joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ddb0
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a128
push 0x43063c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
cmp dword [0x49bbb0], edi
jne 0x42df1b
xor ebx, ebx
cmp dword [0x49bba8], edi
je 0x42ddfc
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x49bbb0], edi
jne 0x42deef
cmp dword [0x49bba8], edi
jne 0x42de1d
call fcn.00409420
test eax, eax
je 0x42def4
mov eax, dword [0x468130]
mov dword [ebp - 0x48], eax
mov eax, dword [0x4a1d30]
cmp eax, edi
jne 0x42dee1
xor esi, esi
cmp dword [0x4a1d34], edi
jne 0x42de6e
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42de64
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
cmp eax, edi
je 0x42de89
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x42ded2
mov eax, dword [0x4a1d3c]
cmp eax, edi
jne 0x42dec4
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42deae
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x454fb0]
jmp 0x42debb
mov edx, dword [0x454fbc]
push edx
call dword [0x454fb4]
cmp eax, edi
je 0x42ded2
mov dword [0x4a1d3c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d30], eax
cmp esi, edi
jne 0x42dee1
xor eax, eax
jmp 0x42deeb
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call eax
cmp eax, edi
je 0x42def4
mov ebx, 1
cmp ebx, edi
jne 0x42df1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x42df08
cmp eax, 0x78
jne 0x42df13
mov ebx, 1
mov dword [0x49bbb0], ebx
cmp ebx, edi
jne 0x42df1b
xor eax, eax
jmp 0x42df20
mov eax, 1
cmp eax, edi
jne 0x42df39
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x34]
push eax
mov ecx, dword [ebp + 0x30]
push ecx
mov edx, dword [ebp + 0x2c]
push edx
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0042df99
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x42df99
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x49bbb0], edi
jne 0x42e08d
xor ebx, ebx
cmp dword [ebp - 0x20], edi
sete bl
cmp ebx, edi
je 0x42dfbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x42dfbf
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x24]
mov eax, dword [0x4a1d40]
test eax, eax
jne 0x42e07a
xor esi, esi
mov eax, dword [0x4a1d34]
test eax, eax
jne 0x42e00c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e002
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
test eax, eax
je 0x42e027
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x42e06f
mov eax, dword [0x4a1d3c]
test eax, eax
jne 0x42e061
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e04b
mov eax, dword [str.Kernel32.dll]
push eax
call dword [0x454fb0]
jmp 0x42e058
mov ecx, dword [0x454fbc]
push ecx
call dword [0x454fb4]
test eax, eax
je 0x42e06f
mov dword [0x4a1d3c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d40], eax
test esi, esi
je 0x42e07f
push edi
push 0
call eax
test ebx, ebx
je 0x42e08d
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x42e090
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a138
push 0x43063c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [0x49bbb0], edi
jne 0x42e1fb
xor ebx, ebx
cmp dword [0x49bba8], edi
je 0x42e0dc
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x49bbb0], edi
jne 0x42e1cf
cmp dword [0x49bba8], edi
jne 0x42e0fd
call fcn.00409420
test eax, eax
je 0x42e1d4
mov eax, dword [0x468130]
mov dword [ebp - 0x48], eax
mov eax, dword [0x4a1d30]
cmp eax, edi
jne 0x42e1c1
xor esi, esi
cmp dword [0x4a1d34], edi
jne 0x42e14e
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e144
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
cmp eax, edi
je 0x42e169
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x42e1b2
mov eax, dword [0x4a1d3c]
cmp eax, edi
jne 0x42e1a4
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e18e
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x454fb0]
jmp 0x42e19b
mov edx, dword [0x454fbc]
push edx
call dword [0x454fb4]
cmp eax, edi
je 0x42e1b2
mov dword [0x4a1d3c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d30], eax
cmp esi, edi
jne 0x42e1c1
xor eax, eax
jmp 0x42e1cb
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call eax
cmp eax, edi
je 0x42e1d4
mov ebx, 1
cmp ebx, edi
jne 0x42e1fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x42e1e8
cmp eax, 0x78
jne 0x42e1f3
mov ebx, 1
mov dword [0x49bbb0], ebx
cmp ebx, edi
jne 0x42e1fb
xor eax, eax
jmp 0x42e200
mov eax, 1
cmp eax, edi
jne 0x42e21a
xor ax, ax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0042e24f
mov ax, word [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42e24f
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x49bbb0], edi
jne 0x42e345
xor ebx, ebx
cmp word [ebp - 0x1c], di
sete bl
cmp ebx, edi
je 0x42e273
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x42e276
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x24]
mov eax, dword [0x4a1d40]
test eax, eax
jne 0x42e332
xor esi, esi
mov eax, dword [0x4a1d34]
test eax, eax
jne 0x42e2c3
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e2b9
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
test eax, eax
je 0x42e2de
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x42e327
mov eax, dword [0x4a1d3c]
test eax, eax
jne 0x42e319
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e303
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x454fb0]
jmp 0x42e310
mov edx, dword [0x454fbc]
push edx
call dword [0x454fb4]
test eax, eax
je 0x42e327
mov dword [0x4a1d3c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d40], eax
test esi, esi
je 0x42e337
push edi
push 0
call eax
test ebx, ebx
je 0x42e345
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x42e350
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a198
push 0x43063c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x20], esi
cmp dword [0x49bbb0], esi
jne 0x42e4af
xor edi, edi
cmp dword [0x49bba8], esi
je 0x42e399
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x49bbb0], esi
jne 0x42e483
cmp dword [0x49bba8], esi
jne 0x42e3ba
call fcn.00409420
test eax, eax
je 0x42e488
mov ebx, dword [0x468130]
mov eax, dword [0x4a1d30]
cmp eax, esi
jne 0x42e476
mov eax, dword [0x4a1d34]
test eax, eax
jne 0x42e408
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e3fe
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
test eax, eax
je 0x42e423
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x42e46b
mov eax, dword [0x4a1d3c]
test eax, eax
jne 0x42e45d
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e447
mov eax, dword [str.Kernel32.dll]
push eax
call dword [0x454fb0]
jmp 0x42e454
mov ecx, dword [0x454fbc]
push ecx
call dword [0x454fb4]
test eax, eax
je 0x42e46b
mov dword [0x4a1d3c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d30], eax
test esi, esi
je 0x42e47d
lea edx, [ebp - 0x20]
push edx
push ebx
call eax
xor esi, esi
cmp eax, esi
je 0x42e488
mov edi, 1
cmp edi, esi
jne 0x42e4af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x42e49c
cmp eax, 0x78
jne 0x42e4a7
mov edi, 1
mov dword [0x49bbb0], edi
cmp edi, esi
jne 0x42e4af
xor eax, eax
jmp 0x42e4b4
mov eax, 1
cmp eax, esi
je 0x42e4e5
mov dword [ebp - 4], esi
mov eax, dword [0x4a1d54]
cmp eax, esi
jne 0x42e4d7
push str.InitCommonControls
call fcn.0042e5d0
mov dword [0x4a1d54], eax
cmp eax, esi
je 0x42e4d9
call eax
mov dword [ebp - 4], 0xffffffff
call fcn.0042e4f6
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e4f6
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x49bbb0]
test eax, eax
jne 0x42e5c3
mov edi, dword [ebp - 0x20]
mov eax, dword [0x4a1d40]
test eax, eax
jne 0x42e5be
xor esi, esi
mov eax, dword [0x4a1d34]
test eax, eax
jne 0x42e550
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e546
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
test eax, eax
je 0x42e56b
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x42e5b3
mov eax, dword [0x4a1d3c]
test eax, eax
jne 0x42e5a5
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e58f
mov eax, dword [str.Kernel32.dll]
push eax
call dword [0x454fb0]
jmp 0x42e59c
mov ecx, dword [0x454fbc]
push ecx
call dword [0x454fb4]
test eax, eax
je 0x42e5b3
mov dword [0x4a1d3c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d40], eax
test esi, esi
je 0x42e5c3
push edi
push 0
call eax
ret
Function at 0x42e837
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x49bbb0]
test eax, eax
jne 0x42e930
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42e930
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x42e860
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x42e862
xor ebx, ebx
mov edi, dword [ebp - 0x24]
mov eax, dword [0x4a1d40]
test eax, eax
jne 0x42e91d
xor esi, esi
mov eax, dword [0x4a1d34]
test eax, eax
jne 0x42e8af
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e8a5
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
test eax, eax
je 0x42e8ca
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x42e912
mov eax, dword [0x4a1d3c]
test eax, eax
jne 0x42e904
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42e8ef
mov edx, dword [str.Kernel32.dll]
push edx
call dword [0x454fb0]
jmp 0x42e8fb
mov eax, dword [0x454fbc]
push eax
call dword [0x454fb4]
test eax, eax
je 0x42e912
mov dword [0x4a1d3c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d40], eax
test esi, esi
je 0x42e922
push edi
push 0
call eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x42e930
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret

Function at 0x42f325
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x49bbb0], edi
jne 0x42f419
xor ebx, ebx
cmp dword [ebp - 0x1c], edi
sete bl
cmp ebx, edi
je 0x42f348
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x42f34b
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x24]
mov eax, dword [0x4a1d40]
test eax, eax
jne 0x42f406
xor esi, esi
mov eax, dword [0x4a1d34]
test eax, eax
jne 0x42f398
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42f38e
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
test eax, eax
je 0x42f3b3
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x42f3fb
mov eax, dword [0x4a1d3c]
test eax, eax
jne 0x42f3ed
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42f3d8
mov edx, dword [str.Kernel32.dll]
push edx
call dword [0x454fb0]
jmp 0x42f3e4
mov eax, dword [0x454fbc]
push eax
call dword [0x454fb4]
test eax, eax
je 0x42f3fb
mov dword [0x4a1d3c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d40], eax
test esi, esi
je 0x42f40b
push edi
push 0
call eax
test ebx, ebx
je 0x42f419
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x42f6b0
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b430
push 0x43063c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0xffffffff
xor edi, edi
mov dword [ebp - 0x20], edi
cmp dword [0x49bbb0], edi
jne 0x42f81f
xor ebx, ebx
cmp dword [0x49bba8], edi
je 0x42f700
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x49bbb0], edi
jne 0x42f7f3
cmp dword [0x49bba8], edi
jne 0x42f721
call fcn.00409420
test eax, eax
je 0x42f7f8
