joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea esi, [ebp - 1]
call fcn.00424032
mov esi, dword [ebp + 8]
push dword [esi]
call dword [sym.imp.GDI32.dll_DeleteObject]
xor ebx, ebx
mov dword [esi], ebx
add esi, 4
mov eax, dword [esi]
invalid

Function at 0x4725dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
call fcn.0040131d
test al, al
jne 0x47260d
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push str.startpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg al
jmp 0x47287d
call fcn.0040131d
test al, al
je 0x472626
call fcn.00423932
test al, al
jne 0x472626
inc al
jmp 0x47287d
lea eax, [ebp - 8]
push eax
push 0x53abcc
push 0x17
xor ebx, ebx
push ebx
push 0x53abbc
mov dword [ebp - 8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [ebp - 8], ebx
jne 0x47264e
xor al, al
jmp 0x47287d
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ebx
call esi
invalid

Function at 0x472884
Capabilities:
Create process on windows

Disassembly:
call fcn.0040131d
test al, al
jne 0x4728b7
push dword [esp + 4]
call fcn.00401d29
test al, al
je 0x4728b9
xor eax, eax
push eax
push eax
push eax
push dword [esp + 0x10]
push str.startunpin
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg al
jmp 0x4728b9
mov al, 1
ret 4

Function at 0x4728bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
lea eax, [ebp - 0x208]
call fcn.0044936f
cmp word [ebp - 0x208], 0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0x56ed3c
mov ebx, str..lnk
je 0x47292a
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00401dde
lea ecx, [ebp - 0x410]
call fcn.0044a500
push ebx
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0044a0d6
lea eax, [ebp - 0x410]
push eax
call edi
lea eax, [ebp - 0x208]
call fcn.00449381
cmp word [ebp - 0x208], 0
je 0x47297c
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00401dde
lea ecx, [ebp - 0x410]
call fcn.0044a500
push ebx
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0044a0d6
lea eax, [ebp - 0x410]
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x472a68
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
lea eax, [ebp - 0x208]
call fcn.0044936f
cmp word [ebp - 0x208], 0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, str..lnk
je 0x472abf
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0044a0d6
lea eax, [ebp - 0x410]
push eax
call fcn.00472884
lea eax, [ebp - 0x410]
push eax
call esi
lea eax, [ebp - 0x208]
call fcn.00449381
cmp word [ebp - 0x208], 0
je 0x472b00
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0044a0d6
lea eax, [ebp - 0x410]
push eax
call fcn.00472884
lea eax, [ebp - 0x410]
push eax
call esi
pop edi
pop esi
leave
ret 4

Function at 0x472b06
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push esi
lea eax, [ebp - 0x208]
push eax
xor esi, esi
push esi
push esi
push 0x28
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x472bc6
push 0x53ec98
push 0x56ed3c
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0044a0d6
push esi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x410]
push eax
call fcn.00401d29
test al, al
je 0x472bc6
push ebx
push edi
mov ebx, 0x5a5be0
jmp 0x472b72
xor esi, esi
cmp dword [ebx], esi
je 0x472bc4
push str..lnk
push dword [ebx + 4]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.0044a0d6
push dword [ebx]
mov esi, 0x104
push str._extfind__s
lea edi, [ebp - 0x208]
call fcn.0044b138
pop ecx
pop ecx
push dword [ebx + 4]
mov eax, edi
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x618]
push eax
call fcn.0047220a
add ebx, 8
jne 0x472b70
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x472bcb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x414]
mov word [ebp - 0x20c], si
call fcn.0044936f
cmp word [ebp - 0x414], si
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, 0x56ed3c
je 0x472c4f
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00401dde
lea eax, [ebp - 0x20c]
push eax
call fcn.00401d29
test al, al
lea eax, [ebp - 0x20c]
je 0x472c40
push eax
call fcn.00401f7b
test al, al
je 0x472cfd
jmp 0x472c4f
push esi
push eax
call edi
test eax, eax
jne 0x472c4f
mov word [ebp - 0x20c], si
cmp word [ebp - 0x20c], si
jne 0x472c92
lea eax, [ebp - 0x414]
call fcn.00449381
cmp word [ebp - 0x414], si
je 0x472cfd
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00401dde
push esi
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x472cfd
cmp dword [str.VideoPad], esi
mov dword [ebp - 4], esi
je 0x472cfd
mov ebx, 0x5a5be0
push str..lnk
push dword [ebx + 4]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.0044a0d6
push dword [ebx]
mov esi, 0x104
push str._extfind__s
lea edi, [ebp - 0x61c]
call fcn.0044b138
pop ecx
pop ecx
push dword [ebx + 4]
mov eax, edi
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x824]
push eax
call fcn.0047220a
inc dword [ebp - 4]
mov ebx, dword [ebp - 4]
lea ebx, [ebx*8 + 0x5a5be0]
cmp dword [ebx], 0
jne 0x472ca2
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x474927
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
movzx ebx, word [ebp + 8]
push esi
push edi
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx esi, word [ebp + 8]
cmp esi, 0x25
mov dword [ebp - 4], eax
je 0x474988
cmp esi, 0x27
je 0x474988
cmp esi, 0x26
je 0x474988
cmp esi, 0x28
je 0x474988
cmp esi, 0x2d
je 0x474988
cmp esi, 0x21
je 0x474988
cmp esi, 0x22
je 0x474988
cmp esi, 0x2e
je 0x474988
cmp esi, 0x24
je 0x474988
cmp esi, 0x23
je 0x474988
cmp esi, 0x5b
je 0x474988
cmp esi, 0x5c
je 0x474988
cmp esi, 0x5d
jne 0x47498f
or dword [ebp - 4], 0x100
and word [ebp - 0x20c], 0
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
movzx eax, word [ebp - 4]
shl eax, 0x10
or eax, ebx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
cmp word [ebp - 0x20c], 0
jne 0x4749d4
cmp esi, 0x13
jne 0x4749d4
push edi
mov edx, str.Pause
lea esi, [ebp - 0x20c]
call fcn.0044b0f6
test dword [ebp + 8], 0x40000
mov eax, 0x53ec98
je 0x4749ed
cmp dword [ebp - 4], 0x2a
mov edx, str.Shift
jne 0x4749ef
mov edx, eax
test dword [ebp + 8], 0x10000
je 0x474a03
cmp dword [ebp - 4], 0x38
mov ecx, str.Alt
jne 0x474a05
mov ecx, eax
test dword [ebp + 8], 0x20000
je 0x474a19
cmp dword [ebp - 4], 0x1d
je 0x474a19
mov eax, str.Ctrl
lea esi, [ebp - 0x20c]
push esi
push edx
push ecx
push eax
mov esi, edi
mov edi, dword [ebp + 0xc]
push str._s_s_s_s
call fcn.0044b138
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x479bce
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
lea eax, [ebp - 0x418]
push eax
call fcn.00449293
push str.notifications_en.txt
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 0xc]
call fcn.00401dde
xor ebx, ebx
push ebx
call fcn.0052057a
pop ecx
push ebx
mov edi, str.Polled
push edi
mov esi, str.PushNotifications
push esi
mov dword [ebp - 8], eax
call fcn.004248dd
cmp eax, ebx
jle 0x479c35
add eax, 0x93a80
cmp eax, dword [ebp - 8]
jl 0x479c35
push dword [ebp + 0xc]
call fcn.00401d29
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 0x210]
push eax
call fcn.00401cb0
push ebx
lea eax, [ebp - 0x210]
push eax
push str.http:__www.audiochannel.net_components_notifications_expressburn.txt
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.004285f3
cmp dword [ebp - 4], 1
jne 0x479c75
lea eax, [ebp - 0x210]
push eax
mov eax, 0x1f4
call fcn.00449190
xor al, al
jmp 0x479c2e
push dword [ebp - 8]
push edi
push esi
call fcn.004248a7
cmp dword [ebp - 4], 2
lea eax, [ebp - 0x210]
je 0x479c66
push 3
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x479cb3
lea eax, [ebp - 0x210]
push eax
mov eax, 0x1f4
call fcn.00449190
mov al, bl
jmp 0x479c2e
mov word [ebp - 0x210], bx
mov bl, 1
jmp 0x479c9b

Function at 0x47a3a7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0xff]
push ebx
push eax
mov byte [ebp - 0x100], bl
call fcn.005251f0
mov esi, dword [sym.imp.USER32.dll_GetKeyboardState]
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
mov edi, dword [sym.imp.USER32.dll_keybd_event]
je 0x47a3fa
test byte [ebp - 0xee], 0x80
jne 0x47a3fa
push ebx
push 1
push ebx
push 0x12
call edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
je 0x47a421
test byte [ebp - 0xee], 0x80
jne 0x47a421
push ebx
push 3
push ebx
push 0x12
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x47b526
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
push edi
push edi
mov ebx, eax
push 0x1004
push ebx
mov dword [ebp - 0x3c], 0xd
call esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
push eax
push edi
push 0x104d
push ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ecx
call esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
cmp eax, edi
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x34], edi
je 0x47b5b5
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], ecx
inc dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
push edi
push 0x104c
push ebx
call esi
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, edi
jne 0x47b595
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47e071
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, 0x3e8
push edi
mov ebp, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, 0x4ff
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [esp + 0x18], eax
xor eax, eax
push eax
push eax
push eax
call esi
mov edi, 0x102
jmp 0x47e0ce
push dword [esp + 0x18]
call fcn.0047e028
test al, al
jne 0x47e0dc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, ebp
jbe 0x47e0bf
mov eax, ebp
add dword [esp + 0x10], eax
push ebx
sub ebp, eax
push ebp
xor eax, eax
push eax
push eax
push eax
call esi
cmp eax, edi
jne 0x47e0a2
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
xor al, al
jmp 0x47e0d4
Function at 0x47fd23
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
xor ebx, ebx
push ebx
push 0x1039
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], ecx
mov ecx, dword [edi]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov eax, dword [ebp - 4]
mov ecx, edi
call dword [eax + 0x34]
test al, al
je 0x47fe00
cmp dword [ebp - 0x10], ebx
jge 0x47fdee
push ebx
push ebx
push 0x1037
push dword [ebp + 8]
call esi
test al, 1
je 0x47fe00
push ebx
push ebx
push 0x1004
push dword [ebp + 8]
mov dword [ebp - 0x50], 0xd
call esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x104d
push dword [ebp + 8]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 0x53ec98
call esi
mov edx, dword [edi]
push eax
mov ecx, edi
mov dword [ebp + 0xc], eax
call dword [edx]
mov eax, dword [edi + 4]
invalid
Function at 0x4802e7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
push ebx
push ebx
push 0x101f
push dword [ebp + 8]
call edi
push ebx
push ebx
push 0x31
push dword [ebp + 8]
mov dword [ebp - 4], eax
call edi
mov dword [esi + 0x15], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x480323
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push 0x1038
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
jle 0x4804aa
push ebx
push dword [0x5a9cd0]
mov eax, SysReAllocString
push 0x5b
push dword [ebp - 4]
push eax
push eax
push eax
push eax
push 0x50210043
push 0x53ec98
push str.combobox
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
push ebx
push 0x14b
push eax
mov dword [esi + 4], eax
call edi
push dword [ebp + 0xc]
mov ebx, dword [esi]
push dword [ebp + 0x10]
add ebx, 0x2c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov ecx, esi
call dword [ebx]
push dword [esi + 4]
call fcn.004432db
push 0
push eax
push 0x160
push dword [esi + 4]
call edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x10]
push 1
push dword [ebp - 0x1c]
mov dword [esi + 8], eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
push eax
push ecx
push dword [esi + 4]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x2a], ecx
mov dword [esi + 0x2e], eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push dword [esi + 0x15]
push 0x30
push dword [esi + 4]
call edi
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
and word [ebp - 0x250], 0
lea eax, [ebp - 0x250]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x120b
push dword [ebp - 4]
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x38], 0x104
call edi
push dword [ebp - 0x40]
push 0xffffffffffffffff
push 0x158
push dword [esi + 4]
call edi
test eax, eax
jg 0x480445
xor eax, eax
push 0
push eax
push 0x14e
push dword [esi + 4]
call edi
push str.LVEdtOldWndProc
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_SetPropW]
jne 0x480485
push 0x47ec45
push 0xfffffffffffffffc
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push eax
push str.LVEdtOldWndProc
push dword [ebp - 4]
call ebx
push esi
push str.LVExtColHandler
push dword [ebp - 4]
call ebx
push 0
push str.DoNotUpdateParentList
push dword [esi + 4]
call ebx
push 0
push 1
push 0x14f
push dword [esi + 4]
call edi
pop edi
pop ebx
leave
ret 0xc
Function at 0x483b64
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
push edi
lea esi, [ebp - 0x28]
call fcn.00425b7c
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x111]
mov ecx, dword [edi + 0x25]
imul eax, eax, 0x227
xor esi, esi
add eax, ecx
xor dl, dl
cmp dword [eax + 0x214], esi
mov byte [ebp - 5], 0
mov dword [ebp - 0x14], esi
jle 0x483d0d
mov dword [ebp - 0x10], esi
mov ebx, dword [eax + 0x210]
add ebx, dword [ebp - 0x10]
cmp byte [ebx + 0x44f], 0
jne 0x483cab
cmp byte [ebx + 0x450], 0
jne 0x483cab
mov eax, ebx
call fcn.004812a2
test al, al
je 0x483be5
test dl, dl
je 0x483cab
mov byte [ebp - 5], 1
jmp 0x483cab
cmp byte [ebp - 5], 0
je 0x483bff
push esi
push esi
push 0x800
push dword [ebp - 0x24]
mov byte [ebp - 5], 0
call dword [sym.imp.USER32.dll_AppendMenuW]
mov esi, dword [ebx + 0x446]
mov eax, esi
shr eax, 3
and al, 1
je 0x483c1d
mov ecx, esi
shr ecx, 4
test cl, 1
jne 0x483c1d
mov ecx, dword [ebx + 0x10]
jmp 0x483c20
mov ecx, dword [ebx + 0xc]
test al, al
mov dword [ebp - 0xc], ecx
mov eax, str._s...
jne 0x483c31
mov eax, 0x5527c8
lea ecx, [ebx + 0x16]
push ecx
push eax
mov esi, 0x104
lea edi, [ebp - 0x234]
call fcn.0044b138
mov eax, dword [ebx + 0x455]
test eax, eax
pop ecx
pop ecx
jne 0x483c62
mov eax, edi
push eax
push dword [ebp - 0xc]
lea esi, [ebp - 0x28]
call fcn.00477517
jmp 0x483c76
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.0047757e
movzx eax, byte [ebx + 0x44e]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.0040262a
mov al, byte [ebx + 0x453]
neg al
sbb eax, eax
and eax, 8
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov edi, dword [ebp + 8]
mov dl, 1
xor esi, esi
mov eax, dword [edi + 0x111]
mov ecx, dword [edi + 0x25]
imul eax, eax, 0x227
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x671
add eax, ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax + 0x214]
jl 0x483ba6
test dl, dl
je 0x483d0d
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [0x62af2c]
add ecx, 2
cmp ecx, eax
ja 0x483d0d
mov esi, dword [edi + 0x19]
test esi, esi
je 0x483d0d
push dword [ebp - 0x24]
lea eax, [edi + 0x1b7]
push dword [ebp - 0x28]
call fcn.0042673c
call ebx
mov dword [0x62af2c], eax
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_DestroyMenu]
lea edi, [ebp - 0x18]
call fcn.0041d672
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x486662
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
lea esi, [ebp - 0x404]
mov eax, esi
xor ebx, ebx
push eax
push 0x1ff
mov byte [ebp - 1], bl
mov word [ebp - 0x404], bx
mov word [ebp - 0x402], bx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x404], bx
mov word [ebp - 8], bx
mov word [ebp - 6], bx
je 0x4866d0
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x4866b4
inc byte [ebp - 1]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4866b9
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x4866a5
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret

Function at 0x4866d7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
lea esi, [ebp - 0x400]
mov eax, esi
push eax
xor ebx, ebx
push 0x1ff
mov word [ebp - 0x400], bx
mov word [ebp - 0x3fe], bx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x400], bx
mov word [ebp - 4], bx
mov word [ebp - 2], bx
je 0x486752
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax]
test al, al
jne 0x486760
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x486736
cmp byte [ebp + 0x10], bl
je 0x486768
dec byte [ebp + 0x10]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x48673b
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x486717
mov dword [edi], 2
pop esi
mov eax, edi
pop ebx
leave
ret 0xc
mov dword [edi], 1
jmp 0x486758
push esi
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call fcn.00486777
jmp 0x486758

Function at 0x486add
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
lea esi, [ebp - 0x404]
mov eax, esi
xor ebx, ebx
push eax
push 0x1ff
mov word [edi], bx
mov word [ebp - 0x402], bx
mov word [ebp - 0x404], bx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x404], bx
mov word [ebp - 6], bx
mov word [ebp - 8], bx
mov byte [ebp - 1], bl
je 0x486b65
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x486b3a
mov al, byte [ebp - 1]
cmp al, byte [ebp + 8]
je 0x486b58
inc byte [ebp - 1]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x486b3f
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x486b23
jmp 0x486b65
push esi
call fcn.00520fb7
pop ecx
push edi
call fcn.00401016
pop esi
pop ebx
leave
ret 4
Function at 0x486b6b
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
movzx eax, word [eax]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
lea esi, [ebp - 0x408]
mov eax, esi
push eax
xor ebx, ebx
push 0x1ff
mov word [ebp - 0x406], bx
mov word [ebp - 0x408], bx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x408], bx
mov word [ebp - 0xa], bx
mov word [ebp - 0xc], bx
mov byte [ebp - 1], bl
je 0x486bfb
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x486bdf
movzx eax, word [esi]
push eax
call fcn.00521ef8
mov edi, eax
movzx eax, word [ebp - 8]
push eax
call fcn.00521ef8
cmp edi, eax
pop ecx
pop ecx
je 0x486c02
inc byte [ebp - 1]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x486be4
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x486bb5
or al, 0xff
pop edi
pop esi
pop ebx
leave
ret
mov al, byte [ebp - 1]
jmp 0x486bfd
Function at 0x4878a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
push 0x53ec98
push str.Default_Mail_Account
push str.softwaremicrosoftiam
push SysReAllocString
lea eax, [ebp - 0x228]
call fcn.004010db
test al, al
jne 0x4878d8
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
cmp word [ebp - 0x228], ax
je 0x4878cf
lea ecx, [ebp - 0x430]
push ecx
push eax
push eax
push 0x1c
push eax
mov word [ebp - 0x430], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
mov ebx, 0x104
push str._s_microsoft_windows_mail_local_folders__s
mov esi, ebx
lea edi, [ebp - 0x638]
call fcn.0044b138
add esp, 0xc
lea eax, [ebp - 0x638]
push eax
xor edi, edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x840]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x13], edi
mov dword [ebp - 0xf], edi
mov byte [ebp - 0x14], 1
mov dword [ebp - 0xb], edi
mov dword [ebp - 7], edi
call fcn.0042726c
push str.MessageAccount
lea eax, [ebp - 0x18]
call fcn.00455c6a
cmp eax, edi
mov dword [ebp - 0x1c], eax
jne 0x487970
lea esi, [ebp - 0x18]
call fcn.0040578b
jmp 0x4878cf
push 0x581ea8
call fcn.00455cac
cmp eax, edi
je 0x487963
push ebx
mov ecx, eax
call fcn.00455c4f
mov esi, dword [ebp + 8]
mov edx, eax
call fcn.0044b0f6
mov eax, dword [ebp - 0x1c]
push 0x581ec0
call fcn.00455cac
cmp eax, edi
jne 0x4879b2
xor bl, bl
lea esi, [ebp - 0x18]
call fcn.0040578b
mov al, bl
jmp 0x4878d1
push ebx
mov ecx, eax
call fcn.00455c4f
mov esi, dword [ebp + 0xc]
mov edx, eax
call fcn.0044b0f6
mov bl, 1
jmp 0x4879a3

Function at 0x487a46
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push eax
push 1
push 0
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x487aab
push ebx
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x208
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
pop ebx
jne 0x487aab
mov eax, dword [ebp - 4]
shr eax, 1
cmp eax, 0x104
jb 0x487aa2
mov eax, 0x103
and word [esi + eax*2], 0
mov al, 1
jmp 0x487ac4
mov eax, 0x53ec98
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x487ab4
xor al, al
leave
ret 8