joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417500
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5bd254]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x4175f4
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4175f4
lea ecx, [ebp - 4]
push ecx
push 0x10008
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x4175f2
cmp dword [ebp - 0x20c], 0
jne 0x4175e8
mov dword [ebp - 0x210], 0x1f4
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x208]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x103
jne 0x4175c1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x20c], eax
jmp 0x4175e8
cmp dword [ebp - 0x20c], 0
jne 0x4175e3
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00417500
add esp, 8
mov dword [ebp - 0x20c], eax
jmp 0x417562
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4175fe
mov dword [ebp - 0x20c], 0x3f2
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00511a80
mov esp, ebp
pop ebp
ret

Function at 0x417880
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.00417f00
add esp, 4
mov eax, dword [ebp + 8]
push eax
call sym.convertifd.exe_ImmGetContext
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417949
mov ecx, dword [sym.convertifd.exe_fdwProperty]
and ecx, 0x10000
je 0x4178ef
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x40
mov edx, dword [sym.convertifd.exe_Pt]
mov dword [ebp - 0x1c], edx
mov eax, dword [0x6a2f2c]
add eax, dword [sym.convertifd.exe_iTextH]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call sym.convertifd.exe_ImmSetCandidateWindow
jmp 0x41793c
mov dword [ebp - 0x28], 0
jmp 0x417901
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jae 0x41793c
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
push eax
call sym.convertifd.exe_ImmGetCandidateWindow
test eax, eax
jne 0x41791e
jmp 0x4178f8
cmp dword [ebp - 0x20], 0
jne 0x417926
jmp 0x4178f8
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call sym.convertifd.exe_ImmSetCandidateWindow
jmp 0x4178f8
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.convertifd.exe_ImmReleaseContext
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x417960
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
call sym.convertifd.exe_IsAsianDBCSEnv
add esp, 4
test eax, eax
jne 0x417998
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x417aec
cmp dword [ebp - 8], 0x3a4
je 0x4179c5
cmp dword [ebp - 8], 0x3b5
je 0x4179c5
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x417aec
cmp dword [sym.convertifd.exe_fdwProperty], 0
jne 0x4179df
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.00417f00
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x10f
ja 0x417a1c
cmp dword [ebp - 0xc], 0x10f
je 0x417a48
cmp dword [ebp - 0xc], 0x51
je 0x417aac
cmp dword [ebp - 0xc], 0x10d
je 0x417abd
cmp dword [ebp - 0xc], 0x10e
je 0x417a61
jmp 0x417acc
cmp dword [ebp - 0xc], 0x281
je 0x417a95
cmp dword [ebp - 0xc], 0x282
je 0x417a76
cmp dword [ebp - 0xc], 0x286
je 0x417a3c
jmp 0x417acc
mov dword [ebp - 4], 1
jmp 0x417acc
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00417af0
add esp, 8
mov dword [ebp - 4], eax
jmp 0x417acc
mov eax, dword [ebp + 8]
push eax
call fcn.00417dc0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x417acc
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00417e00
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x417acc
call fcn.00417ed0
test eax, eax
jne 0x417aaa
mov edx, dword [ebp + 0x14]
and edx, 0x7fffffff
mov dword [ebp + 0x14], edx
jmp 0x417acc
mov eax, dword [ebp + 8]
push eax
call sym.convertifd.exe_Previous_IME_InputLangChange
add esp, 4
mov dword [ebp - 4], eax
jmp 0x417acc
mov ecx, dword [ebp + 8]
push ecx
call fcn.00417d40
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417aea
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x417aec
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x417af0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call sym.convertifd.exe_ImmGetContext
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
and ecx, 8
je 0x417b40
push 0x200
push sym.convertifd.exe_szCompStr
push 8
mov edx, dword [ebp - 4]
push edx
call sym.convertifd.exe_ImmGetCompositionStringA
mov dword [sym.convertifd.exe_dwCompStrLen], eax
mov eax, dword [sym.convertifd.exe_dwCompStrLen]
mov byte [eax + sym.convertifd.exe_szCompStr], 0
mov dword [ebp - 8], 1
jmp 0x417b51
mov dword [sym.convertifd.exe_dwCompStrLen], 0
mov byte [sym.convertifd.exe_szCompStr], 0
mov ecx, dword [ebp + 0xc]
and ecx, 0x10
je 0x417b7c
push 0x200
push sym.convertifd.exe_bCompAttr
push 0x10
mov edx, dword [ebp - 4]
push edx
call sym.convertifd.exe_ImmGetCompositionStringA
mov dword [sym.convertifd.exe_dwCompAttrLen], eax
mov dword [ebp - 8], 1
jmp 0x417b8d
mov dword [sym.convertifd.exe_dwCompAttrLen], 0
mov byte [sym.convertifd.exe_bCompAttr], 0
mov eax, dword [ebp + 0xc]
and eax, 0x20
je 0x417bb8
push 0x200
push sym.convertifd.exe_dwCompCls
push 0x20
mov ecx, dword [ebp - 4]
push ecx
call sym.convertifd.exe_ImmGetCompositionStringA
mov dword [sym.convertifd.exe_dwCompClsLen], eax
mov dword [ebp - 8], 1
jmp 0x417bd6
mov dword [sym.convertifd.exe_dwCompClsLen], 0
mov dword [sym.convertifd.exe_dwCompCls], 0
mov dword [0x6a3384], 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.convertifd.exe_ImmReleaseContext
cmp dword [ebp - 8], 0
je 0x417bf5
mov ecx, dword [ebp + 8]
push ecx
call sym.convertifd.exe_Previous_IME_ReFlashDraw
add esp, 4
call fcn.00417ed0
test eax, eax
jne 0x417c09
mov edx, dword [ebp + 0xc]
and edx, 0x800
je 0x417c10
mov eax, 1
jmp 0x417c12
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x417c20
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
call sym.convertifd.exe_IsAsianDBCSEnv
add esp, 4
test eax, eax
jne 0x417c3b
jmp 0x417d35
cmp dword [ebp - 8], 0x3a4
je 0x417c52
cmp dword [ebp - 8], 0x3b5
je 0x417c52
jmp 0x417d35
mov ecx, dword [ebp + 8]
push ecx
call sym.convertifd.exe_ImmGetContext
mov dword [ebp - 4], eax
push 0x200
push sym.convertifd.exe_szCompStr
push 8
mov edx, dword [ebp - 4]
push edx
call sym.convertifd.exe_ImmGetCompositionStringA
mov dword [sym.convertifd.exe_dwCompStrLen], eax
cmp dword [sym.convertifd.exe_dwCompStrLen], 0
je 0x417d19
mov dword [ebp - 0xc], 0
jmp 0x417c97
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [sym.convertifd.exe_dwCompStrLen]
jge 0x417cc0
push 1
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + sym.convertifd.exe_szCompStr]
push eax
push 0x102
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x417c8e
mov dword [sym.convertifd.exe_dwCompStrLen], 0
mov byte [sym.convertifd.exe_szCompStr], 0
mov dword [sym.convertifd.exe_dwCompClsLen], 0
mov dword [sym.convertifd.exe_dwCompCls], 0
mov dword [0x6a3384], 0
mov dword [sym.convertifd.exe_dwCompClsLen], 0
mov dword [sym.convertifd.exe_dwCompCls], 0
mov dword [0x6a3384], 0
mov edx, dword [ebp + 8]
push edx
call sym.convertifd.exe_Previous_IME_ReFlashDraw
add esp, 4
push 0
push 4
push 0x15
mov eax, dword [ebp - 4]
push eax
call sym.convertifd.exe_ImmNotifyIME
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.convertifd.exe_ImmReleaseContext
mov esp, ebp
pop ebp
ret

Function at 0x41b7d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f0
mov eax, dword [0x5bd254]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3f0]
push eax
push 0x3e8
push 0xd
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x3e8
lea edx, [ebp - 0x3f0]
push edx
push 0
call sym.convertifd.exe_ReplaceBrandingKeyWords
add esp, 0xc
test eax, eax
je 0x41b82a
lea eax, [ebp - 0x3f0]
push eax
push 0
push 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x41b850
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511a80
mov esp, ebp
pop ebp
ret
Function at 0x41ece0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f0
mov eax, dword [0x5bd254]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2d8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e0], 0
lea edx, [ebp - 0x2d8]
mov dword [ebp - 4], edx
jmp 0x41ed2c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
je 0x41ed6a
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x2e
jne 0x41ed4c
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2e0], edx
jmp 0x41ed68
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
jne 0x41ed68
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2e4], eax
jmp 0x41ed6a
jmp 0x41ed23
lea ecx, [ebp - 0x170]
push ecx
lea edx, [ebp - 0x2d8]
push edx
call sym.convertifd.exe_JfPrependPath
add esp, 8
cmp dword [ebp - 0x2e0], 0
jne 0x41ed9b
push str..EXE
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x2dc], 0
jmp 0x41edb6
mov ecx, dword [ebp - 0x2dc]
add ecx, 1
mov dword [ebp - 0x2dc], ecx
cmp dword [ebp - 0x2dc], 2
jge 0x41eed7
lea edx, [ebp - 0x170]
push edx
call sym.convertifd.exe_IsFilePresent
add esp, 4
test eax, eax
jne 0x41eed0
push 0x5c
lea eax, [ebp - 0x170]
push eax
call fcn.00516c60
add esp, 8
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0
jne 0x41ee08
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x2e8], ecx
jmp 0x41ee17
mov edx, dword [ebp - 0x2e8]
add edx, 1
mov dword [ebp - 0x2e8], edx
push str.JfDict.EXE
mov eax, dword [ebp - 0x2e8]
push eax
call fcn.0051e073
add esp, 8
test eax, eax
jne 0x41eec9
lea ecx, [ebp - 0x170]
push ecx
push str.Copy__s
lea edx, [ebp - 0x4f0]
push edx
call fcn.005135ca
add esp, 0xc
push 0x5c
lea eax, [ebp - 0x4f0]
push eax
call fcn.00516c60
add esp, 8
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0
jne 0x41ee7c
lea ecx, [ebp - 0x4eb]
mov dword [ebp - 0x2e8], ecx
jmp 0x41ee8b
mov edx, dword [ebp - 0x2e8]
add edx, 1
mov dword [ebp - 0x2e8], edx
push str.JfDict2.exe
mov eax, dword [ebp - 0x2e8]
push eax
call fcn.00513670
add esp, 8
lea ecx, [ebp - 0x170]
push ecx
mov edx, dword [ebp - 0x2e8]
push edx
call fcn.00513680
add esp, 8
lea eax, [ebp - 0x4f0]
push eax
call fcn.00517426
add esp, 4
jmp 0x41eda7
mov eax, 2
jmp 0x41ef0e
jmp 0x41eed7
cmp dword [ebp - 0x2e4], 0
je 0x41eefd
mov ecx, dword [ebp - 0x2e4]
mov byte [ecx], 0x20
mov edx, dword [ebp - 0x2e4]
push edx
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x170]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00511a80
mov esp, ebp
pop ebp
ret
Function at 0x41ef20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x5bd254]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x170]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511a80
mov esp, ebp
pop ebp
ret
Function at 0x441110
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5bd254]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x44113a
mov eax, dword [ebp + 0xc]
push eax
call fcn.005138b0
add esp, 4
cmp eax, 3
jae 0x441141
mov dword [ebp + 0xc], 0x5a8e04
cmp dword [ebp + 8], 0
je 0x441157
mov ecx, dword [ebp + 8]
push ecx
call fcn.005138b0
add esp, 4
test eax, eax
jne 0x4411bb
lea edx, [ebp - 0x118]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x44119c
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0x5a8e08
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x44119c
push 0x5a8e0c
lea ecx, [ebp - 0x118]
push ecx
call fcn.00513670
add esp, 8
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 8], eax
jmp 0x4411d5
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x441234
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp + 0x10], 0
jne 0x4411fe
mov eax, dword [ebp + 0x10]
push eax
call fcn.005138b0
add esp, 4
test eax, eax
je 0x441220
lea ecx, [ebp - 0x220]
push ecx
call sym.convertifd.exe_UtStripExt
add esp, 4
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x220]
push eax
call sym.convertifd.exe_UtAddExt
add esp, 8
lea ecx, [ebp - 0x220]
push ecx
call fcn.0052ab0e
add esp, 4
mov dword [ebp - 4], eax
jmp 0x44123b
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00511a80
mov esp, ebp
pop ebp
ret
Function at 0x4613e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 4]
push ecx
push str.CLSIDDFD27DA0_27C9_11d3_A1C8_0090272316F6InprocServer32
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x461432
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x461432
mov eax, 1
jmp 0x461434
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x461440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
jne 0x461450
xor eax, eax
jmp 0x4614c8
cmp dword [sym.convertifd.exe_embed_gfx], 0
jne 0x46145d
xor eax, eax
jmp 0x4614c8
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
jmp 0x461476
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [sym.convertifd.exe_remnbitmaps]
jge 0x4614b0
mov edx, dword [ebp - 4]
mov eax, dword [sym.convertifd.exe_remBitmaps]
mov ecx, dword [eax + edx*4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004614d0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4614ae
cmp dword [ebp - 0xc], 0
jg 0x4614ae
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x46146d
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
push 0x606017
call fcn.0051646d
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4614d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1130
call fcn.00516c30
mov eax, dword [0x5bd254]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4614f5
or eax, 0xffffffff
jmp 0x4616c6
cmp dword [ebp + 0xc], 0
jne 0x461503
or eax, 0xffffffff
jmp 0x4616c6
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sym.convertifd.exe_UtGetExt
add esp, 8
movsx edx, byte [ebp - 0x12c]
test edx, edx
je 0x46155b
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sym.convertifd.exe_FindLogoFileNoMsg
add esp, 0xc
test eax, eax
jne 0x461559
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00513670
add esp, 8
jmp 0x46156e
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00513670
add esp, 8
push 0x5ab314
lea ecx, [ebp - 0x110]
push ecx
call fcn.00515a07
add esp, 8
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x461599
or eax, 0xffffffff
jmp 0x4616c6
push 2
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00515def
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.0051600c
add esp, 4
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.005138b0
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0051646d
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
push 0x5ab318
call fcn.0051646d
add esp, 0x10
push 2
push 0
mov edx, dword [ebp - 0x118]
push edx
call fcn.00515def
add esp, 0xc
mov eax, dword [ebp - 0x118]
push eax
call fcn.0051600c
add esp, 4
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
push ecx
call sym.convertifd.exe_MdfAsciiOfLong
add esp, 4
mov dword [ebp - 0x114], eax
mov edx, dword [ebp + 8]
push edx
push 1
push 8
mov eax, dword [ebp - 0x114]
push eax
call fcn.0051646d
add esp, 0x10
push 0
push 0
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.00515def
add esp, 0xc
mov edx, dword [ebp - 0x118]
push edx
push 0x1000
push 1
lea eax, [ebp - 0x1130]
push eax
call fcn.00515cb6
add esp, 0x10
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jle 0x4616a1
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [ebp - 0x11c]
push edx
lea eax, [ebp - 0x1130]
push eax
call fcn.0051646d
add esp, 0x10
cmp dword [ebp - 0x11c], 0x1000
jge 0x4616af
jmp 0x4616b1
jmp 0x461659
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.005158c7
add esp, 4
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511a80
mov esp, ebp
pop ebp
ret
Function at 0x465700
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1408
call fcn.00516c30
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x1404], eax
push esi
mov esi, dword [0x606038]
test esi, esi
je 0x465907
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x465730
sub eax, edx
je 0x465907
push str._tempConvertIFD
push esi
call fcn.0051e073
add esp, 8
test eax, eax
jne 0x4657f1
lea eax, [esp + 0x408]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x408]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x465774
sub eax, edx
mov edx, eax
mov eax, dword [str.ConvertIFD.log]
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x465790
mov ecx, dword [0x606038]
sub eax, esi
push ecx
lea esi, [eax + edx + 1]
call sym.convertifd.exe_IpFree
push esi
call sym.convertifd.exe_IpMalloc
lea edx, [esp + 0x410]
push edx
push esi
push eax
mov dword [0x606038], eax
call fcn.00517df3
mov eax, dword [str.ConvertIFD.log]
mov ecx, dword [0x606038]
push eax
push esi
push ecx
call fcn.00517d82
add esp, 0x20
pop esi
mov ecx, dword [esp + 0x1404]
xor ecx, esp
call fcn.00511a80
add esp, 0x1408
ret
mov edx, dword [0x606038]
push str._temp_form
push edx
call fcn.0051e073
add esp, 8
test eax, eax
jne 0x4658fa
mov ecx, dword [0x606030]
lea eax, [esp + 8]
push eax
push ecx
call sym.convertifd.exe_UtGetName
lea eax, [esp + 0x10]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x465828
sub eax, edx
je 0x465907
lea edx, [esp + 0x408]
push edx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x408]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x465856
sub eax, edx
push edi
mov edi, eax
lea eax, [esp + 0xc]
lea edx, [eax + 1]
jmp 0x465870
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x465870
sub eax, edx
mov edx, eax
mov eax, dword [str..log]
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x465885
sub eax, esi
add eax, edx
lea esi, [eax + edi + 1]
mov eax, dword [0x606038]
push eax
call sym.convertifd.exe_IpFree
push esi
call sym.convertifd.exe_IpMalloc
lea ecx, [esp + 0x414]
push ecx
push esi
push eax
mov dword [0x606038], eax
call fcn.00517df3
mov eax, dword [0x606038]
lea edx, [esp + 0x20]
push edx
push esi
push eax
call fcn.00517d82
mov ecx, dword [str..log]
mov edx, dword [0x606038]
push ecx
push esi
push edx
call fcn.00517d82
add esp, 0x2c
pop edi
pop esi
mov ecx, dword [esp + 0x1404]
xor ecx, esp
call fcn.00511a80
add esp, 0x1408
ret
push 0x580cbb
call fcn.004656b0
add esp, 4
mov ecx, dword [esp + 0x1408]
pop esi
xor ecx, esp
call fcn.00511a80
add esp, 0x1408
ret
Function at 0x465ee0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x364
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
mov ebx, dword [0x6a20f6]
push esi
push edi
lea eax, [esp + 0x260]
push eax
push 0x104
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x158]
push ecx
push 0x580cbb
push sym.convertifd.exe_i_ifd
push 0x581734
call sym.convertifd.exe_GetAndProcessFileDirectory
lea eax, [esp + 0x168]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x465f43
sub eax, edx
je 0x465f5e
lea edx, [esp + 0x158]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x13c
push 0
mov ecx, 0x4f
mov esi, sym.convertifd.exe_i_icf
lea edi, [esp + 0x20]
push sym.convertifd.exe_i_icf
rep movsd dword es:[edi], dword [esi]
call fcn.00511e90
call sym.convertifd.exe_CfPartialInit
mov eax, dword [0x6a20ee]
mov dword [0x6a20f6], ebx
imul ebx, ebx, 0x5f
lea ecx, [ebx + eax]
mov esi, 1
push ecx
mov dword [0x6a2158], esi
call sym.convertifd.exe_CfScan
push eax
push str._tCfScan_Return_Code:__d_n
call fcn.00465b40
mov dword [sym.convertifd.exe_IsDesignProg], esi
call sym.convertifd.exe_CfSave
mov eax, dword [0x6a20ee]
mov edx, dword [esp + 0x28]
add ebx, eax
mov ecx, 0x4f
lea esi, [esp + 0x30]
mov edi, sym.convertifd.exe_i_icf
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [0x6a20f6], edx
call sym.convertifd.exe_CfScan
push eax
push str._tCfScan_Return_Code:__d_n
call fcn.00465b40
add esp, 0x24
lea ecx, [esp + 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x36c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00511a80
mov esp, ebp
pop ebp
ret