joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013360
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10013373
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1001337e
push 0x1d7d
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebp
ret
Function at 0x10019892
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100198af
push 0
push 0x22f6
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x100198ea
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 2
jmp 0x100198d1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x100198ea
mov dword [ebp - 0xc], 0xf782
cmp dword [ebp - 0xc], 0
je 0x100198e8
jmp 0x100198ea
jmp 0x100198c6
mov esp, ebp
pop ebp
ret

Function at 0x10019bf2
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10019c1c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10019c17
push 0x1325
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x10019d0f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [eax], 2
mov eax, dword [ebp - 0xc]
cmp dword [eax], 2
jge 0x10019c8a
mov dword [ebp - 0x1c], 1
jmp 0x10019c8e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
je 0x10019cab
mov dword [ebp - 0x10], 1
jmp 0x10019caf
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
dec eax
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jl 0x10019cc3
mov dword [ebp - 0x14], 1
jmp 0x10019cc7
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jle 0x10019cdf
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x10019cdf
and dword [ebp - 0x40], 0
jmp 0x10019ce6
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x3bb2669c
jne 0x10019d01
mov dword [ebp - 0x44], 1
jmp 0x10019d05
and dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002769c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100276e3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x100276f5
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esp, ebp
pop ebp
ret
Function at 0x1002b7a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1002b2bb
add esp, 0xc
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002b7d4
xor eax, eax
jmp 0x1002b8fb
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 0x5f7
push 0x3012
push 0x3d61
lea eax, [ebp - 8]
push eax
push 1
push 0x1a58
call fcn.1002b30e
add esp, 0x20
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002b810
xor eax, eax
jmp 0x1002b8fb
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.1002b6f6
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002b82f
xor eax, eax
jmp 0x1002b8fb
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 0x2d43
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
call fcn.1002b170
add esp, 0x1c
push dword [ebp - 4]
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.10024d69
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002b881
push 0
push dword [ebp - 4]
push dword [ebp - 0x14]
call fcn.100276f9
add esp, 0xc
push dword [ebp - 4]
call fcn.1002ae90
pop ecx
test eax, eax
jne 0x1002b892
xor eax, eax
jmp 0x1002b8fb
push 0
push dword [ebp - 4]
call fcn.100292cf
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002b8e3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002b8bd
xor eax, eax
jmp 0x1002b8fb
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002b8d6
xor eax, eax
jmp 0x1002b8fb
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002b759
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002b8f4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002b8f8
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret

Function at 0x1002b8ff
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002b944
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x1002b965
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002b965
push 0x1325
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x10077eb5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008038c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10068cac
mov dword [ebp - 0x14], eax
cmp dword [0x107301f4], esi
jne 0x10077fa8
push 0x800
push esi
push 0x10007fdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10077f35
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10078088
push esi
push esi
push 0x10007fdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10078088
push 0x10007ff4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10078088
push eax
call ebx
push 0x10008000
push edi
mov dword [0x107301f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008010
push edi
mov dword [0x107301f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008024
push edi
mov dword [0x107301fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10730204], eax
test eax, eax
je 0x10077fa5
push 0x10008040
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10730200], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10077fcd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10077fc0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10077fe2
push 4
pop eax
jmp 0x1007808a
cmp dword [ebp - 0x14], esi
je 0x10077fe2
push dword [0x107301f4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10077fc7
mov eax, dword [0x10730200]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10078040
cmp dword [0x10730204], edi
je 0x10078040
push eax
call ebx
push dword [0x10730204]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10078040
test eax, eax
je 0x10078040
call ecx
test eax, eax
je 0x10078035
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10078035
test byte [ebp - 8], 1
jne 0x10078040
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10078070
mov eax, dword [0x107301f8]
cmp eax, edi
je 0x1007806d
push eax
call ebx
test eax, eax
je 0x1007806d
call eax
mov esi, eax
test esi, esi
je 0x1007806d
mov eax, dword [0x107301fc]
cmp eax, edi
je 0x1007806d
push eax
call ebx
test eax, eax
je 0x1007806d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x107301f4]
call ebx
test eax, eax
je 0x10078088
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007808a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x407fa0
Capabilities:
Modify service

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp], 1
mov dword [esp + 8], 0
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 3
cmp eax, 0xffffffff
mov dword [esp + 4], ecx
setne dl
mov eax, 0x70f87c
lea ecx, [esp + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
push ecx
lea eax, [esp + 4]
push 2
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
add esp, 0x1c
ret

Function at 0x408140
Capabilities:
Create http request

Disassembly:
sub esp, 0x50
push esi
push edi
mov ecx, 0xe
mov esi, str.http:__www.ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com
lea edi, [esp + 8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov word [esp + 0x55], ax
push eax
push eax
push eax
push 1
push eax
mov byte [esp + 0x6b], al
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x84000000
push 0
lea ecx, [esp + 0x14]
mov esi, eax
push 0
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test edi, edi
jmp 0x4081a7
call esi
push 0
call esi
call fcn.00408090
pop edi
xor eax, eax
pop esi
add esp, 0x50
ret 0x10
Function at 0x10032be
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc1c
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc14], eax
mov dword [ebp - 0xc1c], esi
cmp byte [0x1017001], bl
je 0x1009852
lea ecx, [ebp - 0xc0c]
push ecx
lea ecx, [ebp - 0xc04]
push ecx
lea ecx, [ebp - 0xc08]
push ecx
push ebx
push edi
push eax
mov dword [ebp - 0xc0c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x1004a28
jle 0x1003335
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0xc28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0xc
lea eax, [ebp - 0xc04]
cmp dword [ebp - 0xc08], ebx
jbe 0x1004a99
cmp dword [ebp - 0xc08], 2
ja 0x1009953
push 0xffffffffffffffff
push 0x1004ab0
lea eax, [ebp - 0xc04]
push eax
mov byte [esi], 1
call fcn.01002753
test eax, eax
je 0x1004a95
push 0xffffffffffffffff
push 0x1004ab4
lea eax, [ebp - 0xc04]
push eax
call fcn.01002753
test eax, eax
je 0x1004a95
push 0xffffffffffffffff
push 0x1004aa4
lea eax, [ebp - 0xc04]
push eax
call fcn.01002753
test eax, eax
je 0x1004a95
mov byte [esi], 1
xor eax, eax
jmp 0x1003335
mov byte [esi], bl
jmp 0x1004a8e
mov eax, 0x80040153
jmp 0x1003335
cmp edi, ebx
je 0x10098fb
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
mov dword [ebp - 0xc18], eax
cmp eax, ebx
jne 0x1009882
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x1003329
call fcn.0100320b
mov dword [ebp - 0xc10], esp
push ebx
push ebx
push dword [ebp - 0xc18]
push dword [ebp - 0xc10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
test eax, eax
je 0x1009875
mov esi, dword [ebp - 0xc1c]
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc08]
push eax
push ebx
push dword [ebp - 0xc10]
mov edi, 0x400
push dword [ebp - 0xc14]
mov dword [ebp - 0xc0c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x1003329
mov eax, dword [ebp - 0xc0c]
cmp eax, ebx
jne 0x1009903
mov eax, 0x80004005
jmp 0x1003335
mov dword [ebp - 0xc10], ebx
jmp 0x10098ac
cmp dword [ebp - 0xc08], 1
mov byte [ebp + eax - 0x405], bl
je 0x1009927
cmp dword [ebp - 0xc08], 2
je 0x1009927
lea eax, [ebp - 0x404]
jmp 0x1004a2e
push edi
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1009875
mov eax, dword [ebp - 0xc14]
jmp 0x1004a2e
cmp dword [ebp - 0xc08], 4
jne 0x1004a99
cmp dword [ebp - 0xc0c], 4
jne 0x1004a99
cmp dword [eax], ebx
setne al
mov byte [esi], al
jmp 0x1004a8e
Function at 0x40eb7e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x40ec06
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x40ebb8
push 0
push 0x3524
call fcn.00412861
pop ecx
pop ecx
jmp 0x40ec04
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x40ebf7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x40ebf5
push 0x5b60
push 1
push 0
call fcn.0040ddc7
add esp, 0xc
jmp 0x40ec04
push 0x1d52
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x40ec23
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0x2d2c
push 0x6a0b
push dword [ebp - 0x20]
push 1
call fcn.00408ab6
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4122f4
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41235a
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41232e
push 1
push 0x6320
call fcn.004123f1
pop ecx
pop ecx
jmp 0x412355
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push 1
push 1
push 0
push dword [ebp - 0x18]
push 0x3c8
call fcn.0040bd65
add esp, 0x18
jmp 0x4123ed
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4123ac
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4123a2
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4123a0
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
jmp 0x4123aa
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4123ed
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4123d1
push 0x20c1
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4123ed
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x4123ed
call dword [sym.imp.USER32.dll_GetCapture]
mov esp, ebp
pop ebp
ret
Function at 0x413e24
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x413ebb
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x413e68
push 0x7ce9
push 0x45c2
push 0
call fcn.0041ea5e
add esp, 0xc
jmp 0x413eb6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x413e88
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x413eb6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x413eb6
push 1
push 0x49ac
push 0x76f9
push 0
push 0
call fcn.00410916
add esp, 0x14
jmp 0x413f56
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x413f43
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x413f0d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x413f0b
push 0
call fcn.00410bc2
pop ecx
jmp 0x413f41
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x413f41
push 0x474
push 0x1cc9
push 0x1519
push 0x1f3b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
jmp 0x413f56
push 0
push 0x481d
push 1
push 1
call fcn.00420298
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4173fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x417558
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4174ae
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41749c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x417476
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x41749a
push 1
push 1
push 1
push 0x5a2e
push 0x5fce
push 1
call fcn.004151e9
add esp, 0x18
jmp 0x41746b
jmp 0x4174a9
push 0x20c1
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x417556
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x41752c
mov dword [ebp - 0x58], 0xae9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4174f0
push 1
push 1
push 0x7309
push 1
call fcn.004125c8
add esp, 0x10
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x41752a
push 0x55bc
push 0x3e34
push 0
push 0x6cbd
push 0x4ff9
push 1
push 1
push 0x3871
push 1
push 0x4697
call fcn.0041c694
add esp, 0x28
jmp 0x417556
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
jmp 0x417590
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x50], eax
push 0x22cb
push 0xa20
push dword [ebp - 0x4c]
push 0
push 0x7494
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x54]
call fcn.0040dc9d
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x41a6b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x41a73a
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41a6fd
push 0x2304
push 0x3eec
push 1
push 0x7c14
call fcn.0041a756
add esp, 0x10
jmp 0x41a738
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41a72b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x41a738
push 0x19ed
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x41a752
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0x21d3
push 0
call fcn.004127d0
add esp, 0xc
mov esp, ebp
pop ebp
ret