joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f4e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebp
push edi
push esi
push ebx
mov eax, dword [esp + 0x30]
mov ebp, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
add esp, 0xfffffff4
push 0
lea edi, [esp + 0x2c]
push edi
push 4
lea eax, [esp + 0x30]
push eax
push dword [0x4f5f24]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41f553
add esp, 0xfffffff4
inc eax
push eax
call fcn.004f1e90
mov ebx, eax
add esp, 0xfffffff4
push 0
push edi
push dword [esp + 0x3c]
push ebx
push dword [0x4f5f24]
call sub.KERNEL32.dll_ReadFile
mov eax, dword [esp + 0x34]
mov byte [eax + ebx], 0
add esp, 0x1c
jmp 0x41f555
xor ebx, ebx
cmp dword [esp + 0x14], 0
jne 0x41f56e
test ebx, ebx
je 0x41f56e
add esp, 0xfffffff4
push ebx
call fcn.004f1e88
xor ebx, ebx
add esp, 0x10
cmp ebp, 0x7f
ja 0x41f57a
mov esi, dword [ebp*4 + 0x505980]
test esi, esi
je 0x41f595
mov dword [esi], ebx
mov eax, dword [esp + 0x14]
mov dword [esi + 8], eax
add esp, 0xfffffff4
push dword [esi + 4]
call fcn.00421310
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x1c
ret

Function at 0x41f634
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
cmp dword [0x4f5f20], 0
jne 0x41f653
add esp, 0xfffffff4
push 0x41f5a0
call fcn.0041ca18
jmp 0x41f75c
push 0
push dword [esp + 0x34]
push dword [0x4f5f08]
push dword [0x4f5f88]
call sub.USER32.dll_PostMessageA
add esp, 0xfffffff4
push 0
call sub.KERNEL32.dll_SetLastError
push 0
lea ebx, [esp + 0x2c]
push ebx
push 4
lea eax, [esp + 0x50]
push eax
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f69b
cmp dword [esp + 0x1c], 4
je 0x41f6ab
add esp, 0xfffffff4
push 0x41f5e2
call fcn.00421298
add esp, 0x10
mov eax, dword [esp + 0x38]
test eax, eax
jle 0x41f6ea
add esp, 0xfffffff4
push 0
push ebx
push eax
push dword [esp + 0x4c]
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f6da
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x1c], eax
je 0x41f6ea
add esp, 0xfffffff4
push 0x41f5fb
call fcn.00421298
add esp, 0x10
add esp, 0xfffffff4
push 0
push ebx
push 4
lea eax, [esp + 0x58]
push eax
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f710
cmp dword [esp + 0x1c], 4
je 0x41f720
add esp, 0xfffffff4
push 0x41f617
call fcn.00421298
add esp, 0x10
mov eax, dword [esp + 0x40]
test eax, eax
jle 0x41f75f
add esp, 0xfffffff4
push 0
push ebx
push eax
push dword [esp + 0x54]
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f74f
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x1c], eax
je 0x41f75f
add esp, 0xfffffff4
push 0x41f5fb
call fcn.00421298
add esp, 0x10
pop ebx
add esp, 0x28
ret
Function at 0x41f83c
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
cmp dword [0x4f5f20], 0
jne 0x41f860
add esp, 0xfffffff4
push 0x41f780
call fcn.0041ca18
jmp 0x41f9de
push 0
push dword [esp + 0x34]
push dword [0x4f5f0c]
push dword [0x4f5f88]
call sub.USER32.dll_PostMessageA
add esp, 0xfffffff4
push 0
call sub.KERNEL32.dll_SetLastError
push 0
lea ebx, [esp + 0x2c]
push ebx
push 4
lea eax, [esp + 0x50]
push eax
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f8a8
cmp dword [esp + 0x1c], 4
je 0x41f8b8
add esp, 0xfffffff4
push 0x41f5e2
call fcn.00421298
add esp, 0x10
mov eax, dword [esp + 0x38]
test eax, eax
jle 0x41f8f7
add esp, 0xfffffff4
push 0
push ebx
push eax
push dword [esp + 0x4c]
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f8e7
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x1c], eax
je 0x41f8f7
add esp, 0xfffffff4
push 0x41f5fb
call fcn.00421298
add esp, 0x10
add esp, 0xfffffff4
push 0
push ebx
push 4
lea eax, [esp + 0x58]
push eax
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f91d
cmp dword [esp + 0x1c], 4
je 0x41f92d
add esp, 0xfffffff4
push 0x41f5e2
call fcn.00421298
add esp, 0x10
mov eax, dword [esp + 0x40]
test eax, eax
jle 0x41f96c
add esp, 0xfffffff4
push 0
push ebx
push eax
push dword [esp + 0x54]
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f95c
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x1c], eax
je 0x41f96c
add esp, 0xfffffff4
push 0x41f7e0
call fcn.00421298
add esp, 0x10
add esp, 0xfffffff4
push 0
push ebx
push 4
lea eax, [esp + 0x60]
push eax
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f992
cmp dword [esp + 0x1c], 4
je 0x41f9a2
add esp, 0xfffffff4
push 0x41f800
call fcn.00421298
add esp, 0x10
mov eax, dword [esp + 0x48]
test eax, eax
jle 0x41f9e1
add esp, 0xfffffff4
push 0
push ebx
push eax
push dword [esp + 0x5c]
push dword [0x4f5f20]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x41f9d1
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x1c], eax
je 0x41f9e1
add esp, 0xfffffff4
push 0x41f81f
call fcn.00421298
add esp, 0x10
pop ebx
add esp, 0x28
ret

Function at 0x41f9f8
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [0x4f5f20]
test eax, eax
je 0x41fa10
add esp, 0xfffffff4
push eax
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [0x4f5f20], eax
push 0x1000
push 0
push 0x4f5f28
push 0x4f5f24
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x41fa46
add esp, 0xfffffff4
push 0x41f9e6
call fcn.00421298
add esp, 0x10
push dword [0x4f5f28]
call sub.KERNEL32.dll_GetCurrentProcess
push eax
push dword [0x4f5f1c]
push dword [0x4f5f88]
call sub.USER32.dll_PostMessageA
add esp, 0xc
ret
Function at 0x422688
Capabilities:
Inspect load icon resource

Disassembly:
sub esp, 0x3c
push 1
push 1
push 0
push 0
call sub.GDI32.dll_CreateRectRgn
mov dword [0x52c850], eax
cmp dword [0x4f5fc8], 0
je 0x4226b3
cmp dword [0x52c700], 0
je 0x422831
mov dword [esp], 0x20
mov dword [esp + 4], 0x421358
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov eax, dword [0x52cd60]
mov dword [esp + 0x10], eax
add esp, 0xfffffff8
push 2
push eax
call sub.USER32.dll_LoadIconA
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
add esp, 0xfffffffc
push 0
call sub.GDI32.dll_GetStockObject
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x52c9d0
lea eax, [esp + 0xc]
push eax
call sub.USER32.dll_RegisterClassA
add esp, 0xc
mov eax, dword [0x4f5f88]
test eax, eax
jne 0x422756
push 0
push dword [0x52cd60]
push 0
push 0
push 0x80000000
push 0x80000000
push 0
push 0
push 0x2cf0000
push 0x422667
push 0x52c9d0
push 0x40000
jmp 0x42279c
mov dword [0x4f5fd0], 1
push 0
push dword [0x52cd60]
push 0
push eax
add esp, 0xfffffff4
push 1
call sub.USER32.dll_GetSystemMetrics
add esp, 0xc
push eax
add esp, 0xfffffff4
push 0
call sub.USER32.dll_GetSystemMetrics
add esp, 0xc
push eax
push 0
push 0
push 0x42000000
push 0x422667
push 0x52c9d0
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x4f5f84], eax
add esp, 0xfffffffc
push 0x4213bc
push 0xfffffffffffffffc
push dword [0x4f5f84]
call sub.USER32.dll_SetWindowLongW
add esp, 0xfffffff8
push 0x42266f
call sub.USER32.dll_RegisterWindowMessageA
mov dword [0x4f5ff4], eax
add esp, 0xfffffffc
push 0
push dword [0x52cd60]
push 0
push dword [0x4f5f84]
push 0x80000000
push 0x80000000
push 0
push 0
push 0x40b00004
push 0x42267f
push 0x422680
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x52c5e0], eax
call fcn.0042081c
call fcn.0042259c
add esp, 0xfffffff4
push dword [0x4f5f84]
call sub.USER32.dll_SetForegroundWindow
add esp, 0xfffffffc
call fcn.0046887c
add esp, 0x20
call fcn.0042390c
add esp, 0x3c
ret
Function at 0x422db4
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x3c
push ebp
push edi
push esi
push ebx
cmp dword [esp + 0x50], 0
jne 0x422dd0
xor eax, eax
jmp 0x422f26
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
mov ebp, eax
and ebp, 0x8000
mov eax, dword [esp + 0x5c]
mov edx, dword [eax + 8]
mov ebx, edx
and ebx, 4
mov edi, edx
and edi, 8
mov ecx, edx
and ecx, 1
add esp, 0xc
cmp dword [0x4f5fbc], 0
je 0x422e16
mov eax, edx
and eax, 0x10
or ecx, eax
and edx, 2
or ecx, edx
xor edx, edx
xor esi, esi
jmp 0x422e38
cmp dword [0x4f5fc0], 0
jne 0x422e30
mov esi, edx
and esi, 0x10
and edx, 2
jmp 0x422e38
mov esi, edx
and esi, 2
and edx, 0x10
test ecx, ecx
je 0x422e62
test esi, esi
jne 0x422e62
test edx, edx
jne 0x422e62
test ebp, ebp
je 0x422e53
test edi, edi
jne 0x422e57
xor ecx, ecx
mov esi, 1
test edi, edi
je 0x422e62
test ebp, ebp
jne 0x422e62
xor ecx, ecx
mov edx, 1
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x50]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x50]
movsx eax, word [eax + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x50]
movsx eax, word [eax + 0xe]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0
test ecx, ecx
je 0x422ea1
mov dword [esp + 0x30], 4
mov eax, dword [esp + 0x30]
test esi, esi
je 0x422eaf
or al, 1
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
test edx, edx
je 0x422ebd
or al, 2
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0
test ebx, ebx
je 0x422ed1
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x34]
test edi, edi
je 0x422edf
or al, 2
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
test ebp, ebp
je 0x422eed
or al, 8
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x50]
mov eax, dword [edx]
mov edx, 1
cmp eax, dword [0x4f5f84]
je 0x422f0a
mov edx, eax
mov dword [esp + 0x3c], edx
call fcn.00422d40
mov edi, eax
lea esi, [esp + 0x20]
cld
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x3c
ret

Function at 0x422f30
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebp
push edi
push esi
push ebx
call fcn.00422d40
mov ebp, eax
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
mov edi, eax
and edi, 0x8000
push 0x10
call sub.USER32.dll_GetKeyState
mov esi, eax
and esi, 0x8000
push 0x11
call sub.USER32.dll_GetKeyState
mov ebx, eax
and ebx, 0x8000
mov dword [ebp], 3
add esp, 0xfffffffc
call fcn.00423714
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [ebp + 8], eax
mov edx, dword [esp + 0x38]
mov dword [ebp + 0xc], edx
mov eax, dword [esp + 0x3c]
mov dword [ebp + 0x10], eax
add esp, 0x10
test esi, esi
setne al
and eax, 0xff
test ebx, ebx
je 0x422fa8
or al, 2
test edi, edi
je 0x422fae
or al, 8
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [ebp + 0x18], eax
mov eax, 1
mov edx, dword [esp + 0x20]
cmp edx, dword [0x4f5f84]
je 0x422fcb
mov eax, edx
mov dword [ebp + 0x1c], eax
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x422fdc
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x30]
test ebp, ebp
jne 0x422ff2
xor eax, eax
jmp 0x423176
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
mov edx, eax
and edx, 0x8000
mov dword [esp + 0x28], edx
push 0x10
call sub.USER32.dll_GetKeyState
mov ecx, eax
and ecx, 0x8000
mov dword [esp + 0x24], ecx
push 0x11
call sub.USER32.dll_GetKeyState
mov edx, eax
and edx, 0x8000
mov dword [esp + 0x20], edx
push dword [ebp + 8]
call fcn.00422a54
mov ebx, eax
mov edi, dword [ebp + 8]
add esp, 0x10
mov eax, dword [ebp + 4]
add eax, 0xffffff00
cmp eax, 6
ja case.0x42304b.259
jmp dword [eax*4 + 0x423052]
test ebx, ebx
je 0x423076
mov edi, ebx
mov dword [esp + 0x10], 1
test byte [ebp + 0xf], 0x40
je 0x4230b5
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
cmp eax, 2
ja 0x4230b5
jmp 0x423171
test ebx, ebx
je 0x42309a
mov edi, ebx
mov dword [esp + 0x10], 2
jmp 0x4230b5
cmp edi, 0xd
je 0x423171
mov dword [esp + 0x10], 0
cmp dword [esp + 0x14], 0
je 0x4230d3
cmp dword [esp + 0x1c], 0
je 0x4230d3
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
call fcn.00422d40
mov esi, eax
mov dword [esi], 2
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov eax, edi
and eax, 0xff
movzx eax, byte [eax + 0x4f6010]
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
cmp dword [esp + 0x1c], 0
je 0x423113
mov dword [esi + 0x10], 8
mov eax, dword [esi + 0x10]
cmp dword [esp + 0x18], 0
je 0x423122
or al, 1
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
cmp dword [esp + 0x14], 0
je 0x423131
or al, 2
mov dword [esi + 0x10], eax
mov eax, dword [ebp]
mov edx, 1
cmp eax, dword [0x4f5f84]
je 0x423143
mov edx, eax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0
cmp dword [esp + 0x10], 1
jne 0x423171
test ebx, ebx
je 0x423171
call fcn.00422d40
mov edi, eax
cld
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0xc], 0
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x1c
ret

Function at 0x423458
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push esi
push ebx
add esp, 0xfffffff4
push 1
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
setl al
and eax, 0xff
lea ebx, [eax*4]
mov esi, ebx
add esp, 0xfffffff4
push 4
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x4234b1
cmp dword [0x4f5fbc], 0
je 0x4234a0
or ebx, 4
jmp 0x4234b1
or ebx, 1
cmp dword [0x4f5fc0], 0
je 0x4234b1
mov ebx, esi
or ebx, 2
add esp, 0xfffffff4
push 2
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x4234e3
cmp dword [0x4f5fbc], 0
je 0x4234d1
or ebx, 4
jmp 0x4234e3
cmp dword [0x4f5fc0], 0
je 0x4234e0
or ebx, 1
jmp 0x4234e3
or ebx, 2
cmp ebx, 4
jne 0x423518
add esp, 0xfffffff4
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x423501
mov ebx, 2
jmp 0x423518
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x423518
mov ebx, 1
and ebx, 7
mov dword [0x4f5f74], ebx
mov eax, 1
pop ebx
pop esi
add esp, 0x14
ret
Function at 0x42352c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebx
add esp, 0xfffffff4
push 0x10
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
setl al
and eax, 0xff
lea ebx, [eax*8]
add esp, 0xfffffff4
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x423576
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jl 0x423576
or ebx, 0x10
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x42359d
add esp, 0xfffffff4
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jl 0x42359d
or ebx, 0x40
add esp, 0xfffffff4
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x4235c4
add esp, 0xfffffff4
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jge 0x4235c4
or ebx, 0x20
mov eax, dword [0x4f5f74]
and eax, 7
or ebx, eax
mov dword [0x4f5f74], ebx
mov eax, 1
pop ebx
add esp, 0x18
ret

Function at 0x423fb4
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push esi
push ebx
mov esi, dword [esp + 0x20]
add esp, 0xfffffff4
push dword [0x4f5f84]
call sub.USER32.dll_IsWindow
add esp, 0xc
test eax, eax
je 0x423ff5
cmp dword [0x4f6134], esi
je 0x423ff5
add esp, 0xfffffff4
push dword [0x4f5f84]
call sub.USER32.dll_IsWindowVisible
add esp, 0xc
test eax, eax
jne 0x424000
mov dword [0x4f5fec], esi
mov eax, 1
jmp 0x42415f
test esi, esi
je 0x4240a0
mov ebx, dword [0x4f5f88]
test ebx, ebx
je 0x42405f
mov dword [0x4f5f88], 0
add esp, 0xfffffff4
push dword [0x4f5f84]
call sub.USER32.dll_DestroyWindow
add esp, 0xfffffffc
call fcn.00422688
add esp, 0xfffffff4
push dword [0x4f5f84]
call sub.USER32.dll_SetForegroundWindow
push dword [0x4f5f84]
call sub.USER32.dll_SetActiveWindow
push dword [0x4f5f84]
call sub.USER32.dll_BringWindowToTop
mov dword [0x4f5f88], ebx
add esp, 0x1c
add esp, 0xfffffffc
push 0x82000000
push 0xfffffffffffffff0
push dword [0x4f5f84]
call sub.USER32.dll_SetWindowLongA
push 0x40000
push 0xffffffffffffffec
push dword [0x4f5f84]
call sub.USER32.dll_SetWindowLongA
add esp, 0xfffffffc
push 3
push dword [0x4f5f84]
call sub.USER32.dll_ShowWindow
add esp, 0xfffffffc
push 1
jmp 0x424135
add esp, 0xfffffff8
push 9
push dword [0x4f5f84]
call sub.USER32.dll_ShowWindow
push 0
push dword [0x4f5f84]
call sub.USER32.dll_ShowWindow
add esp, 0xfffffff4
push 0x2cf0000
push 0xfffffffffffffff0
push dword [0x4f5f84]
call sub.USER32.dll_SetWindowLongA
push 0x40000
push 0xffffffffffffffec
push dword [0x4f5f84]
call sub.USER32.dll_SetWindowLongA
push 0x2f
push 0
push 0
push 0
push 0
push 0
push dword [0x4f5f84]
call sub.USER32.dll_SetWindowPos
add esp, 0x14
cmp dword [0x4f5f88], 0
je 0x424120
add esp, 0xfffffff4
push dword [0x4f5f84]
call sub.USER32.dll_DestroyWindow
add esp, 0xfffffffc
call fcn.00422688
add esp, 0x10
add esp, 0xfffffff8
push 1
push dword [0x4f5f84]
call sub.USER32.dll_ShowWindow
add esp, 0xfffffffc
push 0
call fcn.0041838c
add esp, 0x10
add esp, 0xfffffff4
push dword [0x4f5f84]
call sub.USER32.dll_SetForegroundWindow
mov dword [0x4f5fec], esi
mov dword [0x4f6134], esi
mov eax, 1
add esp, 0xc
pop ebx
pop esi
add esp, 0x14
ret
Function at 0x425940
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x134
push esi
push ebx
mov dword [esp + 0x1c], 0
cmp dword [0x4f6140], 0
jne 0x425980
add esp, 0xfffffff4
push 0x425921
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xfffffff4
push 0x42592d
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4f6140], eax
add esp, 0x18
test eax, eax
je 0x4259e9
add esp, 0xfffffff4
push 0xd
call sub.USER32.dll_IsClipboardFormatAvailable
add esp, 0xc
test eax, eax
je 0x4259e9
add esp, 0xfffffff4
push dword [0x4f5f84]
call sub.USER32.dll_OpenClipboard
add esp, 0xc
test eax, eax
je 0x4259e9
add esp, 0xfffffff4
push 0xd
call sub.USER32.dll_GetClipboardData
mov ebx, eax
push ebx
call sub.KERNEL32.dll_GlobalLock
mov edx, eax
add esp, 0xfffffff4
lea eax, [esp + 0x34]
push eax
push edx
mov eax, dword [0x4f6140]
call eax
mov esi, eax
add esp, 0xfffffffc
push ebx
call sub.KERNEL32.dll_GlobalUnlock
add esp, 0xfffffffc
call sub.USER32.dll_CloseClipboard
mov eax, dword [esp + 0x3c]
add esp, 0x20
cmp eax, 1
jg 0x4259f0
xor eax, eax
jmp 0x425a25
push 0
push 0
push 0x104
lea ebx, [esp + 0x2c]
push ebx
push 0xffffffffffffffff
push dword [esi + eax*4 - 4]
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
add esp, 0xfffffff4
push ebx
call fcn.004688ec
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_LocalFree
add esp, 0x1c
pop ebx
pop esi
add esp, 0x134
ret
Function at 0x425a7c
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
push edi
push esi
push ebx
add esp, 0xfffffff8
lea ebx, [ebp - 0x110]
push ebx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.00421124
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x425acb
add esp, 0xfffffff8
push 0x2f
mov eax, dword [ebp + 8]
push eax
call fcn.00421124
mov esi, eax
add esp, 0x10
test esi, esi
je 0x425c4e
mov byte [esi], 0
inc esi
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_lstrlenA
add esp, 0xc
lea edi, [ebp - 0x230]
cmp eax, 0xc
jg 0x425c08
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
push 0x425a70
push edi
call sub.KERNEL32.dll_lstrcatA
add esp, 0xfffffffc
push edi
call sub.KERNEL32.dll_SetCurrentDirectoryA
add esp, 0xfffffff4
lea ebx, [ebp - 0x370]
push ebx
push 0x425a72
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebp - 0x374], eax
add esp, 0x18
cmp eax, 0xffffffff
je 0x425c08
lea eax, [ebp - 0x344]
mov dword [ebp - 0x384], eax
lea esi, [esi]
add esp, 0xfffffff8
push 0x425a76
mov eax, dword [ebp - 0x384]
push eax
call sub.KERNEL32.dll_lstrcmpA
add esp, 8
test eax, eax
je 0x425b93
add esp, 0xfffffff8
push 0x425a79
mov eax, dword [ebp - 0x384]
push eax
call sub.KERNEL32.dll_lstrcmpA
add esp, 8
test eax, eax
je 0x425b93
add esp, 0xfffffff8
lea eax, [ebp - 0x240]
push eax
lea ebx, [ebp - 0x120]
push ebx
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
mov eax, ebx
jmp 0x425ba0
mov byte [ebp - 0x120], 0
lea eax, [ebp - 0x120]
add esp, 0xfffffff8
push esi
push eax
call sub.KERNEL32.dll_lstrcmpA
add esp, 8
test eax, eax
jne 0x425bd5
add esp, 0xfffffff4
mov eax, dword [ebp - 0x374]
push eax
call sub.KERNEL32.dll_FindClose
add esp, 0xfffffff4
mov eax, dword [ebp - 0x384]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
add esp, 0x18
jmp 0x425c15
add esp, 0xfffffff8
lea eax, [ebp - 0x370]
push eax
mov eax, dword [ebp - 0x374]
push eax
call sub.KERNEL32.dll_FindNextFileA
add esp, 8
test eax, eax
jne 0x425b40
add esp, 0xfffffff4
mov eax, dword [ebp - 0x374]
push eax
call sub.KERNEL32.dll_FindClose
add esp, 0xc
add esp, 0xfffffff8
push esi
push edi
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
add esp, 0xfffffff4
mov eax, dword [ebp + 8]
push eax
call fcn.00425a7c
add esp, 0xfffffff8
push 0x425a70
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_lstrcatA
push edi
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_lstrcatA
add esp, 0xfffffffc
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
add esp, 0x1c
lea esp, [ebp - 0x3a8]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x425d24
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x1c
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x30]
mov dword [esp + 0x18], 0
add esp, 0xfffffff8
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
add esp, 0xfffffff8
push 0
push 0
push 0
push esi
call sub.KERNEL32.dll_SetFilePointer
add esp, 0x10
test eax, eax
jne 0x425e14
add esp, 0xfffffff4
push 0
lea ebp, [esp + 0x2c]
push ebp
push 4
lea edi, [esp + 0x30]
push edi
push esi
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x425e14
add esp, 0xfffffff4
push dword [esp + 0x24]
call fcn.00417de0
add esp, 0x10
test eax, eax
jne 0x425e10
add esp, 0xfffffff4
add esp, 0xfffffff4
push dword [esp + 0x30]
call fcn.00403f38
push eax
call fcn.00417de0
add esp, 0x20
test eax, eax
jne 0x425e10
add ebx, 0xfffffe00
push 0
push 0
push 0x200
push esi
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0x200
jne 0x425e14
add esp, 0xfffffff4
push 0
push ebp
push 4
push edi
push esi
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x425e14
add esp, 0xfffffff4
push dword [esp + 0x24]
call fcn.00417de0
add esp, 0x10
test eax, eax
jne 0x425e10
add esp, 0xfffffff4
add esp, 0xfffffff4
push dword [esp + 0x30]
call fcn.00403f38
push eax
call fcn.00417de0
add esp, 0x20
test eax, eax
je 0x425e14
mov eax, ebx
jmp 0x425e16
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x1c
ret

Function at 0x425eac
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x264
push esi
push ebx
add esp, 0xfffffff8
lea esi, [esp + 0x18]
push esi
push 0x425e9c
call sub.KERNEL32.dll_FindFirstFileW
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
je 0x425f14
add esp, 0xfffffff8
push esi
push ebx
call sub.KERNEL32.dll_FindNextFileW
mov esi, eax
add esp, 0xfffffffc
push ebx
call sub.KERNEL32.dll_FindClose
add esp, 0xc
test esi, esi
jne 0x425f14
push 0
push 0
push 0x104
push 0x52c860
push 0xffffffffffffffff
lea eax, [esp + 0x50]
push eax
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
mov eax, 1
jmp 0x425f16
xor eax, eax
pop ebx
pop esi
add esp, 0x264
ret