joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480e50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1c
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
cmp byte [0x529678], 0
je 0x480e7c
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov byte [0x529678], 1
cmp dword [0x5296b4], 0
jne 0x480efd
push 8
call fcn.00476140
pop ecx
cmp eax, 0
je 0x480ef8
mov esi, eax
mov dword [ebp - 0x1c], 0
mov eax, str.menuShutdown
cmp eax, 0
je 0x480ed7
push str.menuShutdown
call fcn.0040dc70
pop ecx
push eax
push str.menuShutdown
lea ecx, [ebp - 0x1c]
call fcn.0040c560
cmp dword [ebp - 0x1c], 0
je 0x480ed7
mov ebx, dword [ebp - 0x1c]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.00435af0
cmp dword [ebp - 0x1c], 0
je 0x480ef0
mov ecx, dword [ebp - 0x1c]
call fcn.0040c380
mov dword [esi], 0x5296c0
mov eax, esi
mov dword [0x5296b4], eax
call fcn.00492660
cmp al, 0
je 0x480f18
push 0
push str.SHELL_TRAYWND
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x20], eax
jmp 0x480f28
push 0
push 0x529688
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x480f39
push 0
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00492600
cmp al, 0
je 0x480f4c
call fcn.00492630
mov dword [ebp - 0x20], eax
jmp 0x480f55
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x480f7c
cmp dword [0x529680], 0
jne 0x480f7c
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_GetMenu]
mov dword [0x529680], eax
mov eax, dword [ebp - 0x20]
mov dword [0x529684], eax
jmp 0x480f89
cmp dword [ebp - 0x20], 0
jne 0x480f89
mov byte [0x529678], 0
mov eax, dword [ebp - 0x20]
cmp dword [0x529684], eax
jne 0x480ff4
push 0xf
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_GetMenu]
cmp eax, 0
jne 0x480fb4
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_SetMenu]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0xc], edx
push 1
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
push edx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x18]
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_MoveWindow]
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x485930
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [ebp - 8], ecx
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0
je 0x48595f
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 4], eax
jmp 0x48596a
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 4], eax
movsx eax, word [ebp - 4]
test eax, 0x8000
je 0x485979
mov al, 1
jmp 0x48597b
mov al, 0
leave
ret

Function at 0x4864b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [ebp - 8], ecx
push 1
mov edx, dword [ebp - 8]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0xd0]
cmp byte [ebp + 8], 0
jne 0x4864eb
call fcn.004691a0
cmp dword [ebp - 8], eax
jne 0x4864eb
push 0
call fcn.00469120
pop ecx
cmp byte [ebp + 8], 0
je 0x486501
push 5
mov eax, dword [ebp - 8]
push dword [eax + 0x58]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x48650f
push 0
mov eax, dword [ebp - 8]
push dword [eax + 0x58]
call dword [sym.imp.USER32.dll_ShowWindow]
lea esp, [ebp - 4]
pop esi
pop ebp
ret 4

Function at 0x492aa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
cmp dword [ebp + 8], 0x70
jl 0x492acd
cmp dword [ebp + 8], 0x87
jg 0x492acd
mov eax, dword [ebp + 8]
add eax, 0x58
leave
ret
cmp dword [ebp + 8], 0x60
jl 0x492ae1
cmp dword [ebp + 8], 0x69
jg 0x492ae1
mov eax, dword [ebp + 8]
add eax, 0xffffffd0
leave
ret
mov edx, dword [ebp + 8]
sub edx, 0x21
cmp edx, 0x76
ja case.0x492aec.41
jmp dword [edx*4 + 0x4fe00c]
mov eax, 3
leave
ret
mov eax, 0x1c
leave
ret
mov eax, 0x1d
leave
ret
mov eax, 0x1e
leave
ret
mov eax, 0x1f
leave
ret
mov eax, 1
leave
ret
mov eax, 4
leave
ret
mov eax, 0xb
leave
ret
mov eax, 0xc
leave
ret
mov eax, 5
leave
ret
mov eax, 0x7f
leave
ret
mov eax, 0x2a
leave
ret
mov eax, 0x2b
leave
ret
mov eax, 0x2d
leave
ret
mov eax, 0x2e
leave
ret
mov eax, 0x2f
leave
ret
cmp dword [ebp + 8], 0x1f
jle 0x492bd5
mov dword [ebp - 4], 0x20
jmp 0x492bcc
movsx eax, byte [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov dword [ebp - 8], eax
mov dl, byte [ebp - 8]
and dl, 0xff
mov byte [ebp - 9], dl
movsx edx, word [ebp - 8]
and edx, 0xff00
sar edx, 8
mov byte [ebp - 0xa], dl
movzx edx, byte [ebp - 9]
cmp edx, dword [ebp + 8]
jne 0x492bc9
movsx eax, byte [ebp - 0xa]
test eax, 1
je 0x492bb3
cmp byte [ebp + 0xc], 0
jne 0x492bc4
movsx eax, byte [ebp - 0xa]
test eax, 1
jne 0x492bc9
cmp byte [ebp + 0xc], 0
jne 0x492bc9
mov eax, dword [ebp - 4]
leave
ret
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jl 0x492b72
mov eax, dword [ebp + 8]
leave
ret
Function at 0x496810
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0xc
rep stosd dword es:[edi], eax
pop edi
pop ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsRectEmpty]
cmp eax, 0
je 0x49683f
mov eax, 0
leave
ret
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x28], ecx
push 8
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 4], eax
push 0xa
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x18], eax
push 0xcc0020
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push 0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x14], eax
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x14]
leave
ret

