joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433d90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xbc], 0xffffffff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x433dbf
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x433ddd
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x6c], 0
je 0x433dec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
movsx ecx, word [ebp + 0xc]
mov eax, 0x88888889
imul ecx, dword [esi + 0xc0]
push 1
push dword [esi + 4]
imul ecx
add edx, ecx
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
call dword [sym.imp.USER32.dll_GetScrollPos]
mov edx, eax
test edi, edi
jle 0x433e2f
mov ecx, dword [esi + 0x9c]
xor edx, edx
imul ecx, edi
sub eax, ecx
test eax, eax
cmovg edx, eax
jmp 0x433e3a
mov eax, dword [esi + 0x9c]
imul eax, edi
sub edx, eax
push 0
push edx
push 1
mov ecx, esi
call fcn.00435280
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x433fd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0x3ec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [esi + 0x100], 0
je 0x43400a
push dword [esi + 0x100]
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x43400a
mov dword [esi + 0x100], 0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x434034
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x434052
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 4]
mov dword [ebp - 8], 0xffffffff
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0xffffffff
push eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.004320f0
test eax, eax
je 0x4340b6
push edi
mov edi, dword [ebp - 8]
mov ecx, esi
push edi
call fcn.0050f820
mov ecx, esi
test eax, eax
jne 0x43409f
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call fcn.004355a0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
push eax
push edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], eax
call fcn.00431190
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x434240
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x583384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor ecx, ecx
lea eax, [ebx + 0x20]
push esi
test eax, eax
mov esi, ebx
push edi
mov edi, dword [ebp + 0xc]
cmove esi, ecx
cmp byte [eax + 0x1c], cl
je 0x434296
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x434287
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43429b
test edi, edi
jne 0x434296
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43429b
cmp edi, 1
je 0x4342b1
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
cwde
push eax
movsx eax, cx
lea ecx, [esi + 0x20]
push eax
call fcn.00424cb0
push 0
push 0
push 0x130b
push dword [ebx + 0x744]
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x744]
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 4]
push dword [ebx + 0x744]
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, 2
add edx, dword [ebx + 0x748]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
sub ecx, 3
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
inc esi
push 0x10
mov dword [ebp - 8], eax
sub eax, edx
push eax
mov dword [ebp - 0xc], ecx
sub ecx, esi
push ecx
push edx
push esi
push 0
push dword [ebx + 0x3c4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edx
call edi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
push dword [ebx + 0x3c4]
call esi
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x10
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push 0
push dword [ebx + 0x44]
call edi
push 1
push 0
push dword [ebx + 0x44]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00513512
mov esp, ebp
pop ebp
ret 0x10

Function at 0x434380
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0
mov edi, ecx
push 0
push 0x130b
push dword [edi + 0x744]
call esi
push 0
push 0
push 0x130b
push dword [edi + 0x744]
call esi
test eax, eax
jne 0x4343c0
mov ebx, dword [edi + 0x44]
mov eax, dword [edi + 0x3c4]
jmp 0x4343c9
mov eax, dword [edi + 0x44]
mov ebx, dword [edi + 0x3c4]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ebx
mov dword [ebp - 4], eax
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
push ebx
call esi
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
mov ebx, dword [ebp - 4]
push 0
push ebx
call edi
push 0
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x434510
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x583384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x6c], 0
je 0x434533
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xbc], 0xffffffff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x43455b
