joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437757
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0xed
push str.filecore.cpp
mov eax, dword [ebp - 8]
push eax
call fcn.00439e70
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x437793
push 0xee
push str.filecore.cpp
call fcn.0047b040
test eax, eax
je 0x437793
int3
xor edx, edx
test edx, edx
jne 0x437776
cmp dword [ebp + 0xc], 0
jne 0x4377a4
jmp 0x437845
cmp dword [ebp + 8], 0
jne 0x4377be
push 0xf3
push str.filecore.cpp
call fcn.0047b040
test eax, eax
je 0x4377be
int3
xor eax, eax
test eax, eax
jne 0x4377a4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041cf66
test eax, eax
jne 0x4377eb
push 0xf4
push str.filecore.cpp
call fcn.0047b040
test eax, eax
je 0x4377eb
int3
xor eax, eax
test eax, eax
jne 0x4377c4
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x437828
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0047766a
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043a570
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x437845
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0047766a
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0043a750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x437f8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push str.CLSID
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x438062
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x438058
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push str.InProcServer32
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x43804e
push 0x104
mov ecx, dword [ebp + 0xc]
call fcn.00436808
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x4af7bc
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00436943
xor ecx, ecx
cmp dword [ebp - 0x18], 0
sete cl
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x43806b
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x178], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push 0x800
push 0x160
lea ecx, [ebp - 0x174]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x4380cc
mov eax, dword [ebp - 0x16c]
and eax, 0x10000
test eax, eax
jne 0x4380d3
xor eax, eax
jmp 0x438203
lea ecx, [ebp - 0x14]
push ecx
push 0x494cf0
push 0
push 0x494d00
lea ecx, [ebp - 4]
call fcn.00437d07
test eax, eax
jge 0x4380f6
xor eax, eax
jmp 0x438203
lea edx, [ebp - 0x10]
push edx
push 0x49b938
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx]
test eax, eax
jl 0x4381f5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x438130
mov dword [ebp - 0x180], 0
jmp 0x43817e
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
shl eax, 1
add eax, 3
and al, 0xfc
call fcn.004051e0
mov dword [ebp - 0x184], esp
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
call fcn.004021a0
mov dword [ebp - 0x180], eax
push 0
mov edx, dword [ebp - 0x180]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 0x14]
test eax, eax
jl 0x4381e9
push 2
mov ecx, dword [ebp + 8]
call fcn.0047bb3c
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 0x4c]
test eax, eax
jl 0x4381e9
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
mov eax, 1
jmp 0x438203
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax + 8]
xor eax, eax
lea esp, [ebp - 0x184]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43820f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4910bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
push 1
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0041cf66
test eax, eax
jne 0x438258
push 0x216
push str.filecore.cpp
call fcn.0047b040
test eax, eax
je 0x438258
int3
xor ecx, ecx
test ecx, ecx
jne 0x438230
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x4382ae
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x438294
mov ecx, dword [ebp + 0xc]
push ecx
push str.Warning:_could_not_parse_the_path__s._n
call fcn.0041ce35
add esp, 8
push 0x104
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x4383a1
lea ecx, [ebp - 0x1c]
call fcn.004775c7
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004383b4
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.0047766a
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x438326
lea ecx, [ebp - 0x1c]
call fcn.0047766a
push eax
push str.Warning:_could_not_get_volume_information__s._n
call fcn.0041ce35
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0043605c
mov eax, dword [ebp - 0x164]
jmp 0x4383a1
mov edx, dword [ebp - 0x18]
and edx, 2
test edx, edx
jne 0x43833a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov ecx, dword [ebp - 0x18]
and ecx, 4
test ecx, ecx
jne 0x438382
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x438382
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x168], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0043605c
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43b40d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call fcn.00482042
