joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406211
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x40628f
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x19e8]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x19ec]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d74]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x19f0], eax
mov dword [ebp - 0x19c], 0
jmp 0x4060f3
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x4061a5
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x4061a5
push eax
xor eax, 0x162ff
or eax, 0x6acf
add eax, 0x183b3
pop eax
push eax
push ecx
add esp, 4
sub eax, 0x64f3
sub eax, 0x13c02
xor eax, 0xe1e9
or eax, 0xff7c
pop eax
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x406197
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x40619e
jmp 0x4060e4
jmp 0x4061a5
push edi
push ebx
add esp, 4
or edi, 0x10030
xor byte [eax], al
add dword [eax], eax
sub edi, 0xb76d
add edi, 0x12294
and edi, 0x17e1c
pop edi
push ebx
call fcn.004061d3
add byte [edi], dh
dec edx
dec ecx
inc esp
xor edi, dword [0xc4834a4b]
add esp, 4
pop ebx
add esp, 4
pop ebx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x406204
mov dword [ebp - 0xcb8], 0
jmp 0x406273
push edi
push ebx
add esp, 4
or edi, 0x17fb6
and edi, 0x102e8
call 0x81406318
out 0x69, eax
stc
add byte [eax], al
and edi, 0xd487
pop edi
push ecx
and ecx, 0x157b
sub ecx, 0x9d17
sub ecx, 0x1851b
pop ecx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x406269
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x406273
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x40628a
mov ecx, dword [ebp - 0x19f0]
mov dword [ebp - 0x510], ecx
jmp 0x40629b
jmp 0x406074
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
Function at 0x4213f4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [ecx + 0x14]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x4214cd
lea edx, [ebp - 0x2a0]
push 0x102
push edx
push ebx
push ebx
mov byte [ebp - 0x2a0], bl
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp byte [ebp - 0x2a0], bl
jne 0x421474
cmp dword [ebp + 8], 0x25
jne 0x4214cd
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
jae 0x42146c
lea eax, [ebp - 0x2a0]
push str.eject
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp - 0x2a0], bl
je 0x4214cd
push esi
lea eax, [ebp - 0x2a0]
push edi
push eax
lea eax, [ebp + 8]
push eax
call fcn.004214d4
mov eax, dword [ebp + 8]
pop ecx
xor edi, edi
cmp dword [0x4c8488], ebx
pop ecx
mov dword [ebp - 4], eax
je 0x4214b8
mov eax, 0x4c8488
mov esi, eax
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4214b8
add esi, 8
inc edi
mov eax, esi
cmp dword [esi], ebx
jne 0x42149f
mov esi, dword [edi*8 + 0x4c848c]
lea ecx, [ebp + 8]
call fcn.004010b4
mov eax, esi
pop edi
pop esi
jmp 0x4214cf
xor eax, eax
pop ebx
leave
ret 4

Function at 0x42516f
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x20
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0xc]
mov esi, dword [esi]
xor ecx, ecx
mov eax, dword [eax]
push ecx
and eax, 0x27
or eax, 0x8000000
push eax
push 2
push ecx
push ecx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
pop esi
ret
Function at 0x428991
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
neg esi
lea eax, [ecx - 0x1c]
sbb esi, esi
and esi, eax
cmp byte [ecx + 0x1c], 0
je 0x4289d4
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x4289c5
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4289da
cmp dword [ebp + 0xc], 0
jne 0x4289d4
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x4289f1
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x1c]
shr eax, 0x10
movsx eax, ax
push eax
movsx eax, word [ebp + 0x10]
push eax
call fcn.0042954e
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x432593
Capabilities:
Capture screenshot
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp dword [ebp + 8], esi
je 0x4325b4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDC]
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x4325bb
xor eax, eax
jmp 0x432739
push edi
mov edi, dword [ebp + 0xc]
push dword [ebx + 0x33c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], esi
push dword [edi + 4]
push dword [edi]
call fcn.0045181c
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x43270e
push dword [ebp - 0xc]
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], esi
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call esi
test eax, eax
mov dword [ebp - 8], eax
je 0x4326a1
push dword [ebp - 0xc]
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x4326a1
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x4326a1
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp - 8]
call esi
push dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 4]
call esi
mov dword [ebp - 0x14], eax
xor eax, eax
push 0xcc0020
push eax
push eax
push dword [ebp - 4]
push dword [edi + 4]
push dword [edi]
push eax
push eax
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
push dword [ebp - 8]
call esi
push dword [ebp - 0x14]
push dword [ebp - 4]
call esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4326a1
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
jne 0x4326bf
mov eax, dword [0x4e9e94]
mov ecx, dword fs:[0x2c]
push 0x10
mov eax, dword [ecx + eax*4]
mov ecx, dword [eax + 4]
call fcn.0047a2e3
jmp 0x4326da
mov eax, dword [ebx + 0xcc]
push 0
push 0x2b2d
push 0x8002
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp + 8]
call fcn.00450a0e
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x4326f2
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 4], edi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
je 0x432702
push dword [ebp - 4]
call esi
cmp dword [ebp - 8], edi
je 0x432729
push dword [ebp - 8]
call esi
jmp 0x432729
mov eax, dword [ebx + 0xcc]
push 1
push 0x271e
push 0x8002
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0xc]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x432de8
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x432dfe
xor eax, eax
jmp 0x432fa0
xor eax, eax
push ebx
cmp dword [ebp + 0x18], eax
push edi
sete al
mov dword [esi + 0xc], eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
push 6
lea eax, [ebp - 0x1c]
push 6
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
call dword [sym.imp.USER32.dll_InflateRect]
push 1
pop ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x432e50
mov dword [esi + 8], ebx
mov dword [esi + 4], 2
jmp 0x432e5a
mov dword [esi + 8], 2
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [0x4e9e94]
mov ecx, dword fs:[0x2c]
push ebx
mov edi, dword [ecx + eax*4]
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x6f0]
call fcn.00474fba
cmp dword [esi + 0xc], 0
jne 0x432f3b
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp + 8]
jne 0x432f3b
push ebx
push 0x20d
push 0x200
lea eax, [ebp - 0x38]
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x432edb
push ebx
push 0x109
push 0x100
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x432f1f
mov eax, dword [ebp - 0x34]
cmp eax, 0x202
je 0x432f3b
cmp eax, 0x205
je 0x432f3b
cmp eax, 0x201
je 0x432f3b
cmp eax, 0x204
je 0x432f3b
cmp eax, 0x100
jne 0x432f07
cmp dword [ebp - 0x30], 0x1b
je 0x432f3b
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x258
jbe 0x432e8d
mov dword [esi + 0xc], ebx
jmp 0x432e8d
mov eax, dword [edi + 4]
push 0
mov ecx, dword [eax + 0x6f0]
call fcn.00474fba
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor ecx, ecx
pop edi
cmp dword [esi + 0xc], ecx
mov dword [ebp + 0x18], ecx
pop ebx
je 0x432f94
mov eax, dword [0x4d9ae4]
cmp eax, ecx
je 0x432f83
lea edx, [ebp + 0x18]
push edx
push dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0x14]
push dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
and ecx, dword [ebp + 8]
push ecx
call eax
jmp 0x432f94
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_DoDragDrop]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x18]
pop esi
leave
ret 0x14

Function at 0x43318f
Capabilities:
Log keystrokes via polling

Disassembly:
test byte [ecx + 0x77], 2
jne 0x433198
xor eax, eax
ret
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call esi
test ah, 0x80
je 0x4331b6
push 2
call esi
test ah, 0x80
je 0x4331b6
push 1
pop eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x434621
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x43467c
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
add esi, 4
push 0
push 0x1032
push dword [esi]
call edi
test eax, eax
je 0x43467c
cmp eax, 1
jne 0x434680
cmp dword [esp + 0xc], 0
jne 0x434680
push 2
push 0xffffffffffffffff
push 0x100c
push dword [esi]
call edi
push eax
mov ecx, esi
call fcn.00404c43
test eax, eax
je 0x434680
mov ecx, eax
call fcn.0041d76c
test eax, eax
je 0x434680
xor eax, eax
jmp 0x434693
push 0
push 0x802b
push 0x111
push dword [esi]
call edi
push 1
pop eax
pop edi
pop esi
ret 4

Function at 0x439307
Capabilities:
Log keystrokes via polling

Disassembly:
cmp word [esp + 8], 2
push esi
mov esi, ecx
je 0x439400
mov eax, dword [esi + 0x34]
push ebx
push ebp
lea ebp, [esi + 0x1c]
push edi
push ebp
push eax
call fcn.00470664
mov edi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
pop ecx
and dword [esi + 0x24], 0xffffffdf
pop ecx
push 0x4f8
push dword [esi + 4]
call edi
test eax, eax
je 0x439344
or dword [esi + 0x24], 0x20
movzx ebx, word [esi + 0x20]
push 0x3f3
and ebx, 0xffffff84
push dword [esi + 4]
call edi
test eax, eax
jne 0x439384
push 0x3f1
push dword [esi + 4]
call edi
test eax, eax
je 0x43936a
or ebx, 2
push 0x458
push dword [esi + 4]
call edi
test eax, eax
je 0x43937d
or ebx, 0x20
jmp 0x439384
mov ecx, ebp
call fcn.00403369
push 0x3f0
push dword [esi + 4]
call edi
test eax, eax
jne 0x439395
or ebx, 1
push 0x3f2
push dword [esi + 4]
call edi
test eax, eax
je 0x4393a6
or ebx, 8
push 0x469
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x147
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 4
jne 0x4393d0
test bl, 0x10
je 0x4393d0
xor eax, eax
movzx eax, ax
movzx ecx, bx
shl eax, 0x10
or eax, ecx
cmp word [esp + 0x18], 1
pop edi
pop ebp
mov dword [esi + 0x20], eax
pop ebx
jne 0x4393fb
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x4393fb
push 1
pop eax
jmp 0x4393fd
xor eax, eax
mov dword [esi + 0x28], eax
movzx eax, word [esp + 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
pop esi
ret 0x10
Function at 0x43c475
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x1c]
cmp ecx, dword [eax]
je 0x43c493
mov eax, dword [ebp + 0x14]
and dword [eax], 0
jmp 0x43c59a
push ebx
push esi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp + 0x14], eax
mov eax, dword [0x4cfce8]
mov ebx, 0x809d
mov dword [ebp + 0xc], eax
push 0
push ebx
push 0x419
push dword [edi + 0x14]
call esi
cmp eax, 0xffffffff
je 0x43c538
push ebx
lea ecx, [ebp + 0xc]
call fcn.00403548
mov eax, dword [ebp + 0xc]
cmp dword [eax - 8], 0
je 0x43c538
push 0
push 0x28
lea ecx, [ebp + 0xc]
call fcn.004030cc
test eax, eax
mov dword [ebp - 4], eax
jle 0x43c50c
lea ecx, [ebp + 0xc]
call fcn.00402c68
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push 0x4d823c
push 0x4d47e4
mov byte [ecx + eax], 9
lea ecx, [ebp + 0xc]
call fcn.004033b6
and dword [ebp - 4], 0
push 0
push ebx
push 0x409
push dword [edi + 0x14]
call esi
test eax, eax
jne 0x43c528
mov dword [ebp - 4], 3
push dword [ebp + 0xc]
push ebx
push dword [ebp - 4]
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_AppendMenuA]
inc ebx
cmp ebx, 0x80a3
jle 0x43c4b1
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
cmp ecx, 0xffffffff
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
jne 0x43c56a
cmp eax, ecx
jne 0x43c56a
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
xor esi, esi
push esi
push dword [edi + 0x20]
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
push 2
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
lea ecx, [ebp + 0xc]
call fcn.004010b4
cmp dword [ebp + 0x14], esi
pop esi
pop ebx
je 0x43c59a
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
pop edi
leave
ret 0x10

Function at 0x444f45
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 0xc]
and eax, 0x8000
sub ecx, 0x41
je 0x444f89
dec ecx
dec ecx
je 0x444f7e
sub ecx, 3
je 0x444f73
sub ecx, 0x2c
jne 0x444fa5
mov eax, 0x80aa
jmp 0x444f92
test eax, eax
je 0x444fa5
mov eax, 0x80ab
jmp 0x444f92
test eax, eax
je 0x444fa5
mov eax, 0x80ad
jmp 0x444f92
test eax, eax
je 0x444fa5
mov eax, 0x80a7
push 0
push eax
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x444fac
mov eax, dword [esp + 0x14]
and dword [eax], 0
xor eax, eax
pop esi
ret 0x10
Function at 0x446c29
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x30], 0
jne 0x446c44
push dword [ebp + 8]
call fcn.00428248
test eax, eax
je 0x446c80
mov eax, dword [esi + 0x20]
mov edi, dword [ebp + 0xc]
sub eax, dword [esi + 0x18]
lea ebx, [esi + 0x18]
test edi, edi
mov dword [ebp - 4], eax
je 0x446c80
test edi, 0xffff0000
jne 0x446c7a
push eax
push edi
call fcn.004706e9
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
pop ecx
jne 0x446c87
push edi
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x446c87
xor eax, eax
jmp 0x446d07
cmp dword [esi + 0x50], 0
lea edi, [esi + 0x50]
jne 0x446cc5
mov ecx, dword [ebp + 8]
push 0
call fcn.00446d0e
push ecx
mov ecx, esp
push eax
call fcn.0048eac5
push 0
push 0x46000043
push 0
push ecx
mov ecx, esp
push ebx
call fcn.0048eac5
mov ecx, dword [ebp + 8]
call fcn.0042d732
push eax
mov ecx, edi
call fcn.0042631f
push 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0xc]
push 0x170
push dword [edi]
call ebx
push 4
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
movzx eax, word [esi + 0x28]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx + 2]
push eax
push 1
push 0xd3
mov dword [esi + 0x2c], eax
push dword [esi + 0x30]
call ebx
mov eax, dword [ebp + 0xc]
push 1
mov dword [esi + 0x10], eax
pop eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x446db2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
neg esi
lea eax, [ecx - 0x1c]
sbb esi, esi
and esi, eax
cmp byte [ecx + 0x1c], 0
je 0x446df5
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x446de6
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x446dfb
cmp dword [ebp + 0xc], 0
jne 0x446df5
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x446e11
mov eax, dword [ebp + 0x10]
mov ecx, esi
shr eax, 0x10
movsx eax, ax
push eax
movsx eax, word [ebp + 0x10]
push eax
call fcn.00446e18
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x44cdfb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push esi
mov dword [ebp - 8], ebx
jne 0x44ce66
mov eax, dword [0x4d8504]
push ebx
push ebx
push 1
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
call fcn.00414d0b
push eax
call fcn.004600aa
add esp, 0x10
cmp dword [ebp - 0x10], ebx
mov esi, eax
mov dword [ebp - 8], esi
je 0x44ce4a
cmp dword [ebp - 0x14], ebx
je 0x44ce4a
mov eax, dword [0x4d8228]
push dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp esi, ebx
jne 0x44ce55
xor eax, eax
jmp 0x44cf0d
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push 0x20
mov ecx, esi
call fcn.00460d4d
mov dword [ebp + 0x10], esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov esi, eax
mov ecx, 0x4d8e00
shr esi, 2
call fcn.0040f77e
cmp esi, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ebx
jle 0x44cefb
lea eax, [edi + 4]
mov dword [ebp + 0xc], 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0x10]
push ebx
push ebx
push edi
call fcn.0046294b
cmp eax, ebx
jne 0x44cec4
cmp dword [ebp - 0xc], ebx
je 0x44cec9
mov ecx, dword [ebp + 0x10]
push ebx
push ebx
push edi
mov byte [edi + 2], bl
call fcn.0046294b
cmp eax, ebx
mov byte [edi + 2], 0x5c
je 0x44cec9
add edi, 4
jmp 0x44ceec
cmp dword [ebp + 0xc], esi
jge 0x44cee1
mov ecx, dword [ebp + 8]
mov eax, esi
sub eax, dword [ebp + 0xc]
mov dl, byte [ecx]
mov byte [ecx - 4], dl
add ecx, 4
dec eax
jne 0x44ced6
sub dword [ebp + 8], 4
dec esi
dec dword [ebp - 4]
dec dword [ebp + 0xc]
inc dword [ebp - 4]
add dword [ebp + 8], 4
inc dword [ebp + 0xc]
cmp dword [ebp - 4], esi
jl 0x44ce9a
mov ecx, dword [ebp - 8]
pop edi
cmp ecx, ebx
je 0x44cf08
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, esi
shl eax, 2
pop esi
pop ebx
leave
ret
Function at 0x44df40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x4d8234]
push 2
push dword [esp + 8]
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x4d8234]
push eax
mov ecx, dword [ecx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
cmp word [eax + 0xe], 0x20
sete cl
mov al, cl
ret

Function at 0x44e45d
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push esi
mov esi, ecx
cmp dword [esi + 0x2c], 0xffffffff
jne 0x44e49f
mov eax, dword [0x4d8eb8]
push 0x4008
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x160]
push 0x160
push eax
push 0
push dword [esi + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 0x15c]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x2c]
pop esi
leave
ret
Function at 0x4511c0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x70]
lea edi, [esi + 0x70]
cmp dword [eax - 8], 0
jne 0x4512ab
and byte [ebp - 0x58], 0
push 0x410
lea eax, [ebp - 0x168]
push 0x160
push eax
call fcn.00421820
neg eax
sbb eax, eax
mov ecx, esi
and al, 0x90
add eax, 0x80
push eax
mov eax, dword [esi]
call dword [eax + 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [0x4cfce8]
cmp byte [ebp - 0x58], 0
mov dword [ebp - 4], eax
jne 0x451298
mov ecx, esi
call fcn.0041d8dd
test eax, eax
je 0x451239
push 0x2b2a
lea ecx, [ebp - 4]
call fcn.00403548
jmp 0x45128b
mov eax, dword [0x4cfce8]
push 0x2e26
lea ecx, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.00403548
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
push eax
call fcn.0046bde8
test eax, eax
pop ecx
je 0x451277
push dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push str._s__s
push eax
call fcn.00404f20
add esp, 0x10
jmp 0x451283
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.00402dbe
lea ecx, [ebp - 8]
call fcn.004010b4
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.00402dbe
jmp 0x4512a3
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.00402e2b
lea ecx, [ebp - 4]
call fcn.004010b4
mov eax, dword [edi]
pop edi
pop esi
leave
ret