joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439b80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, eax
mov eax, dword [0x51cbcc]
push ebp
push eax
mov edi, ecx
push str.__s_s
mov esi, 0x800
call fcn.004ac070
mov esi, eax
lea ecx, [esi + 1]
add esp, 0xc
cmp ecx, 0x800
jg 0x439bdb
lea edx, [edi + 2]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x439bdb
mov edx, dword [esp + 0x18]
mov dword [edi + esi*2], 0x22
mov ecx, dword [0x51cbcc]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov al, 1
pop ebx
ret
call fcn.0043a210
test eax, eax
je 0x439c28
push ebp
push ebx
push str.__s_s
mov esi, 0x800
call fcn.004ac070
mov esi, eax
lea edx, [esi + 1]
add esp, 0xc
cmp edx, 0x800
jg 0x439c28
lea eax, [edi + 2]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x439c28
mov eax, dword [esp + 0x18]
mov dword [edi + esi*2], 0x22
pop edi
pop esi
mov dword [eax], ebx
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x439c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x2210
call fcn.004d5830
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ebx, [esp + 0x1224]
push ecx
lea eax, [esp + 0x20]
mov ecx, ebx
mov ebp, 0x4f5ac4
call fcn.00439b80
add esp, 8
test al, al
jne 0x439c6d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2210
ret
cmp byte [esp + 0x2224], 0
je 0x439ce2
push 0x4f3a94
call fcn.004a4b10
mov edx, dword [esp + 0x18]
add esp, 4
push eax
push edx
push str.__s_s
mov esi, 0x800
lea edi, [esp + 0x22c]
call fcn.004ac070
mov esi, eax
lea eax, [esi + 1]
add esp, 0xc
cmp eax, 0x800
jg 0x439ce2
lea ecx, [esp + 0x222]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x439ce2
mov edx, 0x22
xor eax, eax
mov word [esp + esi*2 + 0x220], dx
mov word [esp + esi*2 + 0x222], ax
mov ebx, edi
lea ebp, [esp + 0x1220]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push 0x51c0f8
mov ecx, ebx
call fcn.0042ec50
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x2210
ret
Function at 0x43d960
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x218
push ebx
push ebp
mov ebp, dword [0x51ae08]
push esi
push edi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push 0
mov eax, esi
call fcn.00413290
mov bl, al
add esp, 0xc
test bl, bl
jne 0x43d9ff
push 0
lea ebx, [esp + 0x18]
mov eax, esi
call fcn.0044ea90
mov edi, eax
add esp, 4
test edi, edi
jne 0x43d9c2
push 1
push eax
push 0xffffffffffffffff
push 0x4f5ac4
push ebp
call fcn.004aefb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x28]
mov dword [esp + 0x18], eax
push 0
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
call fcn.0044ed80
fstp st(0)
add esp, 8
lea eax, [esp + 0x18]
mov ebx, ebp
call fcn.004ae8c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
mov edx, dword [esp + 0x22c]
movzx esi, word [edx]
test esi, 0xffffff80
jne 0x43da23
push 2
push esi
call fcn.004cae3e
add esp, 8
test eax, eax
je 0x43da23
and esi, 0xffffffdf
movzx eax, si
cmp eax, 0x50
je 0x43da3b
xor ecx, ecx
cmp eax, 0x54
setne cl
lea eax, [ecx - 1]
and eax, 2
jmp 0x43da40
mov eax, 1
push eax
call fcn.0044ecd0
add esp, 4
test al, al
mov eax, 0x4f40fc
jne 0x43da57
mov eax, 0x4f4100
push 1
push 0
push 0xffffffffffffffff
push eax
push ebp
call fcn.004aefb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
Function at 0x43da80
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4dc3fe
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push esi
mov esi, ecx
mov ecx, dword [0x51ae08]
push edi
call fcn.0041acb0
xor edi, edi
cmp esi, edi
je 0x43dc3e
cmp word [esi], di
je 0x43dc3e
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.004cb3f1
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x30]
mov word [esp + 0x238], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43dae7
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
lea ecx, [esp + eax*2 + 0x30]
je 0x43db1d
inc eax
cmp eax, 0x105
jae 0x43dc3e
mov edx, 0x5c
mov word [ecx], dx
xor ecx, ecx
mov word [esp + eax*2 + 0x30], cx
test byte [0x51f578], 1
jne 0x43db6f
or dword [0x51f578], 1
push 0x4f4104
mov dword [esp + 0x250], edi
call fcn.004a4bf0
add esp, 4
push eax
push str.____9w
call fcn.004a4b10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51f574], eax
mov dword [esp + 0x24c], 0xffffffff
jmp 0x43db74
mov eax, dword [0x51f574]
cmp eax, edi
je 0x43dbc0
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x43dc3e
test bl, bl
je 0x43dbad
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43dbfe
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43dbfe
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x43dc3e
mov eax, dword [esp + 0x14]
test bl, bl
jne 0x43dbef
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 8]
shr eax, 0x14
mov esi, eax
mov ecx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e6a28
push ecx
call fcn.004aefb0
mov eax, dword [0x51ae08]
push 0x18
push edi
push esi
call fcn.00401590
mov eax, 1
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [0x5165ec]
test byte [edx + 0x100], 1
jne 0x43dc78
mov eax, dword [0x51b6d0]
push 1
push edi
push 0xffffffffffffffff
push 0x4eb75c
push eax
call fcn.004aefb0
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push 0x4f5ac4
push edi
push 0x4eb75c
call fcn.0042dac0
mov ecx, dword [esp + 0x244]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43fb80
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x218
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
call ebp
test eax, eax
jne 0x43fbad
cmp byte [0x51cbd4], al
je 0x43fc59
call fcn.00409f60
pop ebp
add esp, 0x218
ret
cmp byte [0x51cbd4], 0
push ebx
push esi
mov esi, 0x51b6d8
jne 0x43fbc1
lea esi, [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
push 0x104
call ebx
test eax, eax
je 0x43fc1f
cmp word [edi], 0
je 0x43fc37
cmp word [edi + 2], 0x3a
jne 0x43fc37
cmp word [edi + 4], 0
jne 0x43fc37
push esi
push edi
call fcn.004c9bad
add esp, 8
test eax, eax
je 0x43fc37
push edi
lea ecx, [esp + 0x10]
push 0x4f47a8
push ecx
call fcn.004c9fb7
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call ebp
test eax, eax
je 0x43fc37
push esi
push 0x104
call ebx
test eax, eax
jne 0x43fc37
push 0x103
push edi
push esi
call fcn.004cb3f1
add esp, 0xc
xor eax, eax
mov word [esi + 0x206], ax
cmp byte [0x51cbd4], 0
pop esi
pop ebx
je 0x43fc59
mov ecx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e6a28
push ecx
call fcn.004aefb0
pop ebp
add esp, 0x218
ret
Function at 0x4402f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x20c
push ebp
push edi
mov edi, dword [esp + 0x218]
mov ebp, ecx
test edi, edi
je 0x44045e
cmp word [edi], 0
je 0x44045e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x440348
mov ecx, dword [0x5165ec]
shr eax, 4
not al
and al, 1
movzx edx, al
push edx
push ebp
mov dword [ecx + 0x30], 0xb7
call fcn.0042db70
pop edi
pop ebp
add esp, 0x20c
ret 4
push ebx
push 0x5c
push edi
call fcn.004cb9fc
mov ebx, eax
add esp, 8
cmp ebx, edi
jbe 0x440426
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x440363
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x4403cf
mov eax, dword [0x5165ec]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x6f
jne 0x4403b0
mov eax, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4eb75c
push eax
call fcn.004aefb0
pop ebx
pop edi
pop ebp
add esp, 0x20c
ret 4
push 0x4f5ac4
push 0
push 0x4eb75c
mov ecx, ebp
call fcn.0042dac0
pop ebx
pop edi
pop ebp
add esp, 0x20c
ret 4
push esi
mov esi, ebx
sub esi, edi
sar esi, 1
push esi
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.004cb3f1
add esp, 0xc
lea eax, [esp + 0x14]
xor edx, edx
push eax
mov ecx, ebp
mov word [esp + esi*2 + 0x18], dx
call fcn.004402f0
cmp word [ebx + 2], 0
pop esi
je 0x440415
mov ecx, dword [0x51b6d0]
push 0
push 1
call fcn.004016f0
cmp word [eax], 0x31
jne 0x440426
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 0x20c
ret 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
sete cl
mov byte [esp + 0xc], cl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x5165ec]
mov dword [edx + 0x30], eax
mov eax, dword [esp + 0xc]
push eax
push ebp
call fcn.0042db70
pop ebx
pop edi
pop ebp
add esp, 0x20c
ret 4
mov eax, dword [0x5165ec]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x440495
mov ecx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4eb75c
push ecx
call fcn.004aefb0
pop edi
pop ebp
add esp, 0x20c
ret 4
push 0x4f5ac4
push 0
push 0x4eb75c
call fcn.0042dac0
pop edi
pop ebp
add esp, 0x20c
ret 4
Function at 0x4410b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
xor edi, edi
cmp ebp, edi
je 0x441100
push edi
push 1
mov ecx, ebp
call fcn.004016f0
cmp byte [ebp + 0x17], 0
mov dword [esp + 0x24], eax
jne 0x4410da
mov esi, dword [ebp + 0xc]
jmp 0x4410dc
mov esi, ebp
cmp byte [esi + 0x17], 1
jne 0x4410f7
test byte [esi + 0x15], 8
je 0x4410ef
mov eax, esi
call fcn.00401610
mov ebx, dword [esi + 0xc]
add esi, 0xc
jmp 0x44112e
mov esi, 0x51e75c
mov ebx, dword [esi]
jmp 0x44112e
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push edi
call fcn.004aea00
add esp, 0xc
test eax, eax
jne 0x44112a
mov edx, dword [0x5165ec]
mov dword [edx + 0x30], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x441176
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], edi
test eax, eax
je 0x44116b
push 0
lea ecx, [esp + 0x24]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
cmp dword [esp + 0x20], ebx
sete dl
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x5165ec]
mov dword [ecx + 0x30], eax
cmp esi, 0xffffffff
je 0x441191
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x4411a2
mov edx, dword [esp + 0x24]
push edx
call fcn.004ca991
add esp, 4
mov edx, dword [esp + 0x1c]
test edi, edi
sete al
movzx ecx, al
push ecx
push edx
call fcn.0042db70
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x4411d0
Capabilities:
Delete file

Disassembly:
sub esp, 8
push ebx
mov ebx, 0x4f492c
mov eax, esi
call fcn.00409d30
test eax, eax
jne 0x44121f
cmp word [esi], ax
je 0x44121f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
sete al
mov byte [esp + 8], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 8]
mov ecx, dword [0x5165ec]
push edx
push edi
mov dword [ecx + 0x30], eax
call fcn.0042db70
pop ebx
add esp, 8
ret
push 0
push 0
push 0x4411c0
push 0
push 1
push esi
mov ecx, edi
call fcn.00441870
mov ecx, dword [0x5165ec]
xor eax, eax
cmp dword [ecx + 0x104], eax
pop ebx
sete al
add esp, 8
ret
Function at 0x4415d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [0x51ae08]
sub esp, 0x100
push esi
mov esi, eax
call fcn.0041acb0
test esi, esi
je 0x441686
cmp word [esi], 0
je 0x441686
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44163d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x5165ec]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jne 0x4416ba
mov eax, dword [0x51b6d0]
push 1
push 0
push esi
push 0x4eb75c
push eax
call fcn.004aefb0
pop esi
add esp, 0x100
ret
mov edx, dword [0x51b6d0]
mov ecx, dword [0x5165ec]
push 1
push 0
push 0xffffffffffffffff
push 0x4e6a28
push edx
mov dword [ecx + 0x30], 0
call fcn.004aefb0
mov edx, esi
lea eax, [esp + 4]
call fcn.004ad060
push 1
push 0
push 0xffffffffffffffff
push eax
mov eax, dword [0x51ae08]
push eax
call fcn.004aefb0
pop esi
add esp, 0x100
ret
mov eax, dword [0x5165ec]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x4416ba
mov ecx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4eb75c
push ecx
call fcn.004aefb0
pop esi
add esp, 0x100
ret
push 0x4f5ac4
push 0
push 0x4eb75c
mov ecx, edi
call fcn.0042dac0
pop esi
add esp, 0x100
ret

Function at 0x4416e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
mov edi, eax
cmp word [eax], bx
je 0x4417a6
nop
movzx esi, word [edi]
test esi, 0xffffff80
jne 0x44171d
push 2
push esi
call fcn.004cae3e
add esp, 8
test eax, eax
je 0x44171d
and esi, 0xffffffdf
movzx eax, si
add eax, 0xffffffd5
cmp eax, 0x33
ja case.0x44172f.44
movzx eax, byte [eax + 0x4417f8]
jmp dword [eax*4 + 0x4417d4]
movzx ebx, word [edi]
jmp case.0x44172f.44
mov eax, 1
jmp 0x44176a
mov eax, 0x20
jmp 0x44176a
mov eax, 4
jmp 0x44176a
mov eax, 2
jmp 0x44176a
mov eax, 0x80
jmp 0x44176a
mov eax, 0x1000
jmp 0x44176a
mov eax, 0x100
mov ecx, ebx
sub ecx, 0x2b
je 0x44178d
sub ecx, 2
je 0x441781
sub ecx, 0x31
jne case.0x44172f.44
xor dword [esp + 0x14], eax
jmp case.0x44172f.44
not eax
and dword [esp + 0x10], eax
and dword [esp + 0x14], eax
jmp case.0x44172f.44
mov ecx, eax
not ecx
and dword [esp + 0x10], ecx
or dword [esp + 0x14], eax
add edi, 2
cmp word [edi], 0
jne 0x441700
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x2c]
push 0x441830
push eax
push ecx
mov ecx, dword [esp + 0x34]
push edx
call fcn.00441870
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10
Function at 0x442070
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x51ae08]
sub esp, 0x258
push ebx
push esi
call fcn.0041acb0
test edi, edi
je 0x4421dd
cmp word [edi], 0
je 0x4421dd
push 0
push 0
push 3
push 0
push 7
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4420d1
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x44213c
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x44211d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x5165ec]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jne 0x442211
mov edx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4eb75c
push edx
call fcn.004aefb0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
or ecx, dword [esp + 0x30]
xor esi, esi
or eax, esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
jmp 0x442144
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [ebp + 0xc]
movzx esi, word [edx]
test esi, 0xffffff80
jne 0x44216c
push 2
push esi
call fcn.004cae3e
mov ecx, dword [esp + 0x10]
add esp, 8
test eax, eax
mov eax, dword [esp + 0xc]
je 0x44216c
and esi, 0xffffffdf
movzx edx, si
sub edx, 0x4b
je 0x442181
sub edx, 2
jne 0x442197
push edx
push 0x100000
jmp 0x442188
push 0
push 0x400
push eax
push ecx
call fcn.004d8a10
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov ecx, dword [0x51b6d0]
mov eax, dword [0x5165ec]
push 1
push 0
push 0xffffffffffffffff
push 0x4e6a28
push ecx
mov dword [eax + 0x30], 0
call fcn.004aefb0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 0x18
push edx
push eax
mov eax, dword [0x51ae08]
call fcn.00401590
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x5165ec]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x442211
mov ecx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4eb75c
push ecx
call fcn.004aefb0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x4f5ac4
push 0
push 0x4eb75c
call fcn.0042dac0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44ecd0
Capabilities:
Log keystrokes via polling

Disassembly:
test bl, bl
jne 0x44ecd7
xor al, al
ret
mov eax, dword [esp + 4]
dec eax
je 0x44ecff
dec eax
je 0x44ecf1
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
ret
movzx ecx, bl
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
ret
lea edx, [ebx - 1]
cmp dl, 5
ja 0x44ed0c
cmp bl, 3
jne 0x44ed13
lea eax, [ebx + 0x66]
cmp al, 5
ja 0x44ed39
cmp dword [0x51b004], 0
je 0x44ed29
movzx ecx, bl
mov al, byte [ecx + 0x51aef0]
shr al, 7
ret
movzx edx, bl
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
ret
cmp dword [0x51b000], 0
je 0x44ed68
xor ecx, ecx
xor edx, edx
mov al, bl
call fcn.004129b0
test al, al
je 0x44ed5b
push 1
call fcn.004127e0
add esp, 4
movzx eax, bl
mov al, byte [eax + 0x51aef0]
shr al, 7
ret
movzx ecx, bl
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
ret
Function at 0x44f300
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4dbd4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
push esi
push edi
mov esi, edx
xor eax, eax
push esi
push eax
mov edi, ecx
push 0x410
mov word [edi], ax
call ebx
mov ebp, eax
test ebp, ebp
jne 0x44f350
push esi
push eax
push 0x1000
call ebx
mov ebp, eax
test ebp, ebp
je 0x44f4d1
cmp byte [esp + 0x230], 0
push 0x104
push edi
push 0
push ebp
je 0x44f36b
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x44f371
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test byte [0x51f304], 1
mov ebx, eax
jne 0x44f3c9
or dword [0x51f304], 1
push 0x4f5544
mov dword [esp + 0x22c], 0
call fcn.004a4bf0
add esp, 4
push eax
push str.__07_
call fcn.004a4b10
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51f300], eax
mov dword [esp + 0x228], 0xffffffff
jmp 0x44f3ce
mov eax, dword [0x51f300]
test ebx, ebx
jne 0x44f4c8
test eax, eax
je 0x44f4c8
push 0x104
push edi
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x44f4c8
cmp byte [esp + 0x230], 0
je 0x44f437
push 0x5c
push edi
call fcn.004cb9fc
add esp, 8
test eax, eax
je 0x44f4c8
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x44f413
sub ecx, esi
sar ecx, 1
add ecx, ecx
push ecx
add eax, 2
push eax
push edi
call fcn.004ca630
add esp, 0xc
jmp 0x44f4c8
mov ecx, 0x41
mov dword [esp + 0x12], 0x3a
mov word [esp + 0x10], cx
lea esp, [esp]
push 0x104
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esi, eax
cmp esi, 2
jbe 0x44f489
sub esi, 2
push esi
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.004cbb84
add esp, 0xc
test eax, eax
jne 0x44f489
cmp word [edi + esi*2], 0x5c
je 0x44f49d
mov ax, word [esp + 0x10]
inc ax
mov word [esp + 0x10], ax
cmp ax, 0x5a
jbe 0x44f450
jmp 0x44f4c8
mov dx, word [esp + 0x10]
mov ax, word [esp + 0x12]
sub ebx, esi
mov word [edi], dx
lea ecx, [ebx + ebx + 2]
push ecx
lea edx, [edi + esi*2]
mov word [edi + 2], ax
push edx
add edi, 4
push edi
call fcn.004ca630
add esp, 0xc
add ebx, 2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x4525d0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x230
push esi
xor esi, esi
cmp eax, esi
je 0x452698
cmp word [eax], si
je 0x452698
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [esp + 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x452607
sub eax, edx
sar eax, 1
cmp eax, esi
je 0x45262b
cmp word [esp + eax*2 + 0x26], 0x5c
lea eax, [esp + eax*2 + 0x26]
jne 0x45262b
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x452632
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x2a], dx
lea edx, [esp + 4]
lea eax, [esp + 0x28]
mov ecx, 0x4054
push edx
mov dword [esp + 0x1e], esi
mov dword [esp + 0x22], esi
mov dword [esp + 0x1a], esi
mov dword [esp + 8], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
setne al
movzx ecx, al
push ecx
push edi
call fcn.0042db70
pop esi
add esp, 0x230
ret
mov edx, dword [0x5165ec]
test byte [edx + 0x100], 1
jne 0x4526c4
mov eax, dword [0x51b6d0]
push 1
push esi
push 0xffffffffffffffff
push 0x4eb75c
push eax
call fcn.004aefb0
pop esi
add esp, 0x230
ret
push 0x4f5ac4
push esi
push 0x4eb75c
mov ecx, edi
call fcn.0042dac0
pop esi
add esp, 0x230
ret
Function at 0x4526e0
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [0x51ae08]
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push edi
mov edi, eax
call fcn.0041acb0
test edi, edi
je 0x452859
cmp word [edi], 0
je 0x452859
push esi
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x45277a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x5165ec]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jne 0x45275b
mov ecx, dword [0x51b6d0]
push 1
push esi
push 0xffffffffffffffff
push 0x4eb75c
push ecx
call fcn.004aefb0
pop esi
pop edi
pop ebp
add esp, 0x10c
ret 4
push 0x4f5ac4
push 0
push 0x4eb75c
mov ecx, ebp
call fcn.0042dac0
pop esi
pop edi
pop ebp
add esp, 0x10c
ret 4
push ebx
push esi
call fcn.004c9c38
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x45282e
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0x4ec878
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45282e
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
push edx
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
mov esi, 0x80
lea edi, [esp + 0x30]
call fcn.004ac070
push ebx
call fcn.004ca991
mov eax, dword [0x51b6d0]
mov edx, dword [0x5165ec]
add esp, 0x18
push 1
push 0
push 0xffffffffffffffff
push 0x4e6a28
push eax
mov dword [edx + 0x30], 0
call fcn.004aefb0
mov edx, dword [0x51ae08]
push 1
push 0
push 0xffffffffffffffff
mov ecx, edi
push ecx
push edx
call fcn.004aefb0
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x10c
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x5165ec]
push ebx
mov dword [ecx + 0x30], eax
call fcn.004ca991
add esp, 4
push ebp
call fcn.004305b0
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x10c
ret 4
mov eax, dword [0x5165ec]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x452890
mov edx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4eb75c
push edx
call fcn.004aefb0
pop edi
pop ebp
add esp, 0x10c
ret 4
push 0x4f5ac4
push 0
push 0x4eb75c
mov ecx, ebp
call fcn.0042dac0
pop edi
pop ebp
add esp, 0x10c
ret 4