joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61c0a4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
xor eax, eax
push ebp
push 0x61c13e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0061c4fc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.00403b24
mov ecx, 1
mov edx, 0x80000000
mov esi, dword [ebp - 4]
mov eax, esi
call fcn.006585a4
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x61c106
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x61c123
mov eax, esi
call fcn.006585c4
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x61c123
push eax
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c145
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x61c66c
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x61c7cd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x66c890], 0
jne 0x61c6a6
call fcn.0064d744
mov dword [0x66c890], eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.00654918
mov edx, dword [ebp - 4]
mov eax, dword [0x66c890]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ebx, eax
test ebx, ebx
jge 0x61c79e
xor ebx, ebx
mov eax, esi
call fcn.0061c614
cmp eax, 2
jne 0x61c6dc
mov bl, 1
jmp 0x61c78b
cmp eax, 3
jne 0x61c78b
lea eax, [ebp - 0x23c]
mov ecx, dword [ebp - 4]
mov edx, 0x61c7e4
call fcn.00403b24
mov eax, dword [ebp - 0x23c]
mov ecx, 3
mov edx, 0x80000000
call fcn.006585a4
mov esi, eax
cmp esi, 0xffffffff
je 0x61c78b
lea eax, [ebp - 0x22c]
mov edx, 0x224
call fcn.00658544
mov dword [ebp - 0x228], 0x224
xor eax, eax
mov dword [ebp - 0x238], eax
xor eax, eax
mov dword [ebp - 0x234], eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0xc
lea eax, [ebp - 0x238]
push eax
push 0x2d1400
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x61c785
mov edi, dword [ebp - 0x210]
cmp edi, 4
je 0x61c783
cmp edi, 7
je 0x61c783
cmp byte [ebp - 0x222], 0
je 0x61c785
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
xor ecx, ecx
mov cl, bl
mov edx, dword [ebp - 4]
mov eax, dword [0x66c890]
call fcn.0064ed68
jmp 0x61c7ac
mov edx, ebx
mov eax, dword [0x66c890]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c7d4
lea eax, [ebp - 0x23c]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x61c944
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor eax, eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x268]
mov edx, dword [0x65271c]
call fcn.00403e48
xor eax, eax
push ebp
push 0x61caa1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.00626a74
test eax, eax
jne 0x61ca6a
lea eax, [ebp - 4]
call fcn.0061c4fc
lea eax, [ebp - 0x26c]
mov ecx, 0x61cab0
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
lea ecx, [ebp - 0x268]
mov edx, 0x3f
call fcn.00654658
test eax, eax
jne 0x61ca2f
mov edx, dword [ebp - 0x260]
mov eax, 0x61cabc
call fcn.00654124
dec eax
jne 0x61ca20
test byte [ebp - 0x264], 0x10
je 0x61ca00
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
xor edx, edx
call fcn.00621e10
jmp 0x61ca20
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x268]
call fcn.006546fc
test eax, eax
je 0x61c9c1
lea eax, [ebp - 0x268]
call fcn.00654720
lea edx, [ebp - 0x270]
mov eax, 0x61cac8
call fcn.00654410
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61caa8
lea eax, [ebp - 0x270]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x268]
mov edx, dword [0x65271c]
call fcn.00403f10
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x61d398
Capabilities:
Create process on windows

Disassembly:
add esp, 0xffffffc4
mov eax, esp
mov edx, 0x3c
call fcn.00658544
mov dword [esp], 0x3c
mov eax, 0x61d3e8
mov dword [esp + 0xc], eax
mov eax, dword [0x669348]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [0x669850]
mov eax, dword [eax]
call fcn.00403aa8
mov dword [esp + 0x14], eax
mov eax, dword [0x6698b0]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
push esp
call sub.shell32.dll_ShellExecuteExW
add esp, 0x3c
ret
Function at 0x61d3f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x61d4a1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x66c8d8], 0
je 0x61d48b
push 5
push 0
mov eax, dword [0x66c8dc]
call fcn.00403aa8
push eax
mov eax, dword [0x66c8d8]
push eax
push 0x61d4ac
push 0
call sub.shell32.dll_ShellExecuteW
call sub.kernel32.dll_GetLastError
cmp eax, 0x2e4
jne 0x61d48b
lea eax, [ebp - 0x3c]
mov edx, 0x3c
call fcn.00658544
mov dword [ebp - 0x3c], 0x3c
mov eax, 0x61d4b8
mov dword [ebp - 0x30], eax
mov eax, dword [0x66c8d8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x66c8dc]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x40]
mov eax, dword [0x66c8d8]
call fcn.006548ec
