joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d019
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x1c
mov dx, word [0x54fa6c]
push ebx
mov bx, word [0x54fa74]
push ebp
cmp dx, bx
movzx eax, dx
push esi
mov si, word [0x54fa70]
push edi
mov di, word [0x54fa78]
movzx ecx, bx
cmovbe ecx, eax
cmp si, di
movzx ebp, cx
movzx ecx, di
movzx eax, si
cmovbe ecx, eax
cmp dx, bx
movzx eax, cx
mov dword [esp + 0x18], eax
movzx eax, dx
movzx ecx, bx
cmovae ecx, eax
cmp si, di
movzx edx, cx
movzx ecx, di
movzx eax, si
cmovae ecx, eax
mov eax, ebp
mov ebp, dword [esp + 0x18]
movzx edi, cx
mov ecx, edx
mov dword [esp + 0x20], ecx
sub edx, eax
mov dword [esp + 0x10], eax
movzx eax, bp
movzx ecx, di
sub ecx, eax
mov dword [esp + 0x24], edi
inc ecx
mov dword [esp + 0x1c], edx
lea eax, [edx + 3]
imul ecx, eax
inc ecx
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [esp + 0x28], esi
test esi, esi
jne 0x46d0d8
push str.Insufficient_Memory_to_Copy_to_Clipboard
call fcn.00413845
pop ecx
pop edi
pop esi
xor eax, eax
pop ebp
mov word [0x54fa68], ax
pop ebx
add esp, 0x1c
jmp fcn.0046d1d9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x46d0fd
push str.Unable_to_Lock_Clipboard_Memory
call fcn.00413845
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x46d0c4
movzx eax, bp
xor ebx, ebx
cmp bp, di
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x30]
ja 0x46d185
mov edx, dword [esp + 0x1c]
inc edx
mov dword [esp + 0x1c], edx
movzx esi, bx
movzx eax, ax
push edx
lea edi, [esi + ecx]
movzx ecx, word [ebp + 4]
imul ecx, eax
add ecx, dword [esp + 0x14]
add ecx, dword [ebp + 0x44]
push ecx
push edi
call fcn.00442cc0
sub esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
add esi, dword [esp + 0x2c]
push edi
mov byte [esi + eax + 1], 0
call fcn.0045bb79
push edi
call fcn.00447230
mov ecx, dword [esp + 0x28]
add ebx, eax
mov edx, dword [esp + 0x30]
add esp, 0x14
movzx eax, bx
inc ebx
mov byte [eax + ecx], 0xd
movzx eax, bx
inc ebx
mov byte [eax + ecx], 0xa
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp ax, word [esp + 0x24]
jbe 0x46d118
mov esi, dword [esp + 0x28]
movzx eax, bx
push esi
mov byte [eax + ecx], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46d1b7
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 7
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x46d1c2
push str.Error_Copying_to_Clipboard
call fcn.00413845
pop ecx
xor eax, eax
push ebp
mov word [0x54fa68], ax
call fcn.0046d1d9
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x46f579
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
test byte [esi + 0x2e], 1
je 0x46f59b
movzx eax, byte [esi + 0x24]
movzx ecx, byte [esi + 0x25]
add cx, ax
mov eax, dword [0x50d53c]
add cx, word [esi + 0x22]
add word [eax], cx
mov eax, dword [0x50d534]
cmp eax, 3
je 0x46f638
push 1
cmp eax, 7
je 0x46f5f3
mov eax, dword [0x50d248]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x50d53c]
push 0x24
movzx eax, word [eax]
push eax
mov eax, dword [0x50d538]
movzx eax, word [eax]
push eax
movsx eax, word [esi + 0x3e]
push eax
movsx eax, word [esi + 0x3c]
push eax
mov eax, dword [0x50d248]
push 0
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x46f676
mov eax, dword [0x50d53c]
movzx eax, word [eax]
push eax
mov eax, dword [0x50d538]
movzx eax, word [eax]
push eax
movsx eax, word [esi + 0x3e]
push eax
movsx eax, word [esi + 0x3c]
push eax
mov eax, dword [0x50d248]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [0x50d248]
push 7
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [0x50d534], 0
jmp 0x46f676
mov eax, dword [0x50d53c]
push 0
movzx eax, word [eax]
push eax
mov eax, dword [0x50d538]
movzx eax, word [eax]
push eax
movsx eax, word [esi + 0x3e]
push eax
movsx eax, word [esi + 0x3c]
push eax
mov eax, dword [0x50d248]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [0x50d248]
push 3
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
or word [esi + 8], 0x40
pop esi
ret

Function at 0x46f7c5
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4bbb05
call fcn.00441d06
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.004082c1
push dword [ebp + 0x10]
xor eax, eax
xor ebx, ebx
mov word [esi + 0x18], ax
movzx eax, word [ebp + 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
push 0xffffffffffffffff
lea ecx, [esi + 0x1e]
mov dword [esi + 0x1a], eax
call fcn.00482318
cmp dword [esi + 0x1a], 0xffffffff
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 1
mov dword [esi + 0x26], eax
je 0x46f833
lea eax, [esi + 0x22]
push eax
push ebx
push esi
push 0x46f8c7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [esi + 0x1e]
call fcn.0046f925
mov eax, esi
call fcn.00441ce0
ret 0x10
Function at 0x46fe0e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push 0x90
xor esi, esi
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00443240
add esp, 0xc
mov dword [ebp - 0x20], 0x94
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
je 0x46fe53
xor eax, eax
jmp 0x46fe67
cmp dword [ebp - 0x1c], 6
ja 0x46fe61
jne 0x46fe64
cmp dword [ebp - 0x18], 1
jb 0x46fe64
xor esi, esi
inc esi
mov ax, si
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.00441a5e
lea esp, [ebp + 0x78]
pop ebp
ret

Function at 0x471a33
Capabilities:
Get session user name

Disassembly:
sub esp, 0x8c
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x88], eax
push esi
push str.ZFAPI32.DLL
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x471a6e
push str.ZFAPI32.DLL_not_found
push esi
call fcn.0046be1a
pop ecx
pop ecx
jmp 0x471b4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZfxGetAPIVersion
push eax
call edi
lea ecx, [esp + 8]
push ecx
push 0x15
lea ecx, [esp + 0x18]
push ecx
call eax
test ax, ax
je 0x471a9a
push str.Cannot_determine_Zetafax_version
jmp 0x471b43
mov eax, 0x600
cmp word [esp + 8], ax
jae 0x471ab0
push str.Invalid_Zetafax_version
jmp 0x471b43
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x65
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x471b3e
cmp dword [esp + 0xc], 0
je 0x471b3e
push ebx
lea eax, [esp + 0x2c]
mov byte [esp + 0x34], 0
push ebp
push eax
call fcn.004098b2
mov dword [esp], str.ZfxAPIInit
push dword [esi + 0x1c]
call edi
xor ebp, ebp
lea ebx, [esi + 0x18]
push ebp
mov edi, eax
lea eax, [esp + 0x34]
push ebp
push eax
push ebx
call edi
movzx eax, ax
mov ecx, 0xf704
cmp ax, cx
jne 0x471b1b
push ebp
push ebp
push str.NOTEBOOK
push ebx
call edi
movzx eax, ax
pop ebp
pop ebx
test ax, ax
je 0x471b39
add eax, 0xee6
push eax
call fcn.00471f3f
push eax
push esi
call fcn.0046be1a
add esp, 0xc
jmp 0x471b4b
xor eax, eax
inc eax
jmp 0x471b4b
push str.Cannot_determine_Zetafax_user_Name
push esi
call fcn.0046be1a
pop ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x8c]
pop esi
xor ecx, esp
call fcn.00441a5e
add esp, 0x8c
ret
Function at 0x471df2
