joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4233b4
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x57b3e8
call fcn.0054d533
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x74], esi
jne 0x4233da
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42342e
call fcn.00422a3c
push eax
lea ecx, [ebp - 0x10]
call fcn.00421cd9
mov ecx, dword [edi + 0x74]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 4], esi
mov eax, dword [ecx]
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.005619ee
push eax
call fcn.00402f60
add esp, 0x14
test edi, edi
je 0x423421
push edi
call fcn.005619f9
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004222c8
mov eax, esi
call fcn.0054d4fc
ret 8

Function at 0x425e76
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00423009
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x425eb2
call fcn.00426182
mov dword [esi + 0xc], 1
jmp 0x425eb7
call fcn.00426182
cmp dword [esi], 0
je 0x425f00
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x425eda
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00423d51
jmp 0x425eeb
push 0xff
mov ecx, esi
call fcn.0042223e
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00423d74
jmp 0x425f24
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x425f24
push dword [esi]
push dword [ebp - 4]
call fcn.0043b0da
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4260d7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00426182
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42611f
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00423d51
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00423d74
jmp 0x42612a
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0043b0da
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x428d2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x428d70
call fcn.004240bc
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x428d70
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x428d8c
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042650f
mov ebx, eax
test edi, edi
je 0x428d8a
test esi, esi
je 0x428d8a
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4296ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42976a
cmp dword [esi + 0x20], 0
je 0x42976a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42976a
cmp dword [ebp + 8], 0
je 0x42976a
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.004240bc
push 0x594988
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x42973b
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42976a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0043da81
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x42975b
test edi, edi
je 0x42975b
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x429766
mov ecx, esi
call fcn.00429476
mov eax, ebx
jmp 0x42976c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42db3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004240bc
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42db71
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0042db92
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42de49
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x5754fd
call fcn.0054d59e
mov esi, ecx
mov dword [ebp - 0x24], esi
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edi
call fcn.004240bc
xor ebx, ebx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
cmp dword [esi + 0x84], ebx
je 0x42dea8
call fcn.004240bc
push 5
push dword [esi + 0x84]
mov edi, dword [eax + 0xc]
push edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [ebp - 0x1c], eax
test edi, edi
je 0x42deb8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
jmp 0x42debb
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x42dec7
or eax, 0xffffffff
jmp 0x42e00f
mov ecx, esi
call fcn.0042e351
mov edi, eax
mov dword [ebp - 0x30], edi
call fcn.00427b3d
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
test edi, edi
je 0x42df3f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x42df3f
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42df3f
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.00423947
mov dword [ebp - 0x18], eax
test eax, eax
je 0x42df3f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x150]
test eax, eax
je 0x42df3f
mov ecx, dword [ebp - 0x18]
call fcn.004234d1
test eax, eax
je 0x42df3f
mov ecx, dword [ebp - 0x18]
push ebx
call fcn.00422eb3
mov dword [ebp - 0x28], 1
push esi
mov dword [ebp - 4], ebx
