joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6dd0a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6dd26e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [sym.StartupControl.exe___xp_26Acshellctrls_TacRootFolder]
call fcn.004a1734
test eax, eax
jl 0x6dd10d
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.006dc0a0
and eax, 0x7f
mov eax, dword [eax*4 + sym.StartupControl.exe__Acshellctrls_nFolder]
push eax
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x6dd1e8
mov eax, dword [ebx]
test eax, eax
je 0x6dd127
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x6dd127
mov edx, dword [ebx]
mov eax, ebx
call fcn.004c1d4c
test eax, eax
je 0x6dd130
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6dd1e8
lea edx, [ebp - 0x1c]
mov eax, dword [ebx]
call sym.StartupControl.exe__Acntutils_NormalDir_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004c29f8
mov eax, dword [ebx]
test eax, eax
je 0x6dd166
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x6dd166
mov edx, dword [ebx]
mov eax, ebx
call fcn.004c1d4c
test eax, eax
je 0x6dd16f
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x3a
jne 0x6dd185
mov eax, ebx
mov edx, 0x6dd28c
call fcn.004c2e1c
mov eax, dword [ebx]
test eax, eax
je 0x6dd19f
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x6dd19f
mov edx, dword [ebx]
mov eax, ebx
call fcn.004c1d4c
test eax, eax
je 0x6dd1a8
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x20]
mov eax, dword [ebx]
call fcn.004abad8
mov eax, dword [ebp - 0x20]
call fcn.004c3ea8
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x24]
call sym.StartupControl.exe__Acshellctrls_DesktopShellFolder_qqrv
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x6dd226
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
lea edx, [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x6dd29c
call fcn.004ac140
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.004c29f8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4a89e0]
call fcn.004afd94
call fcn.004c1444
mov eax, dword [ebp - 0x10]
call sym.StartupControl.exe__Acshellctrls_CreateRootFromPIDL_qqrp11_ITEMIDLIST
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x6dd243
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], edx
call fcn.004c09bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6dd275
lea eax, [ebp - 0x24]
call fcn.004c4fac
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004c29f0
lea eax, [ebp - 4]
call fcn.004c29e8
ret
Function at 0x6ddfe0
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.004c0234
mov dword [esp], 0x3c
mov eax, dword [0x7b9688]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.SHELL32.DLL_ShellExecuteExW
add esp, 0x3c
pop ebx
ret

Function at 0x6de898
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6de984
push dword fs:[eax]
mov dword fs:[eax], esp
test cl, cl
je 0x6de96e
mov eax, ebx
call fcn.00549a1c
test eax, eax
je 0x6de96e
mov edx, 0x6de9a0
mov eax, esi
call fcn.004aa394
test al, al
je 0x6de92b
mov eax, ebx
call fcn.00549a1c
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_PathName_qqrv
mov eax, dword [ebp - 8]
call fcn.004ab478
test al, al
jne 0x6de96e
mov eax, ebx
call fcn.00549a1c
xor edx, edx
call fcn.00546a70
mov eax, ebx
call fcn.00549a1c
call fcn.00547a8c
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], edx
call fcn.004c09bc
jmp 0x6de96e
mov edx, 0x6de9bc
mov eax, esi
call fcn.004aa394
test al, al
je 0x6de94d
mov eax, ebx
call fcn.00549a1c
mov edx, eax
mov eax, ebx
call sym.StartupControl.exe__Acshellctrls_TacCustomShellTreeView_Refresh_qqrp18Comctrls_TTreeNode
jmp 0x6de96e
mov edx, 0x6de9d4
mov eax, esi
call fcn.004aa394
test al, al
je 0x6de96e
mov eax, dword [ebx + 0x3c0]
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6de98b
lea eax, [ebp - 8]
call fcn.004c29e8
ret
Function at 0x6de9e0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x210], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6deae7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6deb04
mov eax, esi
call fcn.004aa394
test al, al
je 0x6dea43
mov eax, ebx
call fcn.00549a1c
test eax, eax
je 0x6dea43
mov eax, ebx
call fcn.00549a1c
call fcn.0054795c
mov byte [edi], 1
jmp 0x6deac9
mov edx, 0x6deb20
mov eax, esi
call fcn.004aa394
test al, al
je 0x6deac9
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryW
lea edx, [ebp - 0x210]
lea eax, [ebp - 0x20a]
call fcn.004abfd8
mov edx, dword [ebp - 0x210]
lea eax, [ebx + 0x3c0]
call fcn.004c29f8
mov eax, ebx
call fcn.00549a1c
mov eax, dword [eax + 0xc]
lea edx, [ebp - 0x218]
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_PathName_qqrv
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004ab9a8
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 0x20a]
call fcn.004abd20
lea eax, [ebp - 0x20a]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6deaee
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.004c29f0
ret
Function at 0x6df1c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6df2e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov eax, dword [ebx + 0xc]
mov dword [ebp - 8], eax
test byte [esi + 0x1c], 0x10
je 0x6df205
mov eax, ebx
call fcn.00547908
test eax, eax
jg 0x6df2c7
cmp word [esi + 0x36a], 0
je 0x6df223
lea eax, [ebp - 1]
push eax
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x36c]
call dword [esi + 0x368]
cmp byte [ebp - 1], 0
je 0x6df2b4
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 8]
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_IsFolder_qqrx20System_UnicodeStringo
test al, al
je 0x6df25e
mov eax, ebx
call fcn.00547100
test al, al
je 0x6df25e
mov eax, ebx
call fcn.0054753c
test eax, eax
jne 0x6df25e
mov edx, ebx
mov eax, esi
call sym.StartupControl.exe__Acshellctrls_TacCustomShellTreeView_PopulateNode_qqrp18Comctrls_TTreeNode
jmp 0x6df2b4
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 8]
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_IsFolder_qqrx20System_UnicodeStringo
test al, al
jne 0x6df2b4
push 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_PathName_qqrv
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004ab9a8
mov eax, dword [ebp - 0xc]
call fcn.004c2a84
push eax
push 0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_PathName_qqrv
mov eax, dword [ebp - 0x14]
call fcn.004c2a84
push eax
push 0
mov eax, esi
call fcn.005333f8
push eax
call sub.SHELL32.DLL_ShellExecuteW
mov eax, ebx
call fcn.0054753c
test eax, eax
setg dl
mov eax, ebx
call fcn.00547170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6df2e9
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004c29f0
ret
Function at 0x6e0c60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x20]
xor eax, eax
push ebp
push 0x6e0cfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x400]
xor edx, edx
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Acshellctrls_TacCustomShellComboBox_AddItems_qqrip27Acshellctrls_TacShellFolder
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
mov edx, 0x6e0d18
call fcn.004c31ac
jne 0x6e0ce2
lea eax, [ebp - 8]
push eax
push 0x11
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Acshellctrls_TacCustomShellComboBox_IndexFromID_qqrp11_ITEMIDLIST
mov ebx, eax
test ebx, ebx
jl 0x6e0ce2
mov edx, ebx
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Acshellctrls_TacCustomShellComboBox_GetFolder_qqri
mov ecx, eax
mov edx, ebx
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Acshellctrls_TacCustomShellComboBox_AddItems_qqrip27Acshellctrls_TacShellFolder
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e0d05
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x24]
ret
Function at 0x6e22cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6e23c0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x4a3], 0
je 0x6e239e
mov eax, ebx
call fcn.005524a0
test eax, eax
je 0x6e239e
mov eax, ebx
call fcn.005524a0
call fcn.0054dd18
mov edx, eax
mov eax, ebx
call sym.StartupControl.exe__Acshellctrls_TacCustomShellListView_GetFolder_qqri
mov esi, eax
mov eax, ebx
call fcn.005524a0
call fcn.0054dd18
mov edx, eax
mov eax, ebx
call sym.StartupControl.exe__Acshellctrls_TacCustomShellListView_GetFolder_qqri
lea ecx, [ebp - 4]
mov dl, 1
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_DisplayName_qqr29Acshellctrls_TacShowExtension
mov edx, dword [ebp - 4]
movzx ecx, byte [sym.StartupControl.exe__Acshellctrls_DoOpenZipFile]
mov eax, esi
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_IsFolder_qqrx20System_UnicodeStringo
test al, al
je 0x6e235a
mov edx, dword [esi + 8]
mov eax, ebx
call sym.StartupControl.exe__Acshellctrls_TacCustomShellListView_SetPathFromID_qqrp11_ITEMIDLIST
jmp 0x6e239e
push 5
lea edx, [ebp - 0xc]
mov eax, esi
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_PathName_qqrv
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004ab9a8
mov eax, dword [ebp - 8]
call fcn.004c2a84
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, esi
call sym.StartupControl.exe__Acshellctrls_TacShellFolder_PathName_qqrv
mov eax, dword [ebp - 0x10]
call fcn.004c2a84
push eax
push 0
mov eax, ebx
call fcn.005333f8
push eax
call sub.SHELL32.DLL_ShellExecuteW
mov eax, ebx
call fcn.0052c744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e23c7
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004c29f0
ret
Function at 0x6e485c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6e4996
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x388]
mov dl, 1
mov eax, dword [sym.StartupControl.exe__Sspeedbutton_TsSpeedButton_]
call sym.StartupControl.exe__Sspeedbutton_TsSpeedButton__bctr_qqrp18Classes_TComponent
mov esi, eax
mov dl, 2
mov eax, esi
call fcn.004ca2dc
mov edx, 0xa
mov eax, esi
call fcn.004ca2f4
mov dl, 1
mov eax, esi
call fcn.004ca2b0
lea eax, [ebp - 4]
push eax
movzx eax, bl
mov edx, dword [sym.StartupControl.exe__Acshellctrls_nFolder]
mov eax, dword [edx + eax*4]
push eax
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call sym.StartupControl.exe__Acshellctrls_DesktopShellFolder_qqrv
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 4]
call sym.StartupControl.exe__Acshellctrls_GetDisplayName_qqr40System__DelphiInterface_t12IShellFolder_p11_ITEMIDLISTui29Acshellctrls_Ta
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0052aa64
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Acshellctrls_CreateRootFromPIDL_qqrp11_ITEMIDLIST
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
xor ecx, ecx
xor edx, edx
call sym.StartupControl.exe__Acshellctrls_GetShellImage_qqrp11_ITEMIDLISToo
mov ecx, eax
mov edx, 1
mov eax, esi
call sym.StartupControl.exe__Sspeedbutton_TsSpeedButton_SetInteger_qqrxixi
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], edx
call fcn.004c09bc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x38c]
mov eax, esi
call sym.StartupControl.exe__Sspeedbutton_TsSpeedButton_SetImages_qqrpx24Imglist_TCustomImageList
movzx eax, bl
mov dword [esi + 0xc], eax
mov dl, 1
mov eax, esi
call fcn.00529cfc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [esi + 0x114], eax
mov dword [esi + 0x110], sym.StartupControl.exe__Acpathdialog_TPathDialogForm_BtnOnClick_qqrp14System_TObject
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x388]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, esi
call fcn.006e4668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e499d
lea eax, [ebp - 0x10]
call fcn.004c4fac
lea eax, [ebp - 0xc]
call fcn.004c29e8
ret
Function at 0x6e49a4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
mov edx, 0xff00000c
call fcn.0052abe4
cmp dword [0x7b2584], 0
je 0x6e49db
mov eax, dword [0x7b2584]
push eax
call sub.COMCTL32.DLL_ImageList_GetImageCount
test eax, eax
jne 0x6e4a00
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x20000
push 0x6e4a94
call sub.SHELL32.DLL_SHGetFileInfoW
mov dword [0x7b2584], eax
cmp dword [0x7b2584], 0
je 0x6e4a6a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38c]
call sym.StartupControl.exe__Acalphaimagelist_TsAlphaImageList_AcBeginUpdate_qqrv
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38c]
mov edx, dword [0x7b2584]
call fcn.004ce504
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38c]
mov byte [eax + 0xb4], 1
mov byte [eax + 0x9b], 0
mov edx, 0x1fffffff
call sym.StartupControl.exe__Acalphaimagelist_TsAlphaImageList_SetBkColor_qqrx15Graphics_TColor
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38c]
call sym.StartupControl.exe__Acalphaimagelist_TsAlphaImageList_UpdateFromStd_qqrv
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38c]
mov dl, 1
call sym.StartupControl.exe__Acalphaimagelist_TsAlphaImageList_AcEndUpdate_qqro
push ebp
xor eax, eax
call fcn.006e485c
pop ecx
push ebp
mov al, 1
call fcn.006e485c
pop ecx
push ebp
mov al, 0xe
call fcn.006e485c
pop ecx
push ebp
mov al, 2
call fcn.006e485c
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x6f64a0
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
cmp dword [esp + 4], 6
jae 0x6f64be
xor eax, eax
jmp 0x6f64c0
mov al, 1
add esp, 0x114
ret

Function at 0x6fcf30
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
push 0
push ebx
call sub.USER32.DLL_MapVirtualKeyW
shl eax, 0x10
sub ebx, 8
je 0x6fcf5e
sub ebx, 5
je 0x6fcf5e
add ebx, 0xfffffffd
sub ebx, 3
jb 0x6fcf5e
or eax, 0x1000000
push 0xff
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextW
mov edx, esi
mov eax, esp
call fcn.004abfd8
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x7072e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x7072fd
test al, 0x10
jne 0x707301
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x707308
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd20
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.004c29e0
xor eax, eax
push ebp
push 0x70751e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.004c02d0
mov esi, eax
lea eax, [ebp - 0x2d0]
xor ecx, ecx
mov edx, 0x2b4
call fcn.004c0234
cmp dword [ebp + 0x20], 0
je 0x7073c3
cmp dword [ebp - 0x10], 0
je 0x7073c3
mov eax, dword [ebp + 0x20]
call fcn.004ab478
test al, al
jne 0x707379
mov eax, dword [ebp + 0x20]
call fcn.007072e4
test al, al
je 0x70739c
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.004c2a84
push eax
call sub.SHELL32.DLL_SHGetFileInfoW
jmp 0x7073bd
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.004c2a84
push eax
call sub.SHELL32.DLL_SHGetFileInfoW
mov esi, dword [ebp - 0x2cc]
cmp byte [ebp + 0x1c], 0
je 0x7073ea
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x707530
call sub.SHELL32.DLL_SHGetFileInfoW
mov edi, eax
jmp 0x707409
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x707530
call sub.SHELL32.DLL_SHGetFileInfoW
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.COMCTL32.DLL_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.004a7b6c
test bl, bl
je 0x707449
cmp byte [ebp + 0x14], 0
jne 0x707449
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004fdd24
push eax
push esi
push edi
call sub.COMCTL32.DLL_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x707508
mov dl, 1
mov eax, dword [0x4fb01c]
call fcn.00502454
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x707501
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
call fcn.00502d6c
call fcn.004fdd24
push eax
push esi
push edi
call sub.COMCTL32.DLL_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2dc], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.004c0080
add eax, dword [ebp - 8]
mov dword [ebp - 0x2d8], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.004c0080
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x2e0]
mov eax, dword [ebp - 4]
call fcn.00707208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x707508
mov eax, dword [ebp - 0x1c]
call fcn.004c09bc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x707525
lea eax, [ebp + 0x20]
call fcn.004c29e8
ret
Function at 0x70dddc
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
cmp dword [esp + 4], 5
ja 0x70de08
cmp dword [esp + 4], 5
jne 0x70de04
cmp dword [esp + 8], 1
jae 0x70de08
xor eax, eax
jmp 0x70de0a
mov al, 1
add esp, 0x114
ret

Function at 0x70e58c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x70e59f
add esp, 0xfffffff0
call fcn.004c0ea0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00519d64
mov eax, dword [0x70e7cc]
not eax
and eax, dword [ebx + 0x50]
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x703824]
call fcn.00703b40
mov dword [ebx + 0x284], eax
mov dl, 1
mov eax, dword [0x7045b8]
call fcn.00717d88
mov esi, eax
mov dword [ebx + 0x28c], esi
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], 0x717744
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], 0x7177ac
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], 0x7177a0
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x88], 0x717768
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x78], 0x7142c8
mov eax, dword [ebx + 0x284]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x70e580
mov dword [ebx + 0x294], 0xff0000
mov dword [ebx + 0x2f4], 0x1fffffff
mov dword [ebx + 0x2f8], 0x1fffffff
mov dword [ebx + 0x300], 0x808080
mov dword [ebx + 0x2fc], 2
mov ecx, ebx
mov dl, 1
mov eax, dword [0x70426c]
call fcn.00718188
mov dword [ebx + 0x328], eax
mov dl, 1
mov eax, dword [0x702214]
call fcn.004c098c
mov dword [ebx + 0x360], eax
mov dl, 1
mov eax, ebx
call fcn.00531e98
mov dl, 1
mov eax, dword [0x4fb01c]
call fcn.00502454
mov dword [ebx + 0x368], eax
mov byte [ebx + 0x36e], 0
mov dword [ebx + 0x378], 0x14
mov dword [ebx + 0x380], 0x808080
mov byte [ebx + 0x398], 1
mov dword [ebx + 0x3b8], 0xffffffff
mov dword [ebx + 0x3bc], 0xffffffff
mov byte [ebx + 0x3e8], 0
call sub.KERNEL32.DLL_GetVersion
mov esi, eax
mov eax, esi
movzx edi, al
mov eax, esi
call fcn.0048c4a8
movzx eax, al
cmp edi, 5
ja 0x70e701
cmp edi, 5
jne 0x70e6fd
cmp eax, 1
jae 0x70e701
xor eax, eax
jmp 0x70e703
mov al, 1
mov byte [ebx + 0x36c], al
mov ecx, ebx
mov dl, 1
mov eax, dword [0x704dc0]
call fcn.00719070
mov dword [ebx + 0x384], eax
mov byte [ebx + 0x388], 1
mov byte [ebx + 0x389], 1
mov eax, dword [ebx + 0x6c]
mov dword [ebx + 0x298], eax
mov dword [ebx + 0x38c], 0x1fffffff
mov dword [ebx + 0x3e0], 0x1fffffff
mov dword [ebx + 0x3e4], 0x1fffffff
mov dl, 1
mov eax, dword [0x704b64]
call fcn.0071b970
mov esi, eax
mov dword [ebx + 0x3dc], esi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], 0x7142bc
mov dl, 1
mov eax, dword [0x492478]
call fcn.004c098c
mov dword [ebx + 0x3ec], eax
mov byte [ebx + 0x306], 1
mov dword [ebx + 0x3f0], 0xffffffff
mov edx, 0x12c
mov eax, ebx
call fcn.00714990
mov edx, 0xc8
mov eax, ebx
call fcn.00714954
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x70e7c2
call fcn.004c0ef8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret