joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a080
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov ecx, dword [esi + 0x18]
lea eax, [esi + 0x124]
push 0x104
push eax
push 0x17c
push ecx
call edi
mov eax, dword [esi + 0x18]
lea edx, [esi + 0x20]
push 0x104
push edx
push 0x17d
push eax
call edi
mov ecx, dword [esi + 0x18]
mov edi, dword [sym.imp.USER32.dll_GetDlgItemInt]
push 0
push 0
push 0x1bd
push ecx
call edi
mov edx, dword [esi + 0x18]
push 0
push 0
push 0x1c1
push edx
mov dword [esi + 4], eax
call edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
mov dword [esi + 8], eax
mov eax, dword [esi + 0x18]
push 0
push 0xf0
push 0x1ba
push eax
call edi
mov ecx, dword [esi + 0x18]
dec eax
neg eax
push 0
push 0
sbb eax, eax
push 0x147
inc eax
push 0x1c2
push ecx
mov dword [esi], eax
call edi
mov edx, dword [esi + 0x18]
push 0x1cd
push edx
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push str.HistCamCaptureTemplate
push str.SoftwareACD_SystemsACDSee
push 0x800
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x18]
push 0x14
push 1
push 0x17c
push eax
call edi
push eax
call fcn.00472f40
mov ecx, dword [esi + 0x18]
add esp, 0x18
push str.HistCamCaptureFolder
push str.SoftwareACD_SystemsACDSee
push 0x800
push 0x14
push 1
push 0x17d
push ecx
call edi
push eax
call fcn.00472f40
add esp, 0x18
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0x20006
push 0
push 0x4f55a8
push 0
push str.SoftwareACD_SystemsACDSee
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41a1d0
mov ecx, dword [esp + 8]
push 0x14
push esi
push 3
push eax
push str.TakePixOptions
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 8
ret
Function at 0x41a1e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x78
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 1
mov eax, dword [esi + 0x18]
push eax
call edi
mov ecx, dword [esi + 0x18]
push 2
push ecx
call edi
mov edx, dword [esi + 0x230]
mov ecx, esi
push edx
call fcn.0041a3f0
mov eax, dword [esi + 0x230]
test eax, eax
je 0x41a279
mov ecx, dword [esi + 0x14]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0xc]
push 0x28
push eax
push 0xe7
push ecx
call edi
mov eax, dword [esi + 0x18]
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea edx, [esp + 0xc]
push edx
push 1
push eax
call ebx
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x34]
push 0x50
push ecx
push 0xe1
push edx
mov dword [esi + 0x230], 0
call edi
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x34]
push eax
push 0x1c0
push ecx
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x78
ret
mov ecx, esi
call fcn.0041a080
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41a2e1
mov cl, byte [esi + 0x20]
lea eax, [esi + 0x20]
test cl, cl
je 0x41a29d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41a2e1
push 1
mov ecx, esi
call fcn.0041a3f0
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
push 0
push 0xe8
push 0x24e
push edx
push eax
call fcn.00471530
mov ecx, dword [esi + 0x18]
add esp, 0x14
push 0x17d
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x78
ret
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push ebp
lea edx, [esp + 0x38]
push 0x50
push edx
push 0xd5
push eax
call edi
mov edx, dword [esi + 0x18]
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [esp + 0x38]
push ecx
push 0x1c0
push edx
call ebx
mov ecx, dword [esi + 0x22c]
mov edx, dword [esi + 0x18]
push edx
mov eax, dword [ecx]
call dword [eax + 0x50]
mov ecx, dword [esi + 0x14]
mov ebp, eax
lea eax, [esp + 0x38]
push 0x50
push eax
push 0xe1
push ecx
call edi
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x38]
push edx
push 0x1c0
push eax
call ebx
test ebp, ebp
pop ebp
jne 0x41a37b
push 1
mov ecx, esi
call fcn.0041a3f0
mov ecx, dword [esi + 0x22c]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
push 0
add ecx, 0x30
push 0x24c
push ecx
push edx
push eax
call fcn.004714c0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x78
ret
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0xc]
push 0x28
push ecx
push 0x96
push edx
call edi
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0xc]
push eax
push 1
push ecx
call ebx
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x34]
push 0x50
push edx
push 0xe6
push eax
call edi
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x34]
push ecx
push 0x1c0
push edx
call ebx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
push 0
push 0
inc eax
push 2
push ecx
mov dword [esi + 0x1c], eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x230], 1
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x78
ret
Function at 0x41b760
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4d1d38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], vtable.CFolder.0
mov eax, dword [esi + 0x134]
mov dword [esp + 0x14], 0
test eax, eax
je 0x41b8b4
mov eax, dword [esi + 0x140]
test eax, eax
mov eax, dword [esi + 0x138]
jne 0x41b7ca
test eax, eax
je 0x41b857
mov edx, dword [0x4f5e08]
lea ecx, [esi + 0x30]
push 0x100
push ecx
push 0
push eax
push edx
jmp 0x41b84d
test eax, eax
je 0x41b857
mov eax, dword [esi + 0x144]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41b807
mov eax, dword [esi + 0x138]
test eax, eax
je 0x41b857
mov edx, dword [0x4f5e08]
lea ecx, [esi + 0x30]
push 0x100
push ecx
push 0xffffffffffffffff
push eax
push edx
jmp 0x41b84d
mov eax, dword [esi + 0x140]
mov ecx, dword [esi + 0x138]
push eax
call fcn.00490700
mov ecx, dword [esi + 0x144]
mov edi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
jne 0x41b832
mov dword [esi + 0x140], edi
mov eax, dword [esi + 0x138]
test eax, eax
je 0x41b857
lea edx, [esi + 0x30]
push 0x100
push edx
push edi
push eax
mov eax, dword [0x4f5e08]
push eax
mov ecx, 0x4f55f8
call fcn.0049b6c0
mov eax, dword [esi + 0x144]
test eax, eax
je 0x41b868
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x148]
test eax, eax
je 0x41b8b4
mov ecx, dword [eax + 8]
xor edi, edi
test ecx, ecx
jle 0x41b8a4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp edi, ecx
jge 0x41b892
test edi, edi
jl 0x41b892
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi*4]
jmp 0x41b894
xor eax, eax
push eax
call ebx
mov eax, dword [esi + 0x148]
inc edi
cmp edi, dword [eax + 8]
jl 0x41b886
pop ebx
mov ecx, dword [esi + 0x148]
test ecx, ecx
je 0x41b8b4
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0045f750
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4203e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x108
mov edx, dword [esp + 0x10c]
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0x20006
push 0
push 0x4f55a8
push 0
push edx
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x420420
xor eax, eax
add esp, 0x108
ret
push ebx
push esi
mov esi, dword [esp + 0x118]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
lea eax, [esp + 0x18]
push str._s_ClrTable
push eax
call edi
mov edx, dword [esp + 0x18]
add esp, 0xc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x14]
push 0x50
push 0x4ee09c
push 3
push 0
push ecx
push edx
call ebx
push esi
lea eax, [esp + 0x18]
push str._s_ClrTableMRU
push eax
call edi
mov edx, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x14]
push 0x14
push 0x4ee0ec
push 3
push 0
push ecx
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x108
ret

Function at 0x4204b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4204df
xor eax, eax
add esp, 0x10c
ret
push ebx
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
lea edx, [esp + 0x1c]
push str._s_ClrTable
push edx
call edi
add esp, 0xc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push 0x4ee09c
push ecx
lea edx, [esp + 0x24]
push 0
push edx
push eax
mov dword [esp + 0x28], 0x50
call ebx
push esi
lea ecx, [esp + 0x1c]
push str._s_ClrTableMRU
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push 0x4ee0ec
push eax
push 0
push ecx
push edx
mov dword [esp + 0x28], 0x14
call ebx
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x10c
ret
Function at 0x4212a0
Capabilities:
Get common file path
Get graphical window text
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x4d2182
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x480
push ebx
push ebp
push esi
mov esi, dword [esp + 0x49c]
push edi
push 0x6b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, eax
mov al, byte [0x4f55a8]
mov byte [esp + 0x90], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x91]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x90]
push 0x104
push ecx
push ebp
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 0x90]
test al, al
jne 0x421338
lea edx, [esp + 0x90]
push edx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
lea eax, [esp + 0x90]
push str..EXE
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [0x4f1eec]
mov dword [esp + 0x14], ecx
push 0x10d
lea ecx, [esp + 0x18]
mov dword [esp + 0x49c], 0
call fcn.004c2949
mov edx, dword [0x4f1eec]
mov dword [esp + 0x10], edx
push 0x10e
lea ecx, [esp + 0x14]
mov byte [esp + 0x49c], 1
call fcn.004c2949
lea ecx, [esp + 0x18]
call fcn.004bd5dd
push esi
mov byte [esp + 0x49c], 2
call fcn.004bd9fe
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x98]
push 0x1004
push edx
push 0x4ee1f4
push 1
lea ecx, [esp + 0x1ac]
call fcn.004bb585
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x194]
mov byte [esp + 0x498], 3
mov dword [esp + 0x220], eax
call fcn.004bb6e7
mov ebx, eax
cmp ebx, 1
jne 0x4214d0
mov ecx, dword [esp + 0x20c]
push ecx
push 0x453
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x171
push 0x451
push esi
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x20c]
push ebx
push 0
push edx
call fcn.004736f0
add esp, 0xc
push 0
push eax
push 0x170
push 0x451
push esi
call edi
mov eax, dword [esp + 0x214]
lea ecx, [esp + 0x38c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x38c]
push 0x2e
push edx
call fcn.004a8830
add esp, 8
test eax, eax
je 0x42146a
mov byte [eax], 0
mov eax, dword [esp + 0x20c]
lea ecx, [esp + 0x54]
push eax
call fcn.004a4810
lea ecx, [esp + 0x38c]
push 0x104
push ecx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x4a0], 4
call fcn.004a49f0
lea edx, [esp + 0x38c]
push edx
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextA]
push ebp
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x54]
mov byte [esp + 0x498], 3
call fcn.004a4830
lea ecx, [esp + 0x240]
mov byte [esp + 0x498], 5
call fcn.004c251d
lea ecx, [esp + 0x194]
mov byte [esp + 0x498], 2
call fcn.004c1b83
lea ecx, [esp + 0x18]
mov byte [esp + 0x498], 1
call fcn.004be0b7
lea ecx, [esp + 0x10]
mov byte [esp + 0x498], 0
call fcn.004c251d
lea ecx, [esp + 0x14]
mov dword [esp + 0x498], 0xffffffff
call fcn.004c251d
mov ecx, dword [esp + 0x490]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x48c
ret
Function at 0x422af0
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4d21f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov al, byte [esi + 0x1c]
mov dword [esp + 0x14], 0
test al, 0x10
je 0x422b5c
mov eax, dword [esi + 8]
xor edi, edi
test eax, eax
jle 0x422b4b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp edi, eax
jge 0x422b3d
test edi, edi
jl 0x422b3d
mov eax, dword [esi + 4]
mov eax, dword [eax + edi*4]
jmp 0x422b3f
xor eax, eax
push eax
call ebx
mov eax, dword [esi + 8]
inc edi
cmp edi, eax
jl 0x422b31
pop ebx
mov cl, byte [esi + 0x20]
lea eax, [esi + 0x20]
test cl, cl
je 0x422b5c
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esi + 0x134]
mov edi, dword [sym.imp.ole32.dll_ReleaseStgMedium]
lea eax, [esi + 0x134]
test ecx, ecx
je 0x422b75
push eax
call edi
mov ecx, dword [esi + 0x128]
lea eax, [esi + 0x128]
test ecx, ecx
je 0x422b88
push eax
call edi
mov ecx, dword [esi + 0x140]
lea eax, [esi + 0x140]
test ecx, ecx
je 0x422b9b
push eax
call edi
mov ecx, dword [esi + 0x14c]
lea eax, [esi + 0x14c]
test ecx, ecx
je 0x422bae
push eax
call edi
mov eax, dword [esi + 0x124]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], 0xffffffff
test eax, eax
mov dword [esi], vtable.Table_char_.0
je 0x422bfb
mov eax, dword [esi + 8]
xor edi, edi
test eax, eax
jle 0x422bfb
cmp edi, eax
jge 0x422be8
test edi, edi
jl 0x422be8
mov edx, dword [esi + 4]
mov eax, dword [edx + edi*4]
jmp 0x422bea
xor eax, eax
push eax
call fcn.004bd4c4
mov eax, dword [esi + 8]
add esp, 4
inc edi
cmp edi, eax
jl 0x422bdc
mov eax, dword [esi + 4]
push eax
call fcn.004bd4c4
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4238b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 0x10
lea eax, [esp + 0x18]
push 0x423ac0
push eax
mov dword [esp + 0x20], ebp
call sub.USER32.dll_DdeInitializeA
cmp eax, ebp
mov dword [esp + 0x14], eax
jne 0x423aad
mov ecx, dword [esp + 0x10]
push 0x3ec
push 0x4ed560
push ecx
call sub.USER32.dll_DdeCreateStringHandleA
mov edx, dword [esp + 0x10]
push 0x3ec
mov esi, eax
push str.System
push edx
mov dword [esp + 0x28], esi
call sub.USER32.dll_DdeCreateStringHandleA
mov edi, eax
mov eax, dword [esp + 0x10]
push ebp
push edi
push esi
push eax
mov dword [esp + 0x28], edi
call sub.USER32.dll_DdeConnect
mov ebx, eax
cmp ebx, ebp
jne 0x423994
mov ecx, dword [esp + 0x10]
push ecx
call sub.USER32.dll_DdeGetLastError
cmp eax, 0x400a
jne 0x423a89
mov edx, dword [esp + 0x74]
push 0xa
push 0x4f55a8
push str._dde
push edx
push ebp
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x423aad
test ebx, ebx
jne 0x423994
mov eax, dword [esp + 0x10]
push ebx
push edi
push esi
push eax
call sub.USER32.dll_DdeConnect
mov ebx, eax
test ebx, ebx
jne 0x42397e
mov ecx, dword [esp + 0x10]
push ecx
call sub.USER32.dll_DdeGetLastError
mov dword [esp + 0x14], eax
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0x14
jl 0x423959
test ebx, ebx
je 0x423a89
mov al, byte [0x4edc84]
mov edx, dword [str.open]
mov byte [esp + 0x24], al
mov ecx, 0x12
xor eax, eax
lea edi, [esp + 0x25]
mov dword [esp + 0x20], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x7c]
cmp eax, 0xffffffff
je 0x4239da
test eax, eax
mov eax, str._add
jne 0x4239ce
mov eax, str._noadd
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x80]
cmp eax, 0xffffffff
je 0x423a00
test eax, eax
mov eax, str._viewall
jne 0x4239f4
mov eax, str._noviewall
lea edx, [esp + 0x20]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebp, dword [esp + 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
call edi
mov esi, eax
lea eax, [esp + 0x20]
push eax
call edi
lea ecx, [esi + eax + 5]
push ecx
call fcn.004bd49b
add esp, 4
lea edx, [esp + 0x20]
mov esi, eax
push edx
push 0x4ee354
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call ebp
push 0x4ee350
push esi
call ebp
push 0
push 0xffffffffffffffff
push 0x4050
push 0
push 0
push ebx
push esi
call edi
inc eax
push eax
push esi
call sub.USER32.dll_DdeClientTransaction
mov eax, dword [esp + 0x10]
push eax
call sub.USER32.dll_DdeGetLastError
push esi
mov dword [esp + 0x18], eax
call fcn.004bd4c4
add esp, 4
push ebx
call sub.USER32.dll_DdeDisconnect
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push esi
push ecx
call sub.USER32.dll_DdeFreeStringHandle
mov edx, dword [esp + 0x10]
push edi
push edx
call sub.USER32.dll_DdeFreeStringHandle
mov eax, dword [esp + 0x10]
push eax
call sub.USER32.dll_DdeUninitialize
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x4249d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d229b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
or eax, 0xffffffff
push 0x54
mov dword [esi + 4], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 8], edi
call fcn.004bd49b
add esp, 4
mov dword [esp + 8], eax
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x424a37
push edi
push edi
mov ecx, eax
call fcn.00439210
jmp 0x424a39
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], eax
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x425190
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
sub esp, 0x4b4
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x3c]
push eax
call fcn.004bd4c4
mov edx, dword [edi + 0x34]
add esp, 4
lea ecx, [esp + 0x35c]
push 0x400
push 0x160
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x4251e4
lea eax, [esp + 0x46c]
push eax
call fcn.00470f80
add esp, 4
mov dword [edi + 0x3c], eax
pop edi
pop esi
add esp, 0x4b4
ret
test byte [edi + 0x2c], 2
je 0x42521c
mov edx, dword [0x4f5e08]
lea ecx, [esp + 0xc]
push 0x50
push ecx
push 0x108
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0xc]
push eax
call fcn.00470f80
add esp, 4
mov dword [edi + 0x3c], eax
pop edi
pop esi
add esp, 0x4b4
ret
mov ecx, dword [edi + 0x34]
push 0x2e
push ecx
call fcn.004a7c73
mov esi, eax
add esp, 8
test esi, esi
je 0x4252da
lea edx, [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [esp + 0x260]
push edx
push eax
push esi
push 0x80000000
mov dword [esp + 0x1c], 0x100
call ebx
test eax, eax
jne 0x425282
lea ecx, [esp + 0xc]
lea edx, [esp + 0x160]
push ecx
lea eax, [esp + 0x264]
push edx
push eax
push 0x80000000
mov dword [esp + 0x1c], 0x100
call ebx
jmp 0x4252bd
inc esi
lea ecx, [esp + 0x60]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x60]
push edx
call fcn.004a8197
mov ecx, dword [0x4f5e08]
add esp, 4
lea eax, [esp + 0x60]
lea edx, [esp + 0x160]
push eax
push 0x109
push ecx
push edx
call fcn.00472a10
add esp, 0x10
lea eax, [esp + 0x160]
push eax
call fcn.00470f80
add esp, 4
mov dword [edi + 0x3c], eax
pop ebx
pop edi
pop esi
add esp, 0x4b4
ret
push 0
call fcn.00470f80
add esp, 4
mov dword [edi + 0x3c], eax
pop edi
pop esi
add esp, 0x4b4
ret
Function at 0x425560
Capabilities:
Get disk information
Get file system object information

Disassembly:
sub esp, 0x36c
push esi
mov esi, ecx
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x4256dd
mov al, byte [0x4f55a8]
push edi
mov byte [esp + 0x14], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x2c]
test al, 4
je 0x4255a9
mov ecx, dword [esi + 0x34]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4256c4
test al, 8
je 0x4256b1
mov eax, dword [esi + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x42566f
mov cl, byte [0x4f55a8]
xor eax, eax
mov byte [esp + 0x114], cl
mov ecx, 0x3f
lea edi, [esp + 0x115]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0x14]
push 0
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esi + 0x34]
push ecx
lea edx, [esp + 0x128]
push 0x100
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov al, byte [esp + 0x114]
test al, al
je 0x425653
lea ecx, [esp + 0x214]
lea edx, [esp + 0x114]
push ecx
push edx
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [esi + 0x34]
lea edx, [esp + 0x214]
movsx ecx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x1c]
push str._s___c:_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x4256c4
mov ecx, dword [esi + 0x34]
movsx edx, byte [ecx]
push edx
push str.__c:_
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4256c4
mov edx, dword [esi + 0x34]
push 0x200
lea ecx, [esp + 0x218]
push 0x160
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x4256a6
lea eax, [esp + 0x220]
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4256c4
mov edx, dword [esi + 0x34]
push edx
push 0x4ee470
jmp 0x42565f
mov edx, dword [esi + 0x34]
lea ecx, [esp + 0x14]
push 0x100
push ecx
push edx
call sub.comdlg32.dll_GetFileTitleA
lea eax, [esp + 0x14]
push eax
call fcn.00470f80
add esp, 4
mov dword [esi + 0x38], eax
pop edi
pop esi
add esp, 0x36c
ret
mov eax, dword [esi + 0x38]
pop esi
add esp, 0x36c
ret

Function at 0x4256f0
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [ecx + 0x14]
sub esp, 0x160
test eax, eax
jge 0x42574b
mov eax, dword [ecx + 4]
test eax, eax
je 0x425713
push ecx
mov ecx, eax
call fcn.0045f870
add esp, 0x160
ret
mov dl, byte [ecx + 0x2c]
mov dword [esp + 4], 0
test dl, 2
mov eax, 0x80
je 0x42572d
mov eax, 0x90
push 0x4000
lea edx, [esp + 4]
push 0x160
push edx
push eax
mov eax, dword [ecx + 0x34]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [esp + 4]
add esp, 0x160
ret