joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dbed
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push esi
push edi
mov edx, ecx
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [edx + 4]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
xor esi, esi
push eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x18], 0x44
mov dword [ebp - 0x12], esi
mov dword [ebp - 0xe], 0x469bb8
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x42dd22
cmp dword [ebp - 0x16], esi
jne 0x42dd22
mov ax, word [0x469bb8]
mov ecx, 0x81
mov word [ebp - 0x230], ax
xor eax, eax
lea edi, [ebp - 0x22e]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
call edi
mov esi, 0x103
pop ecx
cmp eax, esi
jbe 0x42dc88
mov eax, esi
jmp 0x42dc8c
push ebx
call edi
pop ecx
push eax
lea eax, [ebp - 0x230]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
lea eax, [ebp - 0x230]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x42dd22
push dword [ebp + 0xc]
and word [ebx], 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
je 0x42dd22
mov ax, word [0x469bb8]
mov ecx, 0x81
mov word [ebp - 0x438], ax
xor eax, eax
lea edi, [ebp - 0x436]
add ebx, 2
rep stosd dword es:[edi], eax
push ebx
push dword [ebp + 0xc]
stosw word es:[edi], ax
push 0x40b0b4
lea eax, [ebp - 0x438]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea eax, [ebp - 0x438]
push 0xffffffffffffffff
push eax
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x1efe0]
call fcn.004529f0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42eb6e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1070
call fcn.00466f70
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [0x49c070], edi
jne 0x42ec78
cmp dword [ebp + 8], edi
je 0x42ec78
mov eax, dword [esi + 0x4fc4]
push ebx
push dword [ebp + 8]
push eax
call fcn.00426545
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp - 4], eax
jl 0x42ec01
push edi
push edi
push 0x403
push dword [esi + 0x4fe4]
call ebx
push 9
mov edx, eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
push edx
push dword [ebp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x24], eax
call fcn.0042634c
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x28]
push eax
push 0
push 0x40c
push dword [esi + 0x4fe4]
call ebx
mov ax, word [0x469bb8]
mov ecx, 0x411
mov word [ebp - 0x1070], ax
xor eax, eax
lea edi, [ebp - 0x106e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1070]
push eax
push 0x824
push 0xd
push dword [esi + 0x4fc4]
call ebx
push 0
push 0
push dword [ebp + 8]
call fcn.00426a41
add esp, 0xc
mov edi, eax
test edi, edi
pop ebx
je 0x42ec78
push dword [ebp + 8]
lea eax, [ebp - 0x1070]
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x42ec69
push edi
mov ecx, esi
call fcn.00430559
push edi
lea ecx, [esi + 0x7458]
push dword [ebp + 8]
call fcn.00439198
pop edi
pop esi
leave
ret 4

Function at 0x42ecb9
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
push esi
push edi
lea eax, [ebp - 8]
mov edi, 0x40cd44
push eax
mov esi, SysReAllocString
push edi
push esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42ecfa
lea eax, [ebp - 8]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x42ecfa
xor eax, eax
jmp 0x42ed6c
lea eax, [ebp - 0xc]
xor edi, edi
push eax
lea eax, [ebp - 4]
push eax
push edi
mov esi, 0x40cd20
push edi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42ed30
cmp dword [ebp - 4], 1
sete al
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 4], edi
sete al
mov dword [ebp - 4], eax
jmp 0x42ed37
mov dword [ebp - 4], 1
cmp dword [ebp + 8], edi
je 0x42ed47
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42ed69
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push 4
push edi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0044e716
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret 4
Function at 0x4321c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x1f004], edi
jne 0x4321eb
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1f004], eax
mov eax, dword [esi + 0x1f004]
cmp eax, edi
je 0x43222c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esi + 0x1f004]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push esi
push 0x432255
push edi
push edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, edi
je 0x43222c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret

Function at 0x432332
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x1f448], edi
jne 0x432355
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1f448], eax
mov eax, dword [esi + 0x1f448]
cmp eax, edi
je 0x432396
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esi + 0x1f448]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push esi
push 0x4323bf
push edi
push edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, edi
je 0x432396
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x43417c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24ac
call fcn.00466f70
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0xc], esi
lea ecx, [esi + 0x7458]
call fcn.00438cdd
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x5c
push 0x46b680
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
mov dword [ebp - 4], eax
mov eax, dword [0x40cfc8]
pop ecx
mov dword [ebp - 0x214], eax
pop ecx
xor eax, eax
cmp dword [ebp - 4], eax
mov ecx, 0x81
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
je 0x4341eb
add dword [ebp - 4], 2
lea eax, [ebp - 0x214]
push dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push ebx
mov ebx, 0x40b0c0
lea eax, [ebp - 0x24ac]
push ebx
push 0x928
push eax
call edi
and word [ebp - 0x125e], 0
lea eax, [ebp - 0x24ac]
push eax
call fcn.00453a29
push dword [ebp - 4]
lea eax, [ebp - 0x24ac]
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 0x1c
mov dword [ebp - 8], eax
test eax, eax
je 0x4342e3
push dword [ebp - 4]
mov esi, dword [sym.imp.MSVCRT.dll_wcslen]
call esi
mov ecx, dword [ebp - 8]
push 2
push 0x40cfc0
lea eax, [ecx + eax*2]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCRT.dll_wcsncmp]
add esp, 0x10
test eax, eax
jne 0x434265
add dword [ebp - 8], 4
push dword [ebp - 8]
call esi
test eax, eax
pop ecx
jbe 0x4342e0
push dword [ebp - 8]
lea eax, [ebp - 0x125c]
push ebx
push 0x823
push eax
call edi
and word [ebp - 0x216], 0
lea eax, [ebp - 0x125c]
push eax
call fcn.00453978
lea eax, [ebp - 0x125c]
push eax
call fcn.00427312
lea eax, [ebp - 0x125c]
push eax
call esi
add esp, 0x1c
test eax, eax
jbe 0x4342e0
lea eax, [ebp - 0x125c]
push 0x40cfa8
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
je 0x4342e0
mov ecx, dword [ebp - 0xc]
push 0
push 1
push 0
lea eax, [ebp - 0x125c]
push 1
push eax
call fcn.004303d3
mov esi, dword [ebp - 0xc]
mov ecx, esi
call fcn.00431d3c
lea ecx, [esi + 0x7494]
xor edi, edi
xor ebx, ebx
call fcn.00463013
test eax, eax
jne 0x43431a
push edi
push edi
lea ecx, [esi + 0x7458]
call fcn.004381b4
mov edx, dword [eax]
push edi
push 0x40c610
mov ecx, eax
call dword [edx + 0x14]
push 1
pop ebx
cmp dword [0x48d558], edi
je 0x434332
push ebx
push 1
push 1
lea ecx, [esi + 0x7458]
call fcn.00439854
call fcn.00427361
mov ecx, esi
call fcn.00434ab7
mov ecx, esi
call fcn.00433335
mov ecx, esi
call fcn.00430573
push 1
call fcn.00427238
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434712
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov eax, dword [edi + 4]
mov dword [ebp - 4], ebx
cmp eax, 0x100
je 0x434833
mov ecx, 0x104
cmp eax, ecx
jne 0x434742
cmp dword [edi + 8], 0x79
jae 0x434833
cmp eax, 0x101
jne 0x4347f8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, dword [edi + 8]
shr eax, 8
movzx eax, al
cmp edi, 9
mov dword [ebp + 8], eax
je 0x4347b3
cmp edi, 0x11
jne 0x4347d2
push 9
call esi
shr eax, 8
test al, al
je 0x43478b
cmp dword [ebp + 8], 0
je 0x434797
push 2
lea ecx, [ebx + 0x7458]
call fcn.004396f0
mov dword [ebx + 0x1f688], 1
jmp 0x4347d2
xor eax, eax
cmp dword [ebx + 0x1f688], eax
setne al
push eax
lea ecx, [ebx + 0x7458]
call fcn.004396f0
push 1
pop eax
jmp 0x4347d4
push 0x11
call esi
shr eax, 8
test al, al
je 0x4347d2
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4347db
push 2
lea ecx, [ebx + 0x7458]
call fcn.004396f0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
lea esi, [ebx + 0x1f688]
xor eax, eax
lea ecx, [ebx + 0x7458]
cmp dword [esi], edi
setne al
push eax
call fcn.004396f0
mov dword [esi], edi
jmp 0x4347ae
cmp eax, ecx
jne 0x4347d2
mov eax, dword [edi + 8]
sub eax, 0x26
je 0x434808
dec eax
dec eax
jne 0x4347d2
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x4347d2
xor eax, eax
cmp dword [0x48d9e8], eax
je 0x4347d2
cmp dword [edi + 8], 0x26
jne 0x4347a2
push 2
pop eax
jmp 0x4347a2
mov eax, dword [edi + 8]
cmp eax, 0x70
jb 0x4347d2
cmp eax, 0x7b
ja 0x4347d2
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 8
push 0x12
movzx ebx, al
call esi
shr eax, 8
movzx eax, al
push 0x11
mov dword [ebp + 8], eax
call esi
shr eax, 8
test ebx, ebx
movzx eax, al
jne 0x4347d2
cmp dword [ebp + 8], ebx
jne 0x4347d2
test eax, eax
jne 0x4347d2
mov eax, dword [edi + 8]
sub eax, 0x70
imul eax, eax, 0x1048
lea esi, [eax + 0x48ddd8]
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
jbe 0x4347d2
mov eax, dword [ebp - 4]
push esi
lea ecx, [eax + 0x7458]
call fcn.00439bae
jmp 0x4347ae
Function at 0x4349b3
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.00466f70
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov edx, ecx
push edi
mov word [eax], si
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x104a]
mov word [ebp - 0x104c], si
push 0x824
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x104c]
mov dword [ebp - 4], edx
push eax
push dword [edx + 0x4fc4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [0x48dc30], esi
je 0x434a83
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
shr eax, 8
push 0x12
movzx ebx, al
call esi
shr eax, 8
push 0x10
movzx edi, al
call esi
shr eax, 8
test ebx, ebx
movzx eax, al
je 0x434a50
test edi, edi
je 0x434a40
push 0x48dd4c
push 0x48dd24
jmp 0x434a6e
test eax, eax
je 0x434a60
push 0x48dcfc
push 0x48dcd4
jmp 0x434a6e
test eax, eax
je 0x434a60
push 0x48dcac
push 0x48dc84
jmp 0x434a6e
test ebx, ebx
je 0x434a83
push 0x48dc5c
push 0x48dc34
lea eax, [ebp - 0x104c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004261ce
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
pop edi
pop esi
pop ebx
test eax, eax
jne 0x434aa6
lea eax, [ebp - 0x104c]
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
push 1
push dword [ebp + 8]
call fcn.004303f4
leave
ret 8

Function at 0x434b2d
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x434b5a
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x48dc18], 0
mov ecx, esi
jne 0x434b6c
call fcn.00458563
pop esi
ret
mov ecx, esi
call fcn.004587b6
test byte [0x48d55c], 1
je 0x434b71
mov ecx, esi
call fcn.00458539
pop esi
ret
Function at 0x43683a
Capabilities:
Copy file
Delete file
Get common file path
Get file size
Read file on windows

Disassembly:
mov eax, 0x468490
call fcn.00466f40
sub esp, 0x420
push ebx
push esi
mov edx, 0x81
push edi
xor ebx, ebx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x222]
mov word [ebp - 0x224], bx
mov word [ebp - 0x42c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x42a]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x14], ebx
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x224]
push eax
push ebx
lea eax, [ebp - 0x42c]
push 0x40d36c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x224]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push 0x8000080
push 3
push ebx
push 1
lea eax, [ebp - 0x224]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x436976
push ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x43696d
lea edi, [eax + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov esi, eax
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
cmp esi, ebx
rep stosb byte es:[edi], al
je 0x43696d
lea eax, [ebp - 0x1c]
push ebx
push eax
push dword [ebp - 0x18]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
mov ah, byte [esi + 1]
mov al, byte [esi]
cmp ax, 0xfeff
jne 0x43695d
add esi, 2
cmp esi, ebx
jne 0x43694a
xor eax, eax
jmp 0x436951
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0xc]
push esi
push eax
call fcn.004167eb
jmp 0x436966
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0042b629
mov dword [ebp - 0x14], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x437535
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
lea eax, [ebp - 0x22c]
push edi
mov esi, 0x104
push eax
mov ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x22c]
push eax
push 0x40d5b0
lea eax, [ebp - 0x434]
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x22c]
xor edi, edi
push dword [ebp + 8]
mov word [ebp - 0x22e], di
push eax
push 0x40d570
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push edi
push eax
mov word [eax + ecx*2 - 2], di
call fcn.0044dd66
add esp, 0x1c
test eax, eax
je 0x4375b6
push 1
pop eax
jmp 0x437686
lea eax, [ebp - 0x434]
push eax
call fcn.0044e021
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.COMCTL32.dll_ImageList_GetIconSize]
push dword [0x46bb6c]
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
call esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
push edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_FillRect]
push 1
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebx + 0xc]
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.00450b17
add esp, 0xc
mov edi, eax
push dword [ebp - 0x14]
push dword [ebp + 0x10]
call esi
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 4]
push dword [0x46bb6c]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x437700
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x468509
call fcn.00466f40
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
call fcn.00459697
xor ebx, ebx
mov dword [esi + 0x30], 0x401d54
mov dword [ebp - 4], ebx
mov dword [esi + 0x34], 0x64
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.0045ea84
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 2
call fcn.004607a1
mov al, byte [ebp - 0xd]
lea edi, [esi + 0x143d8]
push ebx
push ebx
mov ecx, edi
mov byte [ebp - 4], 3
mov byte [edi], al
call fcn.00439d4f
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea ecx, [esi + 0x143e4]
mov byte [ebp - 4], 4
call fcn.00463e0b
lea ecx, [esi + 0x14808]
mov byte [ebp - 4], 5
call fcn.004599a1
xor eax, eax
lea edi, [esi + 0x147e0]
mov dword [esi], 0x401d90
mov dword [esi + 0x30], 0x401d88
mov dword [esi + 0x38], 0x401d84
mov ecx, dword [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi + 0x143d4], ebx
mov dword [esi + 0x147f4], 1
mov dword [esi + 0x147f8], ebx
mov dword [esi + 0x147fc], ebx
mov dword [esi + 0x14800], ebx
mov dword [esi + 0x14804], ebx
mov dword [esi + 0x14820], ebx
mov dword [esi + 0x147f0], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x437968
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
call fcn.00438a0b
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.MSVCRT.dll__wstrtime]
push SysReAllocString
lea eax, [ebp - 0x41c]
push 0xffffffffffffffff
push eax
push 0x40d658
push 0x40b278
call fcn.004521a5
add esp, 0x18
call fcn.00451be3
cmp dword [esi + 0x14820], ebx
lea eax, [esi + 0x14820]
je 0x4379c7
push ebx
push eax
call fcn.004512b8
pop ecx
pop ecx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
mov word [ebp - 0x214], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40d640
lea eax, [ebp - 0x214]
push 0x103
push eax
push dword [0x49a558]
call fcn.0044ddca
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esi + 0x143d4], ebx
cmp dword [0x49a574], ebx
je 0x437a56
lea edi, [esi + 0x3c]
mov ecx, edi
call fcn.00463013
cmp eax, ebx
mov dword [ebp - 4], eax
jle 0x437a4d
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.00463079
push dword [ebp - 8]
mov ecx, esi
push dword [ebp - 0xc]
call fcn.004382d6
inc ebx
cmp ebx, dword [ebp - 4]
jl 0x437a2a
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x439b3b
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x40d640
push 0x103
lea esi, [edi + 0x14824]
push esi
push dword [0x49a558]
call fcn.0044ddca
push 0
push esi
call fcn.0044dd66
add esp, 0x18
test eax, eax
jne 0x439b85
lea ebx, [edi + 0x14820]
push 2
push esi
push ebx
call fcn.00451156
push 0
push ebx
call fcn.004512b8
add esp, 0x14
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
push esi
call ebx
push 1
add edi, 0x14820
push esi
push edi
call fcn.00451156
add esp, 0xc
push 2
push esi
call ebx
pop edi
pop esi
pop ebx
ret

Function at 0x43bcbe
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x468808
call fcn.00466f40
sub esp, 0xa7c
and word [ebp - 0x880], 0
push ebx
push esi
mov dword [ebp - 0x18], ecx
mov esi, 0x81
push edi
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x87e]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0x103
push 0
lea eax, [ebp - 0x880]
push ebx
push eax
push dword [0x49a558]
call fcn.0044ddca
and word [ebp - 0x678], 0
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x676]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x880]
push 0x40b488
push eax
push 0x40d980
lea eax, [ebp - 0x678]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push eax
call ebx
and word [ebp - 0x472], 0
and dword [ebp - 4], 0
add esp, 0x14
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x43bd78
xor eax, eax
jmp 0x43be7c
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [ebp - 0x444]
push 0x40b3c4
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x43be4c
lea eax, [ebp - 0x444]
push 0x40b3bc
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x43be4c
test byte [ebp - 0x470], 0x10
je 0x43be4c
and word [ebp - 0x220], 0
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x880]
push eax
push 0x40d950
lea eax, [ebp - 0x220]
push 0x104
push eax
call ebx
and word [ebp - 0xa88], 0
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0xa86]
rep stosd dword es:[edi], eax
add esp, 0x14
and word [ebp - 0x1a], 0
stosw word es:[edi], ax
lea eax, [ebp - 0xa88]
push 0x207
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.0044dd66
pop ecx
test eax, eax
pop ecx
je 0x43be4c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x220]
push eax
call fcn.0043bea0
lea eax, [ebp - 0x470]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43bd78
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.0043c5cb
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret