joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4708f2
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
push 0x38
pop eax
mov ecx, dword [esi + 8]
and ecx, 0x3f
mov byte [ecx + esi + 0x40], 0x80
inc ecx
cmp ecx, eax
jbe 0x47093c
push 0x40
pop edx
cmp ecx, edx
je 0x470927
sub edx, ecx
lea eax, [esi + 0x40]
push edx
add eax, ecx
push 0
push eax
call fcn.00433180
add esp, 0xc
lea ebp, [esi + 0x40]
lea edi, [esi + 0x20]
mov edx, ebp
push 1
mov ecx, edi
call dword [esi]
push 0x38
xor ecx, ecx
pop eax
jmp 0x470942
lea ebp, [esi + 0x40]
lea edi, [esi + 0x20]
sub eax, ecx
push eax
lea eax, [esi + 0x40]
add eax, ecx
push 0
push eax
call fcn.00433180
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, ebp
shld eax, ecx, 3
shl ecx, 3
bswap ecx
bswap eax
mov dword [esi + 0x7c], ecx
mov ecx, edi
push 1
mov dword [esi + 0x78], eax
call dword [esi]
push 4
pop edx
mov ecx, dword [edi + 4]
mov eax, dword [edi]
lea edi, [edi + 8]
bswap eax
mov dword [ebx], eax
lea ebx, [ebx + 8]
bswap ecx
mov dword [ebx - 4], ecx
sub edx, 1
jne 0x470977
pop edi
mov ecx, esi
pop esi
pop ebp
pop ebx
jmp fcn.00470d13

Function at 0x470d07
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x4b3be8]
mov dword [ecx], eax
jmp fcn.00470d13

Function at 0x470d13
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 8], 0
and dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x4711da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
push edx
push edi
push edi
call fcn.00437975
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x471204
call fcn.0047117d
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x472d46
Capabilities:
Open clipboard

Disassembly:
push 0x1c
mov eax, 0x48e145
call fcn.0046791f
mov esi, edx
and dword [ebp - 4], 0
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne byte [ebp - 0xd]
test eax, eax
je 0x472e02
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x472e02
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea eax, [eax*2 + 2]
push eax
push 0xd
pop ecx
call fcn.00472e14
push 0
mov edx, esi
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00472742
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc ecx
push ecx
mov ecx, eax
call fcn.00472e14
push 1
pop edi
test al, al
movzx ebx, bl
push edi
mov edx, esi
lea ecx, [ebp - 0x28]
cmovne ebx, edi
call fcn.00472742
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00471e9d
push dword [ebp - 0x28]
call fcn.0042cb3a
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc eax
pop ecx
push eax
push 7
pop ecx
call fcn.00472e14
push dword [ebp - 0x1c]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.0042cb3a
pop ecx
jmp 0x472e04
xor bl, bl
lea ecx, [ebp - 0xd]
call fcn.00472e7b
mov al, bl
call fcn.004678f9
ret

Function at 0x472e14
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
mov esi, edx
call fcn.0047568a
test al, al
je 0x472e6a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x472e6a
push dword [ebp + 8]
push esi
push eax
call fcn.00432c00
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x472e6a
mov dword [ebp - 4], ebx
mov bl, 1
lea ecx, [ebp - 4]
call fcn.0047566d
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4
Function at 0x47396b
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x348]
sub esp, 0x348
push 0xffffffffffffffff
push 0x48e26d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4b3074]
xor eax, ebp
mov dword [ebp + 0x344], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 4], ebx
mov edi, 0x114
mov word [eax], cx
cmp byte [0x4c1d11], cl
jne 0x473a13
lea eax, [ebp + 0x22c]
mov byte [ebp + 0x22c], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x473a0c
cmp eax, edi
jae 0x473a0c
lea edx, [ebp + 0x22c]
mov byte [ebp + 0x340], bl
lea ecx, [ebp - 0x1c]
call fcn.00471664
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00472441
push dword [ebp - 0x1c]
call fcn.0042cb3a
mov al, 1
jmp 0x473aad
xor al, al
jmp 0x473aae
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
je 0x473a0c
cmp esi, edi
jae 0x473a47
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ebp + 0x228], ax
lea eax, [ebp]
push eax
call fcn.004723ab
mov al, 1
jmp 0x473aae
lea ecx, [ebp - 0x1c]
call fcn.00472387
mov dword [ebp - 4], 1
cmp esi, dword [ebp - 0x14]
jbe 0x473a64
push esi
lea ecx, [ebp - 0x1c]
call fcn.00471dd1
mov edi, dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x473aa5
xor eax, eax
mov word [edi + esi*2], ax
mov eax, ebx
cmp word [edi], bx
je 0x473a89
inc eax
cmp word [edi + eax*2], bx
jne 0x473a82
mov dword [ebp - 0x18], eax
cmp eax, ecx
jne 0x473aa5
lea eax, [esi - 1]
cmp eax, ecx
jne 0x473aa5
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.00472441
mov bl, 1
push edi
call fcn.0042cb3a
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x344]
xor ecx, ebp
call fcn.0042cb29
add ebp, 0x348
leave
ret

Function at 0x473adc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.00474988
cmp eax, 0xffffffff
je 0x473b09
mov edx, eax
and dl, 0x11
cmp dl, 1
jne 0x473b09
and eax, 0xfffffffe
mov ecx, esi
mov edx, eax
call fcn.00473e35
test al, al
je 0x473b42
cmp byte [0x4c1d11], 0
jne 0x473b33
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.0047168a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042cb3a
pop ecx
test esi, esi
jmp 0x473b3c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x473b42
mov al, 1
jmp 0x473b44
xor al, al
pop esi
leave
ret
Function at 0x473c8c
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x48e2c8
call fcn.0046791f
mov edi, ecx
cmp byte [0x4c1d11], 0
jne 0x473ccb
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.0047168a
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.0042cb3a
pop ecx
test esi, esi
je 0x473cd9
mov al, 1
jmp 0x473d1f
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x473cc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x473cea
xor al, al
jmp 0x473d1f
lea ecx, [ebp - 0x50]
call fcn.0047456d
lea ecx, [ebp - 0x28]
call fcn.00472387
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0047458e
test al, al
je 0x473d14
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.0042cb3a
pop ecx
mov al, bl
call fcn.004678f9
ret

Function at 0x473d25
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4c1d11], 0
jne 0x473d59
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0047168a
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042cb3a
pop ecx
test esi, esi
pop esi
jmp 0x473d64
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x473d6a
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x473dd7
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4c1d11], 0
jne 0x473e09
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0047168a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042cb3a
pop ecx
test esi, esi
pop esi
jmp 0x473e12
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x473e18
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x473e35
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4c1d11], 0
push esi
mov esi, edx
jne 0x473e69
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.0047168a
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042cb3a
pop ecx
test esi, esi
jmp 0x473e73
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x473e79
mov al, 1
jmp 0x473e7b
xor al, al
pop esi
leave
ret
Function at 0x473edc
Capabilities:
Get disk information

Disassembly:
push 0x30
mov eax, 0x48e32e
call fcn.0046791f
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.00402939
cmp byte [0x4c1d11], 0
jne 0x473fc8
mov ecx, ebx
call fcn.00402939
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x473f20
xor al, al
jmp 0x474091
push edi
call fcn.0042cc59
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x474088
cmp edi, dword [ebp - 0x1c]
ja 0x474088
lea ecx, [ebp - 0x30]
call fcn.00472292
mov byte [ebp - 4], 1
test edi, edi
je 0x473fc1
xor eax, eax
mov dword [ebp - 0x18], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x14], eax
cmp byte [esi + eax - 1], 0
jne 0x473fb2
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.004724a1
mov ebx, dword [ebp - 0x14]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x3c]
call fcn.0047163e
mov edi, eax
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004029e4
mov ecx, dword [ebp - 0x10]
push edi
call fcn.004029a5
mov byte [ebp - 4], 1
push dword [ebp - 0x3c]
call fcn.0042cb3a
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jne 0x473f68
mov edi, dword [ebp - 0x20]
cmp ebx, edi
jmp 0x47407c
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x473f19
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042cc59
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x474088
cmp edi, dword [ebp - 0x20]
ja 0x474088
lea ecx, [ebp - 0x30]
call fcn.00472387
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x1c], edx
mov ecx, ebx
mov dword [ebp - 0x14], ecx
test edi, edi
je 0x47407a
push 2
pop eax
mov dword [ebp - 0x18], eax
cmp word [esi + eax - 2], bx
jne 0x474069
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.004723ab
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x1c], eax
call fcn.004029e4
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
call fcn.004029a5
mov eax, dword [ebp - 0x18]
mov edx, eax
mov ecx, dword [ebp - 0x14]
inc ecx
add eax, 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
cmp ecx, edi
jb 0x474033
mov edx, dword [ebp - 0x1c]
cmp edx, edi
push dword [ebp - 0x30]
sete bl
call fcn.0042cb3a
pop ecx
push esi
call fcn.0042cb3a
mov al, bl
pop ecx
call fcn.004678f9
ret
Function at 0x474988
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4c1d11], 0
jne 0x4749ba
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0047168a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042cb3a
pop ecx
mov eax, esi
pop esi
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret

Function at 0x474dfb
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x474e25
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x474e25
xor al, al
jmp 0x474e39
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x478204
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
cmp esi, 0xffffffff
je 0x4782e4
mov edx, dword [ecx + 0x78]
mov eax, dword [ecx + 0x7c]
lea ecx, [esp + 0x2c]
and dword [esp + 0x34], 0
add eax, dword [edx + esi*4]
mov dword [esp + 0x2c], eax
mov eax, dword [edx + esi*4 + 4]
sub eax, dword [edx + esi*4]
mov dword [esp + 0x30], eax
call fcn.0047a7e1
mov ebx, eax
test ebx, ebx
jmp 0x4782da
lea ecx, [esp + 0x2c]
call fcn.0047a7c9
mov esi, dword [esp + 0x34]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x2c]
movzx ebp, al
movlpd qword [esp + 0x20], xmm0
mov edi, dword [esp + 0x24]
mov byte [esp + 0x3c], al
lea ecx, [esi + ecx]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
and ebp, 0xf
jbe 0x4782af
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movzx eax, byte [esi + ebx]
shld edi, ecx, 8
cdq
shl ecx, 8
or edi, edx
or eax, ecx
inc esi
mov ecx, eax
cmp esi, ebp
jb 0x47828c
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x14]
mov al, byte [esp + 0x3c]
add esi, ebp
mov dword [esp + 0x34], esi
cmp ecx, 0x6f10701
jne 0x4782c1
test edi, edi
je 0x4782f0
test al, 0x20
je 0x4782d7
lea ecx, [esp + 0x2c]
call fcn.0047a7e1
and dword [esp + 0x24], 0
add dword [esp + 0x34], eax
sub ebx, 1
mov dword [esp + 0x14], ebx
jne 0x478247
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov al, 1
jmp 0x4782e6
Function at 0x47c909
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x47c919
mov dword [esi], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47c95f
push edi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], edi
test esi, esi
je 0x47c954
add dword [esi], edx
test eax, eax
jne 0x47c95f
call fcn.0047ce33
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x4866a5
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
mov edx, ecx
cmp edx, 8
je 0x4866e8
cmp edx, 0x52
je 0x4866d7
cmp ecx, 0x76
jne 0x4866e4
mov ecx, esi
call fcn.00485c08
jmp 0x4866ef
test al, al
je 0x4866e4
mov ecx, esi
call fcn.00485e10
jmp 0x4866ef
xor al, al
jmp 0x4866f1
mov ecx, esi
call fcn.00485da5
mov al, 1
pop esi
ret 4
Function at 0x487d3e
Capabilities:
Get file system object information

Disassembly:
push 0x1c8
mov eax, 0x48fe21
call fcn.00467953
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d4]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1b0], eax
call fcn.00472387
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x487dc1
push dword [edi + 0xc]
lea ecx, [ebp - 0x1bc]
push dword [edi + 8]
call fcn.00487cbe
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a8]
call fcn.00487d01
push eax
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 2
call fcn.00472441
push dword [ebp - 0x1a8]
call fcn.0042cb3a
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x1bc]
call fcn.0042cb3a
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1ac], eax
call fcn.004718e0
mov esi, eax
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.00471cfe
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c8]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.004724f3
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.00487f97
lea eax, [ebp - 0x1c8]
mov ecx, ebx
push eax
call fcn.00487f97
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00472413
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.00471a46
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.004719c7
lea ecx, [ebp - 0x19c]
call fcn.00471a46
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x19c]
call fcn.004719c7
lea ecx, [ebp - 0x19c]
call fcn.00471a46
cmp byte [edi + 1], 0
je 0x487ede
mov edx, 0x3f4
lea ecx, [ebp - 0x1a8]
call fcn.00475b7a
push eax
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 6
call fcn.004719c7
mov byte [ebp - 4], 5
push dword [ebp - 0x1a8]
call fcn.0042cb3a
lea ecx, [ebp - 0x19c]
mov dword [esp], 0x4a2874
call fcn.0047197b
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x10]
call fcn.0047590d
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0047197b
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
mov edx, dword [ebp - 0x19c]
mov ecx, eax
call fcn.00476318
mov edx, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1a8]
push 0
call fcn.00472742
push 0x110
push 0x160
lea eax, [ebp - 0x190]
push eax
push 0x80
push dword [ebp - 0x1a8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1a8]
mov esi, eax
call fcn.0042cb3a
pop ecx
test esi, esi
je 0x487f5f
push dword [ebp - 0x1b0]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.0042cb3a
pop ecx
push dword [ebp - 0x1c8]
call fcn.0042cb3a
pop ecx
push dword [ebp - 0x1bc]
call fcn.0042cb3a
pop ecx
push dword [ebp - 0x1d4]
call fcn.0042cb3a
pop ecx
call fcn.0046790e
ret 0xc
Function at 0x488521
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x488554
cmp dword [edx + 8], 0xffffff65
jne 0x488554
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x48858e
sub eax, 0x14
je 0x48855b
dec eax
sub eax, 1
je 0x48858e
xor al, al
pop esi
leave
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x488554
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
jmp 0x488556
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x488554
mov ecx, esi
call fcn.00488431
jmp 0x48858a
Function at 0x48a7db
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x4b3074]
xor eax, esp
mov dword [esp + 0x164], eax
test cl, cl
mov edx, 0x4011
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x90
push 0x4a1b14
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.0042cb29
mov esp, ebp
pop ebp
ret

Function at 0x48a831
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d0
mov eax, dword [0x4b3074]
xor eax, esp
mov dword [esp + 0x2cc], eax
push esi
mov esi, edx
or esi, 0x80
cmp byte [0x4c1d11], 0
push edi
mov edi, dword [ebp + 8]
jne 0x48a894
mov edx, ecx
lea ecx, [esp + 0xc]
call fcn.0047168a
push 0x4010
push 0x160
lea ecx, [esp + 0x20]
push ecx
push esi
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [esp + 0xc]
mov esi, eax
call fcn.0042cb3a
pop ecx
mov eax, esi
jmp 0x48a8a2
push ecx
push ecx
lea eax, [esp + 0x20]
mov edx, esi
push eax
call fcn.0048a7bd
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x2d4]
pop edi
pop esi
xor ecx, esp
call fcn.0042cb29
mov esp, ebp
pop ebp
ret 4

Function at 0x48af8b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x48afb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x48afb7
xor al, al
jmp 0x48afc8
mov ecx, dword [ebp - 4]
xor eax, eax
add eax, edi
mov dword [esi], eax
mov al, 1
adc ecx, 0
mov dword [esi + 4], ecx
pop edi
pop esi
leave
ret
Function at 0x401ae0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55bac3
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x5b9fe4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.00404f68
push 0xc
call fcn.0040415b
add esp, 4
mov dword [ebp - 0xf4], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x401b62
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405aa3
mov esi, eax
jmp 0x401b64
xor esi, esi
push 0x56b8e4
mov dword [ebp - 4], 0xffffffff
call fcn.0040e17e
push 0x59b4c0
mov ecx, edi
call fcn.00411b3e
push 0xd8
lea eax, [ebp - 0xf0]
push 0
push eax
call fcn.005405e0
add esp, 0xc
lea ecx, [ebp - 0xf0]
push 0
push 0x66
call fcn.00418dcd
mov dword [ebp - 4], 1
mov dword [ebp - 0xf0], 0x59b7dc
call fcn.0041964d
call fcn.0041964d
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xf0]
mov dword [ebp - 4], 2
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.004123b5
test esi, esi
je 0x401bf7
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
call fcn.004132c3
lea ecx, [ebp - 0x30]
call fcn.0041707b
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], vtable.CBrush.0
call fcn.004021a0
lea ecx, [ebp - 0xf0]
call fcn.00411e1e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d942
mov esp, ebp
pop ebp
ret