joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c6ae
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x56e32b
call fcn.00566548
sub esp, 0x60
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x18]
push edx
call fcn.00402516
xor ebx, ebx
lea ecx, [ebp - 0x18]
push 0x2e
mov dword [ebp - 4], ebx
call fcn.004039f1
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00403a1a
test esi, esi
js 0x44c6ea
cmp esi, eax
jge 0x44c6f2
lea ecx, [ebp - 0x18]
call fcn.00402c77
lea eax, [ebp - 0x18]
mov dword [ebp - 0x6c], 0x3c
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x68], 0x140
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call fcn.00402516
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00402516
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp dword [ebp - 0x20], ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x24]
cmove eax, ecx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x4c]
mov dword [ecx], eax
call fcn.0056651e
push dword [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.0056651e
pop ecx
pop ecx
cmp esi, 0x20
ja 0x44c789
cmp esi, 0x1f
jne 0x44c784
push ebx
call fcn.004091fc
mov ecx, dword [ebp + 8]
mov edx, eax
call fcn.0044a6d3
mov ebx, 0x80004005
push dword [ebp - 0x18]
call fcn.0056651e
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x44e94e
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x56e5b2
call fcn.00566548
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.00402516
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.00402516
lea eax, [esi + 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x18]
call fcn.00402516
lea eax, [esi + 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x24]
call fcn.00402516
lea eax, [esi + 0x30]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x30]
call fcn.00402516
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x44e9bb
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x56e5b2
call fcn.00566548
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040260e
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.0040260e
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040260e
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0040260e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x44ff22
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
sub esp, 0x60
mov eax, 0x56e939
call fcn.00566548
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [ebp]
push 0x57bb54
call fcn.00402595
xor eax, eax
mov dword [ebp + 0x10], 0x45061a
xor esi, esi
mov dword [ebp - 4], eax
inc esi
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], eax
mov eax, dword [0x5b2870]
push esi
push eax
mov dword [ebp + 0x1c], eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f84
push 0
mov dword [ebp + 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x28], 0x10
mov dword [ebp + 0x2c], 0x47
mov dword [ebp + 0x30], 0x57ca28
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x4500c9
push 0x5b2c50
lea eax, [ebp + 0x63]
mov byte [ebp + 0x44], 0
mov edi, SysReAllocString
lea ecx, [ebp + 0x34]
push eax
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x5c], edi
call fcn.0046c2d3
cmp byte [ebp + 0x63], 0
je 0x44ffe6
mov ecx, dword [ebp + 0x34]
mov edx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x38]
sub edx, ecx
mov edi, dword [ebp + 0x40]
mov dword [ebp + 0x5c], ecx
sub edi, eax
mov dword [ebp + 0x54], eax
jmp 0x44ffe8
mov edx, edi
cmp byte [0x5b2c50], 0
je 0x450014
mov eax, dword [ebp + 0x50]
mov dword [0x5b2c40], eax
mov eax, dword [ebp + 0x48]
cmp eax, esi
jb 0x450005
cmp eax, 2
jbe 0x45000a
mov eax, esi
mov dword [ebp + 0x48], eax
mov ecx, dword [ebp + 0x4c]
cmp ecx, 2
jb 0x45001e
jmp 0x450019
mov eax, esi
mov dword [ebp + 0x48], eax
xor ecx, ecx
mov dword [ebp + 0x4c], ecx
mov dword [0x5b2898], eax
xor eax, eax
push eax
push dword [0x5b2870]
mov dword [0x5b289c], ecx
push eax
push eax
push edi
push edx
push dword [ebp + 0x54]
push dword [ebp + 0x5c]
push 0xcf0000
push dword [ebp]
push 0x57ca28
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov dword [ebp + 0x58], esi
test esi, esi
je 0x4500c9
xor eax, eax
inc eax
cmp ebx, eax
je 0x450071
cmp ebx, 5
je 0x450071
cmp ebx, 0xa
je 0x450071
cmp ebx, 3
jne 0x450083
jmp 0x45007a
cmp byte [ebp + 0x44], 0
je 0x450081
push 3
pop ebx
mov byte [0x5b2876], al
jmp 0x450083
mov ebx, eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x2c
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x4500bc
cmp byte [ebp + 0x63], 0
je 0x4500ac
lea esi, [ebp + 0x34]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x58]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPlacement]
jmp 0x4500c4
push ebx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor esi, esi
inc esi
jmp 0x4500cb
xor esi, esi
push dword [ebp]
call fcn.0056651e
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x64
leave
ret
Function at 0x453b0f
Capabilities:
Move file

Disassembly:
mov eax, 0x56ec98
call fcn.00566548
sub esp, 0x20
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 0x14], ebx
call fcn.00409f92
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.00409f92
mov esi, eax
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x453b82
cmp esi, 1
je 0x453b76
push 2
push ebx
push 0x453707
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
test eax, eax
je 0x453b64
mov al, 1
jmp 0x453c30
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x453c16
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x453b82
test esi, esi
je 0x453c16
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp dword [eax + 0x1c], ebx
jne 0x453c2e
lea ecx, [ebp - 0x2c]
call fcn.0040260e
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.0040260e
cmp dword [ebp - 0x10], 1
mov byte [ebp - 4], 1
je 0x453bb4
mov al, 1
cmp esi, 1
jne 0x453bb6
mov al, bl
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00409f26
test al, al
je 0x453bea
push 2
push dword [ebp - 0x14]
push 0x453707
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
test eax, eax
je 0x453c00
mov bl, 1
push dword [ebp - 0x20]
call fcn.0056651e
push dword [ebp - 0x2c]
call fcn.0056651e
pop ecx
pop ecx
mov al, bl
jmp 0x453c30
push dword [ebp - 0x20]
call fcn.0056651e
push dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
call fcn.0056651e
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x453c2e
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00407a77
jmp 0x453c30
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4551c3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ecx, 0x44c
jb 0x45522b
push esi
push ecx
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.004657eb
mov eax, dword [0x5b289c]
imul esi, eax, 0x184
add esi, 0x5b2a70
mov ecx, dword [esi]
test ecx, ecx
je 0x45520b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi], 0
mov eax, dword [0x5b289c]
imul esi, eax, 0x184
add esi, 0x5b2a74
mov ecx, dword [esi]
test ecx, ecx
je 0x455226
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi], 0
mov al, 1
pop esi
leave
ret
mov eax, 0x224
cmp ecx, eax
ja 0x4553aa
je 0x45537b
add eax, 0xfffffff8
cmp ecx, eax
ja 0x4552cc
je 0x4552b0
sub ecx, 0x65
je 0x45529c
sub ecx, 1
je 0x455295
sub ecx, 1
je 0x45528e
sub ecx, 1
je 0x455287
sub ecx, 1
je 0x455280
sub ecx, 1
je 0x455279
sub ecx, 1
jne case.0x4553c0.553
push 0x57b884
jmp 0x4552a1
push 0x5788c0
jmp 0x4552a1
push str.SHA256
jmp 0x4552a1
push str.SHA1
jmp 0x4552a1
push str.CRC64
jmp 0x4552a1
push str.CRC32
jmp 0x4552a1
push 0x578880
mov ecx, 0x5b2890
call fcn.00459b4f
jmp 0x45548c
push 1
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.00462eac
jmp 0x45548c
sub ecx, 0x21d
je 0x45535f
sub ecx, 1
je 0x455358
sub ecx, 1
je 0x45533c
sub ecx, 1
je 0x455338
sub ecx, 1
je 0x45531e
sub ecx, 1
je 0x455305
sub ecx, 1
jne case.0x4553c0.553
push dword [0x5b289c]
push ecx
push 1
jmp 0x45530f
push dword [0x5b289c]
push 0
push 0
mov ecx, 0x5b2890
call fcn.00446f87
jmp 0x45548c
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.00467cf9
jmp 0x45548c
push 1
jmp 0x45533e
push 0
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.00461e01
jmp 0x45548c
push 0
jmp 0x4552b2
push 0
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.00462e5f
jmp 0x45548c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
imul ecx, dword [0x5b289c], 0x184
shr eax, 0xf
not al
and al, 1
mov byte [ebp - 4], al
push dword [ebp - 4]
add ecx, 0x5b2904
call fcn.00467443
jmp 0x45548c
lea eax, [ecx - 0x225]
cmp eax, 0x2a
ja case.0x4553c0.553
movzx eax, byte [eax + 0x4554cb]
jmp dword [eax*4 + 0x455497]
push str._.
jmp 0x455361
push 0x57b3ec
jmp 0x455361
mov ecx, 0x5b2890
call fcn.0045eeb9
jmp 0x45548c
push ecx
mov ecx, 0x5b2890
call fcn.00472aa0
jmp 0x45548c
mov ecx, 0x5b2890
call fcn.00469a9c
jmp 0x45548c
mov ecx, 0x5b2890
call fcn.00468b4f
jmp 0x45548c
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.00465c7a
jmp 0x45548c
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.00466da8
jmp 0x45548c
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.00467216
jmp 0x45548c
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.0046700d
jmp 0x45548c
mov ecx, 0x5b2890
call fcn.0047515f
jmp 0x45548c
imul ecx, dword [0x5b289c], 0x184
add ecx, 0x5b2904
call fcn.0045debb
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x45a437
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
mov eax, 0x56f2ef
call fcn.00566548
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], ebx
mov dword [edi], 0x57d804
mov dword [edi + 0x58], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ebx
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 2
call fcn.0040260e
lea ecx, [edi + 0x7c]
mov byte [ebp - 4], 3
call fcn.0040260e
lea ecx, [edi + 0x98]
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], ebx
call fcn.0045a56c
or dword [edi + 0x18], 0xffffffff
mov esi, dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push 0xf
pop eax
mov word [edi + 0xc], ax
xor eax, eax
inc eax
mov dword [edi + 0x10], ebx
push str.7_Zip::SetTargetFolder
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], eax
call esi
push str.7_Zip::SetTransfer
mov dword [edi + 0x20], eax
call esi
push str.7_Zip::GetTransfer
mov dword [edi + 0x24], eax
call esi
push 0x57d834
mov dword [edi + 0x28], eax
call esi
push str.Logical_Performed_DropEffect
mov dword [edi + 0x2c], eax
call esi
push str.DisableDragText
mov dword [edi + 0x30], eax
call esi
push str.IsShowingLayered
mov dword [edi + 0x34], eax
call esi
push str.IsShowingText
mov dword [edi + 0x38], eax
call esi
push str.DropDescription
mov dword [edi + 0x3c], eax
call esi
push str.TargetCLSID
mov dword [edi + 0x40], eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x44], eax
mov eax, edi
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x50], ebx
mov word [edi + 0x54], bx
mov dword [edi + 0x88], ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x45c975
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56e3aa
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x57d98c
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov word [esi + 0x18], bx
mov byte [esi + 0x1a], bl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
or dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x38], 1
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x45ed9d
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x60], 0
je 0x45edb7
mov ecx, dword [esi + 0x1c]
call fcn.004076ad
mov ecx, dword [esi + 0x10]
pop esi
jmp fcn.00407ba4
pop esi
ret
Function at 0x45f20c
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x56f995
call fcn.00566548
sub esp, 0x244
push esi
push edi
mov edi, ecx
call fcn.0042cae8
and dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
je 0x45f2ce
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040260e
mov ebx, 0x22c
mov byte [ebp - 4], 1
push ebx
lea eax, [ebp - 0x250]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x250], ebx
lea eax, [ebp - 0x250]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
pop ebx
jmp 0x45f2ba
mov eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x22c]
push eax
call fcn.00402804
mov ecx, edi
call fcn.00403988
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.0045ece2
lea eax, [ebp - 0x250]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45f27a
push dword [ebp - 0x18]
call fcn.0056651e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4688d8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x570593
call fcn.00566548
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x57de6c
lea ecx, [esi + 0x10]
mov dword [esi + 8], edi
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
call fcn.0040260e
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x46b0bc
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x56e4ae
call fcn.00566548
sub esp, 0x18
push esi
mov esi, ecx
lea ecx, [ebp - 0x18]
lea edx, [esi + 0x3c]
call fcn.0046b347
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
push eax
call fcn.0040272f
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.0056651e
pop ecx
lea edx, [esi + 0x40]
lea ecx, [ebp - 0x18]
call fcn.0046b371
push eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 1
call fcn.0040272f
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.0056651e
pop ecx
lea edx, [esi + 0x44]
lea ecx, [ebp - 0x24]
call fcn.0046b39b
push eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 2
call fcn.0040272f
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call fcn.0056651e
lea ecx, [esi + 0x30]
mov dword [esp], 0x57e194
call fcn.00402790
push 0x11
pop ecx
call fcn.0046b831
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], eax
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x46b831
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push ecx
push esi
mov dword [ebp - 4], esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], esi
je 0x46b88c
push 0x4008
push 0x2b4
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x2b4], esi
push eax
push 0x80
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
je 0x46b88c
mov eax, dword [ebp - 0x2b4]
jmp 0x46b88e
xor eax, eax
pop esi
leave
ret

Function at 0x46b891
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2b4]
or edx, 0x80
push eax
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x2b0]
mov dword [edx], ecx
leave
ret 4

Function at 0x46b8c8
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
mov edx, 0x4011
test cl, cl
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x90
push 0x578d0c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0x2b4
ret
Function at 0x46dee9
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x12
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x46df09
cmp dword [esi + 0x38], 1
ja 0x46df09
mov eax, dword [esi]
mov ecx, esi
pop esi
jmp dword [eax + 0x20]
mov ecx, esi
pop esi
jmp 0x46e319
mov eax, 0x570be9
call fcn.00566548
sub esp, 0x48
xor eax, eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea ecx, [esi + 8]
mov dword [ebp - 4], eax
lea edx, [ebp - 0x18]
call fcn.0046deb6
cmp dword [ebp - 0x14], 1
mov ebx, dword [ebp - 0x18]
jne 0x46e3f3
push edi
mov edi, dword [ebx]
lea ecx, [ebp - 0x54]
call fcn.0046dce6
cmp dword [esi + 0x38], 1
mov eax, dword [esi + 0x1c]
mov byte [ebp - 4], 1
push dword [eax + edi*4]
je 0x46e37e
lea ecx, [ebp - 0x48]
call fcn.0040272f
cmp edi, dword [esi + 0x2c]
jae 0x46e386
mov eax, dword [esi + 0x28]
push dword [eax + edi*4]
lea ecx, [ebp - 0x3c]
call fcn.0040272f
mov ecx, dword [ebp - 0x3c]
push 0xd
pop edx
call fcn.00402f9f
pop edi
test eax, eax
jns 0x46e3de
push 0x57e610
lea ecx, [ebp - 0x30]
call fcn.004025d8
push 0x57e618
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004025d8
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004038d5
push dword [ebp - 0x24]
call fcn.0056651e
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0056651e
pop ecx
pop ecx
push dword [esi + 4]
lea ecx, [ebp - 0x54]
push 0x5e
call fcn.0040e9e0
lea ecx, [ebp - 0x54]
call fcn.0046dd2b
push ebx
call fcn.0056651e
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x46e7d9
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x570c2a
call fcn.00566548
sub esp, 0x340
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x3c]
push edi
call fcn.0040260e
mov edi, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x46e845
push dword [edi + 0xc]
lea ecx, [ebp - 0x58]
push dword [edi + 8]
call fcn.00450eee
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00450ea9
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.0040272f
push dword [ebp - 0x4c]
call fcn.0056651e
push dword [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.0056651e
pop ecx
pop ecx
lea ecx, [edi + 0x18]
call fcn.00403a1a
mov esi, eax
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00402457
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x24]
add eax, 2
mov byte [ebp - 4], 3
lea eax, [eax + esi*2]
push eax
call fcn.004025d8
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.0046e760
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.0046e760
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402516
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00402cc2
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402a78
lea ecx, [ebp - 0x18]
call fcn.00402cc2
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402a78
lea ecx, [ebp - 0x18]
call fcn.00402cc2
cmp byte [edi + 1], 0
je 0x46e90e
mov edx, 0x3f4
lea ecx, [ebp - 0x18]
call fcn.00453f36
push 0x578c84
lea ecx, [ebp - 0x18]
call fcn.00402aad
push 0
lea ecx, [edi + 0x10]
lea edx, [ebp - 0x98]
call fcn.0040ae3a
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402aad
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call esi
push dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x110
push 0x2b4
lea eax, [ebp - 0x34c]
push eax
push 0x80
push dword [edi + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x46e965
push dword [ebp + 0xc]
push dword [ebx + 4]
call esi
push 0
push dword [ebp - 0x34c]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x18]
call fcn.0056651e
push dword [ebp - 0x24]
call fcn.0056651e
push dword [ebp - 0x30]
call fcn.0056651e
push dword [ebp - 0x3c]
call fcn.0056651e
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x46ec75
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x570d6f
call fcn.00566548
push ecx
push ebx
or eax, 0xffffffff
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x38]
mov dword [esi], 0x10000
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
call fcn.0040260e
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.0040260e
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.0040260e
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
call fcn.00458603
lea ecx, [esi + 0x98]
call fcn.0055aa20
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x471d18
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x56a2ad
call fcn.00566548
sub esp, 0x10
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [ebx + 4], eax
jne 0x471d3b
or eax, 0xffffffff
jmp 0x471dff
push esi
xor eax, eax
lea ecx, [ebp - 0x1c]
or esi, 0xffffffff
cmp dword [ebp + 0xc], esi
cmovne eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.0040260e
xor eax, eax
mov dword [ebp - 4], eax
mov eax, 0x110
cmp dword [ebp - 0x14], eax
jae 0x471d6b
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403715
push 0x10e
push dword [ebp - 0x1c]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
xor ebx, ebx
mov word [edx + 0x21c], cx
cmp word [edx], bx
mov ebx, dword [ebp + 8]
je 0x471d9d
xor ebx, ebx
inc ecx
cmp word [edx + ecx*2], bx
jne 0x471d93
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x471dab
cmp eax, 0x10e
jb 0x471db4
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040272f
push 1
lea eax, [ebp + 0xc]
push eax
xor eax, eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
cmp eax, 1
jne 0x471df3
cmp dword [ebp + 0xc], 0
je 0x471df3
push dword [ebp + 0xc]
push esi
push dword [edi + 0x24]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov esi, dword [edi + 0x20]
lea eax, [esi + 1]
mov dword [edi + 0x20], eax
push dword [ebp - 0x1c]
call fcn.0056651e
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 8