joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426004]
jne 0x401010
repz ret
jmp fcn.004016df

Function at 0x406568
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004023d2
and dword [ebp - 4], 0
cmp dword [0x4280bc], 0
mov ebx, eax
jne 0x406619
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4066ca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4066ca
push eax
call fcn.00402360
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4280bc], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4280c0], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4280c4], eax
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4280cc], eax
test eax, eax
je 0x406619
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4280c8], eax
mov eax, dword [0x4280c8]
cmp eax, ebx
je 0x406671
cmp dword [0x4280cc], ebx
je 0x406671
push eax
call fcn.004023db
push dword [0x4280cc]
mov esi, eax
call fcn.004023db
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406671
test edi, edi
je 0x406671
call esi
test eax, eax
je 0x406668
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406668
test byte [ebp - 0xc], 1
jne 0x406671
or dword [ebp + 0x10], 0x200000
jmp 0x4066aa
mov eax, dword [0x4280c0]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4066aa
mov eax, dword [0x4280c4]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4280bc]
call fcn.004023db
pop ecx
test eax, eax
je 0x4066ca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4066cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4208bb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x436024]
push dword [0x435d40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x42094a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ebx, 0x19f
jne 0x42095e
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x420982
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.0042093f
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x420966
pop esi
pop edi
cmp ebx, 0x2d
jne 0x420999
or dword [0x436034], 0xffffffff
mov dword [0x436030], 0xa62e7790
leave
ret
Function at 0x403220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x403249
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40325f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403256
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x403292
nop
cmp esi, ecx
jae 0x403256
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x403280
cmp esi, ecx
jae 0x403256
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x405270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0043368a
Function at 0x40bbf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a1e4
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x608ec4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebx], vtable.Ryeol::CHttpClientT_class_Ryeol::CHttpToolA__class_Ryeol::CHttpEncoderA_.0
lea esi, [ebx + 0x24]
mov dword [ebx + 0x20], vtable.Ryeol::CHttpClientMapT_class_Ryeol::CHttpToolA_.0
push 0x1c
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00425426
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [ebp - 4], 0
lea esi, [ebx + 0x30]
mov dword [ebx + 0x2c], vtable.Ryeol::CHttpClientMapT_class_Ryeol::CHttpToolA_.0
push 0x1c
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00425426
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea ecx, [ebx + 0x54]
call fcn.0040b1d0
lea ecx, [ebx + 0x8c]
call fcn.0040b1d0
mov dword [ebx + 4], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov byte [ebp - 4], 4
call fcn.0040a840
mov ecx, eax
mov dword [ebx + 8], ecx
test ecx, ecx
je 0x40bdd3
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bd20
sub ecx, edx
lea eax, [ecx + 0x1f]
push eax
call fcn.0057bce0
mov ecx, eax
add esp, 4
mov dword [ebx + 0x14], ecx
test ecx, ecx
je 0x40be55
mov edx, str.multipart_form_data__boundary
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x40bd47
mov edx, dword [ebx + 8]
mov esi, edx
mov edi, dword [ebx + 0x14]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x40bd60
sub edx, esi
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bd70
mov ecx, edx
lea eax, [ebx + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push dword [ebx + 8]
call fcn.0040cc50
mov dword [ebx + 0xc], eax
jmp 0x40bdd3
mov dword [ebx + 0xc4], 0
mov eax, ebx
mov dword [ebx + 0xc8], 0
mov dword [ebx + 0xcc], 0
mov dword [ebx + 0xd0], 0
mov dword [ebx + 0xd4], 0
mov dword [ebx + 0xd8], 0
mov dword [ebx + 0xdc], 0
mov dword [ebx + 0xe0], 0
mov dword [ebx + 0xe4], 0
mov dword [ebx + 0xe8], 1
mov dword [ebx + 0xec], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x6039f4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.Out_of_memory
push eax
call fcn.0057224a
int3
Function at 0x40ce00
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xe4], 0
je 0x40ceba
cmp dword [ebp + 8], 0
je 0x40ce9d
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40ce9d
cmp dword [ebp + 0x10], 0
lea ebx, [edi + 0x8c]
push esi
mov ecx, ebx
je 0x40ce3e
call fcn.0040b8a0
jmp 0x40ce43
call fcn.0040b540
mov ecx, dword [edi + 0xe4]
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x40cec6
xor edi, edi
test esi, esi
je 0x40ce7e
lea eax, [esp + 0x10]
push eax
mov eax, esi
sub eax, edi
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x40cea6
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edi, esi
jb 0x40ce57
cmp dword [ebp + 0x10], 0
mov ecx, ebx
push esi
je 0x40ce95
call fcn.0040b8a0
add dword [ebx + 0x14], esi
mov ecx, ebx
add dword [ebx + 0x34], esi
push esi
call fcn.0040b540
add dword [ebx + 0xc], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x198
call fcn.0040a250
xor edx, edx
mov ecx, str.CHttpClientT::_WritePost:_m_hRequest_can_not_be_NULL.
call fcn.0040a220
xor edx, edx
mov ecx, str.CHttpToolA::InternetWriteFile:_hRequest_can_not_be_NULL.
call fcn.0040a220
int3
Function at 0x412a50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x608ec4]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
mov dword [esp + 0x14], ecx
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x412a80
sub edi, ecx
add edi, 0xffffffff
js 0x412b16
cmp byte [ebx + edi], 0x5c
jne 0x412a9f
cmp byte [ebx + edi - 1], 0x3a
jne 0x412aa6
sub edi, 1
jns 0x412a92
jmp 0x412b16
lea esi, [edi + 1]
push esi
call fcn.0042545e
push esi
mov esi, eax
mov dword [esp + 0x18], eax
push 0
push esi
call fcn.005720f0
push edi
push ebx
push esi
call fcn.00571b70
lea eax, [esp + 0x34]
push eax
push esi
call fcn.0057d0ab
add esp, 0x24
cmp eax, 0xffffffff
jne 0x412b0b
mov ecx, dword [esp + 0x14]
push esi
call fcn.00412a50
test al, al
jne 0x412b0b
push 1
push esi
call fcn.0056eea1
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.0056ee93
mov esp, ebp
pop ebp
ret 4
push 1
push esi
call fcn.0056eea1
add esp, 8
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x144]
test eax, eax
pop edi
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.0056ee93
mov esp, ebp
pop ebp
ret 4
Function at 0x412c10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x608ec4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x612b60]
mov ebx, 1
push 0xf0
push 0x88
push esi
mov dword [ebp - 0x114], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x412e6c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x412e6c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x412e6c
mov edx, 0x1234
push edi
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x412e6b
mov ecx, dword [esi + 4]
mov edi, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x118], ecx
mov ecx, 0x403
mov dword [ebp - 0x110], edi
cmp cx, ax
jne 0x412d77
lea eax, [ebp - 0x84]
mov dword [ebp - 0x88], eax
test esi, esi
jne 0x412cc4
xor eax, eax
mov dword [ebp - 0x88], eax
jmp 0x412d32
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412cd0
sub ecx, edx
lea edi, [ecx + 1]
test edi, edi
js 0x412e8a
cmp edi, 0x80
jle 0x412cf9
push 1
push edi
call fcn.0057bba0
add esp, 8
jmp 0x412cff
lea eax, [ebp - 0x84]
mov dword [ebp - 0x88], eax
test eax, eax
je 0x412e80
test edi, edi
je 0x412d1c
push edi
push esi
push eax
call fcn.00571b70
add esp, 0xc
push 0
call fcn.00408450
mov eax, dword [ebp - 0x88]
add esp, 4
mov edi, dword [ebp - 0x110]
push eax
push 0
push 0x143
movzx eax, di
push eax
mov eax, dword [ebp - 0x114]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x88]
cmove ebx, ecx
lea ecx, [ebp - 0x84]
cmp eax, ecx
je 0x412e54
push eax
call fcn.0057bbb0
add esp, 4
jmp 0x412e54
cmp dx, ax
jne 0x412e59
mov dword [ebp - 0x13c], 1
lea eax, [ebp - 0x108]
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0x10c], eax
test esi, esi
jne 0x412dae
xor eax, eax
mov dword [ebp - 0x10c], eax
jmp 0x412e15
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412db3
sub ecx, edx
lea edi, [ecx + 1]
test edi, edi
js 0x412e8a
cmp edi, 0x80
jle 0x412ddc
push 1
push edi
call fcn.0057bba0
add esp, 8
jmp 0x412de2
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], eax
test eax, eax
je 0x412e80
test edi, edi
je 0x412dff
push edi
push esi
push eax
call fcn.00571b70
add esp, 0xc
push 0
call fcn.00408450
mov eax, dword [ebp - 0x10c]
add esp, 4
mov edi, dword [ebp - 0x110]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], eax
cmp eax, ecx
je 0x412e2e
push eax
call fcn.0057bbb0
add esp, 4
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x401
movzx eax, di
push eax
mov eax, dword [ebp - 0x114]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp eax, 0xffffffff
je 0x412e69
mov edx, 0x1234
add esi, dword [ebp - 0x118]
test ebx, ebx
jne 0x412c76
jmp 0x412e6b
xor ebx, ebx
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0056ee93
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.00403680
push 0x80070057
call fcn.00403680
int3
Function at 0x412ee0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a825
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x608ec4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x412f32
test al, 0x10
je 0x412f32
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5c
push dword [edi]
call fcn.005803aa
mov esi, eax
add esp, 8
test esi, esi
jne 0x412f49
or esi, 0xffffffff
jmp 0x412f4b
sub esi, dword [edi]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.004039d0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x10], eax
or ebx, 0xffffffff
mov dword [ebp - 4], 0
cmp esi, ebx
je 0x41300d
push esi
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.004103b0
mov byte [ebp - 4], 1
mov ecx, dword [eax]
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x412fd5
cmp dword [esi + 0xc], 0
jl 0x412fc9
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x412fc9
push edx
call fcn.004039d0
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, ebx
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412fc1
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x10], eax
jmp 0x412fd5
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x10]
call fcn.004036d0
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412ff3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x10]
call fcn.00412ee0
test eax, eax
je 0x41300d
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
jmp 0x41300f
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41302e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420660
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b4d0
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x608ec4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x470], ebx
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x45c
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x46c]
push 0
push eax
mov dword [ebp - 0x478], edi
call fcn.005720f0
mov ecx, dword [ebp + 0x1c]
add esp, 0xc
xor eax, eax
test ecx, ecx
setne al
test ecx, ecx
cmove esi, edi
lea eax, [eax*8 + 0x4201]
push eax
push 0x45c
lea eax, [ebp - 0x46c]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x480], 0
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x420879
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x47c], esi
mov eax, dword [ebp + 0x10]
lea ecx, [ebx + 0x128]
mov dword [ebp - 4], 0
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x4a0]
push eax
mov dword [ebp - 0x4a0], 0x1f
mov dword [ebp - 0x488], 0
call fcn.004324e1
push dword [ebp - 0x46c]
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0x404
call fcn.00425426
mov ebx, eax
add esp, 4
mov dword [ebp - 0x47c], ebx
test ebx, ebx
je 0x4207b2
push 0x404
push 0
push ebx
call fcn.005720f0
add esp, 0xc
jmp 0x4207b4
xor ebx, ebx
mov edx, ebx
mov ecx, edi
sub edx, edi
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4207c0
mov eax, dword [ebp - 0x470]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x146
mov dword [ebx + 0x400], 1
push dword [eax + 0x148]
call edi
push ebx
dec eax
push eax
mov eax, dword [ebp - 0x470]
push 0x151
push dword [eax + 0x148]
call edi
mov edi, dword [ebp - 0x474]
lea eax, [ebp - 0x460]
push eax
push 0x400
lea eax, [edi + 0x400]
push eax
call fcn.0057b0ba
push dword [ebp - 0x478]
push 0x400
push edi
call fcn.0057b0ba
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42085b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056ee93
mov esp, ebp
pop ebp
ret 0x18
push 0x80004005
call fcn.00403680
int3
Function at 0x4214c0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc78
mov eax, dword [0x608ec4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, 0x7fc01ff1
xor ecx, ecx
mov dword [ebp - 0xc68], ecx
push esi
mov ecx, dword [ebx + 0x4b0]
mov esi, dword [ebx + 0x4ac]
sub ecx, esi
imul ecx
push edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4216b5
xor edi, edi
mov dword [ebp - 0xc6c], edi
nop dword [eax]
push 0x45c
add esi, edi
lea eax, [ebp - 0x460]
mov ecx, 0x201
lea edi, [ebp - 0xc64]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.005720f0
add esp, 0xc
lea eax, [ebp - 0x460]
push 0x4301
push 0x45c
push eax
push 0
lea eax, [ebp - 0xc64]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0
push 0
push 0x1004
push dword [ebx + 0x248]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x454]
push 0
push 0
push ecx
push eax
push 3
lea ecx, [ebx + 0x228]
call fcn.00426efe
push 0x5e21bf
mov edi, eax
lea ecx, [ebx + 0x228]
push 1
push edi
mov dword [ebp - 0xc70], edi
call fcn.00427124
push 0x5e5a90
push 2
push edi
lea ecx, [ebx + 0x228]
call fcn.00427124
push 0x433
call fcn.00425426
mov edi, eax
add esp, 4
mov dword [ebp - 0xc78], edi
test edi, edi
je 0x4215e4
push 0x433
push 0
push edi
call fcn.005720f0
add esp, 0xc
jmp 0x4215e6
xor edi, edi
movups xmm0, xmmword [0x5abea0]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
lea eax, [ebp - 0xc74]
push eax
call fcn.00422680
mov eax, dword [ebp - 0xc74]
mov esi, edi
mov ecx, eax
sub esi, ecx
nop dword [eax]
mov dl, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], dl
test dl, dl
jne 0x421610
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x421635
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ax, word [0x5e5a94]
lea ecx, [ebx + 0x228]
push edi
push 0
push 0
push 0
push 0
push 4
mov word [edi + 0x400], ax
mov al, byte [0x5e5a96]
push 0
push dword [ebp - 0xc70]
mov byte [edi + 0x402], al
mov byte [edi + 0x432], 1
call fcn.0042707f
mov ecx, dword [ebx + 0x4b0]
mov eax, 0x7fc01ff1
mov esi, dword [ebx + 0x4ac]
sub ecx, esi
mov edi, dword [ebp - 0xc6c]
inc dword [ebp - 0xc68]
add edi, 0x804
imul ecx
mov dword [ebp - 0xc6c], edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0xc68], eax
jb 0x421510
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056ee93
mov esp, ebp
pop ebp
ret
Function at 0x4220f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b773
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x608ec4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], eax
push 0x400
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x410]
push 0
push eax
mov dword [ebp - 0x420], 0
call fcn.005720f0
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0xe
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x422305
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x414]
call fcn.004033a0
test al, al
jne 0x4221cc
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4221b0
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
lea ecx, [ebp - 0x414]
call fcn.004036d0
mov dword [ebp - 4], 2
mov edi, dword [ebp - 0x414]
push 0x5c
push edi
mov esi, dword [edi - 0xc]
call fcn.005803aa
mov ecx, eax
add esp, 8
sub eax, edi
or ebx, 0xffffffff
test ecx, ecx
lea ecx, [ebp - 0x414]
cmove eax, ebx
sub esi, eax
lea eax, [ebp - 0x418]
dec esi
push esi
push eax
call fcn.004104b0
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x418]
push 0x5e21bf
push esi
call fcn.0057a1f3
add esp, 8
test eax, eax
jne 0x42223d
push 6
push str.Videos
lea ecx, [ebp - 0x418]
call fcn.004036d0
mov esi, dword [ebp - 0x418]
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x42230f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x41c]
add eax, 0x10
mov dword [ecx], eax
lea eax, [ebp - 0x424]
mov dword [ebp - 0x420], 1
push eax
call fcn.004219a0
push esi
mov byte [ebp - 4], 4
push dword [eax]
push str._s_s
push dword [ebp - 0x41c]
call fcn.00403070
mov byte [ebp - 4], 3
add esp, 0x10
mov edx, dword [ebp - 0x424]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4222ad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4222c8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4222e1
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056ee93
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00403680
push 0x80004005
call fcn.00403680
int3