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
push str.ZFAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x550340], eax
test eax, eax
jne 0x471e23
mov eax, 0x5dc
jmp 0x471efb
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZfxGetAPIVersion
push eax
call esi
lea ecx, [ebp - 0x88]
push ecx
push 0x15
lea ecx, [ebp - 0x1c]
push ecx
call eax
test ax, ax
je 0x471e50
mov eax, 0x5dd
jmp 0x471efa
mov eax, 0x600
cmp word [ebp - 0x88], ax
jae 0x471e66
add eax, 0xffffffde
jmp 0x471efa
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0x65
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x471ef5
cmp dword [ebp - 0x8c], 0
je 0x471ef5
push ebx
lea eax, [ebp - 0x84]
xor ebx, ebx
push edi
push eax
mov byte [ebp - 0x7c], bl
call fcn.004098b2
mov dword [esp], str.ZfxAPIInit
push dword [0x550340]
call esi
push ebx
mov esi, eax
mov edi, 0x55033c
push ebx
lea eax, [ebp - 0x84]
push eax
push edi
call esi
movzx edx, ax
mov eax, 0xf704
cmp dx, ax
jne 0x471ee0
push ebx
push ebx
push str.NOTEBOOK
push edi
call esi
movzx edx, ax
movzx ecx, dx
xor eax, eax
sub ecx, 0xf11a
test dx, dx
pop edi
cmovne eax, ecx
pop ebx
jmp 0x471efa
mov eax, 0x5df
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441a5e
mov esp, ebp
pop ebp
ret

Function at 0x4722bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push 2
push dword [esp + 0x10]
xor ebx, ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x472398
push ebp
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
je 0x472397
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push 4
pop ecx
movzx eax, word [edi + 0xe]
cmp ax, cx
je 0x47230b
cmp eax, 8
jne 0x47238d
mov ebx, dword [edi + 0x20]
test ebx, ebx
jne 0x472317
inc ebx
mov cl, al
shl ebx, cl
xor edx, edx
push esi
test ebx, ebx
jle 0x472363
mov esi, dword [esp + 0x1c]
cmp dword [edi + edx*4 + 0x28], esi
jne 0x47232d
cmp esi, 0xffffffff
jne 0x47235e
mov ah, byte [edi + edx*4 + 0x28]
mov cl, byte [edi + edx*4 + 0x29]
mov al, byte [edi + edx*4 + 0x2a]
cmp ah, cl
jne 0x472341
cmp cl, al
je 0x47235e
shr cl, 1
shr al, 1
add al, cl
shr ah, 1
add al, ah
movzx eax, al
mov ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, eax
mov dword [edi + edx*4 + 0x28], ecx
inc edx
cmp edx, ebx
jl 0x472322
push 0
call dword [sym.imp.USER32.dll_GetDC]
push 0
add ebx, 0xa
mov esi, eax
push edi
lea eax, [edi + ebx*4]
push eax
push 4
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push esi
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop esi
push ebp
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, ebx
pop edi
pop ebp
pop ebx
ret 0xc
Function at 0x477bba
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x11c
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x128]
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push edi
xor ebp, ebp
mov dword [esp + 0x14], ebx
push 0x2c
push ebp
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebp
call fcn.00443240
add esp, 0xc
push ebp
push ebp
push 3
push ebp
push ebp
push connect
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x477c1c
mov eax, 0x58c
jmp 0x477dad
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.00441cd2
mov esi, eax
pop ecx
test esi, esi
je 0x477d41
push ebp
lea eax, [esp + 0x14]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x477d99
cmp dword [esp + 0x10], ebx
jne 0x477d99
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
lea eax, [esp + 0x20]
push ecx
push ecx
push eax
push ecx
push ecx
push ecx
push dword [esp + 0x30]
mov ebp, esi
call fcn.0040d952
lea eax, [esp + 0x3c]
push 0x4c8f60
push eax
call fcn.00447146
add esp, 0x24
test eax, eax
je 0x477ca2
lea eax, [esp + 0x20]
push str.JPEG
push eax
call fcn.00447146
pop ecx
pop ecx
test eax, eax
jne 0x477d0a
push 0x4c8f6c
call fcn.00447230
movzx eax, ax
push eax
push 0x4c8f6c
push esi
call fcn.0045b836
add esp, 0x10
test ax, ax
je 0x477d0a
push 0x4c8f6c
call fcn.00447230
movzx eax, ax
sub ebp, eax
mov dword [esp], 0x4c8f6c
dec ebp
add ebp, ebx
jmp 0x477ce8
cmp ebp, esi
je 0x477d04
dec ebp
push 0x4c8f6c
call fcn.00447230
movzx eax, ax
push eax
push 0x4c8f6c
push ebp
call fcn.0045b836
add esp, 0x10
test ax, ax
jne 0x477cde
mov eax, esi
sub eax, ebp
add ebx, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x477d24
push esi
call fcn.00441cdb
pop ecx
jmp 0x477d41
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x477d4f
push esi
call fcn.00441cdb
mov esi, dword [esp + 0x18]
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x58d
jmp 0x477dac
push ebx
push ebp
push eax
call fcn.00442cc0
push esi
call fcn.00441cdb
mov esi, dword [esp + 0x24]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esp + 0x134]
push ebx
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.00477dc5
mov eax, dword [esp + 0x28]
push eax
mov dword [esi + 0x28], eax
call fcn.0043eaa9
movzx eax, al
add esp, 0x14
mov word [esi + 0x24], ax
xor eax, eax
jmp 0x477dac
push esi
call fcn.00441cdb
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x58e
pop esi
mov ecx, dword [esp + 0x124]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a5e
add esp, 0x11c
ret
Function at 0x477ff0
Capabilities:
Read .ini file

Disassembly:
push 0x33c
mov eax, 0x4bbeed
call fcn.00441d3a
mov esi, ecx
mov dword [ebp - 0x344], esi
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x56c]
mov dword [ebp - 0x348], esi
mov dword [ebp - 0x33c], edi
call fcn.00408368
and dword [ebp - 4], 0
lea ecx, [esi + 0x584]
call fcn.00408368
lea ecx, [esi + 0x59c]
mov byte [ebp - 4], 1
call fcn.00408368
lea ecx, [esi + 0x5b4]
mov byte [ebp - 4], 2
call fcn.00408368
lea eax, [esi + 0x5d0]
mov byte [ebp - 4], 3
mov ecx, eax
mov dword [ebp - 0x344], eax
call fcn.00466577
mov ax, word [ebp + 0xc]
lea ebx, [esi + 0x5cc]
push edi
push esi
mov byte [ebp - 4], 4
mov word [esi + 0x51], ax
mov dword [ebx], 1
call fcn.00446f90
pop ecx
pop ecx
mov edi, 0x101
lea eax, [ebp - 0x12c]
push edi
push eax
push 0x4e6150
push str.device
push str.windows
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
lea eax, [ebp - 0x12c]
push 0x2c
push eax
call fcn.00447230
pop ecx
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0045bc0c
movzx eax, ax
add esp, 0xc
cmp eax, edi
jae 0x478222
lea edi, [esi + 0x53]
mov byte [ebp + eax - 0x12c], 0
push edi
call fcn.004adb42
cmp dword [ebp - 0x33c], 0
pop ecx
je 0x478218
cmp word [ebp + 0xc], 0
je 0x478126
push edi
push 0x15
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push 0x4c060e
call fcn.00478359
push eax
push str.printers
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
lea eax, [ebp - 0x28]
push 5
push eax
call fcn.004097f9
add esp, 0xc
xor ebx, ebx
cmp dword [esi + 0x5cc], ebx
jbe 0x478218
push edi
push 0x15
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push str.Portrait
push ebx
call fcn.0047837b
push eax
push str.printers
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x28]
push str.Portrait
push eax
call fcn.004478d0
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
push edi
setne cl
inc ecx
movzx eax, cx
mov ecx, esi
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x230]
push 0x101
push eax
lea eax, [ebp - 0x12c]
push eax
push ebx
call fcn.004783b3
push eax
push str.printers
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor eax, eax
mov dword [ebp - 0x340], eax
cmp word [ebp + 0xc], ax
je 0x4781e6
push edi
push 0x15
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push 0x4c060e
push ebx
call fcn.00478414
push eax
push str.printers
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x28]
push 5
push eax
call fcn.00409892
mov eax, dword [ebp - 0x340]
add esp, 0xc
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x338]
call fcn.0047a27a
push eax
lea ecx, [esi + 0x5d0]
call fcn.00478441
inc ebx
cmp ebx, dword [esi + 0x5cc]
jb 0x478134
mov eax, esi
call fcn.00441cf5
ret 8
call fcn.00441f00
int3
Function at 0x48f5e4
Capabilities:
Create process on windows

Disassembly:
call fcn.0048f8b0
cmp dword [eax + 0x14], 0x10
jb 0x48f5f1
mov eax, dword [eax]
push 5
xor ecx, ecx
push ecx
push ecx
push eax
push str.edit
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x48f60c
xor eax, eax
ret
xor eax, eax
inc eax
ret
Function at 0x494f85
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
push ebp
call fcn.0049a793
xor ebx, ebx
inc ebx
pop ecx
test eax, eax
je 0x4950fe
push ebp
call fcn.0049a793
pop ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
xor ecx, ecx
push 2
pop edx
lea edi, [esi + 1]
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00441cd2
lea ecx, [esi + 2]
mov ebx, eax
push ecx
push 0
push ebx
mov dword [esp + 0x20], ebx
call fcn.00443240
add esp, 0x10
push edi
push ebx
push ebp
call fcn.0049a793
pop ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp + 0x231]
lea ecx, [esp + 0x2c]
push ebx
mov esi, dword [eax + 0xa7]
call fcn.0040a97c
push esi
mov ecx, eax
call fcn.00487c06
mov ebx, eax
lea ecx, [esp + 0x2c]
neg ebx
sbb bl, bl
xor edi, edi
push edi
push 1
call fcn.004087c3
mov esi, dword [esp + 0x10]
add bl, 1
jne 0x4950f4
push esi
lea ecx, [esp + 0x18]
call fcn.00408313
lea eax, [esp + 0x14]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push edi
push eax
movzx eax, word [ebp + 0x18e]
push eax
push 0xff0f
push ebp
call fcn.004923fd
add esp, 0x14
test ax, ax
jne 0x49509a
push esi
call fcn.00441cdb
pop ecx
push 0xffffffffffffffff
push edi
push 0xb1
push ebp
call fcn.0049a793
pop ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 1
lea ecx, [esp + 0x1c]
call fcn.0040758b
xor eax, eax
jmp 0x495101
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
call fcn.0040a8c8
mov ecx, dword [ebp + 0x231]
lea eax, [esp + 0x2c]
push eax
mov ecx, dword [ecx + 0xa7]
call fcn.0040a9d9
xor ebx, ebx
lea ecx, [esp + 0x2c]
push edi
inc ebx
push ebx
call fcn.004087c3
cmp word [esp + 0x50], di
mov eax, 0x88
push edi
lea ecx, [eax + 0x40]
cmove eax, ecx
push eax
push ebp
call fcn.0047d1cd
add esp, 0xc
lea ecx, [esp + 0x14]
push edi
push ebx
call fcn.0040758b
jmp 0x4950f7
xor ebx, ebx
inc ebx
push esi
call fcn.00441cdb
pop ecx
mov ax, bx
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a5e
add esp, 0x38
ret
Function at 0x4985ca
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x68
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, dword [esp + 0x7c]
push 2
call esi
push 2
mov dword [esp + 0x1c], eax
call esi
xor ebx, ebx
mov dword [esp + 0x14], eax
push edi
mov word [esp + 0x14], bx
mov dword [esp + 0x60], str.Start_of_List__CtrlHome_
mov dword [esp + 0x64], str.Previous_Page__PgUp_
mov dword [esp + 0x68], str.Previous_Item__Up_Arrow_
mov dword [esp + 0x6c], str.Next_Item__Down_Arrow_
mov dword [esp + 0x70], str.Next_Page__PgDn_
mov dword [esp + 0x74], str.End_of_List__CtrlEnd_
call fcn.0049854e
push 0x30
pop ebp
push ebp
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.00443240
mov eax, dword [0x50d254]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 0x11
push edi
mov eax, dword [eax]
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], edi
call fcn.00498444
add esp, 0x14
mov dword [edi + 0x1f0], eax
lea eax, [esp + 0x4c]
push eax
push edi
call fcn.00492343
pop ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
call esi
mov ecx, dword [esp + 0x58]
sub ecx, eax
mov dword [esp + 0x58], ecx
movzx ebp, bx
lea esi, [edi + 0x1c0]
lea eax, [ebx + 0x30d5]
push eax
lea esi, [esi + ebp*4]
cmp bx, 3
jae 0x4986be
mov edx, dword [esp + 0x18]
mov eax, ebp
mov ecx, dword [esp + 0x1c]
imul eax, edx
push edx
push ecx
push eax
mov eax, dword [esp + 0x64]
sub eax, ecx
jmp 0x4986da
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
push 6
pop eax
sub eax, ebp
imul eax, dword [esp + 0x20]
sub ecx, eax
mov eax, dword [esp + 0x60]
push ecx
sub eax, edx
push eax
push esi
push edi
call fcn.00498cf2
add esp, 0x1c
test ax, ax
je 0x498783
lea eax, [ebx + 0x41]
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push eax
push 0
push 0xc
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xfffffffffffffffc
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x494add
push 0xfffffffffffffffc
push dword [esi]
mov dword [edi + ebp*4 + 0x1d8], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push dword [edi + 0x1f0]
push 0x30
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + ebp*4 + 0x5c]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x404
push dword [edi + 0x1bc]
call dword [sym.imp.USER32.dll_SendMessageA]
push 6
inc ebx
pop eax
cmp bx, ax
jae 0x49877e
mov ecx, dword [esp + 0x58]
jmp 0x49868d
xor eax, eax
inc eax
jmp 0x498785
xor eax, eax
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a5e
add esp, 0x68
ret
Function at 0x498dce
Capabilities:
Hide graphical window

Disassembly:
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [esp + 8]
test byte [esi + 0x113], 2
jne 0x498e1b
push esi
call fcn.00498b27
pop ecx
test ax, ax
jne 0x498df2
xor eax, eax
pop esi
ret
test byte [esi + 0x113], 2
jne 0x498e1b
mov eax, dword [esi + 0x121]
test eax, eax
je 0x498e1b
push eax
call fcn.0042240f
push 0
push dword [esi + 0x121]
call fcn.0042710e
add esp, 0xc
push esi
call fcn.00498948
pop ecx
push 5
push esi
call fcn.00492343
pop ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call fcn.004955e8
test dword [esi + 0x113], 0x100
pop ecx
pop ecx
je 0x498e5f
push esi
call fcn.0049d311
pop ecx
test ax, ax
jne 0x498e5f
push str.Failed_to_register_drop_target
call fcn.00413845
pop ecx
test byte [esi + 0x113], 0x10
je 0x498e79
push esi
push 0xffffffffffffffeb
push esi
call fcn.00492343
pop ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor eax, eax
inc eax
pop esi
ret
Function at 0x4a7877
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4a788e
test al, 0x10
je 0x4a788e
xor eax, eax
inc eax
ret
xor eax, eax
ret