joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457260
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor dl, dl
push esi
mov esi, dword [ebp + 8]
mov byte [ebp + 0xb], dl
test ebx, ebx
js 0x45735a
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
js 0x457351
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x4572a0
push 0
push 0
push 0x1200
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dl, byte [ebp + 0xb]
jmp 0x4572a3
or eax, 0xffffffff
cmp edi, eax
jge 0x457351
mov edx, dword [ebp + 0x14]
mov dword [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 4], ebx
mov dword [esi + 8], edi
mov ecx, dword [edx]
sub ecx, 0
je 0x45731c
sub ecx, 1
je 0x457326
sub ecx, 2
je 0x457348
push str.UxListViewControl_said__underconstruction._
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov ecx, dword [esi]
or ecx, 1
mov dword [esi], ecx
mov eax, dword [edx + 8]
mov dword [esi + 0x14], eax
cmp dword [edx + 4], 0
jl 0x457348
test edi, edi
jne 0x457348
or ecx, 2
mov dword [esi], ecx
mov eax, dword [edx + 4]
mov dword [esi + 0x1c], eax
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x10
pop edi
pop esi
mov al, dl
pop ebx
pop ebp
ret 0x10
pop esi
mov al, dl
pop ebx
pop ebp
ret 0x10
Function at 0x45d380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
push 0
mov dword [ebp - 0xc], edi
mov dword [edi + 0x70], eax
mov eax, dword [edi + 8]
mov esi, dword [eax + 4]
mov eax, dword [eax + 8]
cdq
xor eax, edx
mov dword [ebp - 8], esi
lea ecx, [esi + 3]
sub eax, edx
and ecx, 0xfffffffc
mov dword [ebp + 8], eax
push ecx
call fcn.004898f0
add esp, 8
mov ebx, eax
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], ebx
mov dword [ebp + 0xc], 0
je 0x45d45d
cmp dword [ebp + 8], 0
jle 0x45d4c5
nop dword [eax]
mov ecx, dword [edi + 8]
push esi
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 4]
cdq
add ecx, 3
mov ebx, eax
and ecx, 0xfffffffc
xor ebx, edx
sub ebx, edx
sub ebx, dword [ebp + 0xc]
dec ebx
imul ebx, ecx
mov ecx, edi
add ebx, dword [edi + 0xc]
call fcn.0045d760
mov edi, esi
sub edi, eax
sub esi, edi
push esi
lea eax, [edi + ebx]
push eax
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
push edi
mov edi, dword [ebp - 4]
push ebx
lea eax, [esi + edi]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebp - 8]
push esi
push edi
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0xc]
add esp, 0x24
mov edi, dword [ebp - 0xc]
inc eax
mov dword [ebp + 0xc], eax
cmp eax, dword [ebp + 8]
jl 0x45d3e0
mov ebx, dword [ebp - 4]
push 0
push ebx
call fcn.00489940
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 8], 0
jle 0x45d4c5
mov ecx, dword [edi + 8]
push esi
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 4]
cdq
add ecx, 3
mov edi, eax
and ecx, 0xfffffffc
xor edi, edx
sub edi, edx
sub edi, dword [ebp + 0xc]
dec edi
imul edi, ecx
mov ecx, dword [ebp - 0xc]
add edi, dword [ecx + 0xc]
call fcn.0045d760
sub esi, eax
add eax, edi
push esi
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 8]
sub eax, esi
push eax
lea eax, [esi + ebx]
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebp - 8]
push esi
push ebx
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0xc]
add esp, 0x24
mov edi, dword [ebp - 0xc]
inc eax
mov dword [ebp + 0xc], eax
cmp eax, dword [ebp + 8]
jl 0x45d463
push 0
push ebx
call fcn.00489940
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x463500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, ecx
call dword [sym.imp.GDI32.dll_GdiFlush]
test byte [esi + 0x60], 1
mov ebx, dword [ebp + 0x20]
mov byte [ebp + 0x1b], bl
je 0x4635f3
cmp edi, 0x10
jl 0x4635f3
mov eax, edi
mov dword [ebp - 0x14], 0xffffffff
shr eax, 4
and edi, 0xf
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], 0xffffffff
mov ebx, dword [ebp + 0x20]
mov eax, ebx
shl ebx, 8
or eax, ebx
shl ebx, 8
or eax, ebx
shl ebx, 8
or eax, ebx
mov dword [ebp - 4], eax
movd mm7, dword [ebp - 4]
movd mm6, dword [ebp - 4]
punpcklbw mm7, mm6
movq mm6, qword [ebp - 0x14]
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movq mm1, qword [esi]
movq mm4, qword [esi + 8]
movq mm2, mm1
movq mm0, qword [edi]
movq mm5, mm4
movq mm3, qword [edi + 8]
pcmpeqb mm2, mm7
pcmpeqb mm5, mm7
pand mm0, mm2
pand mm3, mm5
pxor mm2, mm6
pxor mm5, mm6
pand mm1, mm2
pand mm4, mm5
por mm0, mm1
movq qword [edi], mm0
por mm3, mm4
movq qword [edi + 8], mm3
add esi, 0x10
add edi, 0x10
dec edx
jne 0x46357e
or ecx, ecx
je 0x4635d3
mov al, byte [esi]
inc esi
inc edi
cmp al, byte [ebp + 0x1b]
je 0x4635d0
mov byte [edi - 1], al
dec ecx
jne 0x4635c4
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
sub edi, dword [ebp + 0xc]
sub esi, dword [ebp + 0x14]
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], esi
dec ebx
jne 0x463578
emms
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov edx, dword [ebp + 0x1c]
mov dword [ebp + 0x20], edx
test edx, edx
jle 0x46363c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
test edi, edi
jle 0x463628
mov esi, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, bl
je 0x463618
mov byte [ecx], dl
inc ecx
inc eax
sub esi, 1
jne 0x463610
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
sub ecx, dword [ebp + 0xc]
sub eax, dword [ebp + 0x14]
sub edx, 1
mov dword [ebp + 8], ecx
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x20], edx
jne 0x463603
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x465bc0
Capabilities:
Capture screenshot
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb900
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4ea160]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], ebx
cmp dword [eax + 8], 0
je 0x465d61
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.FCRect.0
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], vtable.FCPalette.0
mov dword [ebp - 0x40], 0
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0xc]
mov ecx, dword [esi + 8]
mov dword [ebp - 0x28], eax
sub eax, dword [ebx + 4]
cdq
mov esi, dword [ecx + 4]
idiv esi
mov dword [ebp - 0x2c], esi
mov edi, eax
mov eax, dword [ecx + 8]
cdq
mov ebx, eax
mov eax, dword [ebp - 0x30]
xor ebx, edx
sub ebx, edx
mov ecx, dword [eax + 8]
mov esi, dword [eax + 0x10]
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x38], ecx
cdq
idiv ebx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
imul edx, edi
sub dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x28]
cmp edx, dword [ecx + 4]
lea ecx, [edi + 1]
lea edx, [eax + 1]
cmove ecx, edi
imul ebx, eax
mov dword [ebp - 0x2c], ecx
sub esi, ebx
mov ebx, dword [ebp - 0x34]
cmp esi, dword [ebp - 0x38]
mov ecx, ebx
cmove edx, eax
mov dword [ebp - 0x28], edx
call fcn.00463ff0
push 0
push ebx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x38], eax
call fcn.0048f7d0
mov eax, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
test eax, eax
je 0x465cc1
push 0
push 0x200
push eax
mov ecx, ebx
call fcn.0045bcb0
push dword [ebx + 8]
call dword [sym.imp.GDI32.dll_RealizePalette]
xor edi, edi
cmp dword [ebp - 0x28], edi
jle 0x465d2c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor esi, esi
test eax, eax
jle 0x465d27
nop dword [eax]
mov eax, dword [ebp - 0x34]
push 0xcc0020
push 0
push 0
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 4]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 0x38]
push dword [edx + 8]
mov edx, dword [ebp - 0x30]
push eax
push ecx
imul eax, edi
imul ecx, esi
add eax, dword [edx + 8]
add ecx, dword [edx + 4]
push eax
push ecx
push dword [ebx + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0x2c]
inc esi
cmp esi, eax
jl 0x465ce0
mov ecx, dword [ebp - 0x28]
inc edi
cmp edi, ecx
jl 0x465cd7
push 0x200
mov ecx, ebx
call fcn.0045be40
mov ecx, dword [ebp - 0x34]
call fcn.00465420
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], vtable.FCPalette.0
call fcn.0048f8c0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], vtable.FCRect.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f18f
mov esp, ebp
pop ebp
ret 8
Function at 0x467e30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9668
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi]
mov eax, dword [eax]
cmp dword [esi + 0x150], ecx
jg 0x467e88
cmp dword [esi + 0x158], ecx
jle 0x467e88
cmp dword [esi + 0x154], eax
jg 0x467e88
cmp dword [esi + 0x15c], eax
jle 0x467e88
xor bl, bl
jmp 0x467e8a
mov bl, 1
test bl, bl
je 0x467ffe
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.FCString.0
call fcn.00451b70
push str.correctPosition:
push 0x100
lea ecx, [ebp - 0x18]
call fcn.00450e40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push str._narea:
call fcn.00450850
push 0x20
push 0
push 0xa
push dword [esi + 0x150]
lea ecx, [ebp - 0x18]
call fcn.00450650
push 0x4c3868
lea ecx, [ebp - 0x18]
call fcn.00450850
push 0x20
push 0
push 0xa
push dword [esi + 0x154]
lea ecx, [ebp - 0x18]
call fcn.00450650
push 0x4cce98
lea ecx, [ebp - 0x18]
call fcn.00450850
mov eax, dword [esi + 0x158]
lea ecx, [ebp - 0x18]
sub eax, dword [esi + 0x150]
push 0x20
push 0
push 0xa
push eax
call fcn.00450650
push 0x4c4b5c
lea ecx, [ebp - 0x18]
call fcn.00450850
mov eax, dword [esi + 0x15c]
lea ecx, [ebp - 0x18]
sub eax, dword [esi + 0x154]
push 0x20
push 0
push 0xa
push eax
call fcn.00450650
push str.__pos:
lea ecx, [ebp - 0x18]
call fcn.00450850
push 0x20
push 0
push 0xa
push dword [edi]
lea ecx, [ebp - 0x18]
call fcn.00450650
push 0x4c3868
lea ecx, [ebp - 0x18]
call fcn.00450850
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0x20
push 0
push 0xa
push dword [eax]
call fcn.00450650
push 0x4d7efc
lea ecx, [ebp - 0x18]
call fcn.00450850
mov eax, dword [ebp - 0x14]
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 0x10]
sub eax, 2
je 0x467fdb
sub eax, 2
je 0x467fd0
sub eax, 4
je 0x467fbe
mov eax, dword [esi + 0x150]
mov dword [edi], eax
jmp 0x467fe4
mov eax, dword [esi + 0x158]
dec eax
mov dword [edi], eax
mov eax, dword [esi + 0x15c]
dec eax
jmp 0x467fea
mov eax, dword [esi + 0x158]
dec eax
mov dword [edi], eax
jmp 0x467fe4
mov ecx, dword [esi + 0x158]
dec ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x154]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
lea ecx, [ebp - 0x18]
call fcn.00450480
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x469260
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
shr eax, 2
test al, 1
je 0x469273
pop ebp
jmp fcn.00469280
pop ebp
jmp fcn.00469280
Function at 0x470b90
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc478
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4ea160]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], ebx
cmp dword [eax + 8], 0
je 0x470cdd
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.FCRect.0
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [ebp - 4], 0
mov ecx, dword [esi + 8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x28], eax
sub eax, dword [ebx + 4]
mov esi, dword [ecx + 4]
cdq
idiv esi
mov edi, dword [ecx + 8]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 0x34], esi
mov esi, eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 8]
mov eax, ebx
sub eax, ecx
mov dword [ebp - 0x38], ecx
cdq
idiv edi
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2c]
imul edx, esi
sub dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x28]
cmp edx, dword [ecx + 4]
lea ecx, [esi + 1]
cmove ecx, esi
imul edi, eax
lea esi, [eax + 1]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x30]
sub ebx, edi
cmp ebx, dword [ebp - 0x38]
cmove esi, eax
mov dword [ebp - 0x28], esi
call fcn.0046e040
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
push dword [ecx + 8]
call dword [sym.imp.GDI32.dll_RealizePalette]
xor edi, edi
test esi, esi
jle 0x470cc7
mov ebx, dword [ebp - 0x34]
mov eax, esi
nop dword [eax]
xor esi, esi
test ebx, ebx
jle 0x470cc2
nop word [eax + eax]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
push 0xcc0020
push 0
mov eax, dword [eax + 8]
push 0
push dword [edx + 8]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
push ecx
push eax
imul ecx, edi
imul eax, esi
add ecx, dword [edx + 8]
add eax, dword [edx + 4]
push ecx
push eax
mov eax, dword [ebp - 0x3c]
push dword [eax + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
inc esi
cmp esi, ebx
jl 0x470c80
mov eax, dword [ebp - 0x28]
inc edi
cmp edi, eax
jl 0x470c70
mov ecx, dword [ebp - 0x30]
call fcn.0046ee90
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], vtable.FCRect.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f18f
mov esp, ebp
pop ebp
ret 8
Function at 0x4710c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4baaa8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x471164
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.FCPathName.0
mov dword [ebp - 0x18], vtable.FCString.0
call fcn.00451b70
push esi
push 0x200
lea ecx, [ebp - 0x18]
call fcn.00450e40
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.00453660
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x471147
and ecx, dword [ebp + 0xc]
mov edx, 1
cmp ecx, dword [ebp + 0xc]
cmove esi, edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], vtable.FCPathName.0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00450480
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x471470
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4baaa8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x471524
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.FCPathName.0
mov dword [ebp - 0x18], vtable.FCString.0
call fcn.00451b70
push esi
push 0x200
lea ecx, [ebp - 0x18]
call fcn.00450e40
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.00453660
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x471507
mov eax, dword [ebp + 0xc]
test eax, ecx
je 0x471507
not eax
and ecx, eax
mov eax, dword [ebp - 0x14]
push ecx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], vtable.FCPathName.0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00450480
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x471900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.004719a0
test eax, eax
jne 0x47194c
cmp dword [esi + 4], eax
je 0x47191b
mov ecx, esi
call fcn.00471960
mov ecx, dword [ebp + 0x10]
test cl, 4
je 0x47192a
mov dword [esi + 0xc], 1
lea eax, [esi + 8]
push eax
mov eax, dword [esi]
push ecx
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [eax + 4]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
pop esi
pop ebp
ret 0xc

Function at 0x471960
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x471999
call fcn.004719a0
test eax, eax
je 0x471982
mov eax, dword [esi + 4]
test eax, eax
je 0x471982
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
ret

Function at 0x4719e0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x471a04
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x471a07
cmp eax, 1
ja 0x471a07
mov dword [esi + 0xc], 0
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x472280
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc702
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004724c0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.FCChildWindow.0
mov dword [esi + 0x44], vtable.FCRect.0
movups xmm0, xmmword [eax + 4]
movups xmmword [esi + 0x48], xmm0
mov dword [ebp - 4], 2
mov dword [esi], vtable.FCViewport.0
add esi, 0x58
mov ecx, dword [eax + 0x10]
mov edi, dword [eax + 0xc]
sub ecx, dword [eax + 8]
sub edi, dword [eax + 4]
lea eax, [esi + 0x14]
mov dword [ebp + 8], esi
mov dword [esi], vtable.FCVSurface.0
push eax
mov dword [ebp + 0xc], ecx
mov dword [esi + 0x10], vtable.FCCriticalSection.0
mov dword [esi + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
push 1
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.0045bda0
mov byte [ebp - 4], 4
lea eax, [esi + 0x78]
push eax
mov dword [esi + 0x74], vtable.FCRect.0
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov byte [ebp - 4], 5
mov ecx, esi
call fcn.004642b0
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.0045cc30
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0xf0]
mov dword [esi + 0xec], vtable.FCCriticalSection.0
push eax
mov dword [esi + 0x108], 0
call edi
mov byte [ebp - 4], 7
lea eax, [esi + 0x110]
push eax
mov dword [esi + method.FCCriticalSection.virtual_0], vtable.FCCriticalSection.0
mov dword [esi + 0x128], 0
call edi
mov byte [ebp - 4], 8
mov dword [esi + method.FCXList_class_FCClickMap_.virtual_0], vtable.FCXList_class_FCClickMap_.0
mov dword [esi + 0x130], 0
mov dword [esi + 0x134], 0
mov byte [ebp - 4], 9
mov dword [esi + method.FCNList_class_FCViewportMagnifyContainer_.virtual_0], vtable.FCNList_class_FCViewportMagnifyContainer_.0
mov dword [esi + 0x13c], 0
mov dword [esi + 0x140], 0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x154]
mov dword [ebp + 0xc], ecx
mov dword [ecx], vtable.FCCaret.0
mov dword [ecx + 0x14], vtable.FCPoint.0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 0xb
call fcn.00466030
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x188]
mov dword [ecx], vtable.FCFont.0
mov dword [ecx + 0x40], 0
call fcn.00459ed0
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x1d0]
mov dword [esi + method.FCString.virtual_0], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [esi + 0x1d0]
call fcn.00450e40
mov byte [ebp - 4], 0xe
lea eax, [esi + 0x1e4]
push eax
mov dword [esi + method.FCCriticalSection.virtual_0], vtable.FCCriticalSection.0
mov dword [esi + 0x1fc], 0
call edi
mov byte [ebp - 4], 0xf
mov ecx, esi
call fcn.004665b0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x475e40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x5c3a41
mov bl, byte [esi]
add bl, 0x41
cmp bl, 0x5a
jg 0x475ebf
mov ecx, dword [esi]
mov edx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push edi
mov edi, dword [ebp + 0xc]
mov eax, 1
shl eax, cl
test dword [ebp - 8], eax
je 0x475eaa
lea eax, [ebp - 4]
mov byte [ebp - 4], bl
push eax
call edx
cmp edi, 0xffffffff
jne 0x475ea0
cmp eax, 1
je 0x475ea4
mov ecx, dword [esi]
pop edi
lea eax, [ecx + 1]
mov dword [esi], eax
mov eax, ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, edi
je 0x475e90
mov edx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
inc dword [esi]
inc bl
mov ecx, dword [esi]
cmp bl, 0x5a
jle 0x475e71
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476b70
Capabilities:
Get memory capacity

Disassembly:
add ecx, 8
push ecx
mov dword [ecx], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
ret
Function at 0x47d2f0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x47d310
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47d310
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi + 0x864a4]
test esi, esi
je 0x47d337
mov eax, dword [esi + 4]
test eax, eax
je 0x47d337
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47d337
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret