joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441171
Capabilities:
Get common file path

Disassembly:
sub esp, 0x7c
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x78], eax
push dword [0x514b64]
call fcn.0044158e
pop ecx
test ax, ax
je 0x44119b
push str.Illegal_Copy
call fcn.0042bf8e
pop ecx
mov eax, dword [str.AXISVERLAB]
push ebx
push ebp
xor ebp, ebp
xor ebx, ebx
inc ebp
test byte [eax + 0x38], 0x20
je 0x4411d4
push str.___prompts_for_serialisation_information
push 0x4cd908
call fcn.0042bfa3
push ebp
push ebx
push 0x24
call fcn.00472020
add esp, 0x14
test ax, ax
je 0x4411d4
mov word [0x5344e4], bp
mov eax, dword [str.AXISVERLAB]
test byte [eax + 0x38], 0x20
je 0x441378
push edi
mov edi, 0x533fc8
push edi
call fcn.0040e19b
mov dword [esp], str.lxxver.dat
push edi
call fcn.00446fa0
pop ecx
pop ecx
call fcn.004123c5
test ax, ax
je 0x44124b
push esi
push 0x519
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5c
push edi
call fcn.0040970e
pop ecx
pop ecx
call fcn.004136a7
push ebx
push ebx
push ebx
push edi
mov esi, eax
call fcn.00447230
pop ecx
add eax, edi
push eax
push ebx
push ebx
push dword [esi]
call fcn.0040d952
push str..LXX
push edi
call fcn.00446fa0
add esp, 0x24
pop esi
push edi
call fcn.0040d5d3
pop ecx
test ax, ax
jne 0x4412a4
lea eax, [esp + 0xc]
push eax
push ebx
push edi
call fcn.0040cbb6
add esp, 0xc
test ax, ax
je 0x441276
push str.Error_Creating_License_File
call fcn.0042bf8e
pop ecx
push 0x74
push dword [0x514b64]
push dword [esp + 0x14]
call fcn.0040d07a
add esp, 0xc
test ax, ax
je 0x44129a
push str.Error_Initialising_License_File
call fcn.0042bf8e
pop ecx
push dword [esp + 0xc]
call fcn.0040cd10
pop ecx
lea eax, [esp + 0xc]
push eax
push ebp
push edi
call fcn.0040ce6d
add esp, 0xc
pop edi
test ax, ax
je 0x4412c4
push str.Error_Opening_License_File
call fcn.0042bf8e
pop ecx
push 0x74
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call fcn.0040d044
add esp, 0xc
test ax, ax
je 0x4412e7
push str.Error_Reading_License_File
call fcn.0042bf8e
pop ecx
push dword [esp + 8]
call fcn.0040cd10
lea eax, [esp + 0x10]
push eax
call fcn.0044158e
pop ecx
pop ecx
test ax, ax
je 0x44130c
push str.Illegal_License_File
call fcn.0042bf8e
pop ecx
mov ecx, dword [str.AXISVERLAB]
mov ax, word [esp + 0x46]
cmp ax, word [ecx + 0x3a]
jne 0x441378
mov al, byte [esp + 0x48]
cmp al, byte [ecx + 0x3c]
jne 0x441378
mov al, byte [esp + 0x49]
cmp al, byte [ecx + 0x3d]
jne 0x441378
test byte [esp + 0x44], 1
je 0x441351
mov ax, word [esp + 0x50]
mov word [ecx + 0x44], ax
mov eax, dword [str.AXISVERLAB]
mov ecx, dword [esp + 0x52]
mov dword [eax + 0x46], ecx
mov ecx, dword [str.AXISVERLAB]
lea eax, [esp + 0x56]
push eax
lea eax, [ecx + 0x4a]
push eax
call fcn.00446f90
pop ecx
pop ecx
mov ecx, dword [str.AXISVERLAB]
mov ax, word [ecx + 0x38]
xor ax, word [esp + 0x44]
and ax, 8
xor word [ecx + 0x38], ax
mov ecx, dword [esp + 0x80]
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a5e
add esp, 0x7c
ret

Function at 0x44f923
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044f5e3
Function at 0x45c8ab
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x3c], 0xffffffff
jne 0x45c901
lea eax, [edi + 0x24]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040a8c8
cmp dword [eax + 0x14], 8
jb 0x45c8dd
mov eax, dword [eax]
lea ecx, [ebp - 0x26c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
mov esi, eax
lea ecx, [ebp - 0x1c]
push 1
mov dword [edi + 0x3c], esi
call fcn.004087c3
cmp esi, 0xffffffff
jmp 0x45c913
lea eax, [ebp - 0x26c]
push eax
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x45c99c
mov ecx, dword [ebp - 0x26c]
test cl, 0x16
je 0x45c92d
mov eax, dword [edi + 0x40]
and eax, ecx
test al, 0x16
je 0x45c8c3
mov eax, dword [ebp - 0x268]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x264]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x260]
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 0x25c]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x258]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x254]
mov dword [edi + 0x20], eax
xor eax, eax
or eax, dword [ebp - 0x24c]
mov dword [edi], eax
lea eax, [ebp - 0x240]
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 0x250]
push eax
lea eax, [ebp - 0x1c]
mov dword [edi + 4], ecx
push eax
lea ecx, [edi + 0x24]
call fcn.00408424
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040758b
xor eax, eax
jmp 0x45c9a1
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00441a5e
mov esp, ebp
pop ebp
ret

Function at 0x45c9b1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [ebp + 8], 0
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
jne 0x45ca7d
test edi, edi
je 0x45ca41
lea eax, [esi + 0x243]
cmp dword [eax + 0x14], 0x10
jb 0x45c9e9
mov eax, dword [eax]
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x10c]
push ebx
push ebx
push ecx
lea ecx, [ebp - 0x214]
push ecx
push ebx
push ebx
push eax
call fcn.0040d952
push ebx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [esi + 0x105]
push eax
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.0040dd79
add esp, 0x34
mov ecx, edi
push eax
call fcn.00408388
push ebx
push 1
lea ecx, [ebp - 0x22c]
call fcn.0040758b
pop ebx
mov ax, word [esi + 0x227]
lea ecx, [esi + 0x210]
mov word [esi + 0x20e], ax
mov eax, dword [esi + 0x21f]
mov dword [esi + 0x217], eax
mov eax, dword [esi + 0x223]
mov dword [esi + 0x21b], eax
lea eax, [esi + 0x23b]
push eax
call fcn.004a6e9c
xor eax, eax
jmp 0x45caa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.0045cb93
pop ecx
cmp edi, 2
je 0x45ca96
cmp edi, 3
jne 0x45ca99
push 0x12
pop edi
push edi
call fcn.0040c537
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00441a5e
mov esp, ebp
pop ebp
ret
Function at 0x45cbdc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x520]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
push esi
call fcn.0040d952
lea eax, [ebp - 0x520]
push 0x4c1278
push eax
call fcn.004478d0
add esp, 0x24
test eax, eax
jne 0x45cc27
mov eax, 0xa2b
jmp 0x45cc84
lea eax, [ebp - 0x520]
push esi
push eax
call fcn.00446f90
lea eax, [ebp - 0x520]
push eax
call fcn.00447230
add esp, 0xc
cmp eax, 1
jbe 0x45cc61
dec eax
cmp byte [ebp + eax - 0x520], 0x5c
jne 0x45cc61
cmp eax, 0x519
jae 0x45cc94
mov byte [ebp + eax - 0x520], bl
push ebx
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x45cc77
xor eax, eax
jmp 0x45cc84
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040c537
pop ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00441a5e
mov esp, ebp
pop ebp
ret
call fcn.00441f00
int3

Function at 0x45cc9a
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x520]
push eax
call fcn.00446f90
lea eax, [ebp - 0x520]
push 0x4c1278
push eax
call fcn.004478d0
add esp, 0x10
xor ebx, ebx
test eax, eax
je 0x45cd0e
lea eax, [ebp - 0x520]
push eax
call fcn.00447230
pop ecx
cmp byte [ebp + eax - 0x521], 0x5c
jne 0x45cd0e
lea eax, [ebp - 0x520]
push eax
call fcn.00447230
movzx eax, ax
dec eax
pop ecx
cmp eax, 0x519
jae 0x45cd41
mov byte [ebp + eax - 0x520], bl
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x45cd2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040c537
pop ecx
movzx ebx, ax
mov ecx, dword [ebp - 4]
mov ax, bx
xor ecx, ebp
pop ebx
call fcn.00441a5e
mov esp, ebp
pop ebp
ret
call fcn.00441f00
int3
Function at 0x45d1f1
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ecx
push ecx
push 7
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x45d3d4
mov eax, dword [0x50d234]
push dword [eax]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45d3df
push ebx
push ebp
push esi
push edi
push 7
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
push ebx
mov dword [esp + 0x18], ebp
call esi
push ebp
mov edi, eax
call esi
mov esi, eax
push edi
push esi
mov dword [esp + 0x18], esi
call fcn.00446f90
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
xor ebp, ebp
call fcn.00447230
pop ecx
xor ecx, ecx
cmp cx, ax
jae 0x45d3bc
mov edi, esi
movzx esi, bp
mov al, byte [esi + edi]
cmp al, 0xa
je 0x45d36b
cbw
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_OemKeyScan]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45d36b
mov ecx, dword [0x517624]
cmp dword [ecx], 1
jne 0x45d37e
mov esi, ebx
and esi, 0x20000
je 0x45d2d3
push 0x2a
call fcn.0045d784
pop ecx
test ax, ax
jne 0x45d3b1
mov eax, dword [0x517620]
inc word [eax]
mov edi, ebx
and edi, 0x40000
je 0x45d2f6
push 0x1d
call fcn.0045d784
pop ecx
test ax, ax
jne 0x45d3b1
mov eax, dword [0x517620]
inc word [eax]
movzx eax, bl
push eax
call fcn.0045d784
pop ecx
test ax, ax
jne 0x45d3b1
mov eax, dword [0x517620]
or bl, 0x80
inc word [eax]
movzx eax, bl
push eax
call fcn.0045d784
pop ecx
test ax, ax
jne 0x45d3b1
mov eax, dword [0x517620]
inc word [eax]
test esi, esi
je 0x45d34b
push 0xaa
call fcn.0045d784
pop ecx
test ax, ax
jne 0x45d3b1
mov eax, dword [0x517620]
inc word [eax]
test edi, edi
je 0x45d367
push 0x9d
call fcn.0045d784
pop ecx
test ax, ax
jne 0x45d3b1
mov eax, dword [0x517620]
inc word [eax]
mov edi, dword [esp + 0x10]
push edi
inc ebp
call fcn.00447230
pop ecx
cmp bp, ax
jb 0x45d27c
jmp 0x45d3bc
movsx ax, byte [esi + edi]
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_OemKeyScan]
movsx cx, byte [esi + edi]
shl eax, 8
add cx, ax
movzx eax, cx
push eax
call fcn.0045d784
pop ecx
test ax, ax
jne 0x45d3b1
mov eax, dword [0x517620]
inc word [eax]
jmp 0x45d36b
push str.Object_too_Large___Unable_to_Paste_Complete_Object
call fcn.00413845
pop ecx
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
pop ebx
jmp 0x45d3df
push str.No_Data_of_Correct_Type_in_Clipboard
call fcn.00413845
pop ecx
pop ecx
pop ecx
ret

Function at 0x45d3e2
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x517624]
cmp dword [eax], 0
jne 0x45d429
mov ecx, dword [esp + 0xc]
movzx eax, byte [esp + 8]
sar ecx, 8
and ecx, 0xff00
add cx, ax
mov eax, 0xf09
push esi
movzx esi, cx
cmp si, ax
jne 0x45d421
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 0x80
mov eax, 0xf00
cmovne esi, eax
push esi
call fcn.0045d784
pop ecx
pop esi
xor eax, eax
inc eax
ret
Function at 0x45d443
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x108
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [0x517624]
push ebp
xor ebp, ebp
inc ebp
push esi
push edi
cmp dword [eax], ebp
jne 0x45d512
mov esi, dword [esp + 0x11c]
push esi
call fcn.0045d1c1
mov edi, 0xe0
pop ecx
test ax, ax
je 0x45d4cf
call fcn.0045d916
mov word [esp + 0xe], ax
test al, 0x20
je 0x45d49e
test al, 3
jne 0x45d4cf
push edi
call fcn.0045d784
push 0x2a
jmp 0x45d4c8
test al, 2
je 0x45d4b9
push edi
call fcn.0045d784
push 0xaa
call fcn.0045d784
mov ax, word [esp + 0x16]
pop ecx
pop ecx
test al, 1
je 0x45d4cf
push edi
call fcn.0045d784
push 0xb6
call fcn.0045d784
pop ecx
pop ecx
test dword [esp + 0x120], 0x1000000
je 0x45d4f1
push esi
call fcn.0045d1dd
add esp, 4
test ax, ax
jne 0x45d4f1
push edi
call fcn.0045d784
pop ecx
cmp esi, 0x6f
jne 0x45d4fa
push 0x35
jmp 0x45d504
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call fcn.0045d784
pop ecx
mov ax, bp
jmp 0x45d5c9
push ebx
mov ebx, dword [esp + 0x120]
cmp ebx, 0x70
jb 0x45d524
cmp ebx, 0x79
jbe 0x45d534
push ebx
call fcn.0045d1c1
pop ecx
test ax, ax
je 0x45d5c6
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push ebx
call esi
push 2
mov edi, eax
push ebx
shl edi, 8
call esi
add eax, edi
mov ecx, 0x4800
movzx esi, ax
mov edi, 0x5000
mov eax, 0x4b00
mov ebx, 0x4d00
cmp si, cx
je 0x45d576
cmp si, di
je 0x45d576
cmp si, ax
je 0x45d576
cmp si, bx
jne 0x45d5ba
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test byte [esp + 0x25], 0x80
je 0x45d5ba
mov eax, esi
cmp eax, 0x4800
je 0x45d5b5
cmp eax, 0x4b00
je 0x45d5ae
cmp eax, ebx
je 0x45d5a7
cmp eax, edi
jne 0x45d5ba
mov esi, 0x9100
jmp 0x45d5ba
mov esi, 0x7400
jmp 0x45d5ba
mov esi, 0x7300
jmp 0x45d5ba
mov esi, 0x8d00
push esi
call fcn.0045d784
pop ecx
mov ax, bp
jmp 0x45d5c8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00441a5e
add esp, 0x108
ret
Function at 0x45d5e1
Capabilities:
Log keystrokes

Disassembly:
push ecx
mov eax, dword [0x517624]
push ebx
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
jne 0x45d6dc
test dword [esp + 0x14], 0x1000000
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, 0xe0
je 0x45d61e
push esi
call fcn.0045d1dd
add esp, 4
test ax, ax
jne 0x45d61e
push edi
call fcn.0045d784
pop ecx
cmp esi, 0x6f
jne 0x45d62e
push 0xb5
call fcn.0045d784
pop ecx
mov ebp, 0xaa
cmp esi, 0x2c
jne 0x45d66d
push 0x2a
call fcn.0045d784
push edi
call fcn.0045d784
push 0x37
call fcn.0045d784
push edi
call fcn.0045d784
push 0xb7
call fcn.0045d784
push edi
call fcn.0045d784
push ebp
call fcn.0045d784
add esp, 0x1c
jmp 0x45d682
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
or eax, 0x80
push eax
call fcn.0045d784
pop ecx
push esi
call fcn.0045d1c1
pop ecx
test ax, ax
je 0x45d6d4
call fcn.0045d916
mov word [esp + 0x12], ax
test al, 0x20
je 0x45d6a9
test al, 3
jne 0x45d6d4
push edi
call fcn.0045d784
push ebp
jmp 0x45d6cd
test al, 2
je 0x45d6c1
push edi
call fcn.0045d784
push 0x2a
call fcn.0045d784
mov ax, word [esp + 0x1a]
pop ecx
pop ecx
test al, 1
je 0x45d6d4
push edi
call fcn.0045d784
push 0x36
call fcn.0045d784
pop ecx
pop ecx
pop edi
pop esi
mov ax, bx
pop ebp
jmp 0x45d6de
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x45d6ef
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x517624]
push ebx
xor ebx, ebx
inc ebx
cmp dword [eax], ebx
jne 0x45d722
cmp dword [esp + 0xc], 0x1b
je 0x45d752
cmp dword [esp + 0xc], 9
je 0x45d752
push 0
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
call fcn.0045d784
pop ecx
mov ax, bx
pop ebx
ret
cmp dword [esp + 0xc], 0x79
jne 0x45d752
push edi
push 0
push 0x79
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 2
mov edi, eax
push 0x79
shl edi, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
add eax, edi
push eax
call fcn.0045d784
pop ecx
pop edi
mov ax, bx
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x45d916
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x84]
sub esp, 0x104
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp + 0x80], eax
push esi
lea eax, [ebp - 0x80]
xor esi, esi
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test byte [ebp - 0x6c], 1
je 0x45d947
push 0x40
pop esi
test byte [ebp + 0x10], 1
je 0x45d951
or si, 0x20
test byte [ebp + 0x11], 1
je 0x45d95b
or si, 0x10
test byte [ebp - 0x53], 1
mov ecx, 0x80
je 0x45d969
or si, cx
test byte [ebp - 0x70], cl
je 0x45d972
or si, 2
test byte [ebp - 0x6f], cl
je 0x45d97f
mov eax, 0x104
or si, ax
test byte [ebp - 0x6e], cl
je 0x45d98c
mov eax, 0x208
or si, ax
mov ecx, dword [ebp + 0x80]
mov ax, si
xor ecx, ebp
pop esi
call fcn.00441a5e
lea esp, [ebp + 0x84]
pop ebp
ret
Function at 0x45db2a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0045db70
test ax, ax
jne 0x45db3c
xor eax, eax
jmp 0x45db6c
push 2
lea eax, [ebp - 4]
push eax
push str.PROGINIT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 4]
add eax, ecx
push eax
call fcn.0040972a
push dword [ebp - 4]
call fcn.0040813e
pop ecx
pop ecx
xor ecx, ecx
cmp al, 0x59
sete cl
mov ax, cx
mov esp, ebp
pop ebp
ret

Function at 0x45db70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, 0x104
lea eax, [ebp - 0x108]
push edi
push eax
push str.USERDOMAIN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x108]
add eax, ecx
push eax
call fcn.0040972a
lea eax, [ebp - 0x108]
mov dword [esp], str.SYSAXIS
push eax
call fcn.00447146
pop ecx
pop ecx
test eax, eax
jne 0x45dbc8
xor eax, eax
inc eax
jmp 0x45dbfc
push edi
lea eax, [ebp - 0x20c]
push eax
push str.AXISDOMAIN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x20c]
add eax, ecx
push eax
call fcn.0040972a
push dword [ebp - 0x20c]
call fcn.0040813e
pop ecx
pop ecx
cmp al, 0x59
je 0x45dbc3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00441a5e
mov esp, ebp
pop ebp
ret

Function at 0x461e78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x4f8]
sub esp, 0x578
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp + 0x4f4], eax
cmp word [ebp + 0x504], 0
je 0x461ea7
call fcn.00460d64
jmp 0x461f60
lea eax, [ebp - 0x80]
push eax
call fcn.004237ac
cmp byte [ebp - 0x51], 0x41
pop ecx
je 0x461f60
push esi
lea eax, [ebp - 0x34]
push edi
push eax
call fcn.0040f455
add eax, 0x400
push eax
call fcn.0045dd6f
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00464010
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x14
call edi
mov esi, dword [0x53728c]
mov ecx, eax
mov edx, dword [0x537288]
sub ecx, esi
cmp ecx, edx
jae 0x461f0a
sub edx, eax
add edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov dword [0x53728c], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040d2a6
pop ecx
pop ecx
test ax, ax
jne 0x461f5e
mov edi, 0x537290
lea ecx, [ebp - 0x30]
push edi
call fcn.0045a45b
test al, al
je 0x461f5e
call fcn.00460da5
cmp al, byte [0x537263]
je 0x461f57
cmp dword [0x537264], 0
mov byte [0x537263], al
je 0x461f57
call fcn.0046214f
lea esi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov ecx, dword [ebp + 0x4f4]
xor ecx, ebp
call fcn.00441a5e
lea esp, [ebp + 0x4f8]
pop ebp
ret
Function at 0x464327
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
call fcn.00440594
cmp eax, 0xffffffff
jne 0x46433c
xor al, al
jmp 0x46438c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x46436f
push 0
lea eax, [ebp - 4]
mov ecx, edi
push eax
push esi
push ebx
call fcn.00440594
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x464369
test eax, eax
je 0x46436f
add ebx, eax
sub esi, eax
jne 0x464348
cmp byte [ebp + 0x10], 0
je 0x464383
mov ecx, edi
call fcn.00440594
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46c74d
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
sub esp, 0x250
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x24c], eax
call fcn.0045db70
test ax, ax
je 0x46c8f8
push ebx
push ebp
lea eax, [esp + 0x48]
push 1
push eax
call fcn.0046b01e
lea eax, [esp + 0x50]
push str.lxkuser.log
push eax
call fcn.00446fa0
add esp, 0x10
mov ebp, 0x54f9a0
mov ecx, ebp
call fcn.00440594
xor ebx, ebx
test eax, eax
jne 0x46c7c4
push ebx
push 0x80000080
push 3
push ebx
push 3
push 0xc0000000
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
mov ecx, ebp
call fcn.0046f925
mov ecx, ebp
call fcn.00440594
cmp eax, 0xffffffff
je 0x46c8f6
push esi
push edi
lea ecx, [esp + 0x38]
call fcn.00408368
lea eax, [esp + 0x14]
push eax
call fcn.0045c51b
mov esi, eax
lea edi, [esp + 0x34]
pop ecx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 8
push 0x54e928
push str.COMPUTERNAME
call fcn.004a44ef
pop ecx
push eax
push str.USERNAME
call fcn.004a44ef
pop ecx
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x58]
push str._date__2__time__2_login__str__computer__str__userid__txt__command_line__str__Thread__dword__5
push eax
call fcn.00408abf
add esp, 0x28
lea eax, [esp + 0x268]
lea ecx, [esp + 0x38]
push eax
push dword [esp + 0x268]
call fcn.004096bf
mov esi, 0x4ca024
push esi
call fcn.00447230
pop ecx
push eax
push esi
lea ecx, [esp + 0x40]
call fcn.0040891d
mov eax, dword [esp + 0x48]
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], eax
mov ecx, ebp
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push ebx
push 1
push ebx
push 2
call fcn.00440594
push eax
call dword [sym.imp.KERNEL32.dll_LockFileEx]
pop edi
pop esi
test eax, eax
je 0x46c8ea
push 2
push ebx
push ebx
mov ecx, ebp
call fcn.00440594
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 8]
push ebx
push ecx
push dword [esp + 0x10]
lea eax, [esp + 0x3c]
mov ecx, ebp
cmovae eax, dword [esp + 0x3c]
push eax
call fcn.00440594
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push 1
push ebx
push ebx
mov ecx, ebp
call fcn.00440594
push eax
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push ebx
push 1
lea ecx, [esp + 0x38]
call fcn.0040758b
pop ebp
pop ebx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00441a5e
add esp, 0x250
ret