joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4434b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x20c], eax
mov ecx, dword [ecx + 4]
push esi
mov esi, dword [esp + 0x218]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x801a
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x44350f
lea edx, [esp + 8]
push edx
call fcn.00476ff0
add esp, 4
push str.FeyWriterLogs_
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44352e
push 0x103
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 8]
push edx
call fcn.00477110
add esp, 4
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004be890
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004911aa
add esp, 0x210
ret 4
Function at 0x446ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x130
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov esi, dword [esp + 0x13c]
xor ebx, ebx
push edi
mov edi, ecx
cmp esi, ebx
je 0x446ae5
push esi
call dword [sym.imp.USER32.dll_IsMenu]
test eax, eax
je 0x446caa
mov eax, dword [edi + 0x44]
cmp eax, ebx
je 0x446af9
test byte [edi + 0x58], 2
jne 0x446af9
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
test byte [edi + 0x84], 2
mov dword [edi + 0x44], esi
jne 0x446ca5
mov eax, dword [edi + 4]
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb
push eax
call ebp
mov ecx, dword [edi + 4]
push ebx
push ebx
push 0x418
push ecx
call ebp
cmp eax, ebx
jle 0x446b42
mov esi, eax
lea ecx, [ecx]
mov edx, dword [edi + 4]
push ebx
push ebx
push 0x416
push edx
call ebp
sub esi, 1
jne 0x446b30
mov eax, dword [edi + 0x44]
cmp eax, ebx
je 0x446c82
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x10], eax
jle 0x446c82
push 0x2c
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.004911c0
mov eax, dword [edi + 0x44]
add esp, 0xc
lea edx, [esp + 0x34]
push edx
push 1
push esi
lea ecx, [esp + 0x80]
push eax
mov dword [esp + 0x44], 0x2c
mov dword [esp + 0x48], 0x15
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], 0x64
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
lea ecx, [esp + 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x63
jle 0x446bdc
mov eax, dword [edi + 0x44]
lea edx, [esp + 0x34]
push edx
push 1
push esi
push eax
mov dword [esp + 0x4c], 4
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
xor ecx, ecx
mov word [esp + 0x74], cx
mov edx, dword [esp + 0x40]
mov ecx, dword [edi + 4]
xor eax, eax
and dl, 3
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
neg dl
lea eax, [esp + 0x60]
push eax
sbb dl, dl
push 0xffffffffffffffff
and dl, 0xfc
push 0x443
add dl, 4
push ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], esi
mov byte [esp + 0x78], dl
mov byte [esp + 0x79], 0x18
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
call ebp
mov ecx, dword [edi + 4]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x440
lea edx, [esp + 0x80]
push ecx
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 2
mov dword [esp + 0x3c], edx
call ebp
inc esi
cmp esi, dword [esp + 0x10]
jl 0x446b62
mov edx, dword [edi + 4]
push ebx
push 1
push 0xb
push edx
call ebp
mov eax, dword [edi + 4]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
pop ebp
mov eax, 1
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004911aa
add esp, 0x130
ret 4
Function at 0x447030
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2bc
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
push ebp
push esi
push edi
push 0x2b0
lea eax, [esp + 0x1c]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x20], 0
call fcn.004911c0
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0xc
push 0x4101
push 0x2b4
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x4c49ac
call ebx
mov edx, dword [esi + 0xd60]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x1003
push edx
call edi
push 0x4100
push 0x2b4
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4c49ac
call ebx
