joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45143c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push ebx
push esi
push edi
mov edi, 0x4db494
mov esi, eax
mov ecx, edi
call fcn.004016a0
mov eax, dword [0x4db494]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x4db494]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
xor ebx, ebx
push 0x18e
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1a2]
push ebx
push eax
mov word [ebp - 0x1a4], bx
call fcn.004883c0
add esp, 0xc
lea edi, [ebp - 0x10]
call fcn.004468d2
mov edi, esi
call fcn.0040206d
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x451533
lea eax, [ebp - 0x1a4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x451533
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00451604
lea edi, [ebp - 8]
call fcn.0040206d
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], ebx
je 0x451533
mov edi, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004518fb
cmp eax, ebx
jne 0x451533
push dword [ebp - 0xc]
lea ebx, [ebp + 8]
call fcn.00451552
mov edi, esi
call fcn.0040206d
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x451533
push eax
call fcn.0044693b
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040151c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x4517f7
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9c
push esi
push 0x9a
lea eax, [ebp - 0x23]
push 0
push eax
mov byte [ebp - 0x24], 0
call fcn.004883c0
add esp, 0xc
push 0x9b
lea eax, [ebp - 0x24]
push eax
xor esi, esi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x451844
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x451844
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x45184c
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
xor esi, esi
mov dword [ebp - 4], 0x288
push dword [ebp - 4]
call fcn.0048732f
mov edi, eax
test edi, edi
pop ecx
je 0x451899
push dword [ebp - 4]
push 0
push edi
call fcn.004883c0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov esi, eax
cmp esi, 0x6f
jne 0x45189f
push edi
call fcn.0048843a
pop ecx
xor edi, edi
inc ebx
cmp ebx, 2
jl 0x451862
test esi, esi
jne 0x4518e6
test edi, edi
mov esi, edi
je 0x4518f1
push 6
lea eax, [esi + 0x10c]
push str.vmware
push eax
call fcn.004906aa
add esp, 0xc
test eax, eax
jne 0x4518cb
mov esi, dword [esi]
test esi, esi
jne 0x4518a9
jmp 0x4518e6
push 8
add esi, 0x194
push esi
push dword [ebp + 8]
call fcn.00489cd0
add esp, 0xc
mov dword [ebp - 8], 1
test edi, edi
je 0x4518f1
push edi
call fcn.0048843a
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4519e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x19c
push esi
push edi
push 0x7f
lea eax, [ebp - 0x23]
push 0
push eax
mov dword [ebp + 0x5c], 1
mov dword [ebp + 0x60], 2
mov dword [ebp + 0x64], 3
mov dword [ebp + 0x68], 4
mov dword [ebp + 0x6c], 5
mov byte [ebp - 0x24], 0
call fcn.004883c0
add esp, 0xc
push str.mo:_72Bilrqgb8ls5kn8z
lea esi, [ebp - 0xa8]
call fcn.004268c3
mov edi, dword [eax]
test edi, edi
je 0x451a71
push edi
call fcn.0048a3c0
xor esi, esi
test eax, eax
pop ecx
mov dword [ebp + 0x70], eax
jle 0x451a71
lea eax, [ebp - 0x24]
sub edi, eax
push ebx
mov eax, esi
cdq
push 5
pop ebx
idiv ebx
lea ecx, [ebp + esi - 0x24]
mov al, byte [ebp + edx*4 + 0x5c]
xor al, byte [edi + ecx]
inc esi
cmp esi, dword [ebp + 0x70]
mov byte [ecx], al
jl 0x451a55
pop ebx
lea eax, [ebp - 0xa4]
cmp dword [ebp - 0xa8], eax
je 0x451a8b
push dword [ebp - 0xa8]
call fcn.00488d99
pop ecx
lea eax, [ebp - 0x24]
push eax
lea esi, [ebp - 0x128]
call fcn.004020ae
push dword [eax]
mov eax, dword [ebp + 0x7c]
call fcn.00401989
lea eax, [ebp - 0x124]
cmp dword [ebp - 0x128], eax
pop edi
pop esi
je 0x451ac0
push dword [ebp - 0x128]
call fcn.00488d99
pop ecx
mov eax, dword [ebp + 0x7c]
add ebp, 0x74
leave
ret
Function at 0x451f3c
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x451fb3
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
je 0x451fb3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], esi
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fchs
faddp st(1)
fmul qword [0x4c6208]
fcomp qword [0x4c61e0]
fnstsw ax
test ah, 1
jne 0x451fb3
inc esi
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x4520b4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
and word [ebp - 0x400], 0
push 0x3fe
lea eax, [ebp - 0x3fe]
push 0
push eax
call fcn.004883c0
add esp, 0xc
push dword [esi]
lea eax, [ebp - 0x400]
push 0x200
push eax
push str.http:__wpa.b.qq.com_cgi_wpa.php_ln1keyXzgwMDA0MjEwMF8yMzc1NzlfODAwMDQyMTAwXzJf
push str.MarketQQLink
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
lea eax, [ebp - 0x400]
push eax
mov eax, dword [ebp + 8]
call fcn.00401989
mov eax, dword [ebp + 8]
leave
ret 4
Function at 0x45280b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
xor esi, esi
push 0x208
lea eax, [ebp - 0x21a]
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov word [ebp - 0x21c], si
call fcn.004883c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x20019
push esi
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0x104
mov dword [ebp - 0xc], esi
call ebx
cmp eax, esi
jne 0x452910
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push str.Install_Path_Dir
lea eax, [ebp - 8]
push eax
lea esi, [ebp - 4]
lea edi, [ebp - 0x21c]
call fcn.0041121f
test eax, eax
jne 0x452910
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, edi
push eax
lea eax, [ebp - 4]
call fcn.00401989
push str.liebao.exe
lea eax, [ebp - 4]
push eax
call fcn.00405235
push dword [ebp - 4]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x4528e2
mov eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.00401aed
push str.LBBrowserliebao.exe
lea eax, [ebp - 4]
push eax
call fcn.00405235
push dword [ebp - 4]
call esi
test eax, eax
je 0x4528e9
mov dword [ebp - 0x10], 1
xor esi, esi
cmp dword [ebp - 0xc], esi
je 0x4528fc
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], esi
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.0040151c
cmp dword [ebp - 0x10], esi
jne 0x4529ba
push 0x20a
xor esi, esi
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.004883c0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallliebao
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0x104
mov dword [ebp - 0xc], esi
call ebx
cmp eax, esi
jne 0x4529ba
xor eax, eax
cmp dword [ebp - 8], esi
je 0x45295b
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
jne 0x4529ba
push str.UninstallString
lea eax, [ebp - 8]
push eax
lea esi, [ebp - 4]
lea edi, [ebp - 0x21c]
call fcn.0041121f
test eax, eax
jne 0x4529ba
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.liebao.exe
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4529ab
mov dword [ebp - 0x10], 1
test ebx, ebx
je 0x4529c9
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 8], 0
cmp dword [ebp - 8], 0
je 0x4529c9
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4529d1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 8], ebx
mov word [ebp - 0x218], bx
call fcn.004883c0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SOFTWAREBaiduBaiduPlayer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x452a6f
mov eax, dword [ebp - 4]
push esi
push edi
mov dword [ebp - 0xc], eax
push str.InstallExe
lea eax, [ebp - 0xc]
push eax
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x218]
call fcn.0041121f
test eax, eax
pop edi
pop esi
jne 0x452a61
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x452a61
mov dword [ebp - 8], 1
cmp dword [ebp - 4], ebx
je 0x452a6f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop ebx
leave
ret
Function at 0x452c71
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
and dword [esp + 4], 0
push ebx
mov ebx, dword [0x4db428]
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0xc
mov esi, eax
call edi
push eax
push 0xb
call edi
push eax
push 1
mov edi, 0x80
push edi
push ebx
call dword [sym.imp.USER32.dll_LoadImageW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, eax
push ebp
push 1
push edi
push dword [esi + 4]
call ebx
push ebp
xor ebp, ebp
push ebp
push edi
push dword [esi + 4]
call ebx
push str.1509
mov edi, 0x4dc7dc
push edi
call fcn.0040c977
test eax, eax
je 0x452ce3
push str.1335
push edi
call fcn.0040c977
test eax, eax
jne 0x452d1f
push 0x19
call fcn.004254a5
test eax, eax
pop ecx
jne 0x452d17
push 0x10
call fcn.004254a5
test eax, eax
pop ecx
jne 0x452d17
push ecx
call fcn.00439bf2
mov edi, esp
call fcn.00447643
call fcn.004255d4
test eax, eax
pop ecx
je 0x452d17
xor eax, eax
inc eax
jmp 0x452d19
xor eax, eax
mov dword [esi + 0x7f0], eax
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 8
push eax
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 3
push ebp
push ebp
push ebp
push ebp
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [esi + 0x7f4]
push eax
lea edi, [esi + 0x24]
push 0x12d
mov eax, edi
call fcn.00455171
push ebp
push 0x1e
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [esi + 0x388]
push eax
push 0x67
mov eax, edi
call fcn.00455171
mov eax, esi
call fcn.00452ae9
test eax, eax
je 0x452d94
mov dword [esp + 0x14], 1
push 0xc
call fcn.0046c752
cmp eax, ebp
pop ecx
jne 0x452da4
xor esi, esi
jmp 0x452dc8
push ebp
push ebp
push eax
push 0x41de5d
push ebp
push ebp
mov dword [eax], vtable.KAvVirusDetect.0
mov dword [eax + 8], ebp
mov dword [eax + 4], 0x41ddc9
call fcn.0048ad3c
add esp, 0x18
mov esi, eax
mov eax, dword [0x4d7cc8]
cmp eax, ebp
je 0x452dd8
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x14]
pop edi
mov dword [0x4d7cc8], esi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4

Function at 0x453b7e
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push str.initInfoc...
mov esi, 0x4dc90c
call fcn.0044866c
pop ecx
push 0x32
call fcn.0046c752
mov edi, eax
test edi, edi
pop ecx
je 0x453bac
call fcn.0047d176
mov dword [edi], vtable.KInstallBlock.0
jmp 0x453bae
xor edi, edi
call fcn.00424d1d
test edi, edi
mov dword [0x4dc82c], eax
je 0x453c0a
push 0xc
call fcn.0046c752
test eax, eax
pop ecx
jne 0x453bcc
xor edi, edi
jmp 0x453bf4
push 0
push 0
push eax
push 0x41de5d
push 0
push 0
mov dword [eax], vtable.KEvent.0
mov dword [eax + 8], edi
mov dword [eax + 4], 0x451ac8
call fcn.0048ad3c
add esp, 0x18
mov edi, eax
mov eax, dword [0x4d7cdc]
test eax, eax
je 0x453c04
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x4d7cdc], edi
push str.initInfoc_end
call fcn.0044866c
pop ecx
pop edi
pop esi
pop ecx
ret
Function at 0x453c19
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
push edi
push 0
push 0xcc
lea eax, [esi + 0x24]
call fcn.004550d6
push dword [esi + 0x73c]
push dword [esi + 0x7bc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edi, [esp + 8]
mov eax, esi
call fcn.00454378
push 1
lea edi, [esi + 0x794]
push edi
call fcn.0041daa2
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x7bc]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
add esp, 0x18
ret

Function at 0x453cea
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 0x7bc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x453d69
mov eax, dword [0x4db494]
mov ecx, 0x4db494
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea edi, [esi + 0x790]
lea eax, [ebp - 8]
call fcn.0044d56a
lea ecx, [esi + 0x384]
mov eax, dword [ecx]
lea edx, [ebp - 8]
push edx
call dword [eax]
test eax, eax
jne 0x453d50
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040151c
jmp 0x453e91
lea edi, [esi + 0x73c]
lea eax, [ebp - 8]
call fcn.0040206d
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040151c
lea edi, [esi + 0x73c]
mov eax, dword [edi]
push 3
pop ebx
cmp dword [eax - 0xc], ebx
jle 0x453d9c
mov ecx, ebx
lea edx, [ebp - 8]
mov eax, edi
mov dword [ebp - 0xc], 1
call fcn.00401a63
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, ebx
mov byte [ebp - 1], 0
je 0x453da0
mov byte [ebp - 1], 1
test byte [ebp - 0xc], 1
je 0x453db1
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040151c
cmp byte [ebp - 1], 0
je 0x453df3
mov eax, 0xe0000021
call fcn.004245b3
push 2
push 2
push 0x4b6ff8
push 0
push 0x4c2018
call fcn.00403152
add esp, 0x14
mov eax, esi
call fcn.0045464c
push dword [esi + 4]
lea edi, [esi + 0x398]
call fcn.0044cf41
jmp 0x453e91
mov ecx, ebx
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.00401a63
push dword [eax]
call fcn.00451f3c
mov ebx, eax
mov eax, dword [ebp - 0xc]
neg ebx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.0040151c
test bl, bl
je 0x453e5a
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.00453c72
mov eax, dword [eax]
push 2
push 3
push 0x4c2038
push 0x4b7040
push eax
call fcn.00403152
mov ebx, eax
mov eax, dword [ebp - 0xc]
add esp, 0x14
add eax, 0xfffffff0
call fcn.0040151c
test bl, 1
jne 0x453e5a
call fcn.00453c19
jmp 0x453e91
push dword [edi]
call fcn.0042291d
test eax, eax
pop ecx
jne 0x453e8a
mov eax, 0xe0000021
call fcn.004245b3
push 2
push 2
push 0x4b6ff8
push 0
push 0x4c2018
call fcn.00403152
add esp, 0x14
jmp 0x453e91
mov dword [ebp - 0x10], 1
mov eax, esi
call fcn.0045464c
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x453ea0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4db494]
push esi
push edi
mov ecx, 0x4db494
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
lea edi, [ebx + 0x790]
lea eax, [ebp - 4]
call fcn.0044d56a
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], 0
je 0x453f3b
lea edi, [ebx + 0x73c]
lea eax, [ebp - 4]
call fcn.0040206d
mov eax, edi
call fcn.00405111
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
lea edx, [ebp - 8]
mov eax, edi
call fcn.00401a63
push dword [eax]
lea ecx, [ebx + 0x24]
mov esi, 0xcc
push esi
mov eax, ecx
call fcn.00454f14
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040151c
push dword [edi]
lea edi, [ebx + 0x24]
push 0x4b7c60
push esi
push edi
call fcn.00454fc1
push 0
push dword [ebx + 0x794]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push esi
mov eax, edi
call fcn.004550d6
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.0040151c
pop edi
xor eax, eax
pop esi
leave
ret

Function at 0x454742
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
push esi
push edi
sub eax, 0x10
mov esi, ecx
call fcn.00401648
mov edi, dword [ebp + 8]
add eax, 0x10
push eax
mov dword [edi], eax
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45477c
mov eax, edi
inc bl
call fcn.0045495f
test eax, eax
je 0x454788
jmp 0x4547de
push dword [edi]
call fcn.0042291d
test eax, eax
pop ecx
jne 0x4547d6
mov eax, dword [0x4db494]
mov ecx, 0x4db494
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
push edi
lea eax, [ebp + 0xc]
call fcn.004547e7
test eax, eax
je 0x4547c7
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.00454742
call fcn.0040206d
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040151c
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.0040151c
test bl, bl
jne 0x4547de
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4548c1
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xc8
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, esi
call fcn.0040206d
mov eax, dword [esi]
cmp dword [eax - 0xc], 1
jge 0x4548e5
xor eax, eax
jmp 0x45493b
push ebx
xor ecx, ecx
mov eax, edi
call fcn.00425c1e
push 0x64
mov bl, al
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.004883c0
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0x64
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
cmp word [ebp - 0x50], 0
lea esi, [ebp - 0x50]
je 0x454938
movzx eax, word [ebp - 0x50]
movsx ebx, bl
movzx eax, ax
cmp eax, ebx
jg 0x454942
push esi
call fcn.004886c1
lea esi, [esi + eax*2 + 2]
movzx eax, word [esi]
test ax, ax
pop ecx
jne 0x45491e
xor eax, eax
pop ebx
pop edi
pop esi
add ebp, 0x78
leave
ret
xor ecx, ecx
mov eax, edi
call fcn.00425c1e
movzx ecx, word [esi]
movzx eax, ax
push ecx
push eax
mov eax, edi
call fcn.00425b1b
xor eax, eax
inc eax
jmp 0x45493a
Function at 0x45495f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [eax]
push ebx
push esi
push edi
sub eax, 0x10
call fcn.00401648
add eax, 0x10
push 0x5c
lea edi, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.004058d3
push str._test.txt
mov eax, edi
push eax
call fcn.0044898c
mov ebx, dword [ebp - 4]
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4549ce
call esi
cmp eax, 0x50
je 0x4549ce
xor esi, esi
lea eax, [ebx - 0x10]
call fcn.0040151c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
call esi
cmp eax, 0x50
je 0x4549db
call esi
test eax, eax
jne 0x4549ee
cmp edi, 0xffffffff
je 0x4549e7
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor esi, esi
inc esi
jmp 0x4549bf
Function at 0x45519b
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [0x4dc3a0]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], ebp
je 0x4551b8
mov esi, dword [eax + 4]
jmp 0x4551ba
xor esi, esi
cmp esi, ebp
jne 0x4551ca
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
cmp esi, ebp
je 0x4551ef
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x4551ef
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4551ef
push ebp
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push ecx
mov eax, esp
mov dword [edi + 0x378], ebp
push esi
mov ebx, edi
mov dword [eax], ebp
call fcn.00455ce2
mov ebx, eax
cmp ebx, ebp
jne 0x455218
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x4552f4
mov edx, ebx
call fcn.0040abb7
mov dword [esp + 0x20], eax
lea eax, [edi + 4]
push eax
mov eax, esi
call fcn.0040aa6a
cmp dword [edi + 0x36c], ebp
je 0x4552a2
push ebp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push ebp
push ebp
push ebp
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push ebp
push ebp
push ebp
push ebp
push ebp
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x14]
je 0x455285
push 1
push eax
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x14]
je 0x4552a2
push ebp
push eax
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
call fcn.0043cb35
push 0x97
push ebp
lea ebx, [edi + 4]
push ebx
mov dword [edi + 0x378], ebp
call fcn.0041dc9b
cmp dword [esp + 0x1c], ebp
je 0x4552e0
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp esi, ebp
je 0x4552e0
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx]
jne 0x4552e0
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x20]
call fcn.0040abb7
push dword [ebx]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4567ef
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x28]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x45683b
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0xfc]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x45683b
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x1d0]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
cmp dword [esi + 0x2c0], 0
je 0x4568b3
lea ebx, [esi + 0x2cc]
cmp dword [ebx], 0
je 0x456858
call dword [sym.imp.USER32.dll_ReleaseCapture]
and dword [ebx], 0
cmp dword [esi + 0x2c0], edi
jne 0x4568ac
push edi
call fcn.0041d7b3
mov edi, eax
movzx eax, word [ebp + 0x10]
pop ecx
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x205
call fcn.0041d9f5
mov eax, dword [esi + 4]
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xd
mov dword [ebp - 0x14], eax
mov ecx, dword [edi + 0x10]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x14]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [esi + 0x2c0], 0
pop edi
pop ebx
leave
ret 0xc