mov eax, dword [0x468130]
mov dword [ebp - 0x48], eax
mov eax, dword [0x4a1d30]
cmp eax, edi
jne 0x42f7e5
xor esi, esi
cmp dword [0x4a1d34], edi
jne 0x42f772
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42f768
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
cmp eax, edi
je 0x42f78d
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x42f7d6
mov eax, dword [0x4a1d3c]
cmp eax, edi
jne 0x42f7c8
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42f7b2
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x454fb0]
jmp 0x42f7bf
mov edx, dword [0x454fbc]
push edx
call dword [0x454fb4]
cmp eax, edi
je 0x42f7d6
mov dword [0x4a1d3c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d30], eax
cmp esi, edi
jne 0x42f7e5
xor eax, eax
jmp 0x42f7ef
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call eax
cmp eax, edi
je 0x42f7f8
mov ebx, 1
cmp ebx, edi
jne 0x42f81f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x42f80c
cmp eax, 0x78
jne 0x42f817
mov ebx, 1
mov dword [0x49bbb0], ebx
cmp ebx, edi
jne 0x42f81f
xor eax, eax
jmp 0x42f824
mov eax, 1
cmp eax, edi
jne 0x42f83f
or ax, 0xffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], edi
mov eax, dword [0x4a1d48]
cmp eax, edi
jne 0x42f85e
push str.GetFileTitleA
call fcn.0042f990
mov dword [0x4a1d48], eax
cmp eax, edi
je 0x42f86f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0042f894
mov ax, word [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42f894
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x49bbb0], edi
jne 0x42f98a
xor ebx, ebx
cmp word [ebp - 0x24], 0xffff
sete bl
cmp ebx, edi
je 0x42f8b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x42f8bc
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x20]
mov eax, dword [0x4a1d40]
test eax, eax
jne 0x42f977
xor esi, esi
mov eax, dword [0x4a1d34]
test eax, eax
jne 0x42f909
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42f8ff
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
test eax, eax
je 0x42f924
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x42f96c
mov eax, dword [0x4a1d3c]
test eax, eax
jne 0x42f95e
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42f949
mov edx, dword [str.Kernel32.dll]
push edx
call dword [0x454fb0]
jmp 0x42f955
mov eax, dword [0x454fbc]
push eax
call dword [0x454fb4]
test eax, eax
je 0x42f96c
mov dword [0x4a1d3c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d40], eax
test esi, esi
je 0x42f97c
push edi
push 0
call eax
test ebx, ebx
je 0x42f98a
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x42fbf7
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x49bbb0]
test eax, eax
jne 0x42fcf0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42fcf0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x42fc20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x42fc22
xor ebx, ebx
mov edi, dword [ebp - 0x24]
mov eax, dword [0x4a1d40]
test eax, eax
jne 0x42fcdd
xor esi, esi
mov eax, dword [0x4a1d34]
test eax, eax
jne 0x42fc6f
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42fc65
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
test eax, eax
je 0x42fc8a
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x42fcd2
mov eax, dword [0x4a1d3c]
test eax, eax
jne 0x42fcc4
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42fcaf
mov edx, dword [str.Kernel32.dll]
push edx
call dword [0x454fb0]
jmp 0x42fcbb
mov eax, dword [0x454fbc]
push eax
call dword [0x454fb4]
test eax, eax
je 0x42fcd2
mov dword [0x4a1d3c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d40], eax
test esi, esi
je 0x42fce2
push edi
push 0
call eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x42fcf0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x442f30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ecx
test edi, edi
je 0x442f7a
call fcn.0044aa50
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x442f7a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x442f71
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push ebx
call fcn.00442f90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x445370
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
cmp dword [eax + 4], 0x100
jne 0x4453bc
cmp dword [eax + 8], 0x70
jne 0x4453bc
mov eax, dword [eax + 0xc]
shr eax, 0x10
test ah, 0x40
jne 0x4453bc
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jl 0x4453bc
push 0x11
call esi
test ax, ax
jl 0x4453bc
push 0x12
call esi
test ax, ax
jl 0x4453bc
mov eax, 1
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x445f90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
mov edi, dword [ebp + 0xc]
push eax
push esi
push 0x100
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x445fec
push 0x100
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4981ec]
mov dword [ebp + 8], ecx
lea edx, [ebp + 8]
mov dword [ebp - 4], 0
push edx
push esi
call fcn.004460b0
mov edx, dword [ebp + 8]
push 0
lea eax, [ebp + 0xc]
push 0
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x446049
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00444260
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
test byte [ebp + 0xc], 2
jne 0x446056
push esi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp + 0xc], 4
jne 0x446087
lea eax, [ebp - 0x154]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x446087
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x128]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00444260
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8