joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4204d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4e42d0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
mov dword [ebp - 0x210], 0
push ecx
mov word [ebp - 0x20c], ax
call fcn.00493520
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0x4ba358
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsStormPlayer.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0x102
mov dword [ebp - 0x210], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42056f
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x20c]
jmp 0x420574
mov ecx, 0x4ba358
push esi
call fcn.00402b20
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret

Function at 0x420a70
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ebx]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [eax + 1]
test esi, esi
jns 0x420a8b
push 0x80070057
call fcn.004035c0
mov eax, dword [edi]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, esi
or ecx, edx
jge 0x420aa7
mov eax, esi
mov ecx, edi
call fcn.00402c80
mov eax, dword [edi]
push esi
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x420ace
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x420ad2
push ecx
push eax
call fcn.004907a5
add esp, 8
test eax, eax
js 0x420a81
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x420a81
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
pop esi
ret

Function at 0x4217a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [eax - 0xc], ebx
jne 0x4217d8
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4217cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x10]
mov edi, eax
push edx
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x421815
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
shrd edx, eax, 0x14
shr eax, 0x14
mov dword [ecx], edx
mov ebx, 1
push edi
call esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x421837
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4223a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x4e42d0]
xor eax, esp
mov dword [esp + 0x120], eax
mov eax, dword [edi + 4]
push esi
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov edx, eax
lea ecx, [edi + 4]
call fcn.00423e00
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 6
jb 0x422423
push 0x4bc714
push 0
push 2
push 0
push 0
push 0x86
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x13
jmp 0x422445
push 0x4bc720
push 0
push 2
push 0
push 0
push 0x86
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xd
call dword [sym.imp.GDI32.dll_CreateFontW]
push 0x1a1a1a
mov dword [edi + 0x4c], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, edi
mov dword [edi + 0x40], eax
call fcn.00422580
mov edx, dword [edi + 4]
lea ecx, [edi + 4]
call fcn.00423e00
mov ecx, dword [esp + 0x124]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret
Function at 0x4244b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x4e42d0]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
push edi
mov dword [esp + 0x14], eax
je 0x42461f
cmp byte [esi + 0x25], 0
je 0x42461f
cmp byte [esi + 0x26], 0
je 0x42461f
mov ecx, dword [esi + 0x74]
cmp ecx, dword [esi + 0x7c]
je 0x42461f
mov edi, dword [esi + 4]
lea ecx, [edi + 0xb0]
lea ebx, [esp + 0x18]
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0
call fcn.004243e0
mov eax, dword [esp + 0x10]
cmp eax, dword [edi + 0xb4]
je 0x42461f
mov ebx, dword [eax + 0x10]
xor edi, edi
cmp ebx, edi
je 0x42461f
mov edx, dword [ebx]
mov eax, dword [ebx + 0x14]
mov edx, dword [edx + 8]
push eax
mov ecx, ebx
call edx
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov edi, eax
mov eax, dword [esi + 0x74]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edi
cmp eax, dword [esi + 0x78]
jne 0x42458e
fld1
mov edx, dword [ebx]
mov edx, dword [edx + 0x18]
push ecx
mov ecx, dword [esi + 4]
fstp dword [esp]
movzx ecx, byte [ecx + 0xa9]
push ecx
lea ecx, [esp + 0x24]
push ecx
lea eax, [esi + 0x30]
push eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, ebx
call edx
mov edi, dword [esp + 0x28]
mov eax, dword [esi + 0x78]
fild dword [esi + 0x74]
sub eax, dword [esi + 0x7c]
mov ecx, dword [esi + 0x3c]
mov dword [esp + 0x10], eax
fidiv dword [esp + 0x10]
sub ecx, dword [esi + 0x34]
mov dword [esp + 0x10], ecx
fimul dword [esp + 0x10]
call fcn.00493650
fld1
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esi + 0x38]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x44], ecx
mov ecx, dword [esi + 0x3c]
mov dword [esp + 0x34], edx
mov edx, dword [esi + 0x34]
mov dword [esp + 0x48], ecx
sub ecx, eax
push ecx
mov dword [esp + 0x3c], edi
fstp dword [esp]
sub edi, eax
mov eax, dword [esi + 4]
mov dword [esp + 0x44], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], edi
movzx ecx, byte [eax + 0xa9]
mov edx, dword [ebx]
mov edx, dword [edx + 0x18]
push ecx
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x48]
push ecx
push eax
mov ecx, ebx
call edx
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x425550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4e42d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x118]
mov ebx, 0x114
push eax
mov esi, ecx
mov dword [ebp - 0x118], ebx
call edi
cmp dword [ebp - 0x114], 6
jne 0x4255a9
cmp dword [ebp - 0x110], 1
jne 0x4255a9
lea eax, [esi + 0x54]
push str.1234
push eax
mov ebx, 1
call fcn.00402a30
jmp 0x425609
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], ebx
call edi
cmp dword [ebp - 0x114], 5
jne 0x4255de
mov ebx, 1
cmp dword [ebp - 0x110], ebx
jne 0x4255de
lea eax, [esi + 0x54]
push 0x4bccd8
push eax
call fcn.00402a30
