joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4074c9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [0x481068], esi
call fcn.004087e4
mov ebx, eax
xor edi, edi
cmp ebx, edi
jge 0x40751b
lea ecx, [ebp - 0xc]
call fcn.0041e62f
push ebx
lea eax, [ebp - 0xc]
push str.Load_template_failed___d_
push eax
call fcn.0041ecd1
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0041f593
push eax
call fcn.0042024b
pop ecx
lea ecx, [ebp - 0xc]
call fcn.0041e765
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 0x10]
call fcn.00409761
mov eax, dword [ebp + 0x14]
mov dword [0x481068], edi
cmp eax, edi
je 0x407537
mov dword [eax], esi
cmp dword [esi + 4], edi
mov dword [esi + 0x6c], eax
jne 0x407547
or eax, 0xffffffff
jmp 0x4076ca
push dword [0x481060]
inc dword [0x481058]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [0x481058]
push 0x42
shl eax, 2
push eax
push dword [0x481060]
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push eax
mov dword [0x481060], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [0x481060], edi
mov dword [0x48105c], eax
jne 0x40759a
mov ecx, 0x481a9c
call fcn.0041f593
push eax
call fcn.0042024b
pop ecx
mov eax, dword [0x481058]
mov ecx, dword [0x48105c]
mov dword [ecx + eax*4 - 4], esi
mov ecx, esi
call fcn.00409b18
mov ecx, esi
call fcn.004083ac
test al, al
je 0x4075ff
mov eax, dword [0x481064]
cmp eax, edi
je 0x4075ff
mov ecx, dword [eax + 0x18]
cmp ecx, dword [esi + 0x18]
jne 0x4075ff
mov ecx, dword [eax + 0x1c]
cmp ecx, dword [esi + 0x1c]
jne 0x4075ff
mov ecx, dword [eax + 0x20]
cmp ecx, dword [esi + 0x20]
jne 0x4075ff
lea ecx, [ebp - 0x10]
push ecx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
push edi
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
push edi
push edi
push 0x110
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
cmp dword [esi + 0x7c], edi
jle 0x40763f
push ebx
lea ecx, [esi + 0x70]
call fcn.0042168b
cmp dword [eax + 0x10], 1
je 0x40762d
inc ebx
cmp ebx, dword [esi + 0x7c]
jl 0x407616
jmp 0x40763f
push ebx
lea ecx, [esi + 0x70]
call fcn.0042168b
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, esi
call fcn.004083ac
test al, al
je 0x4076c7
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov ebx, eax
push edi
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
push 0xf120
push ebx
call edi
push 0
push 0xf020
push ebx
call edi
push 0
push 0xf030
push ebx
call edi
push 0
push 0xf000
push ebx
call edi
push 0x400
push 1
push ebx
call edi
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
push 0x42e9e4
push 2
push 0x800
push ebx
call edi
push str.About...
push 1
push 0
push ebx
call edi
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.00408152
pop ecx
mov dword [0x481224], esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x407c3e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x50]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
push 0xfffffffffffffff0
push edi
sete byte [ebp - 1]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebx, dword [ebp + 0xc]
mov ecx, eax
mov eax, 0x8000000
push 0
and ecx, eax
pop edi
cmp ecx, eax
mov al, byte [ebx + 0x10]
sete byte [ebp + 0xb]
and al, 1
mov byte [ebp + 0xf], al
mov eax, edi
je 0x407c8b
mov eax, dword [esi + 0x1c]
jmp 0x407cce
cmp byte [ebp + 0xb], 0
je 0x407c98
mov eax, dword [esi + 0x1c]
shl eax, 1
jmp 0x407cce
mov ecx, dword [ebx + 0x10]
and ecx, 0x40
cmp cl, 0x40
jne 0x407cb4
mov ecx, dword [esi + 0x1c]
lea edx, [ecx + ecx*2 + 3]
cmp dword [esi + 0x64], edx
jle 0x407cb4
lea eax, [ecx + ecx*2]
jmp 0x407cce
cmp byte [ebp - 1], 0
je 0x407cce
mov ecx, dword [esi + 0x1c]
lea edx, [ecx*4 + 4]
cmp dword [esi + 0x64], edx
jle 0x407cce
mov eax, ecx
shl eax, 2
push 0xcc0020
push edi
push eax
push dword [esi + 0x5c]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push edi
push edi
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_BitBlt]
and byte [ebp - 0xf4], 0
push 0x31
pop ecx
xor eax, eax
lea edi, [ebp - 0xf3]
push 0xc8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xf4]
push eax
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, eax
push 1
test edi, edi
jle 0x407df5
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_SetBkMode]
cmp byte [ebp + 0xb], 0
je 0x407d37
push 0xa0a0a0
jmp 0x407d3a
push dword [esi + 0x2c]
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_SetTextColor]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xf4]
push edi
push eax
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov eax, dword [esi + 0x1c]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
and dword [ebp - 0x18], 0
push 0x25
push eax
lea eax, [ebp - 0xf4]
push edi
push eax
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_DrawTextA]
cmp byte [ebp - 1], 0
je 0x407df3
mov eax, dword [esi + 0x1c]
lea ecx, [eax*4 + 4]
cmp dword [esi + 0x64], ecx
jg 0x407df3
add dword [ebp - 0xc], 6
add dword [ebp - 8], 4
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0xc]
cdq
sub eax, edx
sar ecx, 1
mov edi, eax
mov eax, ecx
sar edi, 1
sub eax, edi
add edi, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x20]
cdq
sub eax, edx
mov dword [ebp - 0x24], edi
mov esi, eax
mov eax, dword [ebp - 8]
cdq
sar esi, 1
sub eax, edx
mov edx, esi
sar eax, 1
sub edx, eax
add eax, esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x28], edx
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40c2c5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 8]
push edi
mov edi, ecx
push eax
push 0xa
push dword [edi + 4]
call fcn.00420527
mov ecx, dword [ebp + 8]
add esp, 0xc
push dword [ebp - 8]
call fcn.0041e77c
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
xor ebx, ebx
mov dword [esi], eax
cmp byte [eax], bl
jne 0x40c309
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x481da8
jmp 0x40c4db
push eax
call fcn.00427950
cmp eax, 2
pop ecx
jb 0x40c4d1
mov ecx, dword [ebp - 8]
mov byte [ebp + 0xb], bl
mov al, byte [ecx]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 4], al
mov eax, dword [esi]
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], bl
cmp byte [eax], 0x5c
jne 0x40c3cd
cmp byte [eax + 1], 0x5c
jne 0x40c3cd
mov byte [ebp + 0xb], 1
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [ebp + 0xb]
neg cl
sbb ecx, ecx
and ecx, 2
cmp ecx, eax
jge 0x40c458
mov esi, dword [ebp - 8]
mov dl, byte [ecx + esi]
cmp dl, 0x3a
jne 0x40c375
cmp ecx, 1
jne 0x40c449
cmp dl, 0x7c
je 0x40c449
cmp dl, 0x2a
je 0x40c449
cmp dl, 0x2f
je 0x40c449
cmp dl, 0x3e
je 0x40c449
cmp dl, 0x3c
je 0x40c449
cmp dl, 0x3f
je 0x40c449
cmp dl, 0x22
je 0x40c449
cmp ecx, ebx
jle 0x40c3c3
cmp dl, 0x5c
jne 0x40c3c3
cmp byte [ecx + esi - 1], dl
je 0x40c43a
inc ecx
cmp ecx, eax
jl 0x40c364
jmp 0x40c458
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp - 8]
cmp byte [ecx + 1], 0x3a
jne 0x40c4d1
mov dl, byte [ecx + 2]
cmp dl, 0x5c
je 0x40c3f4
cmp dl, bl
jne 0x40c4d1
cmp eax, 1
jne 0x40c408
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x481dc0
jmp 0x40c4db
cmp eax, 3
je 0x40c348
cmp eax, 4
je 0x40c348
cmp eax, 2
je 0x40c348
cmp eax, ebx
je 0x40c348
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x481dcc
jmp 0x40c4db
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x481dd8
jmp 0x40c4db
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x481de4
jmp 0x40c4db
cmp byte [ebp + 0xb], bl
jne 0x40c4cd
lea eax, [ebp - 4]
push 1
push eax
call fcn.0040efb3
cmp edx, dword [0x4817ac]
pop ecx
pop ecx
mov dword [0x4817a0], eax
mov dword [0x4817a4], edx
ja 0x40c4cd
jb 0x40c487
cmp eax, dword [0x4817a8]
jae 0x40c4cd
lea ecx, [ebp - 0x14]
call fcn.0041e62f
lea eax, [ebp - 4]
mov ecx, 0x481df0
push eax
call fcn.0041f593
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041ecd1
mov edi, dword [edi + 4]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ebx
push ebx
call fcn.0041f593
push eax
push edi
mov ecx, 0x4810c0
call fcn.0041da7b
lea ecx, [ebp - 0x14]
call fcn.0041e765
jmp 0x40c4ec
mov al, 1
jmp 0x40c4ee
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x481db4
call fcn.0041f593
push eax
push edi
mov ecx, 0x4810c0
call fcn.0041da7b
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40c4f5
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push eax
call fcn.0041f593
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x40c5c3
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push edi
xor ebx, ebx
test byte [ebp - 0x144], 0x10
je 0x40c5a8
cmp byte [ebp - 0x118], 0x2e
je 0x40c5a8
cmp byte [ebp - 0x118], bl
je 0x40c5a8
push ebx
push ebx
push 0x18b
push 0xb
push dword [ebp + 8]
call esi
xor edi, edi
cmp eax, ebx
mov dword [ebp - 4], eax
jle 0x40c594
lea eax, [ebp - 0x248]
mov byte [ebp - 0x248], bl
push eax
push edi
push 0x189
push 0xb
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40c5a8
inc edi
cmp edi, dword [ebp - 4]
jl 0x40c55c
lea eax, [ebp - 0x118]
push eax
push ebx
push 0x180
push 0xb
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c52b
pop edi
pop esi
pop ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
leave
ret 8
Function at 0x40e944
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop edi
jne 0x40e999
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret

Function at 0x40e99b
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call edi
cmp eax, 0xffffffff
je 0x40e9b9
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call edi
inc eax
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
ret

Function at 0x40e9cc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x40e9ea
or eax, 0xffffffff
jmp 0x40ea5d
push edi
push esi
call fcn.00427db9
mov edi, eax
pop ecx
test edi, edi
jne 0x40ea09
mov ecx, 0x481a9c
call fcn.0041f593
push eax
call fcn.0042024b
pop ecx
push edi
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40ea1e
push 0xfffffffffffffffd
jmp 0x40ea52
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x42eb7c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40ea3d
push 0xfffffffffffffffc
jmp 0x40ea52
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push 1
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
pop esi
push edi
call fcn.00427dae
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x40ea60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 0x10]
push edi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x40ea84
or eax, 0xffffffff
jmp 0x40ebff
push ebx
push esi
call fcn.00427db9
mov ebx, eax
pop ecx
cmp ebx, edi
mov dword [ebp - 0xc], ebx
jne 0x40eaa6
mov ecx, 0x481a9c
call fcn.0041f593
push eax
call fcn.0042024b
pop ecx
push ebx
push esi
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40eabe
