joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463fdc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x46400b
cmp dword [esp + 4], 5
ja 0x46400f
cmp dword [esp + 4], 5
jne 0x46400b
cmp dword [esp + 8], 0
ja 0x46400f
xor eax, eax
jmp 0x464014
mov eax, 1
add esp, 0x94
ret

Function at 0x464838
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x464841
mov eax, dword [ebp - 4]
add esp, 0xfffffaf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4a9f9c
call fcn.004980b0
call fcn.004a0080
mov dword [ebp - 0x2458], eax
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x464884
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.00413298
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x28fc]
call fcn.00413d60
lea eax, [ebp - 0x28d0]
call fcn.00413d60
lea eax, [ebp - 0x28a4]
call fcn.00413d60
inc dword [0x4c780c]
jmp 0x464971
test bl, bl
jne 0x464907
call fcn.004a0080
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x464907
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.00472a98
mov bl, 1
test bl, bl
je 0x46491b
lea eax, [ebp - 0x3510]
call fcn.004748b0
call fcn.00473bd8
call fcn.0047cc10
cmp byte [ebp + 0x18], 0
je 0x46493b
lea eax, [ebp - 0x3510]
call fcn.0040bd28
lea edx, [ebp - 0x3510]
cmp eax, edx
jne 0x46493f
xor eax, eax
jmp 0x464944
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x14]
lea eax, [ebp - 0x3510]
push edx
lea edx, [ebp - 0x3110]
mov cl, byte [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x3510]
push dword [ebp + 0xc]
call fcn.00464a24
lea edx, [ebp - 0x3510]
lea eax, [ebp - 0x242c]
call fcn.004133cc
test eax, eax
jne 0x464993
cmp dword [0x4c7814], 0
je 0x4648df
dec dword [0x4c780c]
mov eax, dword [0x4c7814]
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 0x2459], dl
mov word [ebp - 0x2440], 0x14
test eax, eax
je 0x4649ca
mov eax, esi
call fcn.004607e4
xor edx, edx
mov dword [0x4c7814], edx
jmp 0x4649d1
mov eax, esi
call fcn.00460ae0
cmp dword [ebp + 8], 0
je 0x4649e1
call fcn.00474d28
mov edx, dword [ebp + 8]
mov byte [edx], al
test bl, bl
je 0x4649f0
push dword [0x4c4e70]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.00413370
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4657dd
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.00496490
pop ecx
mov edi, eax
test edi, edi
jne 0x465800
mov eax, 1
xor edx, edx
jmp 0x465893
mov dword [esp], 0
mov dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x465857
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x465826
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x465821
push edi
call fcn.004962cc
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0049c154
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x46b488
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x4c7828
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46b4bf
push 0x40
mov eax, 0x2bc
call fcn.004125d0
push eax
mov eax, 0x2bd
call fcn.004125d0
push eax
push dword [0x4c4e64]
call sub.USER32.DLL_MessageBoxA
pop ebx
ret
push 0
mov edx, 0x4c7828
xor ecx, ecx
mov eax, ebx
call fcn.0046a620
pop ebx
ret

Function at 0x46b4d4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffb64
mov esi, ecx
mov ebx, edx
push 0
push 0
xor edx, edx
mov eax, ebx
call fcn.00469715
test al, al
je 0x46b520
push 0x30
mov eax, 0x65
call fcn.004125d0
push eax
mov eax, 0x596
call fcn.004125d0
push eax
push dword [0x4c4e64]
call sub.USER32.DLL_MessageBoxA
jmp 0x46b6e5
cmp dword [0x4c7804], 0
jne 0x46b55d
push 0
push 1
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00469ef0
test al, al
jne 0x46b6e5
push ebx
mov eax, 0x201
call fcn.004125d0
push eax
call fcn.00486954
add esp, 8
jmp 0x46b6e5
mov edx, esp
mov eax, 0x4aa597
call fcn.00463a04
test al, al
je 0x46b6e5
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call fcn.00499610
pop ecx
lea edx, [esp + 0x800]
mov eax, 0x4c5bc4
call fcn.004575cc
call fcn.00449558
mov ecx, 0x4bdcb8
mov edx, 0x4bd8b8
mov eax, 0x4c5bc4
call fcn.00457598
mov ecx, dword [esp + 0x810]
mov dword [0x4bc468], ecx
mov edx, 0x4aa416
mov eax, dword [0x4be4b8]
call fcn.0040fbf4
call fcn.0044a0dc
mov eax, 0x4c5bc4
xor ecx, ecx
xor edx, edx
call fcn.0045249c
cmp dword [0x4c7818], 0
jne 0x46b6e5
lea edx, [esp + 0x89c]
mov eax, ebx
call fcn.0040be38
lea edx, [esp + 0xc9c]
mov eax, esi
call fcn.0040bf64
lea edx, [esp + 0x89c]
lea eax, [esp + 0x89c]
call fcn.0040abcc
lea edx, [esp + 0xc9c]
lea eax, [esp + 0xc9c]
call fcn.0040ac14
push 0x2010
push 0
push 0x4cf924
call fcn.00497b00
add esp, 0xc
lea ecx, [esp + 0x89c]
push ecx
push 0x4d0531
call fcn.00497c80
add esp, 8
mov eax, 0x4d0932
lea edx, [esp + 0xc9c]
call fcn.0041077c
push 0x4bd8b8
push 0x4cf929
call fcn.00497c80
add esp, 8
mov edx, 0x4bdcb8
mov eax, 0x4cfd2a
call fcn.0041077c
push esp
push 0x4d1132
call fcn.00497c80
add esp, 8
lea ecx, [esp + 0x400]
push ecx
call fcn.00499610
pop ecx
mov byte [0x4cf928], 0
cmp dword [esp + 0x88c], 0
setne dl
mov eax, dword [0x4bc468]
push 0x4cf924
mov dword [0x4d052c], eax
and edx, 1
push 0x10000
push 0x469778
mov byte [0x4d0530], dl
call fcn.0049ff00
add esp, 0xc
add esp, 0x149c
pop esi
pop ebx
ret
Function at 0x471ffe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb6c
push ebx
push esi
push edi
mov dword [ebp - 0x58], ecx
mov edi, edx
mov dword [ebp - 0x54], eax
mov eax, 0x4ab4c8
call fcn.004980b0
push 0x4ab438
push 0x10000
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x47204a
mov eax, dword [ebp - 0x50]
mov dword fs:[0], eax
jmp 0x47224a
push 0
push 0
push 0
push 2
push ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov word [ebp - 0x40], 8
mov esi, eax
mov word [ebp - 0x40], 0x14
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.00411d74
add dword [ebp - 0x34], 2
mov word [ebp - 0x40], 0x20
test edi, edi
je 0x4720b7
lea eax, [ebp - 0x20]
mov dl, 0x49
call fcn.00411f00
lea eax, [ebp - 0x20]
mov dl, 0x1a
call fcn.00411f00
lea eax, [ebp - 0x20]
mov ecx, 0x1a
mov edx, edi
call fcn.00411fd0
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x58]
call fcn.00471fc9
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0x14]
call fcn.00471fc9
cmp dword [ebp + 0x10], 0
je 0x4720e8
lea eax, [ebp - 0x20]
mov dl, 0x54
call fcn.00411f00
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0x10]
call fcn.00471fc9
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0xc]
call fcn.00471fc9
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 8]
call fcn.00471fc9
mov word [ebp - 0x40], 0x2c
lea eax, [ebp - 0x2c]
call fcn.00402134
inc dword [ebp - 0x34]
lea edx, [ebp - 0x2c]
mov word [ebp - 0x40], 0x20
lea eax, [ebp - 0x20]
call fcn.00412098
cmp dword [ebp - 0x28], 0x10000
jle 0x47214f
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004017ec
sub dword [ebp - 0x34], 2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00411df4
mov ecx, dword [ebp - 0x50]
mov dword fs:[0], ecx
jmp 0x47224a
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.00497a90
add esp, 0xc
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push 0x400
lea eax, [ebp - 0x458]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov dword [ebp - 0x494], 0x3c
mov dword [ebp - 0x490], 0x40
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x48c], edx
xor eax, eax
mov dword [ebp - 0x488], 0x4ab452
mov dword [ebp - 0x484], ecx
xor edx, edx
mov dword [ebp - 0x480], 0x4ab458
mov dword [ebp - 0x47c], 0x4ab328
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], edx
lea ecx, [ebp - 0x494]
push ecx
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
je 0x4721f6
push 0xffffffffffffffff
push dword [ebp - 0x45c]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [ebp - 0x45c]
call sub.KERNEL32.DLL_CloseHandle
push ebx
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004017ec
sub dword [ebp - 0x34], 2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00411df4
mov word [ebp - 0x40], 8
mov word [ebp - 0x40], 0
jmp 0x472240
mov edx, dword [ebp - 0x50]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x472418
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffdc0
mov byte [esp], dl
mov ebx, eax
mov esi, 0x4ab02c
lea eax, [esp + 4]
call fcn.0046445c
lea eax, [esp + 4]
call fcn.0040c22c
lea edx, [esi + 0x387]
push edx
lea ecx, [esp + 8]
push ecx
call fcn.00497ba4
add esp, 8
lea eax, [esp + 4]
push eax
lea edx, [esp + 0x408]
push edx
call fcn.00497c80
add esp, 8
test bl, bl
je 0x472485
lea edx, [esi + 0x394]
lea eax, [esi + 8]
mov ecx, 1
call fcn.004610d0
jmp 0x4724c7
lea edx, [esp + 4]
lea eax, [esi + 0x387]
mov cl, 1
call fcn.0040c434
lea eax, [esp + 4]
xor edx, edx
call fcn.0040a72c
test al, al
jne 0x4724c7
cmp byte [esp], 0
je 0x4724b2
xor eax, eax
jmp 0x47264e
lea edx, [esp + 0x404]
push edx
lea ecx, [esp + 8]
push ecx
call fcn.00497c80
add esp, 8
cmp byte [esp], 0
jne 0x4724ff
lea eax, [esi + 0x3a5]
test bl, bl
push eax
mov eax, 0x5b4
push ebx
jne 0x4724df
inc eax
call fcn.004125d0
mov edx, eax
lea ecx, [esp + 0xc]
mov eax, dword [0x4c4e64]
call fcn.0044d500
test al, al
jne 0x4724ff
xor eax, eax
jmp 0x47264e
lea edx, [esp + 4]
test bl, bl
push edx
je 0x472510
lea ecx, [esi + 0x3ab]
jmp 0x472516
lea ecx, [esi + 0x3d6]
push ecx
lea eax, [esp + 0x80c]
push eax
call fcn.0049abd0
add esp, 0xc
push 0x3c
push 0
lea edx, [esp + 0xd0c]
push edx
call fcn.00497b00
add esp, 0xc
mov eax, dword [0x4c4e64]
lea edx, [esi + 0x3de]
mov dword [esp + 0xd04], 0x3c
mov dword [esp + 0xd08], 0x40
mov dword [esp + 0xd0c], eax
mov dword [esp + 0xd14], edx
lea ecx, [esp + 0x804]
lea eax, [esp + 0xd04]
mov dword [esp + 0xd18], ecx
mov dword [esp + 0xd20], 1
push eax
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne dl
and edx, 1
mov byte [esp + 1], dl
cmp byte [esp + 1], 0
je 0x4725c0
push 0x1388
push dword [esp + 0xd40]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0xd3c]
call sub.KERNEL32.DLL_CloseHandle
test bl, bl
je 0x4725d2
lea edx, [esi + 0x394]
lea eax, [esi + 8]
call fcn.004614a0
cmp byte [esp + 1], 0
je 0x472629
test bl, bl
jne 0x4725e2
call fcn.00472658
lea ecx, [esp + 4]
push ecx
mov eax, 0x460
test bl, bl
jne 0x4725f1
inc eax
call fcn.004125d0
push eax
lea edx, [esp + 0xd48]
push edx
call fcn.0049abd0
add esp, 0xc
mov eax, 0x2ee
push 0
call fcn.004125d0
push eax
lea edx, [esp + 0xd48]
push edx
push dword [0x4c4e64]
call sub.USER32.DLL_MessageBoxA
jmp 0x47264a
cmp byte [esp], 0
jne 0x47264a
lea ecx, [esp + 0x804]
mov eax, 0x201
push ecx
call fcn.004125d0
push eax
call fcn.00486954
add esp, 8
mov al, byte [esp + 1]
add esp, 0x1240
pop esi
pop ebx
ret
Function at 0x47275c
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
push eax
add esp, 0xfffffbe4
push 0x4ab438
push 0
push 4
call sub.KERNEL32.DLL_OpenFileMappingA
mov edi, eax
test edi, edi
je 0x472888
push 0x10000
push 0
push 0
push 4
push edi
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
test esi, esi
jne 0x4727a6
push edi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x472888
mov ebx, esi
xor eax, eax
mov al, byte [esi]
cmp eax, 0x49
jne 0x472815
xor edx, edx
mov dl, byte [esi + 1]
cmp edx, 0x1a
jne 0x472815
push 0x1a
lea ecx, [esi + 2]
push ecx
lea eax, [esp + 8]
push eax
call fcn.00497a90
add esp, 0xc
lea ebx, [esi + 0x1c]
mov eax, ebx
mov ecx, 0x400
lea edx, [esp + 0x1c]
call fcn.00472253
mov ebx, eax
lea edx, [esp + 0x41c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472253
mov ebx, eax
test ebx, ebx
je 0x472815
mov eax, esp
xor edx, edx
call fcn.004633f8
lea edx, [esp + 0x41c]
lea eax, [esp + 0x1c]
call fcn.00471f7e
xor ecx, ecx
mov cl, byte [ebx]
cmp ecx, 0x54
jne 0x47287c
inc ebx
lea edx, [esp + 0x81c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472253
mov ebx, eax
lea edx, [esp + 0xc1c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472253
mov ebx, eax
lea edx, [esp + 0x101c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472253
mov ebx, eax
test ebx, ebx
je 0x47287c
lea ecx, [esp + 0x101c]
lea edx, [esp + 0xc1c]
lea eax, [esp + 0x81c]
call fcn.004635e8
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0x141c
pop edi
pop esi
pop ebx
ret

Function at 0x472916
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
push eax
push dword [0x4c4e70]
call sub.USER32.DLL_GetDlgItem
mov ebx, eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.USER32.DLL_GetWindowTextA
push esp
push esi
call fcn.00497c34
add esp, 8
test eax, eax
je 0x472953
push esi
push ebx
call sub.USER32.DLL_SetWindowTextA
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x473bd8
Capabilities:
Get graphical window text

Disassembly:
add esp, 0xfffffe00
mov eax, dword [0x4c4e70]
test eax, eax
je 0x473c85
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.DLL_GetWindowTextA
cmp dword [0x4d1ae8], 8
je 0x473c2a
push 0x4d1aec
lea ecx, [esp + 4]
push ecx
call fcn.00497c34
add esp, 8
test eax, eax
je 0x473c2a
push 0x4d1aec
push dword [0x4c4e70]
call sub.USER32.DLL_SetWindowTextA
mov eax, dword [0x4d1ae8]
test eax, eax
je 0x473c42
cmp eax, 1
je 0x473c42
cmp eax, 2
je 0x473c42
cmp eax, 8
jne 0x473c67
mov edx, 0x4d1b6c
mov eax, 0x9c
call fcn.00472916
mov eax, 0x4d1bec
call fcn.0040bd28
mov edx, eax
mov eax, 0x9b
call fcn.00472916
mov edx, 0x64
mov eax, 2
call fcn.0047d668
test al, al
je 0x473c85
push dword [0x4c4e70]
call sub.USER32.DLL_UpdateWindow
add esp, 0x200
ret
Function at 0x474e60
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
cmp dword [ebx + 8], 0
jne 0x474e86
mov eax, 0x4ab5d8
call fcn.00463b3c
mov dword [ebx + 8], eax
mov eax, dword [ebx]
test eax, eax
je 0x474e92
push eax
call sub.USER32.DLL_DestroyWindow
mov dword [ebx + 0xc], 0xffffffff
mov dl, byte [ebp - 1]
mov byte [ebx + 4], dl
push 0
push dword [0x4b214c]
push dword [ebp + 8]
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp byte [ebp - 1], 0
je 0x474eca
mov ecx, 0x4ab5e5
jmp 0x474ecf
mov ecx, 0x4ab5f2
push ecx
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx], eax
cmp byte [ebp - 1], 0
je 0x474f7c
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4209
push 0x160
lea edx, [ebp - 0x17c]
push edx
push 0
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetFileInfoA
push eax
push 0
push 0x402
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 8]
mov eax, dword [0x4cb56c]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0
lea ecx, [ebp - 0x170]
push dword [ebp - 0x178]
push ecx
push 0
push 0
push 0xffffffffffffffff
push 0
mov ecx, 1
lea edx, [ebp - 0x170]
mov eax, ebx
call fcn.004752f4
push 0
push 4
push 0x408
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0
push 0
push 0x407
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x474f8f
call fcn.00463f34
jmp 0x474f8f
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.DLL_SetWindowPos
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
je 0x474fbc
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x474fbc
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00475020
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x47500d
call fcn.00463e48
mov edi, eax
xor esi, esi
mov ecx, esi
mov eax, 1
shl eax, cl
test eax, edi
je 0x475007
lea edx, [esi + 0x41]
lea eax, [ebp - 0x1c]
push edx
push 0x4ab5fb
push eax
call fcn.0049abd0
add esp, 0xc
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov eax, ebx
push 0
push 0xffffffffffffffff
push 0
push 0
push 2
push 0xffffffffffffffff
push 1
call fcn.004752f4
inc esi
cmp esi, 0x20
jl 0x474fcb
mov eax, ebx
call fcn.00475484
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4752f4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe74
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x1c]
push 0x408
call fcn.004962f0
pop ecx
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [ebp + 0x20]
mov dword [esi + 4], edx
mov eax, dword [ebp - 4]
call fcn.0040f1c4
push eax
lea edx, [esi + 8]
push edx
call fcn.00497c80
add esp, 8
cmp byte [ebx + 4], 0
je 0x47545b
cmp dword [ebx + 8], 0x50000
jb 0x47535d
cmp dword [0x4c817c], 4
jne 0x475361
cmp dword [0x4c8180], 0
jne 0x475361
mov byte [ebp + 8], 0
cmp byte [ebp + 8], 0
jne 0x475372
cmp edi, 0xffffffff
je 0x475376
cmp dword [ebp + 0x18], 0
je 0x475376
xor eax, eax
jmp 0x47537b
mov eax, 1
test al, al
je 0x4753be
cmp dword [ebp - 8], 2
mov eax, 0x4201
jne 0x47538d
or eax, 2
push eax
push 0x160
lea edx, [ebp - 0x168]
push edx
push 0
push dword [ebp - 4]
call sub.SHELL32.DLL_SHGetFileInfoA
cmp edi, 0xffffffff
jne 0x4753af
mov edi, dword [ebp - 0x164]
cmp dword [ebp + 0x18], 0
jne 0x4753be
lea eax, [ebp - 0x15c]
mov dword [ebp + 0x18], eax
push 0x24
push 0
lea edx, [ebp - 0x18c]
push edx
call fcn.00497b00
add esp, 0xc
mov dword [ebp - 0x18c], 0x37
cmp dword [ebp + 0x18], 0
je 0x4753e6
mov ecx, dword [ebp + 0x18]
jmp 0x4753e9
or ecx, 0xffffffff
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x16c], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x17c], edi
mov dword [ebp - 0x178], edi
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x170], edx
cmp dword [ebp + 0x14], 0
je 0x475442
call fcn.0041043c
test eax, eax
je 0x475442
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x18c]
mov dword [ebp - 0x184], eax
push edx
push 0
push 0x40b
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x47547b
lea ecx, [ebp - 0x18c]
push ecx
push 0
push 0x401
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x47547b
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x14a
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push esi
push eax
push 0x151
push dword [ebx]
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x475484
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbf4
mov esi, eax
mov eax, 0x4c4e78
call fcn.0045e694
mov edi, eax
test edi, edi
je 0x47550b
xor eax, eax
mov dword [esp], eax
push esp
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x4754f8
xor ebx, ebx
push 0
push ebx
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x4754f8
mov edx, dword [eax + 4]
test edx, edx
je 0x4754ef
push edx
push edi
push 0
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x4754ef
push 0
push ebx
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
jmp 0x4754f8
inc ebx
cmp ebx, 0x80
jl 0x4754b1
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x4755b1
lea ecx, [esp + 0xc]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov byte [esp + 4], 0
xor edi, edi
push 0
push edi
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x475580
cmp dword [ebx], 0
jne 0x475577
movzx ebp, byte [ebx + 8]
push ebp
call fcn.0049bc38
pop ecx
push eax
xor eax, eax
mov al, byte [esp + 0x10]
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
call fcn.0049bc38
pop ecx
pop edx
cmp edx, eax
jne 0x475577
push 0
push edi
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov byte [esp + 4], 1
jmp 0x475580
inc edi
cmp edi, 0x80
jl 0x475521
cmp byte [esp + 4], 0
jne 0x475598
push 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x10]
mov eax, esi
call fcn.00475758
cmp dword [0x4c7804], 0
je 0x4755aa
mov eax, esi
call fcn.00475a18
jmp 0x4755b1
mov eax, esi
call fcn.004759cc
add esp, 0x40c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4755bc
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
push dword [ebx]
call sub.USER32.DLL_GetWindowTextA
mov eax, esp
call fcn.0047d3b4
mov edx, esp
push edx
push 0xffffffffffffffff
push 0x158
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x475624
push 0
push eax
push 0x14e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov eax, ebx
call fcn.00475678
cmp dword [0x4c7804], 0
je 0x47561b
mov eax, ebx
call fcn.00475a18
jmp 0x47566e
mov eax, ebx
call fcn.004759cc
jmp 0x47566e
cmp dword [0x4c7804], 0
je 0x475648
mov eax, esp
call fcn.0040c8ac
test al, al
jne 0x475648
mov edx, esp
mov eax, 0x4c4e78
xor ecx, ecx
call fcn.0045c228
jmp 0x47566e
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x475667
test al, 0x10
jne 0x475667
mov edx, esp
mov eax, 0x4c4e78
xor ecx, ecx
call fcn.0045c0b8
jmp 0x47566e
mov eax, esp
call fcn.004827d4
add esp, 0x400
pop ebx
ret