joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4728f6
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50798d
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0xaba010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0xc], ebx
je 0x472931
push dword [edi + 0xc]
push ebx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [edi + 0xc], ebx
cmp dword [edi + 8], ebx
je 0x47293d
mov ecx, edi
call fcn.00473161
mov eax, dword [0xd506e8]
test eax, eax
je 0x47294e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [edi + 0x24]
call fcn.0041584b
lea esi, [edi + 0x10]
jmp 0x472962
mov ecx, esi
call fcn.0041ea38
cmp dword [esi + 0x10], ebx
jne 0x47295b
mov ebx, dword [esi + 8]
jmp 0x472984
mov eax, dword [esi + 4]
dec ebx
mov ecx, dword [eax + ebx*4]
test ecx, ecx
je 0x472984
push ecx
push 4
push 4
pop edx
call fcn.0040b8be
pop ecx
pop ecx
test ebx, ebx
jne 0x47296c
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x47299c
mov edx, dword [esi + 8]
push ecx
push 4
call fcn.0040b8be
pop ecx
pop ecx
xor ebx, ebx
xor edx, edx
mov dword [esi + 8], ebx
inc edx
push ecx
mov dword [esi + 4], ebx
mov ecx, dword [esi]
push 8
call fcn.0040b8be
mov dword [esi], ebx
or eax, 0xffffffff
mov edx, dword [edi + 4]
pop ecx
pop ecx
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4729d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4730df
Capabilities:
Create process on windows

Disassembly:
push 0
mov eax, 0x5075e9
call fcn.00506098
mov eax, dword [ecx + 0x28]
mov esi, dword [ecx + 0x24]
sub eax, esi
mov edx, dword [ebp + 8]
sar eax, 2
add edx, 0xfffffed4
js 0x473159
dec eax
cmp edx, eax
jg 0x473159
mov ecx, dword [esi + edx*4]
sub ecx, 0x10
call fcn.004098e7
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
xor edi, edi
mov edx, str._ExecuteTrayOpenFld
push esi
mov ecx, str.LastFoldersKeeper
mov dword [ebp - 4], edi
call fcn.0041e74f
pop ecx
push 1
push edi
push edi
push esi
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or eax, 0xffffffff
add esi, 0xfffffff0
mov dword [ebp - 4], eax
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x473159
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00506061
ret 4
Function at 0x473161
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
or dword [ebp - 4], 0xffffffff
push edi
push 0x80
push 4
mov edi, ecx
lea ecx, [ebp - 4]
push 0
push 0x40000000
push dword [edi + 4]
call fcn.0040b961
test eax, eax
je 0x473213
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x7ec8b0
push eax
lea ecx, [ebp - 4]
call fcn.0040b34a
test eax, eax
je 0x473213
mov eax, dword [edi + 0x20]
lea ecx, [ebp - 4]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040b34a
mov eax, dword [edi + 0x10]
lea ecx, [ebp - 0x14]
mov esi, dword [edi + 0x1c]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x18], esi
call fcn.004738e4
mov eax, dword [edi + 0x1c]
add eax, dword [edi + 0x20]
mov dword [ebp - 0xc], esi
cmp esi, eax
je 0x473209
lea ecx, [ebp - 0x14]
call fcn.0041ea6e
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
call fcn.004738e4
mov dword [ebp - 0x18], esi
inc esi
jmp 0x4731d9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
cmp dword [ebp - 4], 0xffffffff
pop edi
je 0x473223
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4757e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
je 0x4758b6
cmp dword [ebp + 8], 0
push esi
je 0x47588e
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x475822
mov eax, dword [0xd58f54]
push ecx
lea ecx, [edi + 0x4c]
push dword [eax + 4]
call fcn.00476686
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x48], eax
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x475839
lea ecx, [edi + 0x4c]
call fcn.004abd95
jmp 0x475881
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x48], eax
mov edx, str.DelayedShow
movzx eax, word [edi + 0x8c]
mov ecx, str.CTrayMonitorDlg
push eax
call fcn.0041e6ff
pop ecx
push 0
push 0x12c
push 1
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_SetTimer]
push 1
push 0x51e784
push dword [edi + 0x38]
lea ecx, [edi + 0x4c]
push dword [edi + 0x24]
call fcn.004abaa3
mov ecx, dword [edi + 0x50]
xor edx, edx
inc edx
call fcn.0046da79
jmp 0x4758b5
mov esi, dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1f4
jae 0x4758b5
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4758b5
lea ecx, [edi + 0x4c]
call fcn.004abd95
pop esi
pop edi
pop ebp
ret 4

Function at 0x4761bb
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0xaba010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
lea ebx, [eax + 1]
cmp dword [edi + 0x34], eax
je 0x4761f7
mov esi, dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0xee48
jae 0x4761f7
mov esi, dword [ebp + 8]
xor eax, eax
inc eax
jmp 0x476207
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x2c], eax
xor eax, eax
inc eax
xor ebx, ebx
mov esi, eax
mov dword [edi + 0x34], eax
mov eax, 0x1f8
push eax
mov dword [ebp - 0x200], eax
lea eax, [ebp - 0x1fc]
push 0
push eax
call fcn.004f1a90
mov eax, dword [edi + 0x30]
add esp, 0xc
mov dword [ebp - 0x1f8], eax
mov eax, dword [0xd59fc4]
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1f4], 4
test esi, esi
jne 0x47624d
test ebx, ebx
jne 0x476278
mov eax, dword [edi + 0x24]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1f4], 6
test ebx, ebx
jne 0x476278
mov dword [ebp - 0x1f0], 0x40b
mov dword [ebp - 0x1f4], 7
push 0x80
push dword [edi + 0x3c]
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x40], eax
lea eax, [ebp - 0x200]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov eax, dword [0xd5b6cc]
test eax, eax
jne 0x4762ba
push 1
test ebx, ebx
pop ecx
cmovne eax, ecx
mov dword [0xd5b6cc], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004efcea
mov esp, ebp
pop ebp
ret 4
Function at 0x476d89
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 4]
push 0x80
push 4
push 0
push 0x40000000
push dword [0xd5ab94]
call fcn.0040b961
test eax, eax
je 0x476e1e
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x11a6da5
push eax
lea ecx, [ebp - 4]
call fcn.0040b34a
test eax, eax
je 0x476e1e
mov eax, dword [0xd5ab9c]
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040b34a
mov ecx, dword [0xd5ab98]
mov eax, dword [ecx]
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x476e15
add eax, 0x10
lea ecx, [ebp - 4]
push eax
call fcn.004733a7
push ecx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.0040fc9f
mov eax, dword [ebp - 8]
cmp eax, dword [0xd5ab98]
jne 0x476df1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 4], 0xffffffff
je 0x476e2d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x477bfa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xaba010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x5c]
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
sar eax, 4
cmp eax, 0xc8
jae 0x477c29
push ecx
call fcn.00479b83
push ecx
push 0x16
mov ecx, esi
call fcn.00477cc1
push ecx
push 0xb
mov ecx, esi
call fcn.00477cc1
push ecx
push 0x19
mov ecx, esi
call fcn.00477cc1
push ecx
push pe_nt_image_headers32
mov ecx, esi
call fcn.00477cc1
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x477ca9
lea ecx, [ebp - 0x20c]
call fcn.004227d2
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00477d26
lea ecx, [esi + 0xc]
call fcn.004786ef
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004efcea
mov esp, ebp
pop ebp
ret

Function at 0x477cc1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xaba010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push dword [ebp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x477d15
push 1
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00477d26
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004efcea
mov esp, ebp
pop ebp
ret 8
Function at 0x4786ef
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x10], 0
je 0x478831
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 4]
push ebx
push 0x80
push 4
pop ebx
push ebx
push 0
push 0x40000000
push dword [edi + 0xc]
call fcn.0040b961
test eax, eax
je 0x478821
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x244158a
push eax
lea ecx, [ebp - 4]
call fcn.0040b34a
test eax, eax
je 0x478821
mov eax, dword [edi + 4]
lea ecx, [ebp - 4]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0040b34a
mov eax, dword [edi]
mov esi, dword [eax]
cmp esi, eax
je 0x478817
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.0040b34a
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.0040b34a
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0040b34a
mov eax, dword [esi + 0x20]
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0040b34a
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 0x1c]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
cmp byte [esi + 0xd], 0
jne 0x47880f
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x4787f8
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x47880f
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4787ea
jmp 0x47880f
mov eax, dword [esi + 4]
jmp 0x478807
cmp esi, dword [eax + 8]
jne 0x47880d
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4787fd
mov esi, eax
cmp esi, dword [edi]
jne 0x478765
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
cmp dword [ebp - 4], 0xffffffff
je 0x478830
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4789fa
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x50d769
call fcn.00506098
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp byte [0xd5bae8], 0
mov edi, 0xd5bae8
jne 0x478aa5
lea ecx, [ebp - 0x10]
call fcn.004204dd
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x478a5e
push 0x51e784
mov ecx, esi
call fcn.004094e6
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x478aad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x478aad
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, edi
call fcn.004227d2
push str.Tray_
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x478aa5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push edi
mov ecx, esi
call fcn.004094e6
mov eax, esi
call fcn.00506061
ret
Function at 0x478ab5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
cmp byte [0xd5b8e0], 0
push edi
mov edi, 0xd5b8e0
jne 0x478b16
lea ecx, [ebp - 4]
call fcn.004789fa
push dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x478afa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.004227d2
push str.Blocked_
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov ecx, esi
call fcn.004094e6
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x478b26
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
cmp byte [0xd5b6d8], 0
push edi
mov edi, 0xd5b6d8
jne 0x478b87
lea ecx, [ebp - 4]
call fcn.004789fa
push dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x478b6b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.004227d2
push str.Folders_
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov ecx, esi
call fcn.004094e6
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x478cfe
Capabilities:
Copy file

Disassembly:
push 0x244
mov eax, 0x50d78f
call fcn.005060cc
mov edi, ecx
cmp dword [edi + 0x34], 0
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], eax
je 0x478ec7
cmp dword [edi + 0x7c], 0
jne 0x478ec7
test esi, esi
je 0x478ec7
test eax, eax
je 0x478ec7
cmp byte [esi], 0
je 0x478d68
push eax
push esi
call fcn.00478b97
mov ebx, eax
test ebx, ebx
jne 0x478d72
push 0x51e784
push esi
mov ecx, edi
call fcn.00478b97
mov ebx, eax
jmp 0x478d6a
xor ebx, ebx
test ebx, ebx
je 0x478ec7
cmp dword [edi + 0x30], 0
je 0x478ec7
mov esi, dword [edi + 0x38]
jmp 0x478dcf
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x21c], ecx
test eax, eax
je 0x478dc4
push dword [ebx + 4]
lea ecx, [esi + 4]
call fcn.0040d992
test eax, eax
jne 0x478dbe
push dword [ebx + 8]
lea ecx, [esi + 8]
call fcn.0040d992
mov ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
jmp 0x478dc4
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
jne 0x478ec7
