joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000733c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10011aa0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100052df
and dword [ebp - 0x14], 0
cmp dword [0x100127e8], 0
mov dword [ebp - 0x18], eax
jne 0x100073ef
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10007497
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10007497
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100127e8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100127ec], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100127f0], eax
call edi
push eax
call esi
mov dword [0x100127f8], eax
test eax, eax
je 0x100073ef
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100127f4], eax
mov eax, dword [0x100127f4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10007448
cmp dword [0x100127f8], ecx
je 0x10007448
push eax
call esi
push dword [0x100127f8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10007448
test ebx, ebx
je 0x10007448
call edi
test eax, eax
je 0x1000743f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000743f
test byte [ebp - 8], 1
jne 0x10007448
or dword [ebp + 0x10], 0x200000
jmp 0x1000747b
mov eax, dword [0x100127ec]
cmp eax, dword [ebp - 0x18]
je 0x1000747b
push eax
call esi
test eax, eax
je 0x1000747b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000747b
mov eax, dword [0x100127f0]
cmp eax, dword [ebp - 0x18]
je 0x1000747b
push eax
call esi
test eax, eax
je 0x1000747b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100127e8]
call esi
test eax, eax
je 0x10007497
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10007499
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100076a7
leave
ret

Function at 0x100076a7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011aa0]
jne 0x100076b1
repz ret
jmp fcn.1000959c
Function at 0x401210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov edi, ecx
mov dword [ebp - 4], 0
xor ebx, ebx
mov eax, 0x431fa7
nop dword [eax]
movzx ecx, byte [eax - 7]
mov esi, edi
shr esi, cl
mov edx, edi
movzx ecx, byte [eax - 6]
shr edx, cl
movzx ecx, byte [eax - 5]
xor esi, edx
mov edx, edi
shr edx, cl
movzx ecx, byte [eax - 4]
xor esi, edx
mov edx, edi
shr edx, cl
movzx ecx, byte [eax - 3]
xor esi, edx
mov edx, edi
shr edx, cl
movzx ecx, byte [eax - 2]
xor esi, edx
mov edx, edi
shr edx, cl
movzx ecx, byte [eax - 1]
xor esi, edx
mov edx, edi
shr edx, cl
movzx ecx, byte [eax + 1]
xor esi, edx
mov edx, edi
shr edx, cl
movzx ecx, byte [eax]
xor esi, edx
mov edx, edi
add eax, 9
shr edx, cl
mov ecx, ebx
xor esi, edx
inc ebx
mov edx, dword [ebp - 4]
and esi, 1
shl esi, cl
or edx, esi
mov dword [ebp - 4], edx
cmp eax, 0x4320c7
jl 0x401230
mov ebx, dword [ebp - 8]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shl eax, 0x18
and edx, 0xffff00
or ecx, eax
or ecx, edx
mov edx, ebx
mov esi, ecx
rol edx, 1
mov eax, ecx
shr esi, 9
and eax, 0xffd50055
and ecx, 0x55aa55aa
shl eax, 9
and esi, 0x550055
or esi, eax
or esi, ecx
mov ecx, edx
and ecx, esi
not edx
mov eax, ecx
shr eax, 0x10
xor ecx, eax
mov eax, ecx
shr eax, 8
xor ecx, eax
mov eax, ecx
shr eax, 4
xor ecx, eax
mov eax, ecx
shr eax, 2
xor ecx, eax
mov eax, ecx
shr eax, 1
xor eax, ecx
mov ecx, ebx
test al, 1
mov eax, 0
pop edi
cmove edx, eax
and ecx, 0xffff0000
xor esi, edx
mov edx, esi
mov eax, esi
shr edx, 4
shl eax, 4
xor edx, eax
shl esi, 4
and edx, 0xf0f0f0f
xor edx, esi
mov eax, edx
sub edx, ebx
and eax, 0xffff0000
sub eax, ecx
movzx ecx, dx
pop esi
or eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404460
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push 0x2f
push esi
call fcn.0040e660
add esp, 8
test eax, eax
jne 0x404481
push 0x5c
push esi
call fcn.0040e660
add esp, 8
test eax, eax
je 0x404484
lea esi, [eax + 1]
push esi
push str.usage:__s__option___subkey1__subkey2__subkey3__subkey4_____n___C_N_____Specify_command_for_R_test._0EMM_1ECM_2CHK___Default0__n___w_XXYY__Specify_work_key__Kw__for_ECM_CHK_command._n_____________XX:BroadcastGroupId_hex__YY:WorkKeyId_hex__n_____________If__C_option_is_not_specified_explicitly__behave_as_with__C1._n___p_N_____Specify_protocol_number__hex_._Affect_R_test_or__K_option_n___n_N_____Specify_number_of_commands_per_test.___Default1___as_N_MAX__n___b_N_____Specify_number_of_cipher_blocks_in_a_command.___as_BLOCK_NUM__n_____________Do_not_use_if_you_do_not_know_well._n___m_N_____Specify_R_test_measurement_method._0Each_One_1Batch___Default0__n___c_______Write_sample_to_STDOUT__no_anything_reports._n___I_FILE__Recount_the_specified_file_as_sample_input._FILE_is____read_STDIN_n___z_NUM___Specify_score_bonus_coefficient.___Default0.0_as_No_effect__n___t_NUM___Specify_score_threshold_for_sampling_process_exit.___Default2.0__n___x_N_____Specify_sample_count_number_for_sampling_process_exit._n_____________If_with__t_specified_explicitly__behave_as_the_count_limiter._n_____________0Infinity__useful_for_using__I_option._n___1_______An_one_round_only__no_automatically_progress._n___l_______Skip_brute_force_extraction_process._n___v_FLAG__Specify_flag_of_verbose_displaying_item._n______________a_All__p_Sampling_progress__f_Fingerprint__g_Graph_n___g_______Using_gnuplot._n_n___E_______Extract_the_subkey_from_fp_code_specified_in_command_line._n___K_______Forward_key_schedule_from_key_specified_in_command_line._n_n___h_______Display_this_message_and_exit._n
call fcn.00401be0
add esp, 8
push 1
call fcn.0040f97c
int3

Function at 0x4046f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push edi
xor edi, edi
test eax, eax
je 0x40476e
push ebx
lea ebx, [ebp + 8]
push esi
mov dword [ebp - 4], ebx
nop dword [eax + eax]
movzx ecx, byte [eax]
lea esi, [eax + 1]
mov dword [ebp - 8], ecx
cmp byte [ecx + 0x43a630], 0
je 0x404758
mov al, byte [esi]
test al, al
je 0x404758
mov ebx, ecx
nop word [eax + eax]
movzx eax, al
lea esi, [esi + 1]
cmp byte [eax + 0x43a630], 0
je 0x40474f
push eax
push ebx
push str.Cant_use_option___c_with___c_n
call fcn.00401be0
add esp, 0xc
inc edi
mov al, byte [esi]
test al, al
jne 0x404730
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 4]
add ebx, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], ebx
test eax, eax
jne 0x404710
pop esi
pop ebx
test edi, edi
jne 0x404773
pop edi
mov esp, ebp
pop ebp
ret
push 1
call fcn.0040f97c
int3
Function at 0x406060
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [0x43a7c0]
mov ecx, eax
mov edx, dword [0x43a7c4]
or ecx, edx
jne 0x4060be
rdtsc
push 0x3e8
mov dword [0x43a7c0], eax
mov dword [0x43a7c4], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
sub eax, dword [0x43a7c0]
push 0
sbb edx, dword [0x43a7c4]
push 0xf4240
push edx
push eax
call fcn.00428e70
push 0
push 0xf4240
push edx
push eax
call fcn.004283e0
mov dword [0x43a7c0], eax
mov dword [0x43a7c4], edx
ret

Function at 0x409550
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
nop dword [eax]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x409560
pop esi
ret

Function at 0x4095a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
sub ecx, 1
jne 0x4095b0
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub edi, 1
jne 0x4095f2
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x409670
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, 0x1571
mov eax, 1
mov dword [edi + 0x1384], 0xffffffff
lea esi, [edi + 8]
mov dword [edi + 4], 0x1571
mov ecx, edx
lea esi, [esi + 4]
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
inc eax
mov dword [esi - 4], edx
cmp eax, 0x270
jl 0x409692
mov dword [edi], 0x270
mov eax, edi
pop edi
pop esi
ret 0xc
Function at 0x41ccd3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [0xa345c635], al
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.0041c8ee
push eax
push esi
push dword [ebp + 8]
call fcn.0041c8a3
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041c8ee
push eax
push esi
push dword [ebp + 8]
call fcn.0041c8a3
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041c8de
jge 0x41cda7
pushfd
salc
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0041c8de
dec ebp
dec byte [esp + eax*4 - 0x73]
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
mov edi, dword [eax - 0x3a]
inc ebp
invalid

Function at 0x41d159
Capabilities:
Contain obfuscated stackstrings

Disassembly:
insd dword es:[edi], dx
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
invalid

Function at 0x41d177
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x17af0001], ebp
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
pop ecx
push eax

Function at 0x41d182
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041c8a3
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
Function at 0x41d1eb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0041c8ee
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041c8a3
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
invalid
invalid
cmc
invalid

Function at 0x41d7d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebp, 0xfffff9ad
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
invalid

Function at 0x4209e9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004206a9
Function at 0x401360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401379
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4013b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4013b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4013b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4013a0
cmp esi, eax
jb 0x4013ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401820
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x17c
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x178], eax
mov eax, dword [esp + 0x184]
push ebx
mov ebx, dword [esp + 0x184]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x20]
push edi
xor ebp, ebp
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.USER32.dll_GetParent]
lea edx, [esp + 0x10]
push edx
mov edi, eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x401958
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x60
push edi
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jl 0x40194c
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x40194c
mov edi, 0xa0000000
lea ebx, [ebx]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x24], edi
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0x24]
call eax
mov eax, dword [esp + 0x1c]
test edi, eax
je 0x401903
test eax, 0x20000000
je 0x401903
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push 0
push ecx
push edx
mov ecx, esi
call fcn.00401750
test eax, eax
jne 0x401921
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x4018c0
jmp 0x40194c
mov edx, dword [esp + 0x14]
push 0x4008
push 0x160
lea ecx, [esp + 0x30]
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov ebp, 1
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x188]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.004f6592
add esp, 0x17c
ret 8
Function at 0x401980
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x168
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x164], eax
mov ecx, dword [esp + 0x16c]
push esi
mov esi, dword [esp + 0x174]
lea eax, [esp + 4]
push eax
push ecx
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 4]
test eax, eax
je 0x401a21
push 0x309
push 0x160
lea edx, [esp + 0x10]
push edx
push 0x80
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x401a21
lea eax, [esp + 0x14]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4019f0
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esp + 0xc]
pop esi
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.004f6592
add esp, 0x168
ret 8
mov ecx, dword [esp + 0x168]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004f6592
add esp, 0x168
ret 8
Function at 0x401e60
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x270
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x26c], eax
push ebx
push ebp
push esi
push edi
push 0x103
lea eax, [esp + 0x17d]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x184], 0
call fcn.004f67e0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x17c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0x4001
push 0x160
lea edx, [esp + 0x20]
push edx
push 0
lea eax, [esp + 0x188]
push eax
call edi
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x11
push 0
mov dword [esi + 0x120], ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x401f44
mov ecx, dword [esp + 0x10]
push 0x4009
push 0x160
lea eax, [esp + 0x20]
push eax
push 0
push ecx
call edi
test eax, eax
je 0x401f31
push eax
call fcn.004a4385
test eax, eax
je 0x401f1d
mov eax, dword [eax + 4]
mov edx, dword [esi + 0x20]
push eax
push 0
push 0x1109
push edx
call ebx
push eax
call fcn.004a4385
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [esp + 0x10], 0
cmp byte [esp + 0x284], 0
je 0x401f60
mov ecx, dword [esi + 0x20]
push 0xffff0000
push 0
push 0x1101
push ecx
call ebx
lea ebp, [esi + 0x11c]
push ebp
lea edi, [esi + 0x238]
push edi
mov ecx, esi
call fcn.00401820
test eax, eax
jne 0x401f92
mov edx, dword [str.My_Computer]
mov dword [edi], edx
mov eax, dword [0x539410]
mov dword [edi + 4], eax
mov ecx, dword [0x539414]
mov dword [edi + 8], ecx
mov eax, dword [ebp]
push eax
push eax
push 1
push 0xffff0000
push edi
mov ecx, esi
call fcn.00401ae0
lea edi, [esi + 0x134]
push edi
push 0
mov ecx, esi
mov dword [esi + 0x33c], eax
call fcn.00401980
push eax
push eax
push 1
push 0xffff0000
push edi
mov ecx, esi
mov dword [esi + 0x118], eax
call fcn.00401ae0
mov edx, dword [esi + 0x33c]
push edx
push 2
mov dword [esi + 0x130], eax
mov eax, dword [esi + 0x20]
push 0x1102
push eax
call ebx
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0x14]
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f6592
add esp, 0x270
ret 4
Function at 0x402030
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x268
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
mov ebx, dword [esp + 0x274]
push ebp
push esi
mov esi, dword [esp + 0x278]
push edi
push 0x301
push 0x160
lea eax, [esp + 0x18]
push eax
push 0
push esi
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x284]
mov eax, dword [esp + 0x14]
mov ebp, eax
test cl, cl
je 0x402098
push eax
push eax
push ecx
push ebx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.00401ae0
mov edx, dword [esp + 0x10]
push edx
jmp 0x4020e4
push 0x5c
push esi
call fcn.004f6860
add esp, 8
lea edx, [esp + 0x170]
test eax, eax
je 0x4020bd
inc eax
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4020b1
jmp 0x4020cb
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4020c1
push ebp
push ebp
push 0
push ebx
lea eax, [esp + 0x180]
push eax
mov ecx, edi
call fcn.00401ae0
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [esp + 0x274]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f6592
add esp, 0x268
ret 0x14