joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f866
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
cmp esi, ebx
jne 0x47f87b
xor al, al
jmp 0x47f902
lea edx, [ecx + 0xc]
push edi
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
cmp dword [ecx], ebx
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [edx], 0x14
mov dword [ecx + 4], esi
mov dword [ecx + 0x2c], eax
pop edi
je 0x47f8aa
mov dword [ecx], ebx
mov eax, dword [ebp + 0xc]
cmp byte [ebp + 0x24], bl
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov byte [ecx + 0x25], bl
je 0x47f8cc
mov eax, dword [ebp + 0x28]
cmp eax, ebx
jne 0x47f8c9
mov eax, str.FILE:
mov dword [ecx + 0x14], eax
cmp byte [ebp + 8], bl
jne 0x47f8dc
mov byte [ecx + 0x25], 1
call fcn.0047f91e
jmp 0x47f902
lea eax, [ebp + 0x24]
mov dword [ebp + 0x24], ebx
push eax
push ebx
push ecx
push 0x47f908
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp esi, ebx
setne al
pop esi
pop ebx
pop ebp
ret 0x24

Function at 0x480516
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
lea ebx, [ecx + 0x16]
push 0x40
xor esi, esi
pop ecx
xor eax, eax
cmp dword [ebp + 8], esi
mov edi, ebx
rep stosd dword es:[edi], eax
je 0x480566
push esi
push esi
push 3
push esi
push esi
push SHChangeNotifyRegister
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x480566
lea eax, [ebp + 8]
push esi
push eax
push 0x100
push ebx
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x48394a
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 0x4bc550
lea ecx, [ebp - 8]
call fcn.00403927
push dword [0x4b312c]
push ecx
mov ecx, esp
push 0x4afa64
call fcn.00403927
mov ecx, 0x4c6c04
call fcn.0044acc1
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push str.m_lang_id
push 0x4afae4
mov dword [0x4b312c], eax
call fcn.0044a9d1
add esp, 0x14
xor ebx, ebx
cmp eax, ebx
mov dword [0x4b312c], eax
push ecx
mov ecx, esp
jne 0x4839cd
push str.DE_HELP
call fcn.00403927
lea eax, [ebp - 4]
push eax
call fcn.0044a52d
pop ecx
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.00403a8c
lea ecx, [ebp - 4]
jmp 0x4839ee
push str.EN_HELP
call fcn.00403927
lea eax, [ebp - 4]
push eax
call fcn.0044a52d
pop ecx
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.00403a8c
lea ecx, [ebp - 4]
call fcn.004038fb
mov eax, dword [0x4bc51c]
mov ecx, 0x81
mov dword [ebp - 0x214], eax
xor eax, eax
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0xc]
push eax
call fcn.0040a529
push str.tmp_htm__q_dir_hlp_z.html
lea ecx, [ebp - 4]
call fcn.00403927
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 4]
call fcn.004038fb
push 0x4af8e0
push dword [ebp - 0xc]
call fcn.0049cd90
pop ecx
mov dword [ebp - 4], eax
pop ecx
push ebx
lea ecx, [ebp - 8]
call fcn.00403c58
mov edi, eax
cmp edi, ebx
jne 0x483a77
xor edx, edx
jmp 0x483a9b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.0049c210
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.00483af4
mov edx, eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
push dword [ebp - 4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 1
push edx
call fcn.0049cc26
push dword [ebp - 4]
call fcn.0049cba9
add esp, 0x14
push 3
push ebx
push ebx
push dword [ebp - 0xc]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
lea esp, [ebp - 0x220]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x484793
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4af550]
and byte [ebp - 0xa], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 4]
mov byte [ebp - 0x2c], 0x2f
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x4d
mov byte [ebp - 0x25], 0x69
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x73
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x2e
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x41
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0x11], 0x43
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0xb], 0x73
call fcn.00403adc
push str.control
lea ecx, [ebp - 8]
call fcn.00403927
mov eax, dword [eax]
push 5
push 0
push dword [ebp - 4]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
push 1
pop eax
leave
ret 0x10

Function at 0x484874
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4af550]
and byte [ebp - 0xa], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 4]
mov byte [ebp - 0x2c], 0x2f
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x4d
mov byte [ebp - 0x25], 0x69
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x73
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x2e
mov byte [ebp - 0x1c], 0x44
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0x41
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x50
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x73
call fcn.00403adc
push str.control
lea ecx, [ebp - 8]
call fcn.00403927
mov eax, dword [eax]
push 5
push 0
push dword [ebp - 4]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
push 1
pop eax
leave
ret 0x10
Function at 0x484955
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4af550]
and byte [ebp - 5], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x76
mov byte [ebp - 0xd], 0x6d
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x6d
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x63
call fcn.00403adc
push 5
push 0
push 0
push dword [ebp - 4]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004038fb
push 1
pop eax
leave
ret 0x10

Function at 0x4849c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
and dword [ebx], 0
mov esi, ecx
mov edi, 0x400
lea ecx, [esi + 0x24]
push edi
call fcn.00403c58
push edi
push eax
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edi, [esi + 0x24]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00403cd2
push 0x3ed
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [esi + 0x2c], eax
mov dword [ebx], 1
lea ebx, [esi + 0x48]
push edi
mov ecx, ebx
call fcn.00403a8c
push dword [esi + 4]
push ecx
mov ecx, esp
push ebx
call fcn.004038b5
push ecx
lea eax, [esi + 0x44]
mov ecx, esp
push eax
call fcn.004038b5
call fcn.00483f03
add esp, 0xc
cmp eax, 1
jne 0x484a4b
movzx eax, word [esp + 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
movzx eax, word [esp + 0x14]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x484aed
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
cmp dword [eax - 8], edi
je 0x484bd3
mov eax, dword [0x4af550]
mov esi, 0x104
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.00403c58
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.00403cd2
push str.S_OK_tmp_
lea ecx, [ebp - 8]
call fcn.00403927
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 8]
call fcn.004038fb
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [0x4af550]
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4c55c4]
push eax
push dword [eax - 8]
call fcn.00403bd8
mov esi, str..zip
mov eax, esi
test eax, eax
je 0x484b87
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.00403bd8
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push edi
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
call fcn.00484e81
add esp, 0xc
lea eax, [ebp - 4]
lea ecx, [ebp + 0xc]
push eax
call fcn.00403a8c
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
push ecx
lea eax, [ebp + 0x10]
mov ecx, esp
push eax
call fcn.004038b5
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.004038b5
push dword [ebp + 8]
mov ecx, ebx
call fcn.00484c10
lea ecx, [ebp + 0xc]
mov bl, al
call fcn.004038fb
lea ecx, [ebp + 0x10]
call fcn.004038fb
pop edi
mov al, bl
pop esi
pop ebx
leave
ret 0xc
Function at 0x486733
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
push esi
mov esi, ecx
cmp dword [esi + 0x48], 0
jne 0x486810
push ebx
lea eax, [esi + 0x5c]
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea edi, [esi + 0x2c]
push edi
push 6
push 0
call ebx
test eax, eax
jl 0x4867a7
lea eax, [esi + 0x28]
push eax
push 0
push 0
call ebx
test eax, eax
jl 0x4867aa
push dword [edi]
push dword [esi + 0x28]
call fcn.0048682e
pop ecx
lea edi, [esi + 0x3c]
pop ecx
mov ebx, eax
push 0x400
mov ecx, edi
call fcn.00403c58
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00403cd2
jmp 0x4867aa
and dword [edi], 0
or dword [esi + 0x40], 0xffffffff
or dword [esi + 0x44], 0xffffffff
mov ecx, 0xad
xor eax, eax
lea edi, [ebp - 0x4b4]
push 0x7f
rep stosd dword es:[edi], eax
mov eax, dword [0x4bc51c]
pop ecx
mov dword [ebp - 0x200], eax
xor eax, eax
lea edi, [ebp - 0x1fc]
push 0xff
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x4001
lea eax, [ebp - 0x4b4]
push 0x2b4
push eax
lea eax, [ebp - 0x200]
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop edi
mov dword [esi + 0x48], eax
pop ebx
pop esi
leave
ret

Function at 0x4868d7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
call fcn.00486733
xor ebx, ebx
cmp dword [esi + 0x60], ebx
jne 0x486908
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
mov dword [esi + 0x60], eax
call fcn.004469ac
cmp dword [esi + 0x60], ebx
pop ecx
jne 0x486908
xor eax, eax
jmp 0x4869b1
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [esi + 0x4c], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push ebx
mov dword [ebp - 4], ebx
call edi
test eax, eax
jl 0x4869ad
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call edi
test eax, eax
jl 0x4869ad
mov eax, dword [esi + 0x58]
lea ecx, [esi + 0x64]
add eax, 0x2710
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
call fcn.00487fd9
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [edi + 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0048682e
mov dword [edi + 8], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x18], eax
inc dword [esi + 0x58]
cmp dword [ebp + 8], ebx
pop ecx
pop ecx
jne 0x48698e
mov eax, dword [esi + 0x5c]
lea edx, [edi + 0x10]
push edx
push 0x4ab2c8
mov ecx, dword [eax]
push ebx
push dword [edi + 4]
push eax
call dword [ecx + 0x14]
jmp 0x4869a3
add edi, 0x10
push ebx
push edi
push 0x4ab2c8
push dword [ebp - 4]
call fcn.004871af
add esp, 0x10
push dword [esi + 0x60]
mov ecx, esi
call fcn.00486a1a
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x486f1d
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov esi, ecx
je 0x486fd4
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_IsMenu]
test eax, eax
je 0x486fd4
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
call ebx
mov eax, dword [0x4c6b40]
mov dword [esi + 0x10], eax
mov eax, dword [0x4c6b3c]
cmp dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
jne 0x486f6f
mov eax, dword [esi + 0x60]
cmp eax, edi
mov dword [esi + 0x10], eax
je 0x486fd4
push 0xb
xor eax, eax
pop ecx
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [esi + 0x40]
mov dword [ebp - 0x3c], 0x2c
push eax
mov dword [ebp - 0x38], 0x31
call ebx
push dword [ebp - 4]
push dword [ebp - 8]
push dword [0x4c6b40]
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_MenuItemFromPoint]
lea ecx, [ebp - 0x3c]
mov dword [esi + 0x14], eax
push ecx
push 1
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x486fd0
lea eax, [ebp - 0x10]
push eax
call ebx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push 0
push edi
call fcn.004878c4
and dword [esi + 0x10], 0
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4872aa
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c8
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0xac
xor eax, eax
lea edi, [ebp - 0x2bc]
mov dword [ebp - 0x2c0], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2b4]
lea ecx, [ebp - 4]
push eax
mov dword [ebp - 0xc], ebx
call fcn.0040a529
mov esi, dword [ebp + 0xc]
push 0x208
lea eax, [ebp - 0x2c0]
push 0x2b4
push eax
push ebx
push dword [esi + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x487328
lea eax, [ebp - 0x2b4]
test eax, eax
je 0x487318
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x2b4]
push ecx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x4873b5
mov ecx, dword [esi + 4]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x20038000
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0x24]
mov esi, dword [esi + 0x10]
cmp esi, ebx
je 0x48736e
cmp dword [ebp - 8], ebx
je 0x48736e
mov eax, dword [esi]
lea ecx, [ebp - 0x3c8]
push ecx
push 1
push dword [ebp - 8]
push esi
call dword [eax + 0x2c]
mov eax, dword [0x4af550]
push ebx
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea esi, [ebp - 0x3c8]
sub esp, 0x108
push 0x42
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.004873d3
mov eax, dword [ebp + 0xc]
add esp, 0x110
cmp dword [eax - 8], ebx
je 0x4873ad
lea eax, [ebp + 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00403a8c
lea ecx, [ebp + 0xc]
call fcn.004038fb
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.004038b5
lea ecx, [ebp - 4]
call fcn.004038fb
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x487a42
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x4c6b38], ebx
push esi
push edi
mov esi, ecx
je 0x487b4c
cmp dword [esi + 0x70], ebx
je 0x487b4c
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 4]
sub eax, 0x11f
je 0x487b3b
sub eax, 0xe2
je 0x487b01
dec eax
je 0x487ad4
sub eax, 6
jne 0x487b4c
lea edi, [esi + 0x40]
push edi
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [edi + 4]
push dword [edi]
push dword [0x4c6b40]
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_MenuItemFromPoint]
cmp eax, 0xffffffff
je 0x487b4c
mov edx, dword [esi]
push 1
push dword [0x4c6b40]
mov ecx, esi
push eax
call dword [edx]
test eax, eax
je 0x487b4c
push ebx
push ebx
push 0x1f
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x487b4c
mov eax, dword [esi + 0x40]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 8], eax
xor eax, eax
cmp dword [esi + 0x40], 0x186a0
jne 0x487af4
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 1
pop eax
or edx, 0xffffffff
mov ecx, edx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], edx
jmp 0x487b4e
lea edi, [esi + 0x40]
push edi
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [edi + 4]
push dword [edi]
push dword [0x4c6b40]
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_MenuItemFromPoint]
cmp eax, 0xffffffff
je 0x487b4c
mov edx, dword [esi]
push ebx
push dword [0x4c6b40]
mov ecx, esi
push eax
call dword [edx]
test eax, eax
je 0x487b4c
push 1
pop eax
jmp 0x487b4e
movzx eax, word [ecx + 8]
mov dword [0x4c6b3c], eax
mov eax, dword [ecx + 0xc]
mov dword [0x4c6b40], eax
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x487b54
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac8
push ebx
xor ebx, ebx
cmp dword [ecx + 0x20], ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
je 0x487c8e
mov esi, dword [ebp + 8]
mov ecx, 0xac
xor eax, eax
lea edi, [ebp - 0x2c4]
mov dword [ebp - 0x2c8], ebx
push 0x2708
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c8]
push 0x2b4
push eax
push ebx
push dword [esi + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x487c8e
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xac6]
mov word [ebp - 0xac8], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xac8]
push eax
push dword [esi + 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0xac8]
lea ecx, [ebp + 8]
push eax
call fcn.0040a529
push 0x4bc550
lea ecx, [ebp - 4]
call fcn.00403927
mov eax, dword [esi + 4]
mov esi, dword [esi + 0x10]
mov edi, 0x20000000
cmp esi, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
je 0x487c12
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 1
push esi
call dword [eax + 0x24]
test dword [ebp - 8], edi
jne 0x487c37
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00490c03
pop ecx
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.00403a8c
lea ecx, [ebp - 0xc]
call fcn.004038fb
mov eax, dword [ebp - 4]
cmp dword [eax - 8], ebx
je 0x487c4b
lea eax, [ebp - 4]
lea ecx, [ebp + 8]
push eax
call fcn.00403a8c
push ebx
lea ecx, [ebp + 8]
call fcn.00403c58
mov esi, dword [ebp - 0x10]
push eax
push 0x100
push 0x40b
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
lea ecx, [ebp + 8]
call fcn.00403c58
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x48925c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x4af550]
and dword [ebp - 0x2b8], 0
push edi
mov dword [ebp - 4], eax
mov ecx, 0xac
xor eax, eax
lea edi, [ebp - 0x2b4]
push 0x208
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2b8]
push 0x2b4
push eax
push 0
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
pop edi
je 0x4892cc
lea eax, [ebp - 0x2ac]
test eax, eax
je 0x4892bc
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x2ac]
push ecx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.004038b5
lea ecx, [ebp - 4]
call fcn.004038fb
mov eax, dword [ebp + 8]
leave
ret
Function at 0x4892e5
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x4af550]
and dword [ebp - 0x2b8], 0
push edi
mov dword [ebp - 4], eax
mov ecx, 0xac
xor eax, eax
lea edi, [ebp - 0x2b4]
push 0x408
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2b8]
push 0x2b4
push eax
push 0
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
pop edi
je 0x489355
lea eax, [ebp - 0xa4]
test eax, eax
je 0x489345
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0xa4]
push ecx
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.004038b5
lea ecx, [ebp - 4]
call fcn.004038fb
mov eax, dword [ebp + 8]
leave
ret

Function at 0x4899a5
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
push eax
push dword [esp + 0xc]
and dword [eax], 0
mov dword [esi], 0x4a9988
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, esi
pop esi
ret 8

Function at 0x489b9c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov edx, ecx
push edi
mov ecx, 0xad
xor eax, eax
lea edi, [ebp - 0x2b4]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
or ax, 0x4008
push eax
lea eax, [ebp - 0x2b4]
push 0x2b4
push eax
push 0
push dword [edx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b0]
pop edi
leave
ret 4

Function at 0x489c06
Capabilities:
Get common file path

Disassembly:
cmp dword [ecx + 4], 0
push esi
lea esi, [ecx + 4]
je 0x489c17
mov ecx, esi
call fcn.00403816
push esi
push dword [esp + 0xc]
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
pop esi
ret 8

Function at 0x489c38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
push edi
mov edx, ecx
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov eax, edx
lea ecx, [edx + 4]
neg eax
sbb eax, eax
and dword [ebp - 0x18], 0
and eax, ecx
and dword [ebp - 0x38], 0
mov ecx, 0x1ff
lea edi, [ebp - 0x83c]
mov eax, dword [eax]
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4bc51c]
mov dword [ebp - 0x840], eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
mov ecx, edx
push eax
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x24], 1
call fcn.00489a02
push dword [ebp - 4]
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x840]
push 0x5c
push eax
call fcn.0049ce62
pop ecx
pop ecx
pop edi
test eax, eax
je 0x489cd2
and word [eax], 0
lea eax, [ebp - 0x840]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 4]
call fcn.004038fb
xor eax, eax
leave
ret 8