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x434579
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [esi + 0x24], 0
je 0x43459e
mov eax, dword [esi + 0xa0]
mov dword [ebp - 0x10], eax
jmp 0x4345a5
mov dword [ebp - 0x10], 0
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, 8
ja case.default.0x4345be
jmp dword [eax*4 + 0x43469c]
xor edi, edi
jmp 0x43464c
mov eax, edi
xor edi, edi
sub eax, dword [esi + 0x9c]
test eax, eax
cmovg edi, eax
jmp 0x43464c
sub edi, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
add eax, edi
xor edi, edi
test eax, eax
cmovg edi, eax
jmp 0x43464c
mov edi, dword [esi + 0x384]
imul edi, dword [esi + 0x9c]
jmp 0x43464c
add edi, dword [esi + 0x9c]
jmp 0x43464c
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
add edi, eax
jmp 0x43464c
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0
push eax
xorps xmm0, xmm0
push 1
push dword [esi + 4]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x30], 0x1c
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x2c], 0x10
call dword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
je case.default.0x4345be
mov eax, dword [ebp - 0x18]
cmp eax, edi
je case.default.0x4345be
mov edi, eax
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
push 0
push edi
push 1
mov ecx, esi
call fcn.00435280
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513512
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 0x70], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00513512
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4353c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x583384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xbc], 0xffffffff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x4353fd
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43541b
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx edi, ax
xorps xmm0, xmm0
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0xc4]
mov ebx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0xc]
dec ebx
add ebx, ecx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x18], ebx
je 0x435503
cmp dword [esi + 0x3c], 0
je 0x4354d5
cmp dword [esi + 0x58], 0
je 0x4354d5
mov eax, edi
sub eax, dword [esi + 0xec]
test eax, eax
jg 0x4354d5
cmp edi, dword [esi + 0xf4]
jge 0x43558b
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
cmp eax, ebx
jl 0x43558b
push dword [esi + 0xdc]
mov ecx, esi
call fcn.004aa530
mov ecx, edi
sub ecx, dword [esi + 0xec]
add eax, ecx
test eax, eax
jle 0x4354c7
push dword [esi + 0xdc]
mov ecx, esi
call fcn.004aa530
sub edi, dword [esi + 0xec]
add eax, edi
mov dword [esi + 0xf0], eax
push eax
jmp 0x43557e
xor eax, eax
mov dword [esi + 0xf0], eax
push eax
jmp 0x43557e
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0xf4], edi
pop edi
mov dword [esi + 0x60], 0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513512
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0xf0]
xor ebx, ebx
sub eax, dword [esi + 0xf4]
add eax, edi
test eax, eax
cmovg ebx, eax
cmp dword [esi + 0x58], 0
je 0x435577
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
cmp eax, dword [ebp - 0x18]
jl 0x435577
push dword [esi + 0xdc]
mov ecx, esi
call fcn.004aa530
cmp ebx, eax
jge 0x435577
cmp dword [esi + 0x60], 0
jne 0x43558b
push 0
push 0x14
push 0x3e9
push dword [esi + 4]
mov dword [esi + 0x60], 1
mov dword [esi + 0xec], edi
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513512
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x60], 0
jne 0x43558b
push ebx
push dword [esi + 0xdc]
mov ecx, esi
call fcn.004357b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00513512
mov esp, ebp
pop ebp
ret 4

Function at 0x435830
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0xa8], edx
mov dword [ecx + 0xac], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], edx
pop ebp
jmp fcn.00431190
Function at 0x43f8f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f438
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x583384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, 0x300
cmp ax, word [ebp + 8]
jne 0x43f9aa
call fcn.00406110
mov ecx, eax
test ecx, ecx
jne 0x43f93a
push 0x80004005
call fcn.004063a0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x200
or eax, ecx
mov dword [ebp - 4], 0
jge 0x43f970
push 0x200
lea ecx, [ebp + 8]
call fcn.00406dd0
mov esi, dword [ebp + 8]
push 0x200
push esi
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push esi
lea ecx, [edi + 0x84]
call fcn.004b3260
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43f9aa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x440260
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x583384]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x90
lea eax, [ebp - 0x94]
mov dword [ebp - 0x98], 0x94
push 0
push eax
call fcn.00517590
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4402e9
cmp dword [ebp - 0x94], 6
jb 0x4402e9
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x9c], 0
push eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0xa0], 0
push ecx
call fcn.0043ee20
add esp, 8
test eax, eax
js 0x4402e9
cmp dword [ebp - 0x9c], 6
mov eax, 0x64
jae 0x4402ee
mov eax, 0x50
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513512
mov esp, ebp
pop ebp
ret
Function at 0x444680
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b2e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x583384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.0040db70
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 4]
call fcn.00453160
lea edi, [esi + 0x1a8]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x28]
lea ebx, [esi + 0x124]
push eax
mov ecx, ebx
call fcn.00450810
mov ecx, esi
call fcn.00444430
cmp dword [ebp + 8], 0
je 0x444731
push 0x10
call fcn.005134da
add esp, 4
lea ecx, [esi + 0x5c]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push 0x444790
push 0
push 0
mov dword [eax + 4], ebx
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
je 0x444731
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x18]
call fcn.004121e0
push dword [ebp - 0x18]
call fcn.0051350d
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.004121e0
push dword [ebp - 0x20]
call fcn.0051350d
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.004121e0
push dword [ebp - 0x28]
call fcn.0051350d
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x446350
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x583384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
mov esi, ecx
lea eax, [ebp - 0x108]
push 0x24
push eax
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4463c0
push 0x160
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.00517590
add esp, 0xc
lea eax, [ebp - 0x268]
push 0x4000
push 0x160
push eax
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 0x264]
mov dword [esi + 0x2fc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00513512
mov esp, ebp
pop ebp
ret

Function at 0x4463d0
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x583384]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x24
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x446444
push 0x160
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.00517590
add esp, 0xc
lea eax, [ebp - 0x268]
push 0x4000
push 0x160
push eax
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513512
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
call fcn.00513512
mov esp, ebp
pop ebp
ret
Function at 0x446a00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b658
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x583384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x446a3f
mov eax, 0x80004003
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.0044d610
add esp, 4
test eax, eax
je 0x446b27
call fcn.00406110
mov ecx, eax
test ecx, ecx
jne 0x446a65
push 0x80004005
call fcn.004063a0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
cmp dword [ebp + 0xc], 0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
je 0x446a89
push 0xc
push str.__explore___
jmp 0x446a90
push 0xb
push str.__select___
call fcn.00407040
mov ecx, esi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446aa0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp + 8]
call fcn.004241f0
push 1
push 0x547394
lea ecx, [ebp + 8]
call fcn.004241f0
mov esi, dword [ebp + 8]
push 1
push 0
push esi
push str.explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x20
jbe 0x446b12
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446b00
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446b27
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x447350
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
mov eax, dword [0x583384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x278]
mov dword [ebp - 0x114], 0x24
mov ebx, ecx
mov dword [ebp - 0x110], 0x25
push eax
push 0x11
mov dword [ebp - 0x10c], 0
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x4474ca
