joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cac0
Capabilities:
Check os version
Set global application hook

Disassembly:
sub esp, 0xa0
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x20]
mov edx, eax
add esp, 4
inc edx
xor eax, eax
sub ecx, edx
shl ecx, 1
lea edi, [edi + edx*2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xf05c]
xor ebx, ebx
test eax, eax
jne 0x44cb15
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esi + 8], eax
test eax, eax
je 0x44cb3a
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x44cb3a
mov eax, dword [esi + 8]
push 0
push eax
mov ebx, 1
call ebp
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x9c
call edi
test eax, eax
jne 0x44cb73
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x94
push edx
call edi
test eax, eax
je 0x44cb8a
mov eax, dword [esp + 0x24]
sub eax, 2
jne 0x44cb8a
cmp dword [esp + 0x18], 5
jb 0x44cb8a
mov dword [esi + 4], 0x58
mov dword [0x5e60d4], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
push 0
push 0x44cc30
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x5e60d0], eax
mov eax, dword [esi]
test eax, eax
je 0x44cbc1
lea eax, [esi + 4]
push eax
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
jmp 0x44cbcb
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
mov edx, dword [0x5e60d0]
mov edi, eax
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x5e60d4]
test eax, eax
je 0x44cbeb
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
call dword [sym.imp.comdlg32.dll_CommDlgExtendedError]
test ebx, ebx
je 0x44cbfd
mov eax, dword [esi + 8]
push 1
push eax
call ebp
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44cc13
push esi
call dword [sym.imp.USER32.dll_SetFocus]
test edi, edi
mov eax, edi
jne 0x44cc1e
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x44d190
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 8]
add ecx, 4
push ecx
mov ecx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
ret 0x10

Function at 0x44d1c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
add ecx, 4
push ecx
mov ecx, dword [esp + 0xc]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
ret 0xc
Function at 0x4529b0
Capabilities:
Create directory
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push 1
push 0x23
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push str.Storm
push esi
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push 0x5ce884
push esi
call edi
mov eax, dword [esp + 0xc]
push eax
push esi
call edi
pop edi
pop esi
ret
Function at 0x452cc0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56e754
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x120
test eax, eax
push ebp
push esi
push edi
jne 0x452ced
xor eax, eax
jmp 0x452ecc
push ecx
mov dword [esp + 0x10], esp
mov ebp, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x140]
mov dword [esp + 0x138], 0
test esi, esi
je 0x452d44
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.00565b3f
test eax, eax
mov dword [esi], eax
jne 0x452d46
test edi, edi
je 0x452d46
push 0x8007000e
call fcn.00565a92
jmp 0x452d46
xor esi, esi
test esi, esi
mov dword [esp + 0x138], 0xffffffff
mov dword [ebp], esi
jne 0x452d62
push 0x8007000e
call fcn.00565a92
mov ecx, dword [esp + 0x144]
call fcn.00454d70
cmp ax, 0xffff
je 0x452ec7
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ebp, eax
lea eax, [esp + 0x28]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x28]
push ecx
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
push 0
push 0x80
push 2
push 0
push 0
lea eax, [esp + 0x3c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
mov dword [esp + 0xc], esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x134], 1
push ecx
call fcn.004544c0
add esp, 4
cmp esi, 0xffffffff
jne 0x452dec
xor eax, eax
jmp 0x452ecc
lea edx, [esp + 0x24]
push 0
push edx
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x452e0e
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x452ecc
or edi, 0xffffffff
push esi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0x28]
mov word [esp + 0x14], 8
push eax
call fcn.00565b3f
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x452e4b
lea ecx, [esp + 0x28]
test ecx, ecx
je 0x452e4b
push 0x8007000e
call fcn.00565a92
mov eax, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x12]
push ecx
mov esi, dword [esp + 0x144]
sub esp, 0x10
mov byte [esp + 0x148], 2
mov ecx, esp
mov edx, dword [esi]
push esi
mov dword [ecx], ebp
mov ebp, dword [esp + 0x30]
mov dword [ecx + 4], ebp
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x38]
mov dword [ecx + 0xc], eax
call dword [edx + 0xe8]
test eax, eax
jge 0x452e94
push 0x5d19c0
push esi
push eax
call fcn.00565aa0
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], 1
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jge 0x452eb1
push eax
call fcn.00565a92
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp word [esp + 0x12], di
je 0x452ec7
xor eax, eax
jmp 0x452ecc
mov eax, 1
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x12c
ret
Function at 0x452ef0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56e768
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x452f27
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x28], 0
call ebx
test eax, eax
jge 0x452f51
push eax
call fcn.00565a92
mov esi, dword [esp + 0x2c]
mov word [esp + 0xc], 8
push esi
call fcn.00565b3f
test eax, eax
mov dword [esp + 0x14], eax
jne 0x452f78
test esi, esi
je 0x452f78
push 0x8007000e
call fcn.00565a92
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov ecx, dword [esp + 0xc]
sub esp, 0x10
mov eax, esp
mov edx, dword [edi]
push edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0xc], ecx
call dword [edx + 0x108]
mov esi, eax
test esi, esi
jge 0x452fc6
push 0x5d19c0
push edi
push esi
call fcn.00565aa0
test esi, esi
mov dword [esp + 0x24], 0xffffffff
je 0x452ff5
lea edx, [esp + 0xc]
push edx
call ebx
test eax, eax
jge 0x452fe1
push eax
call fcn.00565a92
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0xc]
push eax
call ebx
test eax, eax
jge 0x453006
push eax
call fcn.00565a92
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret

Function at 0x453090
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4530af
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x4530f9
xor eax, eax
add esp, 0x14
ret
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x453440
Capabilities:
Get file version info

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push ebx
push ebp
push esi
lea ecx, [esp + 0x10]
push edi
lea eax, [esp + 0x18]
push ecx
push edx
xor esi, esi
xor edi, edi
mov dword [esp + 0x18], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4534ba
push ebx
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4534ba
mov eax, dword [esp + 0x2c]
push ebp
push ebx
push edi
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4534b1
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x5ce884
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4534b1
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
or esi, eax
or edi, ecx
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x4535b0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push 0x5e6250
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x5e6250
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push str.Storm_
push 0x5e6250
call esi
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x4535fd
push eax
push 0x5e6250
call esi
push 0x5e6250
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov eax, 0x5e6250
jne 0x453679
mov cl, byte [0x5e6250]
test cl, cl
je 0x453674
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcpynA]
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push 0x5ce884
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov esi, eax
test esi, esi
je 0x453674
mov edx, esi
sub edx, 0x5e6250
test edx, edx
jle 0x45366a
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
inc edx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x14]
push 0x5e6250
push eax
call ebx
lea ecx, [esp + 0x10]
push 0
push ecx
call ebp
mov cl, byte [esi + 1]
lea eax, [esi + 1]
test cl, cl
jne 0x453627
mov eax, 0x5e6250
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x453690
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push str.mee.db
stosw word es:[edi], ax
push ecx
push 0x5d4440
lea edx, [esp + 0x11c]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [esp + 0x110]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x453782
mov edx, dword [esp + 0x218]
lea ecx, [esp + 8]
push 0
push ecx
push 8
push edx
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
push esi
je 0x45377c
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret
Function at 0x453790
Capabilities:
Check if file exists
Get common file path
Read file on windows

Disassembly:
sub esp, 0x310
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x110]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [esp + 0x110]
lea edx, [esp + 0xc]
push ecx
push str._sStormcurrent.ecs
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call esi
test eax, eax
jne 0x453838
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [esp + 0xc]
push str...current.ecs
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0xc]
push eax
call esi
test eax, eax
je 0x4538c8
lea ecx, [esp + 0xc]
push 0x104
lea edx, [esp + 0x218]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
lea eax, [esp + 0x214]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4538c8
mov edx, dword [esp + 0x31c]
lea ecx, [esp + 8]
push 0
push ecx
push 8
push edx
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
push esi
je 0x4538c2
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x310
ret
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x310
ret

Function at 0x4539d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
lea edx, [esp + 4]
mov dword [esp + 8], 0x40
push edx
mov dword [esp + 8], 0x3c
mov dword [esp + 0x24], 5
mov dword [esp + 0x14], str.open
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
je 0x453a4f
mov eax, dword [esp + 0x38]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x38]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
add esp, 0x3c
ret
xor eax, eax
add esp, 0x3c
ret
Function at 0x453aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56e7b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [esp + 0x38]
push esi
push eax
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CString::CString_2
push 0x5d3a14
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0
call fcn.00564d16
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [esp + 0x40]
call fcn.00564d16
push 0x5d3a14
lea ecx, [esp + 0x40]
call fcn.00564d16
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x3c]
push edx
call fcn.00564d16
push 0x5d3a14
lea ecx, [esp + 0x40]
call fcn.00564d16
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x3c]
push eax
call fcn.00564d16
mov edx, dword [0x5d44ac]
mov ax, word [0x5d44b0]
mov ecx, dword [str.STROMTRAY]
mov dword [esp + 8], edx
mov edx, dword [0x5d449c]
mov word [esp + 0xc], ax
mov eax, dword [0x5d44a0]
mov dword [esp + 4], ecx
mov ecx, dword [str.STROMTRAY_CLASS]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
lea edx, [esp + 4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x5d44a4]
lea eax, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x453bc0
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push ecx
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CString::GetBuffer
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x18], eax
push 0
push 0x3e8
mov eax, dword [edx - 8]
push 2
inc eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4a
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret

Function at 0x453d40
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
push 0x453bf0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x453d70
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop ecx
ret
push 0
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 0x80004005
pop ecx
ret
Function at 0x453d80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x25c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x59]
mov byte [esp + 0x58], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15d]
mov byte [esp + 0x15c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x58]
lea ecx, [esp + 0x15c]
push eax
push 0x5d44b4
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea edx, [esp + 0x15c]
push 0
push edx
call fcn.0055e030
test eax, eax
je 0x453e7b
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 4], eax
rep stosd dword es:[edi], eax
mov dword [esp + 8], eax
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
mov dword [esp + 0xc], eax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
push eax
lea eax, [esp + 0x17c]
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x453e7b
mov ecx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
pop esi
xor eax, eax
pop edi
add esp, 0x25c
ret
mov eax, 0x80004005
pop edi
add esp, 0x25c
ret
Function at 0x453e90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x464
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x165]
mov byte [esp + 0x164], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x164]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x164]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x60]
stosb byte es:[edi], al
lea eax, [esp + 0x164]
push eax
push str._sEncoderMediaEnc.exe
push 0x104
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x60]
push ebx
push edx
call fcn.0055e030
test eax, eax
je 0x45401f
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x269]
mov byte [esp + 0x268], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x474]
cmp eax, 3
ja case.default.0x453f54
jmp dword [eax*4 + 0x454030]
lea eax, [esp + 0x60]
push eax
push str.__s__storm
jmp 0x453fa3
lea edx, [esp + 0x60]
lea eax, [esp + 0x268]
push edx
push str.__s__stormhasfiles
push 0x208
push eax
jmp 0x453fb0
lea ecx, [esp + 0x60]
lea edx, [esp + 0x268]
push ecx
push str.__s__storm
push 0x208
push edx
jmp 0x453fb0
lea eax, [esp + 0x60]
push eax
push str.__s__stormclip
lea ecx, [esp + 0x270]
push 0x208
push ecx
call esi
add esp, 0x10
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x20]
xor edx, edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
mov dword [esp + 0x14], edx
push ecx
push ebx
mov dword [esp + 0x20], edx
push ebx
push ebx
mov dword [esp + 0x2c], edx
push ebx
push ebx
lea edx, [esp + 0x284]
push ebx
push edx
push ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x44], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x45401f
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x464
ret
pop edi
pop esi
mov eax, 0x80004005
pop ebx
add esp, 0x464
ret
Function at 0x4540e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x56e819
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
push esi
lea eax, [esp + 0x160]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x15c], 0
call fcn.00564cce
mov bl, 1
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
mov byte [esp + 0x160], bl
call sub.MFC42.DLL_CString::Replace_1
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x15c], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x160]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4541de
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
push edi
mov edi, dword [esp + 0x16c]
lea ecx, [esp + 0x44]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_operator_2
push eax
mov ecx, edi
mov byte [esp + 0x164], 3
call sub.MFC42.DLL_CStringList::AddTail
lea ecx, [esp + 0x14]
mov byte [esp + 0x160], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
push ecx
push esi
call ebp
test eax, eax
jne 0x454195
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
pop ebp
lea ecx, [esp + 8]
mov byte [esp + 0x158], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x160]
mov dword [esp + 0x158], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x150]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x154
ret