joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40d42d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0040c0aa
lea ecx, [esi + 0x24]
mov dword [esp + 0x14], 0
call fcn.0040c0a4
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 1
call fcn.0040c0a4
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], 2
call fcn.0040c0a4
push 0x78
mov byte [esp + 0x18], 3
mov dword [esi], 0x40fcb0
call fcn.0040c086
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov byte [esp + 0x14], 4
je 0x405ceb
push 0
mov ecx, eax
call fcn.0040c09e
jmp 0x405ced
xor eax, eax
push 0x1c
mov byte [esp + 0x18], 3
mov dword [esi + 0x20], eax
call fcn.0040c086
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov byte [esp + 0x14], 5
je 0x405d17
push 0xa
mov ecx, eax
call fcn.0040c098
jmp 0x405d19
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x5969696a
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x522132a9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4012f0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0xeb
mov dword [esp + 4], 1
mov dword [esp], str.bzip2:_Im_not_configured_correctly_for_this_platform__n_tI_require_Int32__Int16_and_Char_to_have_sizes_n_tof_4__2_and_1_bytes_to_run_properly__and_they_dont._n_tProbably_you_can_fix_this_by_defining_them_correctly__n_tand_recompiling.__Bye__n
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
cmp dword [0x408184], 2
jg 0x401331
mov dword [0x408184], 3
mov eax, dword [0x408184]
mov dword [esp], eax
call sub.cygwin1.dll_exit
nop

Function at 0x401340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [0x4085b0], 0
jne 0x401351
leave
ret
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0xf0
mov dword [esp + 4], 1
mov dword [esp], str._nIt_is_possible_that_the_compressed_file_s__have_become_corrupted._nYou_can_use_the__tvv_option_to_test_integrity_of_such_files._n_nYou_can_use_the__bzip2recover_program_to_attempt_to_recover_ndata_from_undamaged_sections_of_corrupted_files._n_n
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
leave
ret

Function at 0x401380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], edx
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], esi
mov esi, eax
call sub.cygwin1.dll_strlen
cmp eax, 0x400
ja 0x4013c4
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], 0x400
call sub.cygwin1.dll_strncpy
mov ebx, dword [ebp - 8]
mov byte [esi + 0x400], 0
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], ebx
mov dword [esp + 4], str.bzip2:_file_name_n__s_nis_suspiciously__more_than__d_chars__long._nTry_using_a_reasonable_file_name_instead.__Sorry__:___n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov eax, dword [0x408184]
test eax, eax
jle 0x4013fe
mov eax, dword [0x408184]
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov dword [0x408184], 1
jmp 0x4013f1
Function at 0x401410
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
cmp dword [0x4089d8], 3
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x74], eax
je 0x401470
cmp byte [0x4085b0], 0
je 0x40144f
mov esi, dword [0x4089cc]
test esi, esi
jle 0x40144f
mov edi, dword [0x4089d4]
cmp esi, edi
jg 0x4014f6
mov eax, dword [ebp - 0x74]
cmp eax, dword [0x408184]
jle 0x40145f
mov dword [0x408184], eax
mov eax, dword [0x408184]
mov dword [esp], eax
call sub.cygwin1.dll_exit
lea esi, [esi]
cmp dword [0x408188], 3
je 0x40142e
cmp byte [0x408180], 0
je 0x40142e
lea eax, [ebp - 0x70]
mov dword [esp + 4], eax
mov dword [esp], 0x4085c0
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x401530
cmp byte [0x4085b0], 0
jne 0x4015c5
mov eax, dword [0x409234]
test eax, eax
je 0x4014bb
mov dword [esp], eax
call sub.cygwin1.dll_fclose
mov dword [esp], 0x408e20
call sub.cygwin1.dll_remove
test eax, eax
je 0x40142e
mov ebx, dword [0x4089dc]
call sub.cygwin1.dll___getreent
mov dword [esp + 4], str._s:_WARNING:_deletion_of_output_file__apparently__failed._n
mov dword [esp + 8], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x40142e
mov ebx, dword [0x4089dc]
call sub.cygwin1.dll___getreent
mov edx, esi
sub edx, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], str._s:_WARNING:_some_files_have_not_been_processed:_n_s:_____d_specified_on_command_line___d_not_processed_yet._n_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x40144f
mov ebx, dword [0x4089dc]
call sub.cygwin1.dll___getreent
mov dword [esp + 4], str._s:_WARNING:_deletion_of_output_file_suppressed_n
mov dword [esp + 8], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov ebx, dword [0x4089dc]
call sub.cygwin1.dll___getreent
mov dword [esp + 4], str._s:____since_input_file_no_longer_exists.__Output_file_n
mov dword [esp + 8], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov ebx, dword [0x4089dc]
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], 0x408e20
mov dword [esp + 4], str._s:______s_may_be_incomplete._n
mov dword [esp + 8], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov ebx, dword [0x4089dc]
call sub.cygwin1.dll___getreent
mov dword [esp + 4], str._s:____I_suggest_doing_an_integrity_test__bzip2__tv__of_it._n
mov dword [esp + 8], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x40142e
mov ebx, dword [0x4089dc]
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], 0x408e20
mov dword [esp + 4], str._s:_Deleting_output_file__s__if_it_exists._n
mov dword [esp + 8], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x4014aa
Function at 0x4016d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], edx
mov dword [ebp - 0x10], eax
call sub.cygwin1.dll_getenv
test eax, eax
je 0x40178f
mov edi, eax
xor esi, esi
lea ebx, [edi + esi]
movzx eax, byte [ebx]
test al, al
je 0x40178f
mov edx, dword [sym.imp.cygwin1.dll___ctype_ptr__]
movsx eax, al
mov edi, ebx
mov ecx, dword [edx]
test byte [ecx + eax + 1], 8
je 0x40172b
movzx edx, byte [ebx + 1]
lea edi, [ebx + 1]
mov ebx, edi
movsx eax, dl
test byte [ecx + eax + 1], 8
jne 0x401712
xor esi, esi
test dl, dl
je 0x4016f0
xor esi, esi
jmp 0x40173a
movsx eax, al
test byte [ecx + eax + 1], 8
jne 0x401745
add esi, 1
movzx eax, byte [ebx + esi]
test al, al
jne 0x401730
cmp esi, 0x400
mov ecx, 0x400
cmovle ecx, esi
xor edx, edx
movzx eax, byte [ebx + edx]
mov byte [edx + 0x408a00], al
add edx, 1
cmp ecx, edx
jg 0x401755
mov byte [ecx + 0x408a00], 0
mov ecx, dword [ebp - 0x10]
mov edx, 0x408a00
lea ebx, [edi + esi]
mov eax, dword [ecx]
call fcn.00401640
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
movzx eax, byte [ebx]
test al, al
jne 0x4016fe
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402120
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [0x408050]
mov dword [esp], eax
mov dword [ebp - 8], edx
mov edx, dword [0x408058]
mov dword [ebp - 4], edx
lea edx, [ebp - 8]
mov dword [esp + 4], edx
call sub.cygwin1.dll_utime
test eax, eax
jne 0x40214d
leave
ret
lea esi, [esi]
call fcn.00401a60
lea esi, [esi]
lea edi, [edi]
Function at 0x402a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x402a7f
pop dword [ebp - 0x30]
mov eax, 0x6ff6d519
sub eax, 0x6fb6aa9a
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x936259f5
add dword [ebp - 0x40], 0xbaefeb56
mov dword [ebp - 0x3c], 0xa158b720
sub dword [ebp - 0x3c], 0x6f256adb
mov dword [ebp - 0x38], 0x1be9dc87
add dword [ebp - 0x38], 0x306267a7
mov dword [ebp - 0x34], 0xd043c529
sub dword [ebp - 0x34], 0xd043c529
lea eax, [ebp - 0x40]
push eax
mov eax, 0xad73a983
sub eax, 0xad3268f3
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x1677592a
add dword [ebp - 0x40], 0x5dfb102c
mov dword [ebp - 0x3c], 0x64588a5d
add dword [ebp - 0x3c], 0xdd13d718
mov dword [ebp - 0x38], 0xd80ea17e
sub dword [ebp - 0x38], 0x749f3512
mov dword [ebp - 0x34], 0xe1e4e217
add dword [ebp - 0x34], 0x1e1b1de9
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x81d2e43d
sub eax, 0x8191a401
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3c252
push 0
call eax
mov ecx, 0x7dd6d7f6
add ecx, 0x822975a9
xor edi, edi
add edi, eax
mov edx, 0x41c000
add edx, dword [ebp - 0x30]
mov esi, 0xbfdc949
add esi, 0x2c947724
mov dword [ebp - 0xc], 0x810290ae
mov ebx, dword [edx]
add dword [ebp - 0x2c], 0x5077492f
xor ebx, esi
sub dword [ebp - 0x18], esi
mov dword [edi], ebx
mov dword [ebp - 0x24], 0xe07b1b97
add edi, 0x42be3845
add edi, 0xbd41c7bf
add edx, 4
loop 0x402b9d
add eax, 0x1294f
mov ebx, eax
add eax, 0x8a8efcf6
add eax, 0x7571030f
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40288e
pop dword [ebp - 0xc]
mov eax, 0xc67179ca
sub eax, 0xc631513c
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x1770906
sub dword [ebp - 0x1c], 0xb324c3bb
mov dword [ebp - 0x18], 0x854f546d
add dword [ebp - 0x18], 0xace3f7d8
mov dword [ebp - 0x14], 0xe9ec7482
add dword [ebp - 0x14], 0x625fcfac
mov dword [ebp - 0x10], 0xc9efd95b
add dword [ebp - 0x10], 0x361026a5
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xecc4e1aa
add dword [ebp - 0x1c], 0x87ad87ac
mov dword [ebp - 0x18], 0xa89f40ac
add dword [ebp - 0x18], 0x98cd20c9
mov dword [ebp - 0x14], 0x9aa368f5
sub dword [ebp - 0x14], 0x3733fc89
mov dword [ebp - 0x10], 0xe4fd8a67
sub dword [ebp - 0x10], 0xe4fd8a67
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x351f2
push 0
call eax
mov ecx, 0x54ade4d0
add ecx, 0xab525d4a
xor esi, esi
add esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0xc]
mov ebx, 0xa8f2b2e4
sub ebx, 0x46c4573
sub dword [ebp - 8], esi
mov edi, dword [edx]
xor dword [ebp - 8], 0xa2e97984
add edi, ebx
sub dword [ebp - 8], edx
mov dword [esi], edi
sub dword [ebp - 8], 0x967bf675
add esi, 4
add edx, 4
loop 0x4029a2
add eax, 0xf10f237b
sub eax, 0xf10e2840
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd6e96097
add ecx, 0x29569f69
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4035ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4035fc
pop dword [ebp - 8]
mov eax, 0x313f306
sub eax, 0x2d3bd0a
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x991d88ed
sub dword [ebp - 0x18], 0x4acb43a2
mov dword [ebp - 0x14], 0x417126d1
sub dword [ebp - 0x14], 0xf3dda8c
mov dword [ebp - 0x10], 0x2832e9c1
sub dword [ebp - 0x10], 0xdbe6a593
mov dword [ebp - 0xc], 0x1bf2fe74
sub dword [ebp - 0xc], 0x1bf2fe74
lea eax, [ebp - 0x18]
push eax
mov eax, 0x59cdd66a
sub eax, 0x598d664e
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x2b685e3e
sub dword [ebp - 0x18], 0xb6f5f4e8
mov dword [ebp - 0x14], 0xa4b2f8aa
sub dword [ebp - 0x14], 0x63469735
mov dword [ebp - 0x10], 0x17e37f7
add dword [ebp - 0x10], 0x61f13475
mov dword [ebp - 0xc], 0x2b030ec6
add dword [ebp - 0xc], 0xd4fcf13a
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x38fad
push 0
call eax
mov ecx, 0xb2d21bf5
sub ecx, 0xb2d1ceca
xor edi, edi
add edi, eax
mov ebx, 0x863d4916
add ebx, 0x7a037eea
add ebx, dword [ebp - 8]
mov edx, 0xdc370102
sub edx, 0xf02995f3
mov dword [ebp - 4], 0xc01bd346
mov esi, dword [ebx]
xor dword [ebp - 4], ebx
add esi, edx
mov dword [edi], esi
add edi, 0x8ed3b598
sub edi, 0x8ed3b594
add ebx, 0xef109e1c
add ebx, 0x10ef61e8
loop 0x40371b
add eax, 0x1277f
xor ebx, ebx
add ebx, eax
add eax, 0x5f749ed5
add eax, 0xa08b6130
mov ecx, 0x56c6e74e
sub ecx, 0x5686e74e
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004035ed
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004035ed
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x4010bc
Capabilities:
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x100]
sub esp, 0x180
mov eax, dword [0x49a2a0]
xor eax, ebp
mov dword [ebp + 0xfc], eax
mov eax, dword [ebp + 0x108]
push ebx
mov ebx, dword [ebp + 0x10c]
push esi
push edi
mov edi, ecx
push dword [edi + 0x20]
mov dword [ebp - 0x7c], eax
xor eax, eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x78], eax
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x4011cb
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
lea edx, [ebp - 0x70]
push edx
push 0x60
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x4011c2
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
lea edx, [ebp - 0x80]
push edx
lea edx, [ebp - 0x6c]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x4011c2
mov esi, 0xa0000000
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x74]
push edx
lea edx, [ebp - 0x6c]
push edx
push 1
mov dword [ebp - 0x74], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test dword [ebp - 0x74], esi
je 0x401184
test dword [ebp - 0x74], 0x20000000
je 0x401184
push dword [ebp - 0x7c]
mov ecx, edi
push 0
push dword [ebp - 0x6c]
push dword [ebp - 0x68]
call fcn.0040103f
test eax, eax
jne 0x40119d
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
lea edx, [ebp - 0x80]
push edx
lea edx, [ebp - 0x6c]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x40114a
jmp 0x4011c2
push 0x4008
push 0x160
lea eax, [ebp - 0x64]
push eax
push 0
push dword [ebp - 0x6c]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 0x60]
mov dword [ebx], eax
mov dword [ebp - 0x78], 1
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0xfc]
mov eax, dword [ebp - 0x78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cdba
add ebp, 0x100
leave
ret 8

Function at 0x4011e8
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0xe8]
sub esp, 0x168
mov eax, dword [0x49a2a0]
xor eax, ebp
mov dword [ebp + 0xe4], eax
and dword [ebp - 0x80], 0
push esi
mov esi, dword [ebp + 0xf4]
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xf0]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 0x80], 0
je 0x401260
push 0x309
push 0x160
lea eax, [ebp - 0x7c]
push eax
push 0x80
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x401260
lea eax, [ebp - 0x70]
push eax
push esi
call fcn.0045cdd0
pop ecx
pop ecx
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x78]
jmp 0x401262
xor eax, eax
mov ecx, dword [ebp + 0xe4]
xor ecx, ebp
pop esi
call fcn.0045cdba
add ebp, 0xe8
leave
ret 8
Function at 0x401914
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x1f4]
sub esp, 0x274
mov eax, dword [0x49a2a0]
xor eax, ebp
mov dword [ebp + 0x1f0], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp + 0xed]
push ebx
push eax
mov esi, ecx
mov byte [ebp + 0xec], bl
call fcn.0045cd40
add esp, 0xc
call fcn.004450d4
mov eax, dword [eax + 4]
push 0x92
mov ecx, eax
call fcn.00401375
mov dword [ebp - 0x80], eax
push 0x104
lea eax, [ebp + 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0x4001
push 0x160
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp + 0xec]
push eax
call edi
mov eax, dword [ebp - 0x70]
mov dword [esi + 0x120], eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 0x11
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x4019fa
push 0x4009
push 0x160
lea eax, [ebp - 0x74]
push eax
push ebx
push dword [ebp - 0x78]
call edi
cmp eax, ebx
je 0x4019ee
push eax
call fcn.004454a9
push dword [ebp - 0x80]
mov edi, eax
push dword [esi + 0x120]
push dword [edi + 4]
call fcn.004017ec
push ebx
push edi
mov ecx, esi
call fcn.0040141d
push dword [ebp - 0x78]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x78], ebx
cmp byte [ebp + 0x1fc], bl
je 0x401a09
mov ecx, esi
call fcn.00401407
lea edi, [esi + 0x11c]
lea eax, [esi + 0x238]
push edi
push eax
mov ecx, esi
call fcn.004010bc
test eax, eax
jne 0x401a35
lea eax, [esi + 0x238]
push str.My_Computer
push eax
call fcn.0045cdd0
pop ecx
pop ecx
mov eax, dword [edi]
push eax
push eax
push 1
mov edi, 0xffff0000
push edi
lea eax, [esi + 0x238]
push eax
mov ecx, esi
call fcn.00401611
mov dword [esi + 0x33c], eax
lea eax, [esi + 0x134]
push eax
push ebx
mov ecx, esi
call fcn.004011e8
push eax
push eax
push 1
push edi
lea edi, [esi + 0x134]
push edi
mov ecx, esi
mov dword [esi + 0x118], eax
call fcn.00401611
push dword [esi + 0x33c]
mov dword [esi + 0x130], eax
push 2
push 0x1102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x7c]
push eax
push ebx
push dword [esi + 0x20]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push edi
push dword [ebp - 0x7c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov ecx, dword [ebp + 0x1f0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cdba
add ebp, 0x1f4
leave
ret 4
Function at 0x401acb
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x49a2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x301
push 0x160
lea eax, [ebp - 0x268]
push eax
push 0
push esi
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x26c], eax
je 0x401b22
push eax
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x25c]
jmp 0x401b57
push 0x5c
push esi
call fcn.0045d580
pop ecx
pop ecx
test eax, eax
je 0x401b34
inc eax
push eax
jmp 0x401b35
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0045cdd0
pop ecx
pop ecx
push dword [ebp - 0x26c]
lea eax, [ebp - 0x108]
push dword [ebp - 0x26c]
push 0
push edi
push eax
mov ecx, ebx
call fcn.00401611
push dword [ebp - 0x268]
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cdba
leave
ret 0x14