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d4a8
lea eax, [ebp - 0x40]
call fcn.00403880
ret
Function at 0x61f580
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 7], cx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61f7b0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x66c7b8], 0
je 0x61f5bd
mov word [ebp - 0xa], 2
jmp 0x61f795
call fcn.0047a1bc
test eax, eax
je 0x61f60c
mov eax, dword [0x6697c0]
cmp dword [eax], 0
je 0x61f60c
mov eax, dword [0x6690d8]
mov ax, word [eax + 0xa9]
mov word [ebp - 0xc], ax
call fcn.00529a70
and byte [eax + 0x14], 0xfb
test byte [ebp - 0xc], 0x80
je 0x61f5f8
call fcn.00529a70
or byte [eax + 0x14], 4
mov eax, dword [0x6690d8]
and word [eax + 0xa9], 0xff7f
mov byte [ebp - 0xe], 1
jmp 0x61f610
mov byte [ebp - 0xe], 0
mov ebx, dword [0x669938]
mov bl, byte [ebx + 0x10]
cmp bl, 0xff
je 0x61f632
mov eax, dword [0x669938]
mov eax, ebx
call fcn.0062e8b8
test al, al
jne 0x61f632
xor eax, eax
jmp 0x61f634
mov al, 1
mov ebx, eax
mov eax, dword [0x669168]
mov eax, dword [eax]
mov al, byte [eax + 0x16d]
xor al, 1
test al, bl
je 0x61f655
mov eax, dword [0x669168]
mov eax, dword [eax]
call fcn.0063d480
mov eax, dword [0x669168]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
push eax
call sub.user32.dll_IsWindowVisible
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
test bl, bl
je 0x61f68b
mov al, byte [ebp - 5]
sub al, 4
jae 0x61f68b
xor eax, eax
mov al, byte [ebp - 5]
add eax, 0x3e8
call fcn.0049a860
mov word [ebp - 0xa], 2
mov eax, dword [0x669168]
mov eax, dword [eax]
cmp byte [eax + 0x16d], 0
je 0x61f6b6
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x14]
call fcn.006560b4
jmp 0x61f72f
xor eax, eax
push ebp
push 0x61f712
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0061c23c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x669938]
call fcn.004032c8
mov eax, dword [0x669938]
mov dl, byte [ebp - 5]
mov byte [eax + 4], dl
mov eax, dword [0x669938]
mov dx, word [ebp - 7]
mov word [eax + 5], dx
call fcn.0062e770
mov word [ebp - 0xa], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61f72f
cmp byte [ebp - 0xd], 0
jne 0x61f74a
push 0
mov eax, dword [0x669168]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 0xe], 0
je 0x61f769
mov eax, dword [0x6690d8]
mov dx, word [ebp - 0xc]
mov word [eax + 0xa9], dx
call fcn.00529a70
and byte [eax + 0x14], 0xfb
call fcn.004fe288
test eax, eax
je 0x61f795
call fcn.004fe3f4
call fcn.005336e0
test eax, eax
je 0x61f795
call fcn.005336e0
cmp byte [eax + 0x464], 0
je 0x61f795
mov byte [eax + 0x46a], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f7b7
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403298
ret

Function at 0x621268
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push eax
push 0x62127c
push 0
call sub.shell32.dll_ShellExecuteW
ret
Function at 0x621288
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x621390
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00654560
test al, al
je 0x621368
mov eax, dword [0x669328]
cmp byte [eax], 0
je 0x621305
mov eax, dword [0x669220]
cmp dword [eax], 0
jne 0x6212de
push 0x62139c
push 0x6213b0
call sub.kernel32.dll_LoadLibraryW
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [0x669220]
mov dword [edx], eax
mov eax, dword [0x66912c]
cmp dword [eax], 0
jne 0x621305
push 0x6213c8
push 0x6213b0
call sub.kernel32.dll_LoadLibraryW
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [0x66912c]
mov dword [edx], eax
mov eax, dword [0x669220]
cmp dword [eax], 0
je 0x621341
mov eax, dword [0x66912c]
cmp dword [eax], 0
je 0x621341
push ebx
mov eax, dword [0x669220]
mov eax, dword [eax]
call eax
mov ebx, eax
test ebx, ebx
je 0x62137a
push 0
push 0
push 0
push ebx
mov eax, dword [0x66912c]
mov eax, dword [eax]
call eax
push ebx
call sub.ole32.dll_CoTaskMemFree
jmp 0x62137a
push 5
push 0
lea ecx, [ebp - 4]
mov eax, 0x6213e4
mov edx, ebx
call fcn.00655274
mov eax, dword [ebp - 4]
push eax
push 0x6213f4
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x62137a
lea edx, [ebp - 4]
mov eax, ebx
call fcn.006548ec
mov eax, dword [ebp - 4]
call fcn.00621268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x621397
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x6216bc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x621739
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x62171e
mov eax, ebx
call fcn.00621634
test al, al
jne 0x62171e
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00621840
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.006548ec
mov eax, dword [ebp - 4]
call fcn.00403ab8
mov esi, eax
