joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42feb8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
jne 0x42fed1
xor eax, eax
jmp 0x430080
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebp + 0xc]
jle 0x42fedc
mov dword [ebp + 0xc], eax
mov edx, dword [ebx + 0x10]
cmp edx, dword [ebp + 0x10]
jle 0x42fee7
mov dword [ebp + 0x10], edx
cmp ebx, 0x55d678
jne 0x42fef5
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0xc], 1
jl 0x42ff3a
cmp dword [ebp + 0x10], 1
jl 0x42ff3a
lea ecx, [ebp - 0x30]
push ecx
push 0x18
push dword [ebx + 4]
call sub.GDI32.dll_GetObjectA
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0xc]
jne 0x42ff29
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp + 0x10]
jne 0x42ff29
mov eax, 1
jmp 0x430080
push dword [0x56cee8]
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
jne 0x42ff70
mov eax, dword [ebx + 4]
test eax, eax
je 0x42ff47
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [ebx + 4], edx
mov eax, dword [ebx + 8]
test eax, eax
je 0x42ff59
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [ebx + 8], edx
mov byte [ebx + 0x14], 0
push 0
call fcn.0042c4bf
xor eax, eax
jmp 0x430080
push edi
call sub.GDI32.dll_CreateCompatibleDC
mov esi, eax
test esi, esi
jne 0x42ff8a
push edi
push dword [0x56cee8]
call sub.USER32.dll_ReleaseDC
jmp 0x42ff3a
push edi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42ffad
push esi
call sub.GDI32.dll_DeleteDC
push edi
push dword [0x56cee8]
call sub.USER32.dll_ReleaseDC
jmp 0x42ff3a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42ffe1
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
push esi
call sub.GDI32.dll_DeleteDC
push edi
push dword [0x56cee8]
call sub.USER32.dll_ReleaseDC
jmp 0x42ff3a
push dword [ebp - 0xc]
push esi
call sub.GDI32.dll_SelectObject
mov dword [ebp - 4], eax
push dword [ebx + 4]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x14], edx
push 0xcc0020
push 0
push 0
push dword [ebp - 0x10]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push esi
call sub.GDI32.dll_BitBlt
mov ecx, dword [ebx + 0xc]
add dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jl 0x430005
mov edx, dword [ebx + 0x10]
add dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + 0x10]
jl 0x430000
push dword [ebp - 4]
push esi
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
push esi
call sub.GDI32.dll_DeleteDC
push edi
push dword [0x56cee8]
call sub.USER32.dll_ReleaseDC
push dword [ebx + 4]
call sub.GDI32.dll_DeleteObject
mov eax, dword [ebp - 0xc]
mov dword [ebx + 4], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43090b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0051dd0a
mov ebx, eax
test ebx, ebx
je 0x430a57
push dword [ebx + 0xb6c]
call fcn.00412773
test eax, eax
je 0x430a57
call sub.USER32.dll_GetFocus
mov esi, eax
mov eax, dword [ebx + 0x818]
cmp esi, eax
je 0x430954
cmp esi, dword [ebx + 0x81c]
jne 0x430a57
cmp eax, esi
jne 0x430960
mov eax, dword [ebx + 0x68c]
jmp 0x430966
mov eax, dword [ebx + 0x690]
mov edx, dword [ebx + 0xb6c]
xor ecx, ecx
mov dword [edx + 0x1c00], ecx
test eax, eax
je 0x430a00
mov ebx, eax
test ebx, ebx
je 0x43098f
cmp dword [ebx + 0x1c], 1
je 0x43098f
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x430982
test ebx, ebx
je 0x4309d8
cmp dword [ebx + 0x40], 0
je 0x4309d8
mov edx, dword [ebx + 0x40]
cmp dword [edx], 0
je 0x4309d8
xor eax, eax
mov dword [ebx + 0x1c], eax
mov ebx, dword [ebx + 0x40]
mov dword [ebx + 0x1c], 1
push dword [ebx]
push 0
push 0xc
push esi
call sub.USER32.dll_SendMessageA
push dword [ebx]
call fcn.0054c2d0
pop ecx
push eax
push dword [ebx]
call fcn.0054c2d0
pop ecx
push eax
push 1
push esi
call fcn.00478c58
jmp 0x430a57
cmp ebx, dword [eax + 0x44]
jne 0x430a00
mov ebx, eax
test ebx, ebx
je 0x4309ef
xor eax, eax
mov dword [ebx + 0x1c], eax
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x4309e3
push 0x55eac2
push 0
push 0xc
push esi
call sub.USER32.dll_SendMessageA
jmp 0x430a57
push 0x578211
push 0x3e6
push 0xd
push esi
call sub.USER32.dll_SendMessageA
push 0x55eac6
push 0x578211
call fcn.0054c5e4
add esp, 8
test eax, eax
je 0x430a2b
mov byte [eax], 0
cmp byte [0x578211], 0
je 0x430a41
push 0x578211
push edi
call fcn.004306d0
jmp 0x430a48
push 0
call fcn.0042c4bf
push 0x55eac9
push 0
push 0xc
push esi
call sub.USER32.dll_SendMessageA
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x430a5e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0051dd0a
mov ebx, eax
test ebx, ebx
je 0x430b3b
push dword [ebx + 0xb6c]
call fcn.00412773
test eax, eax
je 0x430b3b
call sub.USER32.dll_GetFocus
mov esi, eax
mov eax, dword [ebx + 0x818]
cmp esi, eax
je 0x430aa7
cmp esi, dword [ebx + 0x81c]
jne 0x430b3b
cmp eax, esi
jne 0x430ab3
mov eax, dword [ebx + 0x68c]
jmp 0x430ab9
mov eax, dword [ebx + 0x690]
mov edx, dword [ebx + 0xb6c]
xor ecx, ecx
mov dword [edx + 0x1c00], ecx
test eax, eax
je 0x430ad8
cmp dword [eax + 0x1c], 0
jne 0x430b3b
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x430acb
push 0x578211
push 0x3e6
push 0xd
push esi
call sub.USER32.dll_SendMessageA
push 0x55eacd
push 0x578211
call fcn.0054c5e4
add esp, 8
test eax, eax
je 0x430b03
mov byte [eax], 0
cmp byte [0x578211], 0
je 0x430b3b
push 0x578211
push edi
call fcn.004306d0
cmp esi, dword [ebx + 0x818]
jne 0x430b27
mov eax, dword [ebx + 0x68c]
jmp 0x430b2d
mov eax, dword [ebx + 0x690]
test eax, eax
je 0x430b3b
mov edx, dword [eax + 0x44]
mov dword [edx + 0x1c], 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x436ece
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea ebx, [ebp - 8]
push dword [ebp + 8]
call fcn.0051dd0a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4370c8
push 0x180
push 0x40
push 0x4301
push dword [ebp + 0xc]
call fcn.00552270
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x436f1b
push 0
call fcn.0042c4bf
jmp 0x4370c8
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 0x10], eax
push 0x180
push 0x577e2a
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.dll_GetWindowTextA
push 0
push 0x57c
call fcn.0042c564
push eax
push 0x577e2a
call fcn.0054c5e4
add esp, 8
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x436f90
add dword [ebx], 4
push dword [ebx]
call fcn.0054c2d0
pop ecx
push eax
push dword [ebx]
push dword [ebp - 0xc]
call fcn.00551d70
add esp, 0xc
push 1
push 0x55f075
push dword [ebp - 0xc]
call fcn.00551d70
add esp, 0xc
xor edi, edi
push ebx
push edi
push 0x189
mov eax, dword [ebp - 4]
push dword [eax + 0x820]
call sub.USER32.dll_SendMessageA
inc eax
je 0x4370b7
cmp dword [ebx], 0
je 0x4370b7
mov edx, dword [ebx]
push edi
mov esi, 0x577e2a
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [ebx], 0x577e2a
jmp 0x436fe9
inc dword [ebx]
mov eax, dword [ebx]
cmp byte [eax], 0x20
je 0x436fe7
mov edx, dword [ebx]
cmp byte [edx], 0
je 0x4370b1
push 9
push dword [ebx]
call fcn.0054c230
add esp, 8
mov esi, eax
test esi, esi
je 0x4370b1
mov byte [esi], 0
push dword [ebx]
call fcn.0054c2d0
pop ecx
push eax
push dword [ebx]
push dword [ebp - 0xc]
call fcn.00551d70
add esp, 0xc
inc esi
cmp byte [esi], 0
je 0x43709f
mov dword [ebx], esi
push 9
push dword [ebx]
call fcn.0054c230
add esp, 8
mov esi, eax
test esi, esi
je 0x437047
mov byte [esi], 0
push 1
push 0x55f078
push dword [ebp - 0xc]
call fcn.00551d70
add esp, 0xc
push dword [ebx]
call fcn.0054c2d0
pop ecx
push eax
push dword [ebx]
push dword [ebp - 0xc]
call fcn.00551d70
add esp, 0xc
test esi, esi
je 0x43709f
inc esi
cmp byte [esi], 0
je 0x43709f
push 1
push 0x55f07b
push dword [ebp - 0xc]
call fcn.00551d70
add esp, 0xc
push esi
call fcn.0054c2d0
pop ecx
push eax
push esi
push dword [ebp - 0xc]
call fcn.00551d70
add esp, 0xc
push 1
push 0x55f07e
push dword [ebp - 0xc]
call fcn.00551d70
add esp, 0xc
inc edi
jmp 0x436f92
push dword [ebp - 0xc]
call fcn.0054f720
pop ecx
push dword [ebp - 0x10]
call sub.USER32.dll_SetCursor
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43adb8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc14
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x43add2
xor eax, eax
jmp 0x43af4a
cmp dword [ebx + 0x520], 3
je 0x43adeb
cmp dword [ebx + 0x534], 2
je 0x43adeb
xor eax, eax
jmp 0x43af4a
xor edx, edx
mov dword [ebx + 0x878], edx
push 1
push 1
push dword [ebx + 0x884]
push 0x801d
call fcn.00526a8c
test eax, eax
je 0x43ae12
xor eax, eax
jmp 0x43af4a
inc dword [ebx + 0x880]
cmp dword [ebx + 0x880], 0x14
jl 0x43ae48
xor edx, edx
mov dword [ebx + 0x880], edx
push 0
push 1
push dword [ebx + 0x884]
push 0x801d
call fcn.00526a8c
test eax, eax
je 0x43ae48
xor eax, eax
jmp 0x43af4a
push 0
push 0x3e6
lea edx, [ebp - 0x3ec]
push edx
push dword [ebx + 0x884]
call sub.WSOCK32.dll_recv
mov edi, eax
cmp edi, 0xffffffff
jne 0x43ae95
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x43ae7b
xor eax, eax
jmp 0x43af4a
push 0
push 0x527
call fcn.0042c564
push eax
push ebx
call fcn.0043b0d1
xor eax, eax
jmp 0x43af4a
test edi, edi
jle 0x43af3d
mov byte [ebp + edi - 0x3ec], 0
xor edx, edx
mov dword [ebp - 4], edx
lea esi, [ebp - 0x3ec]
cmp edi, dword [ebp - 4]
jle 0x43ae12
mov al, byte [esi]
cmp al, 9
je 0x43af14
cmp al, 0xd
je 0x43af14
cmp al, 0xa
jne 0x43aee2
mov edx, dword [ebx + 0x3ec]
mov byte [ebx + edx + 4], 0
xor ecx, ecx
mov dword [ebx + 0x3ec], ecx
push ebx
call fcn.0043aa0c
jmp 0x43af14
mov eax, dword [ebx + 0x3ec]
mov dl, byte [esi]
mov byte [ebx + eax + 4], dl
inc dword [ebx + 0x3ec]
mov eax, dword [ebx + 0x3ec]
cmp eax, 0x3b5
jl 0x43af14
mov byte [ebx + eax + 4], 0
xor edx, edx
mov dword [ebx + 0x3ec], edx
push ebx
call fcn.0043aa0c
push ebx
call fcn.00438ac0
test eax, eax
je 0x43ae12
cmp dword [ebx + 0x520], 0
je 0x43ae12
inc dword [ebp - 4]
inc esi
cmp edi, dword [ebp - 4]
jg 0x43aeb9
jmp 0x43ae12
push 0x55f439
push ebx
call fcn.0043b0d1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43af53
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc18
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
je 0x43af6e
cmp byte [esi], 0
jne 0x43af78
mov eax, 1
jmp 0x43b06a
push 0x3e7
lea edx, [ebp - 0x3e8]
push edx
call fcn.0042e3f0
push esi
mov edi, esi
lea esi, [ebp - 0x3e8]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
cmp dword [0x55d2c0], 0
je 0x43afc5
lea eax, [ebp - 0x3e8]
push eax
call fcn.00415144
lea edx, [ebp - 0x3e8]
push edx
call fcn.0054c2d0
pop ecx
mov esi, eax
xor eax, eax
mov dword [ebx + 0x878], eax
mov edi, dword [ebx + 0x884]
cmp edi, 0xffffffff
jne 0x43afeb
xor eax, eax
jmp 0x43b06a
push 0
push esi
lea edx, [ebp - 0x3e8]
push edx
push edi
call sub.WSOCK32.dll_send
cmp esi, eax
je 0x43b065
cmp dword [ebx + 0x540], 0
jne 0x43b061
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x43b04e
push 0
lea ecx, [ebp - 0x3e8]
push ecx
push dword [ebx + 0x874]
call fcn.004c6a50
test eax, eax
je 0x43b032
mov dword [ebx + 0x874], eax
push 0x23
push 0x801d
push dword [0x56cee8]
push dword [ebx + 0x884]
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x43b06a
push 0
push 0x528
call fcn.0042c564
push eax
push ebx
call fcn.0043b0d1
xor eax, eax
jmp 0x43b06a
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43c51f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx], eax
push 1
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
jne 0x43c545
or dword [ebx], 1
push 2
call sub.USER32.dll_GetKeyState
movsx ecx, ax
and ecx, 0x8000
cmp ecx, 0x8000
jne 0x43c560
or dword [ebx], 2
push 4
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x43c579
or dword [ebx], 0x10
push 0x11
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
jne 0x43c594
or dword [ebx], 8
push 0x10
call sub.USER32.dll_GetKeyState
movsx ecx, ax
and ecx, 0x8000
cmp ecx, 0x8000
jne 0x43c5af
or dword [ebx], 4
pop ebx
pop ebp
ret 4
Function at 0x4422d7
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [0x55f94c]
call sub.USER32.dll_ShowWindow
mov eax, dword [0x55f94c]
test eax, eax
je 0x4422f3
push eax
call sub.USER32.dll_DestroyWindow
xor edx, edx
mov dword [0x55f94c], edx
ret
Function at 0x44e1b3
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0
je 0x44e1e8
mov edi, dword [esi + 4]
test edi, edi
je 0x44e2bb
cmp byte [edi], 0x2d
jne 0x44e2bb
push 0x68
push edi
call fcn.0054c230
add esp, 8
test eax, eax
je 0x44e250
push 0x5a
push dword [ebp + 0xc]
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x44e246
xor eax, eax
mov dword [ebx + 0x510], eax
mov byte [ebx + 0x4ac], 0
lea esi, [ebx + 0x448]
mov eax, dword [ebp + 0xc]
push esi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push esi
call fcn.0050d0ae
push 0x33
push 0
push esi
push 0x560405
push dword [ebx]
call fcn.0047177d
mov eax, 1
jmp 0x44e38f
push 0x75
push dword [esi + 4]
call fcn.0054c230
add esp, 8
test eax, eax
je 0x44e2bb
push ebx
call fcn.00412a2f
test eax, eax
jne 0x44e27d
push 0xc
push 0
push dword [esi]
push 0
call fcn.00479c10
jmp 0x44e38f
push 0
push 0
push 0xa
push 0
push dword [ebx]
push 0
push 5
push 0
push 0
push 0
imul edx, dword [ebx + 0xb84], 0x64
add ebx, edx
add ebx, 0xa58
push ebx
call fcn.00519010
test eax, eax
jne 0x44e2b1
xor eax, eax
jmp 0x44e38f
mov eax, 1
jmp 0x44e38f
mov eax, dword [esi + 4]
test eax, eax
je 0x44e38a
push eax
call fcn.0054c2d0
pop ecx
cmp eax, 0x5a
jbe 0x44e2d9
mov edx, dword [esi + 4]
mov byte [edx + 0x5a], 0
lea edi, [ebx + 0x448]
mov eax, dword [esi + 4]
push esi
push edi
mov esi, edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push edi
call fcn.0050d0ae
mov eax, dword [esi + 8]
test eax, eax
je 0x44e38a
push eax
call fcn.0054c2d0
pop ecx
cmp eax, 0x5a
jbe 0x44e327
mov edx, dword [esi + 8]
mov byte [edx + 0x5a], 0
push dword [esi + 8]
call sub.WSOCK32.dll_inet_addr
mov edi, eax
mov dword [ebx + 0x510], edi
cmp edi, 0xffffffff
jne 0x44e34d
xor eax, eax
mov dword [ebx + 0x510], eax
mov byte [ebx + 0x4ac], 0
jmp 0x44e38a
push dword [ebx + 0x510]
call sub.WSOCK32.dll_htonl
mov dword [ebx + 0x510], eax
add ebx, 0x4ac
mov eax, dword [esi + 8]
push esi
mov esi, ebx
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x44ea60
Capabilities:
Create directory
Delete directory
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0
jne 0x44ea87
push 0
push 0
push dword [edi]
push 0
call fcn.00479c10
jmp 0x44eb97
push 0
push 0x104
push ebx
push 1
push edi
call fcn.004e5393
test eax, eax
jge 0x44eaad
push 3
push 0
push dword [edi]
push 0
call fcn.00479c10
jmp 0x44eb97
push ebx
call fcn.0042e464
push ebx
push ebx
call fcn.0042cd5e
test eax, eax
jne 0x44ead0
push 3
push 0
push dword [edi]
push 0
call fcn.00479c10
jmp 0x44eb97
cmp dword [ebp + 0x14], 0
jne 0x44eb16
push 0
push ebx
call sub.KERNEL32.dll_CreateDirectoryA
push 2
push ebx
call fcn.0042c9b5
test eax, eax
je 0x44eaf4
mov eax, 1
jmp 0x44eb97
push ebx
push 0
push 0x348
call fcn.0042c564
push eax
push 0x57e17c
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor eax, eax
jmp 0x44eb97
mov byte [esi], 0
push esi
push 0x180
call sub.KERNEL32.dll_GetCurrentDirectoryA
push esi
call fcn.0054c2d0
pop ecx
test eax, eax
jle 0x44eb61
cmp byte [esi + eax - 1], 0x5c
jne 0x44eb3b
mov byte [esi + eax - 1], 0
push ebx
push esi
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x44eb61
push 0x5c
push esi
call fcn.0054c5b8
add esp, 8
test eax, eax
je 0x44eb61
mov byte [eax], 0
push esi
call sub.KERNEL32.dll_SetCurrentDirectoryA
push ebx
call sub.KERNEL32.dll_RemoveDirectoryA
push 2
push ebx
call fcn.0042c9b5
test eax, eax
jne 0x44eb7a
mov eax, 1
jmp 0x44eb97
push ebx
push 0
push 0x349
call fcn.0042c564
push eax
push 0x57e17c
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4520cd
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
cmp dword [esi + 4], 0
jne 0x4520fa
push 0
push 0
push dword [esi]
push 0
call fcn.00479c10
jmp 0x452218
push 0
push 0x104
push ebx
push 1
push esi
call fcn.004e5393
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x452125
push 3
push 0
push dword [esi]
push 0
call fcn.00479c10
jmp 0x452218
push ebx
push ebx
call fcn.0042cd5e
test eax, eax
jne 0x452142
push 3
push 0
push dword [esi]
push 0
call fcn.00479c10
jmp 0x452218
push 1
push ebx
call fcn.0042c9b5
test eax, eax
jne 0x45215f
push 1
push ebx
push dword [esi]
push 0
call fcn.00479c10
jmp 0x452218
push 0
push 0x104
push edi
mov eax, dword [ebp - 4]
inc eax
push eax
push esi
call fcn.004e5393
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x45218d
push 3
push 0
push dword [esi]
push 0
call fcn.00479c10
jmp 0x452218
push edi
push edi
call fcn.0042cd5e
test eax, eax
jne 0x4521a7
push 3
push 0
push dword [esi]
push 0
call fcn.00479c10
jmp 0x452218
push edi
push ebx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
je 0x4521fa
cmp dword [ebp + 0x18], 0
je 0x4521f3
push edi
push ebx
push 0
push 0x395
call fcn.0042c564
push eax
lea edx, [ebp - 0x3ec]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
xor ecx, ecx
mov dword [0x56ac00], ecx
push dword [0x55f89c]
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp + 8]
call fcn.004ef100
mov eax, 1
jmp 0x452218
push edi
push ebx
push 0
push 0x396
call fcn.0042c564
push eax
push 0x57e17c
call sub.USER32.dll_wsprintfA
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x452221
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
je 0x452239
cmp dword [ebx + 8], 0
jne 0x45224b
push 0
push 0
push dword [ebx]
push 0
call fcn.00479c10
jmp 0x4523fe
push dword [ebx + 4]
call fcn.0054c2d0
pop ecx
cmp eax, 0x5a
jbe 0x452260
mov eax, dword [ebx + 4]
mov byte [eax + 0x5a], 0
push dword [ebp + 0x14]
push dword [ebx + 4]
call fcn.00412db7
mov esi, eax
test esi, esi
jne 0x452283
push 7
push 0
push dword [ebx]
push 0
call fcn.00479c10
jmp 0x4523fe
cmp dword [esi + 0x6bc], 9
je 0x45229e
push 7
push 0
push dword [ebx]
push 0
call fcn.00479c10
jmp 0x4523fe
push dword [ebx + 8]
call fcn.0054c2d0
pop ecx
cmp eax, 0x5a
jbe 0x4522b3
mov eax, dword [ebx + 8]
mov byte [eax + 0x5a], 0
mov eax, dword [ebx + 8]
cmp byte [eax], 0x40
jne 0x4522c7
push eax
call fcn.0054c2d0
pop ecx
cmp eax, 1
ja 0x4522d9
push 3
push 0
push dword [ebx]
push 0
call fcn.00479c10
jmp 0x4523fe
push dword [ebp + 0x14]
push dword [ebx + 8]
call fcn.00412db7
test eax, eax
je 0x452317
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0054c494
add esp, 8
test eax, eax
je 0x452317
push 6
push 0
push 0
push 0x397
call fcn.0042c564
push eax
push 0
call fcn.00479c10
jmp 0x4523fe
lea edx, [esi + 8]
mov ecx, dword [ebx + 8]
push esi
push edi
mov esi, edx
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea eax, [esi + 8]
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, eax
mov esi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [ebx + 0xc], 0
je 0x4523ac
mov byte [edi], 0
push ebx
push edi
push 3
call fcn.004e45c5
cmp byte [edi], 0
je 0x4523d9
push 0x56082d
push dword [ebp + 0xc]
call fcn.0054c1f4
add esp, 8
push edi
push dword [ebp + 0xc]
call fcn.0054c1f4
add esp, 8
push 0xf
push dword [ebp + 0xc]
call fcn.0050cc40
jmp 0x4523d9
push 0x104
push edi
push dword [esi]
call sub.USER32.dll_GetWindowTextA
cmp byte [edi], 0
je 0x4523d9
push 0x20
push edi
call fcn.0054c230
add esp, 8
test eax, eax
je 0x4523d9
push eax
push dword [ebp + 0xc]
call fcn.0054c1f4
add esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [esi + 0x700], 0
je 0x4523eb
cmp byte [eax], 0x40
jne 0x4523eb
inc eax
push eax
push dword [esi]
call sub.USER32.dll_SetWindowTextA
push esi
call fcn.00417312
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x10