joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497f4c
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe00
mov ebp, eax
mov eax, 0x15e
call fcn.00402504
mov esi, eax
mov eax, dword [ebp + 0x18]
test eax, eax
jl 0x498127
push esp
push 0xff
mov edx, eax
mov eax, dword [ebp + 4]
mov ecx, 6
call fcn.004101bc
mov eax, esp
call fcn.004ab81c
mov eax, dword [0x4befa8]
xor ecx, ecx
mov edx, 0x80000000
call fcn.004adc9c
mov edi, eax
cmp edi, 0xffffffff
je 0x498118
push 0
push 0
push 0x10
push edi
call sub.kernel32.dll_SetFilePointer_1
push pe_nt_image_headers32
lea eax, [esp + 0x104]
push eax
push edi
call sub.kernel32.dll__lread
push edi
call sub.kernel32.dll_CloseHandle_1
mov ax, 0x11a
call fcn.004aa600
mov edx, eax
mov eax, esi
call fcn.004b81b0
test bl, bl
je 0x498000
lea eax, [esp + 0x100]
call fcn.004aed10
push eax
mov ax, 0x292
call fcn.004aa600
pop edx
call fcn.004ae1b0
jmp 0x498015
mov ax, 0x292
call fcn.004aa600
lea edx, [esp + 0x100]
call fcn.004ae1b0
mov eax, dword [0x4bedb0]
push eax
push esi
call sub.kernel32.dll_lstrcatA
mov edx, 2
mov eax, esi
call fcn.004b12a8
test al, al
jbe 0x498127
mov eax, dword [0x4befa8]
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x49805e
mov edx, dword [0x4befa8]
mov ax, 4
call fcn.004acdac
jmp 0x498127
mov eax, dword [0x4befa8]
call fcn.004adcfc
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.004b19b4
mov edx, dword [ebp + 0x18]
mov eax, ebp
call fcn.00486b70
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 4]
call fcn.0041002c
dec dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x4980d3
mov dword [ebp + 0x18], 0xffffffff
push 2
mov eax, dword [ebp]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SetFocus
mov eax, ebp
xor ecx, ecx
mov dx, 1
call fcn.00489a04
mov eax, ebp
xor ecx, ecx
mov dx, 3
call fcn.00489a04
mov eax, ebp
xor ecx, ecx
mov dx, 4
call fcn.00489a04
jmp 0x4980ed
cmp eax, dword [ebp + 0x18]
jne 0x4980db
dec dword [ebp + 0x18]
push 2
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 4]
mov ecx, 2
call fcn.0041018c
fild dword [ebp + 0x1c]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov ax, 0x11c
call fcn.004aa600
call fcn.004ae0e4
mov ecx, dword [0x4bedb0]
mov eax, ebp
mov dx, 0x65
call fcn.00488934
jmp 0x498127
mov edx, dword [0x4befa8]
mov ax, 4
call fcn.004acdac
mov eax, esi
call fcn.00402524
add esp, 0x200
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x498a28
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
xor ebx, ebx
push 0x163
mov eax, dword [0x4bedb0]
push eax
push 0x30a
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [0x4bedb0]
cmp byte [eax], 0
jne 0x498a6f
mov eax, dword [esp]
mov dx, 0x30a
call fcn.00488878
jmp 0x498b87
mov eax, dword [0x4bedb0]
call fcn.004b8144
cmp eax, 0xff
jle 0x498ab5
push 0
push 0xff
mov ax, 0x10f
call fcn.004aa600
call fcn.004ae0e4
mov eax, dword [0x4bedb0]
mov edx, 3
call fcn.004b12a8
mov eax, dword [esp]
mov dx, 0x30a
call fcn.00488878
jmp 0x498b87
mov esi, dword [0x4bedb0]
mov edi, dword [0x4be784]
add edi, 0x1b7a
mov edx, 0xff
mov eax, edi
call fcn.004066e4
mov dl, 0xd
mov eax, esi
call fcn.004b8284
mov ebp, eax
test ebp, ebp
je 0x498b12
cmp esi, ebp
je 0x498b0d
mov ecx, ebp
sub cx, si
mov edx, esi
mov eax, edi
call fcn.004b81d8
mov eax, edi
call fcn.004989b0
test al, al
je 0x498b87
mov eax, edi
call fcn.004b8144
inc eax
add edi, eax
lea esi, [ebp + 2]
jmp 0x498b26
mov edx, esi
mov eax, edi
call fcn.004b81b0
mov eax, edi
call fcn.004989b0
test al, al
je 0x498b87
test ebp, ebp
jne 0x498ad3
mov edx, dword [0x4be784]
add edx, 0x1b7a
mov eax, dword [0x4be644]
mov ecx, 0xff
call fcn.004066dc
mov edx, 0xff
mov eax, dword [0x4be644]
cmp byte [eax], 0
jne 0x498b5d
cmp byte [eax + 1], 0
je 0x498b5d
mov byte [eax], 0x3b
inc eax
dec edx
jne 0x498b4f
mov edx, dword [0x4beb38]
mov eax, 0x498b90
mov cl, 1
call fcn.004ae4fc
cmp al, 0xff
jne 0x498b85
mov eax, dword [esp]
mov dx, 0x30a
call fcn.00488878
jmp 0x498b87
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49e05c
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
xor eax, eax
test bl, bl
jge 0x49e09e
movsx edx, bl
mov ecx, dword [0x4be6ac]
mov edx, dword [ecx + edx*4 + 0xa8]
test edx, edx
je 0x49e166
movsx eax, bl
mov ecx, dword [0x4be6ac]
mov eax, esi
call fcn.004b81b0
mov al, 1
jmp 0x49e166
cmp bl, 0x1a
jle 0x49e0b5
mov ecx, esi
xor edx, edx
mov eax, ebx
call fcn.0049e530
mov al, 1
jmp 0x49e166
movsx edi, bl
mov eax, dword [0x4be328]
mov eax, dword [eax + edi*4 - 4]
test eax, eax
je 0x49e0de
movsx edx, bl
mov ecx, dword [0x4be328]
call fcn.004b8480
mov eax, dword [0x4be328]
xor edx, edx
mov dword [eax + edi*4 - 4], edx
mov eax, edi
add eax, 0x40
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
push 0xff
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xff
push esi
lea eax, [esp + 0x1c]
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x49e149
mov eax, esi
call fcn.004b8144
test eax, eax
jle 0x49e149
lea eax, [esi + 1]
push eax
call sub.user32.dll_CharLowerA
mov eax, esi
call fcn.004b8404
movsx edx, bl
mov ecx, dword [0x4be328]
mov dword [ecx + edx*4 - 4], eax
jmp 0x49e150
mov byte [esi], 0
xor eax, eax
jmp 0x49e166
movsx eax, bl
mov edx, dword [0x4be328]
mov edx, dword [edx + eax*4 - 4]
mov eax, esi
call fcn.004b81b0
mov al, 1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x49e43c
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov esi, ecx
mov edi, edx
mov byte [esi], 0
mov byte [edi], 0
cmp al, 0x1a
jbe 0x49e45b
mov bl, 1
jmp 0x49e51f
and eax, 0xff
add eax, 0x40
mov edx, dword [0x4bedb0]
mov byte [edx], al
mov eax, dword [0x4bedb0]
mov byte [eax + 1], 0x3a
mov eax, dword [0x4bedb0]
mov byte [eax + 2], 0x5c
mov eax, dword [0x4bedb0]
mov byte [eax + 3], 0
push 0xff
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0xff
mov eax, dword [0x4beb38]
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x49e51d
cmp byte [esp + 0xc], 0
je 0x49e51d
mov bl, 1
push 0x49e52c
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x49e4d8
mov byte [edi], 2
test byte [esp + 8], 0x10
je 0x49e4e2
mov byte [esi], 1
test byte [esp + 9], 0x80
je 0x49e4ec
mov byte [esi], 2
mov esi, 0xfffffffe
mov ebp, dword [0x4bef40]
add ebp, 0x1c
mov eax, dword [ebp]
push eax
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x49e512
mov eax, esi
mov byte [edi], al
jmp 0x49e51f
inc esi
add ebp, 4
cmp esi, 5
jne 0x49e4fa
jmp 0x49e51f
xor ebx, ebx
mov eax, ebx
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49ea34
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
push ebx
push esi
xor ebx, ebx
push 0
mov eax, dword [0x4beb40]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x49ea61
mov edx, dword [0x4beb40]
mov edx, dword [edx + 0xc]
mov ax, 9
call fcn.004acdac
jmp 0x49eada
call sub.kernel32.dll_GetTickCount
mov esi, eax
push 0x14
call sub.kernel32.dll_Sleep
push 0
push 0x49eae0
call sub.user32.dll_FindWindowA
mov edx, dword [0x4beb98]
mov dword [edx], eax
mov eax, dword [0x4beb98]
cmp dword [eax], 0
jne 0x49ea9b
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0x3e8
jbe 0x49ea68
mov eax, dword [0x4beb98]
cmp dword [eax], 0
jne 0x49eab9
mov edx, dword [0x4beb40]
mov edx, dword [edx + 0xc]
mov ax, 0xa
call fcn.004acdac
jmp 0x49eada
mov eax, dword [0x4be450]
cmp byte [eax], 0
je 0x49ead8
mov eax, dword [0x4beae0]
mov eax, dword [eax]
push eax
mov eax, dword [0x4beb98]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4a0888
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
movsx eax, bl
mov edx, dword [0x4be408]
cmp esi, dword [edx + eax*4 + 0xa8]
ja 0x4a0a6b
lea eax, [ebp - 0x20d]
push eax
mov ecx, 1
mov edx, esi
mov eax, ebx
call fcn.0049f7f8
test al, al
je 0x4a0a6b
cmp byte [ebp - 0xf], 0x55
jne 0x4a0a6b
cmp byte [ebp - 0xe], 0xaa
jne 0x4a0a6b
movzx esi, byte [ebp - 0x4f]
xor eax, eax
mov al, byte [ebp - 0x3f]
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x2f]
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x1f]
add esi, eax
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x4a09a0
lea eax, [ebp - 0x4e]
fild qword [eax]
fcomp dword [0x4a0a74]
fnstsw ax
sahf
jne 0x4a0932
lea eax, [ebp - 0x46]
fild qword [eax]
fcomp dword [0x4a0a74]
fnstsw ax
sahf
je 0x4a095f
and esi, 0x8000007f
jns 0x4a093f
dec esi
or esi, 0xffffff80
inc esi
test esi, esi
jne 0x4a095f
movsx eax, bl
mov edx, dword [0x4be408]
mov eax, dword [edx + eax*4 + 0xa8]
lea edx, [ebp - 0x43]
cmp eax, dword [edx]
jb 0x4a095f
cmp bl, 0xfe
jle 0x4a09a0
cmp dword [ebp + 8], 0
jne 0x4a0a6b
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004a01d8
mov byte [ebp - 0xd], al
push 0
movsx eax, bl
mov edx, dword [0x4be408]
mov eax, dword [edx + eax*4 + 0xa8]
push eax
mov al, byte [ebp - 0xd]
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
call fcn.004a0830
jmp 0x4a0a6b
xor edi, edi
mov eax, edi
shl eax, 4
mov edx, eax
add edx, 0x1c0
lea edx, [ebp + edx - 0x20d]
cmp word [edx], 0
je 0x4a0a61
add eax, 0x1c6
lea eax, [ebp + eax - 0x20d]
mov esi, dword [eax]
add esi, dword [ebp + 8]
mov eax, edi
shl eax, 4
add eax, 0x1c2
mov al, byte [ebp + eax - 0x20d]
cmp al, 5
je 0x4a09f5
mov edx, edi
shl edx, 4
add edx, 0x1c2
cmp al, 0xf
jne 0x4a0a12
cmp dword [ebp + 8], 0
jne 0x4a09fe
mov dword [ebp + 8], esi
push esi
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004a0888
jmp 0x4a0a61
mov eax, edi
shl eax, 4
add eax, 0x1c6
lea eax, [ebp + eax - 0x20d]
mov esi, dword [eax]
add esi, dword [ebp - 0xc]
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.004a01d8
mov byte [ebp - 0xd], al
push esi
mov eax, edi
shl eax, 4
add eax, 0x1ca
lea eax, [ebp + eax - 0x20d]
mov eax, dword [eax]
push eax
mov al, byte [ebp - 0xd]
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
call fcn.004a0830
test al, al
je 0x4a0a6b
inc edi
cmp edi, 4
jne 0x4a09a2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a3ca0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
or esi, 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x4a3e0e
mov eax, dword [0x4be784]
cmp byte [eax + 0x1831], 0
je 0x4a3e2d
lea eax, [ebp - 0x10a]
mov edx, edi
call fcn.004b81b0
lea eax, [ebp - 0x10a]
call fcn.004aedb4
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x10a]
push eax
call sub.kernel32.dll_lstrcatA
xor ebx, ebx
jmp 0x4a3d65
lea eax, [ebp - 0x10a]
mov edx, edi
call fcn.004b81b0
lea eax, [ebp - 0x10a]
call fcn.004aedb4
xor eax, eax
mov al, bl
mov dword [ebp - 0x110], eax
fild dword [ebp - 0x110]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b849c
push eax
lea eax, [ebp - 0x10a]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4a3e40
lea eax, [ebp - 0x10a]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x10a]
push eax
call sub.kernel32.dll_lstrcatA
inc ebx
lea eax, [ebp - 0x10a]
call fcn.004b194c
test al, al
jne 0x4a3d02
mov eax, dword [0x4be784]
cmp byte [eax + 0x187b], 0
je 0x4a3db1
lea eax, [ebp - 0x10a]
call fcn.004ab508
test al, al
jne 0x4a3da5
lea edx, [ebp - 0x10a]
mov ax, 3
call fcn.004acdac
jmp 0x4a3e32
lea eax, [ebp - 0x10a]
push eax
call sub.kernel32.dll_DeleteFileA_1
push 0
lea eax, [ebp - 0x10a]
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4a3dda
lea edx, [ebp - 0x10a]
mov ax, 3
call fcn.004acdac
jmp 0x4a3e32
inc dword [0x4c251c]
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov al, byte [ebp + 0x10]
push eax
push 1
push 0
lea eax, [ebp - 0x10a]
push eax
lea eax, [ebp - 0xa]
push eax
or ecx, 0xffffffff
mov edx, dword [ebp - 4]
mov al, byte [ebp + 0x1c]
call fcn.004a40a4
inc eax
je 0x4a3e32
jmp 0x4a3e2d
push edi
push 0
push 0
mov eax, dword [0x4be754]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4 - 4]
mov ecx, ebx
mov edx, dword [ebp - 8]
call fcn.00461604
test al, al
je 0x4a3e32
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4a9974
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdc0
lea edi, [esp + 0x100]
xor esi, esi
mov edx, esp
xchg edx, eax
call fcn.004b81b0
push 0x4a99ec
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4beb54]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov byte [edi + 0x2c], 0
push edi
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x4a99d1
test byte [edi], 0x10
jne 0x4a99c6
inc esi
mov byte [edi + 0x2c], 0
push edi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp byte [edi + 0x2c], 0
jne 0x4a99c0
push ebx
call sub.kernel32.dll_FindClose
mov eax, esi
add esp, 0x240
pop edi
pop esi
pop ebx
ret

Function at 0x4a99f0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get common file path
Set current directory
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffcc0
mov esi, eax
lea ebp, [esp + 0x200]
xor ebx, ebx
lea eax, [esp + 0x100]
mov edx, esi
call fcn.004b81b0
push 0x4a9b3c
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4beb54]
push eax
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcatA
mov byte [ebp + 0x2c], 0
push ebp
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_FindFirstFileA
mov edi, eax
jmp 0x4a9ac8
cmp al, 0x2e
je 0x4a9abd
mov eax, esp
mov edx, esi
call fcn.004b81b0
push 0x4a9b3c
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp + 0x2c]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
test byte [ebp], 0x10
jne 0x4a9aa8
push 0x80
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_SetFileAttributesA
push esp
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4a9abd
push edi
call sub.kernel32.dll_FindClose
jmp 0x4a9b2c
mov eax, esp
call fcn.004a99f0
mov ebx, eax
test bl, bl
jne 0x4a9abd
push edi
call sub.kernel32.dll_FindClose
jmp 0x4a9b2c
mov byte [ebp + 0x2c], 0
push ebp
push edi
call sub.kernel32.dll_FindNextFileA
mov al, byte [ebp + 0x2c]
test al, al
jne 0x4a9a4e
push edi
call sub.kernel32.dll_FindClose
push 0x4cf288
push 0xff
call sub.kernel32.dll_GetCurrentDirectoryA
push esi
push 0x4cf288
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x4a9b01
push 0x4c4f84
call sub.kernel32.dll_SetCurrentDirectoryA
push esi
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4a9b2c
call sub.kernel32.dll_GetLastError_1
call fcn.004ae200
mov eax, 0x4cf288
mov ecx, 1
mov edx, esi
call fcn.004b12b8
mov eax, ebx
add esp, 0x340
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4aa1d8
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov eax, dword [0x4bdd9c]
call fcn.004b1c50
push 0
push 0x4cf288
call sub.kernel32.dll__lopen
mov edi, eax
cmp edi, 0xffffffff
jne 0x4aa212
mov edx, 0x4cf288
mov ax, 1
call fcn.004acdac
jmp 0x4aa2bd
mov dword [0x4c8230], 0x6221
mov eax, 0x4c8668
mov edx, dword [0x4c8230]
call fcn.004066e4
push 0
push edi
call sub.kernel32.dll_GetFileSize_1
mov ebp, eax
push 4
push 0x1000
lea ebx, [ebp + 1]
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
test esi, esi
jne 0x4aa26d
mov dword [esp], ebx
fild dword [esp]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b1e30
mov edx, eax
mov ax, 0xb
call fcn.004acdac
jmp 0x4aa2b7
push ebp
push esi
push edi
call sub.kernel32.dll__lread
mov ebx, esi
inc ebx
mov al, byte [ebx]
test al, al
je 0x4aa282
cmp al, 0xa
jne 0x4aa277
lea eax, [esp + 4]
mov edx, ebx
call fcn.0040366c
lea eax, [esp + 4]
mov edx, 0x4aa2c8
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402ec4
je 0x4aa2b7
inc ebx
mov eax, ebx
call fcn.004a9df4
push 0x4000
inc ebp
push ebp
push esi
call sub.kernel32.dll_VirtualFree_1
push edi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ac0f4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdec
mov dword [esp], ecx
mov edi, edx
mov ebp, eax
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetSystemTimeAsFileTime
mov esi, edi
mov eax, edi
call fcn.004b8144
mov edx, dword [ebp + 8]
add edx, 0xa
add eax, edx
add eax, 0xb
mov ebx, dword [ebp + 4]
cmp eax, ebx
jle 0x4ac1bb
mov eax, dword [ebp]
mov dword [esp + 4], eax
test ebx, ebx
jne 0x4ac140
mov ebx, 0x400
jmp 0x4ac14e
mov eax, edi
call fcn.004b8144
add eax, dword [ebp + 4]
mov ebx, eax
add ebx, ebx
push 4
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp], eax
cmp dword [ebp], 0
jne 0x4ac190
mov dword [esp + 0x210], ebx
fild dword [esp + 0x210]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b1e30
mov edx, eax
mov ax, 0xb
call fcn.004acdac
jmp 0x4ac261
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4ac1b8
mov ecx, eax
mov eax, dword [ebp]
mov edx, dword [esp + 4]
call fcn.004066dc
push 0x4000
mov eax, dword [ebp + 4]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualFree_1
mov dword [ebp + 4], ebx
xor ebx, ebx
cmp dword [esp], 0
je 0x4ac218
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
mov eax, dword [0x4c2d98]
call fcn.004ac084
cmp byte [0x4c81ab], 6
jne 0x4ac1f4
lea edx, [esp + 0x10]
mov cl, byte [0x4c6809]
mov eax, dword [esp]
call fcn.004b49ac
mov ebx, eax
jmp 0x4ac1f6
xor ebx, ebx
test edi, edi
jne 0x4ac218
push 0xff
lea eax, [esp + 0x114]
push eax
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_GetWindowTextA
lea esi, [esp + 0x110]
mov eax, dword [ebp]
add eax, dword [ebp + 8]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
mov eax, dword [ebp]
add eax, dword [ebp + 8]
add eax, 8
mov byte [eax], bl
mov eax, dword [ebp]
add eax, dword [ebp + 8]
add eax, 8
inc eax
mov edx, esi
call fcn.004b81b0
mov eax, esi
call fcn.004b8144
add eax, 9
inc eax
add dword [ebp + 8], eax
mov eax, dword [0x4c2d98]
mov byte [eax + 0x163], 1
add esp, 0x214
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ac35c
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
push 0
push 0x4cf288
call sub.kernel32.dll__lopen
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ac381
mov edx, esi
mov ax, 1
call fcn.004acdac
jmp 0x4ac3ee
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov dword [0x4cf27c], eax
push 4
push 0x1000
mov eax, dword [0x4cf27c]
inc eax
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x4cf284], eax
cmp dword [0x4cf284], 0
jne 0x4ac3d6
mov eax, dword [0x4cf27c]
inc eax
mov dword [esp], eax
fild dword [esp]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b1e30
mov edx, eax
mov ax, 0xb
call fcn.004acdac
jmp 0x4ac3e8
mov eax, dword [0x4cf27c]
push eax
mov eax, dword [0x4cf284]
push eax
push ebx
call sub.kernel32.dll__lread
push ebx
call sub.kernel32.dll_CloseHandle_1
pop edx
pop esi
pop ebx
ret
Function at 0x4accc8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x4cfd60]
push eax
call sub.user32.dll_IsWindow
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4acd93
push 0
mov eax, dword [0x4bf704]
push eax
push 0
mov eax, dword [0x4cfd40]
push eax
mov eax, dword [0x4c822c]
mov ecx, 5
cdq
idiv ecx
mov ebx, eax
push ebx
mov eax, dword [0x4c8228]
sar eax, 1
jns 0x4acd11
adc eax, 0
push eax
push ebx
mov eax, dword [0x4c8228]
test eax, eax
jns 0x4acd1f
add eax, 3
sar eax, 2
push eax
push 0x80fc0040
mov ax, 0x339
call fcn.004aa600
push eax
mov eax, dword [0x4be9a8]
mov eax, dword [eax + 0xc]
push eax
push 0x280
call sub.user32.dll_CreateWindowExA
mov dword [0x4cfd60], eax
cmp dword [0x4cfd60], 0
jne 0x4acd6f
call sub.kernel32.dll_GetLastError_1
call fcn.004ae200
mov eax, 0x4cf288
mov edx, 1
call fcn.004b12a8
pop esi
pop ebx
ret
push 0
push 0x11
call sub.gdi32.dll_GetStockObject
push eax
push 0x30
mov eax, dword [0x4cfd60]
push eax
call sub.user32.dll_SendMessageA
push 4
mov eax, dword [0x4cfd60]
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
push 0x180
mov eax, dword [0x4cfd60]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret

Function at 0x4ad540
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
cmp dword [0x4c2d98], 0
je 0x4ad5e0
mov edx, 0x4ad5e8
mov eax, esp
call fcn.004b81b0
push 0x32
lea eax, [esp + 0x104]
push eax
mov eax, dword [0x4cfd18]
push eax
call sub.user32.dll_GetWindowTextA
mov ax, 0x136
call fcn.004aa600
push eax
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x4ad5e0
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, esp
call fcn.004ab7d8
push 0x4ad5f8
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
xor eax, eax
mov al, bl
add ax, 0x1c4
call fcn.004aa600
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov edx, esp
mov eax, dword [0x4c2d98]
xor ecx, ecx
call fcn.004a9c04
add esp, 0x200
pop ebx
ret