joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d650
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbac
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, 0x45f53a
push 0x73
push ebx
call sub.USER32.dll_IsDlgButtonChecked
mov dword [ebp - 4], eax
push 0x6c
push ebx
call sub.USER32.dll_IsDlgButtonChecked
mov dword [ebp - 8], eax
push 0x4c
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.00452e2c
mov dword [ebp - 0x54], 0x4c
mov dword [ebp - 0x50], ebx
mov edx, dword [0x466a00]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x38], esi
add esp, 0xc
mov dword [ebp - 0x34], 0x400
push 0x140
call fcn.00408028
mov dword [ebp - 0x24], eax
push esi
call fcn.0040809c
cmp esi, eax
jne 0x40d6de
lea ecx, [ebp - 0x454]
push ecx
push 0x400
call sub.KERNEL32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x454]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x1080c
cmp dword [ebp - 8], 0
je 0x40d6fb
mov dword [ebp - 0x18], 0x45f576
mov dword [ebp - 0x3c], 4
jmp 0x40d71f
cmp dword [ebp - 4], 0
je 0x40d711
mov dword [ebp - 0x18], 0x45f57a
mov dword [ebp - 0x3c], 2
jmp 0x40d71f
mov dword [ebp - 0x18], 0x45f57e
mov dword [ebp - 0x3c], 3
lea edx, [ebp - 0x54]
push edx
call sub.COMDLG32.dll_GetOpenFileNameA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d734
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff780
push ebx
push esi
push edi
mov esi, 1
cmp dword [ebp + 8], 0
mov ebx, dword [ebp + 0xc]
je 0x40d755
mov eax, 0x45f582
jmp 0x40d75a
mov eax, 0x45f587
mov edi, eax
xor eax, eax
push esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0xc]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov byte [ebx], 0
push 0x4656f0
call fcn.0042333c
dec eax
jne 0x40d7f0
lea eax, [ebp - 0x30]
push eax
call fcn.004262c0
lea edx, [ebp - 0x28]
push edx
call fcn.004262c0
push 0
push 0x4656f0
call fcn.00423214
lea ecx, [ebp - 0x480]
push ecx
push 0x4656f0
call fcn.00423214
xor eax, eax
lea edi, [ebp - 0x480]
or ecx, 0xffffffff
mov esi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebp - 0x20], 0x10
setne al
and eax, 1
mov esi, eax
jmp 0x40d830
lea eax, [ebp - 0x880]
push eax
push 0x400
call sub.KERNEL32.dll_GetCurrentDirectoryA
lea edx, [ebp - 0x880]
push edx
call fcn.0040809c
mov edi, eax
xor eax, eax
push esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
cmp byte [ebx], 0
jne 0x40d844
push esi
mov edi, ebx
mov eax, edi
mov esi, 0x45f58c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
jmp 0x40d84a
push ebx
call fcn.0040da08
push 0x2e
push ebx
call fcn.00453124
add esp, 8
test esi, esi
jne 0x40d864
test eax, eax
je 0x40d864
cmp ebx, eax
je 0x40d864
mov byte [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d924
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa00
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x5c
push edi
call fcn.00453124
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40d955
cmp edi, ebx
je 0x40d955
xor eax, eax
mov al, byte [ebx - 1]
cmp eax, 0x3a
jne 0x40d95f
mov eax, 1
jmp 0x40d9fc
push esi
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x400]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
sub ebx, edi
mov byte [ebp + ebx - 0x400], 0
jmp 0x40d9e6
push 0x14d
call fcn.00408028
push eax
lea eax, [ebp - 0x400]
push eax
push 0x45f5b2
lea edx, [ebp - 0x600]
push edx
call fcn.00456f9c
add esp, 0x10
push 0x34
push 0x65
call fcn.00408028
push eax
lea ecx, [ebp - 0x600]
push ecx
push esi
call sub.USER32.dll_MessageBoxA
cmp eax, 6
jne 0x40d9e2
