joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45491d
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [0x5be030]
xor edi, edi
call fcn.0046b017
mov ebx, eax
cmp dword [ebp + 0xc], edi
je 0x454a07
push esi
push 0x60
push 8
push dword [0x5bb8a0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 0xc]
mov esi, eax
or dword [esi + 4], 0xffffffff
mov dword [esi], 1
call fcn.005401dd
mov dword [esi + 8], eax
mov dword [esp], str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
call fcn.005401dd
pop ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ecx
mov eax, dword [ebx]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 4]
mov ebx, dword [ebp + 0x14]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], eax
test cl, 1
je 0x4549f7
test ebx, ebx
je 0x4549c5
push ebx
push edi
push dword [0x5bb8a0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x48], eax
test eax, eax
je 0x4549c0
push ebx
push dword [ebp + 0x10]
push eax
call fcn.00424ca0
add esp, 0xc
cmp dword [esi + 0x48], edi
je 0x4549ee
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push 0x454a0f
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4549e9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x454a04
cmp dword [ebp + 0xc], edi
jne 0x454a04
push esi
call fcn.004536fc
pop ecx
jmp 0x454a06
mov eax, dword [ebp + 0x10]
push esi
mov dword [esi + 0x48], eax
call fcn.00454503
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0x18

Function at 0x454bd7
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x454b2a
push 0x10
push 0x2c
call fcn.0046b721
push 0
push 0
push 8
mov dword [0x5bcefc], eax
call fcn.0046b082
cmp word [0x5bcef4], 0
mov dword [0x5be038], eax
jne 0x454cb7
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
push str.ws2_32.dll
sbb eax, eax
inc eax
mov word [0x5bcef4], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x5bcf00], eax
test eax, eax
je 0x454cb7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x577bc8
push eax
call esi
push 0x577bd4
push dword [0x5bcf00]
mov dword [0x5bcee4], eax
call esi
push str.getnameinfo
push dword [0x5bcf00]
mov dword [0x5bcee8], eax
call esi
push str.WSAStringToAddressA
push dword [0x5bcf00]
mov dword [0x5bceec], eax
call esi
cmp dword [0x5bcee4], 0
mov ecx, eax
mov dword [0x5bcef0], ecx
pop esi
je 0x454cb7
cmp dword [0x5bcee8], 0
je 0x454cb7
cmp dword [0x5bceec], 0
je 0x454cb7
mov eax, dword [0x5bcef8]
xor edx, edx
inc edx
test ecx, ecx
cmovne eax, edx
mov dword [0x5bcef8], eax
add esp, 0x190
ret
Function at 0x4568c3
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x5be048]
call fcn.0046b64f
mov ebx, eax
test ebx, ebx
je 0x456927
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4568ec
push dword [esp + 0xc]
push ebx
call eax
jmp 0x456927
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.0046bd10
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.0041674d
pop ecx
sub edi, eax
push edi
call fcn.0046bda0
pop edi
pop esi
pop ebx
ret 8
Function at 0x45a369
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor edi, edi
push edi
push edi
push 0x147
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x45a3f8
push 0xfffffffffffffff0
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
jne 0x45a3f8
push esi
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push edi
push dword [0x5bb8a0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea ecx, [esi + 1]
push ecx
xor eax, eax
push edi
mov word [edi], ax
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
or esi, 0xffffffff
push esi
push 0x158
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push dword [0x5bb8a0]
cmp eax, esi
cmove ebx, esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
mov eax, ebx
pop ebp
cdq
pop ebx
ret 4

Function at 0x45b0f9
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x5be040]
call fcn.0046b017
xor ebx, ebx
mov esi, eax
cmp dword [0x5bd6d4], ebx
jne 0x45b1cb
xor ebp, ebp
inc ebp
mov dword [0x5bd6d4], ebp
call fcn.00460916
mov edi, 0xa8
push edi
push ebx
push 0x5bd628
call fcn.00421520
add esp, 0xc
mov dword [0x5bd628], 0x13
lea eax, [esp + 0x10]
mov dword [0x5bd62c], edi
mov dword [0x5bd638], 0x45b044
mov dword [0x5bd63c], 0x45b389
push eax
mov dword [0x5bd690], 0x45b01c
mov dword [0x5bd694], 0x45b2ce
mov dword [0x5bd634], 0x45aff7
mov dword [0x5bd6b8], 0x45b061
mov dword [0x5bd6d8], ebp
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45b1cb
cmp dword [esp + 0x20], ebp
je 0x45b1c5
cmp dword [esp + 0x20], 2
jne 0x45b1cb
cmp dword [esp + 0x14], 5
jb 0x45b1c5
jne 0x45b1cb
cmp dword [esp + 0x18], ebx
jne 0x45b1cb
mov dword [0x5bd6d8], ebx
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.00462dcf
mov eax, dword [esp + 0x140]
push ebx
push dword [0x5bb8a4]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebx
push str.BUTTON
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x45b29f
mov ebp, dword [esp + 0x128]
push ebp
push dword [0x5be048]
call fcn.0046b68d
mov esi, dword [esp + 0x13c]
mov ebx, eax
mov dword [ebx + 0x10], esi
test esi, esi
je 0x45b270
push esi
call fcn.00466422
test eax, eax
je 0x45b270
push 0
push 0
push esi
call fcn.00466083
jmp 0x45b272
xor eax, eax
push 0x45ad4e
push 0xfffffffffffffffc
mov dword [ebx + 0x18], eax
and dword [ebx + 0x14], 0
and dword [ebx + 0x1c], 0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x5bd628
push edi
push ebx
push ebp
mov dword [0x5bd6d0], eax
call fcn.0045f8ea
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x46112a
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x461293
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x461276
sub eax, 1
jne 0x461293
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.004610e3
pop ecx
test eax, eax
je 0x4611a1
cmp byte [esp + 0x23a], 1
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
jne 0x4611d7
inc edi
jmp 0x4611d7
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x461293
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x14]
inc edx
cmp byte [esp + 0x356], dl
cmove edi, edx
sub ecx, 3
je 0x461272
sub ecx, 1
je 0x46126e
sub ecx, 1
je 0x461250
sub ecx, 1
je 0x461214
sub ecx, 4
jne 0x461293
test eax, eax
jne 0x461293
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x461293
sub eax, 0
je 0x461243
sub eax, 1
je 0x461236
sub eax, 1
je 0x46122f
sub eax, 1
jne 0x461293
push 0x69
pop esi
push 0x64
jmp 0x461248
push 0x5a
pop esi
push 0x5f
jmp 0x46123b
push 0x50
pop esi
push 0x55
test edi, edi
pop eax
cmove esi, eax
jmp 0x461293
push 0x4b
pop esi
push 0x46
test edi, edi
pop eax
cmovne esi, eax
jmp 0x461293
sub eax, 0
je 0x46126a
sub eax, 1
je 0x461266
sub eax, 1
jne 0x461293
push 0x41
pop esi
push 0x3c
jmp 0x461248
push 0x3c
jmp 0x461292
push 0x32
jmp 0x461292
push 0x14
jmp 0x461292
push 5
jmp 0x461292
mov eax, dword [esp + 0x14]
test eax, eax
je 0x461290
cmp eax, 0xa
je 0x46128c
cmp eax, 0x5a
jne 0x461293
push 0x28
jmp 0x461292
push 0x1e
jmp 0x461292
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x46168f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x5be074]
call fcn.0046b64f
mov esi, eax
test esi, esi
je 0x46176b
cmp dword [ebp + 0xc], 0
je 0x4616db
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x4616cc
cmp dword [esi + 0x1c], 0
jne 0x4616cc
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x46176b
test byte [ebp + 0x10], 3
push ebx
push 4
pop ebx
je 0x4616f9
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.00461e99
cmp dword [esi + 0x3c], 0xffffffff
je 0x46171d
xor eax, eax
cmp dword [esi + 0x3c], 0x1000000
sete al
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x461735
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
mov eax, dword [ebp + 8]
test dword [ebp + 0x10], 0x2000000
je 0x461750
test eax, eax
je 0x461746
push 8
jmp 0x461756
push 7
test ecx, ecx
pop eax
cmovne ebx, eax
jmp 0x461761
test eax, eax
je 0x461759
push 3
pop ebx
jmp 0x461761
xor ebx, ebx
test ecx, ecx
setne bl
inc ebx
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x462019
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4620af
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4620ac
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4620ac
lea eax, [esi - 1]
push eax
push dword [0x5be074]
call fcn.0046b64f
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4620ae
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x46209c
mov edx, 0xfa01
cmp word [ecx], dx
je 0x4620a7
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x46208c
jmp 0x4620ac
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x462155
push eax
call esi
test al, al
jns 0x462155
push 0x11
call esi
test al, al
js 0x462155
push 0x10
call esi
test al, al
js 0x462155
push 0x12
call esi
test al, al
js 0x462155
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x462155
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.00417e51
add esp, 0xc
test eax, eax
je 0x462129
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.00417e51
add esp, 0xc
test eax, eax
jne 0x462140
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x462196
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call fcn.005403f4
pop ecx
pop ecx
test eax, eax
je 0x462196
test ebp, ebp
je 0x462179
push 0x11
call esi
test al, al
js 0x462171
push 0x10
call esi
test al, al
js 0x462171
push 0x12
call esi
test al, al
jns 0x462179
push 1
push ebp
call fcn.004621a2
test ebx, ebx
je 0x46218d
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x462196
test edi, edi
je 0x462196
mov eax, dword [edi + 8]
jmp 0x462198
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x4630c0
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x463208
xor ecx, ecx
cmp word [eax], cx
je 0x463208
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00533bb8
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call fcn.0041674d
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x463119
cmp eax, 3
jne 0x463153
cmp word [esp + 0xa], 0x3a
jne 0x463153
cmp eax, 2
jne 0x463137
lea eax, [esp + 8]
push 0x55d398
push eax
call fcn.00533bf8
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x463208
push 0xfffffffffffffffe
pop edi
jmp 0x463208
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x463168
cmp ax, bx
jne 0x463172
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x46315b
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x4631b1
test byte [esp + 0x21c], 0x10
je 0x463198
push 0xfffffffffffffffe
pop edi
jmp 0x4631a8
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x463206
cmp word [esp + 0x10], bp
jne 0x4631bf
cmp word [esp + 0x12], bp
je 0x4631de
cmp word [esp + 0x10], bx
jne 0x4631cd
cmp word [esp + 0x12], bx
je 0x4631de
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x463206
cmp word [esp + 0x12], ax
jne 0x463206
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x4631f3
test al, 0x10
je 0x463206
jmp 0x463203
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x463206
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x463217
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x463237
cmp dword [esp + 8], 0
je 0x463237
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x463239
xor eax, eax
ret 8

Function at 0x463255
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x46327e
test byte [esp + 8], 2
je 0x463272
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x463280
xor eax, eax
ret 8
Function at 0x463313
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebx
mov ebx, eax
mov eax, dword [0x5bda50]
push esi
push edi
test eax, eax
jne 0x463339
push 0x463442
push 0x10
push 0x258
call fcn.0046b721
mov dword [0x5bda50], eax
mov edi, dword [esp + 0x10]
push edi
push eax
call fcn.0046b68d
mov esi, eax
test esi, esi
je 0x46343a
cmp dword [esp + 0x14], ebx
mov eax, 0x560268
push ebp
cmovne eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x463371
xor ecx, ecx
cmp word [ebp], cx
jne 0x46337a
mov ebp, 0x5786f4
mov dword [esp + 0x1c], ebp
push eax
call fcn.0041674d
push ebp
mov dword [esp + 0x20], eax
call fcn.0041674d
add eax, dword [esp + 0x20]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x5bb8a0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x463427
push dword [esp + 0x14]
push ebp
call fcn.00533b96
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4633da
mov eax, dword [esp + 0x14]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x4633da
push 0x55d398
push ebp
call fcn.00533bf8
pop ecx
pop ecx
push dword [esp + 0x1c]
push ebp
call fcn.00533bf8
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4633ff
xor ecx, ecx
mov dword [esi + 4], ecx
jmp 0x463413
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
jne 0x463415
mov dword [esi + 4], 1
mov ebx, esi
push ebp
push ecx
push dword [0x5bb8a0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x463439
cmp edi, 0xffffffff
cmove edi, esi
push edi
push dword [0x5bda50]
call fcn.0046b600
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0xc

Function at 0x463585
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x4635fd
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.00533bb8
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041674d
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x4635de
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x4635db
cmp ecx, 0x5c
je 0x4635db
cmp ecx, 0x2f
jne 0x4635e8
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x4635c8
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4635ff
xor eax, eax
leave
ret 4
Function at 0x463610
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
jne 0x463629
push dword [0x5be0b0]
call fcn.0046b13a
pop edi
ret 4
push esi
push edi
push dword [0x5be0b0]
call fcn.0046b64f
mov esi, eax
test esi, esi
je 0x463693
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x46367f
cmp dword [esi + 0x14], 0
mov dword [esp + 0xc], 0
jne 0x46366e
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
push dword [esi + 4]
push 0
push dword [0x5bb8a0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0x5be0b0]
call fcn.0046b600
pop esi
pop edi
ret 4

Function at 0x4636a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x4636dc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x4639c0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x463abe
cmp word [edx], 0
je 0x463abe
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x4639ee
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x463a44
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463a00
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x463a26
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00463b40
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
push edx
xor edx, edx
mov eax, 0xfde9
cmp ecx, 2
cmovne eax, edx
push eax
call fcn.00463c60
mov edi, eax
test edi, edi
je 0x463a3a
cmp dword [esi + 4], 0
je 0x463a91
push dword [esp + 0x14]
push edi
push esi
call fcn.00463b40
push edi
push 0
push dword [0x5bb8a0]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x5bb8a0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x463b40
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x1c], 0
jne 0x463c57
cmp dword [edi + 0x14], 1
push ebx
push ebp
jne 0x463b8d
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x10]
push 1
neg eax
cdq
push ecx
push eax
push dword [edi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
push esi
mov esi, dword [esp + 0x24]
cmp eax, esi
jle 0x463c16
mov ecx, dword [edi + 4]
sub ecx, eax
mov eax, esi
add ecx, dword [edi + 8]
sub eax, 1
je 0x463bff
sub eax, 1
je 0x463be6
sub eax, 2
je 0x463bcf
push esi
push dword [esp + 0x24]
push ecx
call fcn.00424ca0
add esp, 0xc
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov ax, word [eax]
mov word [ecx], ax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov al, byte [eax]
mov byte [ecx], al
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
push edi
call fcn.004636a0
mov eax, dword [edi + 8]
cmp esi, eax
jl 0x463c45
push 0
lea eax, [esp + 0x20]
push eax
push esi
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov ecx, dword [edi + 4]
sub ecx, dword [edi + 0xc]
push esi
push dword [esp + 0x24]
add ecx, eax
jmp 0x463bb7
xor eax, eax
pop edi
add esp, 8
ret 0xc

Function at 0x464ac2
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x464b38
cmp dword [esp + 8], esi
push ebx
push ebp
mov ebx, 0x560268
cmovne ebx, dword [esp + 0x10]
push edi
push ebx
call fcn.0041674d
pop ecx
lea ebp, [eax*2 + 2]
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x464b2f
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x464b2f
push ebp
push ebx
push eax
call fcn.00424ca0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
ret 4