add esi, 0x20
push dword [ebx + 0xc]
cmp esi, dword [edi + 0x3c]
jne 0x478d81
mov ecx, edi
call fcn.00478bec
test eax, eax
jne 0x478ec7
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004f1a90
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.004789fa
mov edx, dword [ebx + 0xc]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [eax]
call fcn.004bded3
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
pop ecx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x478e38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
lea eax, [ebp - 0x218]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x478ec7
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], esi
call fcn.00424dad
lea ecx, [ebp - 0x250]
call fcn.004770c6
push eax
lea ecx, [edi + 0x38]
mov dword [ebp - 4], esi
call fcn.004799be
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.0045a9f7
mov ecx, dword [edi + 0x3c]
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x22c]
lea eax, [ebp - 0x218]
sub ecx, 0x20
push dword [ebp - 0x230]
push eax
call fcn.004771bf
push dword [ebp - 0x224]
lea ecx, [ebp - 0x218]
push dword [ebp - 0x228]
call fcn.00479875
pop ecx
pop ecx
call fcn.00506076
ret 8
Function at 0x47964f
Capabilities:
Delete file
Move file

Disassembly:
push 0x118
mov eax, 0x50d828
call fcn.005060cc
mov dword [ebp - 0x120], ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x124], ebx
test ebx, ebx
je 0x4797a9
cmp dword [ebp + 0xc], 0
je 0x479741
push ecx
mov esi, esp
mov dword [ebp - 0x118], esi
mov ecx, dword [ebx + 0xc]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
lea ecx, [ebp - 0x118]
mov dword [esi], eax
call fcn.00422a77
pop ecx
mov ecx, dword [ebp - 0x120]
and dword [ebp - 4], 0
add ecx, 0x50
push eax
call fcn.00415670
or esi, 0xffffffff
mov dword [ebp - 4], esi
mov eax, esi
mov edx, dword [ebp - 0x118]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4796e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004f1a90
lea ecx, [ebp - 0x118]
call fcn.00478ab5
mov edx, dword [ebx + 0xc]
lea ecx, [ebp - 0x114]
push ecx
mov ecx, dword [eax]
call fcn.004bded3
mov edx, dword [ebp - 0x118]
add esp, 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x479730
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x114]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x479749
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebx + 0x18], 0
je 0x479758
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [edi]
mov ebx, dword [edi + 4]
cmp esi, ebx
je 0x4797a9
mov eax, dword [ebp - 0x124]
lea edi, [esi + 0x20]
cmp esi, eax
je 0x479776
mov esi, edi
cmp esi, ebx
jne 0x479767
jmp 0x4797a9
cmp edi, ebx
je 0x479797
sub esi, edi
push edi
lea ecx, [esi + edi]
call fcn.0047a163
add edi, 0x20
cmp edi, ebx
jne 0x47977c
mov esi, dword [ebp - 0x11c]
mov ebx, dword [esi + 4]
jmp 0x47979d
mov esi, dword [ebp - 0x11c]
lea ecx, [ebx - 0x20]
call fcn.0045a9f7
add dword [esi + 4], 0xffffffe0
call fcn.00506076
ret 0xc
Function at 0x47caa4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 4
mov eax, 0x50de1e
call fcn.00506098
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0xd5cb9c]
cmp eax, dword [esi + 4]
jle 0x47cafd
push 0xd5cb9c
call fcn.004efe9f
cmp dword [0xd5cb9c], 0xffffffff
pop ecx
jne 0x47cafd
and dword [ebp - 4], 0
call fcn.0047c6d1
or dword [ebp - 4], 0xffffffff
push 0xd5cb9c
mov dword [0xd5cba0], eax
call fcn.004efe55
pop ecx
mov eax, dword [0xd5cba4]
xor ecx, ecx
inc ecx
cmp eax, dword [esi + 4]
jle 0x47cb44
push 0xd5cba4
call fcn.004efe9f
cmp dword [0xd5cba4], 0xffffffff
pop ecx
jne 0x47cb41
mov dword [ebp - 4], 1
call fcn.0047c697
or dword [ebp - 4], 0xffffffff
push 0xd5cba4
mov dword [0xd5cba8], eax
call fcn.004efe55
pop ecx
xor ecx, ecx
inc ecx
mov eax, dword [0xd5bcf8]
test eax, eax
jne 0x47cb5b
cmp dword [0xd5cba0], eax
cmove eax, ecx
mov dword [0xd5bcf8], eax
mov eax, dword [0xd5cbac]
cmp eax, dword [esi + 4]
jle 0x47cba4
push 0xd5cbac
call fcn.004efe9f
cmp dword [0xd5cbac], 0xffffffff
pop ecx
jne 0x47cba4
xor eax, eax
push 0x517dbd
mov dword [0xd5cbb0], eax
mov dword [0xd5cbb4], eax
mov dword [0xd5cbb8], eax
call fcn.004f0205
mov dword [esp], 0xd5cbac
call fcn.004efe55
pop ecx
mov eax, dword [0xd5cbbc]
cmp eax, dword [esi + 4]
jle 0x47cbe9
mov esi, 0xd5cbbc
push esi
call fcn.004efe9f
cmp dword [0xd5cbbc], 0xffffffff
pop ecx
jne 0x47cbe9
xor eax, eax
push 0x517db3
mov dword [0xd5cbc0], eax
mov dword [0xd5cbc4], eax
mov dword [0xd5cbc8], eax
call fcn.004f0205
push esi
call fcn.004efe55
pop ecx
pop ecx
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x47cc38
mov esi, dword [0xd5bcf4]
call edi
sub eax, esi
cmp eax, 0x1194
jbe 0x47cc38
cmp dword [0xd5cba0], 0
mov eax, dword [0xd5cbb0]
mov dword [0xd5cbb4], eax
je 0x47cc23
mov ecx, 0xd5cbb0
call fcn.0047c70b
jmp 0x47cc31
cmp dword [0xd5cba8], 0
je 0x47cc31
call fcn.0047c8fe
call edi
mov dword [0xd5bcf4], eax
test ebx, ebx
je 0x47cc98
mov esi, dword [0xd5bcf0]
call edi
sub eax, esi
cmp eax, 0x1194
jbe 0x47cc98
mov esi, dword [0xd5bcf4]
call edi
sub eax, esi
cmp eax, 0x64
jae 0x47cc64
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0xd5cba0], 0
mov eax, dword [0xd5cbc0]
mov dword [0xd5cbc4], eax
je 0x47cc83
mov ecx, 0xd5cbc0
call fcn.0047c801
jmp 0x47cc91
cmp dword [0xd5cba8], 0
je 0x47cc91
call fcn.0047c9d4
call edi
mov dword [0xd5bcf0], eax
cmp dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
je 0x47ccbf
cmp esi, 0xd5cbb0
je 0x47ccbf
push dword [ebp - 0x10]
mov ecx, esi
push dword [0xd5cbb4]
push dword [0xd5cbb0]
call fcn.0047ef07
test ebx, ebx
je 0x47ccdc
push dword [ebp - 0x10]
mov ecx, esi
push dword [0xd5cbc4]
push dword [0xd5cbc0]
push dword [esi + 4]
call fcn.0047ed88
call fcn.00506061
ret
Function at 0x483c47
Capabilities:
Enumerate gui resources

Disassembly:
push 0x1c
mov eax, 0x50e537
call fcn.00506098
mov edi, ecx
test edx, edx
je 0x483c6d
call fcn.004c4c4a
test eax, eax
je 0x483c6d
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [ebp - 0x14]
xor ebx, ebx
inc edx
push edi
mov dword [ebp - 0x14], ebx
call fcn.004833dd
pop ecx
test eax, eax
js 0x483c93
mov ecx, dword [ebp - 0x14]
call fcn.00482fd5
mov ecx, dword [ebp - 0x14]
call fcn.004830bb
push edi
push 0x2a
pop edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.004833dd
pop ecx
test eax, eax
js 0x483cc3
sub esp, 0xc
call fcn.004834be
mov ecx, dword [ebp - 0x14]
push eax
sub esp, 0x10
call fcn.00483063
mov ecx, dword [ebp - 0x14]
call fcn.004830bb
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x24]
mov dword [ebp - 4], ebx
mov ecx, edi
call fcn.0048df9e
mov ebx, dword [ebp - 0x24]
mov esi, ebx
jmp 0x483d0a
push dword [esi + 0x24]
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
xor edx, edx
inc edx
call fcn.0048344e
pop ecx
test eax, eax
js 0x483d07
mov ecx, dword [ebp - 0x14]
call fcn.0048301c
mov ecx, dword [ebp - 0x14]
call fcn.004830bb
add esi, 0x40
cmp esi, dword [ebp - 0x20]
jne 0x483ce0
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x483d2b
mov edx, dword [ebp - 0x1c]
push ecx
sub edx, ebx
mov ecx, ebx
push 0x40
sar edx, 6
call fcn.0040b8be
pop ecx
pop ecx
mov ecx, edi
call fcn.00483574
mov ecx, edi
call fcn.004836da
mov ecx, edi
call fcn.004837fe
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push edi
push 0x48393a
call esi
push edi
push 0x48396f
call esi
push edi
push 0x410af0
call esi
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push edi
mov edx, 0x101
call fcn.004833dd
pop ecx
test eax, eax
js 0x483dad
and dword [ebp - 0x10], 0
push ecx
lea ecx, [ebp - 0x10]
call fcn.00483241
test eax, eax
js 0x483da5
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.004831f7
test eax, eax
js 0x483d9d
mov ecx, dword [ebp - 0x10]
call fcn.004831b0
mov ecx, dword [ebp - 0x10]
call fcn.004830bb
mov ecx, dword [ebp - 0x18]
call fcn.004830bb
mov ecx, edi
call fcn.004839a4
mov ecx, edi
call fcn.00483a1f
mov ecx, edi
call fcn.00483b92
xor eax, eax
call fcn.00506061
ret