push 0x160
lea eax, [ebp - 0x274]
push 0
push eax
call fcn.00517590
add esp, 0xc
lea eax, [ebp - 0x274]
push 0x4208
push 0x160
push eax
push 0
push dword [ebp - 0x278]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
js 0x4474b4
lea eax, [ebp - 0x268]
mov dword [ebp - 0x2ac], 0xffff0002
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x270]
push 0xc
mov dword [ebp - 0x2b0], 0xffff0000
mov dword [ebp - 0x2a8], 0x67
mov dword [ebp - 0x294], 0x104
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], 1
call fcn.005134da
mov esi, eax
add esp, 4
mov dword [ebp - 0x27c], esi
test esi, esi
je 0x44745f
call fcn.00406110
mov ecx, eax
test ecx, ecx
je 0x447523
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 8], eax
jmp 0x447461
xor esi, esi
lea eax, [ebp - 0x2b0]
mov byte [esi], 1
push eax
push 0
mov dword [esi + 4], 0x11
push 0x1100
push dword [ebx + 0x21c]
mov dword [ebp - 0x284], esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
call esi
mov edi, eax
push edi
push 9
push 0x110b
push dword [ebx + 0x21c]
call esi
push dword [ebp - 0x298]
mov ecx, ebx
call fcn.00445e00
push edi
mov ecx, ebx
call fcn.0044b420
push dword [ebp - 0x278]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x278], 0
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor esi, esi
nop dword [eax]
nop word [eax + eax]
push 0
push dword [ebp + esi*4 - 0x114]
lea eax, [ebp - 0x108]
push eax
push dword [ebx + 4]
call edi
test eax, eax
je 0x44750c
push 0xffff0000
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
call fcn.00446b40
inc esi
cmp esi, 3
jb 0x4474e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00513512
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004063a0
int3
Function at 0x44add0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x583384]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x164]
push 0x160
push 0
push eax
call fcn.00517590
add esp, 0xc
test edi, edi
jne 0x44ae12
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513512
mov esp, ebp
pop ebp
ret
cmp byte [edi], 0
jne 0x44afc6
mov byte [edi], 1
cmp dword [edi + 0x54], 0x10
push esi
jb 0x44ae2a
mov eax, dword [edi + 0x40]
jmp 0x44ae2d
lea eax, [edi + 0x40]
push ebx
push eax
call fcn.0044d4f0
add esp, 4
test eax, eax
je 0x44ae8c
cmp dword [edi + 0x54], 0x10
jb 0x44ae46
mov eax, dword [edi + 0x40]
jmp 0x44ae49
lea eax, [edi + 0x40]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea ecx, [ebp - 0x164]
push 0x4600
push 0x160
push ecx
push 0
push eax
call ebx
test eax, eax
jne 0x44aee1
cmp dword [edi + 0x54], 0x10
jb 0x44ae74
mov eax, dword [edi + 0x40]
jmp 0x44ae77
lea eax, [edi + 0x40]
push 0x4610
push 0x160
lea ecx, [ebp - 0x164]
push ecx
push 0x10
jmp 0x44aede
cmp dword [edi + 0x54], 0x10
jb 0x44ae97
mov eax, dword [edi + 0x40]
jmp 0x44ae9a
lea eax, [edi + 0x40]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea ecx, [ebp - 0x164]
push 0x4600
push 0x160
push ecx
push 0
push eax
call ebx
test eax, eax
jne 0x44aee1
cmp dword [edi + 0x54], 0x10
jb 0x44aec5
mov eax, dword [edi + 0x40]
jmp 0x44aec8
lea eax, [edi + 0x40]
push 0x4610
push 0x160
lea ecx, [ebp - 0x164]
push ecx
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x160]
pop ebx
test eax, eax
jg 0x44aefc
mov ecx, 0x4000
test word [edi + 0xe], cx
je 0x44aefc
call fcn.004463d0
lea ecx, [ebp - 0x158]
mov dword [edi + 0x88], eax
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44af10
sub ecx, edx
je 0x44af3a
xor eax, eax
lea esi, [edi + 0x58]
cmp byte [ebp - 0x158], al
cmove ecx, eax
lea eax, [ebp - 0x158]
push ecx
push eax
mov ecx, esi
call fcn.00404fc0
jmp 0x44af73
cmp dword [edi + 0x54], 0x10
jb 0x44af45
mov eax, dword [edi + 0x40]
jmp 0x44af48
lea eax, [edi + 0x40]
push 0x5c
push eax
call fcn.00516a90
add esp, 8
test eax, eax
je 0x44af5a
inc eax
jmp 0x44af68
cmp dword [edi + 0x54], 0x10
jb 0x44af65
mov eax, dword [edi + 0x40]
jmp 0x44af68
lea eax, [edi + 0x40]
lea esi, [edi + 0x58]
push eax
mov ecx, esi
call fcn.004058c0
lea ecx, [ebp - 0x54]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44af80
sub ecx, edx
je 0x44afa2
xor eax, eax
cmp byte [ebp - 0x54], al
cmove ecx, eax
lea eax, [ebp - 0x54]
push ecx
push eax
lea ecx, [edi + 0x70]
call fcn.00404fc0
jmp 0x44afb4
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x44afb1
mov esi, dword [esi]
mov byte [esi], 0
mov eax, dword [ebp - 0x164]
pop esi
test eax, eax
je 0x44afc6
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop edi
call fcn.00513512
mov esp, ebp
pop ebp
ret