ebp
push eax
call dword [0x4d74f4]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp edi, ebp
je 0x4af6d3
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
add esp, 0x10
ret
Function at 0x4b18a0
Capabilities:
Read file via mapping

Disassembly:
push ebx
push ebp
mov ebx, eax
push esi
mov esi, ecx
mov ebp, 1
test ebx, ebx
jbe 0x4b1962
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x4b1962
test bl, 3
je 0x4b18cf
shr ebx, 2
lea ebx, [ebx*4 + 4]
test cl, 3
je 0x4b18e4
shr ecx, 2
lea eax, [ecx*4 + 4]
mov dword [esp + 0x10], eax
mov ecx, eax
mov ebp, 3
lea eax, [edi - 1]
cmp eax, ebp
ja case.0x4b18f0.1
jmp dword [eax*4 + 0x4b1970]
mov eax, 4
jmp 0x4b1907
mov eax, ebp
jmp 0x4b1907
mov eax, 2
imul eax, ebx
imul eax, ecx
push 0
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
mov ecx, eax
test ecx, ecx
je 0x4b1962
mov eax, edi
mov dword [esi + 4], ecx
call fcn.004b1740
imul eax, ebx
imul eax, dword [esp + 0x10]
push eax
push 0
push 0
push 0xf001f
push ecx
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edi
mov byte [esi], 1
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
call fcn.004b16b0
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4

Function at 0x4b1af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [vtable.NLibrary::NDatatype::NString::CConstantString.0]
mov edx, dword [eax]
sub esp, 0xc
push edi
mov ecx, 0x50acd0
mov edi, 1
call edx
cmp al, 1
jne 0x4b1b9f
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
cmp al, 1
jne 0x4b1b9f
test ebx, ebx
je 0x4b1b9f
mov edx, dword [vtable.NLibrary::NDatatype::NString::CConstantString.0]
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [edx + 0x10]
push 0
push 0x20019
push 0
push 0
push 0
mov ecx, 0x50acd0
mov dword [esp + 0x20], 0
call eax
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4b1b9f
lea ecx, [esp + 8]
push ecx
mov eax, 4
push ebx
lea edx, [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esi]
push edx
mov edx, dword [eax + 0x10]
push 0
mov ecx, esi
call edx
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b1b94
xor edi, edi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
add esp, 0xc
ret
Function at 0x4b1bb0
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [edi]
mov edx, dword [eax]
push ebp
mov ecx, edi
mov ebp, 1
call edx
cmp al, 1
jne 0x4b1c59
mov eax, dword [ebx]
mov edx, dword [eax]
mov ecx, ebx
call edx
cmp al, 1
jne 0x4b1c59
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
cmp al, 1
jne 0x4b1c59
mov edx, dword [edi]
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [edx + 0x10]
push 0
push 0x20006
push 0
push 0
push 0
mov ecx, edi
mov dword [esp + 0x20], 0
call eax
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4b1c59
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov edx, dword [esi]
lea ecx, [eax + eax + 2]
mov eax, dword [edx + 0x10]
push ecx
mov ecx, esi
call eax
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0x10]
push ebp
push 0
mov ecx, ebx
call eax
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4b1c4e
xor ebp, ebp
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop ebp
pop ecx
ret

Function at 0x4b1c60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
mov ebx, eax
mov eax, dword [ebx]
mov edx, dword [eax]
push ebp
mov ecx, ebx
mov ebp, 1
call edx
cmp al, 1
jne 0x4b1d2e
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
cmp al, 1
jne 0x4b1d2e
test esi, esi
je 0x4b1d2e
mov edx, dword [ebx]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [edx + 0x10]
push 0
push 0x20019
push 0
push 0
push 0
mov ecx, ebx
mov dword [esp + 0x24], 0
call eax
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4b1d2e
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, esi
call eax
mov edx, dword [esi]
mov ebx, eax
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
lea ecx, [eax + eax + 2]
lea edx, [esp + 0xc]
push edx
mov edx, dword [edi]
push ebx
lea eax, [esp + 0x18]
push eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x18], ecx
push 0
mov ecx, edi
mov dword [esp + 0x20], ebp
call eax
mov ecx, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b1d1a
xor ebp, ebp
mov edx, dword [esi]
mov eax, dword [edx + 0x38]
mov ecx, esi
call eax
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4b1d40
Capabilities:
Delete registry value

Disassembly:
push ecx
mov eax, dword [vtable.NLibrary::NDatatype::NString::CConstantString.0]
mov edx, dword [eax]
push esi
mov ecx, 0x50ac40
mov esi, 1
call edx
cmp al, 1
jne 0x4b1dc4
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
cmp al, 1
jne 0x4b1dc4
mov edx, dword [vtable.NLibrary::NDatatype::NString::CConstantString.0]
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [edx + 0x10]
push 0
push 2
push 0
push 0
push 0
mov ecx, 0x50ac40
mov dword [esp + 0x20], 0
call eax
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4b1dc4
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4b1db9
xor esi, esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x4b1dd0
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [vtable.NLibrary::NDatatype::NString::CConstantString.0]
mov edx, dword [eax]
push ebx
mov ecx, 0x50ac40
mov ebx, 1
call edx
cmp al, bl
jne 0x4b1e86
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
cmp al, bl
jne 0x4b1e86
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
cmp al, bl
jne 0x4b1e86
mov edx, dword [vtable.NLibrary::NDatatype::NString::CConstantString.0]
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [edx + 0x10]
push 0
push 0x20006
push 0
push 0
push 0
mov ecx, 0x50ac40
mov dword [esp + 0x20], 0
call eax
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4b1e86
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov edx, dword [esi]
lea ecx, [eax + eax + 2]
mov eax, dword [edx + 0x10]
push ecx
mov ecx, esi
call eax
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x10]
push ebx
push 0
mov ecx, edi
call eax
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4b1e7b
xor ebx, ebx
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x4b3c40
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x502a10]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push 0x114
lea eax, [esp + 8]
push 0
push eax
xor bl, bl
call fcn.0042cc00
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x4b3cac
mov eax, dword [esp + 8]
cmp eax, 5
jb 0x4b3c94
jne 0x4b3cac
cmp dword [esp + 0xc], 1
jb 0x4b3cac
mov al, 1
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00425bb1
add esp, 0x118
ret
mov ecx, dword [esp + 0x118]
mov al, bl
pop ebx
xor ecx, esp
call fcn.00425bb1
add esp, 0x118
ret

Function at 0x4b5740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
push edi
mov ecx, esi
mov edi, 1
call edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b575f
test al, 0x10
jne 0x4b5775
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov ecx, esi
call edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x4b5779
xor eax, eax
pop edi
ret
mov eax, edi
pop edi
ret

Function at 0x4b5780
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x502a10]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
mov ebp, 1
test edi, edi
je 0x4b5831
push ebx
push esi
lea esi, [esp + 0x14]
mov dword [esp + 0x10], vtable.NLibrary::NDatatype::NPath::CAutoPathBuffer.0
call fcn.004010f0
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0x34]
mov ecx, esi
xor bl, bl
call edx
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x4b57f5
mov ecx, dword [esp + 0xc]
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, ebp
jne 0x4b57f5
mov bl, 1
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x38]
lea ecx, [esp + 0x14]
call eax
pop esi
cmp bl, 1
pop ebx
jne 0x4b5831
mov edx, dword [edi]
mov edx, dword [edx + 0x2c]
lea eax, [esp + 8]
push eax
mov ecx, edi
call edx
test eax, eax
jne 0x4b5831
pop ebp
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00425bb1
add esp, 0x224
ret
mov ecx, dword [esp + 0x224]
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00425bb1
add esp, 0x224
ret

Function at 0x4b59b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x324
mov eax, dword [0x502a10]
xor eax, esp
mov dword [esp + 0x320], eax
push esi
push 0x18f
lea eax, [esp + 8]
push eax
push 0x4eae64
push str.Language
push str.LANGUAGE
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
lea eax, [esp]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b59f0
sub eax, edx
mov edx, dword [esi + 0x2cc80]
mov edx, dword [edx + 0x24]
sar eax, 1
lea ecx, [esi + 0x2cc80]
push eax
lea eax, [esp + 4]
push eax
call edx
mov ecx, dword [esp + 0x320]
xor ecx, esp
mov eax, 1
call fcn.00425bb1
add esp, 0x324
ret
Function at 0x4b7dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x502a10]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov ebx, edx
mov edx, dword [eax + 0x20]
mov dword [esp + 0x14], 1
call edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b7e10
test al, 0x10
jne 0x4b7e22
mov eax, dword [edi]
mov edx, dword [eax + 0x20]
mov ecx, edi
call edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea esi, [esp + 0x54]
mov dword [esp + 0x50], vtable.NLibrary::NDatatype::NPath::CAutoPathBuffer.0
call fcn.004010f0
mov eax, dword [esp + 0x50]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x50]
call edx
mov eax, dword [edi]
mov esi, dword [esp + 0x50]
mov edx, dword [eax + 0x1c]
mov ecx, edi
add esi, 0x48
call edx
push eax
mov eax, dword [esi]
lea ecx, [esp + 0x54]
call eax
test eax, eax
jne 0x4b7f60
push 0x50aa30
lea ecx, [esp + 0x54]
call fcn.004b4830
test eax, eax
jne 0x4b7f60
xor edi, edi
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], vtable.NLibrary::NDatatype::NString::CDynamicHeapStringBuffer.0
mov dword [esp + 0x1c], vtable.NLibrary::NDatatype::NArray::CDynamicHeapArrayBuffer_wchar_t_.0
mov byte [esp + 0x20], al
mov dword [esp + 0x24], 0x1000
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00401540
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call fcn.004b7b20
add esp, 4
test eax, eax
jne 0x4b7f57
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
cmp eax, edi
jbe 0x4b7ed1
dec eax
lea ebx, [eax*4]
lea edi, [esp + 0x34]
call fcn.00403bd0
mov eax, edi
lea edi, [esp + 0x18]
call fcn.004ab640
test eax, eax
jne 0x4b7f4e
lea ecx, [esp + 0x10]
xor ebx, ebx
push ecx
lea esi, [esp + 0x38]
mov dword [esp + 0x14], ebx
call fcn.004ab5e0
add esp, 4
test eax, eax
jne 0x4b7f4e
mov edx, dword [esp + 0x10]
mov ecx, esi
lea eax, [esp + 0x40]
call fcn.00403ca0
lea edx, [esp + 0x10]
push edx
lea edi, [esp + 0x54]
mov dword [esp + 0x14], ebx
call fcn.004ab840
test eax, eax
jne 0x4b7f4e
lea esi, [esp + 0x40]
lea eax, [esp + 0x10]
call fcn.004ab7d0
test eax, eax
jne 0x4b7f45
mov dword [esp + 0x14], ebx
lea esi, [esp + 0x10]
call fcn.004ab820
lea ecx, [esp + 0x34]
call fcn.00403c10
lea ecx, [esp + 0x1c]
call fcn.004032f0
mov ecx, dword [esp + 0x274]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00425bb1
mov esp, ebp
pop ebp
ret
Function at 0x4ba5a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x26c
mov eax, dword [0x502a10]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov ebx, edx
mov edx, dword [eax + 0x20]
mov ebp, 1
call edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ba5d8
test al, 0x10
jne 0x4ba5ea
mov eax, dword [edi]
mov edx, dword [eax + 0x20]
mov ecx, edi
call edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea esi, [esp + 0x54]
mov dword [esp + 0x50], vtable.NLibrary::NDatatype::NPath::CAutoPathBuffer.0
call fcn.004010f0
mov eax, dword [esp + 0x50]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x50]
call edx
mov eax, dword [edi]
mov esi, dword [esp + 0x50]
mov edx, dword [eax + 0x1c]
mov ecx, edi
add esi, 0x48
call edx
push eax
mov eax, dword [esi]
lea ecx, [esp + 0x54]
call eax
test eax, eax
jne 0x4ba725
push 0x50a8e0
lea ecx, [esp + 0x54]
call fcn.004b4830
test eax, eax
jne 0x4ba725
xor edi, edi
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], vtable.NLibrary::NDatatype::NString::CDynamicHeapStringBuffer.0
mov dword [esp + 0x1c], vtable.NLibrary::NDatatype::NArray::CDynamicHeapArrayBuffer_wchar_t_.0
mov byte [esp + 0x20], al
mov dword [esp + 0x24], 0x1000
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00401540
lea ecx, [esp + 0x18]
push ecx
push ebx
call fcn.004ba4a0
add esp, 8
test eax, eax
jne 0x4ba71c
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
cmp eax, edi
jbe 0x4ba698
dec eax
lea ebx, [eax*4]
lea edi, [esp + 0x34]
call fcn.00403bd0
mov eax, edi
lea edi, [esp + 0x18]
call fcn.004ab640
test eax, eax
jne 0x4ba713
lea ecx, [esp + 0x14]
xor ebx, ebx
push ecx
lea esi, [esp + 0x38]
mov dword [esp + 0x18], ebx
call fcn.004ab5e0
add esp, 4
test eax, eax
jne 0x4ba713
mov edx, dword [esp + 0x14]
mov ecx, esi
lea eax, [esp + 0x40]
call fcn.00403ca0
lea edx, [esp + 0x14]
push edx
lea edi, [esp + 0x54]
mov dword [esp + 0x18], ebx
call fcn.004ab840
test eax, eax
jne 0x4ba713
lea esi, [esp + 0x40]
lea eax, [esp + 0x14]
call fcn.004ab7d0
test eax, eax
jne 0x4ba70a
xor ebp, ebp
lea esi, [esp + 0x14]
call fcn.004ab820
lea ecx, [esp + 0x34]
call fcn.00403c10
lea ecx, [esp + 0x1c]
call fcn.004032f0
mov ecx, dword [esp + 0x274]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00425bb1
add esp, 0x26c
ret
Function at 0x4c7550
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x62ad0
call fcn.0042e4a0
mov eax, dword [0x502a10]
xor eax, esp
mov dword [esp + 0x62acc], eax
push esi
push edi
push 0x4eb9d0
push 1
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [esi + 0xa4], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4c75cb
push str.OtakuSoftware.DeskSpace.Window
push 0
call dword [0x4d75fc]
test eax, eax
je 0x4c760e
push 0
push 0
push 0x40f
push eax
call dword [0x4d75f4]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x62acc]
xor ecx, esp
call fcn.00425bb1
mov esp, ebp
pop ebp
ret
call dword [0x4d7034]
mov ecx, esi
call fcn.00412b1d
push 0
call fcn.00414425
add esp, 4
lea eax, [esp + 8]
push eax
call fcn.004c2af0
lea ecx, [esp + 8]
mov dword [esi + 0x20], ecx
call fcn.0040763f
mov edx, dword [esi + 0xa4]
push edx
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea edi, [esp + 8]
call fcn.004026a0
mov ecx, dword [esp + 0x62ad4]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00425bb1
mov esp, ebp
pop ebp
ret

Function at 0x4c7810
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], ecx
test eax, eax
jne 0x4c785e
push 4
lea edx, [esp + 8]
push edx
push 4
push eax
mov eax, dword [esp + 0x10]
push str.TaskbarAnimations
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0
push str.Program_Manager
call dword [0x4d75fc]
mov esi, eax
test esi, esi
je 0x4c788c
push edi
mov edi, dword [0x4d75f4]
push 0
push 0
push 0x1a
push esi
call edi
push 0
push 0
push 0x1a
push esi
call edi
pop edi
pop esi
add esp, 8
ret

Function at 0x4cb560
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ecx], vtable.CMyTabDlg.0
jmp 0x406eed
Function at 0x4cbab0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1014
call fcn.0042e4a0
mov eax, dword [0x502a10]
xor eax, esp
mov dword [esp + 0x1010], eax
push ebx
mov ebx, 1
cmp byte [ecx + 4], bl
jne 0x4cbc6d
cmp dword [esp + 0x101c], ebx
jne 0x4cbc6d
mov eax, dword [ecx + 8]
sub eax, ebx
je 0x4cbbec
sub eax, ebx
je 0x4cbb25
xor eax, eax
cmp byte [ecx + 5], bl
jne 0x4cbc6f
fldz
mov byte [ecx + 5], al
fstp qword [ecx + 0x10]
mov dword [ecx + 8], 2
pop ebx
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.00425bb1
add esp, 0x1014
ret 4
fld qword [ecx + 0x10]
fadd qword [0x4f4298]
fst qword [ecx + 0x10]
fld qword [0x4ea328]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x4cbb9b
fdivp st(1)
push 2
fmul qword [0x4ea250]
call fcn.004d3e60
fadd qword [0x4e66a0]
fnstcw word [esp + 0xe]
fmul qword [0x4f4248]
movzx eax, word [esp + 0xe]
or eax, 0xc00
mov dword [esp + 0x10], eax
fmul qword [0x4f4270]
fadd qword [0x4f4240]
fldcw word [esp + 0x10]
fistp dword [esp + 0x10]
mov al, byte [esp + 0x10]
movzx ecx, al
push ecx
fldcw word [esp + 0x12]
push 0
push esi
call dword [0x4d7634]
jmp 0x4cbc6d
fstp st(1)
fstp st(0)
cmp byte [ecx + 6], bl
jne 0x4cbbdf
push 0x800
lea edx, [esp + 0x14]
push edx
push 0xaa
push 0
mov byte [ecx + 6], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [0x4d7630]
mov ecx, dword [0x50a7b8]
push ebx
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push esi
call dword [0x4d765c]
jmp 0x4cbc6d
fld qword [ecx + 0x10]
fadd qword [0x4f4298]
fst qword [ecx + 0x10]
fld qword [0x4ea328]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x4cbc5d
fdivp st(1)
push 2
fmul qword [0x4ea250]
call fcn.004d3e60
fadd qword [0x4e66a0]
fnstcw word [esp + 0xe]
fmul qword [0x4f4248]
movzx eax, word [esp + 0xe]
fld qword [0x4f4270]
or eax, 0xc00
mov dword [esp + 0x10], eax
fmul st(1), st(0)
fsubrp st(1)
fldcw word [esp + 0x10]
fistp dword [esp + 0x10]
mov dl, byte [esp + 0x10]
movzx eax, dl
push eax
fldcw word [esp + 0x12]
push 0
push esi
call dword [0x4d7634]
jmp 0x4cbc6d
fstp st(1)
mov dword [ecx + 8], 0
fstp st(0)
fldz
fstp qword [ecx + 0x10]
xor eax, eax
mov ecx, dword [esp + 0x1014]
pop ebx
xor ecx, esp
call fcn.00425bb1
add esp, 0x1014
ret 4

Function at 0x4cdbb0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x502a10]
xor eax, esp
mov dword [esp + 0x2b4], eax
mov eax, dword [esp + 0x2bc]
push 0x4009
push 0x2b4
lea ecx, [esp + 8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [esp + 0x2b4]
mov eax, dword [esp + 4]
xor ecx, esp
call fcn.00425bb1
add esp, 0x2b8
ret
Function at 0x4cde70
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x4d4
mov eax, dword [0x502a10]
xor eax, esp
mov dword [esp + 0x4d0], eax
push ebx
push esi
push edi
lea esi, [esp + 0x10]
xor ebx, ebx
mov dword [esp + 0xc], vtable.NLibrary::NDatatype::NPath::CAutoPathBuffer.0
call fcn.004010f0
lea edi, [esp + 0xc]
call fcn.004b5780
test eax, eax
jne 0x4cdee4
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
push 0x4001
push 0x2b4
lea ecx, [esp + 0x230]
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.00425bb1
add esp, 0x4d4
ret
mov ecx, dword [esp + 0x4dc]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00425bb1
add esp, 0x4d4
ret
Function at 0x4cebc0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x406ef6
pop edx
push eax
call 0x406f07
mov dword [ecx], vtable.CAboutDlg.0
jmp 0x406eed