joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446f45
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x100
push ebx
push esi
mov esi, dword [esp + 0x10c]
test eax, 0x200
je 0x446f63
or dword [esi + 0x10], 8
test eax, 0x400
je 0x446f6e
or dword [esi + 0x10], 1
test eax, 0x100
je 0x446f79
or dword [esi + 0x10], 2
mov eax, dword [esi + 0x10]
test al, 8
je 0x446f8d
test eax, 0x800
je 0x446f8d
xor eax, 8
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test al, 1
je 0x446fa1
test eax, 0x100
je 0x446fa1
xor eax, 1
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test al, 2
je 0x446fb5
test eax, 0x200
je 0x446fb5
xor eax, 2
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test al, 0x10
je 0x446fc9
test eax, 0x1000
je 0x446fc9
xor eax, 0x10
mov dword [esi + 0x10], eax
xor ebx, ebx
cmp dword [esi + 0x14], ebx
je 0x447027
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [esi + 0x10]
test eax, 0x800
jne 0x446fe9
mov byte [esp + 0x19], bl
test eax, 0x100
jne 0x446ff4
mov byte [esp + 0x1a], bl
test eax, 0x200
jne 0x447006
mov ecx, dword [esi + 0x20]
mov byte [esp + 0x18], bl
mov byte [esp + ecx + 8], bl
test eax, 0x1000
jne 0x447011
mov byte [esp + 0x63], bl
lea edx, [esp + 8]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
pop esi
pop ebx
add esp, 0x100
ret 8
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x447051
push 0x11
call ebp
mov edx, 0x8000
test dx, ax
je 0x447063
test dword [esi + 0x10], 0x800
jne 0x447063
push ebx
push 0x11
push esi
call fcn.004468e0
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
jne 0x44707f
push 0x12
call ebp
mov edx, 0x8000
test dx, ax
je 0x447091
test dword [esi + 0x10], 0x100
jne 0x447091
push ebx
push 0x12
push esi
call fcn.004468e0
mov eax, dword [esi + 0x20]
push eax
call edi
mov ecx, 0x8000
test cx, ax
jne 0x4470b1
mov edx, dword [esi + 0x20]
push edx
call ebp
mov ecx, 0x8000
test cx, ax
je 0x4470c5
test dword [esi + 0x10], 0x200
jne 0x4470c5
mov edx, dword [esi + 0x20]
push ebx
push edx
push esi
call fcn.004468e0
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
jne 0x4470e7
push 0xa1
call ebp
mov edx, 0x8000
test dx, ax
je 0x4470fc
test dword [esi + 0x10], 0x400
jne 0x4470fc
push ebx
push 0xa1
push esi
call fcn.004468e0
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
jne 0x447118
push 0x5b
call ebp
mov edx, 0x8000
test dx, ax
je 0x44712a
test dword [esi + 0x10], 0x1000
jne 0x44712a
push ebx
push 0x5b
push esi
call fcn.004468e0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x100
ret 8
Function at 0x447178
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [esp + 0x14], bl
je 0x4471df
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_keybd_event]
push 0
mov byte [esp + 0x20], al
mov eax, dword [esp + 0x20]
push 0
push eax
push esi
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0043975d
push 0
push esi
call edi
push 0
mov byte [esp + 0x20], al
mov edx, dword [esp + 0x20]
push 2
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
call fcn.00439774
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
ret 0xc

Function at 0x44724d
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
lea ecx, [eax + 4]
push edi
mov edi, dword [eax + edx]
mov dword [esi], ecx
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412c3a
mov ebx, eax
mov eax, dword [esi]
add eax, dword [esp + 0x18]
lea ebp, [edi + edi]
push ebp
push eax
push ebx
call fcn.00412490
add dword [esi], ebp
xor ecx, ecx
add esp, 0x10
xor eax, eax
mov word [ebx + ebp], cx
test edi, edi
jle 0x4472a9
xor word [ebx + eax*2], di
inc eax
cmp eax, edi
jl 0x4472a0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 8

Function at 0x44786c
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x447888
mov eax, dword [esp + 0x10]
cmp byte [eax + 5], 1
jne 0x4478e0
push 0
push 0
push 0xe
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jne 0x4478a0
mov edi, 0x7fff
push ebp
xor ecx, ecx
lea ebp, [edi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412c3a
add esp, 4
mov esi, eax
push esi
push ebp
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov word [esi + edi*2], cx
pop ebp
test eax, eax
jg 0x4478eb
push esi
call fcn.0041294d
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov edi, dword [esp + 0x10]
cmp byte [edi + 0xc], 0
jne 0x447906
push esi
call fcn.004127f5
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [edi + 0x24]
push eax
push esi
call fcn.00414c82
add esp, 8
push esi
test eax, eax
je 0x4478d8
mov byte [edi + 0xf0], 1
call fcn.0041294d
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x447e4c
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
push edi
push 1
push eax
call fcn.00447a91
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x25
call ebx
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x18], 0
push eax
jge 0x447eaf
mov ecx, dword [esi]
push 0x25
push 0x100
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov edx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
push 0x101
push edx
jmp 0x447ede
mov eax, dword [esi]
push 0x27
push 0x100
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov ecx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push ecx
call ebp
push 0
call edi
mov edx, dword [esi]
push 0
push edx
call fcn.00447a91
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x4499c3
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
push 0x4a5e00
call fcn.00435cba
mov ecx, dword [0x4a5e60]
mov edx, dword [ecx + eax*4]
mov edi, dword [edx]
cmp ebx, esi
jne 0x449a4a
cmp dword [edi + 0x194], 0
je 0x449a26
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edi + 0x194]
push 0
push esi
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
movzx edx, word [esp + 0x28]
movzx eax, word [esp + 0x24]
shl edx, 0x10
or edx, eax
push edx
push ebx
push 0x7b
push esi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
push ebx
push 0x4a5e00
call fcn.0044406d
mov ebp, eax
cmp ebp, 0xffffffff
je 0x449a26
mov ecx, dword [0x4a5e74]
mov edx, dword [ecx + ebp*4]
mov ecx, dword [edx]
mov al, byte [ecx + 0x88]
cmp al, 0xe
je 0x449a26
cmp al, 0xf
je 0x449a26
cmp al, 0x13
je 0x449a26
cmp al, 0x10
je 0x449a26
cmp dword [ecx + 8], 0
je 0x449a26
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push ecx
mov ecx, dword [0x4a5e74]
push edx
mov edx, dword [ecx + ebp*4]
push eax
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x44aed3
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
push 0x4a5e00
call fcn.00443fe7
test al, al
je case.0x44af5c.8
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4a5e60]
mov edx, dword [ecx + eax*4]
mov eax, dword [esp + 0x14]
mov ebx, dword [edx]
mov ecx, dword [0x4a5e74]
mov edx, dword [ecx + eax*4]
mov esi, dword [edx]
mov al, byte [esi + 0x88]
mov edi, dword [esi]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x24], al
call fcn.0043774f
mov eax, dword [esi + 0x44]
add esp, 4
test eax, eax
jl 0x44af43
push eax
call fcn.00443899
movzx eax, byte [esp + 0x20]
cmp eax, 0x1b
ja case.0x44af5c.8
movzx edx, byte [eax + 0x44b103]
mov ebp, dword [esp + 0x24]
jmp dword [edx*4 + 0x44b0df]
mov ebp, dword [esp + 0x24]
cmp ebp, 0xfffffffe
je case.0x44af5c.8
cmp ebp, 0xfe000000
jne 0x44af88
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.00443926
jmp 0x44b0a7
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push 0
push 0x1001
push edi
call ebx
push ebp
push 0
push 0x1026
push edi
call ebx
mov eax, dword [esp + 0x18]
push 1
push esi
push eax
call fcn.00435c24
jmp 0x44b0a7
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44af5c.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.00443926
jmp 0x44b0a7
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44af5c.8
push eax
push 0
push 0x2001
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44b0a7
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44af5c.8
push eax
push 0
push 0x111d
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44b0a7
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44af5c.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.00443926
mov ecx, dword [esi + 0x30]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x44b0a7
test ebp, ebp
jl case.0x44af5c.8
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.00443926
push 1
push esi
push ebx
call fcn.00435c24
jmp 0x44b0a7
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
jl case.0x44af5c.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.00443926
test byte [esi + 0x8a], 0x20
jne 0x44b0a7
mov edx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call edi
mov eax, dword [esi]
push 5
push eax
call edi
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [0x494ce4], 0
je 0x44b0c4
cmp byte [esp + 0x20], 8
jne 0x44b0c4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x44ca4f
Capabilities:
Connect to http server

Disassembly:
sub esp, 0xc
cmp byte [esp + 0x18], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
je 0x44ca7b
mov eax, dword [esp + 0x2c]
push eax
push esi
push edi
call fcn.0044c912
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
mov ebp, dword [edi + 0x54]
push 0
push 0
push ebx
push eax
push ecx
movzx ecx, word [esi + 0x78]
push ecx
push edx
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44cac0
push 0xdeadbeef
push 0x15
push edi
call fcn.00444685
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov esi, dword [esi + 0x60]
push ebp
push accept
push esi
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileW]
mov esi, eax
mov eax, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
test esi, esi
jne 0x44caee
push esi
push 0xdeadbeef
push 0x16
jmp 0x44cb37
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.WININET.dll_FtpGetFileSize]
mov edx, dword [esp + 0x28]
xor ecx, ecx
xor ebx, ebx
or ecx, eax
or edx, ebx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], edx
cmp byte [esp + 0x2c], bl
je 0x44cb31
push esi
push edi
call fcn.0044489c
mov bl, al
lea eax, [esp + 0x14]
push eax
call fcn.004364ee
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
push 1
push 0
push 0
push edi
call fcn.00444685
lea ecx, [esp + 0x14]
push ecx
mov bl, al
call fcn.004364ee
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret 0x10
Function at 0x44cb55
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
cmp dword [esi + 0x74], 4
push edi
mov edi, dword [esp + 0x40]
mov ebp, dword [edi + 0x54]
jne 0x44cb73
or ebp, 0x800000
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
push 0
push 0
push ebx
push eax
movzx eax, word [esi + 0x78]
push ecx
mov ecx, dword [edi + 4]
push eax
push edx
push ecx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44cbb5
push 0xdeadbeef
push 0xb
push edi
call fcn.00444685
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ecx, dword [esi + 0x60]
push ebp
push 0
push 0
push 0
push ecx
push 0
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
test ebx, ebx
jne 0x44cc03
push eax
push 0xdeadbeef
push 0xc
push edi
call fcn.00444685
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004364ee
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
cmp byte [esp + 0x48], 0
je 0x44cc12
push esi
push ebx
push edi
call fcn.004448c4
test ebp, 0x1000
je 0x44cc4d
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0x1f
push ebx
mov dword [esp + 0x54], 4
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [esp + 0x48], 0x100
push 4
lea eax, [esp + 0x4c]
push eax
push 0x1f
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x44ccfa
push ebx
call fcn.0043657c
cmp eax, 0xc8
jne 0x44ccfa
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x20]
push eax
push 5
push ebx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0x20
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea ecx, [esp + 0x18]
push ecx
call fcn.0041495c
add esp, 4
cmp byte [esp + 0x4c], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
je 0x44ccd6
push ebx
push edi
call fcn.0044489c
lea edx, [esp + 0x10]
push edx
mov bl, al
call fcn.004364ee
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 1
push 0
push 0
push edi
call fcn.00444685
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004364ee
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 0
push 0xdeadbeef
push 0xd
push edi
call fcn.00444685
lea ecx, [esp + 0x10]
push ecx
mov bl, al
call fcn.004364ee
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x2c
ret 0x10

Function at 0x44d0f5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp + 0xe4]
push esi
push edi
mov edi, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push eax
call fcn.0044504f
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00444fa9
xor esi, esi
test edi, edi
jbe 0x44d147
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call fcn.00445021
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44d135
pop edi
pop esi
pop ebx
add esp, 0xdc
ret 0xc
Function at 0x44d402
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
sub dword [0x49323c], 1
jne 0x44d411
call fcn.004451ff
mov ecx, dword [0x4a4d04]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a4d04], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
test edx, edx
jge 0x44d45a
fadd qword [0x48d260]
fmul qword [0x48d268]
pop ecx
ret

Function at 0x44d8a9
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44d8bb
push eax
call fcn.0044d754
mov eax, dword [esi + 0x24]
pop esi
test eax, eax
je 0x44d8cc
mov dword [esp + 4], eax
jmp fcn.0044d754
ret 4

Function at 0x44d8cf
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x20], 0
jne 0x44d8f9
push esi
call fcn.00437258
test al, al
je 0x44d8f9
mov eax, dword [esi + 8]
push eax
call fcn.00445668
add esp, 4
push eax
mov dword [esi + 0x20], eax
call fcn.0044d7c1
cmp dword [esi + 0x24], 0
jne 0x44d92c
push esi
call fcn.0043723c
test al, al
je 0x44d92c
push esi
call fcn.0043722c
test al, al
jne 0x44d92c
mov ecx, dword [esi + 0x10]
push ecx
call fcn.00445668
add esp, 4
mov dword [esi + 0x24], eax
pop esi
mov dword [esp + 4], eax
jmp fcn.0044d7c1
pop esi
ret 4

Function at 0x44dc25
Capabilities:
Delete directory
Delete file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x22c
lea eax, [esp + 0x20]
call fcn.00411340
lea eax, [esp + 0x20]
push eax
call fcn.0043864b
add esp, 4
test al, al
jne 0x44dc50
add esp, 0x22c
ret
push ebx
xor ebx, ebx
cmp byte [esp + 0x238], bl
jne 0x44dc74
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x24]
push edx
call fcn.004127f5
xor ecx, ecx
mov word [esp + eax*2 + 0x2a], cx
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x22c
ret
Function at 0x44dcce
Capabilities:
Copy file
Move file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x438
push ebx
mov bl, byte [esp + 0x448]
lea eax, [esp + 0x230]
call fcn.00411340
mov ecx, dword [esp + 0x444]
lea eax, [esp + 0x24]
call fcn.00411340
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44dd4d
test bl, bl
je 0x44dd76
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x234]
push eax
call fcn.00414904
add esp, 8
test eax, eax
je 0x44dd43
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
pop ebx
add esp, 0x438
ret
lea eax, [esp + 0x230]
push eax
call fcn.0043864b
add esp, 4
test al, al
je 0x44dd76
lea ecx, [esp + 0x24]
push ecx
call fcn.0043864b
add esp, 4
test al, al
je 0x44dd80
test bl, bl
jne 0x44dda2
xor al, al
pop ebx
add esp, 0x438
ret
lea edx, [esp + 0x24]
push edx
call fcn.00438245
add esp, 4
test al, al
je 0x44dd76
lea eax, [esp + 0x24]
push eax
call fcn.0043864b
add esp, 4
test al, al
je 0x44dd76
lea ecx, [esp + 0x230]
push str..
push ecx
call fcn.00412b83
lea edx, [esp + 0x238]
push edx
call fcn.004127f5
lea edx, [esp + 0x30]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x242], cx
call fcn.004127f5
xor ecx, ecx
mov word [esp + eax*2 + 0x36], cx
lea edx, [esp + 0x240]
lea eax, [esp + 0x34]
mov dword [esp + 0x1c], edx
add esp, 0x10
mov dword [esp + 0x10], eax
xor eax, eax
lea edx, [esp + 4]
mov ecx, 0x614
push edx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x438
ret
Function at 0x44de2e
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10b4
call fcn.00426a70
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea eax, [esp + 0x438]
xor bl, bl
call fcn.00411340
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x648]
call fcn.00411340
lea eax, [esp + 0x648]
push eax
lea ecx, [esp + 0x43c]
push ecx
call fcn.004385a4
lea edx, [esp + 0x440]
push edx
mov byte [esp + 0x1b], al
call fcn.0043864b
add esp, 0xc
test al, al
je 0x44dea3
lea eax, [esp + 0x438]
push str..
push eax
call fcn.00412b83
add esp, 8
lea ecx, [esp + 0x648]
push ecx
call fcn.0043864b
add esp, 4
test al, al
je 0x44decc
lea edx, [esp + 0x648]
push str..
push edx
call fcn.00412b83
add esp, 8
lea eax, [esp + 0xcb0]
push eax
lea ecx, [esp + 0xebc]
push ecx
lea edx, [esp + 0xab0]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x448]
push ecx
call fcn.004152c0
add esp, 0x14
lea edx, [esp + 0x858]
push edx
lea eax, [esp + 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov byte [esp + 0xe], 1
cmp esi, 0xffffffff
je 0x44e082
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp byte [esp + 0xe], 1
jne 0x44e082
test byte [esp + 0x858], 0x10
jne 0x44e062
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x64c]
push edx
lea eax, [esp + 0xcb8]
push eax
lea ecx, [esp + 0xec4]
push ecx
lea edx, [esp + 0x894]
push edx
call fcn.00438400
add esp, 0x14
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00412bb1
lea edx, [esp + 0xab0]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00412b83
lea ecx, [esp + 0x894]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00412b83
lea eax, [esp + 0x240]
push eax
call fcn.004386a9
add esp, 0x1c
test al, al
je 0x44dfe0
cmp byte [ebp + 0x10], 0
je 0x44e039
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x44e049
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp + 0x14], 1
jne 0x44e024
cmp byte [esp + 0xf], 0
jne 0x44e002
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x44e035
push 0
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
je 0x44e039
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x44e035
push 0
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
jne 0x44e060
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x44e039
mov bl, 1
lea ecx, [esp + 0x858]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44df25
mov byte [esp + 0xe], al
jmp 0x44df25
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret