joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424898
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffefc
mov edi, eax
xor ebx, ebx
cmp byte [edi + 0x70], 0
jne 0x424a16
cmp dword [edi + 0x40], 0
jne 0x424a16
cmp byte [edi + 0x76], 0
je 0x424a16
fild qword [edi + 0xc]
fcomp dword [0x424a24]
fnstsw ax
sahf
ja 0x424a16
cmp dword [edi + 0x78], 0
je 0x4248e2
mov bl, 1
jmp 0x424a16
fild qword [edi + 0xc]
call fcn.004028a0
add eax, 0x400
mov dword [edi + 0x7c], eax
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
push 4
push 0x1000
mov eax, dword [edi + 0x7c]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
test esi, esi
jne 0x42494d
fild dword [edi + 0x7c]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.00412abc
mov edx, eax
mov ax, 0xb
call fcn.0040de10
jmp 0x424a16
mov eax, dword [0x48d318]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov eax, edi
call fcn.00428760
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
fild qword [edi + 0xc]
call fcn.004028a0
push eax
mov edx, dword [0x48d318]
mov eax, edi
mov ecx, esi
call fcn.004254a8
mov dword [esp + 0x100], eax
fild dword [esp + 0x100]
fild qword [edi + 0xc]
fcompp
fnstsw ax
sahf
jbe 0x4249cc
mov eax, edi
call fcn.00428820
push 0x4000
mov eax, dword [edi + 0x7c]
push eax
push esi
call sub.kernel32.dll_VirtualFree_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
jmp 0x424a16
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, edi
call fcn.00428820
mov dword [edi + 0x78], esi
mov ax, word [edi + 0x72]
call fcn.00412944
mov edx, eax
mov eax, esp
call fcn.00405c48
cmp byte [edi + 0x80], 0
je 0x424a10
push esp
call sub.kernel32.dll_DeleteFileA_1
mov byte [edi + 0x80], 0
mov byte [edi + 0x76], 3
mov bl, 1
mov eax, ebx
add esp, 0x104
pop edi
pop esi
pop ebx
ret
Function at 0x42bc98
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov byte [esp], dl
mov esi, eax
mov ebp, dword [0x48d830]
mov eax, 0x1388
call fcn.004024e8
mov edi, eax
cmp byte [esp], 0
jne 0x42bcf5
push 0xff
mov eax, dword [0x48da44]
push eax
mov eax, dword [esi + 0x48]
push eax
call sub.user32.dll_GetWindowTextA
xor ebx, ebx
inc ebx
xor ecx, ecx
mov cl, bl
dec ecx
mov edx, ebp
mov eax, dword [esi + 0x48]
call fcn.0042bbe8
push ebp
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x42bcd2
mov byte [esp], bl
mov bl, 1
push 0x1388
push edi
push 0x42bdb8
push 0
push 0x42bdbc
call sub.kernel32.dll_GetProfileStringA
mov esi, edi
jmp 0x42bd96
cmp bl, byte [esp]
jne 0x42bd8b
push 0xff
push ebp
push 0x42bdb8
push esi
push 0x42bdbc
call sub.kernel32.dll_GetProfileStringA
mov eax, dword [0x48d364]
mov edx, esi
call fcn.00405c48
mov dword [esp + 4], ebp
lea eax, [esp + 4]
call fcn.0042b970
mov edx, eax
mov eax, dword [0x48d364]
add eax, 0x81
call fcn.00405c48
push 0x42bdc4
mov eax, dword [0x48d364]
add eax, 0x81
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 4]
call fcn.0042b970
mov edx, eax
mov eax, dword [0x48d364]
add eax, 0x8e
call fcn.00405c48
jmp 0x42bd9f
inc ebx
mov eax, esi
call fcn.00405bdc
inc eax
add esi, eax
cmp byte [esi], 0
jne 0x42bd15
cmp byte [esi], 0
setne bl
mov eax, edi
call fcn.00402508
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42bf6c
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xfffffe00
call sub.user32.dll_GetFocus
mov ebx, eax
mov eax, dword [0x48d550]
movzx eax, byte [eax + 0x188c]
mov edx, dword [0x48dba0]
mov edx, dword [edx + eax*4]
mov eax, esp
call fcn.00405c48
mov eax, esp
call fcn.00405bdc
mov byte [esp + eax - 4], 0
mov edx, esp
lea eax, [esp + 0x100]
call fcn.00405c48
lea eax, [esp + 0x100]
xor edx, edx
call fcn.00412714
lea eax, [esp + 0x100]
call fcn.00412584
test al, al
je 0x42bfdf
mov eax, esp
xor edx, edx
call fcn.00411180
test al, al
je 0x42c07f
push 0
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll__lcreat
cmp eax, 0xffffffff
jne 0x42c005
lea edx, [esp + 0x100]
mov ax, 3
call fcn.0040de10
jmp 0x42c07f
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
push 0x42c088
lea eax, [esp + 0x108]
push eax
mov eax, dword [0x48d550]
add eax, 0x500
push eax
push 0
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x42c052
test eax, eax
jbe 0x42c052
mov edx, dword [0x48d550]
add edx, 0x500
mov ax, 7
call fcn.0040de10
mov eax, esp
push eax
push 0
push 0x180
push ebx
call sub.user32.dll_SendMessageA
mov edx, dword [0x48d498]
mov dword [edx], eax
push 0
mov eax, dword [0x48d498]
mov eax, dword [eax]
push eax
push 0x186
push ebx
call sub.user32.dll_SendMessageA
add esp, 0x200
pop ebx
ret
Function at 0x42c08c
Capabilities:
Create process on windows

Disassembly:
add esp, 0xffffff00
call sub.user32.dll_GetFocus
mov edx, esp
call fcn.0042bc60
cmp ax, 0xffff
je 0x42c11d
mov eax, esp
xor edx, edx
call fcn.00412714
mov edx, 0x42c124
mov eax, dword [0x48da44]
call fcn.00405c48
push esp
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 0x42c124
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 1
push 0x42c128
mov eax, dword [0x48da44]
push eax
mov eax, dword [0x48d550]
add eax, 0x500
push eax
push 0
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x42c11d
test eax, eax
jbe 0x42c11d
mov edx, dword [0x48d550]
add edx, 0x500
mov ax, 7
call fcn.0040de10
add esp, 0x100
ret

Function at 0x42c12c
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xffffff00
call sub.user32.dll_GetFocus
mov ebx, eax
mov edx, esp
mov eax, ebx
call fcn.0042bc60
cmp ax, 0xffff
je 0x42c1eb
cmp ebx, dword [0x49ba74]
jne 0x42c167
mov ax, 0x2c7
call fcn.0040bc04
mov edx, esp
call fcn.0040f5a0
jmp 0x42c177
mov ax, 0x2c8
call fcn.0040bc04
mov edx, esp
call fcn.0040f5a0
mov eax, dword [0x48da44]
mov edx, 0x66
call fcn.00411d74
cmp al, 1
jne 0x42c1e5
cmp ebx, dword [0x49ba74]
sete dl
mov eax, esp
call fcn.00412714
push esp
call sub.kernel32.dll_DeleteFileA_1
test eax, eax
je 0x42c1e5
push 0
push 0
push 0x188
push ebx
call sub.user32.dll_SendMessageA
mov edx, dword [0x48d498]
mov dword [edx], eax
push 0
mov eax, dword [0x48d498]
mov eax, dword [eax]
push eax
push 0x182
push ebx
call sub.user32.dll_SendMessageA
push 0
mov eax, dword [0x48d498]
mov eax, dword [eax]
push eax
push 0x186
push ebx
call sub.user32.dll_SendMessageA
push ebx
call sub.user32.dll_SetFocus
add esp, 0x100
pop ebx
ret
Function at 0x42c1f4
Capabilities:
Move file

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
call sub.user32.dll_GetFocus
mov esi, eax
mov edx, esp
mov eax, esi
call fcn.0042bc60
cmp ax, 0xffff
je 0x42c30c
mov eax, esp
call fcn.00405e78
mov dword [0x49baec], eax
cmp esi, dword [0x49ba74]
jne 0x42c22e
mov bl, 0x49
jmp 0x42c230
mov bl, 0x4a
mov edx, ebx
mov ax, 0x1f
call fcn.0042d52c
test eax, eax
je 0x42c30c
lea eax, [esp + 0x100]
mov edx, dword [0x49baec]
call fcn.00405c48
cmp esi, dword [0x49ba74]
sete dl
mov eax, esp
call fcn.00412714
cmp esi, dword [0x49ba74]
sete dl
lea eax, [esp + 0x100]
call fcn.00412714
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
je 0x42c2ec
push 0
push 0
push 0x188
push esi
call sub.user32.dll_SendMessageA
mov edx, dword [0x48d498]
mov dword [edx], eax
push 0
mov eax, dword [0x48d498]
mov eax, dword [eax]
push eax
push 0x182
push esi
call sub.user32.dll_SendMessageA
mov eax, dword [0x49baec]
push eax
mov eax, dword [0x48d498]
mov eax, dword [eax]
push eax
push 0x181
push esi
call sub.user32.dll_SendMessageA
push 0
mov eax, dword [0x48d498]
mov eax, dword [eax]
push eax
push 0x186
push esi
call sub.user32.dll_SendMessageA
jmp 0x42c2fc
lea edx, [esp + 0x100]
mov ax, 0xa
call fcn.0040de10
mov eax, dword [0x49baec]
call fcn.00405eac
push esi
call sub.user32.dll_SetFocus
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x42c5ec
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
mov eax, esp
mov edx, 0x160
call fcn.00405a9c
push 0x105
push 0x160
lea eax, [esp + 8]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp]
add esp, 0x160
pop ebx
ret
Function at 0x42d854
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
add esp, 0xffffffe0
mov esi, edx
mov ebx, eax
mov ax, 0xd1
call fcn.0040bc04
mov edx, 3
call fcn.00411d74
movsx eax, si
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetDlgItem
mov ebx, eax
push 0x1f
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetClassNameA
mov eax, dword [0x48d704]
mov eax, dword [eax + 4]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x42d8b1
push 0xffffffffffffffff
push 0
push 0xb1
push ebx
call sub.user32.dll_SendMessageA
push 0
push ebx
call sub.user32.dll_ShowWindow
mov eax, 0x4b
call fcn.0040f448
push 5
push ebx
call sub.user32.dll_ShowWindow
mov eax, 0x4b
call fcn.0040f448
push 0
push ebx
call sub.user32.dll_ShowWindow
mov eax, 0x4b
call fcn.0040f448
push 5
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_SetFocus
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x42d970
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffec0
mov esi, esp
mov ebp, dword [0x48d550]
xor ebx, ebx
mov edi, 1
jmp 0x42d9cc
mov eax, dword [0x48d784]
mov eax, dword [eax]
mov edx, edi
dec edx
imul edx, edx, 0x12c
add eax, edx
cmp byte [eax], 0
je 0x42d9cb
cmp byte [eax + 0x100], 0
je 0x42d9bc
mov edx, 0x42db80
mov eax, dword [0x49ba70]
call fcn.0042bb9c
jmp 0x42d9cb
mov edx, 0x42db80
mov eax, dword [0x49ba70]
call fcn.0042bb9c
inc edi
xor eax, eax
mov al, byte [ebp + 0x18a0]
cmp edi, eax
jle 0x42d98b
test bl, bl
je 0x42d9f2
push 0
push 0
push 0x416
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 0
mov eax, dword [0x48d544]
movsx eax, word [eax]
push eax
push 0x186
mov eax, dword [0x49ba70]
push eax
call sub.user32.dll_SendMessageA
cmp byte [ebp + 0x300], 0x2e
jne 0x42da22
mov eax, 0x42db84
call fcn.00412904
jmp 0x42da32
lea edx, [ebp + 0x300]
mov eax, dword [0x48da44]
call fcn.00405c48
push 0x42db88
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov byte [esi + 0x2c], 0
push esi
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x42da86
test byte [esi], 0x10
jne 0x42da75
lea eax, [esi + 0x2c]
mov dl, 0x2e
call fcn.00405e00
mov byte [eax], 0
lea edx, [esi + 0x2c]
mov eax, dword [0x49ba74]
call fcn.0042bb9c
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x42da8c
cmp byte [esi + 0x2c], 0
jne 0x42da56
push ebx
call sub.kernel32.dll_FindClose
push 0
mov eax, dword [0x48d424]
movsx eax, word [eax]
push eax
push 0x186
mov eax, dword [0x49ba74]
push eax
call sub.user32.dll_SendMessageA
cmp byte [ebp + 0x300], 0x2e
jne 0x42dac2
mov eax, 0x42db84
call fcn.00412904
jmp 0x42dad2
lea edx, [ebp + 0x300]
mov eax, dword [0x48da44]
call fcn.00405c48
push 0x42db90
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov byte [esi + 0x2c], 0
push esi
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x42db26
test byte [esi], 0x10
jne 0x42db15
lea eax, [esi + 0x2c]
mov dl, 0x2e
call fcn.00405e00
mov byte [eax], 0
lea edx, [esi + 0x2c]
mov eax, dword [0x49ba78]
call fcn.0042bb9c
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x42db2c
cmp byte [esi + 0x2c], 0
jne 0x42daf6
push ebx
call sub.kernel32.dll_FindClose
push 0
mov eax, dword [0x48d664]
movsx eax, word [eax]
push eax
push 0x186
mov eax, dword [0x49ba78]
push eax
call sub.user32.dll_SendMessageA
mov ebx, 0x430b68
push ebx
push 0xfffffffffffffffc
mov eax, dword [0x49ba74]
push eax
call sub.user32.dll_SetWindowLongA
mov dword [0x49bad0], eax
push ebx
push 0xfffffffffffffffc
mov eax, dword [0x49ba78]
push eax
call sub.user32.dll_SetWindowLongA
add esp, 0x140
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43052c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov ebx, eax
push 0xffffffffffffffeb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
call sub.user32.dll_GetWindowLongA
push eax
push ebx
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
push 0x18
call sub.user32.dll_GetSysColor
push eax
call sub.gdi32.dll_CreateSolidBrush
mov esi, eax
push esi
push ebx
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x10], eax
push 0x17
call sub.user32.dll_GetSysColor
push eax
push 0
push 0
call sub.gdi32.dll_CreatePen
mov edi, eax
push edi
push ebx
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
push 0xff
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
call sub.user32.dll_GetClientRect
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x124]
call fcn.00405bdc
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
call sub.gdi32.dll_GetTextExtentPoint32A
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 8]
add eax, 3
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
sub eax, edx
push eax
mov eax, dword [ebp - 0x20]
push eax
push edx
push ebx
call sub.gdi32.dll_Rectangle
push 1
push ebx
call sub.gdi32.dll_SetBkMode
push 0x17
call sub.user32.dll_GetSysColor
push eax
push ebx
call sub.gdi32.dll_SetTextColor
lea eax, [ebp - 0x124]
call fcn.00405bdc
push eax
lea eax, [ebp - 0x124]
push eax
mov eax, dword [0x48da78]
movzx eax, byte [eax]
mov edx, 1
sub edx, eax
push edx
push 1
push ebx
call sub.gdi32.dll_TextOutA
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.gdi32.dll_SelectObject
push esi
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.gdi32.dll_SelectObject
push edi
call sub.gdi32.dll_DeleteObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4306c4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
cmp dword [edi], 0
je 0x4306e7
mov byte [0x49ba6c], 1
mov eax, dword [edi]
push eax
call sub.user32.dll_DestroyWindow
push 2
lea ecx, [ebp - 0x14]
movsx edx, si
mov eax, ebx
call fcn.0040b394
mov eax, dword [0x48d550]
cmp byte [eax + 0x189f], 0
seta al
and eax, 0x7f
cmp byte [ebp + 0x10], 0
sete dl
and edx, 0x7f
add edx, edx
add edx, 0xe
imul edx
add eax, 4
mov dword [ebp - 0x14], eax
cmp word [ebp + 0x14], 0
jle 0x43074a
movsx esi, word [ebp + 0x14]
dec esi
test esi, esi
jl 0x43074a
inc esi
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040b450
add dword [ebp - 0x14], eax
inc dword [ebp - 4]
dec esi
jne 0x430737
mov eax, dword [0x48d550]
cmp byte [eax + 0x189f], 0
jbe 0x430771
cmp word [ebp + 0x14], 0
jle 0x430771
cmp byte [ebp + 0x10], 0
sete al
and eax, 0x7f
add eax, eax
add eax, 0xe
sub dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.user32.dll_OffsetRect
push 0
mov eax, dword [0x48e700]
push eax
push 0
push ebx
cmp byte [ebp + 0x10], 0
sete al
and eax, 0x7f
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
sub edx, eax
push edx
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.0040b3bc
add eax, 3
push eax
mov eax, dword [0x48da78]
movzx eax, byte [eax]
add eax, dword [ebp - 0x10]
add eax, 2
push eax
mov eax, dword [ebp - 0x14]
dec eax
push eax
push 0x80000000
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x48d56c]
push eax
push 0x88
call sub.user32.dll_CreateWindowExA
mov dword [edi], eax
push 4
mov eax, dword [edi]
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x31
push ebx
call sub.user32.dll_SendMessageA
push eax
push 0xffffffffffffffeb
mov eax, dword [edi]
push eax
call sub.user32.dll_SetWindowLongA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x430f28
Capabilities:
Inspect load icon resource

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov ebp, 0x49baf8
test al, al
je 0x430fb5
push 0
push 3
push 0x10
push 0x10
push 0x10
call sub.comctl32.dll_ImageList_Create
mov dword [ebp], eax
push 5
call sub.user32.dll_GetSysColor
push eax
mov eax, dword [ebp]
push eax
call sub.comctl32.dll_ImageList_SetBkColor
push 4
mov eax, dword [0x48e700]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba80], eax
push 8
mov eax, dword [0x48e700]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba84], eax
push 0x17
mov eax, dword [0x48d738]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba88], eax
jmp 0x4310af
push 0
mov edi, ebx
and edi, 0x7f
mov eax, edi
add eax, 3
push eax
push 0x10
xor eax, eax
mov al, bl
mov esi, eax
add esi, esi
add esi, 0xe
push esi
push esi
call sub.comctl32.dll_ImageList_Create
mov dword [ebp], eax
push 5
call sub.user32.dll_GetSysColor
push eax
mov eax, dword [ebp]
push eax
call sub.comctl32.dll_ImageList_SetBkColor
mov edx, dword [0x48dac4]
mov edx, dword [edx]
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba80], eax
push 6
mov eax, dword [0x48e700]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba84], eax
push 5
mov eax, dword [0x48e700]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba88], eax
test bl, bl
je 0x4310af
push 0xa
mov eax, dword [0x48d738]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba8c], eax
push 7
mov eax, dword [0x48e700]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba90], eax
push 8
mov eax, dword [0x48e700]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba94], eax
push 8
mov eax, dword [0x48d738]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebp]
call fcn.0040b2b8
mov dword [0x49ba98], eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4315e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdb4
mov ebx, eax
lea eax, [ebx + 0x22]
mov edx, 0x24
call fcn.00405a9c
mov dword [ebx + 0x22], 5
xor edi, edi
mov eax, 0x431840
call fcn.00412904
mov byte [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebp, eax
jmp 0x43178f
test byte [esp + 0xc], 0x10
jne 0x43177a
lea eax, [esp + 0x38]
call fcn.00412904
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x150]
mov edx, dword [0x48d830]
mov eax, dword [0x48da44]
call fcn.004312d4
test al, al
je 0x43177a
mov eax, 0x10
call fcn.004024e8
mov esi, eax
mov eax, dword [0x48d830]
call fcn.00405e78
mov dword [esi], eax
mov byte [0x49baf0], 3
lea eax, [esp + 0x14c]
call fcn.00405e78
mov dword [esi + 4], eax
mov byte [0x49baf1], 3
lea eax, [esp + 0x38]
call fcn.00405e78
mov dword [esi + 8], eax
mov byte [0x49baf2], 3
mov eax, 8
call fcn.004024e8
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0x20]
mov dword [eax], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 4], edx
mov byte [0x49baf3], 2
mov dword [ebx + 0x42], esi
cmp byte [esp + 8], 0
jne 0x4316de
mov eax, dword [0x49ba80]
mov dword [ebx + 0x3e], eax
cmp byte [esp + 8], 0
jle 0x4316ed
mov eax, dword [0x49ba88]
mov dword [ebx + 0x3e], eax
cmp byte [esp + 8], 0
jge 0x4316fc
mov eax, dword [0x49ba8c]
mov dword [ebx + 0x3e], eax
mov eax, dword [esi]
push eax
mov eax, ebx
xor ecx, ecx
mov edx, edi
call fcn.0042d920
mov eax, dword [esi + 4]
push eax
mov eax, ebx
mov cl, 1
mov edx, edi
call fcn.0042d920
mov eax, dword [esi + 8]
push eax
mov eax, ebx
mov cl, 2
mov edx, edi
call fcn.0042d920
push esp
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
mov eax, esp
call fcn.00417530
mov edx, eax
mov eax, dword [0x48da44]
call fcn.00405c48
push 0x431848
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, esp
call fcn.004174e8
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48da44]
push eax
mov eax, ebx
mov cl, 3
mov edx, edi
call fcn.0042d920
inc edi
lea eax, [esp + 0xc]
push eax
push ebp
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x43179a
cmp byte [esp + 0x38], 0
jne 0x431628
push ebp
call sub.kernel32.dll_FindClose
mov eax, dword [ebx + 4]
call fcn.0040b310
mov esi, eax
mov dword [ebx + 0x1c], esi
mov edx, dword [0x48d550]
movsx edx, word [edx + 0x1832]
mov eax, esi
dec eax
call fcn.0040bb7c
mov dword [ebx + 0x18], eax
cmp dword [ebx + 0x1c], 0
setg cl
mov eax, ebx
mov dx, 3
call fcn.0042e904
cmp dword [ebx + 0x1c], 0
setg cl
mov eax, ebx
mov dx, 4
call fcn.0042e904
push 0
push 0
push 0x229
mov eax, dword [0x48da1c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
test eax, eax
je 0x431809
cmp dword [ebx + 0x1c], 0
jg 0x43180d
xor ecx, ecx
jmp 0x43180f
mov cl, 1
mov eax, ebx
mov dx, 1
call fcn.0042e904
mov ecx, dword [0x48d550]
movzx ecx, byte [ecx + 0x1891]
mov edx, 0x4304ac
mov eax, dword [ebx + 4]
call fcn.0040b514
add esp, 0x24c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x432dd0
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], eax
xor ebx, ebx
mov eax, dword [0x48d944]
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.0040eba4
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x432e08
mov edx, dword [0x48d944]
mov ax, 1
call fcn.0040de10
jmp 0x432e6f
push 0
push ebp
call sub.kernel32.dll_GetFileSize_1
mov edi, eax
push 4
push 0x1000
push edi
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
test esi, esi
jne 0x432e48
mov dword [esp + 4], edi
fild dword [esp + 4]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.00412abc
mov edx, eax
mov ax, 0xb
call fcn.0040de10
jmp 0x432e6f
push edi
push esi
push ebp
call sub.kernel32.dll__lread
push ebp
call sub.kernel32.dll_CloseHandle_1
push esi
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_SetWindowTextA
push 0x4000
push edi
push esi
call sub.kernel32.dll_VirtualFree_1
mov bl, 1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret