joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a80dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4a80f5
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4a80ee
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4a8109
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a7aa8
test bl, bl
jne 0x4a81e3
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x55c000
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4a8141
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4a8156
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a7fb0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4a8189
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4a8136
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4a81ad
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4a81bf
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4a81d4
jmp 0x4a82a4
cmp bl, 1
jne 0x4a82a4
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x55c05a
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4a8203
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4a8218
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a7fb0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4a824b
sub ebx, 6
inc dword [ebp - 8]
jne 0x4a81f8
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4a8273
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4a8285
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4a829a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a7b28
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4a9a70
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4a9a86
add esp, 0xfffffff0
call fcn.00404ab8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a9bdd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [edi + 4]
mov edx, esi
call fcn.004056e8
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040b034
mov edx, dword [ebp - 4]
lea eax, [edi + 8]
mov ecx, 0x4a9c0c
call fcn.004059ac
mov dl, 1
mov eax, dword [0x41d688]
call fcn.00404724
mov dword [edi + 0x10], eax
mov dl, 1
mov eax, dword [0x41d688]
call fcn.00404724
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x41d688]
call fcn.00404724
mov dword [edi + 0x18], eax
mov dl, 1
mov eax, dword [0x41d688]
call fcn.00404724
mov dword [edi + 0x1c], eax
mov dl, 1
mov eax, dword [0x41d688]
call fcn.00404724
mov dword [edi + 0x24], eax
mov dl, 1
mov eax, dword [0x41d688]
call fcn.00404724
mov dword [edi + 0x20], eax
mov byte [edi + 0x4c], 0
mov byte [edi + 0x4d], 0
mov byte [edi + 0x4e], 0
mov eax, dword [0x5552ac]
mov eax, dword [eax]
call fcn.00405b24
push eax
push 0
push 0x4a9c18
push 0x4a9c20
call sub.kernel32.dll_GetPrivateProfileIntA
mov esi, eax
mov eax, esi
cdq
push edx
push eax
call fcn.0040d6a8
call fcn.0040365c
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
test edx, edx
jge 0x4a9b67
neg eax
adc edx, 0
neg edx
cmp edx, 0
jne 0x4a9b73
cmp eax, 0xf
jb 0x4a9bbc
jmp 0x4a9b75
jl 0x4a9bbc
mov eax, dword [edi + 8]
call fcn.00405b24
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x5552ac]
mov eax, dword [eax]
call fcn.00405b24
push eax
call fcn.0040d6a8
call fcn.0040365c
push edx
push eax
lea eax, [ebp - 8]
call fcn.0040a8d8
mov eax, dword [ebp - 8]
call fcn.00405b24
push eax
push 0x4a9c18
push 0x4a9c20
call sub.kernel32.dll_WritePrivateProfileStringA
mov eax, edi
mov edx, dword [eax]
call dword [edx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9be4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056b8
ret
Function at 0x4aaf5c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp bl, 0x90
jne 0x4aafb1
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x4aaf9c
and byte [ebp - 0x72], 0xfe
jmp 0x4aafa0
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x4ab038
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x4ab038
mov eax, ebx
movzx eax, al
bt dword [0x55319c], eax
jae 0x4ab006
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004aaf10
pop ecx
cmp byte [ebp - 1], 0
je 0x4ab033
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004aaf10
pop ecx
jmp 0x4ab033
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004aaf10
pop ecx
cmp byte [ebp - 1], 0
je 0x4ab033
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004aaf10
pop ecx
dec si
jne 0x4aafc6
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ab040
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
movzx edx, dl
bt dword [0x55319c], edx
jae 0x4ab074
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.004aaf10
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.004aaf10
pop ecx
pop ebx
pop ebp
ret
Function at 0x4abeb8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403c14
ret

Function at 0x4b1144
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.00405b24
push eax
mov eax, dword [ebp - 4]
call fcn.00405b24
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4b117c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b1213
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00405db4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405b24
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405954
test eax, eax
jns 0x4b11c3
call fcn.0040461c
push eax
call sub.kernel32.dll_GetTempPathA
test eax, eax
jns 0x4b11d2
call fcn.0040461c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405db4
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [0x47a4e4]
call fcn.00479130
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004056e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b121a
lea eax, [ebp - 0xc]
call fcn.00405694
ret

Function at 0x4b58e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b5955
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004b58c0
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004b2a4c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
call fcn.004b24a8
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b595c
lea eax, [ebp - 0x14]
call fcn.00405694
ret
Function at 0x4dd438
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, byte [0x4dd474]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4dd44f
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4dd45e
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4dd46d
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4eabd4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov esi, edx
mov ebx, eax
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4eabef
or byte [esp], 2
mov eax, ebx
call fcn.0043d0d4
test al, al
je 0x4eac1d
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x1a0]
test al, al
jne 0x4eac1d
cmp word [esi], 0x1b
jne 0x4eac1d
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x160]
mov word [esi], 0
mov edx, esi
movzx ecx, byte [esp]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x158]
mov edx, esi
movzx ecx, byte [esp]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x15c]
mov edx, esi
movzx ecx, byte [esp]
mov eax, ebx
call fcn.0045dbc4
cmp word [esi], 0x2e
je 0x4eac5c
cmp word [esi], 0x2d
jne 0x4eac6f
test byte [esp], 1
je 0x4eac6f
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
jne 0x4eac6f
mov word [esi], 0
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4f564c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00430cbc
cmp ebx, dword [ebp - 8]
jge 0x4f56af
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00431128
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00431128
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00431154
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4f5675
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4f56b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00430cbc
cmp ebx, dword [ebp - 8]
jge 0x4f571b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00431128
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00431128
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00431154
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4f56e1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4fae28
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4faedf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405b24
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4fae6a
call fcn.004050b4
jmp 0x4faee6
mov eax, ebx
call fcn.00402fd4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00405b24
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4fae93
call fcn.004050b4
jmp 0x4faee6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4faef4
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4faeb4
call fcn.004050b4
jmp 0x4faee6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4faee6
mov eax, dword [ebp - 8]
call fcn.00402ff0
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fb140
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fb1a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00403c14
test ebx, ebx
jne 0x4fb17d
mov word [ebp - 2], 0
lea ebx, [ebp - 2]
or esi, 0x4008
push esi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fb1b4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fb494
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
push 0x4fb640
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4fb638
xor eax, eax
push ebp
push 0x4fb631
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 6], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x4fb64c
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
test esi, esi
jne 0x4fb50c
push 0x4009
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x4fb64c
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
test edi, edi
jne 0x4fb54d
push 0x4008
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.0042c8f8
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.0042c8f8
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.0042c8f8
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.0042c8f8
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x554600], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb638
cmp dword [ebp - 4], 0
je 0x4fb630
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fb650
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov ebx, eax
call fcn.004fae1c
test al, al
je 0x4fb67d
cmp dword [0x55ce40], 0x40047
jl 0x4fb67d
cmp byte [0x554600], 0
jne 0x4fb67d
call fcn.004fb494
mov esi, ebx
and esi, 0x7f
mov eax, dword [esi*4 + 0x554604]
or eax, 0x4000
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
push 0x4fb6e0
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
jne 0x4fb6d5
mov word [esp], 0
mov eax, dword [esi*4 + 0x554604]
or eax, 0x4000
or eax, 8
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x50339c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, ecx
mov esi, eax
test edx, 0x40000000
jne 0x5033be
mov edx, ebx
mov eax, dword [0x55590c]
call fcn.004079c4
jmp 0x5033f5
push 0x408
push 0x160
lea eax, [esp + 8]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x5033ee
mov eax, ebx
lea edx, [esp + 0x110]
mov ecx, 0x50
call fcn.00405904
jmp 0x5033f5
mov eax, ebx
call fcn.00405694
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x503e18
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
mov ebx, ecx
test ebx, ebx
js 0x503e4b
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x503e44
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00405b14
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 4]
mov edx, dword [0x401110]
call fcn.004063e8
xor eax, eax
push ebp
push 0x503fd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x503fa1
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 8]
push 0x504000
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00405a28
mov eax, dword [ebp - 0x158]
call fcn.00405b24
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x503f95
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x503f7a
test al, 2
jne 0x503f7a
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0x504000
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00405904
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00405a28
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x10]
call fcn.004fafa4
call fcn.00411ce4
test al, al
je 0x503f38
or edi, 0xffffffff
jmp 0x503f47
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004fb140
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.004faf08
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00405904
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x3c]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x503ecd
push ebx
call sub.kernel32.dll_FindClose_1
add esi, 4
dec dword [ebp - 0x14]
jne 0x503e90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503fe0
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.004056b8
lea eax, [ebp - 8]
call fcn.00405694
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x401110]
call fcn.004062a8
ret
Function at 0x50508c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x505123
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x700f0037
mov eax, dword [0x555b30]
cmp dword [eax + 4], 0x60000
jl 0x5050c4
or dword [ebp - 8], 0x400000
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005051b8
mov eax, dword [ebp - 4]
call fcn.00502f88
test al, al
je 0x5050f4
mov eax, dword [ebp - 4]
call fcn.00405b24
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x5050f4
and dword [ebp - 8], 0xfffbffff
lea eax, [ebp - 8]
push eax
lea eax, [ebx + 0xc]
push eax
push 1
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x460]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50512a
lea eax, [ebp - 4]
call fcn.00405694
ret

Function at 0x508a98
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00405b24
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
je 0x508ada
dec eax
je 0x508abb
sub eax, 2
je 0x508ada
jmp 0x508aeb
movzx eax, byte [ebx]
call fcn.004fc784
test al, al
je 0x508aeb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xff9e
call fcn.00404950
jmp 0x508aeb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
mov si, 0xff9e
call fcn.00404950
pop esi
pop ebx
pop ebp
ret

Function at 0x508af0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x508b9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x428], 0
jne 0x508b3e
push 0x465
mov eax, dword [ebp - 4]
call fcn.0045ee80
mov ecx, eax
mov dl, 1
mov eax, dword [0x505354]
call fcn.005053c0
mov edx, dword [ebp - 4]
mov dword [edx + 0x428], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
call fcn.00505888
lea eax, [ebp - 8]
mov edx, 0x508bb4
call fcn.0040572c
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x508b89
test bl, 1
je 0x508b82
lea eax, [ebp - 8]
call fcn.00405b84
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.00508a98
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x508b66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x508ba6
lea eax, [ebp - 8]
call fcn.00405694
ret