joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451b90
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c969b
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
push 0x61417a
lea ecx, [ebp - 0x234]
call fcn.00406640
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x451c0b
jmp 0x451c9e
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x208
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.0058c510
add esp, 0xc
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x248], 0
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x451c5d
jmp 0x451c9e
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x260]
push eax
call fcn.004518b0
add esp, 8
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x234]
call fcn.0040f610
lea ecx, [ebp - 0x260]
call fcn.004066d0
xor edx, edx
jne 0x451bfd
cmp dword [ebp - 0x238], 0
je 0x451cbe
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x234]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406680
mov edx, dword [ebp - 0x23c]
or edx, 1
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.004066d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058815d
mov esp, ebp
pop ebp
ret
Function at 0x451d10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c96f6
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x20]
call fcn.00452ca0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x25c], eax
push 0x614179
lea ecx, [ebp - 0x28]
call fcn.00406640
mov byte [ebp - 4], 1
cmp dword [ebp - 0x25c], 0xffffffff
je 0x451ea3
mov dword [ebp - 0x254], 0x22c
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x451e96
mov edx, dword [ebp - 0x24c]
push edx
lea eax, [ebp - 0x288]
push eax
call fcn.00451b90
add esp, 8
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040f610
lea ecx, [ebp - 0x288]
call fcn.004066d0
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x2a0]
push eax
call fcn.00430200
add esp, 8
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x260], ecx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x2b8]
push eax
call fcn.00430200
add esp, 8
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x264], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x260]
push edx
mov eax, dword [ebp - 0x264]
push eax
call fcn.0040fec0
add esp, 8
mov byte [ebp - 0x255], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2b8]
call fcn.004066d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a0]
call fcn.004066d0
movzx ecx, byte [ebp - 0x255]
test ecx, ecx
je 0x451e7a
lea edx, [ebp - 0x24c]
push edx
mov ecx, dword [ebp + 0x20]
call fcn.0040b8e0
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x451d9e
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004066d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004066d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058815d
mov esp, ebp
pop ebp
ret
Function at 0x451ee0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c9740
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x20]
call fcn.00452ca0
mov dword [ebp - 0x2a0], 0xffffffff
mov byte [ebp - 0x285], 1
push 0x61417e
lea eax, [ebp + 8]
push eax
call fcn.0040a150
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x451f57
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004066d0
jmp 0x452099
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00430200
add esp, 8
mov byte [ebp - 4], 1
mov dword [ebp - 0x29c], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x284], 0x22c
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x28c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x290], eax
xor eax, eax
mov word [ebp - 0x4ac], ax
push 0x208
push 0
lea ecx, [ebp - 0x4aa]
push ecx
call fcn.0058c510
add esp, 0xc
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x298], 0
cmp dword [ebp - 0x290], 0
je 0x452071
lea edx, [ebp - 0x260]
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.00430150
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x58]
push edx
call fcn.00430200
add esp, 8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.0040fec0
add esp, 8
movzx edx, al
test edx, edx
je 0x45203a
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp + 0x20]
call fcn.0040b8e0
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x28c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.004066d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.004066d0
jmp 0x451fdc
mov eax, dword [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004066d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004066d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058815d
mov esp, ebp
pop ebp
ret

Function at 0x4521f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4523b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c9833
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x490], esp
lea eax, [ebp + 8]
push eax
call fcn.004065b0
mov dword [ebp - 0x48c], eax
call fcn.0043cf30
add esp, 0x18
mov byte [ebp - 0x475], al
movzx ecx, byte [ebp - 0x475]
test ecx, ecx
jne 0x452429
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004066d0
jmp 0x45251e
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp + 8]
call fcn.00406750
push eax
call fcn.004300b0
add esp, 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x480], esp
lea eax, [ebp + 8]
push eax
call fcn.004065b0
mov dword [ebp - 0x488], eax
lea ecx, [ebp - 0x438]
push ecx
call fcn.0043df40
add esp, 0x1c
mov dword [ebp - 0x47c], eax
mov byte [ebp - 4], 1
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x438]
call fcn.00406750
push eax
call fcn.004300b0
add esp, 8
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], 0
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x458], 5
mov dword [ebp - 0x454], 0
lea edx, [ebp - 0x474]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x484], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x438]
call fcn.004066d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004066d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058815d
mov esp, ebp
pop ebp
ret
Function at 0x452540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c987b
mov eax, dword fs:[0]
push eax
sub esp, 0xc80
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xc84], esp
lea eax, [ebp + 8]
push eax
call fcn.004065b0
mov dword [ebp - 0xc8c], eax
call fcn.0043cf30
add esp, 0x18
mov byte [ebp - 0xc75], al
movzx ecx, byte [ebp - 0xc75]
test ecx, ecx
jne 0x4525c5
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004066d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004066d0
jmp 0x4526da
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp + 8]
call fcn.00406750
push eax
call fcn.004300b0
add esp, 8
lea eax, [ebp - 0xc20]
push eax
lea ecx, [ebp + 0x20]
call fcn.00406750
push eax
call fcn.004300b0
add esp, 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xc88], esp
lea edx, [ebp + 8]
push edx
call fcn.004065b0
mov dword [ebp - 0xc80], eax
lea eax, [ebp - 0xc38]
push eax
call fcn.0043df40
add esp, 0x1c
mov dword [ebp - 0xc7c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0xc38]
call fcn.00406750
push eax
call fcn.004300b0
add esp, 8
mov dword [ebp - 0xc74], 0x3c
mov dword [ebp - 0xc70], 0
mov dword [ebp - 0xc6c], 0
mov dword [ebp - 0xc68], 0
lea edx, [ebp - 0x218]
mov dword [ebp - 0xc64], edx
lea eax, [ebp - 0xc20]
mov dword [ebp - 0xc60], eax
lea ecx, [ebp - 0x420]
mov dword [ebp - 0xc5c], ecx
mov dword [ebp - 0xc58], 5
mov dword [ebp - 0xc54], 0
lea edx, [ebp - 0xc74]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc38]
call fcn.004066d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004066d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004066d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058815d
mov esp, ebp
pop ebp
ret
Function at 0x4528e0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c98fb
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1cc], 0
push 0x61419e
lea ecx, [ebp - 0x1c8]
call fcn.00406640
mov dword [ebp - 4], 0
movzx eax, byte [ebp + 8]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00433550
push 0x615914
lea ecx, [ebp - 0x1c8]
call fcn.0040def0
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x1c8]
call fcn.00406750
push eax
call fcn.004300b0
add esp, 8
lea edx, [ebp - 0x1ac]
push edx
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1a4]
push ecx
lea edx, [ebp - 0x1a8]
push edx
lea ecx, [ebp - 0x1c8]
call fcn.00406750
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x1a8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1a4]
xor eax, eax
mov ecx, dword [ebp + 0xc]
push eax
push edx
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ecx]
push eax
call fcn.005905d0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x1ac]
xor eax, eax
mov ecx, dword [ebp + 0xc]
push eax
push edx
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ecx]
push eax
call fcn.005905d0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x1a8]
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1a4]
xor eax, eax
mov ecx, dword [ebp + 0x10]
push eax
push edx
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ecx]
push eax
call fcn.005905d0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x1b0]
xor eax, eax
mov ecx, dword [ebp + 0x10]
push eax
push edx
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ecx]
push eax
call fcn.005905d0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c8]
call fcn.004066d0
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058815d
mov esp, ebp
pop ebp
ret
Function at 0x452aa0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c9946
mov eax, dword fs:[0]
push eax
sub esp, 0x1e8
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1ec], 0
xorpd xmm0, xmm0
movlpd qword [ebp - 0x1b0], xmm0
xorpd xmm0, xmm0
movlpd qword [ebp - 0x1a8], xmm0
push 0x61419f
lea ecx, [ebp - 0x1e0]
call fcn.00406640
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov byte [ebp - 0x1e1], 0x41
jmp 0x452b2c
mov cl, byte [ebp - 0x1e1]
add cl, 1
mov byte [ebp - 0x1e1], cl
movsx edx, byte [ebp - 0x1e1]
cmp edx, 0x5a
jg 0x452c49
push 0x6141d9
lea ecx, [ebp - 0x1c8]
call fcn.00406640
mov byte [ebp - 4], 1
movzx eax, byte [ebp - 0x1e1]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00433550
push 0x615918
lea ecx, [ebp - 0x1c8]
call fcn.0040def0
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x1c8]
call fcn.00406750
push eax
call fcn.004300b0
add esp, 8
lea edx, [ebp - 0x1a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
je 0x452c35
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
je 0x452bc5
jmp 0x452c35
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [ebp - 0x1b0]
push edx
movzx eax, byte [ebp - 0x1e1]
push eax
call fcn.004528e0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1f0], ecx
mov edx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [edx + 4]
jl 0x452c35
jg 0x452c0f
mov ecx, dword [ebp - 0x1f0]
mov edx, dword [ebp - 0x1a8]
cmp edx, dword [ecx]
jbe 0x452c35
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1a8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x1a4]
mov dword [eax + 4], edx
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x1e0]
call fcn.004070f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c8]
call fcn.004066d0
jmp 0x452b1d
lea ecx, [ebp - 0x1e0]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406680
mov edx, dword [ebp - 0x1ec]
or edx, 1
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e0]
call fcn.004066d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058815d
mov esp, ebp
pop ebp
ret
Function at 0x4589a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x240], 0x615a3c
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x240]
mov ax, word [edx]
mov word [ebp - 0x22a], ax
mov ecx, dword [ebp - 0x238]
mov dx, word [ebp - 0x22a]
mov word [ecx], dx
mov eax, dword [ebp - 0x240]
add eax, 2
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x238]
add ecx, 2
mov dword [ebp - 0x238], ecx
cmp word [ebp - 0x22a], 0
jne 0x4589df
lea edx, [ebp - 0x228]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x458a6b
push 0x614225
mov ecx, dword [ebp + 8]
call fcn.00406640
mov eax, dword [ebp - 0x234]
or eax, 1
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 8]
jmp 0x458b3c
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x458aed
mov dword [ebp - 0x23c], 0x615a40
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x248], ecx
mov edx, dword [ebp - 0x23c]
mov ax, word [edx]
mov word [ebp - 0x22c], ax
mov ecx, dword [ebp - 0x230]
mov dx, word [ebp - 0x22c]
mov word [ecx], dx
mov eax, dword [ebp - 0x23c]
add eax, 2
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
cmp word [ebp - 0x22c], 0
jne 0x458aa5
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.00430150
add esp, 8
lea edx, [ebp - 0x224]
push edx
mov ecx, dword [ebp + 8]
call fcn.00406680
mov eax, dword [ebp - 0x234]
or eax, 1
mov dword [ebp - 0x234], eax
lea ecx, [ebp - 0x224]
call fcn.004066d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058815d
mov esp, ebp
pop ebp
ret
Function at 0x45a490
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8af8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x5c]
call fcn.004104d0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x64]
movzx ecx, byte [eax + 0x4e]
test ecx, ecx
je 0x45a4e5
mov dword [ebp - 0x68], 1
jmp 0x45a4ec
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x14], edx
push 4
lea eax, [ebp - 0x14]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov byte [ebp - 0x5c], 1
push 0x614247
lea ecx, [ebp - 0x58]
call fcn.00408b60
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041b4e0
mov ecx, dword [ebp - 0x60]
or ecx, 1
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00409a40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058815d
mov esp, ebp
pop ebp
ret 4
Function at 0x46f629
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x46f66e
call fcn.00479f08
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46f66e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x46f68a
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0047a0a1
mov ebx, eax
test edi, edi
je 0x46f688
test esi, esi
je 0x46f688
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x475969
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00479f08
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4759a0
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004759c1
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f07bc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00479342
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4f07f8
call fcn.004f09db
mov dword [esi + 0xc], 1
jmp 0x4f07fd
call fcn.004f09db
cmp dword [esi], 0
je 0x4f0846
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4f0820
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0046f6e1
jmp 0x4f0831
push 0xff
mov ecx, esi
call fcn.00413c40
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0046d5ce
jmp 0x4f086a
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4f086a
push dword [esi]
push dword [ebp - 4]
call fcn.0047ca65
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f0930
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004f09db
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4f0978
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0046f6e1
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0046d5ce
jmp 0x4f0983
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0047ca65
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x5531ac
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00583e9f
call fcn.00479f5c
cmp dword [eax + 0x14], 0
jne 0x5531c7
mov ecx, esi
pop esi
jmp fcn.005525b2
pop esi
ret

Function at 0x55f980
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.0056b72f
call fcn.00479f5c
cmp dword [eax + 0x14], 0
jne 0x55f99b
mov ecx, esi
pop esi
jmp fcn.0055f269
pop esi
ret