lea eax, [ebp - 0x400]
push eax
call fcn.00408838
jmp 0x40d9e6
xor eax, eax
jmp 0x40d9fc
lea edx, [ebp - 0x400]
push edx
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40d992
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40df58
Capabilities:
Create directory
Delete directory
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff914
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call fcn.004262c0
lea edx, [ebp - 0x1c]
push edx
call fcn.004262c0
lea ecx, [ebp - 0x474]
push ecx
push 0x4656f0
call fcn.00423384
test al, al
jne 0x40df99
xor eax, eax
jmp 0x40e124
lea edx, [ebp - 0x874]
push edx
push 0x400
call sub.KERNEL32.dll_GetTempPathA
lea ecx, [ebp - 0x874]
push ecx
call fcn.004080c8
push 0x45f674
lea eax, [ebp - 0x874]
push eax
call fcn.00452e5c
add esp, 8
lea edx, [ebp - 0x874]
push edx
call fcn.00456624
pop ecx
test eax, eax
je 0x40dfed
push 0
lea ecx, [ebp - 0x874]
push ecx
call sub.KERNEL32.dll_CreateDirectoryA
test eax, eax
jne 0x40dff4
xor eax, eax
jmp 0x40e124
lea edx, [ebp - 0xc74]
push edx
push 0x400
call sub.KERNEL32.dll_GetCurrentDirectoryA
lea ecx, [ebp - 0x874]
push ecx
call fcn.00457f40
pop ecx
push 0x938
push 0
lea eax, [ebp - 0x15ac]
push eax
call fcn.00452e2c
add esp, 0xc
lea edx, [ebp - 0x15ac]
push edx
push 0x465fe5
call fcn.0041eca0
push 0x465fe5
call fcn.0041834e
mov dword [ebp - 0x11ac], eax
xor eax, eax
or ecx, 0xffffffff
mov edi, 0x4668cb
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x11a0]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x474]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x11a8], eax
xor edx, edx
mov dword [ebp - 0x11a4], 1
mov dword [ebp - 0xca0], edx
xor ecx, ecx
mov dword [ebp - 0xc9c], ecx
lea eax, [ebp - 0x15ac]
push eax
push 0x465fe5
call fcn.0041ecdc
xor edi, edi
lea eax, [ebp - 0x16ec]
push eax
push 0x45f681
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp eax, 0xffffffff
je 0x40e105
xor ebx, ebx
test byte [ebp - 0x16ec], 0x10
je 0x40e0e6
lea eax, [ebp - 0x16ec]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
sete bl
and ebx, 1
test ebx, ebx
je 0x40e0c4
push esi
call sub.KERNEL32.dll_FindClose
test ebx, ebx
jne 0x40e105
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x16c0]
push edx
call fcn.004085c4
mov edi, 1
lea eax, [ebp - 0xc74]
push eax
call fcn.00457f40
pop ecx
test edi, edi
jne 0x40e122
lea edx, [ebp - 0x874]
push edx
call sub.KERNEL32.dll_RemoveDirectoryA
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40fed8
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffbec
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x46bed0
push 0x46becc
push 0x465fe5
call fcn.0041f098
push 0
mov eax, dword [0x4656d8]
push 0x4100bc
push eax
mov edx, dword [0x466a00]
push 0x45f773
push edx
call sub.USER32.dll_DialogBoxParamA
test eax, eax
je 0x4100b3
lea ecx, [ebp - 0x400]
push ecx
push 0x400
call sub.KERNEL32.dll_GetTempPathA
lea eax, [ebp - 0x400]
push eax
call fcn.004080c8
push 0x45f77e
lea edx, [ebp - 0x400]
push edx
call fcn.00452e5c
add esp, 8
lea ecx, [ebp - 0x400]
push ecx
call fcn.00456624
pop ecx
test eax, eax
je 0x40ff84
push 0x45f78b
lea eax, [ebp - 0x400]
push eax
call fcn.00455e68
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40ffa3
lea edx, [ebp - 0x400]
push edx
push 0x1f6
call fcn.00408028
push eax
call fcn.00414028
add esp, 8
jmp 0x41009c
push ebx
mov ecx, dword [0x46bed0]
push ecx
push 1
mov eax, dword [0x46becc]
push eax
call fcn.004562d0
add esp, 0x10
push ebx
call fcn.004559e4
pop ecx
test esi, esi
jne 0x40ffff
push 0x1014
push 0
lea edx, [ebp - 0x1414]
push edx
call fcn.00452e2c
add esp, 0xc
lea ecx, [ebp - 0x1414]
push ecx
push 0x465fe5
call fcn.0041eca0
push 0x465fe5
call fcn.0041834e
mov dword [ebp - 0x1014], eax
jmp 0x41000e
push esi
lea edi, [ebp - 0x1414]
mov ecx, 0x405
rep movsd dword es:[edi], dword [esi]
pop esi
xor eax, eax
lea edi, [ebp - 0x400]
or ecx, 0xffffffff
lea esi, [ebp - 0x1010]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x410], 0
jne 0x410057
push 0
push 0x45f79a
push 0x45f78e
call fcn.0040bb50
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x40c], 0
jne 0x41007f
or ebx, 0xffffffff
push 0
push 0x45f7ae
push 0x45f7a2
call fcn.0040bb50
test eax, eax
jne 0x410079
inc ebx
mov dword [ebp - 0x40c], ebx
lea eax, [ebp - 0x1414]
push eax
push 0x465fe5
call fcn.0041f148
lea edx, [ebp - 0x400]
push edx
call sub.KERNEL32.dll_DeleteFileA
mov ecx, dword [0x46becc]
push ecx
call fcn.00459d7c
pop ecx
push 0x4656f0
call fcn.00420794
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x411e84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ac
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push 0x400
push 0x45fa07
lea eax, [ebp - 0x400]
push eax
push 0x45f9f8
push 0x45f9f1
call fcn.0040ba80
cmp byte [ebp - 0x400], 0
jne 0x411ec3
xor eax, eax
jmp 0x411fb0
push ebx
lea edx, [ebp - 0x400]
push edx
push 0x45fa08
lea ecx, [ebp - 0x800]
push ecx
call fcn.00456f9c
add esp, 0x10
lea eax, [ebp - 0x844]
push 0x44
push 0
push eax
call fcn.00452e2c
add esp, 0xc
lea edx, [ebp - 0x854]
mov dword [ebp - 0x844], 0x44
push edx
lea ecx, [ebp - 0x844]
push ecx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x800]
push 0
push eax
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
je 0x411f91
mov edx, dword [ebp - 0x854]
xor eax, eax
mov dword [0x46d100], edx
mov edi, ebx
or ecx, 0xffffffff
mov esi, 0x46d104
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0x10], 0
je 0x411f77
push 0x46d100
push 0x10000
push 0x410714
call fcn.0045bb50
add esp, 0xc
jmp 0x411f83
mov eax, dword [ebp - 0x854]
push eax
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x850]
push edx
call sub.KERNEL32.dll_CloseHandle
jmp 0x411fab
lea ecx, [ebp - 0x800]
push ecx
push 0x201
call fcn.00408028
push eax
call fcn.00414028
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x411fbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x3c
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.00452e2c
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x500
test edi, edi
je 0x411ff7
or dword [ebp - 0x38], 0x40
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
push edx
push esi
call fcn.004120dc
mov dword [ebp - 0x30], eax
push 0x45fa0e
push ebx
call fcn.00453150
add esp, 8
test eax, eax
jne 0x41202b
push 0x45fa12
push ebx
call fcn.00453150
add esp, 8
test eax, eax
je 0x412053
push ebx
call fcn.0040809c
cmp ebx, eax
jne 0x412053
push ebx
push 0x45fa16
lea ecx, [ebp - 0x83c]
push ecx
call fcn.00456f9c
add esp, 0xc
lea eax, [ebp - 0x83c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 1
lea edx, [ebp - 0x3c]
push edx
call sub.SHELL32.DLL_ShellExecuteExA
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test edi, edi
je 0x4120b7
test esi, esi
je 0x4120b7
mov eax, dword [ebp - 4]
push esi
mov dword [0x46d504], eax
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, 0x46d508
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x46d504
push 0x10000
push 0x410714
call fcn.0045bb50
add esp, 0xc
test esi, esi
jne 0x4120cb
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x483
jne 0x4120cb
xor eax, eax
jmp 0x4120d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4120dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push 0x2e
mov eax, dword [ebp + 0xc]
push eax
call fcn.00453124
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4120fe
xor eax, eax
jmp 0x412190
mov dword [ebp - 4], 0x50
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x58]
push ecx
push ebx
push 0x80000000
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
je 0x412120
xor eax, eax
jmp 0x412190
push 0x45fa1b
lea edx, [ebp - 0x58]
push edx
call fcn.00452e5c
add esp, 8
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x58]
push eax
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
je 0x41214b
xor eax, eax
jmp 0x412190
mov dword [ebp - 4], 0x50
lea edx, [ebp - 4]
push edx
push 0x46d908
push 0
push 0
push 0x45fa22
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
je 0x412175
xor eax, eax
jmp 0x412190
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [0x46d908], 0
jne 0x41218b
xor eax, eax
jmp 0x412190
mov eax, 0x46d908
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x412198
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x466ac8
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4121d3
push 0x40
push 0x2bc
call fcn.00408028
push eax
push 0x2bd
call fcn.00408028
push eax
mov eax, dword [0x4656d8]
push eax
call sub.USER32.dll_MessageBoxA
jmp 0x4121e0
push 0
push 0x466ac8
push ebx
call fcn.00410ff0
pop ebx
pop ebp
ret 4
Function at 0x4131fc
Capabilities:
Get graphical window text

Disassembly:
add esp, 0xfffffe00
mov eax, dword [0x4656e4]
test eax, eax
je 0x41329f
push 0x200
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.dll_GetWindowTextA
mov eax, esp
mov edx, 0x46ed64
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x413242
test cl, cl
je 0x413254
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x413242
add eax, 2
add edx, 2
test cl, cl
jne 0x413226
je 0x413254
push 0x46ed64
mov eax, dword [0x4656e4]
push eax
call sub.USER32.dll_SetWindowTextA
mov eax, dword [0x46ed60]
test eax, eax
je 0x413267
cmp eax, 1
je 0x413267
cmp eax, 2
jne 0x413287
push 0x46ee64
push 0x6a
call fcn.00413fc0
push 0x46eee4
call fcn.0040809c
push eax
push 0x69
call fcn.00413fc0
jmp 0x413293
push 0x46ede4
push 0x6d
call fcn.00413fc0
mov edx, dword [0x4656e4]
push edx
call sub.USER32.dll_UpdateWindow
add esp, 0x200
ret
Function at 0x413b88
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
cmp byte [0x46f4e8], 0
push ebx
push esi
push edi
je 0x413bae
call fcn.0045c2ec
mov dword [0x46f4e4], eax
mov byte [0x46f4e8], 0
call fcn.0045c2ec
mov esi, eax
sub esi, dword [0x46f4e4]
test esi, esi
jne 0x413bc4
mov esi, 1
mov eax, esi
xor edx, edx
mov ecx, 0x3e8
mov edi, 0x3c
div ecx
mov ebx, eax
xor edx, edx
mov eax, ebx
mov ecx, 0xe10
div ecx
mov ecx, eax
mov eax, ecx
shl eax, 4
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
push eax
mov eax, ebx
pop edx
push ecx
sub eax, edx
xor edx, edx
div edi
mov edi, eax
mov eax, ebx
xor edx, edx
mov ecx, 0x3c
div ecx
mov eax, edx
pop ecx
push eax
push edi
push ecx
lea edx, [ebp - 0xe0]
push 0x45faf8
push edx
call fcn.00456f9c
add esp, 0x14
lea ecx, [ebp - 0xe0]
push ecx
push 0x68
call fcn.00413fc0
cmp dword [0x46ed60], 0
jne 0x413d9e
add esp, 0xfffffff8
push esi
lea eax, [esp + 4]
push eax
call fcn.004262cc
add esp, 0xfffffff8
add esp, 0xfffffff8
push 0x3e8
lea edx, [esp + 4]
push edx
call fcn.004262cc
add esp, 0xfffffff8
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
push edx
call fcn.00426500
lea ecx, [ebp - 8]
push ecx
call fcn.004263b8
lea eax, [ebp - 8]
push eax
call fcn.0041844c
mov esi, eax
test esi, esi
jne 0x413c98
mov esi, 0x64
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
add esp, 0xfffffff8
mov ecx, dword [ebp + 0x10]
mov dword [esp], ecx
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
call fcn.004267f4
test al, al
je 0x413cde
add esp, 0xfffffff8
mov edx, dword [ebp + 8]
lea eax, [ebp + 0x10]
mov dword [esp], edx
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x10]
mov dword [esp + 4], ecx
push eax
push edx
call fcn.004262f8
add esp, 0xfffffff8
push ebx
lea ecx, [esp + 4]
push ecx
call fcn.004262cc
add esp, 0xfffffff8
add esp, 0xfffffff8
push esi
lea eax, [esp + 4]
push eax
call fcn.004262cc
add esp, 0xfffffff8
add esp, 0xfffffff8
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], ecx
add esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
mov edx, dword [ebp + 0x14]
mov dword [esp + 4], edx
lea ecx, [esp + 0x10]
push ecx
call fcn.004266c0
lea eax, [esp + 0x10]
push eax
call fcn.004263b8
lea edx, [ebp - 0x18]
push edx
call fcn.00426694
lea ecx, [ebp - 0x18]
push ecx
call fcn.0041844c
mov ebx, eax
xor edx, edx
mov eax, ebx
mov ecx, 0xe10
div ecx
mov ecx, eax
mov eax, ebx
xor edx, edx
mov esi, 0xe10
div esi
mov eax, edx
mov esi, 0x3c
cdq
idiv esi
mov edi, eax
mov eax, ebx
mov ebx, 0x3c
xor edx, edx
div ebx
mov eax, edx
lea edx, [ebp - 0xe0]
push eax
push edi
push ecx
push 0x45fb07
push edx
call fcn.00456f9c
add esp, 0x14
lea ecx, [ebp - 0xe0]
push ecx
push 0x65
call fcn.00413fc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x413fc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x4656e4]
push edx
call sub.USER32.dll_GetDlgItem
mov ebx, eax
lea eax, [ebp - 0x200]
push 0x200
push eax
push ebx
call sub.USER32.dll_GetWindowTextA
mov eax, esi
lea edx, [ebp - 0x200]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x414016
test cl, cl
je 0x41401f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x414016
add eax, 2
add edx, 2
test cl, cl
jne 0x413ffa
je 0x41401f
push esi
push ebx
call sub.USER32.dll_SetWindowTextA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x414930
Capabilities:
Copy file
Get file attributes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3fc
cmp dword [0x466aa0], 0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
je 0x414953
push esi
call sub.SHELL32.DLL_DragFinish
jmp 0x414b33
push 0
push 0
push 0xffffffffffffffff
push esi
call sub.SHELL32.DLL_DragQueryFileA
mov edi, eax
cmp edi, 1
jne 0x414ab4
push 0x400
lea eax, [ebp - 0x404]
push eax
push 0
push esi
call sub.SHELL32.DLL_DragQueryFileA
cmp dword [0x466a98], 0
jne 0x4149b8
lea edx, [ebp - 0x404]
push edx
call sub.KERNEL32.dll_GetFileAttributesA
test al, 0x10
jne 0x4149b8
push 1
lea ecx, [ebp - 0x404]
push ecx
push 0x4656f0
call fcn.00421670
dec eax
jne 0x4149b8
push esi
call sub.SHELL32.DLL_DragFinish
jmp 0x414b33
cmp byte [0x460c80], 0
jne 0x414ab4
push 7
push 0x45fbbf
lea eax, [ebp - 0x404]
push eax
call fcn.0040809c
push eax
call fcn.00453098
add esp, 0xc
test eax, eax
jne 0x414ab4
push 0x400
lea edx, [ebp - 0x804]
push edx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
lea ecx, [ebp - 0x804]
push ecx
call fcn.0040809c
mov edi, eax
mov esi, 0x45fbc7
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0
lea edx, [ebp - 0x804]
push edx
lea ecx, [ebp - 0x404]
push ecx
call sub.KERNEL32.dll_CopyFileA
mov eax, dword [0x4656d8]
push eax
call sub.USER32.dll_SetForegroundWindow
push 1
mov edx, dword [0x4656d8]
push edx
call sub.USER32.dll_FlashWindow
push 1
call fcn.00437800
mov byte [0x460c80], al
push 0
mov ecx, dword [0x4656d8]
push ecx
call sub.USER32.dll_FlashWindow
cmp dword [0x466a98], 0
je 0x414a73
push 0x4656f0
call fcn.00420794
jmp 0x414a82
push 0x45fbd2
push 0x4656f0
call fcn.0041f7c4
cmp byte [0x460c80], 0
je 0x414b33
push 0x30
push 0x368
call fcn.00408028
push eax
push 0x367
call fcn.00408028
push eax
mov eax, dword [0x4656d8]
push eax
call sub.USER32.dll_MessageBoxA
jmp 0x414b33
push 0x418458
push 5
push edi
push 0x474
push 0
call fcn.00459ed4
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414b33
xor ebx, ebx
cmp edi, ebx
jle 0x414afd
push 0x400
lea eax, [ebx + ebx*8]
shl eax, 3
sub eax, ebx
lea eax, [ebx + eax*4]
shl eax, 2
add eax, dword [ebp - 4]
push eax
push ebx
push esi
call sub.SHELL32.DLL_DragQueryFileA
inc ebx
cmp edi, ebx
jg 0x414ada
push 0x10
call sub.USER32.dll_GetKeyState
test ah, 0x80
setne al
and eax, 1
push eax
push 0
push edi
mov edx, dword [ebp - 4]
push edx
call fcn.0040c8a4
cmp dword [0x466a98], 0
je 0x414b2d
push 0x4656f0
call fcn.00420794
push esi
call sub.SHELL32.DLL_DragFinish
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x414ba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff5cc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x32]
push eax
mov edx, dword [0x4656d8]
push edx
call sub.USER32.dll_GetMenu
push eax
call sub.USER32.dll_GetSubMenu
mov edi, eax
xor esi, esi
jmp 0x414bde
push 0
mov eax, dword [ebx + 0x3a]
add eax, esi
push eax
push edi
call sub.USER32.dll_DeleteMenu
test eax, eax
je 0x414be3
inc esi
cmp esi, dword [ebx + 0x36]
jl 0x414bcb
cmp dword [ebp + 0xc], 0
je 0x414bf4
push ebx
call fcn.0040bd70
jmp 0x414c84
cmp dword [ebx + 0x3a], 0x44c
je 0x414c84
xor esi, esi
xor edi, edi
push esi
push 0x45fbd3
lea eax, [ebp - 0x34]
push eax
call fcn.00456f9c
add esp, 0xc
lea edx, [ebp - 0x834]
lea ecx, [ebp - 0x34]
push 0x800
push 0x45fbd6
push edx
push ecx
push ebx
call fcn.0040ba80
push edi
push 0x45fbd7
lea eax, [ebp - 0x34]
push eax
call fcn.00456f9c
add esp, 0xc
cmp byte [ebp - 0x834], 0
jne 0x414c5e
push 0x45fbda
lea edx, [ebp - 0x34]
push edx
push ebx
call fcn.0040b9e8
jmp 0x414c84
lea ecx, [ebp - 0x834]
push ecx
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x414c81
lea eax, [ebp - 0x834]
lea edx, [ebp - 0x34]
push eax
push edx
push ebx
call fcn.0040b9e8
inc edi
inc esi
jmp 0x414c05
xor ecx, ecx
mov dword [ebx + 0x3e], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x414fb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbcc
push ebx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x3a]
cmp eax, edx
jl 0x414fd4
mov ecx, edx
add ecx, dword [ebx + 0x3e]
cmp eax, ecx
jl 0x414fd8
xor eax, eax
jmp 0x41504f
sub eax, edx
push eax
push 0x45fc09
lea eax, [ebp - 0x34]
push eax
call fcn.00456f9c
add esp, 0xc
lea edx, [ebp - 0x434]
lea ecx, [ebp - 0x34]
push 0x400
push 0x45fc0c
push edx
push ecx
push ebx
call fcn.0040ba80
lea eax, [ebp - 0x434]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x415039
test al, 0x10
je 0x415039
push 0x4656f0
call fcn.004236f8
lea edx, [ebp - 0x434]
push edx
push 0x4656f0
call fcn.00421854
jmp 0x41504a
lea ecx, [ebp - 0x434]
push ecx
push 0x4656f0
call fcn.0042175c
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8