call fcn.004277d5
push edi
call fcn.00428d95
push dword [ebp - 0x20]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.0042ddea
test eax, eax
jne 0x42df87
cmp dword [esi + 0x9c], ebx
jne 0x42df87
call fcn.004240bc
push edi
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.00428d95
push dword [ebp - 0x20]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.0042ddea
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x9c], ebx
jmp 0x42dfb8
cmp dword [ebp - 0x28], 0
je 0x42dfc8
mov ecx, dword [ebp - 0x18]
push 1
call fcn.00422eb3
cmp dword [ebp - 0x2c], 0
je 0x42dfd7
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
je 0x42dfed
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x42dfed
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0042e308
cmp dword [esi + 0x84], ebx
je 0x42e00c
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x68]
call fcn.0054d4fc
ret
Function at 0x42ff8a
Capabilities:
Get disk information

Disassembly:
push 0x268
mov eax, 0x575637
call fcn.0054d567
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
test esi, esi
mov edi, dword [ebp + 0x10]
setne al
mov dword [ebp - 0x264], esi
test eax, eax
jne 0x42ffb8
call fcn.00421b16
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x42ffb3
lea eax, [ebp - 0x268]
push eax
push esi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x430000
push 0xffffffffffffffff
push ebx
push 0x104
push esi
call fcn.005619ee
push eax
call fcn.00402f60
add esp, 0x14
push ebx
push edi
call fcn.0042ff5d
xor eax, eax
jmp 0x430123
cmp eax, 0x104
jb 0x43001d
test edi, edi
je 0x42fff9
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.0042230b
jmp 0x42fff9
call fcn.00422a3c
push eax
lea ecx, [ebp - 0x26c]
call fcn.00421cd9
and dword [ebp - 4], 0
lea eax, [ebp - 0x26c]
push eax
push esi
call fcn.0042f88d
mov esi, dword [ebp - 0x26c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x430118
xor ecx, ecx
lea eax, [ebp - 0x270]
push ecx
push ecx
push eax
lea eax, [ebp - 0x274]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x430088
push ebx
push edi
call fcn.0042ff5d
lea ecx, [esi - 0x10]
call fcn.004222c8
jmp 0x42fff9
mov eax, dword [ebp - 0x270]
test al, 2
jne 0x4300a4
push dword [ebp - 0x264]
call dword [sym.imp.USER32.dll_CharUpperW]
mov eax, dword [ebp - 0x270]
test al, 4
jne 0x430118
lea eax, [ebp - 0x260]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x430118
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x430074
cmp eax, dword [ebp - 0x264]
jbe 0x430074
lea eax, [ebp - 0x234]
push eax
call fcn.005619f9
mov edx, dword [ebp - 0x268]
sub edx, dword [ebp - 0x264]
sar edx, 1
pop ecx
add eax, edx
mov ecx, 0x104
cmp eax, ecx
jge 0x43012b
lea eax, [ebp - 0x234]
sub ecx, edx
push eax
push ecx
push dword [ebp - 0x268]
call fcn.00558abc
push eax
call fcn.00402f60
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.004222c8
xor eax, eax
inc eax
call fcn.0054d511
ret 0xc
test edi, edi
je 0x43007b
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.0042230b
jmp 0x43007b
Function at 0x4343f3
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5759a2
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.0054d2d0
mov eax, dword [0x5e5044]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x10]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x2020], edx
mov dword [ebp - 0x2028], ebx
cmp dword [ecx + 0x58], ebx
je 0x43452a
push ebx
push eax
call fcn.00434579
mov ebx, eax
test ebx, ebx
jne 0x43445b
push esi
jmp 0x434552
call fcn.00422a3c
push eax
lea ecx, [ebp - 0x2014]
call fcn.00421cd9
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x201c]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2020]
mov dword [ebp - 0x201c], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2024], eax
test eax, eax
jne 0x4344e9
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.0042223e
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x201c]
push eax
push 0
push dword [ebp - 0x2020]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x2024], eax
call fcn.00423d74
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2024], 0
jne 0x434517
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.004023f0
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.004222c8
jmp 0x434559
push esi
mov ecx, edi
call fcn.00402a50
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x434510
test esi, esi
jne 0x434533
mov esi, 0x583f5c
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.00402a50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c90d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x434b36
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x575a34
call fcn.0054d567
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x234], edi
call fcn.00434abf
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x434b8a
lea eax, [ebp - 0x22c]
mov ecx, esi
push eax
call fcn.00434ace
test eax, eax
je 0x434b82
mov edx, dword [eax]
mov ecx, eax
push edi
push edi
push 0xfffffffffffffffc
push edi
call dword [edx + 0xc]
cmp dword [ebp - 0x22c], edi
jne 0x434b64
cmp dword [esi + 0x58], edi
je 0x434ca5
xor eax, eax
cmp dword [esi + 0x6c], edi
setne al
test eax, eax
jne 0x434ba4
call fcn.00421b16
push str.Software_
lea ecx, [ebp - 0x220]
call fcn.00402a50
push dword [esi + 0x58]
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], edi
call fcn.004220a1
push 0x583f60
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00417950
push dword [esi + 0x6c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00417950
add esp, 0x18
mov ecx, dword [ebp - 0x230]
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.004222c8
push edi
lea eax, [ebp - 0x228]
mov esi, connect
push eax
push esi
call fcn.004348f7
lea eax, [ebp - 0x224]
push eax
push 8
push edi
push dword [ebp - 0x220]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x434c6e
push 0x104
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x434c62
push edi
lea eax, [ebp - 0x220]
push eax
push esi
call fcn.004348f7
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x228]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.004222c8
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.004222c8
xor eax, eax
inc eax
call fcn.0054d511
ret
Function at 0x43ff6d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x43ff87
mov edi, dword [esi + 0xc]
jmp 0x43ffc7
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x43ffa0
call fcn.00424acc
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x43ffb5
call fcn.00424acc
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x43ffc7
call fcn.00424acc
call fcn.004240bc
cmp dword [eax + 0x3c], 0
je 0x43ffdc
push edi
mov ecx, ebx
call fcn.0043f6d8
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004401b0
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x440005
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x440011
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x457c13
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x438
mov eax, 0x577144
call fcn.0054d567
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x42c], ebx
call fcn.004240bc
push ebx
mov ecx, dword [eax + 4]
call fcn.0043413a
mov esi, eax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x430], ebx
mov eax, dword [edi]
lea ecx, [ebp - 0x424]
push ecx
mov ecx, edi
mov byte [ebp - 4], 1
call dword [eax + 0x20]
push 0x2001f
lea ecx, [ebp - 0x438]
push dword [eax]
push esi
call fcn.0045785a
mov ecx, dword [ebp - 0x424]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ecx - 0x10]
call fcn.004222c8
add bl, 1
je 0x457db5
xor ebx, ebx
lea eax, [ebp - 0x218]
push 0x208
push ebx
push eax
mov esi, ebx
call fcn.0054ee00
add esp, 0xc
mov dword [ebp - 0x424], 0x104
lea eax, [ebp - 0x424]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x457d71
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], 0x104
push 0
push eax
inc esi
call fcn.0054ee00
add esp, 0xc
mov dword [ebp - 0x428], 0x104
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00457ba0
test eax, eax
jne 0x457d5c
lea eax, [ebp - 0x218]
push eax
lea ecx, [edi + 4]
call fcn.00456a7a
lea ecx, [ebp - 0x420]
push ecx
mov ecx, eax
call fcn.0042230b
mov dword [ebp - 0x42c], 1
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x438]
call ebx
test eax, eax
je 0x457ce6
lea ecx, [ebp - 0x438]
call fcn.00434120
mov eax, dword [edi]
lea ecx, [ebp - 0x428]
push ecx
mov ecx, edi
call dword [eax + 0x20]
lea ecx, [ebp - 0x444]
push dword [eax]
call fcn.00457134
mov ecx, dword [ebp - 0x428]
add ecx, 0xfffffff0
call fcn.004222c8
lea ecx, [ebp - 0x438]
call fcn.00434120
lea ecx, [ebp - 0x444]
call fcn.00434120
mov eax, dword [ebp - 0x42c]
call fcn.0054d511
ret
Function at 0x46f636
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xddc
mov eax, dword [0x5e5044]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test edx, edx
je 0x46f85b
test esi, esi
je 0x46f85b
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x874], ebx
mov dword [ebp - 0x870], ebx
mov dword [ebp - 0x86c], ebx
mov dword [ebp - 0x868], ebx
mov dword [ebp - 0x864], ebx
mov dword [ebp - 0x860], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
sub eax, ebx
je 0x46f82c
sub eax, 1
je 0x46f6ce
sub eax, 1
je 0x46f794
sub eax, 1
jne 0x46f846
mov edi, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x20c]
push eax
push dword [edx + 4]
call edi
test eax, eax
je 0x46f827
push ebx
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0043802b
test eax, eax
je 0x46f827
lea eax, [ebp - 0x414]
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x46f78c
push ebx
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0043802b
test eax, eax
je 0x46f78c
cmp dword [ebp + 0x10], 1
jne 0x46f7ec
test byte [ebp - 0x854], 0x10
jne 0x46f827
test byte [ebp - 0x624], 0x10
jne 0x46f78c
mov ecx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x858], ecx
ja 0x46f78c
jb 0x46f827
cmp dword [ebp - 0x85c], eax
jb 0x46f827
cmp dword [ebp - 0x858], ecx
jb 0x46f846
ja 0x46f78c
cmp dword [ebp - 0x85c], eax
jbe 0x46f846
xor ebx, ebx
inc ebx
jmp 0x46f846
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0xddc]
push 0x408
push 0x2b4
push eax
push ebx
push dword [edx + 4]
call edi
test eax, eax
je 0x46f846
push 0x408
push 0x2b4
lea eax, [ebp - 0xb28]
push eax
push ebx
push dword [esi + 4]
call edi
test eax, eax
je 0x46f846
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, eax
jmp 0x46f846
push dword [ebp - 0x638]
lea ecx, [ebp - 0x86c]
push dword [ebp - 0x63c]
call fcn.00437a2f
test al, al
jne 0x46f827
push dword [ebp - 0x638]
lea ecx, [ebp - 0x86c]
push dword [ebp - 0x63c]
call fcn.00437a4e
xor ebx, ebx
test al, al
setne bl
jmp 0x46f846
or ebx, 0xffffffff
jmp 0x46f846
push dword [esi + 8]
mov eax, dword [edx]
push dword [edx + 8]
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jns 0x46f843
xor eax, eax
jmp 0x46f848
movsx ebx, ax
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054c90d
mov esp, ebp
pop ebp
ret 0xc
call fcn.00421b16
int3
Function at 0x46fdd5
Capabilities:
Get file system object information

Disassembly:
push 0x6f8
mov eax, 0x578625
call fcn.0054d567
mov edi, ecx
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
mov esi, dword [ebp + 8]
xor eax, eax
test ecx, ecx
mov dword [ebp - 0x704], ebx
setne al
test eax, eax
jne 0x46fe04
call fcn.00421b16
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x46ff32
sub eax, 1
je 0x46fe5c
sub eax, 1
je 0x46fe34
sub eax, 1
je 0x46fe5c
push 0x583f5c
mov ecx, esi
call fcn.00402a50
mov eax, esi
call fcn.0054d511
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x46fe1e
lea eax, [ebp - 0x4e8]
push eax
jmp 0x46fe23
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x46fe1e
push ebx
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], ebx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x444], ebx
push eax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
call fcn.0043802b
test eax, eax
je 0x46fe1e
call fcn.00422a3c
push eax
lea ecx, [ebp - 0x700]
call fcn.00421cd9
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], ebx
jne 0x46fef2
test byte [ebp - 0x428], 0x18
jne 0x46ff0a
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov ecx, edi
push dword [ebp - 0x430]
call dword [eax + 0x1a0]
jmp 0x46ff0a
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov ecx, edi
call dword [eax + 0x1a4]
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.004023f0
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [esi], eax
lea ecx, [ecx - 0x10]
call fcn.004222c8
jmp 0x46fe2a
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x46fe1e
lea eax, [ebp - 0x6f0]
jmp 0x46fe59

Function at 0x470114
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.004e9d07
call fcn.00424110
cmp dword [eax + 0x14], 0
jne 0x47012f
mov ecx, esi
pop esi
jmp fcn.0046f50b
pop esi
ret

Function at 0x470ef3
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004164f0
call fcn.00424110
cmp dword [eax + 0x14], 0
jne 0x470f0e
mov ecx, esi
pop esi
jmp fcn.004707d0
pop esi
ret
Function at 0x4724aa
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x178]
mov bx, word [ebp + 8]
mov edi, eax
push 2
movzx edx, bx
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x4724ef
test edi, edi
js 0x4724ef
cmp eax, 0x20
je 0x4724e4
cmp bx, 0x71
jne 0x4724ef
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x190]
pop edi
pop esi
pop ebx
pop ebp
ret 8