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43b466
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x43b480
push 0xeb
push str.dlgcore.cpp
call fcn.0047b040
test eax, eax
je 0x43b480
int3
xor edx, edx
test edx, edx
jne 0x43b466
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0043b4db
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004022a0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43c22e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x44]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x40], 0
je 0x43c281
call fcn.00482042
mov dword [ebp - 0x10], eax
push 5
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x40]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c294
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
cmp dword [ebp - 0xc], 0
je 0x43c328
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x43c2df
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0x12]
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x14]
mov word [ebp - 0x1c], dx
jmp 0x43c2f5
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0xa]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0xc]
mov word [ebp - 0x1c], ax
mov ecx, dword [ebp - 0x20]
and ecx, 0x1801
test ecx, ecx
jne 0x43c31b
movsx edx, word [ebp - 0x18]
test edx, edx
jne 0x43c31b
movsx eax, word [ebp - 0x1c]
test eax, eax
jne 0x43c31b
mov dword [ebp - 0x28], 1
jmp 0x43c322
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
jne 0x43c33a
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x44], 0
je 0x43c343
mov ecx, dword [ebp - 4]
push ecx
call fcn.004022a0
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x40], 0
je 0x43c356
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x43c4ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x43c512
push 0x33c
push str.dlgcore.cpp
call fcn.0047b040
test eax, eax
je 0x43c512
int3
xor eax, eax
test eax, eax
jne 0x43c4f8
call fcn.00482042
mov dword [ebp - 8], eax
push 5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43c57e
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x43c560
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Cannot_find_dialog_template_named__s._n
call fcn.0041ce35
add esp, 8
jmp 0x43c577
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Cannot_find_dialog_template_with_IDD_0x_04X._n
call fcn.0041ce35
add esp, 8
xor eax, eax
jmp 0x43c6a8
cmp dword [ebp + 0xc], 0
jne 0x43c58e
mov eax, 1
jmp 0x43c6a8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43c5c1
push str.Warning:_LoadResource_failed_for_dialog_template._n
push 0x4a7898
call fcn.0041ce35
add esp, 8
mov eax, 1
jmp 0x43c6a8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 2]
cmp ecx, 0xffff
jne 0x43c5ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
jmp 0x43c5f2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004022a0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0x14]
and edx, 0x10000000
test edx, edx
je 0x43c654
mov eax, dword [ebp + 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x43c639
mov ecx, dword [ebp + 8]
push ecx
push str.ERROR:_Dialog_named__s_must_be_invisible._n
call fcn.0041ce35
add esp, 8
jmp 0x43c650
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
push str.ERROR:_Dialog_with_IDD_0x_04X_must_be_invisible._n
call fcn.0041ce35
add esp, 8
xor eax, eax
jmp 0x43c6a8
mov eax, dword [ebp - 0x14]
and eax, 0x40000000
test eax, eax
jne 0x43c6a3
mov ecx, dword [ebp + 8]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
test ecx, ecx
je 0x43c689
mov edx, dword [ebp + 8]
push edx
push str.ERROR:_Dialog_named__s_must_have_the_child_style._n
call fcn.0041ce35
add esp, 8
jmp 0x43c69f
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
push str.ERROR:_Dialog_with_IDD_0x_04X_must_have_the_child_style._n
call fcn.0041ce35
add esp, 8
xor eax, eax
jmp 0x43c6a8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e681
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x43e6b2
push 0x43d
push str.wincore.cpp
call fcn.0047b040
test eax, eax
je 0x43e6b2
int3
xor edx, edx
test edx, edx
jne 0x43e68d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
jne 0x43e6fe
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004369b7
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.00436943
jmp 0x43e716
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x38]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x38]
mov eax, dword [edx]
call dword [eax + 0x90]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x441f70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x441ffc
call fcn.00482042
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x441ffc
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x441fcf
xor eax, eax
jmp 0x44202d
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x441ff6
push 0xcc5
push str.wincore.cpp
call fcn.0047b040
test eax, eax
je 0x441ff6
int3
xor edx, edx
test edx, edx
jne 0x441fdc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00442036
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x44202a
cmp dword [ebp - 8], 0
je 0x44202a
mov ecx, dword [ebp - 8]
push ecx
call fcn.004022a0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4456b9
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
push 0x5e
push str.filest.cpp
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00439e70
push 0x118
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404780
add esp, 0xc
push 0x104
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.0047766a
push eax
mov edx, dword [ebp + 8]
add edx, 0x12
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0xffffffff
je 0x445841
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x445734
xor eax, eax
jmp 0x445846
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0xffffffff
jne 0x445759
xor eax, eax
jmp 0x445846
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.0047764c
test eax, eax
je 0x445771
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x10], 0
jmp 0x4457ba
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.0047766a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x445795
mov edx, dword [ebp + 8]
mov byte [edx + 0x10], 0
jmp 0x4457ba
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x1c]
mov byte [eax + 0x10], cl
mov edx, dword [ebp - 0x1c]
and dl, 0
test edx, edx
je 0x4457ba
push str.Warning:_CFile::GetStatus___returns_m_attribute_without_high_order_flags._n
push 0x4a9a24
call fcn.0041ce35
add esp, 8
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041d2ff
push eax
mov ecx, dword [ebp + 8]
call fcn.00477d58
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
call fcn.0041d2ff
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00477d58
push 0xffffffffffffffff
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x28]
call fcn.0041d2ff
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00477d58
mov ecx, dword [ebp + 8]
call fcn.00477d8a
test eax, eax
jne 0x445820
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00477d58
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00477d8a
test eax, eax
jne 0x445841
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00477d58
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x446f35
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x446fa0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x70
jne 0x446fa0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and eax, 0x4000
test eax, eax
jne 0x446fa0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x446fa0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x446fa0
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x446fa0
mov dword [ebp - 4], 1
jmp 0x446fa7
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x451900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
cmp dword [0x4af948], 0
je 0x45191c
mov eax, dword [0x4b1758]
jmp 0x451a60
mov dword [0x4af948], 1
xor eax, eax
mov ax, word [0x4b1754]
test eax, eax
jne 0x45195f
push str.MSH_SCROLL_LINES_MSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4b1750], eax
cmp dword [0x4b1750], 0
jne 0x451956
mov word [0x4b1754], 1
jmp 0x45195f
mov word [0x4b1754], 2
xor ecx, ecx
mov cx, word [0x4b1754]
cmp ecx, 2
jne 0x4519ba
mov dword [ebp - 4], 0
push str.Magellan_MSWHEEL
push str.MouseZ
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4519ba
cmp dword [0x4b1750], 0
je 0x4519ba
push 0
push 0
mov edx, dword [0x4b1750]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x4b1758], eax
mov eax, dword [0x4b1758]
jmp 0x451a60
mov dword [0x4b1758], 3
cmp dword [0x4b1474], 0
jne 0x451a41
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x451a3f
mov dword [ebp - 0x90], 0x80
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x8c]
push ecx
push 0
push str.WheelScrollLines
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x451a35
push 0xa
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.0040c0b0
add esp, 0xc
mov dword [0x4b1758], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x451a5b
cmp dword [0x4b1470], 0
jne 0x451a5b
push 0
push 0x4b1758
push 0
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [0x4b1758]
mov esp, ebp
pop ebp
ret

Function at 0x454f10
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.0047766a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x454f66
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x454f64
push str.Warning:_File_save_with_new_name_failed._n
push 0x4ac280
call fcn.0041ce35
add esp, 8
xor eax, eax
jmp 0x454fa1
jmp 0x454f9c
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.0047766a
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x454f9c
push str.Warning:_File_save_failed._n
push 0x4ac2a0
call fcn.0041ce35
add esp, 8
xor eax, eax
jmp 0x454fa1
mov eax, 1
mov esp, ebp
pop ebp
ret