jmp 0x425609
call fcn.004058a0
test al, al
je 0x4255ee
mov edx, 0x4bccdc
jmp 0x425601
call fcn.00405840
mov edx, 0x4bcce0
test al, al
jne 0x425601
mov edx, 0x4bcb3c
lea edi, [esi + 0x54]
call fcn.00402ae0
call fcn.004058f0
add esi, 0x58
mov ebx, 1
test al, al
je 0x425621
push 0x4bccd8
jmp 0x425626
push str.1234
push esi
call fcn.00402a30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret
Function at 0x425f80
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0x4ba358
push edi
xor ebx, ebx
xor esi, esi
call fcn.00402a30
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 5
push 0xffffffffffffffff
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x425ff1
mov edx, dword [ebp - 4]
cmp edx, esi
jne 0x425fbf
xor eax, eax
jmp 0x425fd3
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x425fc4
sub eax, ebx
sar eax, 1
push edx
push edi
mov ebx, eax
call fcn.00402a30
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4260e0
Capabilities:
Create thread

Disassembly:
mov ecx, dword [ebx + 0xa8]
push esi
mov esi, dword [ebx + 0xa4]
cmp esi, ecx
je 0x426114
mov eax, ecx
sub eax, ecx
push edi
sar eax, 2
lea edi, [eax*4]
push edi
push ecx
push esi
call fcn.0048fc30
add esp, 0xc
add edi, esi
mov dword [ebx + 0xa8], edi
pop edi
push 0
push 0
push ebx
push 0x426280
push 0
push 0
call fcn.00491819
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x426140
Capabilities:
Check internet connectivity via wininet
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push edi
lea eax, [esi + 0xa0]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ebx, 0x4bd158
call fcn.00404f20
mov edx, dword [esp + 0x14]
push 0
push edx
call fcn.00401560
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426190
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0
call dword [sym.imp.SensApi.dll_IsNetworkAlive]
test eax, eax
jne 0x4261de
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42626b
push 0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x42626b
mov al, byte [esp + 0xc]
test al, 0x20
jne 0x42626b
test al, 7
je 0x42626b
push esi
call fcn.0043ab50
cmp byte [0x4e5790], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4261fa
call edi
mov dword [0x4ea674], eax
mov ebx, esi
call fcn.00438c10
push esi
call fcn.00439280
cmp byte [0x4e5790], 0
je 0x42626b
call edi
mov dword [0x4ea678], eax
sub eax, dword [0x4ea674]
mov edi, 0x4ea704
push eax
push 0x4bd17c
push 0x4bd194
call fcn.00402d60
mov eax, dword [0x4ea704]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4ea67c]
test eax, eax
je 0x42626b
push eax
mov eax, dword [0x4ea704]
mov ecx, dword [eax - 0xc]
push ecx
push 2
push eax
call fcn.00492295
mov edx, dword [0x4ea67c]
push edx
call fcn.00492a51
add esp, 0x14
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4acbc6
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4e42d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x50]
sub eax, 0x10
call fcn.004050f0
lea ebx, [eax + 0x10]
mov dword [ebp - 0x224], ebx
lea esi, [ebp - 0x220]
mov eax, edi
mov dword [ebp - 4], 0
call fcn.004260b0
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x220]
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsSameRootW]
neg eax
sbb eax, eax
push esi
inc eax
push ebx
mov ecx, edi
mov dword [edi + 0x3c], eax
call fcn.0043b4e0
push 0
push ebx
mov dword [ebp - 0x21c], eax
call fcn.00404890
add esp, 8
cmp dword [ebp - 0x21c], 0
jne 0x4304ff
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4304d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4304f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x3ea
jmp 0x430588
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.00493520
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsSameRootW]
add esi, 0xfffffff0
mov dword [edi + 0x38], eax
mov byte [ebp - 4], 0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x430560
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430583
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret
Function at 0x437a70
Capabilities:
Create thread
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab6f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4e42d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0
push edi
push 0x43b730
push 0
push 0
call fcn.00491819
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
add esp, 0x18
mov dword [ebp - 0x10], esi
call ebx
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0xa0]
sub eax, 0x10
call fcn.004050f0
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
je 0x437aeb
mov esi, eax
call fcn.00438b70
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x437b00
add edi, 0xa4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1f41
call fcn.00407ec0
call ebx
cmp byte [0x4e5790], 0
je 0x437b5d
sub eax, dword [ebp - 0x14]
mov edi, 0x4ea704
push eax
push 0x4c2bdc
push 0x4bd194
call fcn.00402d60
mov eax, dword [0x4ea704]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4ea67c]
test eax, eax
je 0x437b5d
mov ecx, dword [0x4ea704]
mov edx, dword [ecx - 0xc]
push eax
push edx
push 2
push ecx
call fcn.00492295
mov ecx, dword [0x4ea67c]
push ecx
call fcn.00492a51
add esp, 0x14
call ebx
mov edi, eax
test esi, esi
je 0x437b75
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
cmp byte [0x4e5790], 0
je 0x437bd1
sub eax, edi
push eax
push 0x4c2bf4
push 0x4bd194
mov edi, 0x4ea704
call fcn.00402d60
mov edx, dword [0x4ea704]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4ea67c]
test eax, eax
je 0x437bd1
mov ecx, dword [0x4ea704]
mov edx, dword [ecx - 0xc]
push eax
push edx
push 2
push ecx
call fcn.00492295
mov eax, dword [0x4ea67c]
push eax
call fcn.00492a51
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437bf7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438b70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6258
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4e42d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x438bed
mov dword [ebp - 0x54], vtable.CAccessRight.0
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x4e]
mov dword [ebp - 4], 0
push ecx
mov word [ebp - 0x50], ax
call fcn.00493520
add esp, 0xc
push 0x20
push str.Users
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.00403650
add esp, 0xc
mov eax, 1
jmp 0x438bef
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret

Function at 0x438df0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac30b
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x4e42d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
jne 0x438e31
xor eax, eax
jmp 0x438eee
push 0x4ba434
push esi
push 0x4ba408
lea eax, [ebp - 0x428]
push 0x104
push eax
mov edi, 1
call fcn.00490c40
add esp, 0x14
lea ecx, [ebp - 0x678]
push ecx
lea edx, [ebp - 0x428]
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x680], eax
cmp eax, 0xffffffff
je 0x438e2a
cmp word [ebp - 0x64c], 0x2e
je 0x438ec7
test byte [ebp - 0x678], 0x10
je 0x438f0c
lea eax, [ebp - 0x64c]
push eax
push esi
push str._s_s_
lea ecx, [ebp - 0x220]
push 0x104
push ecx
call fcn.00490c40
add esp, 0x14
push 1
lea eax, [ebp - 0x220]
xor edx, edx
push eax
mov ecx, ebx
mov word [ebp - 0x1a], dx
call fcn.00438df0
mov edi, eax
mov edx, dword [ebp - 0x680]
lea ecx, [ebp - 0x678]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x438e7b
mov eax, dword [ebp - 0x680]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0
je 0x438ec7
lea ecx, [ebp - 0x67c]
push ecx
lea ecx, [ebp - 0x64c]
call fcn.00402b20
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x67c]
push str.ASBarBroker.exe
push edx
call fcn.004909a6
add esp, 8
test eax, eax
jne 0x438f4c
push eax
push esi
call fcn.00404890
add esp, 8
mov edi, eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x67c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438ec7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x438ec7
Function at 0x4390a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4adf08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4e42d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.0043b9f0
mov dword [esp + 0x28], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
push 0
push 0
push esi
push 0x426650
push 0
push 0
mov dword [0x4ea690], eax
call fcn.00491819
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push esi
mov edi, eax
call fcn.0043b1c0
test eax, eax
jne 0x439154
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43913f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call ebx
sub eax, edi
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
jns 0x439168
fadd qword [0x4c8770]
fdiv qword [0x4c87b0]
mov ecx, dword [esi + 0xc]
push 0xffffffffffffffff
push ecx
fstp qword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call ebx
mov edi, eax
mov eax, esi
call fcn.0042f630
push esi
mov dword [esp + 0x1c], eax
call fcn.0042f890
call ebx
sub eax, edi
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
jns 0x4391a6
fadd qword [0x4c8770]
fdiv qword [0x4c87b0]
lea edx, [esi + 0xa0]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, 0x4bd158
fstp qword [esi + 0x28]
call fcn.00404f20
mov ecx, dword [esp + 0x18]
push 0
push ecx
call fcn.00401560
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4391f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, esi
call fcn.00438c10
push esi
call fcn.00439280
push 0x4c30f0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x439226
push 0
push 0
push 0x69a
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call fcn.00439e80
xor ecx, ecx
cmp dword [esp + 0x18], 1
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x14]
sete cl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov esi, ecx
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439260
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b1c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac1b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e42d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x10]
call fcn.0043b3a0
mov esi, dword [ebp + 8]
add esi, 0x50
mov edi, esi
mov dword [ebp - 4], 0
call fcn.00405000
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43b22a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x14]
push esi
push ecx
mov ebx, str.Archive.7z
call fcn.00404f20
add esp, 8
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x4c]
mov dword [ebp - 4], 1
call fcn.00405000
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43b274
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
call fcn.0043b330
mov eax, dword [0x4ea680]
mov ebx, dword [edi]
push str.RESOURCE_DATA
push 0x8a
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43b2aa
mov ecx, dword [ebp + 8]
push ebx
call fcn.004015d0
add esp, 4
test al, al
jne 0x43b2c0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi]
push 2
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [edi]
mov esi, dword [esi]
push eax
call fcn.00424db0
add esp, 4
push eax
push esi
call fcn.00424db0
add esp, 4
push eax
call fcn.00410da0
mov eax, dword [edi]
add esp, 4
sub eax, 0x10
mov dword [ebp + 8], esp
mov esi, esp
call fcn.004050f0
add eax, 0x10
mov dword [esi], eax
call fcn.004044a0
xor edx, edx
add esp, 4
test eax, eax
setne dl
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4