mov eax, ebx
call fcn.00403ab8
cmp esi, eax
jge 0x621716
mov eax, dword [ebp - 4]
call fcn.006216bc
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x621740
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x621904
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
call fcn.0061b8e0
mov eax, ebx
call fcn.006585b8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
call sub.kernel32.dll_GetDiskFreeSpaceW
call fcn.0061b93c
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x10
pop ebx
ret
Function at 0x621c64
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x65271c]
call fcn.00403e48
xor eax, eax
push ebp
push 0x621d57
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00621814
lea eax, [ebp - 0x270]
mov ecx, 0x621d68
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.00654658
test eax, eax
jne 0x621d15
test byte [ebp - 0x268], 0x10
je 0x621d06
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 8]
call fcn.00621748
test al, al
je 0x621d06
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
lea eax, [ebp - 0x26c]
call fcn.006546fc
test eax, eax
je 0x621cd7
lea eax, [ebp - 0x26c]
call fcn.00654720
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x621d5e
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x65271c]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x621d70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x621df9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x66907c]
cmp byte [eax], 0
jne 0x621da1
mov eax, dword [0x6690d8]
test byte [eax + 0xd], 0x80
je 0x621da9
push ebx
call sub.kernel32.dll_DeleteFileW
jmp 0x621de3
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
lea eax, [ebp - 4]
mov ecx, 0x621e0c
mov edx, ebx
call fcn.00403b24
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], 0x54
xor eax, eax
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0x24]
push eax
call sub.shell32.dll_SHFileOperationW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x621e00
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x621e10
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
xor ecx, ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x65271c]
call fcn.00403e48
xor eax, eax
push ebp
push 0x621f1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00621814
lea eax, [ebp - 0x270]
mov ecx, 0x621f30
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.00654658
test eax, eax
jne 0x621ed2
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
test byte [ebp - 0x268], 0x10
jne 0x621eb9
test bl, bl
je 0x621eae
mov eax, dword [ebp - 8]
call fcn.00621d70
jmp 0x621ec3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x621ec3
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00621e10
lea eax, [ebp - 0x26c]
call fcn.006546fc
test eax, eax
je 0x621e86
lea eax, [ebp - 0x26c]
call fcn.00654720
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x621f24
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x65271c]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x622048
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
xor ecx, ecx
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 8]
call fcn.00403e28
lea eax, [ebp - 0x274]
mov edx, dword [0x65271c]
call fcn.00403e48
xor eax, eax
push ebp
push 0x6221c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00621814
lea eax, [ebp - 8]
call fcn.00621814
lea eax, [ebp - 0x278]
mov ecx, 0x6221d8
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x274]
mov edx, 0x3f
call fcn.00654658
jmp 0x622175
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00403b24
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 8]
call fcn.00403b24
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
je 0x62216a
test byte [ebp - 0x270], 0x10
je 0x62212b
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00622048
pop ecx
jmp 0x62216a
mov eax, dword [ebp + 8]
cmp byte [eax - 6], 0
jne 0x622140
mov eax, dword [ebp - 0x10]
call fcn.00654560
test al, al
jne 0x62216a
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x62216a
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0061fba8
cmp ax, 2
jne 0x622140
mov eax, dword [ebp + 8]
mov byte [eax - 5], 0
lea eax, [ebp - 0x274]
call fcn.006546fc
test eax, eax
jne 0x622186
mov eax, dword [ebp + 8]
cmp byte [eax - 5], 0
jne 0x6220d2
lea eax, [ebp - 0x274]
call fcn.00654720
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6221cf
lea eax, [ebp - 0x278]
call fcn.00403880
lea eax, [ebp - 0x274]
mov edx, dword [0x65271c]
call fcn.00403f10
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403898
ret
Function at 0x6221e0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x65271c]
call fcn.00403e48
xor eax, eax
push ebp
push 0x6222f0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00621814
lea eax, [ebp - 0x270]
mov ecx, 0x622300
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.00654658
test eax, eax
jne 0x6222ae
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
je 0x62229f
test byte [ebp - 0x268], 0x10
je 0x622296
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.006221e0
pop ecx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x62229f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x26c]
call fcn.006546fc
test eax, eax
je 0x622253
lea eax, [ebp - 0x26c]
call fcn.00654720
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6222f7
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x65271c]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x622570
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x6225b8]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x622586
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x622595
or bl, 4
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x6225a4
or bl, 8
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x6225b3
or bl, 0x10
mov eax, ebx
pop ebx
ret

Function at 0x626088
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov word [ebp - 2], dx
push ecx
push edx
call sub.user32.dll_VkKeyScanExW
mov ebx, eax
movzx esi, bx
cmp esi, 0xffff
je 0x626109
lea eax, [ebp - 0x104]
mov edx, pe_nt_image_headers32
call fcn.00658544
mov eax, esi
shr eax, 8
test al, 1
je 0x6260cc
mov byte [ebp - 0xf4], 0xff
mov edi, dword [ebp + 8]
push edi
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call sub.user32.dll_ToAsciiEx
mov ebx, eax
test bx, bx
jbe 0x626109
push 1
lea eax, [ebp - 2]
push eax
movzx eax, bx
push eax
lea eax, [ebp - 4]
push eax
push 1
mov eax, edi
call fcn.00652e98
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov ax, word [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x626120
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6262e4
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0064d744
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov edi, 1
cmp edi, 0x7f
je 0x6261e4
xor eax, eax
mov dword [ebp - 0xc], eax
inc dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
shl esi, 0xa
add esi, edi
push 0
push 0
push 2
push esi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403de4
test ebx, ebx
jle 0x626198
push ebx
mov eax, dword [ebp - 8]
push eax
push 2
push esi
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 8]
call fcn.0065418c
cmp dword [ebp - 8], 0
je 0x6261b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, esi
mov edx, dword [ebp - 8]
call fcn.0064ed68
jmp 0x62615c
cmp esi, 0x476
jne 0x6261da
lea edx, [ebp - 0x10]
mov eax, 0x6262f4
call fcn.00654410
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, 0x476
call fcn.0064ed68
jmp 0x6261e4
cmp dword [ebp - 0xc], 1
jle 0x62615c
inc edi
cmp edi, 0x93
jne 0x62614e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00650684
call fcn.0047a1bc
call fcn.0047b394
mov esi, eax
call fcn.0064df70
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov edx, 0x626304
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
push 8
push 0xffffffffffffffff
xor ecx, ecx
mov edx, 0x626318
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jge 0x626287
mov edx, dword [0x669b94]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.00626568
call fcn.00529a70
mov esi, eax
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x18]
dec ebx
cmp ebx, 0
jl 0x6262be
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
cmp byte [edi + 0x14], 0
jne 0x62626e
mov eax, edi
call fcn.0051c2d8
cmp byte [edi + 0x14], 0
je 0x62627f
mov edx, dword [edi + 0x18]
mov eax, dword [ebp - 4]
call fcn.00626568
dec ebx
cmp ebx, 0xffffffff
jne 0x626258
jmp 0x6262be
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x6262be
lea eax, [ebp - 0x14]
mov edx, ebx
add dl, 0x41
call fcn.00403418
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x669b94]
mov ecx, dword [ecx]
mov eax, esi
call fcn.006173dc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00626568
dec ebx
cmp ebx, 0xffffffff
jne 0x62628f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6262eb
lea eax, [ebp - 0x14]
call fcn.00403274
lea eax, [ebp - 0x10]
call fcn.00403880
lea eax, [ebp - 8]
call fcn.00403880
ret

Function at 0x626a74
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
mov dword [esp + 4], edx
mov byte [esp], al
mov eax, esp
push eax
push 0x626a1c
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret