joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442b24
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x664560]
cmp byte [eax + 0xc], 0
je 0x442c91
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x442c8a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x665b24], 0
jne 0x442b78
push 0x442c98
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x442ca0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b24], eax
cmp dword [0x46abf4], 0
jne 0x442c73
push 0x442cb0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46abf4], eax
cmp dword [0x46abf4], 0
je 0x442c73
push 0x442cbc
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b28], eax
push 0x442ccc
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b2c], eax
push 0x442ce0
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b30], eax
push 0x442cf8
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b34], eax
push 0x442d10
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b38], eax
push 0x442d24
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b3c], eax
push 0x442d3c
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b40], eax
push 0x442d54
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b44], eax
push 0x442d70
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b48], eax
push 0x442d7c
mov eax, dword [0x46abf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665b4c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442c91
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x447018
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040428c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x447067
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44e840
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44e890]
test si, 4
je 0x44e854
or bl, 1
test si, 8
je 0x44e85e
or bl, 4
test si, 1
je 0x44e868
or bl, 8
test si, 2
je 0x44e872
or bl, 0x10
test si, 0x10
je 0x44e87c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e88b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44e894
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44e8cc]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e8ad
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e8bc
or bl, 4
test esi, 0x20000000
je 0x44e8c7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x454f90
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x454fa2
add esp, 0xfffffff0
call fcn.0040381c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419ca4
mov eax, dword [0x664218]
mov dword [eax + 4], ebx
mov dword [eax], 0x455334
mov eax, dword [0x664224]
mov dword [eax + 4], ebx
mov dword [eax], 0x455340
mov eax, ebx
call fcn.0045534c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411de0]
call fcn.004034b4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411de0]
call fcn.004034b4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411de0]
call fcn.004034b4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411de0]
call fcn.004034b4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411de0]
call fcn.004034b4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x451764
push eax
push 0
push 0
mov eax, dword [0x664378]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41b75c]
call fcn.0041cef4
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41b75c]
call fcn.0041cef4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41b75c]
call fcn.0041cef4
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045579c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x455664
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x455664
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x455664
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4550df
call fcn.00403874
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x455448
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4555f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4555d4
mov dl, 1
mov eax, dword [0x4121fc]
call fcn.004034b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040428c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4555c3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00442e84
test al, al
je 0x4555b6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x455604
lea eax, [ebp - 0x254]
call fcn.00408f94
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4555b6
xor eax, eax
push ebp
push 0x4555af
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45563c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x455598
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x455598
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4555b6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4554b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415d78
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4555fa
lea eax, [ebp - 0x260]
call fcn.0040428c
ret

Function at 0x455f3c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x665b70]
cmp byte [eax + 0xa5], 0
jne 0x455fad
cmp dword [0x665b88], 0
jne 0x455f6e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x455ef8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x665b88], eax
cmp dword [0x665b84], 0
jne 0x455f89
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x665b84], eax
cmp dword [0x665b8c], 0
jne 0x455fad
push esp
push 0
push 0
push 0x455e9c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x665b8c], eax
pop edx
ret
Function at 0x456640
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x665b70]
cmp dword [eax + 0x30], 0
je 0x4566ea
cmp dword [ebx + 0x94], 0
jne 0x4566e4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4565d0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4566e4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4566aa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4566e4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041415c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4566b9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x457248
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45727d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040437c
jmp 0x45728a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042e0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45839c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4583dd
mov eax, esi
call fcn.0043e41c
test al, al
je 0x4583dd
mov eax, dword [ebx + 0x84]
call fcn.0043e118
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4583dd
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e118
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x401780
Capabilities:
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [0xc2a2a8], 0x400
push esi
push edi
jne 0x4017c1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
lea esi, [ebp - 0x24]
call fcn.004018a0
mov ecx, esi
call fcn.004018c0
mov edi, dword [ebp - 4]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x2afe65
jle 0x4017dc
cmp edi, 0x78e90b55
jne 0x4017e5
inc esi
cmp esi, 0x1c03
jl 0x4017c6
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp esi, 0x206d47
jg 0x401811
inc esi
cmp esi, 0x4f6a4
jl 0x4017f4
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor esi, esi
lea esp, [esp]
push 0
call edi
cmp esi, 0x2b259d
jle 0x401834
cmp ebx, 0x785074d5
jne 0x40183d
inc esi
cmp esi, 0x11915
jl 0x401820
mov eax, dword [0x80b23c]
mov ecx, dword [0x80b210]
mov dword [0xc2a2a8], eax
mov dword [0xc2a2ac], ecx
call fcn.00401520
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, 0x3078f
pop ebx
cmp dword [0xc2a2a8], 0x51f
jne 0x401876
lea edx, [ebp - 0x2c]
push edx
call esi
sub edi, 1
jne 0x401864
mov eax, dword [0xc291fc]
mov dword [0xc2983c], eax
call eax
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40360b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80a158]
jne 0x403615
repz ret
jmp fcn.0040827c
Function at 0x408527
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040458a
and dword [ebp - 4], 0
cmp dword [0x80bf64], 0
mov ebx, eax
jne 0x4085d8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408689
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408689
push eax
call fcn.00404518
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x80bf64], eax
call esi
push eax
call fcn.00404518
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x80bf68], eax
call esi
push eax
call fcn.00404518
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x80bf6c], eax
call esi
push eax
call fcn.00404518
pop ecx
mov dword [0x80bf74], eax
test eax, eax
je 0x4085d8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404518
pop ecx
mov dword [0x80bf70], eax
mov eax, dword [0x80bf70]
cmp eax, ebx
je 0x408630
cmp dword [0x80bf74], ebx
je 0x408630
push eax
call fcn.00404593
push dword [0x80bf74]
mov esi, eax
call fcn.00404593
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408630
test edi, edi
je 0x408630
call esi
test eax, eax
je 0x408627
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408627
test byte [ebp - 0xc], 1
jne 0x408630
or dword [ebp + 0x10], 0x200000
jmp 0x408669
mov eax, dword [0x80bf68]
cmp eax, ebx
je 0x408669
push eax
call fcn.00404593
pop ecx
test eax, eax
je 0x408669
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408669
mov eax, dword [0x80bf6c]
cmp eax, ebx
je 0x408669
push eax
call fcn.00404593
pop ecx
test eax, eax
je 0x408669
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80bf64]
call fcn.00404593
pop ecx
test eax, eax
je 0x408689
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40868b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4217c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd0
movsx ecx, word [0x6a6908]
imul ecx, ecx, 0x4af8
push ebx
xor eax, eax
cmp word [ecx + 0x6ae45a], ax
push ebp
push esi
push edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x2c], eax
jle 0x421950
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
movsx edx, ax
mov ebx, edx
shl ebx, 5
fld qword [ebx + 0x485d28]
fcomp qword [0x4671d8]
fnstsw ax
test ah, 0x40
je 0x42192d
xor eax, eax
mov ecx, 0x19
mov dword [esp + 0x14], eax
lea edi, [esp + 0x7c]
mov dword [esp + 0x18], eax
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [esp + 0x1c], ax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x54], eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x70], ecx
inc edx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x30], ecx
push edx
lea edx, [esp + 0x34]
mov dword [esp + 0x64], eax
mov dword [esp + 0x38], ecx
push str._02d
push edx
mov dword [esp + 0x70], eax
mov word [esp + 0x44], cx
call ebp
mov edi, str.J00
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x485d18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cx, word [esp + 0x3c]
mov word [esp + 0x21], cx
mov eax, dword [esp + 0x20]
mov cx, word [esp + 0x24]
mov dword [edx], eax
lea eax, [esp + 0x4c]
mov word [edx + 4], cx
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x64]
push eax
lea edx, [esp + 0x7c]
push ecx
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x58]
push eax
lea edx, [esp + 0x9c]
push ecx
lea eax, [esp + 0x38]
push edx
push eax
call fcn.0043e2f0
fld qword [esp + 0x4c]
fcomp qword [0x4671d8]
add esp, 0x2c
fnstsw ax
test ah, 0x41
jne 0x42192d
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [ebx + 0x485d28], ecx
mov dword [ebx + 0x485d2c], edx
movsx ecx, word [0x6a6908]
mov eax, dword [esp + 0x2c]
imul ecx, ecx, 0x4af8
inc eax
cmp ax, word [ecx + 0x6ae45a]
mov dword [esp + 0x2c], eax
jl 0x421812
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451ac0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov dx, word [0x46cdc0]
push ebx
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
movsx eax, word [esi]
lea ecx, [eax*8]
sub ecx, eax
mov word [edi + ecx*2 + 4], dx
mov dl, byte [0x46ba38]
movsx eax, word [esi]
lea ecx, [eax*8]
sub ecx, eax
mov byte [edi + ecx*2 + 6], dl
movsx eax, word [esi]
lea ecx, [eax*8]
sub ecx, eax
mov eax, ebx
lea edx, [edi + ecx*2 + 7]
mov ecx, dword [eax]
mov dword [edx], ecx
mov cx, word [eax + 4]
mov word [edx + 4], cx
mov al, byte [eax + 6]
mov byte [edx + 6], al
mov cx, word [esi]
movsx eax, cx
inc eax
lea edx, [eax*8]
sub edx, eax
inc ecx
cmp word [esp + 0x24], 1
mov word [esi], cx
mov ecx, dword [ebx + 0xd]
lea eax, [edi + edx*2]
mov dword [eax], ecx
jne 0x451c25
movsx ecx, word [ebx + 0x18]
xor edx, edx
mov eax, 0x30303030
mov dword [esp + 0xc], edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
push ecx
lea edx, [esp + 0x14]
mov word [esp + 0x1c], ax
push str._01d
push edx
mov byte [esp + 0x26], al
call ebp
mov eax, dword [ebx + 0x14]
add esp, 0xc
lea ecx, [esp + 0x11]
push eax
push str._05ld
push ecx
call ebp
movsx eax, word [ebx + 0x1e]
mov dx, word [ebx + 0x1a]
add esp, 0xc
lea ecx, [esp + 0x18]
mov word [esp + 0x16], dx
push eax
push str._03d
push ecx
call ebp
movsx eax, word [esi]
add esp, 0xc
lea edx, [eax*8]
sub edx, eax
mov ax, word [0x46cdc0]
pop ebp
mov word [edi + edx*2 + 4], ax
mov dl, byte [0x46ba48]
movsx eax, word [esi]
lea ecx, [eax*8]
sub ecx, eax
mov byte [edi + ecx*2 + 6], dl
mov cx, word [esi]
movsx eax, cx
lea edx, [eax*8]
sub edx, eax
inc ecx
mov word [esi], cx
mov ecx, dword [esp + 0xc]
lea eax, [edi + edx*2 + 7]
mov dword [eax], ecx
mov edx, dword [esp + 0x10]
mov dword [eax + 4], edx
mov cx, word [esp + 0x14]
mov word [eax + 8], cx
mov dl, byte [esp + 0x16]
mov byte [eax + 0xa], dl
movsx eax, word [esi]
mov dx, word [0x46cdc0]
add ebx, 7
lea ecx, [eax*8]
sub ecx, eax
mov word [edi + ecx*2 + 4], dx
mov dl, byte [0x46cb58]
movsx eax, word [esi]
lea ecx, [eax*8]
sub ecx, eax
mov byte [edi + ecx*2 + 6], dl
mov ax, word [esi]
movsx ecx, ax
lea edx, [ecx*8]
sub edx, ecx
inc eax
mov word [esi], ax
mov eax, dword [ebx]
lea ecx, [edi + edx*2 + 7]
pop edi
pop esi
mov dword [ecx], eax
mov dl, byte [ebx + 4]
mov byte [ecx + 4], dl
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x45b870
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0xc8
push ebx
push ebp
push esi
push edi
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x38]
mov dword [esp + 0x10], 0x28
rep stosd dword es:[edi], eax
mov eax, dword [0x534800]
cmp dword [eax + 0x3dc60], 1
jne 0x45b8af
lea ecx, [esp + 0x10]
lea edx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x45b8bf
lea eax, [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov al, byte [esp + 0x38]
test al, al
jne 0x45b8f8
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x38]
lea edx, [esp + 0x38]
rep stosd dword es:[edi], eax
mov edi, str.Standalone
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x88]
mov dl, byte [esp + 0x38]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x38]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov al, byte [esp + 0x39]
dec ecx
mov byte [esp + 0x89], dl
mov byte [esp + 0x8a], al
mov cl, byte [esp + ecx + 0x37]
mov byte [esp + 0x88], cl
mov cl, byte [esp + 0x3a]
mov byte [esp + 0x8b], cl
mov eax, dword [esp + 0x88]
push eax
mov dword [0x846be4], eax
call dword [sym.imp.MSVCRT.dll_srand]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
add esp, 4
mov dword [esp + 0x14], 0
mov edx, dword [0x4f1b28]
mov ecx, 0x14
xor eax, eax
mov edi, 0x844444
rep stosd dword es:[edi], eax
mov cx, word [edx + 0x66]
lea eax, [edx + 0x66]
push eax
push str._sTUCFILELOCKTFNAME
push 0x844444
mov word [0x844444], cx
call esi
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x844444
call ebp
cmp eax, 0xffffffff
jne 0x45ba4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x846be0], eax
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x12c
mov dword [esp + 0x14], eax
jg 0x45ba51
call ebx
mov edx, eax
mov ecx, 0x14
push edx
xor eax, eax
lea edi, [esp + 0x8c]
lea edx, [esp + 0x8c]
push 0x46cdb4
push edx
rep stosd dword es:[edi], eax
call esi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x95]
push edx
stosw word es:[edi], ax
mov al, byte [esp + 0x98]
mov byte [esp + 0x29], cl
mov byte [esp + 0x28], al
mov byte [esp + 0x2a], 0x30
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0x10
mov dword [0x844424], eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45b970
mov dword [0x846bd4], eax
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc8
ret
Function at 0x45c2f0
Capabilities:
Delete file

Disassembly:
sub esp, 0x64
mov ecx, 0x19
xor eax, eax
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x78]
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..IDX
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..DAT
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x64
ret
Function at 0x45ecc0
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp], eax
push esi
movsx edx, byte [ecx]
mov dword [esp + 8], eax
push edx
mov word [esp + 0x10], ax
lea eax, [esp + 8]
push str._C:_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 4]
xor esi, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
mov eax, 1
je 0x45ed07
mov eax, esi
pop esi
add esp, 0xc
ret