joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4548b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, cl
test bl, bl
jne 0x4548bb
xor al, al
pop ebx
ret
sub edx, 1
je 0x4548e0
movzx eax, bl
push eax
sub edx, 1
je 0x4548d6
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
pop ebx
ret
mov al, bl
dec al
cmp al, 5
ja 0x4548ed
cmp bl, 3
jne 0x4548f5
mov al, bl
add al, 0x66
cmp al, 5
ja 0x45490c
cmp dword [0x4db798], 0
movzx eax, bl
je 0x45493f
mov al, byte [eax + 0x4dc110]
shr al, 7
pop ebx
ret
cmp dword [0x4db79c], 0
je 0x45493c
push 0
xor edx, edx
mov cl, bl
call fcn.004164f0
add esp, 4
test al, al
je 0x45492e
mov cl, 1
call fcn.00416310
movzx eax, bl
pop ebx
mov al, byte [eax + 0x4dc110]
shr al, 7
ret
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret

Function at 0x454f10
Capabilities:
Get disk information

Disassembly:
sub esp, 0x210
xor eax, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
push eax
push 0x410
mov word [edi], ax
call ebx
mov ebp, eax
test ebp, ebp
jne 0x454f52
push esi
push eax
push 0x1000
call ebx
mov ebp, eax
test ebp, ebp
jne 0x454f52
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
cmp byte [esp + 0x228], 0
push 0x104
push edi
push 0
push ebp
je 0x454f6d
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x454f73
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebx, eax
test ebx, ebx
jne 0x45509d
mov eax, dword [0x4cf41c]
test eax, eax
je 0x45509d
push 0x104
push edi
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x45509d
cmp byte [esp + 0x228], 0
je 0x454ff5
push 0x5c
push edi
call fcn.00492647
mov edx, eax
add esp, 8
test edx, edx
je 0x45509d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x454fc1
sub ecx, esi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.00492730
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x210
ret
mov eax, 0x41
mov dword [esp + 0x12], 0x3a
mov word [esp + 0x10], ax
nop word [eax + eax]
push 0x104
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esi, eax
cmp esi, 2
jbe 0x45504c
sub esi, 2
lea eax, [esp + 0x18]
push esi
push edi
push eax
call fcn.0049e48d
add esp, 0xc
test eax, eax
jne 0x45504c
cmp word [edi + esi*2], 0x5c
lea ecx, [edi + esi*2]
je 0x455072
mov ax, word [esp + 0x10]
inc ax
mov word [esp + 0x10], ax
cmp ax, 0x5a
jbe 0x455010
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x210
ret
movzx eax, word [esp + 0x10]
sub ebx, esi
mov word [edi], ax
movzx eax, word [esp + 0x12]
mov word [edi + 2], ax
lea eax, [ebx*2 + 2]
push eax
push ecx
lea eax, [edi + 4]
push eax
call fcn.00492730
add esp, 0xc
add ebx, 2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x210
ret
Function at 0x457970
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
sub esp, 0x210
push ebx
push ebp
push 0
mov ebp, ecx
xor bl, bl
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
push eax
push 0x4ae800
push 1
push 0
push 0x4ae810
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x457b45
mov eax, dword [esp + 8]
push dword [esp + 0x21c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [esp + 0x224]
cmp word [edx], 0
je 0x4579ce
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [esp + 0x228]
cmp word [edx], 0
je 0x4579e6
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [esp + 0x22c]
cmp word [edx], 0
je 0x4579fe
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x238]
cmp word [edi], 0
je 0x457a53
mov esi, dword [esp + 0x240]
cmp word [esi], 0
je 0x457a45
mov ecx, esi
call fcn.00403e00
test al, al
je 0x457a37
push 0x10
push 0
push esi
call fcn.00495c2d
add esp, 0xc
lea edx, [eax - 1]
jmp 0x457a47
push esi
call fcn.00495cca
add esp, 4
lea edx, [eax - 1]
jmp 0x457a47
xor edx, edx
mov eax, dword [esp + 0x10]
push edx
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov esi, dword [esp + 0x23c]
cmp word [esi], 0
je 0x457a95
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.00416d70
add esp, 0xc
test al, al
je 0x457a95
mov ecx, dword [esp + 0x10]
mov esi, 0x600
movzx eax, al
or ax, si
movzx eax, ax
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x34]
mov esi, dword [esp + 0x244]
cmp word [esi], 0
je 0x457ad2
mov ecx, esi
call fcn.00403e00
test al, al
je 0x457abc
push 0x10
push 0
push esi
call fcn.00495c2d
add esp, 0xc
jmp 0x457ac5
push esi
call fcn.00495cca
add esp, 4
mov edx, eax
mov eax, dword [esp + 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x4ae820
push eax
mov ecx, dword [eax]
call dword [ecx]
pop edi
pop esi
test eax, eax
js 0x457b3b
push 0
lea eax, [esp + 0x14]
push eax
push 0x104
push dword [esp + 0x22c]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x457b31
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
call fcn.0047b2f0
mov bl, 1
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
test bl, bl
je 0x457b5f
pop ebp
mov eax, 1
pop ebx
add esp, 0x210
ret 0x24
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
jne 0x457b8e
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop ebp
pop ebx
add esp, 0x210
ret 0x24
push 0x4c602c
push 0
push 0x4c8740
mov ecx, ebp
call fcn.00434ec0
pop ebp
pop ebx
add esp, 0x210
ret 0x24
Function at 0x457bb0
Capabilities:
Delete file
Move file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x230
push esi
mov esi, ecx
test eax, eax
je 0x457c80
cmp word [eax], 0
je 0x457c80
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [esp + 0x28]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x457bf0
sub eax, edx
sar eax, 1
je 0x457c10
cmp word [esp + eax*2 + 0x26], 0x5c
jne 0x457c10
xor ecx, ecx
mov word [esp + eax*2 + 0x26], cx
lea ecx, [esp + 0x28]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457c17
xor eax, eax
mov dword [esp + 8], 3
sub ecx, edx
mov dword [esp + 0x1a], eax
sar ecx, 1
mov dword [esp + 0x1e], eax
mov dword [esp + 0x16], eax
mov dword [esp + 4], eax
mov word [esp + ecx*2 + 0x2a], ax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, 0x4054
mov word [esp + 0x14], ax
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
mov ecx, esi
setne al
movzx eax, al
push eax
call fcn.00434f60
pop esi
add esp, 0x230
ret 4
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
jne 0x457cae
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop esi
add esp, 0x230
ret 4
push 0x4c602c
push 0
push 0x4c8740
call fcn.00434ec0
pop esi
add esp, 0x230
ret 4
Function at 0x457d50
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10c
push ebx
push esi
push 1
push 0
push 0xffffffffffffffff
mov ebx, ecx
mov ecx, dword [0x4ddf18]
push 0
call fcn.0047b2f0
mov esi, dword [esp + 0x118]
test esi, esi
je 0x457ed2
cmp word [esi], 0
je 0x457ed2
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebp, eax
test ebp, ebp
jne 0x457df1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d89c0]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jne 0x457dd2
mov ecx, dword [0x4db768]
push 1
push ebp
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 4
push 0x4c602c
push 0
push 0x4c8740
mov ecx, ebx
call fcn.00434ec0
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 4
push edi
push ebp
call fcn.00495d48
add esp, 4
mov edi, eax
push edi
push ebp
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x457ea6
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push 0x4c9114
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x457ea6
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [esp + 0x28]
push edx
push str._u._u._u._u
push 0x80
push eax
call fcn.004782d0
push edi
call fcn.00495d53
mov eax, dword [0x4d89c0]
add esp, 0x20
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
mov dword [eax + 0x30], 0
call fcn.0047b2f0
mov ecx, dword [0x4ddf18]
lea eax, [esp + 0x1c]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.0047b2f0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d89c0]
push edi
mov dword [ecx + 0x30], eax
call fcn.00495d53
add esp, 4
mov ecx, ebx
call fcn.00436ff0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 4
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x457f08
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop esi
pop ebx
add esp, 0x10c
ret 4
push 0x4c602c
push 0
push 0x4c8740
mov ecx, ebx
call fcn.00434ec0
pop esi
pop ebx
add esp, 0x10c
ret 4
Function at 0x457f30
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file

Disassembly:
sub esp, 0x43c
lea eax, [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push eax
lea eax, [esp + 0x30]
mov edi, edx
push eax
push 0x104
push ecx
call esi
lea ecx, [esp + 0x2c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457f60
sub ecx, edx
sar ecx, 1
je 0x457f80
cmp word [esp + ecx*2 + 0x2a], 0x5c
jne 0x457f80
xor eax, eax
mov word [esp + ecx*2 + 0x2a], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x23c]
push eax
push 0x104
push edi
call esi
lea ecx, [esp + 0x238]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457fa0
sub ecx, edx
sar ecx, 1
je 0x457fc6
cmp word [esp + ecx*2 + 0x236], 0x5c
jne 0x457fc6
xor eax, eax
mov word [esp + ecx*2 + 0x236], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x2c]
push eax
call esi
cmp eax, 0xffffffff
je 0x457ff9
test al, 0x10
je 0x457ff9
lea eax, [esp + 0x238]
push eax
call esi
cmp eax, 0xffffffff
je 0x458004
test al, 0x10
je 0x458004
cmp byte [esp + 0x448], 0
jne 0x458014
pop edi
xor al, al
pop esi
add esp, 0x43c
ret
lea ecx, [esp + 0x238]
call fcn.00458a30
test al, al
je 0x457ff9
lea ecx, [esp + 0x2c]
add ecx, 0xfffffffe
nop dword [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x458020
mov eax, dword [str..]
mov dword [ecx], eax
mov eax, dword [0x4d1404]
mov dword [ecx + 4], eax
mov ax, word [0x4d1408]
mov word [ecx + 8], ax
lea ecx, [esp + 0x2c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458050
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [esp + ecx*2 + 0x2e], ax
lea ecx, [esp + 0x238]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458070
xor eax, eax
sub ecx, edx
sar ecx, 1
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
mov word [esp + 0x28], ax
movups xmmword [esp + 0x10], xmm0
mov word [esp + ecx*2 + 0x23a], ax
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x238]
mov dword [esp + 0x18], eax
mov eax, 0x614
mov word [esp + 0x1c], ax
lea eax, [esp + 0xc]
push eax
movq qword [esp + 0x24], xmm0
mov dword [esp + 0x14], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
pop edi
sbb eax, eax
inc eax
pop esi
add esp, 0x43c
ret
Function at 0x4580e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x43c
lea eax, [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push eax
lea eax, [esp + 0x30]
mov edi, edx
push eax
push 0x104
push ecx
call esi
lea ecx, [esp + 0x2c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458110
sub ecx, edx
sar ecx, 1
je 0x458130
cmp word [esp + ecx*2 + 0x2a], 0x5c
jne 0x458130
xor eax, eax
mov word [esp + ecx*2 + 0x2a], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x23c]
push eax
push 0x104
push edi
call esi
lea ecx, [esp + 0x238]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458150
sub ecx, edx
sar ecx, 1
je 0x458176
cmp word [esp + ecx*2 + 0x236], 0x5c
jne 0x458176
xor eax, eax
mov word [esp + ecx*2 + 0x236], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x2c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4582ad
test al, 0x10
je 0x4582ad
lea eax, [esp + 0x238]
push eax
call esi
mov esi, dword [esp + 0x448]
cmp eax, 0xffffffff
je 0x4581c0
test al, 0x10
je 0x4582ad
cmp esi, 1
je 0x4581c0
cmp esi, 2
jne 0x4582ad
lea edx, [esp + 0x238]
lea ecx, [esp + 0x2c]
call fcn.00458af0
lea ecx, [esp + 0x2c]
test al, al
je 0x458205
push 1
lea edx, [esp + 0x23c]
call fcn.00457f30
add esp, 4
test al, al
je 0x4582ad
mov dl, 1
lea ecx, [esp + 0x2c]
call fcn.004582c0
pop edi
pop esi
add esp, 0x43c
ret
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458210
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [esp + ecx*2 + 0x2e], ax
lea ecx, [esp + 0x238]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458230
sub ecx, edx
xor eax, eax
sar ecx, 1
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
mov word [esp + 0x28], ax
movq qword [esp + 0x20], xmm0
mov word [esp + ecx*2 + 0x23a], ax
lea eax, [esp + 0x2c]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x238]
mov dword [esp + 0x18], eax
mov eax, 0x614
mov dword [esp + 0x10], 1
mov word [esp + 0x1c], ax
cmp esi, 2
jne 0x458294
mov eax, 0x615
mov word [esp + 0x1c], ax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
pop edi
sbb eax, eax
inc eax
pop esi
add esp, 0x43c
ret
pop edi
xor al, al
pop esi
add esp, 0x43c
ret
Function at 0x4582c0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
sub esp, 0x230
lea eax, [esp + 0x20]
push ebx
push eax
lea eax, [esp + 0x2c]
mov bl, dl
push eax
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [esp + 0x28]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4582e6
sub ecx, edx
sar ecx, 1
je 0x458306
cmp word [esp + ecx*2 + 0x26], 0x5c
jne 0x458306
xor eax, eax
mov word [esp + ecx*2 + 0x26], ax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4583b5
test al, 0x10
je 0x4583b5
test bl, bl
jne 0x45833e
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
pop ebx
setne al
add esp, 0x230
ret
lea ecx, [esp + 0x28]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458345
sub ecx, edx
mov dword [esp + 0x10], 0
sar ecx, 1
xor eax, eax
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x16], 0
mov word [esp + ecx*2 + 0x2a], ax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, 0x614
mov word [esp + 0x14], ax
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
pop ebx
sbb eax, eax
inc eax
add esp, 0x230
ret
xor al, al
pop ebx
add esp, 0x230
ret
Function at 0x458a30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x458ad4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
je 0x458abf
sub eax, 1
jne 0x458ae1
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458a60
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x458ae1
lea eax, [ecx*2 + 2]
call fcn.004ab330
mov edi, esp
mov ecx, esi
mov edx, edi
sub edx, esi
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x458a90
push 0x5c
push edi
call fcn.00492647
add esp, 8
test eax, eax
je 0x458ae1
xor ecx, ecx
mov word [eax], cx
mov ecx, edi
call fcn.00458a30
test al, al
je 0x458ae1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
test al, 0x10
je 0x458ae1
mov al, 1
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
xor al, al
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret

Function at 0x458c20
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push eax
push 0x28
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x458c44
xor al, al
pop esi
add esp, 0x14
ret
lea eax, [esp + 0xc]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 0
push dword [esp + 0x18]
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x458c3d
push eax
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
pop esi
setne al
add esp, 0x14
ret
Function at 0x468970
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x468980
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret

Function at 0x468990
Capabilities:
Hide graphical window

Disassembly:
cmp dword [ecx + 0x24], 0
jne 0x4689ac
mov eax, dword [ecx + 4]
test eax, eax
je 0x4689c1
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret
push 0
push 0x2af80006
push 0x414
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
ret

Function at 0x468a00
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x50
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x468b77
push ebx
push ebp
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
jbe 0x468a49
xor ebx, ebx
nop dword [eax]
mov eax, dword [esi + 0x18]
add eax, ebx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x468a40
cmp byte [eax + 4], 6
je 0x468a40
push str.Submit
push eax
push ecx
mov ecx, esi
call fcn.00468c60
inc edi
add ebx, 0x14
cmp edi, dword [esi + 0x10]
jb 0x468a20
xor edi, edi
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], edi
xor ebx, ebx
mov dword [esp + 0x1c], edi
xor ebp, ebp
mov dword [esp + 0x10], ecx
cmp ebx, dword [esi + 0x10]
mov dword [esp + 0x18], edx
je 0x468a81
mov eax, dword [esi + 0x18]
push 0xfffffffffffffff0
push dword [eax + edx]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x20000
je 0x468ad0
mov ecx, dword [esp + 0x10]
cmp edi, 1
jne 0x468ab5
cmp ebp, edi
jle 0x468ab5
push 0xa
lea eax, [esp + 0x24]
push eax
xor eax, eax
cmp ecx, 0xffffffff
cmovne eax, ecx
push eax
call fcn.00494572
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
add esp, 0xc
push edi
push 0
push 0xffffffffffffffff
push eax
call fcn.0047b2f0
cmp ebx, dword [esi + 0x10]
je 0x468b62
xor ecx, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], ecx
xor ebp, ebp
jmp 0x468ad4
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esp + 0x18]
cmp byte [eax + edx + 4], 6
jne 0x468b47
mov edi, dword [eax + edx + 8]
inc ebp
test edi, edi
je 0x468af4
inc ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], ecx
push 0
push 0
push 0xf0
push dword [eax + edx]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x468b31
cmp dword [esp + 0x10], 0
mov ecx, 0xffffffff
mov eax, ebp
cmovne eax, ecx
mov ecx, eax
mov dword [esp + 0x10], ecx
test edi, edi
je 0x468b4b
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
jmp 0x468b40
test edi, edi
je 0x468b47
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
mov ecx, edi
call fcn.0047b2f0
mov ecx, dword [esp + 0x10]
add dword [esp + 0x18], 0x14
inc ebx
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jbe 0x468a66
cmp byte [esp + 0x64], 0
pop edi
pop ebp
pop ebx
je 0x468b77
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
add esp, 0x50
ret 4
Function at 0x468b90
Capabilities:
Get graphical window text

Disassembly:
mov eax, ecx
cmp edx, 0x2af8
jae 0x468c43
test eax, eax
je 0x468c43
cmp dword [eax + 4], 0
je 0x468c43
cmp edx, dword [eax + 0x10]
jae 0x468c43
mov eax, dword [eax + 0x18]
lea ecx, [edx + edx*4]
mov edx, dword [esp + 4]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + 8]
test edx, edx
je 0x468c0e
test ecx, ecx
je 0x468c02
mov ecx, dword [ecx + 0x18]
push esi
mov esi, edx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x468bd7
lea eax, [edx + 2]
pop esi
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x468bf0
sub edx, eax
sar edx, 1
mov eax, edx
ret
push 0x40
push edx
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
test ecx, ecx
je 0x468c30
mov eax, dword [ecx + 0x18]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x468c20
sub eax, edx
sar eax, 1
ret
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, 0x3f
cmp eax, ecx
cmova eax, ecx
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x468c50
xor ecx, ecx
mov word [eax], cx
xor eax, eax
ret
Function at 0x46b600
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
movzx eax, word [esi]
test ax, ax
je 0x46b63b
nop
movzx eax, ax
cmp eax, 0x21
je 0x46b62c
cmp eax, 0x2b
je 0x46b627
cmp eax, 0x5e
jne 0x46b63b
or bl, 2
jmp 0x46b62f
or bl, 1
jmp 0x46b62f
or bl, 4
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x46b610
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.00416d70
mov bh, al
add esp, 0xc
test bh, bh
jne 0x46b65e
pop esi
xor eax, eax
pop ebx
ret
mov ecx, esi
call fcn.00416cc0
movzx edx, ax
test dx, dx
jne 0x46b679
xor dl, dl
mov cl, bh
call fcn.004172e0
movzx edx, ax
mov al, bl
or al, 8
and edx, 0x100
movzx ecx, al
movzx eax, bl
cmove ecx, eax
movzx eax, cl
movzx ecx, bh
shl ax, 8
pop esi
or ax, cx
pop ebx
ret