mov ecx, dword [esi + 0xd60]
push eax
push 0
push 0x1003
push ecx
call edi
push 5
push 4
push 0x20
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push str.shell32.dll
mov dword [esi + 0x934], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.USER32.dll_LoadImageW]
push 0x20
push 0x10
push 0x10
push 1
mov ebx, eax
push 4
push ebx
call edi
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esi + 0x934]
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push ebp
push 0xffffffffffffffff
push edx
call ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_DestroyIcon]
call ebp
mov eax, dword [0x53a230]
push 0x20
push 0x10
push 0x10
push 1
push 0xd5
push eax
call edi
push eax
mov dword [esp + 0x14], eax
push 0xffffffffffffffff
mov ecx, dword [esi + 0x934]
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [0x53a230]
push 0x20
push 0x10
push 0x10
push 1
push 0xd4
push eax
call edi
mov ecx, dword [esi + 0x934]
push eax
push 0xffffffffffffffff
push ecx
mov dword [esp + 0x1c], eax
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [0x53a230]
push 0x20
push 0x10
push 0x10
push 1
push 0xd3
push eax
call edi
mov ecx, dword [esi + 0x934]
push eax
push 0xffffffffffffffff
push ecx
mov dword [esp + 0x1c], eax
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [0x53a230]
push 0x20
push 0x10
push 0x10
push 1
push 0xd6
push eax
call edi
mov ecx, dword [esi + 0x934]
mov edi, eax
push edi
push 0xffffffffffffffff
push ecx
call ebx
push edi
call ebp
mov edx, dword [esi + 0x934]
mov eax, dword [esi + 0x68c]
push edx
push 0
push 0x1109
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x2c8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004911aa
add esp, 0x2bc
ret
Function at 0x447300
Capabilities:
Get common file path

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x3c]
mov ebx, ecx
mov ecx, dword [esp + 0x3c]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [0x538d70]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x110a
push edx
call edi
mov esi, eax
mov eax, dword [0x538d70]
push esi
push 2
push 0x1102
push eax
call edi
mov ecx, dword [0x538d70]
push esi
push 4
push 0x110a
push ecx
call edi
mov esi, eax
test esi, esi
je 0x4473e0
xor eax, eax
lea edx, [esp + 0x10]
push edx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov eax, dword [0x538d70]
push 0x113e
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 4
call edi
mov ebp, dword [esp + 0x3c]
neg eax
sbb eax, eax
and eax, dword [esp + 0x34]
push ebp
mov ecx, dword [eax + 8]
mov eax, dword [eax]
mov edx, dword [ecx]
push eax
push 0x10000000
push ecx
mov ecx, dword [edx + 0x1c]
call ecx
push esi
test eax, eax
je 0x4473ec
mov edx, dword [0x538d70]
push 6
push 0x110a
push edx
call edi
mov esi, eax
test esi, esi
jne 0x447360
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x28
ret 4
push 9
mov byte [ebx + 0xb48], 0
mov eax, dword [0x538d70]
push 0x110b
push eax
call edi
mov ecx, dword [0x538d70]
push esi
push 2
push 0x1102
push ecx
call edi
pop edi
pop esi
mov al, 1
pop ebp
mov byte [ebx + 0xb48], al
pop ebx
add esp, 0x28
ret 4
Function at 0x44a470
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x8e0
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x8dc], eax
mov eax, dword [esp + 0x8e8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x8f0]
push esi
mov ebp, ecx
mov dword [esp + 0x18], eax
call fcn.004476e0
mov ebx, eax
test ebx, ebx
jne 0x44a4ae
xor al, al
jmp 0x44a5d4
push edi
push ebx
mov ecx, 0x538d70
call fcn.00445890
mov edi, eax
test edi, edi
je 0x44a56b
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x2d4]
push ecx
push edx
mov ecx, 0x5391c0
call fcn.00456340
lea eax, [esp + 0x6e4]
push eax
push esi
mov ecx, 0x5391c0
call fcn.00456340
lea ecx, [esp + 0x2d4]
push ecx
lea edx, [esp + 0x4e0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x6e4]
push eax
call fcn.00477110
lea ecx, [esp + 0x4e0]
push ecx
call fcn.00477110
add esp, 8
lea edx, [esp + 0x6e4]
push edx
lea eax, [esp + 0x4e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44a550
lea ecx, [esp + 0x2d4]
push ecx
push esi
mov ecx, ebp
call fcn.00449d70
jmp 0x44a5d3
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2d8]
push eax
mov ecx, 0x5391c0
call fcn.004566b0
test al, al
jne 0x44a56f
xor al, al
jmp 0x44a5d3
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, 0x5391c0
call fcn.004562d0
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push edx
push eax
mov ecx, 0x5391c0
call fcn.00456370
push 0x208
push 0x2b4
lea ecx, [esp + 0x28]
push ecx
push 0
push eax
mov dword [edi + 4], eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x44a5d1
lea edx, [esp + 0x2c]
push edx
push ebx
mov ecx, 0x538d70
call fcn.00446d90
mov al, 1
pop edi
mov ecx, dword [esp + 0x8e8]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004911aa
add esp, 0x8e0
ret 8
Function at 0x452137
Capabilities:
Capture webcam image

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx]
push esi
mov esi, ecx
cmp eax, dword [esi + 4]
je 0x452153
mov ecx, dword [esp + 0x14]
pop esi
mov dword [ecx], 0
mov eax, 1
pop ebx
ret 0xc
push edi
mov edi, dword [sym.imp.USER32.dll_GetFocus]
call edi
cmp eax, dword [esi + 4]
je 0x452182
test byte [esi + 0x58], 4
je 0x452178
cmp dword [esi + 0xac], 0
jne 0x452178
call edi
mov dword [esi + 0xac], eax
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebx + 0xc]
push 0
push eax
mov eax, dword [esi + 4]
push 0x419
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
and byte [esi + 0x84], 0xcf
push 1
push eax
mov ecx, esi
call fcn.00451dd0
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x452940
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
push 0
push ecx
mov eax, esp
push 0x10000
push 0x56000000
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov esi, ecx
mov dword [eax], 0x4eb6d0
mov eax, dword [esi + 4]
push eax
lea ecx, [esi + 0x138]
call fcn.0044d6a0
push 0
push ecx
mov dword [esi + 0x2c], eax
mov eax, esp
push 0
push 0x56000000
mov dword [esi + 0x17c], 2
push 0
mov dword [esi + 0x198], 6
push ecx
lea edi, [esi + 0x15c]
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0x4eb6d0
mov eax, dword [esi + 0x13c]
lea ebp, [esi + 0x2e0]
push eax
mov ecx, ebp
call fcn.0044da50
mov ecx, ebp
call fcn.00468520
push 0
push ecx
mov eax, esp
push 0x10000
push 0x56000000
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0x4eb6d0
mov eax, dword [esi + 0x13c]
push eax
lea ecx, [esi + 0x1a0]
call fcn.0044d9d0
push 1
mov ecx, esi
mov dword [esi + 0x1e4], 4
call fcn.00446a40
push 0
push ecx
mov eax, esp
push 0x200
push 0x56010000
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], 0x4eb6d0
mov eax, dword [esi + 0x13c]
push eax
lea ecx, [esi + 0x6b0]
call fcn.0044d580
mov edx, dword [esi + 0x2c]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [0x5394a8], 0
je 0x452ab0
mov eax, dword [esi + 0x6b4]
mov byte [esi + 0xb4a], 1
mov ecx, edi
mov dword [edi], eax
call fcn.00446db0
mov ecx, dword [edi]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x452a8b
mov edx, dword [edi]
push 5
push edx
call ebp
mov eax, dword [edi + 4]
push 0
push eax
call ebp
cmp dword [edi + 0x1c], 0
je 0x452aa0
mov dword [edi + 0x1c], 0
mov ecx, edi
mov dword [edi + 0x40], 0
call fcn.00446db0
jmp 0x452ae4
mov ecx, dword [esi + 0x2e4]
mov dword [edi + 4], ecx
mov ecx, edi
call fcn.00446db0
mov edx, dword [esi + 0x1a4]
mov ecx, edi
mov dword [edi], edx
call fcn.00446db0
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
push 1
sub eax, 0x1e
push eax
mov ecx, edi
call fcn.004481e0
push 1
mov ecx, esi
call fcn.00446a40
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
push 1
sub eax, 0x1e
cdq
sub eax, edx
sar eax, 1
push eax
lea ecx, [esi + 0x1c4]
call fcn.004481e0
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x456e30
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x184
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x180], eax
mov al, byte [esp + 0x188]
push esi
mov esi, ecx
cmp al, 0x64
jbe 0x456e54
mov al, 0x64
mov cl, byte [esi + 0x298]
cmp cl, al
jbe 0x456e68
test al, al
jne 0x456f1c
cmp cl, al
je 0x456f1c
push edi
movzx edi, al
push 0
push edi
push 0x402
mov byte [esi + 0x298], al
mov eax, dword [esi - 0x1c]
push 0x3e8
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push edi
push 0x89
call fcn.00443150
add esp, 4
push eax
lea ecx, [esp + 0x10]
push 0x20
push ecx
call fcn.00477440
add esp, 0x10
lea edx, [esp + 8]
push edx
lea ecx, [esi + 0x20c]
call fcn.00439900
cmp byte [esi + 0x290], 0
jne 0x456f16
cmp dword [esi + 0x29c], 0
je 0x456f16
mov ecx, dword [esi - 0x1c]
push 0x40
lea eax, [esp + 0x4c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 0x48]
push edx
push edi
push str._d______s
lea eax, [esp + 0xd4]
push 0x60
push eax
call fcn.00477440
mov ecx, dword [esi - 0x1c]
add esp, 0x14
push ecx
call dword [sym.imp.USER32.dll_GetParent]
lea edx, [esp + 0xc8]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
call fcn.0043ec30
pop edi
mov ecx, dword [esp + 0x184]
pop esi
xor ecx, esp
call fcn.004911aa
add esp, 0x184
ret 4

Function at 0x457310
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x2ac]
test ecx, ecx
je 0x457329
push 2
push 0x4c9d8c
call fcn.00423470
mov eax, dword [esi + 4]
push 0x3fa
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10
Function at 0x45b700
Capabilities:
Hide graphical window

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x4eeb80
call fcn.0045b3b0
mov eax, dword [esi + 0x14]
mov byte [esi + 0xd], 0
test eax, eax
je 0x45b759
lea edi, [eax + 0x24]
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x45b739
mov ecx, dword [edi + 4]
push 5
push ecx
call ebp
mov edx, dword [edi]
push 0
push edx
call ebp
mov ebp, 1
cmp dword [edi + 0x1c], ebp
je 0x45b74d
mov dword [edi + 0x1c], ebp
mov ecx, edi
mov dword [edi + 0x40], ebp
call fcn.00446ef0
jmp 0x45b75e
mov ebp, 1
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 8], 0
test eax, eax
je 0x45b783
mov eax, dword [eax]
push 0xffff0000
push 0
push 0x1101
push eax
call edi
mov eax, dword [esi + 0x20]
test eax, eax
je 0x45b798
mov ecx, dword [eax]
push 0
push 0
push 0x1009
push ecx
call edi
mov ecx, 0x539fd8
call fcn.0046fb30
cmp dword [esi + 0x20], 0
mov dword [esi], ebp
mov byte [esi + 0xc], 0
je 0x45b7b5
mov ecx, esi
call fcn.0045ab60
push 2
push 0x40
call fcn.00443150
add esp, 4
push eax
mov ecx, 0x539fd8
call fcn.0046fe90
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x45b7f7
push ebp
call fcn.00467b70
mov ecx, dword [esi + 0x1c]
push 0xc
call fcn.00467820
mov ecx, dword [esi + 0x1c]
push 0
push 0
call fcn.00467ea0
mov ecx, dword [esi + 0x1c]
call fcn.00458920
xor edx, edx
push edx
push edx
push 0x8024
mov ecx, 0x53846c
mov word [0x4eeb94], dx
call fcn.00459c70
push 0
push 0
push 0x8036
mov ecx, 0x53846c
call fcn.00459c70
pop edi
pop esi
pop ebp
ret
Function at 0x45bbf0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x4c15be
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x2cc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x2e4]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2f8]
mov edi, dword [esp + 0x2f4]
mov eax, dword [esp + 0x2fc]
mov edx, dword [esp + 0x304]
mov ebp, ecx
mov ecx, dword [esp + 0x300]
push ebx
mov dword [esp + 0x1c], ecx
push edi
mov ecx, 0x539fd8
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edx
call fcn.0046ed60
mov esi, eax
test esi, esi
je 0x45bcb4
mov eax, dword [esp + 0x18]
push esi
push eax
lea ecx, [ebp + 4]
call fcn.00422fc0
test al, al
je 0x45be11
mov ecx, dword [esi + 0x6cc]
mov edx, dword [esi + 0x6c8]
push ecx
mov ecx, dword [0x4ede90]
push edx
call fcn.00467f90
mov ecx, dword [0x4ede90]
call fcn.00458920
push esi
push edi
mov ecx, 0x539fd8
call fcn.0046fc50
push 0x6d8
call fcn.004919dd
add esp, 4
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [esp + 0x2ec], esi
cmp eax, esi
je 0x45bcdb
mov ecx, eax
call fcn.0046e170
mov esi, eax
cmp dword [ebp], 1
mov dword [esp + 0x2ec], 0xffffffff
mov dword [esp + 0x14], esi
jne 0x45bcf7
or byte [esi + 0x6d0], 6
push ebx
mov ecx, esi
call fcn.0046e1c0
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
call fcn.0046e1d0
mov ecx, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ecx
lea edx, [esi + 0x418]
push edx
call ebp
push 0x410
push 0x2b4
lea eax, [esp + 0x34]
push eax
push 0x80
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45bd4f
lea ecx, [esp + 0x240]
push ecx
lea edx, [esi + 0x620]
push edx
call ebp
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
cmp eax, 1
jne 0x45bd7d
lea edx, [esi + 0x6c2]
push edx
lea eax, [esi + 0x6c0]
push eax
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov edx, dword [esp + 0x308]
mov eax, dword [esp + 0x30c]
mov dword [esi + 0x6c8], edx
mov dword [esi + 0x6cc], eax
mov ebx, dword [edi + 0x30]
mov edx, dword [ebx + 4]
add edi, 0x1c
lea ecx, [esp + 0x14]
push ecx
push edx
push ebx
mov ecx, edi
call fcn.0045aea0
push 1
mov ecx, edi
mov ebp, eax
call fcn.0045bb10
mov dword [ebx + 4], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ebp
mov ecx, dword [esi + 0x6cc]
mov edx, dword [esi + 0x6c8]
push ecx
mov ecx, dword [0x4ede90]
push edx
call fcn.00467f70
mov ecx, dword [0x4ede90]
call fcn.00458920
mov al, 1
mov ecx, dword [esp + 0x2e4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2cc]
xor ecx, esp
call fcn.004911aa
add esp, 0x2dc
ret 0x1c
xor al, al
jmp 0x45bde7
Function at 0x45c0e0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x4c15be
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x2cc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x2e4]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
mov ebx, dword [esp + 0x2f8]
mov ecx, dword [esp + 0x304]
mov edi, dword [esp + 0x2f4]
mov eax, dword [esp + 0x300]
mov ebp, dword [esp + 0x2fc]
push ebx
mov dword [esp + 0x1c], ecx
push edi
mov ecx, 0x539fd8
mov dword [esp + 0x24], eax
call fcn.0046ee90
xor esi, esi
cmp eax, esi
jne 0x45c27b
push 0x48
call fcn.004919dd
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x2ec], esi
cmp eax, esi
je 0x45c183
push edi
mov ecx, eax
call fcn.0045ba70
mov esi, eax
mov edx, dword [esp + 0x20]
cmp dword [edx], 1
mov dword [esp + 0x2ec], 0xffffffff
mov dword [esp + 0x14], esi
jne 0x45c1a5
mov eax, dword [esi + 0x3c]
or byte [eax + 0x6d0], 6
mov ecx, dword [esi + 0x3c]
push ebx
call fcn.0046e1c0
mov ecx, dword [esi + 0x3c]
push ebp
call fcn.0046e1d0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
add ecx, 0x418
push ecx
call ebx
push 0x410
push 0x2b4
lea edx, [esp + 0x34]
push edx
push 0x10
push 0x4c49ac
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45c202
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0x240]
push eax
add ecx, 0x620
push ecx
jmp 0x45c211
mov edx, dword [esi + 0x3c]
push 0x4c49ac
add edx, 0x620
push edx
call ebx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
cmp eax, 1
jne 0x45c243
mov eax, dword [esi + 0x3c]
lea edx, [eax + 0x6c2]
push edx
add eax, 0x6c0
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov ebx, dword [edi + 0x14]
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x14]
push ecx
push edx
push ebx
mov ecx, edi
call fcn.0045aea0
push 1
mov ecx, edi
mov ebp, eax
call fcn.0045bb10
mov dword [ebx + 4], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ebp
mov ecx, dword [edi + 0x44]
push esi
push ecx
mov ecx, 0x539fd8
call fcn.0046e830
mov eax, esi
mov ecx, dword [esp + 0x2e4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2cc]
xor ecx, esp
call fcn.004911aa
add esp, 0x2dc
ret 0x14