joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414190
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
mov esi, edx
push edi
mov edi, ecx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], edi
movzx eax, word [esi + 0xc]
cmp eax, 0x66
je 0x4141c5
cmp eax, 0x46
jne 0x414318
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x414318
push 8
push edi
call ebx
mov edi, eax
mov ebx, 0x15
mov eax, dword [edi + 0x1035c]
lea ecx, [edi + 0x10131]
test eax, eax
jne 0x41423b
mov eax, dword [0x4b2a34]
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
push ecx
movups xmmword [ecx + 0x10], xmm0
movq qword [ecx + 0x20], xmm0
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ecx + 4], eax
lea eax, [edi + 0x1015a]
mov dword [ecx + 0x10], eax
mov eax, 0x100
mov dword [ecx], 0x28
mov word [ecx + 0x18], ax
mov dword [ecx + 0xc], 0x10001
call dword [sym.imp.COMDLG32.dll_FindTextW]
mov dword [edi + 0x1035c], eax
cmp dword [edi + 0x10360], 0
jne 0x414253
cmp dword [edi + 0x10364], 0
mov ecx, 0x17
cmove ebx, ecx
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x414264
and ebx, 0xffffffef
or ebx, 0x40
push ebx
push 0
push 0
push dword [edi + 0x10364]
push dword [edi + 0x10360]
push 0
push dword [edi + 0x1035c]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [edi + 0x1035c]
test eax, eax
je 0x414307
test bl, 0x40
je 0x414307
push eax
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
test esi, esi
je 0x414304
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4142f5
push 0xfffffffffffffff0
push esi
call ebx
test eax, 0x8000000
jne 0x4142f5
push 0x28
lea eax, [ebp - 0x54]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x54]
push str.Edit
push eax
call fcn.0047fa85
add esp, 8
test eax, eax
jne 0x4142f5
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x4142a5
mov esi, dword [ebp - 0x58]
mov eax, dword [esi]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [edi + 0xbc], eax
mov edi, dword [ebp - 0x5c]
cmp word [esi + 0xc], 0x72
jne 0x414340
push 8
push edi
call ebx
mov ecx, edi
or dword [eax + 0x1013d], 8
mov edx, dword [esi]
mov dword [eax + 0xbc], edx
lea edx, [eax + 0x10131]
call fcn.004140c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
Function at 0x414360
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov eax, dword [edi + 8]
cmp eax, 0xffffff4f
je 0x4144bc
cmp eax, 0xffffff65
je 0x4144ae
cmp eax, 0xffffff9b
jne 0x4144c1
push 8
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [edi]
mov esi, eax
cmp ecx, dword [esi + 0x64]
jne 0x4144c1
cmp dword [esi + 0xc0], 0
jne 0x4144c1
mov eax, dword [esi + 8]
mov ecx, dword [edi + 0xc]
cmp ecx, dword [eax + 4]
jge 0x4144c1
test byte [edi + 0x14], 3
je 0x4144c1
mov edi, dword [eax + ecx*4 + 0x10]
mov edx, edi
mov ecx, dword [edi + 0x20]
mov eax, ecx
sub eax, 6
je 0x414417
sub eax, 2
je 0x414407
sub eax, 1
je 0x4143f7
push ecx
mov ecx, esi
call fcn.004124e0
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x414434
push 9
mov ecx, esi
call fcn.004124e0
add esp, 4
push 0xb
jmp 0x414425
push 8
mov ecx, esi
call fcn.004124e0
add esp, 4
push 0xa
jmp 0x414425
push 6
mov ecx, esi
call fcn.004124e0
add esp, 4
push 7
xor edx, edx
mov dword [ebp - 4], eax
mov ecx, esi
call fcn.004124e0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x68]
add esp, 4
mov ecx, dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x41445e
push eax
call ecx
test eax, eax
je 0x414458
push 0
push dword [esi + 0x68]
call ebx
mov ecx, dword [sym.imp.USER32.dll_IsWindowVisible]
mov eax, dword [esi + 0x70]
test eax, eax
je 0x414473
push eax
call ecx
test eax, eax
je 0x414473
push 0
push dword [esi + 0x70]
call ebx
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x41448c
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41448c
push 0
push dword [esi + 0x6c]
call ebx
mov eax, dword [ebp - 4]
mov ecx, esi
mov dword [esi + 0x6c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xf8], edi
mov dword [esi + 0x70], eax
call fcn.00412d20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00414190
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00413a30
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416360
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
mov dword [ebp - 0x420], 0
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x41639f
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x420]
push eax
push 0xf003f
push 0
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41643c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [ebp - 0x210]
push 0x105
push eax
push 0
push dword [ebp - 0x420]
call edi
test eax, eax
jne 0x41642f
nop
lea eax, [ebp - 0x210]
push eax
push esi
push 0x4a4458
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.00401670
add esp, 0x14
lea edx, [ebp - 0x41c]
mov ecx, 0x80000000
call fcn.00416360
test eax, eax
jne 0x41642f
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0
push dword [ebp - 0x420]
call edi
test eax, eax
je 0x4163e0
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
Function at 0x417340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x210], ecx
push esi
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41739c
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x184
push dword [ebp - 0x210]
call fcn.00479a10
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
test al, 0x10
je 0x4173bc
mov ecx, esi
mov edi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4173a7
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], bx
je 0x41741a
test edi, edi
je 0x4173e8
push esi
push edi
push 0x4a4458
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00401670
add esp, 0x14
lea eax, [ebp - 0x20c]
jmp 0x4173ea
mov eax, esi
push eax
push ebx
call fcn.0047bb50
mov ecx, esi
mov ebx, eax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417400
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], ax
jne 0x4173c1
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c26b
mov esp, ebp
pop ebp
ret

Function at 0x417870
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x2b4
lea eax, [ebp - 0x2b8]
mov ebx, ecx
push 0
push eax
call fcn.0047df00
add esp, 0xc
lea eax, [ebp - 0x2b8]
push 0x4010
push 0x2b4
push eax
push 0x20
push str.a.txt
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0x2b8]
mov edi, eax
test ecx, ecx
je 0x4178ce
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x1003
push ebx
call edi
push 0x2b4
lea eax, [ebp - 0x2b8]
push 0
push eax
call fcn.0047df00
add esp, 0xc
lea eax, [ebp - 0x2b8]
push 0x4011
push 0x2b4
push eax
push 0x20
push str.a.txt
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], eax
test ecx, ecx
je 0x417930
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x2bc]
push eax
push 1
push 0x1003
push ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
Function at 0x4185e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push ebx
push esi
push eax
push 1
push 0
push str.SoftwareBlizzard_EntertainmentWarcraft_III
push 0x80000001
mov esi, ecx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418665
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
push esi
push 0
push 0
push str.InstallPath
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41865a
cmp eax, 0xea
je 0x41865a
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
push esi
push 0
push 0
push str.InstallPathX
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41865a
cmp eax, 0xea
jne 0x41865c
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b2a34]
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], eax
push edx
push eax
mov dword [ebp - 4], esi
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4189b1
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0xc]
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4189b1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x418a03
cmp edi, 4
jbe 0x418a03
mov eax, dword [ebx]
sub edi, 4
push eax
push 8
push dword [0x4b2a38]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x418a03
push edi
lea ecx, [ebx + 4]
push ecx
lea eax, [ebp - 4]
push eax
push esi
call fcn.00442300
add esp, 0x10
cmp eax, 1
je 0x418a03
push esi
push 0
push dword [0x4b2a38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
xor ecx, ecx
jmp 0x418a06
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x418a0f
mov dword [eax], ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x2000
mov esi, edx
mov dword [ebp - 4], ecx
call fcn.0047c4da
add esp, 4
mov edi, eax
push dword [ebp + 8]
push 0
push esi
push 0xfff
push edi
call fcn.00401660
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004840cc
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x419669
cmp eax, 0xfff
ja 0x419669
je 0x419669
lea esi, [edi + eax*2]
jmp 0x419678
xor eax, eax
lea esi, [edi + 0x1ffe]
mov word [edi + 0x1ffe], ax
push 0
push edi
call fcn.0047c0d0
mov ebx, eax
test ebx, ebx
je 0x4196ac
push 0
mov ecx, esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
sub ecx, edi
sar ecx, 1
push ecx
push ebx
push dword [eax + 0x414]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call fcn.004568b0
add esp, 4
push edi
call fcn.004568b0
add esp, 4
sub esi, edi
sar esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x140], edx
lea ecx, [ebp - 0x138]
mov edx, ecx
push edi
test esi, esi
je 0x419cf1
mov edi, 0x10
movzx eax, byte [esi]
lea esi, [esi + 1]
shr eax, 4
movzx eax, byte [eax + str.0123456789ABCDEF]
mov byte [ecx], al
lea ecx, [edx + 2]
movzx eax, byte [esi - 1]
and eax, 0xf
movzx eax, byte [eax + str.0123456789ABCDEF]
mov byte [edx + 1], al
mov edx, ecx
sub edi, 1
jne 0x419cc2
jmp 0x419d38
mov edi, str._____________ERROR______________
lea eax, [ebp - 0x138]
xor esi, esi
mov ecx, 0x134
sub edi, eax
lea eax, [ecx + 0x7ffffeca]
test eax, eax
je 0x419d1f
mov al, byte [edi + edx]
test al, al
je 0x419d1f
mov byte [edx], al
inc esi
inc edx
sub ecx, 1
jne 0x419d05
test ecx, ecx
lea eax, [edx - 1]
lea ecx, [ebp - 0x138]
cmovne eax, edx
mov byte [eax], 0
lea eax, [esi - 1]
cmovne eax, esi
add ecx, eax
push dword [ebp - 0x140]
lea eax, [ebp - 0x13c]
mov word [ecx], 0x2a20
push str._s_r_n
push 0
push 0
push eax
add ecx, 2
lea eax, [ebp - 4]
sub eax, ecx
mov dword [ebp - 0x13c], ecx
push eax
push ecx
call fcn.0041d350
add esp, 0x1c
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x138]
push 0
push eax
mov eax, dword [ebp - 0x13c]
sub eax, ecx
push eax
mov eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
Function at 0x41f150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x31c], eax
mov edi, ecx
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push eax
call fcn.0047df00
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x30c], ax
lea eax, [ebp - 0x30a]
push eax
call fcn.0047df00
add esp, 0x18
mov dword [ebp - 0x314], 0x100
mov dword [ebp - 0x318], 0x208
test esi, esi
jne 0x41f1dd
push 0x2e
push ebx
call fcn.0047dc1e
add esp, 8
mov esi, 0x4a6658
test eax, eax
cmovne esi, eax
push 0
push esi
call fcn.0047bff0
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x310]
push eax
push 1
push 0
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f31f
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x310]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41f31f
cmp word [ebp - 0x104], si
je 0x41f31f
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.0047bff0
mov dword [edi + 8], eax
lea eax, [ebp - 0x310]
push eax
push 1
push esi
lea eax, [ebp - 0x104]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f2c0
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x30c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f2b4
cmp word [ebp - 0x30c], ax
je 0x41f2b4
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.0047bff0
mov dword [edi + 0xc], eax
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x41f2f3
push eax
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
push ebx
call fcn.0041f340
test al, al
je 0x41f2f3
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c26b
mov esp, ebp
pop ebp
ret 0xc
push str.open
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
push ebx
call fcn.0041f340
pop edi
test al, al
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c26b
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c26b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x424650
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
test ecx, ecx
je 0x4246f4
push 0x104
lea edx, [ebp - 0x108]
call fcn.00424470
add esp, 4
lea edi, [eax + 1]
cmp edi, 1
je 0x4246f4
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4246f4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.0047e060
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x4b3e5c]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4246ed
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
Function at 0x425f50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4b4244], 1
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x464], eax
mov ebx, ecx
je 0x4260d7
lea ecx, [ebp - 0x210]
mov esi, eax
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x425fae
movzx eax, word [esi + ecx]
test ax, ax
je 0x425fae
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x425f90
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x210]
mov ax, word [ebp - 0x210]
mov edi, ecx
test ax, ax
je 0x425ff2
movzx edx, ax
cmp dx, 0x5c
je 0x425fe3
cmp word [ecx], 0x2f
je 0x425fe3
add ecx, 2
jmp 0x425fe8
add ecx, 2
mov edi, ecx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x425fd2
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x464], esi
cmp esi, 0xffffffff
je 0x4260d7
nop word [eax + eax]
cmp dword [0x4b4244], 1
je 0x4260d7
test byte [ebp - 0x460], 0x10
je 0x4260b4
cmp word [ebp - 0x434], 0x2e
jne 0x426065
mov ax, word [ebp - 0x432]
cmp ax, 0x2e
jne 0x42605b
cmp word [ebp - 0x430], 0
jmp 0x42605e
test ax, ax
sete al
test al, al
jne 0x4260ba
lea esi, [ebp - 0x434]
mov edx, 0x104
mov eax, edi
sub esi, edi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x426092
movzx ecx, word [esi + eax]
test cx, cx
je 0x426092
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x426074
test edx, edx
lea ecx, [eax - 2]
lea edx, [ebp - 0x210]
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, ebx
call fcn.004260f0
mov esi, dword [ebp - 0x464]
jmp 0x4260ba
inc dword [ebx + 0x624]
lea eax, [ebp - 0x460]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x426020
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
Function at 0x4266a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 8
push ebx
mov dword [ebp - 0x420], ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0x3ea
mov esi, eax
mov dword [ebp - 0x428], 0
push ebx
mov dword [ebp - 0x418], esi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4267a9
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esi + 4]
xor edi, edi
lea ebx, [ecx + 0x208]
mov dword [ebp - 0x424], ecx
lea edx, [ebp - 0x414]
mov dword [ebp - 0x41c], ebx
nop dword [eax]
movzx eax, word [edx]
mov esi, eax
cmp eax, 9
je 0x42672f
cmp eax, 0x20
jne 0x426734
add edx, 2
jmp 0x426720
test ax, ax
je 0x426784
mov ebx, eax
nop dword [eax + eax]
cmp bx, 0x2e
mov word [ecx], si
movzx esi, word [edx + 2]
mov eax, edx
cmovne eax, edi
mov ebx, esi
add edx, 2
add ecx, 2
mov edi, eax
test si, si
jne 0x426740
mov edx, dword [ebp - 0x424]
cmp ecx, edx
jbe 0x42677e
nop dword [eax]
cmp word [ecx - 2], 0x20
jne 0x42677e
add ecx, 0xfffffffe
cmp ecx, edx
ja 0x426770
mov ebx, dword [ebp - 0x41c]
xor eax, eax
mov word [ecx], ax
test edi, edi
jne 0x42679d
sub ebx, ecx
push str..mpq
sar ebx, 1
push ebx
push ecx
call fcn.00403260
mov esi, dword [ebp - 0x418]
mov ebx, dword [ebp - 0x420]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f2
push ebx
call edi
test eax, eax
je 0x4267ce
push 0x104
lea ecx, [esi + 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x3f0
push ebx
call edi
mov edi, eax
test edi, edi
je 0x426863
push edi
add esi, 0x414
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42685e
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0047fa85
add esp, 8
test eax, eax
je 0x426863
lea edx, [ebp - 0x20c]
mov ecx, 0x104
sub edx, esi
lea eax, [ecx + 0x7ffffefa]
test eax, eax
je 0x426843
movzx eax, word [edx + esi]
test ax, ax
je 0x426843
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x426825
test ecx, ecx
lea eax, [esi - 2]
cmovne eax, esi
mov esi, dword [ebp - 0x418]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x624], ecx
jmp 0x426869
xor eax, eax
mov word [esi], ax
mov esi, dword [ebp - 0x418]
push 0x3f6
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x426890
lea eax, [ebp - 0x428]
mov ecx, ebx
push eax
call fcn.004177a0
add esp, 4
mov dword [esi + 0x628], eax
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
Function at 0x427280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ae480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x42735a
cmp word [esi], 0
je 0x42735a
test edi, edi
je 0x42730e
cmp word [edi], 0
je 0x42730e
lea ecx, [ebp - 0x20c]
mov edx, 0x104
mov eax, ecx
sub esi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4272ee
movzx eax, word [esi + ecx]
test ax, ax
je 0x4272ee
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4272d0
lea eax, [ecx - 2]
test edx, edx
push edi
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call fcn.0047b2f0
lea esi, [ebp - 0x20c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42735a
test al, 0x10
je 0x427334
pop edi
pop esi
mov eax, 0x10b
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x427347
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x427347
push esi
push eax
push ebx
call fcn.00403260
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c26b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c26b
mov esp, ebp
pop ebp
ret