joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4396e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x439713
push esi
call fcn.0043c680
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43970c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x439799
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x439782
mov eax, dword [esi + 8]
test eax, eax
je 0x439737
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43977e
cmp eax, 2
je 0x439782
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43972a
cmp eax, 3
je 0x43975d
cmp eax, 1
jne 0x43972a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43972a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43972a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004397c0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4397a8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004397c0
add esp, 4
pop esi
ret

Function at 0x45fac4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45fafc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046271e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004626f6
jmp 0x45fb08
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4611b2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4611f4
call fcn.00468996
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4611f4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4611eb
xor eax, eax
jmp 0x4611fc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00461202
pop edi
pop esi
pop ebx
ret 4

Function at 0x469054
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x469082
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4690a0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00468fba
jmp 0x4690a0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4690a0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00468fba
test edi, edi
mov eax, edi
jne 0x46908a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x42f3a3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004c31a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable._AFX_DEBUG_STATE.0
push str.AFX.INI
push 1
push str.TraceEnabled
push str.Diagnostics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x5450bc], eax
push str.AFX.INI
push 0
push str.TraceFlags
push str.Diagnostics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x5450b8], eax
cmp dword [0x5450c8], 0
je 0x42f42c
push 0x77
push 0x53aa90
call fcn.004aed70
test eax, eax
je 0x42f42c
int3
xor ecx, ecx
test ecx, ecx
jne 0x42f412
push 0x42f1d4
call fcn.00407b00
add esp, 4
mov dword [0x5450c8], eax
cmp dword [0x5450cc], 0
je 0x42f45e
push 0x7a
push 0x53aaa0
call fcn.004aed70
test eax, eax
je 0x42f45e
int3
xor edx, edx
test edx, edx
jne 0x42f444
push 0x42f346
call fcn.0040c2f0
add esp, 4
mov dword [0x5450cc], eax
push 4
push 2
call fcn.0040c210
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454235
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x4542a0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x70
jne 0x4542a0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and eax, 0x4000
test eax, eax
jne 0x4542a0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x4542a0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x4542a0
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x4542a0
mov dword [ebp - 4], 1
jmp 0x4542a7
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x45629d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call fcn.004b7ee2
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4562f6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x456310
push 0xeb
push str.dlgcore.cpp
call fcn.004aed70
test eax, eax
je 0x456310
int3
xor edx, edx
test edx, edx
jne 0x4562f6
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0045636b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00404640
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4570be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x44]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x40], 0
je 0x457111
call fcn.004b7ee2
mov dword [ebp - 0x10], eax
push 5
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x40]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x457124
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
cmp dword [ebp - 0xc], 0
je 0x4571b8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x45716f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0x12]
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x14]
mov word [ebp - 0x1c], dx
jmp 0x457185
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0xa]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0xc]
mov word [ebp - 0x1c], ax
mov ecx, dword [ebp - 0x20]
and ecx, 0x1801
test ecx, ecx
jne 0x4571ab
movsx edx, word [ebp - 0x18]
test edx, edx
jne 0x4571ab
movsx eax, word [ebp - 0x1c]
test eax, eax
jne 0x4571ab
mov dword [ebp - 0x28], 1
jmp 0x4571b2
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
jne 0x4571ca
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x44], 0
je 0x4571d3
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404640
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
je 0x4571e6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x45737f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4573a2
push 0x33c
push str.dlgcore.cpp
call fcn.004aed70
test eax, eax
je 0x4573a2
int3
xor eax, eax
test eax, eax
jne 0x457388
call fcn.004b7ee2
mov dword [ebp - 8], eax
push 5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x45740e
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x4573f0
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Cannot_find_dialog_template_named__s._n
call fcn.0042ef05
add esp, 8
jmp 0x457407
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Cannot_find_dialog_template_with_IDD_0x_04X._n
call fcn.0042ef05
add esp, 8
xor eax, eax
jmp 0x457538
cmp dword [ebp + 0xc], 0
jne 0x45741e
mov eax, 1
jmp 0x457538
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x457451
push str.Warning:_LoadResource_failed_for_dialog_template._n
push 0x537eec
call fcn.0042ef05
add esp, 8
mov eax, 1
jmp 0x457538
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 2]
cmp ecx, 0xffff
jne 0x45747a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
jmp 0x457482
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00404640
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0x14]
and edx, 0x10000000
test edx, edx
je 0x4574e4
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x4574c9
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Dialog_named__s_must_be_invisible._n
call fcn.0042ef05
add esp, 8
jmp 0x4574e0
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Dialog_with_IDD_0x_04X_must_be_invisible._n
call fcn.0042ef05
add esp, 8
xor eax, eax
jmp 0x457538
mov eax, dword [ebp - 0x14]
and eax, 0x40000000
test eax, eax
jne 0x457533
mov ecx, dword [ebp + 8]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
test ecx, ecx
je 0x457519
mov edx, dword [ebp + 8]
push edx
push str.ERROR:_Dialog_named__s_must_have_the_child_style._n
call fcn.0042ef05
add esp, 8
jmp 0x45752f
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
push str.ERROR:_Dialog_with_IDD_0x_04X_must_have_the_child_style._n
call fcn.0042ef05
add esp, 8
xor eax, eax
jmp 0x457538
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x459511
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x459542
push 0x43d
push str.wincore.cpp
call fcn.004aed70
test eax, eax
je 0x459542
int3
xor edx, edx
test edx, edx
jne 0x45951d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
jne 0x45958e
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0045ffa7
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.0045ff33
jmp 0x4595a6
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x38]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x38]
mov eax, dword [edx]
call dword [eax + 0x90]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45ce00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x45ce8c
call fcn.004b7ee2
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45ce8c
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45ce5f
xor eax, eax
jmp 0x45cebd
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45ce86
push 0xcc5
push str.wincore.cpp
call fcn.004aed70
test eax, eax
je 0x45ce86
int3
xor edx, edx
test edx, edx
jne 0x45ce6c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0045cec6
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x45ceba
cmp dword [ebp - 8], 0
je 0x45ceba
mov ecx, dword [ebp - 8]
push ecx
call fcn.00404640
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4655e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0xed
push str.filecore.cpp
mov eax, dword [ebp - 8]
push eax
call fcn.00461360
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x465623
push 0xee
push str.filecore.cpp
call fcn.004aed70
test eax, eax
je 0x465623
int3
xor edx, edx
test edx, edx
jne 0x465606
cmp dword [ebp + 0xc], 0
jne 0x465634
jmp 0x4656d5
cmp dword [ebp + 8], 0
jne 0x46564e
push 0xf3
push str.filecore.cpp
call fcn.004aed70
test eax, eax
je 0x46564e
int3
xor eax, eax
test eax, eax
jne 0x465634
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042f146
test eax, eax
jne 0x46567b
push 0xf4
push str.filecore.cpp
call fcn.004aed70
test eax, eax
je 0x46567b
int3
xor eax, eax
test eax, eax
jne 0x465654
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4656b8
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004ab39a
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00463640
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x4656d5
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004ab39a
push eax
push 0xffffffffffffffff
push 0xd
call fcn.00463820
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x465e1c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push str.CLSID
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x465ef2
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x465ee8
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push str.InProcServer32
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x465ede
push 0x104
mov ecx, dword [ebp + 0xc]
call fcn.0045fdf8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x54515c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.0045ff33
xor ecx, ecx
cmp dword [ebp - 0x18], 0
sete cl
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x465efb
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x178], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push 0x800
push 0x160
lea ecx, [ebp - 0x174]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x465f5c
mov eax, dword [ebp - 0x16c]
and eax, 0x10000
test eax, eax
jne 0x465f63
xor eax, eax
jmp 0x466093
lea ecx, [ebp - 0x14]
push ecx
push 0x5281e8
push 0
push 0x5281f8
lea ecx, [ebp - 4]
call fcn.00465b97
test eax, eax
jge 0x465f86
xor eax, eax
jmp 0x466093
lea edx, [ebp - 0x10]
push edx
push 0x52be30
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx]
test eax, eax
jl 0x466085
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x465fc0
mov dword [ebp - 0x180], 0
jmp 0x46600e
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
shl eax, 1
add eax, 3
and al, 0xfc
call fcn.0040a070
mov dword [ebp - 0x184], esp
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
call fcn.00405010
mov dword [ebp - 0x180], eax
push 0
mov edx, dword [ebp - 0x180]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 0x14]
test eax, eax
jl 0x466079
push 2
mov ecx, dword [ebp + 8]
call fcn.004b1afc
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0x4c]
test eax, eax
jl 0x466079
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
mov eax, 1
jmp 0x466093
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
xor eax, eax
lea esp, [ebp - 0x184]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46609f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d115d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0042f146
test eax, eax
jne 0x4660e8
push 0x216
push str.filecore.cpp
call fcn.004aed70
test eax, eax
je 0x4660e8
int3
xor ecx, ecx
test ecx, ecx
jne 0x4660c0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x46613e
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x466124
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.0042ef05
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x466231
lea ecx, [ebp - 0x1c]
call fcn.004ab2f7
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00466244
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.004ab39a
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4661b6
lea ecx, [ebp - 0x1c]
call fcn.004ab39a
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.0042ef05
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045f64c
mov eax, dword [ebp - 0x164]
jmp 0x466231
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x4661ca
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x466212
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x466212
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045f64c
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47f006
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0047ec30
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x47f065
push 0x20
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0047edc4
test eax, eax
jne 0x47f063
push 0xffffffffffffffff
push 0
mov edx, dword [ebp + 0x14]
push edx
call fcn.0047ea49
mov ecx, dword [ebp + 8]
call fcn.0047ed4f
jmp 0x47f084
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00471263
mov dword [ebp - 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x47f6f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0047ec7e
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x47f76d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x47f744
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0045ffa7
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x47f761
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.0045fdf8
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.0045ff33
jmp 0x47f79e
mov ecx, dword [ebp + 0x10]
call fcn.004ab39a
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x47f79e
mov ecx, dword [ebp + 0x10]
call fcn.004ab39a
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00471263
mov esp, ebp
pop ebp
ret 0xc