joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496c1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf di, sp
dec dx
call fcn.00496c47
push edx
invalid

Function at 0x498fbc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push bp
mov word [esp + 2], si
call fcn.00498f98
rdtsc
bsr eax, ebp
ja 0x49905a
jbe 0x49901c
pushfd
pop ss
xchg edx, esp
adc esi, ebx
or ah, byte [ebp + 0x5e99cd4]
idiv edi
call dword [edi - 0x35]
pop ebx
int 0x7a
jmp [edx - 0x7b]
mov esi, dword [esp + 0x2c]
mov bh, cl
rdtsc
jmp 0x49903d
push ebx
pop word [esp]
lea esp, [esp + 2]
jmp 0x499063
rdtsc
jmp 0x49907b
lea ebp, [esp]
cmc
jbe 0x499027
rdtsc
btc eax, ebp
stc
jmp 0x49907f
push ebx
pop word [esp]
lea esp, [esp + 2]
jmp 0x499006
mov edi, esp
shr edx, 0x1a
jae 0x499087
pushfd
neg dl
mov edx, dword [esp]
jmp 0x499093
btc eax, ebp
stc
sub esp, 0xc0
jmp 0x499065
pushfd
jmp 0x49908e
neg dl
mov edx, dword [esp]
mov ecx, esi
mov dh, 0x59
jmp 0x49917b
xor edx, 0xfbcb7cf0
setge bl
stc
jo 0x4990b6
jno 0x4990b6
mov dl, byte [edx + ecx*4]
in eax, dx
sbb al, 0xdf
sbb al, 0x81
adc dword [eax - 0x7d], esi
inc edi
fiadd word [edx - 0x30]
mov bh, 0x42
lock and dword [esi - 0x3f], 0xffffffdb
or ah, byte [esi - 0x75]
add al, 0x24
rcr bx, 0xa
mov ax, word [esp]
xchg ah, al
jmp 0x4990cc
neg al
cmp dh, al
jmp 0x4990ed
bsf ebx, ecx
jo 0x499137
neg al
cmp dh, al
rcr bx, 0xa
mov ax, word [esp]
xchg ah, al
jmp 0x4990cc

Function at 0x4b94cd
Capabilities:
Encode data using base64

Disassembly:
push word [esp + 2]
lea esp, [esp + 2]
jmp 0x4b9a9e
mov byte [edx + 3], 0x3d
jmp 0x4b95b4
lea esp, [esp + 8]
cmp dword [ebp + 0xc], 3
jne 0x4b94ec
jmp 0x4b9cea
cmp ebx, 0x1a
pushal
pushfd
lea esp, [esp + 0x24]

Function at 0x4b994b
Capabilities:
Encode data using base64

Disassembly:
jmp 0x4b9a4f
cmp edi, 0x34
jmp 0x4b9982
call fcn.004b9a65
push 0x47
invalid
call fcn.004b99e7
xchg dl, ch
pop esi
out dx, al
dec ebx
or byte [esi - 0x57692c64], dh
lea edx, reloc.MSVBVM60.DLL___vbaVarSub
cmp edi, eax
push cx
lea esp, [esp + 2]
jmp 0x4b9a41
call fcn.004b9a71
mov dword [esp], edx
jmp 0x4b9954
lea esp, [esp + 4]
jb 0x484bb8
pushal
jmp 0x4b9a87
jae 0x484c3c
mov ecx, 0x46da5170
mov cx, di
jmp 0x4b99a3
setle cl
lea ecx, [edi + 0x41]
jmp 0x484bfa
lea ecx, [edi + 0x47]
jmp 0x484bfa
lea esp, [esp + 2]
lea esp, [esp + 4]
jae 0x484be4
lea ecx, reloc.MSVBVM60.DLL___vbaVarSub
mov ch, bl
jmp 0x4b9998
jae 0x484c26
lea ecx, [edi - 4]
jmp 0x484bfa
mov byte [edx + 2], 0x3d
jmp 0x4b94c8
lea esp, [esp + 0x20]
cmp edi, 0x1a
push ebp
mov word [esp + 1], di
push word [esp + 2]
jmp 0x4b99b9

Function at 0x4b9a65
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
mov byte [edx + 2], cl
jmp 0x4b94c8
Function at 0x4b9a71
Capabilities:
Encode data using base64

Disassembly:
and eax, dword [esi - 0x4b]
push es
and eax, 0xbc4d2ab4
js 0x4b9a86
cli
invalid
call fcn.004b94cd
je 0x4b9a5a
jo 0x4b9a91
loop 0x4b9aa0
mov dh, 0x27
mov bh, 0xd2
and dword [edx + ebx*8 - reloc.MSVBVM60.DLL___vbaVarSub], ebx
mov esi, 0x2024648d
jl 0x4b9ab7
add dword [esi - 1], esp
je 0x4b9abc
add ch, cl
sbb edi, edi
invalid
and al, 8
cmp dword [edx], eax
add byte [eax], al
inc ecx
add byte [eax], al
lahf
or dword [ecx + reloc.MSVBVM60.DLL___vbaVarSub], ebx
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
clc
or edi, dword [esi + reloc.MSVBVM60.DLL___vbaVarSub]
stosb byte es:[edi], al
outsd dx, dword [esi]
dec ebx
loop 0x4b9ae5
insb byte es:[edi], dx
jg 0x4b9ab3
imul edi, ebp, 0x4b8dffff
inc edi
jmp 0x4ba3db
loopne 0x4b9a6e
jb 0x4b9aad
ljmp 0:0x766830f

Function at 0x553b30
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov word [esp + 3], ax
mov bl, 5
push dword [esp + 5]
jmp 0x553b6c
mov si, ax
xchg word [esp + 0xe], si
add esp, 0x1b
mov esi, ebp
jmp 0x553b1a
bsr bx, bx
xchg dword [esp], ebx
mov edx, dword [esp + 2]
add esp, 8
xchg dl, bl
push word [esp + 1]
jmp 0x553b56

Function at 0x553fdd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 5], si
neg esi
push dword [esp + 0xa]
jmp 0x555d6f
cpuid
neg si
pop dword [esp + 5]
mov di, dx
std
rol ah, cl
rdtsc
push word [esp + 2]
jmp 0x554b90
mov ebp, ebx
cld
cpuid
pop si
mov al, 0xe9
lea esp, [esp + 3]
jmp 0x554bfb

Function at 0x554021
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov ah, 0xa
pop edi
add esp, 1
stc
mov ah, byte [esp]
jmp 0x55402a
mov ax, word [esp + 2]
mov dh, 0xd
jmp 0x55400b
xchg al, dl
cpuid
mov bl, dl
xchg si, ax
lea esi, [edi*4]
bsf esi, ebp
jmp 0x55407a
xchg byte [esp], ch
lea ebp, [edx*4]
rol ah, cl
xchg bx, ax
lea ebp, [ecx*4]
rdtsc
jmp 0x554064

Function at 0x5542c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, di
lea ebx, [eax*4]
btr ecx, edi
inc dh
jmp 0x55431a
rdtsc
neg ebx
neg ecx
stc
xchg di, ax
lea esp, [esp + 0x13]
jmp 0x5542e5
mov edx, dword [esp + 0x13]
xchg edx, eax
lea esp, [esp + 0xc]
cmc
push dword [esp + 5]
mov al, byte [esp + 4]
jmp 0x5542fb

Function at 0x55435a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0xd2
jmp 0x554363
inc al
add esp, 2
lea ebx, [eax + ecx]
mov byte [esp], ah
xchg esi, ebp
setne bl
jmp 0x5543ad
push bx
bts bp, dx
cpuid
xchg al, bh
push word [esp + 2]
rdtsc
jmp 0x55438a
Function at 0x401b30
Capabilities:
Create directory

Disassembly:
sub esp, 0x3e8
push esi
mov esi, dword [esp + 0x3f0]
test esi, esi
jne 0x401b4c
xor al, al
pop esi
add esp, 0x3e8
ret
push esi
call fcn.00401990
add esp, 4
test eax, eax
je 0x401b63
xor al, al
pop esi
add esp, 0x3e8
ret
lea eax, [esp + 4]
push esi
push eax
call fcn.004330d3
lea ecx, [esp + 0xc]
push ecx
call fcn.004017d0
lea edx, [esp + 0x10]
push edx
call fcn.00432a93
add esp, 0x10
cmp eax, 3
ja 0x401bbb
lea eax, [esp + 4]
push eax
call fcn.00432a93
add esp, 4
cmp eax, 2
jb 0x401b59
cmp word [esp + 6], 0x3a
jne 0x401b59
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x401b59
mov al, 1
pop esi
add esp, 0x3e8
ret
lea ecx, [esp + 4]
push ecx
call fcn.00401b30
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
add esp, 0x3e8
ret

Function at 0x402b00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45044e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x463e90]
push ebx
mov ebx, ecx
push ebp
push esi
push edi
lea ebp, [ebx + 0x4bc]
mov dword [esp + 0x10], ebx
mov dword [ebp], eax
lea edx, [ebx + 0x4c0]
mov ecx, 0x16
xor eax, eax
mov edi, edx
mov dword [ebx], fcn.00402c10
lea esi, [ebx + 0xc]
rep stosd dword es:[edi], eax
mov ecx, 0x12c
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov dword [ebx + 0x4dc], esi
mov esi, dword [esp + 0x2c]
mov dword [edx], 0x58
mov edx, dword [esp + 0x28]
test esi, esi
mov dword [esp + 0x1c], 0
mov dword [ebx + 8], ecx
mov dword [ebx + 0x4e0], 0x257
mov dword [ebx + 0x4fc], edx
mov dword [ebx + 0x4f4], eax
je 0x402bb6
cmp word [esi], 0
je 0x402bb6
push esi
call fcn.00432a93
lea ecx, [eax + eax + 2]
lea edi, [ebx + 0xc]
mov edx, ecx
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x402be3
push eax
mov ecx, ebp
call fcn.00444cb3
push 0
push 0x7c
mov ecx, ebp
call fcn.00443079
mov eax, dword [ebp]
mov ecx, dword [esp + 0x38]
mov dword [ebx + 0x4cc], eax
mov dword [ebx + 4], ecx
jmp 0x402bea
mov edx, dword [esp + 0x38]
mov dword [ebx + 4], edx
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x402dc0
Capabilities:
Identify system language via api

Disassembly:
sub esp, 8
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x10], esi
je 0x402eb1
cmp dword [edi + 4], esi
je 0x402eb1
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x402eb1
cmp dword [esp + 0x18], 8
jbe 0x402eb1
push str.040904b0
push eax
call fcn.004330d3
mov edx, dword [edi + 0x10]
add esp, 8
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push str.VarFileInfoTranslation
push edx
mov dword [esp + 0x28], esi
call dword [edi + 4]
test eax, eax
je 0x402eb1
cmp dword [esp + 8], 4
jb 0x402eb1
cmp dword [esp + 0x18], esi
je 0x402eb1
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
xor ecx, ecx
shr edx, 2
je 0x402e78
mov edi, eax
mov eax, ebx
and edi, 0xffff
mov bp, word [eax]
mov dword [esp + 0x14], 0
mov word [esp + 0x14], bp
mov ebp, dword [esp + 0x14]
cmp ebp, edi
je 0x402e76
inc ecx
add eax, 4
cmp ecx, edx
jb 0x402e54
jmp 0x402e78
mov esi, ecx
xor eax, eax
xor ecx, ecx
mov al, byte [ebx + esi*4 + 2]
mov cl, byte [ebx + esi*4 + 3]
push eax
xor edx, edx
mov dl, byte [ebx + esi*4]
xor eax, eax
mov al, byte [ebx + esi*4 + 1]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push str._.2x_.2x_.2x_.2x
push ecx
call fcn.004330f8
add esp, 0x18
mov al, 1
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret 8
pop edi
xor al, al
pop esi
add esp, 8
ret 8
Function at 0x404210
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00404310
mov ecx, dword [esp + 0xc]
test ecx, ecx
jne 0x404228
xor al, al
pop esi
pop ecx
ret 8
mov al, byte [esp + 0x10]
push 0
mov dl, al
push 0x80
neg dl
sbb edx, edx
add edx, 4
neg al
sbb eax, eax
push edx
and eax, 0xc0000000
push 0
add eax, 0xc0000000
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x404266
xor al, al
pop esi
pop ecx
ret 8
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [esi + 0x10], eax
lea eax, [esp + 8]
push 0
push eax
push 2
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push eax
call edi
cmp dword [esp + 8], 1
jbe 0x4042d8
mov eax, dword [esi + 4]
mov cl, byte [eax]
cmp cl, 0xff
jne 0x4042c9
cmp byte [eax + 1], 0xfe
jne 0x4042c9
mov ecx, dword [esi + 8]
push 0
push 0
push 2
push ecx
call edi
jmp 0x4042d4
test cl, cl
je 0x4042d8
mov cl, byte [eax + 1]
test cl, cl
jne 0x4042d8
mov byte [esi + 0xc], 1
mov edi, dword [esi]
test edi, edi
je 0x4042e7
mov ecx, 0x800
xor eax, eax
rep stosd dword es:[edi], eax
mov esi, dword [esi + 4]
test esi, esi
je 0x4042f9
mov ecx, 0x400
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
pop edi
mov al, 1
pop esi
pop ecx
ret 8

Function at 0x404310
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x404334
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
mov edi, dword [esi]
xor edx, edx
cmp edi, edx
mov dword [esi + 0x10], edx
mov byte [esi + 0xc], dl
je 0x40434b
mov ecx, 0x800
xor eax, eax
rep stosd dword es:[edi], eax
mov esi, dword [esi + 4]
cmp esi, edx
je 0x40435d
mov ecx, 0x400
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
pop edi
pop esi
ret

Function at 0x404560
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov al, byte [esi + 0xc]
test al, al
je 0x40457b
mov eax, dword [esi + 4]
push eax
call fcn.00432a93
add esp, 4
shl eax, 1
jmp 0x40458c
push edi
mov edi, dword [esi + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
mov eax, ecx
mov edx, 0x1000
sub edx, eax
test edx, edx
jg 0x40459c
xor al, al
pop esi
pop ecx
ret
lea ecx, [esp + 4]
push 0
push ecx
mov cl, byte [esi + 0xc]
xor eax, eax
mov dword [esp + 0xc], 0
test cl, cl
setne al
inc eax
mov ecx, edx
sub ecx, eax
mov eax, dword [esi + 4]
sub eax, edx
push ecx
mov ecx, dword [esi + 8]
add eax, 0x1000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4045d9
xor al, al
pop esi
pop ecx
ret
mov eax, dword [esp + 4]
pop esi
test eax, eax
setne al
pop ecx
ret
Function at 0x4045f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [esp + 0x10], ebx
mov byte [esp + 0xe], 0xff
mov byte [esp + 0xf], 0xfe
call fcn.00404360
test al, al
je 0x4046b3
mov ecx, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 1
push eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call edi
mov cl, byte [esi + 0xc]
mov dword [esp + 0x14], eax
cmp cl, bl
je 0x404696
cmp eax, 2
jne 0x404696
cmp dword [esp + 0x18], ebx
jne 0x404696
mov edx, dword [esi + 8]
push ebx
push ebx
push ebx
push edx
call edi
mov edx, dword [esi + 8]
lea eax, [esp + 0x10]
push ebx
push eax
lea ecx, [esp + 0x14]
push 2
push ecx
push edx
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0xc]
lea eax, [esp + 0xe]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x404692
mov eax, dword [esi + 8]
push ebx
push ebx
push ebx
push eax
call edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
jmp 0x40469c
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x18]
jne 0x4046b3
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ebx
push ecx
lea edx, [esp + 0x16]
push 2
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4046c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
call fcn.00404360
test al, al
jne 0x4046d4
pop edi
pop esi
pop ecx
ret 4
mov ecx, edi
call fcn.004045f0
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x4046eb
pop edi
xor al, al
pop esi
pop ecx
ret 4
push esi
call fcn.00432a93
add esp, 4
test eax, eax
jg 0x404700
pop edi
xor al, al
pop esi
pop ecx
ret 4
lea ecx, [esp + 8]
push 0
lea edx, [eax + eax]
mov eax, dword [edi + 8]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop edi
pop esi
setne al
pop ecx
ret 4

Function at 0x404730
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00404360
test al, al
jne 0x404742
pop esi
pop ecx
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x404751
xor al, al
pop esi
pop ecx
ret 4
push eax
mov ecx, esi
call fcn.004046c0
mov ecx, dword [esi + 8]
lea eax, [esp + 4]
push 0
push eax
push 4
push 0x462398
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
pop esi
pop ecx
ret 4
Function at 0x405b60
Capabilities:
Link many functions at runtime

Disassembly:
mov al, byte [0x4681ec]
push esi
test al, al
push edi
mov esi, ecx
jne 0x405c6c
mov ecx, 0x11
xor eax, eax
mov edi, esi
push str.uxtheme.dll
rep stosd dword es:[edi], eax
mov byte [0x4681ec], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi], eax
je 0x405c6c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetWindowTheme
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.OpenThemeData
push eax
call edi
mov ecx, dword [esi]
push str.DrawThemeBackground
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.CloseThemeData
push edx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi]
push str.DrawThemeEdge
push eax
call edi
mov ecx, dword [esi]
push str.DrawThemeText
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.DrawThemeParentBackground
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.GetThemeBackgroundContentRect
push eax
call edi
mov ecx, dword [esi]
push str.EnableThemeDialogTexture
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push 0x46242c
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi]
push 0x462410
push eax
call edi
mov ecx, dword [esi]
push 0x4623fc
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi]
push 0x4623ec
push edx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi]
push 0x4623dc
push eax
call edi
mov ecx, dword [esi]
push 0x4623cc
push ecx
mov dword [esi + 0x38], eax
call edi
mov edx, dword [esi]
push 0x4623b8
push edx
mov dword [esi + 0x3c], eax
call edi
mov dword [esi + 0x40], eax
pop edi
pop esi
ret
Function at 0x40c580
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
jne 0x40c591
pop edi
pop esi
xor al, al
pop ebx
ret
mov edi, dword [esp + 0x14]
cmp edi, 0x104
jge 0x40c5a3
pop edi
pop esi
xor al, al
pop ebx
ret
mov ebx, dword [esp + 0x18]
test ebx, ebx
jne 0x40c5b1
pop edi
pop esi
xor al, al
pop ebx
ret
cmp word [ebx], 0
jne 0x40c5bd
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40c5ec
cmp word [eax], 0
je 0x40c5ec
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40c5e7
cmp eax, edi
jg 0x40c5e7
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x40c5ec
mov word [esi], 0
cmp word [esi], 0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
jne 0x40c633
push 0
push 5
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40c60f
pop edi
pop esi
xor al, al
pop ebx
ret
push 0x462d18
push esi
call edi
test eax, eax
jne 0x40c621
pop edi
pop esi
xor al, al
pop ebx
ret
push 0x4625cc
push esi
call edi
test eax, eax
jne 0x40c633
pop edi
pop esi
xor al, al
pop ebx
ret
mov al, byte [esp + 0x1c]
test al, al
je 0x40c644
push esi
call fcn.00401b30
add esp, 4
push ebx
push esi
call edi
test eax, eax
pop edi
pop esi
setne al
pop ebx
ret

Function at 0x40d480
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
push ebx
mov ebx, dword [esp + 0x2bc]
push ebp
mov ebp, dword [esp + 0x2c4]
push esi
and ebp, 0x10
mov esi, ecx
je 0x40d4a7
push 0
push str._FOLDER
jmp 0x40d4c2
test ebx, ebx
je 0x40d4b1
cmp word [ebx], 0
jne 0x40d4bf
push 0
push str._NOEXT
mov ecx, esi
call fcn.0040d380
push 0
push ebx
mov ecx, esi
call fcn.0040d380
test eax, eax
jge 0x40d588
push edi
mov ecx, 0xac
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
test ebp, ebp
pop edi
mov eax, 0x462de2
jne 0x40d4f3
mov eax, ebx
mov edx, ebp
push 0x410
neg edx
sbb edx, edx
lea ecx, [esp + 0x10]
and edx, 0xffffff90
push 0x2b4
add edx, 0x80
push ecx
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp word [esp + 0x220], 0
je 0x40d585
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d533
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
test ebp, ebp
je 0x40d53e
mov eax, str._FOLDER
jmp 0x40d54f
test ebx, ebx
je 0x40d54a
cmp word [ebx], 0
mov eax, ebx
jne 0x40d54f
mov eax, str._NOEXT
push eax
mov ecx, esi
call fcn.0040d340
test eax, eax
jl 0x40d585
lea eax, [esp + 0x220]
lea ecx, [esi + 0xc]
push eax
call fcn.0040d340
test eax, eax
jge 0x40d588
mov ecx, esi
call fcn.0040d0c0
sub eax, 1
mov ecx, esi
sbb edx, 0
push edx
push eax
call fcn.0040d230
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret 8
Function at 0x40d620
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ecx], eax
push edi
push 0x4010
lea edx, [esp + 0x14]
mov dword [ecx + 4], eax
push 0x2b4
lea edi, [esp + 0x1c]
push edx
mov dword [ecx + 8], eax
push 0x80
mov dword [esp + 0x20], eax
push 0x462dd2
mov dword [ecx + 0xc], eax
mov ecx, 0xac
rep stosd dword es:[edi], eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40d683
push eax
call ebp
mov ecx, 0xad
xor eax, eax
lea edi, [esp + 0x10]
push 0x4011
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push 0x2b4
push ecx
push 0x80
push 0x462dd2
call ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40d6b9
push eax
call ebp
lea edx, [esi + 8]
mov ecx, 0x46a500
push edx
push str.__Q_r_
push 2
call fcn.0040cb10
lea eax, [esi + 0xc]
mov ecx, 0x46a500
push eax
push str.__Q_r_
push 4
call fcn.0040cb10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret

Function at 0x40d628
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ecx], eax
push edi
push 0x4010
lea edx, [esp + 0x14]
mov dword [ecx + 4], eax
push 0x2b4
lea edi, [esp + 0x1c]
push edx
mov dword [ecx + 8], eax
push 0x80
mov dword [esp + 0x20], eax
push 0x462dd2
mov dword [ecx + 0xc], eax
mov ecx, 0xac
rep stosd dword es:[edi], eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40d683
push eax
call ebp
mov ecx, 0xad
xor eax, eax
lea edi, [esp + 0x10]
push 0x4011
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push 0x2b4
push ecx
push 0x80
push 0x462dd2
call ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40d6b9
push eax
call ebp
lea edx, [esi + 8]
mov ecx, 0x46a500
push edx
push str.__Q_r_
push 2
call fcn.0040cb10
lea eax, [esi + 0xc]
mov ecx, 0x46a500
push eax
push str.__Q_r_
push 4
call fcn.0040cb10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret