joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4677d4
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4a2ff8
push 1
push 0
push 0x4a3028
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x46789f
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x467820
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x467834
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x467846
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4a3058
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x467896
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x46788d
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4678ac
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x4678e4
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4678f9
xor eax, eax
jmp 0x467937
push ebx
call fcn.0048d918
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.0048d768
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret

Function at 0x467e64
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.00468290
mov eax, esp
call fcn.0040ba60
push ebx
lea edx, [esp + 4]
push edx
call fcn.0048d80c
add esp, 8
mov eax, esp
call fcn.0040a64c
test eax, eax
je 0x467eac
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x467ece
push esp
mov eax, 0x1f7
call fcn.004116e8
push eax
call fcn.0044a224
add esp, 8
mov eax, 0x4a69f4
call fcn.00429838
xor eax, eax
jmp 0x467eda
push esp
push esi
call fcn.0048d8e8
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x467f9c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x44
push 0
lea eax, [esp + 8]
push eax
call fcn.0048d768
add esp, 0xc
mov dword [esp], 0x44
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x468005
test edi, edi
je 0x467fef
push edi
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x468007
xor eax, eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x4680c4
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
call sub.USER32.DLL_GetDesktopWindow
mov ebp, eax
push ebp
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push dword [esp + 8]
call sub.GDI32.DLL_GetObjectA
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [esp + 4], eax
push dword [esp]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [esp + 8], eax
push dword [esp + 4]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [esp + 0xc], eax
push 0xcc0020
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
neg ecx
push ecx
mov ecx, eax
dec ecx
push 0
push ecx
push ebx
push edx
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [esp + 8]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [esp + 0xc]
push esi
call sub.GDI32.DLL_SelectObject
push dword [esp + 4]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push ebp
call sub.USER32.DLL_ReleaseDC
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x468290
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x4a06fc
push esi
mov edx, 0x4a0714
mov eax, 0x4a070e
mov ecx, ebx
call fcn.00465984
cmp byte [ebx], 0
je 0x4682bd
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4682db
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x4682cd
cmp byte [ebx], 0
jne 0x4682db
push str._rartemp
push ebx
call fcn.0048d8e8
add esp, 8
mov eax, ebx
call fcn.0040ba60
pop esi
pop ebx
ret

Function at 0x468418
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x468447
cmp dword [esp + 4], 5
ja 0x46844b
cmp dword [esp + 4], 5
jne 0x468447
cmp dword [esp + 8], 0
ja 0x46844b
xor eax, eax
jmp 0x468450
mov eax, 1
add esp, 0x94
ret
Function at 0x4689e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x4689ed
mov eax, dword [ebp - 4]
add esp, 0xfffffaf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4a07fc
call fcn.0048dd88
call fcn.00495d7c
mov dword [ebp - 0x2458], eax
xor ebx, ebx
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.00412334
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x28fc]
call fcn.00412dfc
lea eax, [ebp - 0x28d0]
call fcn.00412dfc
lea eax, [ebp - 0x28a4]
call fcn.00412dfc
inc dword [0x4bc220]
jmp 0x468b11
test bl, bl
jne 0x468aa7
call fcn.00495d7c
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x468aa7
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.00475efc
mov bl, 1
test bl, bl
je 0x468abb
lea eax, [ebp - 0x3510]
call fcn.00477a04
call fcn.00476f7c
call fcn.004442e0
cmp byte [ebp + 0x14], 0
je 0x468adb
lea eax, [ebp - 0x3510]
call fcn.0040b578
lea edx, [ebp - 0x3510]
cmp eax, edx
jne 0x468adf
xor eax, eax
jmp 0x468ae4
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x10]
lea eax, [ebp - 0x3510]
push edx
lea edx, [ebp - 0x3110]
mov cl, byte [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x3510]
push dword [ebp + 8]
call fcn.00468bb4
lea edx, [ebp - 0x3510]
lea eax, [ebp - 0x242c]
call fcn.00412468
test eax, eax
jne 0x468b33
cmp dword [0x4bc224], 0
je 0x468a7f
dec dword [0x4bc220]
mov eax, dword [0x4bc224]
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 0x2459], dl
mov word [ebp - 0x2440], 0x14
test eax, eax
je 0x468b6a
mov eax, esi
call fcn.00464ff8
xor edx, edx
mov dword [0x4bc224], edx
jmp 0x468b71
mov eax, esi
call fcn.0046530c
test bl, bl
je 0x468b80
push dword [0x4b989c]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.0041240c
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x469907
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.0048c0c4
pop ecx
mov edi, eax
test edi, edi
jne 0x46992a
mov eax, 1
xor edx, edx
jmp 0x4699bd
mov dword [esp], 0
mov dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x469981
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x469950
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x46994b
push edi
call fcn.0048beec
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00491e60
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x46dde0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff6cc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0x10]
lea esi, [ebp - 0x44]
push 0x3c
push 0
push esi
call fcn.0048d768
add esp, 0xc
mov dword [esi], 0x3c
mov dword [esi + 4], 0x500
test bl, bl
jne 0x46de23
or dword [esi + 4], 0x40
mov dword [esi + 0x10], edi
cmp dword [ebp + 8], 0
je 0x46de34
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
jmp 0x46de58
lea edx, [ebp - 0x94]
mov ecx, 0x50
mov eax, dword [esi + 0x10]
call fcn.0046c974
test al, al
je 0x46de53
lea edx, [ebp - 0x94]
jmp 0x46de55
xor edx, edx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x14], ecx
call fcn.0040b578
cmp edi, eax
jne 0x46de8d
push edi
push str.._s
lea edx, [ebp - 0x894]
push edx
call fcn.004908b8
add esp, 0xc
lea ecx, [ebp - 0x894]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], 1
call fcn.0040f820
test eax, eax
je 0x46df4a
mov eax, dword [ebp - 4]
call fcn.0040e5d4
cmp word [eax], 0
je 0x46df4a
xor edi, edi
push str.shell32.dll
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x46ded0
push str.ShellExecuteExW
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edi, eax
test edi, edi
jne 0x46dedb
xor eax, eax
jmp 0x46dff2
mov edx, dword [ebp - 4]
mov dword [esi + 0x10], edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x46df01
lea edx, [ebp - 0x934]
mov ecx, 0x10000000
call fcn.0040f898
lea edx, [ebp - 0x934]
mov dword [esi + 0xc], edx
cmp dword [ebp - 8], 0
je 0x46df23
lea edx, [ebp - 0x1134]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.0040f898
lea eax, [ebp - 0x1134]
mov dword [esi + 0x18], eax
cmp dword [ebp + 0x14], 0
je 0x46df45
lea edx, [ebp - 0x1934]
mov ecx, 0x10000000
mov eax, dword [ebp + 0x14]
call fcn.0040f898
lea edx, [ebp - 0x1934]
mov dword [esi + 0x14], edx
push esi
call edi
jmp 0x46df50
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
je 0x46df60
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x483
jne 0x46df67
xor eax, eax
jmp 0x46dff2
test bl, bl
jne 0x46dff0
mov eax, dword [esi + 0x38]
test eax, eax
je 0x46dfaf
mov edx, dword [0x4a0bfc]
mov dword [edx*4 + 0x4c12f0], eax
mov ecx, dword [0x4a0bfc]
mov eax, dword [esi + 0x20]
mov dword [ecx*4 + 0x4c1330], eax
mov edx, dword [0x4a0bfc]
inc edx
and edx, 0x8000000f
jns 0x46dfa7
dec edx
or edx, 0xfffffff0
inc edx
mov dword [0x4a0bfc], edx
jmp 0x46dfe2
xor ebx, ebx
mov eax, dword [ebx*4 + 0x4c1330]
cmp eax, dword [esi + 0x20]
jne 0x46dfdc
push 0
push dword [ebx*4 + 0x4c12f0]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x46dfdc
mov edx, dword [ebx*4 + 0x4c12f0]
mov dword [esi + 0x38], edx
inc ebx
cmp ebx, 0x10
jl 0x46dfb1
cmp dword [ebp + 0xc], 0
je 0x46dff0
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x38]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46f280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x4bc238
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46f2b7
push 0x40
mov eax, 0x2bc
call fcn.004116e8
push eax
mov eax, 0x2bd
call fcn.004116e8
push eax
push dword [0x4b9890]
call sub.USER32.DLL_MessageBoxA
pop ebx
ret
push 0
mov edx, 0x4bc238
xor ecx, ecx
mov eax, ebx
call fcn.0046e4d4
pop ebx
ret

Function at 0x46f2cc
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffb64
mov esi, ecx
mov ebx, edx
push 0
push 0
xor edx, edx
mov eax, ebx
call fcn.0046d720
test al, al
je 0x46f318
push 0x30
mov eax, 0x65
call fcn.004116e8
push eax
mov eax, 0x596
call fcn.004116e8
push eax
push dword [0x4b9890]
call sub.USER32.DLL_MessageBoxA
jmp 0x46f4d6
cmp dword [0x4bc218], 0
jne 0x46f355
push 0
push 1
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.0046dde0
test al, al
jne 0x46f4d6
push ebx
mov eax, 0x201
call fcn.004116e8
push eax
call fcn.0044a224
add esp, 8
jmp 0x46f4d6
mov edx, esp
mov eax, str.Rar_EXXXXXXX
call fcn.00467e64
test al, al
je 0x46f4d6
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call fcn.0048f2ec
pop ecx
lea edx, [esp + 0x800]
mov eax, 0x4ba5d4
call fcn.0045d2a4
call fcn.004525f4
mov ecx, 0x4b2b34
mov edx, 0x4b2734
mov eax, 0x4ba5d4
call fcn.0045d270
mov ecx, dword [esp + 0x810]
mov dword [0x4b12ec], ecx
mov edx, 0x4a0c26
mov eax, dword [0x4b3334]
call fcn.0040efd4
call fcn.004530d4
mov eax, 0x4ba5d4
xor ecx, ecx
xor edx, edx
call fcn.004587a4
cmp dword [0x4bc228], 0
jne 0x46f4d6
lea edx, [esp + 0x89c]
mov eax, ebx
call fcn.0040b688
lea edx, [esp + 0xc9c]
mov eax, esi
call fcn.0040b794
lea edx, [esp + 0x89c]
lea eax, [esp + 0x89c]
call fcn.0040a568
lea edx, [esp + 0xc9c]
lea eax, [esp + 0xc9c]
call fcn.0040a5b0
push 0x200c
push 0
push 0x4c5598
call fcn.0048d768
add esp, 0xc
lea ecx, [esp + 0x89c]
push ecx
push 0x4c61a1
call fcn.0048d8e8
add esp, 8
mov eax, 0x4c65a2
lea edx, [esp + 0xc9c]
call fcn.0040f928
push 0x4b2734
push 0x4c559c
call fcn.0048d8e8
add esp, 8
mov edx, 0x4b2b34
mov eax, 0x4c599c
call fcn.0040f928
push esp
push 0x4c6da2
call fcn.0048d8e8
add esp, 8
lea ecx, [esp + 0x400]
push ecx
call fcn.0048f2ec
pop ecx
mov eax, dword [0x4b12ec]
cmp dword [esp + 0x88c], 0
setne dl
push 0x4c5598
and edx, 1
mov dword [0x4c619c], eax
push 0x10000
push 0x46d784
mov byte [0x4c61a0], dl
call fcn.00495bfc
add esp, 0xc
add esp, 0x149c
pop esi
pop ebx
ret
Function at 0x475d7a
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
push eax
push dword [0x4b989c]
call sub.USER32.DLL_GetDlgItem
mov ebx, eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.USER32.DLL_GetWindowTextA
push esp
push esi
call fcn.0048d89c
add esp, 8
test eax, eax
je 0x475db7
push esi
push ebx
call sub.USER32.DLL_SetWindowTextA
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x476f7c
Capabilities:
Get graphical window text

Disassembly:
add esp, 0xfffffe00
mov eax, dword [0x4b989c]
test eax, eax
je 0x477029
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.DLL_GetWindowTextA
cmp dword [0x4c7754], 8
je 0x476fce
push 0x4c7758
lea ecx, [esp + 4]
push ecx
call fcn.0048d89c
add esp, 8
test eax, eax
je 0x476fce
push 0x4c7758
push dword [0x4b989c]
call sub.USER32.DLL_SetWindowTextA
mov eax, dword [0x4c7754]
test eax, eax
je 0x476fe6
cmp eax, 1
je 0x476fe6
cmp eax, 2
je 0x476fe6
cmp eax, 8
jne 0x47700b
mov edx, 0x4c77d8
mov eax, 0x9c
call fcn.00475d7a
mov eax, 0x4c7858
call fcn.0040b578
mov edx, eax
mov eax, 0x9b
call fcn.00475d7a
mov edx, 0x64
mov eax, 2
call fcn.00444c28
test al, al
je 0x477029
push dword [0x4b989c]
call sub.USER32.DLL_UpdateWindow
add esp, 0x200
ret
Function at 0x477ec4
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
cmp dword [ebx + 8], 0
jne 0x477eea
mov eax, str.comctl32.dll
call fcn.00468010
mov dword [ebx + 8], eax
mov eax, dword [ebx]
test eax, eax
je 0x477ef6
push eax
call sub.USER32.DLL_DestroyWindow
mov dword [ebx + 0xc], 0xffffffff
mov dl, byte [ebp - 1]
mov byte [ebx + 4], dl
push 0
push dword [0x4a702c]
push dword [ebp + 8]
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp byte [ebp - 1], 0
je 0x477f2e
mov ecx, str.ComboBoxEx32
jmp 0x477f33
mov ecx, str.combobox
push ecx
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx], eax
cmp byte [ebp - 1], 0
je 0x477fde
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4209
push 0x160
lea edx, [ebp - 0x17c]
push edx
push 0
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetFileInfoA
push eax
push 0
push 0x402
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 8]
mov eax, dword [0x4c11e4]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0
lea ecx, [ebp - 0x170]
push dword [ebp - 0x178]
push ecx
push 0
push 0xffffffffffffffff
push 0
mov ecx, 1
lea edx, [ebp - 0x170]
mov eax, ebx
call fcn.0047834c
push 0
push 4
push 0x408
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0
push 0
push 0x407
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x477ff1
call fcn.00468370
jmp 0x477ff1
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.DLL_SetWindowPos
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
je 0x47801e
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x47801e
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00478080
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x47806d
call fcn.004682e8
mov edi, eax
xor esi, esi
mov ecx, esi
mov eax, 1
shl eax, cl
test eax, edi
je 0x478067
lea edx, [esi + 0x41]
lea eax, [ebp - 0x1c]
push edx
push str._c:_
push eax
call fcn.004908b8
add esp, 0xc
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov eax, ebx
push 0
push 0xffffffffffffffff
push 0
push 2
push 0xffffffffffffffff
push 1
call fcn.0047834c
inc esi
cmp esi, 0x20
jl 0x47802d
mov eax, ebx
call fcn.004784b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47834c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
push 0x408
call fcn.0048bf20
mov ebx, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebx], eax
mov edx, dword [ebp + 0x1c]
mov eax, edi
mov dword [ebx + 4], edx
call fcn.0040e5c4
push eax
lea edx, [ebx + 8]
push edx
call fcn.0048d8e8
add esp, 8
cmp byte [esi + 4], 0
je 0x478488
cmp dword [esi + 8], 0x50000
jb 0x4783b0
cmp dword [0x4bcb8c], 4
jne 0x4783b4
cmp dword [0x4bcb90], 0
jne 0x4783b4
mov byte [ebp + 8], 0
cmp byte [ebp + 8], 0
jne 0x4783c6
cmp dword [ebp + 0x18], 0xffffffff
je 0x4783ca
cmp dword [ebp + 0x14], 0
je 0x4783ca
xor eax, eax
jmp 0x4783cf
mov eax, 1
test al, al
je 0x478414
cmp dword [ebp - 4], 2
mov eax, 0x4201
jne 0x4783e1
or eax, 2
push eax
push 0x160
lea edx, [ebp - 0x164]
push edx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
cmp dword [ebp + 0x18], 0xffffffff
jne 0x478405
mov ecx, dword [ebp - 0x160]
mov dword [ebp + 0x18], ecx
cmp dword [ebp + 0x14], 0
jne 0x478414
lea eax, [ebp - 0x158]
mov dword [ebp + 0x14], eax
push 0x24
push 0
lea edx, [ebp - 0x188]
push edx
call fcn.0048d768
add esp, 0xc
mov dword [ebp - 0x188], 0x37
cmp dword [ebp + 0x14], 0
je 0x47843c
mov ecx, dword [ebp + 0x14]
jmp 0x47843f
or ecx, 0xffffffff
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x168], ebx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x184], eax
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x178], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x174], eax
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x16c], edx
push ecx
push 0
push 0x401
push dword [esi]
call sub.USER32.DLL_SendMessageA
jmp 0x4784a6
push edi
push dword [ebp + 0xc]
push 0x14a
push dword [esi]
call sub.USER32.DLL_SendMessageA
push ebx
push eax
push 0x151
push dword [esi]
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4784b0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbf4
mov esi, eax
mov eax, 0x4b98a4
call fcn.00464050
mov edi, eax
test edi, edi
je 0x478537
xor eax, eax
mov dword [esp], eax
push esp
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x478524
xor ebx, ebx
push 0
push ebx
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x478524
mov edx, dword [eax + 4]
test edx, edx
je 0x47851b
push edx
push edi
push 0
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x47851b
push 0
push ebx
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
jmp 0x478524
inc ebx
cmp ebx, 0x80
jl 0x4784dd
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x4785db
lea ecx, [esp + 0xc]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov byte [esp + 4], 0
xor edi, edi
push 0
push edi
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4785ac
cmp dword [ebx], 0
jne 0x4785a3
movzx ebp, byte [ebx + 8]
push ebp
call fcn.0049193c
pop ecx
push eax
xor eax, eax
mov al, byte [esp + 0x10]
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
call fcn.0049193c
pop ecx
pop edx
cmp edx, eax
jne 0x4785a3
push 0
push edi
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov byte [esp + 4], 1
jmp 0x4785ac
inc edi
cmp edi, 0x80
jl 0x47854d
cmp byte [esp + 4], 0
jne 0x4785c2
lea ecx, [esp + 0xc]
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00478784
cmp dword [0x4bc218], 0
je 0x4785d4
mov eax, esi
call fcn.00478a0c
jmp 0x4785db
mov eax, esi
call fcn.004789e4
add esp, 0x40c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4785e8
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
push dword [ebx]
call sub.USER32.DLL_GetWindowTextA
mov eax, esp
call fcn.00444aa0
mov edx, esp
push edx
push 0xffffffffffffffff
push 0x158
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x478650
push 0
push eax
push 0x14e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov eax, ebx
call fcn.004786a4
cmp dword [0x4bc218], 0
je 0x478647
mov eax, ebx
call fcn.00478a0c
jmp 0x47869a
mov eax, ebx
call fcn.004789e4
jmp 0x47869a
cmp dword [0x4bc218], 0
je 0x478674
mov eax, esp
call fcn.0040bf24
test al, al
jne 0x478674
mov edx, esp
mov eax, 0x4b98a4
xor ecx, ecx
call fcn.00461c04
jmp 0x47869a
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x478693
test al, 0x10
jne 0x478693
mov edx, esp
mov eax, 0x4b98a4
xor ecx, ecx
call fcn.00461a94
jmp 0x47869a
mov eax, esp
call fcn.00444f20
add esp, 0x400
pop ebx
ret

Function at 0x4789e4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov ecx, esp
mov edx, esp
mov eax, ebx
call fcn.00478784
add esp, 0x400
pop ebx
ret