joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b36d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
mov eax, dword [ebp + 8]
test byte [eax - 4], 8
je 0x4b36f9
push 0x5b
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
call fcn.00407764
test ax, ax
je 0x4b36f9
mov bl, 1
mov eax, dword [ebp + 8]
test byte [eax - 4], 8
je 0x4b3718
push 0x5c
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
call fcn.00407764
test ax, ax
je 0x4b3718
mov bl, 1
mov eax, dword [ebp + 8]
test byte [eax - 4], 1
je 0x4b3737
push 0x12
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
call fcn.00407764
test ax, ax
je 0x4b3737
mov bl, 1
mov eax, dword [ebp + 8]
test byte [eax - 4], 2
je 0x4b3756
push 0x11
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
call fcn.00407764
test ax, ax
je 0x4b3756
mov bl, 1
mov eax, dword [ebp + 8]
test byte [eax - 4], 4
je 0x4b3775
push 0x10
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
call fcn.00407764
test ax, ax
je 0x4b3775
mov bl, 1
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4b377c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
jmp 0x4b379b
push 0xa
call sub.kernel32.dll_Sleep_1
inc ebx
cmp ebx, 0xc8
jg 0x4b37b9
push esi
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
call fcn.00407764
test ax, ax
jne 0x4b378b
push ebp
call fcn.004b36d4
pop ecx
test al, al
jne 0x4b378b
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b3844
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b3a32
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4d91c0], 0
je 0x4b38a6
mov eax, dword [ebp - 4]
mov edx, dword [0x4dafac]
call fcn.00404854
jmp 0x4b3a14
mov eax, dword [ebp - 4]
call fcn.00404800
lea eax, [ebp - 8]
push eax
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4b3913
xor eax, eax
push ebp
push 0x4b390c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00404a70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3913
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
xor eax, eax
mov dword [ebp - 8], eax
ret
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4b396e
lea edx, [ebp - 0x11c]
mov eax, dword [0x4d96c0]
mov eax, dword [eax]
call fcn.00481e18
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.00409a28
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.0040dbec
lea eax, [ebp - 0x114]
mov edx, 0x4b3a48
call fcn.00404ac8
mov eax, dword [ebp - 0x114]
call fcn.004097c4
test al, al
je 0x4b39a1
lea edx, [ebp - 0x124]
mov eax, dword [0x4d96c0]
mov eax, dword [eax]
call fcn.00481e18
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409a28
mov eax, dword [ebp - 0x120]
mov edx, dword [ebp - 4]
call fcn.0040dbec
jmp 0x4b39fe
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00404a70
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call fcn.0040dbec
lea eax, [ebp - 0x128]
mov edx, 0x4b3a60
call fcn.00404ac8
mov eax, dword [ebp - 0x128]
mov edx, dword [ebp - 4]
call fcn.0040dbec
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004097d4
test al, al
jne 0x4b39fe
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409c8c
mov eax, 0x4dafac
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call fcn.00404854
mov byte [0x4d91c0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3a39
lea eax, [ebp - 0x12c]
mov edx, 7
call fcn.00404824
ret
Function at 0x4b468c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b47ab
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x4d96c0]
mov eax, dword [eax]
call fcn.00481e18
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404cc0
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4b4709
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004093a8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4b47c8
call fcn.00404b0c
mov eax, dword [ebp - 0x1c]
call fcn.004350b8
mov eax, ebx
call fcn.00402a88
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4b47e8
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 4]
sub eax, 1
jb 0x4b4741
je 0x4b4750
dec eax
je 0x4b4761
dec eax
je 0x4b4770
jmp 0x4b477f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [ebp - 6], ax
jmp 0x4b477f
mov eax, dword [ebp - 0x14]
mov ax, word [eax + 8]
and ax, 0xffff
mov word [ebp - 6], ax
jmp 0x4b477f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebp - 6], ax
jmp 0x4b477f
mov eax, dword [ebp - 0x14]
mov ax, word [eax + 0xc]
and ax, 0xffff
mov word [ebp - 6], ax
mov edx, ebx
mov eax, esi
call fcn.00402ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b47b2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404824
lea eax, [ebp - 0xc]
call fcn.00404800
ret
Function at 0x4b6a60
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6b98
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404800
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4b6b7f
xor eax, eax
push ebp
push 0x4b6b78
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
je 0x4b6ad3
call fcn.0040423c
jmp 0x4b6b7f
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b6af2
call fcn.0040423c
jmp 0x4b6b7f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b6b09
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4b6b10
call fcn.0040423c
jmp 0x4b6b7f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, edi
call fcn.00409eb0
add dword [ebp - 8], 4
jmp 0x4b6b5c
test bl, bl
jne 0x4b6b58
push dword [edi]
push 0x4b6bb0
push dword [esi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x29c]
call fcn.00409eb0
push dword [ebp - 0x29c]
mov eax, edi
mov edx, 3
call fcn.00404b80
add dword [ebp - 8], 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
test esi, esi
jne 0x4b6b29
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6b7f
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6b9f
lea eax, [ebp - 0x29c]
call fcn.00404800
ret
Function at 0x4b7320
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4b74a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404800
call fcn.0040b04c
fstp qword [ebp - 8]
wait
xor ebx, ebx
inc ebx
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je 0x4b737d
mov eax, dword [0x4d96c0]
mov eax, dword [eax]
cmp esi, dword [eax + 0x30]
je 0x4b737d
mov eax, dword [0x4dadd8]
call fcn.00468018
cmp esi, eax
je 0x4b737d
mov ebx, 0x14
jmp 0x4b7384
push 0x32
call sub.kernel32.dll_Sleep_1
cmp ebx, 0x14
jl 0x4b7350
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
xor ebx, ebx
mov eax, dword [0x4d96c0]
mov eax, dword [eax]
call fcn.0048159c
fld qword [0x4d923c]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x4b7405
push edi
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [0x4d9238]
call fcn.004b3a6c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408d80
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x4b74c0
call fcn.00438dec
jmp 0x4b7412
inc ebx
push 0x64
call sub.kernel32.dll_Sleep_1
cmp ebx, 0x1e
jl 0x4b73bf
cmp ebx, 0x1e
jne 0x4b748e
cmp dword [edi], 0
jne 0x4b748e
mov eax, dword [0x4d96c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4b748e
xor eax, eax
push ebp
push 0x4b7484
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00438ba4
mov dx, 1
call fcn.00438b6c
test al, al
je 0x4b747a
lea eax, [ebp - 0x14]
push eax
call fcn.00438ba4
lea edx, [ebp - 0x18]
call fcn.004386b8
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, 0x4b74c0
call fcn.00438dec
mov eax, dword [ebp - 0x14]
mov edx, edi
call fcn.00408d80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b748e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b74b0
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404824
ret
Function at 0x4b7878
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cb0
xor eax, eax
push ebp
push 0x4b7944
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404854
mov eax, dword [ebp - 4]
call fcn.0049b964
test al, al
je 0x4b7929
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049bbec
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404898
cmp byte [0x4daec7], 1
jne 0x4b78e1
mov eax, dword [ebp - 4]
call fcn.0049bca8
test al, al
jne 0x4b78e5
xor eax, eax
jmp 0x4b78e7
mov al, 1
test al, al
jne 0x4b7929
mov eax, dword [ebp - 4]
call fcn.00404cc0
push eax
call sub.kernel32.dll_GetFileAttributesA
mov esi, eax
test esi, esi
je 0x4b7929
test esi, 0x10
je 0x4b7929
cmp esi, 0xffffffff
je 0x4b7929
mov edx, dword [ebp - 4]
mov eax, 0x4b795c
call fcn.00438f24
test al, al
jne 0x4b7929
mov eax, ebx
mov edx, 0x4b795c
call fcn.00404ac8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b794b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404824
ret
Function at 0x4b8f00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
xor ecx, ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4b910d
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x4b9037
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402f64
lea edx, [ebp - 4]
mov eax, dword [0x4d9354]
call fcn.00485390
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, 0x4b911c
call fcn.00406258
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0x4b912c
call fcn.00406258
mov eax, dword [ebp - 0x14]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 0x14]
call fcn.00409a28
mov eax, dword [ebp - 0x124]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x10]
push eax
push 9
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x11d]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 6
mov dword [ebp - 0x130], ebx
mov byte [ebp - 0x12c], 0xb
lea edx, [ebp - 0x138]
mov ecx, 1
mov eax, 0x4b9144
call fcn.0040a3c8
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x18]
call fcn.00405058
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405068
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
jmp 0x4b90b7
lea eax, [ebp - 0x10]
push eax
push 9
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x11d]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 6
mov dword [ebp - 0x130], ebx
mov byte [ebp - 0x12c], 0xb
lea edx, [ebp - 0x138]
mov ecx, 1
mov eax, 0x4b9144
call fcn.0040a3c8
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x18]
call fcn.00405058
lea eax, [ebp - 0x140]
mov edx, dword [ebp - 0x18]
call fcn.00404a88
mov eax, dword [ebp - 0x140]
call fcn.004098f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9114
lea eax, [ebp - 0x140]
mov edx, 2
call fcn.00404824
lea eax, [ebp - 0x128]
mov edx, 2
call fcn.00404824
lea eax, [ebp - 0x18]
call fcn.00404f0c
lea eax, [ebp - 0x14]
call fcn.00404800
lea eax, [ebp - 0xc]
call fcn.00406214
lea eax, [ebp - 8]
call fcn.00406214
lea eax, [ebp - 4]
call fcn.00406214
ret
Function at 0x4babec
Capabilities:
Power down monitor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404cb0
xor eax, eax
push ebp
push 0x4bac78
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x4d920c
call fcn.00404800
mov edx, dword [ebp - 4]
mov eax, 0x4bac90
call fcn.00404e04
test eax, eax
jle 0x4bac48
mov bl, 1
push 2
push 0xf170
push 0x112
mov eax, dword [0x4d96c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SendMessageA
mov edx, dword [ebp - 4]
mov eax, 0x4baca4
call fcn.00404e04
test eax, eax
jle 0x4bac62
mov bl, 1
mov eax, esi
call fcn.0047dfb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bac7f
lea eax, [ebp - 4]
call fcn.00404800
ret
Function at 0x4c5270
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c539e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov byte [eax - 0xd], 1
mov dl, 1
mov eax, dword [0x417ee0]
call fcn.00403980
mov dword [0x4dadd4], eax
push 0
push 0x4c5158
call sub.user32.dll_EnumWindows
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x3cc]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [0x4dadd4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4c533a
inc esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x3cc]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [0x4dae30]
jg 0x4c533a
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [0x4dadd4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
push eax
mov edx, ebx
mov eax, dword [0x4dadd4]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x3cc]
mov eax, dword [eax + 0x23c]
pop edx
mov edi, dword [eax]
call dword [edi + 0x3c]
inc ebx
dec esi
jne 0x4c52de
cmp byte [0x4dae58], 0
je 0x4c537e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x3cc]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebp - 4]
je 0x4c537e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x3cc]
mov eax, dword [eax + 0x23c]
mov ecx, 0x4c53b4
mov edx, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [0x4dadd4]
call fcn.004039b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c53a5
lea eax, [ebp - 8]
call fcn.00404800
ret
Function at 0x4ca4b8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x164], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ca70b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d9898]
mov byte [eax], 0
mov eax, dword [0x4d9748]
mov byte [eax], 0
push 0x4ca71c
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x4dafb0], eax
lea eax, [ebp - 0x164]
call fcn.00409c80
mov edx, dword [ebp - 0x164]
mov eax, 0x4dafb4
call fcn.00404854
mov esi, 0x4ca72c
mov edi, 0x4daf6c
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
cmp dword [0x4d91d8], 0
jne 0x4ca58d
xor ecx, ecx
mov dl, 1
mov eax, dword [0x45de4c]
call fcn.0046e658
mov dword [0x4d91d8], eax
mov eax, dword [0x4d91d8]
mov byte [eax + 0x42], 1
push 0x4000
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x4ca76c
call sub.shell32.dll_SHGetFileInfoA
mov edx, eax
mov eax, dword [0x4d91d8]
call fcn.0046e9b4
cmp dword [0x4d91d4], 0
jne 0x4ca5db
xor ecx, ecx
mov dl, 1
mov eax, dword [0x45de4c]
call fcn.0046e658
mov dword [0x4d91d4], eax
mov eax, dword [0x4d91d4]
mov byte [eax + 0x42], 1
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x4ca76c
call sub.shell32.dll_SHGetFileInfoA
mov edx, eax
mov eax, dword [0x4d91d4]
call fcn.0046e9b4
mov dl, 1
mov eax, dword [0x42e328]
call fcn.0042e460
mov dword [0x4dade4], eax
mov dl, 1
mov eax, dword [0x417ee0]
call fcn.00403980
mov dword [0x4dade8], eax
mov dl, 1
mov eax, dword [0x417ee0]
call fcn.00403980
mov dword [0x4dadec], eax
mov dl, 1
mov eax, dword [0x4b1e40]
call fcn.00403980
mov dword [0x4d91f4], eax
mov dl, 1
mov eax, dword [0x41787c]
call fcn.00403980
mov edx, dword [0x4d91f4]
mov dword [edx + 4], eax
mov dl, 1
mov eax, dword [0x417ee0]
call fcn.00403980
mov dword [0x4d91c4], eax
mov dl, 1
mov eax, dword [0x417ee0]
call fcn.00403980
mov dword [0x4d9200], eax
lea edx, [ebp - 0x170]
mov eax, dword [0x4d96c0]
mov eax, dword [eax]
call fcn.00481e18
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.00409a28
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.0040dbec
mov edx, dword [ebp - 0x168]
mov eax, 0x4dade0
call fcn.00404854
xor edx, edx
mov eax, ebx
call fcn.004c0104
call fcn.004b3658
test al, al
je 0x4ca6c7
mov byte [0x4daec7], 1
mov dword [0x4dadfc], 1
mov eax, 0x4dae38
call fcn.00404800
cmp dword [0x4daf18], 0
je 0x4ca6ed
cmp byte [0x4daf1c], 0
je 0x4ca6ed
call fcn.004b3658
test al, al
jne 0x4ca6ed
lea eax, [ebp - 0x174]
call fcn.004d237c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca712
lea eax, [ebp - 0x174]
mov edx, 5
call fcn.00404824
ret
Function at 0x4d4318
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
cmp dword [0x4d9250], 0
je 0x4d4388
mov eax, dword [0x4d9250]
mov edx, dword [0x4b201c]
call fcn.00403b48
test al, al
je 0x4d4388
push esp
mov eax, dword [0x4d9250]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4d96c0]
mov eax, dword [eax]
call fcn.0048159c
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov edx, 3
mov eax, esi
call fcn.004cdfb0
pop edx
pop esi
pop ebx
ret
Function at 0x403e62
Capabilities:
Delete directory
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.00410590
cmp dword [0x52d910], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
jne 0x403e9f
push 0x403698
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x4036ac
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov eax, dword [0x47d438]
mov ebx, dword [0x47d43c]
xor esi, esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x1c], 0x9e3779b9
call fcn.00403e5b
mov eax, dword [0x47d440]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x47d444]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x52d910], 0xc
mov dword [ebp - 4], eax
jne 0x403f3a
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x844]
push eax
push esi
push 0x4036bc
push 0x4036d4
push 0x403708
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push esi
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x52d910]
cmp eax, 0xfa9
jne 0x403f56
mov dword [0x52ceac], 0xedeb2e40
cmp eax, 0x3eb
jne 0x403f63
mov dword [0x52c85c], esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, edi
shr edx, cl
add eax, edi
mov dword [ebp - 0x14], eax
mov dword [0x52cea8], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x52d910], 0x213
mov dword [ebp - 0x14], edx
jne 0x403fa2
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0x52d910], 0xc
jne 0x403fdf
push esi
lea eax, [ebp - 0x444]
push eax
push 0x403718
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push esi
lea eax, [ebp - 0x1044]
push eax
push 0x403770
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x10]
shr eax, cl
add eax, ebx
xor eax, edx
xor dword [ebp - 4], eax
sub edi, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 8], eax
dec dword [ebp - 0x18]
jne 0x403edf
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4