Function at 0x497af0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0xa0
push ecx
lea edi, [esp + 4]
mov eax, 0xcccccccc
mov ecx, 0x28
rep stosd dword es:[edi], eax
pop ecx
cmp byte [0x52aea5], 0
je 0x497ba8
lea edi, [ebp - 0xa0]
mov eax, 0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov byte [0x52aea5], 0
mov dword [ebp - 0xa0], 0x9c
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x497b86
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, 0
jne 0x497b86
mov byte [0x52aea4], 0
mov eax, 0
lea esp, [ebp - 4]
pop edi
pop ebp
ret
cmp dword [ebp - 0x90], 2
jne 0x497ba8
cmp dword [ebp - 0x9c], 5
jne 0x497ba8
cmp dword [ebp - 0x98], 1
jne 0x497ba8
mov byte [0x52aea4], 1
movzx eax, byte [0x52aea4]
lea esp, [ebp - 4]
pop edi
pop ebp
ret
Function at 0x49f090
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1c
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
cmp dword [ebp + 8], 0
je 0x49f0b7
cmp dword [ebp + 0xc], 0
jne 0x49f0d0
push 0xab
push str.FormatNumber.cpp
push 4
push 0x83
call fcn.004807b0
add esp, 0x10
mov dword [ebp - 0x10], 0
push 0x52c0d7
call fcn.0040dc70
pop ecx
push eax
push 0x52c0d7
lea ecx, [ebp - 0x10]
call fcn.0040c560
cmp dword [ebp - 0x10], 0
je 0x49f102
mov ebx, dword [ebp - 0x10]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040cc10
push eax
mov ecx, dword [ebp + 8]
call fcn.0040cc10
cmp dword [ebp - 0x10], 0
je 0x49f125
mov ecx, dword [ebp - 0x10]
call fcn.0040c380
push 4
lea eax, [ebp - 8]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 4
lea eax, [ebp - 0xc]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
call fcn.0040dc70
pop ecx
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040c560
cmp dword [ebp - 0x14], 0
je 0x49f17e
mov ebx, dword [ebp - 0x14]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040d4b0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040cc10
cmp dword [ebp - 0x18], 0
je 0x49f1ab
mov ecx, dword [ebp - 0x18]
call fcn.0040c380
cmp dword [ebp - 0x14], 0
je 0x49f1b9
mov ecx, dword [ebp - 0x14]
call fcn.0040c380
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 8]
lea eax, [ebp - 8]
push eax
call fcn.0040dc70
pop ecx
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040c560
cmp dword [ebp - 0x1c], 0
je 0x49f1ec
mov ebx, dword [ebp - 0x1c]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.0040d4b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040cc10
cmp dword [ebp - 0x20], 0
je 0x49f219
mov ecx, dword [ebp - 0x20]
call fcn.0040c380
cmp dword [ebp - 0x1c], 0
je 0x49f227
mov ecx, dword [ebp - 0x1c]
call fcn.0040c380
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x4af530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x4af55a
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
jmp 0x4af55f
mov edx, 0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
jmp 0x4af5bc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x4af58a
mov ebx, dword [ebp - 8]
add ebx, 1
mov eax, dword [ebp + 8]
mov edx, dword [eax]
add ebx, dword [edx + 4]
jmp 0x4af58f
mov ebx, 0x501009
movzx eax, byte [ebx]
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0x14], 0x61
jl 0x4af5aa
cmp byte [ebp - 0x14], 0x7a
jg 0x4af5aa
mov dl, byte [ebp - 0x14]
add dl, 0xe0
mov byte [ebp - 0x14], dl
mov ecx, dword [ebp - 0x10]
shl ecx, 2
movsx edx, byte [ebp - 0x14]
xor ecx, edx
mov dword [ebp - 0x10], ecx
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jl 0x4af572
mov eax, dword [ebp - 0x10]
and eax, 0xff
lea esp, [ebp - 4]
pop ebx
pop ebp
ret

Function at 0x4b0940
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0x528df8
mov eax, dword [0x5291f0]
mov dword [ebp - 4], eax
jmp 0x4b0997
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x4b098f
mov eax, dword [ebp - 4]
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
add ecx, 0x24
call fcn.0040caf0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x4b0968
mov ecx, dword [ebp - 8]
call fcn.00435b30
mov eax, dword [ebp - 8]
leave
ret
Function at 0x4c0cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x41c
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x107
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 0x424]
call fcn.004c37c0
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0xfffffff6
jne 0x4c0d4b
lea eax, [ebp - 0x410]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov byte [ebp + eax - 0x411], 0
mov byte [ebp - 0x415], 1
jmp 0x4c0dfd
cmp dword [ebp - 0x41c], 0xffffffff
jne 0x4c0d62
mov eax, 0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret 4
cmp dword [ebp - 0x41c], 0xfffffff5
jne 0x4c0d8c
push 0x18
call fcn.00476140
pop ecx
cmp eax, 0
je 0x4c0d81
mov ecx, eax
call fcn.004d5050
mov eax, eax
mov eax, eax
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp eax, 0
jge 0x4c0da9
mov eax, 0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x41c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, 0
je 0x4c0dce
mov eax, 0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov byte [ebp - 0x415], al
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov esi, dword [edx]
call dword [esi + 0x14]
push dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov esi, dword [edx]
call dword [esi + 8]
cmp byte [ebp - 0x415], 0
je 0x4c0e9d
mov bl, 0
push 0x14
call fcn.00476140
pop ecx
mov esi, eax
cmp esi, 0
je 0x4c0e79
mov dword [ebp - 0x414], 0
lea edx, [ebp - 0x410]
lea eax, [ebp - 0x410]
push eax
call fcn.0040dc70
pop ecx
push eax
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x414]
call fcn.0040c560
cmp dword [ebp - 0x414], 0
je 0x4c0e63
mov ebx, dword [ebp - 0x414]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
mov bl, 1
push 0
push 0
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
call fcn.004bf510
mov esi, eax
cmp bl, 0
je 0x4c0e92
cmp dword [ebp - 0x414], 0
je 0x4c0e92
mov ecx, dword [ebp - 0x414]
call fcn.0040c380
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret 4
mov eax, 0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4c5e80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x428
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x10a
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp eax, 0
jge 0x4c5ec1
mov eax, 0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, 0
je 0x4c5ee1
mov eax, 0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov dword [ebp - 0x424], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov esi, dword [edx]
call dword [esi + 0x14]
push dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov esi, dword [edx]
call dword [esi + 8]
cmp dword [ebp - 0x424], 0
je 0x4c60ba
mov dword [ebp - 0x414], 0
lea edx, [ebp - 0x410]
lea eax, [ebp - 0x410]
push eax
call fcn.0040dc70
pop ecx
push eax
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x414]
call fcn.0040c560
cmp dword [ebp - 0x414], 0
je 0x4c5f65
mov ebx, dword [ebp - 0x414]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
mov dword [ebp - 0x418], 0
push 0x531858
call fcn.0040dc70
pop ecx
push eax
push 0x531858
lea ecx, [ebp - 0x418]
call fcn.0040c560
cmp dword [ebp - 0x418], 0
je 0x4c5fa3
mov ebx, dword [ebp - 0x418]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0040d4b0
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x414]
call fcn.0040cc10
cmp dword [ebp - 0x41c], 0
je 0x4c5fe6
mov ecx, dword [ebp - 0x41c]
call fcn.0040c380
cmp dword [ebp - 0x418], 0
je 0x4c5ffa
mov ecx, dword [ebp - 0x418]
call fcn.0040c380
mov byte [ebp - 0x42d], 0
push 0x14
call fcn.00476140
pop ecx
mov ebx, eax
cmp ebx, 0
je 0x4c604b
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x420], edx
cmp dword [ebp - 0x420], 0
je 0x4c6030
mov ecx, dword [ebp - 0x420]
call fcn.0040c350
mov byte [ebp - 0x42d], 1
push 0
push 0
lea eax, [ebp - 0x420]
push eax
mov ecx, ebx
call fcn.004bf510
mov ebx, eax
mov dword [ebp - 0x428], ebx
cmp byte [ebp - 0x42d], 0
je 0x4c606e
cmp dword [ebp - 0x420], 0
je 0x4c606e
mov ecx, dword [ebp - 0x420]
call fcn.0040c380
push 0x5108bc
call fcn.004d90c0
pop ecx
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
je 0x4c6097
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x428]
mov dword [eax + 0x18], ecx
mov ebx, dword [ebp - 0x42c]
cmp dword [ebp - 0x414], 0
je 0x4c60b1
mov ecx, dword [ebp - 0x414]
call fcn.0040c380
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, 0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x4c6320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x404
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x101
rep stosd dword es:[edi], eax
pop edi
pop ecx
push 0x400
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x408], 0
lea edx, [ebp - 0x404]
lea eax, [ebp - 0x404]
push eax
call fcn.0040dc70
pop ecx
push eax
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x408]
call fcn.0040c560
cmp dword [ebp - 0x408], 0
je 0x4c6398
mov ebx, dword [ebp - 0x408]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x408]
push eax
call fcn.004c5c30
pop ecx
mov ebx, eax
cmp dword [ebp - 0x408], 0
je 0x4c63bb
mov ecx, dword [ebp - 0x408]
call fcn.0040c380
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret

Function at 0x4c6490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x808
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x202
rep stosd dword es:[edi], eax
pop edi
pop ecx
lea eax, [ebp - 0x404]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
mov byte [ebp + eax - 0x405], 0
lea eax, [ebp - 0x804]
push eax
push 0
push 0x53185a
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x808], 0
lea edx, [ebp - 0x804]
lea eax, [ebp - 0x804]
push eax
call fcn.0040dc70
pop ecx
push eax
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x808]
call fcn.0040c560
cmp dword [ebp - 0x808], 0
je 0x4c6537
mov ebx, dword [ebp - 0x808]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x808]
push eax
call fcn.004c5c30
pop ecx
mov ebx, eax
cmp dword [ebp - 0x808], 0
je 0x4c655a
mov ecx, dword [ebp - 0x808]
call fcn.0040c380
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x4d1460
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4d1483
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov eax, dword [edx + 0xc]
jmp 0x4d1488
mov eax, 0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040cb50
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.0040caf0
push eax
mov eax, dword [ebp - 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
sete al
leave
ret 8

Function at 0x4d14c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [ebp - 4], ecx
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
mov ecx, dword [ebp + 8]
call fcn.0040caf0
push eax
mov eax, dword [ebp - 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
sete al
leave
ret 8

Function at 0x4d1500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x10c
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x43
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x10], 0xff
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x114]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [esi], 0
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x110]
push eax
call fcn.0040dc70
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
call fcn.0040c560
cmp dword [esi], 0
je 0x4d158d
mov ebx, dword [esi]
mov edx, dword [0x5022fc]
mov dword [ebx + 0x10], edx
mov edx, esi
mov eax, dword [ebp + 8]
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4d15a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.0040caf0
push eax
mov eax, dword [ebp - 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
dec edx
cmp edx, 3
ja case.0x4d15f0.2
jmp dword [edx*4 + 0x4fe750]
mov dword [ebp - 4], 0
jmp 0x4d1619
mov dword [ebp - 4], 1
jmp 0x4d1619
mov dword [ebp - 4], 2
jmp 0x4d1619
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
leave
ret 4