push 0xfffffffffffffffd
jmp 0x40ebf2
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 8]
mov bl, 3
test bl, al
jne 0x40ebf0
cmp eax, edi
je 0x40ebf0
shr eax, 2
test eax, eax
jle 0x40ebd6
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x40eb02
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.0041e62f
mov eax, dword [ebp - 4]
mov esi, 0x42ecb4
movzx eax, word [eax]
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0041ecd1
add esp, 0xc
test byte [ebp - 0x1c], bl
je 0x40eb35
push edi
push 0x30
lea ecx, [ebp - 0x1c]
call fcn.0041f26b
jmp 0x40eb23
push str.StringFileInfo_
lea ecx, [ebp - 0x28]
call fcn.0041e69f
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push eax
call fcn.0041e92f
push 0x4311c8
lea ecx, [ebp - 0x1c]
call fcn.0041e77c
mov eax, dword [ebp - 4]
movzx eax, word [eax + 2]
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0041ecd1
add esp, 0xc
test byte [ebp - 0x1c], bl
je 0x40eb82
push edi
push 0x30
lea ecx, [ebp - 0x1c]
call fcn.0041f26b
jmp 0x40eb70
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push eax
call fcn.0041e92f
push edi
push str.FileDescription
lea ecx, [ebp - 0x28]
call fcn.0041e8b1
lea eax, [ebp - 8]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0041f593
push eax
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp + 0x10]
cmp ecx, edi
je 0x40ebc4
push dword [ebp + 8]
call fcn.0041e77c
lea ecx, [ebp - 0x28]
call fcn.0041e765
lea ecx, [ebp - 0x1c]
call fcn.0041e765
jmp 0x40ebec
mov eax, dword [ebp + 0xc]
mov word [ebp + 8], di
cmp eax, edi
mov word [ebp + 0xa], 0x4b0
je 0x40ebec
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 1
jmp 0x40ebf2
push 0xfffffffffffffffc
pop esi
push dword [ebp - 0xc]
call fcn.00427dae
pop ecx
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40f0b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call fcn.0040ec62
test al, al
pop ecx
je 0x40f0c9
xor al, al
ret
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret

Function at 0x40f0de
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, 2
push edi
je 0x40f1af
cmp esi, 7
je 0x40f1af
cmp esi, 0x10
je 0x40f1af
cmp esi, 0x14
je 0x40f1af
cmp esi, 0xb
je 0x40f1af
cmp esi, 5
je 0x40f1af
cmp esi, 0x17
je 0x40f139
cmp esi, 0x18
je 0x40f139
cmp esi, 0x19
je 0x40f139
cmp esi, 0x16
jne 0x40f23e
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
mov eax, dword [0x4823f8]
or eax, 0x20019
push eax
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f23e
cmp esi, 0x18
mov dword [ebp - 8], 0x104
mov eax, str.Common_Programs
jne 0x40f17c
mov eax, str.Common_Startup
jmp 0x40f192
cmp esi, 0x19
jne 0x40f188
mov eax, str.Common_Desktop
jmp 0x40f192
cmp esi, 0x16
jne 0x40f192
mov eax, str.Common_Start_Menu
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov edi, eax
jmp 0x40f234
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
mov eax, dword [0x4823f8]
or eax, 0x20019
push eax
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f23e
cmp esi, 7
mov dword [ebp - 8], 0x104
mov eax, str.Programs
jne 0x40f1ee
mov eax, str.Startup
jmp 0x40f21c
cmp esi, 0x10
jne 0x40f1fa
mov eax, str.Desktop
jmp 0x40f21c
cmp esi, 0x14
jne 0x40f206
mov eax, str.Fonts
jmp 0x40f21c
cmp esi, 0xb
jne 0x40f212
mov eax, str.Start_Menu
jmp 0x40f21c
cmp esi, 5
jne 0x40f21c
mov eax, str.Personal
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x40f27a
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40f27e
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40f27a
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov al, 1
jmp 0x40f280
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f48e
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x40f659
cmp dword [ebp + 0xc], ebx
je 0x40f659
cmp dword [ebp + 0x14], ebx
je 0x40f659
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
add eax, 4
push eax
call fcn.00427db9
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x40f4e3
mov ecx, 0x481a9c
call fcn.0041f593
push eax
call fcn.0042024b
pop ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x42eed4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x148]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
mov dword [ebp - 4], eax
call fcn.00427dae
cmp dword [ebp - 4], 0xffffffff
pop ecx
jne 0x40f51e
push 0xfffffffffffffffd
jmp 0x40f63c
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x148], 0x10
je 0x40f5cb
cmp byte [ebp - 0x11c], 0x2e
je 0x40f5df
push dword [ebp + 8]
call fcn.00427950
mov edi, eax
pop ecx
lea eax, [ebp - 0x11c]
push eax
call esi
lea eax, [edi + eax + 2]
push eax
call fcn.00427db9
mov edi, eax
pop ecx
test edi, edi
jne 0x40f579
push dword [ebp - 4]
call ebx
mov ecx, 0x481a9c
call fcn.0041f593
push eax
call fcn.0042024b
pop ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x11c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call esi
cmp byte [eax + edi - 1], 0x5c
je 0x40f5a8
push 0x42eb7c
push edi
call fcn.00428050
pop ecx
pop ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0040f48e
push edi
mov dword [ebp - 8], eax
call fcn.00427dae
add esp, 0x14
cmp dword [ebp - 8], 0
jg 0x40f5f8
jmp 0x40f5df
push dword [ebp + 0xc]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40f602
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40f63f
jmp 0x40f524
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 8]
jmp 0x40f65c
push dword [ebp - 4]
call ebx
push dword [ebp + 8]
call esi
inc eax
push eax
call fcn.00427db9
mov esi, eax
pop ecx
test esi, esi
jne 0x40f62b
mov ecx, 0x481a9c
call fcn.0041f593
push eax
call fcn.0042024b
pop ecx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x14]
push 1
mov dword [eax], esi
pop eax
jmp 0x40f65c
push dword [ebp - 4]
call ebx
mov esi, 0x4810c0
mov ecx, esi
call fcn.0041c8ce
cmp eax, 1
je 0x40f649
xor eax, eax
jmp 0x40f65c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f661
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x40f708
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x40f708
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push ebx
push ebx
mov dword [eax], ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x40f695
push 0xfffffffffffffffe
pop eax
jmp 0x40f70b
push edi
call fcn.00427db9
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
jne 0x40f6b4
mov ecx, 0x481a9c
call fcn.0041f593
push eax
call fcn.0042024b
pop ecx
push dword [ebp - 4]
push edi
call esi
test eax, eax
jne 0x40f6ce
push 0xfffffffffffffffc
pop edi
push dword [ebp - 4]
call fcn.00427dae
pop ecx
mov eax, edi
jmp 0x40f70b
mov esi, dword [ebp - 4]
xor edi, edi
cmp byte [esi], bl
je 0x40f6c1
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40f6fb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.0040f48e
mov edi, eax
add esp, 0x10
cmp edi, ebx
jg 0x40f6c1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
jmp 0x40f6d3
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41026c
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 0
je 0x41027c
call fcn.004113d6
push dword [0x481290]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
test eax, eax
mov dword [esi + 0x10], eax
jne 0x4102aa
push edi
push dword [0x481290]
call dword [sym.imp.USER32.dll_ReleaseDC]
or eax, 0xffffffff
jmp 0x410321
push dword [esi + 4]
push dword [esi]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push edi
mov ebx, eax
push dword [0x481290]
call dword [sym.imp.USER32.dll_ReleaseDC]
test ebx, ebx
jne 0x4102d7
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0xfffffffffffffffe
pop eax
jmp 0x410321
push ebx
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
jne 0x4102f2
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0xfffffffffffffffd
jmp 0x410317
push 0xcc0020
push dword [esi + 0xc]
push dword [esi + 8]
push dword [0x48129c]
push dword [esi + 4]
push dword [esi]
push 0
push 0
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_BitBlt]
push 1
pop esi
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, esi
pop edi
pop esi
pop ebx
ret