joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cf46
Capabilities:
Log keystrokes
Parse credit card information

Disassembly:
push 4
mov eax, 0x552ed2
call fcn.004ae531
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov eax, dword [0x5ac004]
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
and dword [ebp - 4], 0
inc ebx
movzx edx, cx
mov dword [ebp - 0x10], ebx
push 2
pop edi
cmp edx, 0x25
ja 0x46cfef
je 0x46cfe5
mov eax, edx
sub eax, 0xd
je 0x46cfdb
sub eax, 0xe
je 0x46cfd1
sub eax, 5
je 0x46cfc7
sub eax, ebx
je 0x46cfbd
sub eax, ebx
je 0x46cfb3
sub eax, ebx
je 0x46cfa9
sub eax, ebx
jne 0x46d026
push str.Home
jmp 0x46d15d
push 0x56525c
jmp 0x46d15d
push str.PageDown
jmp 0x46d15d
push str.PageUp
jmp 0x46d15d
push str.Space
jmp 0x46d15d
push 0x565210
jmp 0x46d15d
push 0x565218
jmp 0x46d15d
push str.Left
jmp 0x46d15d
mov eax, edx
sub eax, 0x26
je 0x46d158
sub eax, 1
je 0x46d151
sub eax, 1
je 0x46d14a
sub eax, edi
je 0x46d143
sub eax, 3
je 0x46d13c
sub eax, 1
je 0x46d135
cmp cx, 0x30
jb 0x46d032
cmp cx, 0x39
jbe 0x46d03b
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x46d052
movzx eax, cx
mov ecx, esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.00408610
jmp 0x46d164
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x46d076
lea eax, [edx - 0x60]
push eax
push str.Num__d
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0040f654
add esp, 0x10
mov dword [ebp - 4], ebx
jmp 0x46d0c8
cmp cx, 0x6a
jne 0x46d086
push 0x5652d0
jmp 0x46d15d
cmp cx, 0x6b
jne 0x46d096
push str.Num_
jmp 0x46d15d
cmp cx, 0x6e
jne 0x46d0a6
push str.Num_Del
jmp 0x46d15d
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x46d0e4
lea eax, [edx - 0x6f]
push eax
push 0x5652f8
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0040f654
add esp, 0x10
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [section..data]
je 0x46d164
call fcn.00401bf0
jmp 0x46d164
push edi
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov cl, al
movsx eax, cl
cmp eax, 0x3d
jg 0x46d10e
je 0x46d11d
cmp eax, 0x27
je 0x46d11d
cmp eax, 0x2b
jle 0x46d164
cmp eax, 0x2f
jle 0x46d11d
cmp eax, 0x3b
je 0x46d11d
jmp 0x46d164
cmp eax, 0x5b
jl 0x46d164
cmp eax, 0x5d
jle 0x46d11d
cmp eax, 0x60
jne 0x46d164
movsx ax, cl
mov ecx, esi
movzx eax, ax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.0040ef90
jmp 0x46d164
push str.Delete
jmp 0x46d15d
push str.Insert
jmp 0x46d15d
push str.Print
jmp 0x46d15d
push str.Down
jmp 0x46d15d
push str.Right
jmp 0x46d15d
push 0x565224
mov ecx, esi
call fcn.004071c0
mov eax, esi
call fcn.004ae4fa
ret
Function at 0x4731db
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004209b5
mov esi, eax
test esi, esi
je 0x473207
mov edx, dword [esi]
mov ecx, esi
push str.menuItem
call dword [edx + 4]
test eax, eax
je 0x473207
mov eax, esi
jmp 0x473309
mov ecx, dword [0x5b3e68]
test ecx, ecx
je 0x47321a
call fcn.004181d9
mov esi, eax
jmp 0x47321c
xor esi, esi
push ebx
push edi
push 0x2800
call fcn.004efd18
mov edi, eax
mov dword [esp], 0x5000
call fcn.004efd18
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push str.menuItem
push str.FindChildByID2_Failed__no_window_of_class___s__with_id_of___d__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.00401580
add esp, 0x20
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x473281
xor ecx, ecx
push ecx
push ecx
push eax
push edi
push 0xffffffffffffffff
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.004efd13
pop ecx
test esi, esi
je 0x4732c0
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
call dword [eax + 0x2c]
test al, al
je 0x4732c0
push dword [ebp + 4]
mov eax, dword [esi]
mov ecx, esi
push str.SOUI::SWindow::FindChildByID2
push 0x1e9
push str.d:jenkinsworkspace_soui_souiincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
call dword [eax + 0x34]
jmp 0x4732fe
mov ebx, 0x2800
push ebx
call fcn.004efd18
mov dword [esp], 0x1e9
mov esi, eax
push str.d:jenkinsworkspace_soui_souiincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByID2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push ebx
push esi
call fcn.004018b0
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.004efd13
pop ecx
push edi
call fcn.004efd13
pop ecx
pop edi
xor eax, eax
pop ebx
pop esi
pop ebp
ret 8

Function at 0x47469b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x474703
mov ecx, esi
call fcn.00474708
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x3ac]
test ecx, ecx
je 0x4746de
push 0
call fcn.00423c93
and dword [esi + 0x3ac], 0
mov ecx, dword [0x5b3fc8]
lea ecx, [ecx + 8]
call fcn.0047579e
mov ecx, dword [esi + 0x3a4]
test ecx, ecx
je 0x474703
pop esi
mov ecx, dword [ecx + 0x174]
pop ebp
jmp fcn.00475528
pop esi
pop ebp
ret 4
Function at 0x478170
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5ac7dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], 0
push 0
push 0x104
lea ecx, [ebp - 0x40]
call fcn.0047a9c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040e380
push eax
lea ecx, [ebp - 0x40]
call fcn.0047df60
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x4781f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4781f0
lea ecx, [ebp - 0x40]
call fcn.0040e380
cmp dword [ebp - 0x7c], eax
jne 0x47821d
push 0x558800
mov ecx, dword [ebp + 8]
call fcn.00406af0
mov eax, dword [ebp - 0x78]
or eax, 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00406a30
mov eax, dword [ebp + 8]
jmp 0x478342
mov ecx, dword [ebp - 0x7c]
add ecx, 1
push ecx
lea ecx, [ebp - 0x40]
call fcn.00409030
lea ecx, [ebp - 0x28]
call fcn.00406b50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00406b50
mov byte [ebp - 4], 2
mov dword [ebp - 0x74], 0xffffffff
jmp 0x47825e
lea ecx, [ebp - 0x28]
call fcn.00406a10
mov edx, dword [ebp - 0x74]
sub edx, 1
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x74]
push eax
push 0x5c
lea ecx, [ebp - 0x40]
call fcn.0047e9a0
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffff
je 0x478303
mov ecx, dword [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0047df60
push eax
lea ecx, [ebp - 0x28]
call fcn.0040e6d0
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x70]
call fcn.0047b120
push 0x566c9c
lea ecx, [ebp - 0x28]
call fcn.0040e660
lea ecx, [ebp - 0x28]
call fcn.004069b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4782bc
jmp 0x478303
push 0x566cc4
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.00478850
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.004069b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4782f6
lea ecx, [ebp - 0x28]
call fcn.00406a10
lea ecx, [ebp - 0x58]
call fcn.00406a30
jmp 0x478303
lea ecx, [ebp - 0x58]
call fcn.00406a30
jmp 0x47824d
lea edx, [ebp - 0x70]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040b020
mov eax, dword [ebp - 0x78]
or eax, 1
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00406a30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00406a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00406a30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae22e
mov esp, ebp
pop ebp
ret
Function at 0x484000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x5ac7dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push str.Unspecified_error.
call fcn.004780a0
add esp, 4
push 0x44
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.004d3150
add esp, 0xc
mov dword [ebp - 0x268], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.004d3150
add esp, 0xc
mov dx, word [0x558800]
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.004d3150
add esp, 0xc
push 0x585e74
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00506497
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.0047c1b0
push eax
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00506497
add esp, 0xc
push 0x569f2c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00506497
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00506497
add esp, 0xc
push 0x585e74
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00506497
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x268]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.0047b350
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x220], 0
je 0x484164
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x214], 0
jne 0x484181
push str.Error_creating_CrashSender_process.
call fcn.004780a0
add esp, 4
mov eax, 1
jmp 0x4841d5
cmp dword [ebp + 0xc], 0
je 0x48419c
push 0xffffffffffffffff
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], 0
je 0x4841af
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x224]
mov dword [ecx], edx
jmp 0x4841c6
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x224], 0
push 0x566854
call fcn.004780a0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae22e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x48bde0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov dword [ebp - 0x108], 0x9227cd4
mov dword [ebp - 0x10c], 0xc2fbf138
mov dword [ebp - 0x164], 0x65789bc3
mov byte [ebp - 0x40], 0x77
mov byte [ebp - 0x3f], 0x69
mov byte [ebp - 0x3e], 0x6e
mov byte [ebp - 0x3d], 0x69
mov byte [ebp - 0x3c], 0x6e
mov byte [ebp - 0x3b], 0x65
invalid

Function at 0x48c070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x140]
push ecx
call fcn.0048c690
add esp, 8
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0x8c], 0x78
mov byte [ebp - 0x8b], 0x6b
mov byte [ebp - 0x8a], 0x3e
mov byte ds:[ebp - 0x89], 0x33
mov byte [ebp - 0x88], 0x33
mov byte [ebp - 0x87], 0x77
mov byte [ebp - 0x86], 0x69
invalid
invalid
invalid
Function at 0x48c110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x73], 0x77
mov byte [ebp - 0x72], 0x77
mov byte [ebp - 0x71], 0x6d
mov byte [ebp - 0x70], 0x67
mov byte [ebp - 0x6f], 0x31
mov byte [ebp - 0x6e], 0x7e
mov byte [ebp - 0x6d], 0x6c
mov byte [ebp - 0x6c], 0x31
mov byte [ebp - 0x6b], 0x67
mov byte [ebp - 0x6a], 0x72
mov byte [ebp - 0x69], 0

Function at 0x48c1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fadd qword [eax + eax]
add byte [ebx - 0x7a76f73c], al
sub al, 0xff
invalid

Function at 0x48c660
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
invalid
inc eax

Function at 0x48c690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff0000
je 0x48c76c
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
jmp 0x48c70e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x20]
jae 0x48c763
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048c630
add esp, 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jne 0x48c761
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x30]
mov cx, word [eax + edx*2]
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
jmp 0x48c78a
jmp 0x48c705
mov dword [ebp - 0x10], 0
jmp 0x48c787
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
sub eax, dword [edx + 0x10]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4936d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x5ac7dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], ecx
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x28
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x493703
xor eax, eax
jmp 0x4938b6
mov edx, dword [ebp - 0x40]
add edx, 1
push edx
call fcn.004ae252
add esp, 4
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
mov edx, dword [ebp - 0x40]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push ecx
call fcn.004d3150
add esp, 0xc
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x3c]
add eax, 0x28
push eax
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x49375e
xor eax, eax
jmp 0x4938b6
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x3c]
call fcn.00493b20
test eax, eax
je 0x493869
mov edx, dword [ebp - 0x30]
shr edx, 0x10
and edx, 0xffff
mov eax, 2
imul ecx, eax, 0
mov eax, dword [ebp - 0x3c]
mov word [eax + ecx + 8], dx
mov ecx, dword [ebp - 0x30]
and ecx, 0xffff
mov edx, 2
shl edx, 0
mov eax, dword [ebp - 0x3c]
mov word [eax + edx + 8], cx
mov ecx, dword [ebp - 0x2c]
shr ecx, 0x10
and ecx, 0xffff
mov edx, 2
shl edx, 1
mov eax, dword [ebp - 0x3c]
mov word [eax + edx + 8], cx
mov ecx, dword [ebp - 0x2c]
and ecx, 0xffff
mov edx, 2
imul eax, edx, 3
mov edx, dword [ebp - 0x3c]
mov word [edx + eax + 8], cx
mov eax, dword [ebp - 0x28]
shr eax, 0x10
and eax, 0xffff
mov ecx, 2
imul edx, ecx, 0
mov ecx, dword [ebp - 0x3c]
mov word [ecx + edx + 0x10], ax
mov edx, dword [ebp - 0x28]
and edx, 0xffff
mov eax, 2
shl eax, 0
mov ecx, dword [ebp - 0x3c]
mov word [ecx + eax + 0x10], dx
mov edx, dword [ebp - 0x24]
shr edx, 0x10
and edx, 0xffff
mov eax, 2
shl eax, 1
mov ecx, dword [ebp - 0x3c]
mov word [ecx + eax + 0x10], dx
mov edx, dword [ebp - 0x24]
and edx, 0xffff
mov eax, 2
imul ecx, eax, 3
mov eax, dword [ebp - 0x3c]
mov word [eax + ecx + 0x10], dx
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x18], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x1c], ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x20], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x24], edx
jmp 0x49386d
xor eax, eax
jmp 0x4938b6
mov eax, dword [ebp - 0x3c]
add eax, 0x438
push eax
push 0x56a180
mov ecx, dword [ebp - 0x3c]
call fcn.00493b90
mov ecx, dword [ebp - 0x3c]
add ecx, 0xc58
push ecx
push 0x56a198
mov ecx, dword [ebp - 0x3c]
call fcn.00493b90
mov edx, dword [ebp - 0x3c]
add edx, 0x848
push edx
push 0x56a1b8
mov ecx, dword [ebp - 0x3c]
call fcn.00493b90
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae22e
mov esp, ebp
pop ebp
ret
Function at 0x494a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554fe3
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5ac7dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
call fcn.00496360
push 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x494ace
mov eax, 1
jmp 0x494b1c
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x228]
call fcn.0047acb0
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0047b1d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.0047afc0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae22e
mov esp, ebp
pop ebp
ret

Function at 0x494da0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555069
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x5ac7dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x818], 0
mov ax, word [0x558800]
mov word [ebp - 0x810], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x80e]
push ecx
call fcn.004d3150
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0x558800
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.0047acb0
mov dword [ebp - 4], 0
push 0x563fac
push 0x563fb0
lea ecx, [ebp - 0x814]
call fcn.00496750
lea ecx, [ebp - 0x814]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0047ac60
mov edx, dword [ebp - 0x818]
or edx, 1
mov dword [ebp - 0x818], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.0047afc0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae22e
mov esp, ebp
pop ebp
ret
Function at 0x495460
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555198
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5ac7dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0047ad50
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp + 0xc]
call fcn.0047b350
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x495579
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp + 0xc]
call fcn.0047b350
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x495579
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x5847dc
mov edx, dword [ebp - 0x24]
push edx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
and eax, 0xffff
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x14]
shr edx, 0x10
and edx, 0xffff
mov word [ebp - 0x14], dx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x14]
and ecx, 0xffff
mov word [ebp - 0x10], cx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 0x14]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1c]
push edx
push str._u._u._u._u
lea eax, [ebp - 0x28]
push eax
call fcn.0047bab0
add esp, 0x18
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.0047ac60
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0047afc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0047afc0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4955d0
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5551cb
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5ac7dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0047ad50
mov byte [ebp - 4], 1
push 0
push 0x3a
lea ecx, [ebp + 8]
call fcn.004963a0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x495626
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x5c
lea ecx, [ebp + 8]
call fcn.004963a0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x495651
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0047b1d0
jmp 0x495686
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp + 8]
call fcn.0047c330
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0047b1d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047afc0
push 0
lea ecx, [ebp - 0x14]
call fcn.0047b350
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4956d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4956d4
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0047afc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0047afc0
mov eax, dword [ebp - 0x2c]
jmp 0x495750
lea ecx, [ebp - 0x14]
call fcn.0047b350
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
and edx, 0x10
jne 0x495715
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0047afc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0047afc0
mov eax, dword [ebp - 0x34]
jmp 0x495750
cmp dword [ebp - 0x10], 0xffffffff
jne 0x49571d
jmp 0x49572b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x49562c
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0047afc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0047afc0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret