joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f646
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x40f72b
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40f704
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x40f6e0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x40f702
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40f702
push 0
push 0
push 0x4e2e
push 0x4cb0
call fcn.00418664
add esp, 0x10
jmp 0x40f729
push 0x5926
push 1
push 0x2b17
push 0x1c73
push 0x6e75
push 1
push 0x48f8
call fcn.0040a7be
add esp, 0x1c
jmp 0x40f7a4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x40f793
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x40f770
mov byte [ebp - 2], 0
push 0
lea eax, [ebp - 2]
push eax
call fcn.004128a4
pop ecx
pop ecx
jmp 0x40f791
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x40f791
push 0x208e
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x40f7a4
push 1
push 0x55c5
push 0
call fcn.00408635
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x41219a
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4121de
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 1
push 0xde8
push 0x5720
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x5927
push 1
push dword [ebp - 0x10]
call fcn.004122ac
add esp, 0x1c
jmp 0x4122a8
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41227e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x412266
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x41224a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x412264
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.00430d9e
or dword [eax], 0xffffffff
jmp 0x41223f
jmp 0x41227c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41227c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x4122a8
push 0x66a
push 0x73cc
push 0x6d32
push 0x7901
push 0x9a2
push 0
push 0x56de
push 0
call fcn.0040947b
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x41297e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x412a2b
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x412a02
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4129dd
push 0x22f6
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x412a00
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x412a00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
jmp 0x412a29
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 0x7543
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
push 1
push 1
push 1
call fcn.0041b464
add esp, 0x1c
jmp 0x412a5b
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
push 0xfb4
push 0x3fd4
push dword [ebp - 0x30]
push 0x4b90
push 1
push dword [ebp - 0x34]
push 0x516d
call fcn.00409ea8
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x412a5f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x412a91
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
push 0x65bd
push 0x1179
push dword [ebp - 8]
push 1
push 1
call fcn.00412b97
add esp, 0x14
jmp 0x412b93
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x412b1e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x412afd
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x412afb
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x412b1c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x412b1c
push 0
push 0xcbe
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x412b93
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x412b6c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x412b6a
push 0x8b9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x412b93
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x415967
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x415a6b
lea eax, [ebp + 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x415a28
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
push dword [ebp - 0x34]
push 0xb37
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x3375
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x33ce
call fcn.00415b2c
add esp, 0x30
jmp 0x415a66
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 1
push 0x4dcc
push 1
push dword [ebp - 0x50]
push 0x1680
push 0x7eb7
push 0x414e
push dword [ebp - 0x54]
push 0x51ee
push 0
push 0x1a5b
call fcn.00415bc7
add esp, 0x2c
jmp 0x415b28
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x415aa4
push 0x7015
push 0x3018
push 0x15ee
push 1
push 0x422f
call fcn.00414801
add esp, 0x14
jmp 0x415b28
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x415b0f
push 1
lea ecx, [ebp - 0x74]
call fcn.00430cb0
mov dword [ebp - 0x64], 0x4c506d44
push 0x68a8
push 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00429b02
add esp, 0x10
push 0
push 0x790e
push 1
lea eax, [ebp - 0x64]
push eax
push 0x38cd
push 0
push 0x804
push 1
lea eax, [ebp - 0x74]
push eax
push 1
call fcn.0042415c
add esp, 0x28
lea ecx, [ebp - 0x74]
call fcn.00430d82
jmp 0x415b28
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2303
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esp, ebp
pop ebp
ret
Function at 0x41fbb5
Capabilities:
Get disk size
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x41fc70
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x41fc4b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41fc23
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41fc21
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x41fc49
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41fc49
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x41fc6e
push 0x2c5
push 0x4d01
push 0x16bb
push 0
push 0x257c
push 0x15a8
call fcn.0042b9f0
add esp, 0x18
jmp 0x41fcb4
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
push 0x4c69
push 0xeac
push 1
push 0x19b0
push 0x6302
push 0x35a2
push 0x19bb
push 0x1ebb
push dword [ebp - 0x30]
push 0x21ef
push dword [ebp - 0x34]
call fcn.004124c5
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x4224bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4225cd
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x422583
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x422536
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x422534
push 0
push 0xf32
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x422581
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x422564
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x422581
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00430d9e
mov dword [eax], 0xe255bb5f
jmp 0x422559
jmp 0x4225cb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 0x1f84
push 0x6cd3
push 1
push 0
push dword [ebp - 0x3c]
push 0x75a7
push 0x399a
push 0x496
push 0x5831
push 0x23ec
push 0x110a
push 1
push dword [ebp - 0x40]
call fcn.00409714
add esp, 0x34
jmp 0x42263e
lea eax, [ebp + 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x422618
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 1
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0x285a
call fcn.00409f6b
add esp, 0x10
jmp 0x42263e
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
push 0
push 0x6145
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push 0x5e57
call fcn.0040c847
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x426c04
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x426cca
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x426c8a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x426c5e
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x426c88
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x426c88
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
jmp 0x426cc8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x150
push 1
push dword [ebp - 0x28]
push 0
push 0x180
push 0x1e9a
push dword [ebp - 0x2c]
push 0x4f58
push 0x7be5
push 0
push 0x3c46
call fcn.00416d56
add esp, 0x2c
jmp 0x426d11
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x426cf0
push 1
call fcn.00420803
pop ecx
jmp 0x426d11
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0
push 0x7846
push dword [ebp - 0x40]
call fcn.00424a03
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43058e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x430636
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x430608
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push 0x7531
push dword [ebp - 0x1c]
push 1
push 0x7416
push 0xb65
push dword [ebp - 0x20]
push 0x227e
push dword [ebp - 0x24]
push 0x4727
call fcn.00430726
add esp, 0x24
jmp 0x430631
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0x3cc8
push 1
push 0x68a2
push 0
push 0x7e89
push 0x3ce
call fcn.0040f1d1
add esp, 0x1c
jmp 0x430722
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4306ea
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4306ca
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4306a0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x20
jl 0x4306c8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4306c6
push 0x1faa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x430695
jmp 0x4306e8
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x4306e8
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x430722
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
push 0x491d
push 0x57ca
push 0x335
push 0x198b
push 0x3831
push 0x7485
push 0x754f
push 0
push 1
push dword [ebp - 0x5c]
call fcn.00413016
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x435833
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4358e6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4358c8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4358b9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4358b7
push 1
push 0x1923
push 0x1054
push 0x4ff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
jmp 0x4358c6
push 0x22f6
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x4358e4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
call fcn.004534cf
add esp, 0xc
jmp 0x435939
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x43591c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0x16a5
push 0
call fcn.00437cfc
add esp, 0xc
jmp 0x435939
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push 0x1895
push 0
push dword [ebp - 0x40]
push 0x2759
call fcn.004369d0
add esp, 0x10
mov esp, ebp
pop ebp
ret