joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100613c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1009ff73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10093a98
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x1012b3b0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x1012b2f8
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x100a1098]
push eax
mov ecx, edi
call fcn.10099100
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.1009a61c
test eax, eax
je 0x100614dc
mov ecx, dword [esp + 0x3c]
call fcn.1009912d
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x100a13bc]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x100614a0
push edi
mov ecx, esi
call fcn.1009677b
mov ecx, esi
call fcn.10061680
cmp dword [esp + 0x38], 1
jne 0x100614d5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.100968b6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x100636c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x100636f3
push esi
call fcn.10071a80
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x100636ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10063779
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10063762
mov eax, dword [esi + 8]
test eax, eax
je 0x10063717
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1006375e
cmp eax, 2
je 0x10063762
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1006370a
cmp eax, 3
je 0x1006373d
cmp eax, 1
jne 0x1006370a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x1006370a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x1006370a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.100637a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10063788
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.100637a0
add esp, 4
pop esi
ret
Function at 0x1000b63a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x14
pop eax
cmp edx, eax
jb 0x1000b814
mov esi, dword [ebp + 8]
mov di, word [esi]
mov word [ecx], di
mov di, word [esi + 2]
mov bx, word [ecx]
mov word [ecx + 2], di
mov di, word [esi + 4]
mov word [ecx + 4], di
mov di, word [esi + 6]
mov word [ecx + 6], di
xor edi, edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x18], edi
cmp bx, 2
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x1c], edi
je 0x1000b79e
cmp bx, 9
je 0x1000b798
cmp bx, 1
jne 0x1000b6c6
cmp edx, 0x20
jb 0x1000b814
mov eax, dword [esi + 0x10]
push 0x20
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
movzx eax, word [esi + 0x18]
cdq
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
movzx eax, word [esi + 0x1a]
mov dword [ecx + 0xc], eax
pop eax
jmp 0x1000b816
cmp bx, 8
jne 0x1000b72f
push 0x28
pop eax
cmp edx, eax
jb 0x1000b814
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edi
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x1c], edi
movzx edx, word [esi + 0x20]
movzx ebx, word [esi + 0x22]
cmp edx, edi
mov dword [ecx + 0xc], ebx
jbe 0x1000b816
lea ecx, [eax + 0xc]
cmp ecx, dword [ebp + 0xc]
ja 0x1000b814
mov ecx, dword [eax + esi + 8]
lea eax, [eax + ecx + 0xd]
cmp eax, dword [ebp + 0xc]
ja 0x1000b814
cmp ecx, 0x400
ja 0x1000b814
inc edi
cmp edi, edx
jb 0x1000b6fc
jmp 0x1000b816
movzx edx, bx
add edx, 0xfffffffd
cmp edx, 0xb
ja 0x1000b814
movzx edx, byte [edx + 0x1004482d]
jmp dword [edx*4 + 0x1004481d]
cmp bx, 2
jne 0x1000b7c5
cmp edx, 0x20
jb 0x1000b814
mov eax, dword [esi + 0x10]
push 0x20
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
mov eax, dword [esi + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edi
jmp 0x1000b7f0
cmp edx, 0x38
jb 0x1000b814
mov eax, dword [esi + 0x10]
push 0x38
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 0xc], eax
pop esi
push dword [ebp + 0x10]
call fcn.1000b5f2
push edi
push 4
push edx
push eax
call 0x100a8100
xor ecx, ecx
add eax, esi
adc edx, ecx
cmp edx, ecx
ja 0x1000b814
jb 0x1000b816
cmp eax, dword [ebp + 0xc]
jbe 0x1000b816
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1000ba28
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e8859
call 0x100a7f70
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f5e7c
mov dword [esi + 4], 0x100f5e6c
lea ecx, [esi + 0x168]
mov dword [ebp - 4], 0x10
call 0x100a1510
mov eax, dword [esi + 0x89c]
test eax, eax
je 0x1000ba5d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x890]
call 0xffca5f8
mov eax, dword [esi + 0x164]
pop ecx
test eax, eax
mov byte [ebp - 4], 0xe
je 0x1000ba7d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x15c]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000ba91
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x154]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000baa5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x138]
call 0xffca5f8
push dword [esi + 0x12c]
call 0xffca5f8
push dword [esi + 0x120]
call 0xffca5f8
mov eax, dword [esi + 0x108]
add esp, 0xc
test eax, eax
mov byte [ebp - 4], 8
je 0x1000badd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x90]
call 0xffca5f8
push dword [esi + 0x88]
call 0xffca5f8
push dword [esi + 0x7c]
call 0xffca5f8
add esp, 0xc
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 4
call fcn.1000bb46
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 3
call fcn.1000bb46
push dword [esi + 0x30]
call 0xffca5f8
push dword [esi + 0x24]
call 0xffca5f8
push dword [esi + 0x18]
call 0xffca5f8
push dword [esi + 0xc]
call 0xffca5f8
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x10010d0d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e8b64
call 0x100a7f70
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call 0xffc8e14
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call 0xffc8e14
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x28]
mov byte [esi + 0x28], al
mov al, byte [edi + 0x29]
mov byte [esi + 0x29], al
mov al, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
mov al, byte [edi + 0x2b]
mov byte [esi + 0x2b], al
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10012097
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100e8ccd
call 0x100a7f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f00e8
mov dword [esi + 4], 0x100f00bc
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call 0xffc95df
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov dword [esi], 0x100f6c00
mov dword [esi + 4], 0x100f6bf0
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1001212d
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x100e8cee
call 0x100a7f70
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [esi + 0x30]
mov dword [ebp - 4], 1
call 0xffca5f8
pop ecx
lea ecx, [esi + 0x24]
call fcn.100067dd
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.1001220a
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.100121c4
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1001480b
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
mov ecx, dword [esp + 8]
lea esi, [edx + ecx]
cmp edx, esi
je 0x10014839
push edi
movzx edi, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, edi
mov edi, dword [esp + 0x10]
shr eax, 8
mov ecx, dword [edi + ecx*4]
xor eax, ecx
inc edx
cmp edx, esi
jne 0x1001481a
pop edi
pop esi
ret 8
Function at 0x100191b3
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100e9379
call 0x100a7f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov byte [esi], al
mov byte [esi + 1], al
mov byte [esi + 2], al
mov byte [esi + 3], al
mov byte [esi + 4], al
mov byte [esi + 5], al
mov byte [esi + 6], al
mov byte [esi + 7], al
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10018f85
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10019c4a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e9492
call 0x100a7f70
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call 0xffc8db8
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call 0xffc8db8
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call 0xffc8db8
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call 0xffc8db8
or dword [esi + 0x7c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x64], bl
mov byte [esi + 0x65], bl
mov byte [esi + 0x66], bl
mov byte [esi + 0x67], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1001b207
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e9636
call 0x100a7f70
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call 0xffc8e14
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call 0xffc8e14
mov eax, dword [esi + 0x18]
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 1
call 0xffc8e14
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
mov byte [ebp - 4], 2
call 0xffc8e14
mov al, byte [esi + 0x64]
push 5
mov byte [ebx + 0x64], al
mov al, byte [esi + 0x65]
mov byte [ebx + 0x65], al
mov al, byte [esi + 0x66]
mov byte [ebx + 0x66], al
mov al, byte [esi + 0x67]
mov byte [ebx + 0x67], al
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x7c], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10020463
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e9bfb
call 0x100a7f70
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call 0xffc95df
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1002e1fc
Capabilities:
Encode data using xor

Disassembly:
popfd
test eax, 0x391ebcc5
xchg dword [eax], ebp
jnp 0x1002e233
loop 0x1002e282
cmp dl, byte [0xcd15d736]
rcr byte [edx], 0xf6
in al, 0x7a
invalid

Function at 0x1004512b
Capabilities:
Get number of processors

Disassembly:
jne 0x10045179
insd dword es:[edi], dx
dec esi
jbe 0x10045193
dec eax
outsb dx, byte [esi]
outsb dx, byte fs:[esi]
push ecx
Function at 0x100452ac
Capabilities:
Get number of processors

Disassembly:
bound esi, qword [edx]
jae 0x1004530b
push 0x62
xor dh, byte [edx]

Function at 0x100452ea
Capabilities:
Get number of processors

Disassembly:
cmp dword [esi + 0x62], ebp
inc edi
push ebp
jne 0x1004534a
xor bh, byte [ecx]
je 0x1004535c
push 0x32626e4a

Function at 0x100452f8
Capabilities:
Get number of processors

Disassembly:
cmp dword [esi + 0x62], ebp
inc edi
push ebp
jne 0x1004534a
xor bh, byte [ecx]
je 0x1004535c
push 0x32626e4a
Function at 0x1004653e
Capabilities:
Get number of processors

Disassembly:
dec ecx
push edx
dec ebx
imul esi, dword [0x4233596e], 0x34475a6a
pop ecx
xor eax, dword [edx + 0x6a]
pop edx
inc edi
xor al, 0x75
pop edx
push 0x62

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40b2fb
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
mov edi, 0x4dd200
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, 0x2b4
lea eax, [ebp - 0x2bc]
push esi
push ebx
push eax
call fcn.00476d20
lea eax, [ebp - 8]
add esp, 0xc
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, ecx
xor ecx, ecx
cmp dword [ebp + 8], ebx
mov eax, dword [eax]
sete cl
or cx, 0x4008
push ecx
lea ecx, [ebp - 0x2bc]
push esi
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 8]
mov esi, eax
neg ecx
sbb ecx, ecx
lea eax, [ebp - 4]
and ecx, eax
mov dword [ebp - 8], edi
call fcn.0040b689
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40bf0c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
mov esi, 0x2b4
push edi
push esi
lea eax, [ebp - 0x2b4]
push 0
mov edi, ecx
push eax
call fcn.00476d20
mov eax, dword [ebp + 8]
add esp, 0xc
or ax, 0x4008
push eax
lea eax, [ebp - 0x2b4]
push esi
push eax
push 0
push dword [edi + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b0]
pop edi
pop esi
leave
ret 4

Function at 0x411d6f
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d3094
call fcn.00476cf8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.004b9292
mov eax, dword [ebp - 0x18]
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [eax - 8], edi
jne 0x411da9
push eax
mov ecx, esi
call fcn.004bd3f1
or ebx, 0xffffffff
jmp 0x411e3b
mov edx, dword [esi]
push eax
push edi
mov ecx, esi
call dword [edx + 0xe0]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x411e1b
mov eax, dword [esi]
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
mov ecx, esi
call dword [eax + 0xd4]
push ebx
mov ecx, esi
call fcn.004b8176
cmp dword [ebp - 0x10], edi
jge 0x411e05
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411e05
push edi
push 1
push dword [ebp + 8]
call fcn.00413afb
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp + 8]
push edi
call dword [eax + 0xd8]
jmp 0x411e29
push dword [ebp - 0x18]
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0xf0]
mov ebx, eax
push edi
push ebx
push 0x14e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004b921e
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x412d8f
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4d3164
call fcn.00476cf8
sub esp, 0x80
push ebx
push esi
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004c4193
cmp dword [esi], 0
mov ebx, eax
je 0x412ddc
lea eax, [ebp - 0x8c]
push 0x40
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x8c]
push eax
call fcn.004232b2
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], edx
jmp 0x412e0f
mov eax, dword [ebp + 0x10]
push 1
push 1
push 0
push dword [eax + 4]
push dword [eax]
lea eax, [ebp + 0x10]
push eax
call fcn.004230b9
add esp, 0x18
push dword [ebp + 0x10]
and dword [ebp - 4], 0
push ebx
call fcn.004c3810
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004b921e
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x41316b
Capabilities:
Copy file

Disassembly:
mov eax, 0x4d31f0
call fcn.00476cf8
mov eax, 0x1024
call fcn.00477b00
push ebx
lea ecx, [ebp - 0x10]
push dword [ebp + 0xc]
call fcn.004b9292
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 4], ebx
jne 0x4131bb
push dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
call fcn.00413433
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004b9365
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], bl
call fcn.004b921e
push dword [ebp - 0x10]
call fcn.004136a8
cmp eax, 0xffffffff
pop ecx
jne 0x4131d0
push 0xfffffffffffffffe
jmp 0x413296
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x830]
push dword [ebp + 8]
push eax
call fcn.00476d78
lea eax, [ebp - 0x830]
push eax
call fcn.004776cf
mov word [ebp + eax*2 - 0x82e], bx
lea eax, [ebp - 0x830]
push 0x7c
push eax
call fcn.004776ec
add esp, 0x18
cmp eax, ebx
je 0x413221
mov word [eax], bx
add eax, 2
push 0x7c
push eax
call fcn.004776ec
pop ecx
pop ecx
jmp 0x41320b
push esi
lea eax, [ebp - 0x1030]
push dword [ebp + 0xc]
push eax
call fcn.00476d78
lea eax, [ebp - 0x1030]
push eax
call fcn.004776cf
mov word [ebp + eax*2 - 0x102e], bx
push 0x1e
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.00476d20
mov eax, dword [ebp + 0x18]
add esp, 0x1c
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x830]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1030]
mov dword [ebp - 0x24], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
pop esi
je 0x41328f
or ebx, 0xffffffff
jmp 0x413297
cmp dword [ebp - 0x1e], ebx
je 0x413297
push 1
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004b921e
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x413778
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d3287
call fcn.00476cf8
sub esp, 0x10
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
call fcn.004b9292
push 1
lea ecx, [ebp - 0x14]
pop ebx
push 0x2e
mov dword [ebp - 4], ebx
call fcn.004b6850
push dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
call fcn.004b9292
mov eax, dword [0x575208]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x14]
mov edi, str._s_s._s
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
push eax
call fcn.004b67b1
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x4137f9
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
call fcn.004b8f8b
mov dword [ebp - 0x1c], ebx
jmp 0x41384f
push ebx
mov dword [ebp - 0x18], ebx
push dword [ebp + 0x10]
mov ebx, str._s___d_
lea eax, [ebp + 0x14]
push ebx
push eax
call fcn.004b67b1
add esp, 0x10
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
push eax
call fcn.004b67b1
add esp, 0x14
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x41383c
inc dword [ebp - 0x18]
push dword [ebp - 0x18]
push dword [ebp + 0x10]
jmp 0x413805
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
call fcn.004b8f8b
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004b921e
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 1
call fcn.004b921e
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b921e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret