joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444f44
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [ebp + 0xc], bl
je 0x444fa5
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004457c4
mov ecx, dword [ebp - 4]
call fcn.0044417c
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004457c4
mov ecx, dword [ebp - 4]
call fcn.00444161
pop esi
pop edi
mov al, bl
pop ebx
leave
ret 8

Function at 0x444fad
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, word [edi + 8]
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
mov byte [ebp - 8], bl
mov byte [ebp - 4], bh
mov dword [ebp - 0xc], eax
je 0x445098
cmp bl, 0x14
je 0x445098
cmp bl, 0x90
je 0x445098
cmp bl, 0x91
je 0x445098
mov ecx, edi
call fcn.0044446b
test al, al
je 0x44507f
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x445029
movzx eax, bl
or byte [ebp + eax - 0x128], 0x80
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 1
call fcn.004443ab
cmp al, 1
jne 0x445044
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x445055
cmp byte [esi + 0x1d], 0
jne 0x445055
cmp bl, 0x12
jne 0x445073
cmp byte [esi + 0x16], 0
jne 0x445073
cmp byte [esi + 0x1c], 0
jne 0x445073
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x104
jmp 0x44508d
movzx eax, bl
push edi
push eax
push 0x100
jmp 0x44508d
mov eax, dword [ebp - 0xc]
movzx eax, ax
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4450f4
mov ecx, edi
call fcn.0044446b
test al, al
je 0x4450c4
mov ecx, edi
call fcn.004443ab
push ecx
mov ecx, esi
cmp al, 1
jne 0x4450b5
push 1
jmp 0x4450b7
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004457c4
jmp 0x4450f4
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x24], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x22], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x28]
inc ecx
push eax
push ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 4
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.0044417c
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x445102
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov bl, byte [edi]
cmp dword [esi + 0x20], 0
mov bh, byte [edi + 7]
mov byte [ebp - 4], bl
mov byte [ebp - 8], bh
je 0x4451dd
cmp bl, 0x14
je 0x4451dd
cmp bl, 0x90
je 0x4451dd
cmp bl, 0x91
je 0x4451dd
mov ecx, edi
call fcn.0044446b
test al, al
je 0x445239
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x44517b
movzx eax, bl
xor byte [ebp + eax - 0x124], 0x80
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 0xc0000001
call fcn.004443ab
cmp al, 1
jne 0x445199
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x4451aa
cmp byte [esi + 0x1d], 0
jne 0x4451aa
cmp bl, 0x12
jne 0x4451c8
cmp byte [esi + 0x16], 0
jne 0x4451c8
cmp byte [esi + 0x1c], 0
jne 0x4451c8
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x105
jmp 0x4451d2
movzx eax, bl
push edi
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x445239
mov ecx, edi
call fcn.0044446b
test al, al
je 0x445209
mov ecx, edi
call fcn.004443ab
push ecx
mov ecx, esi
cmp al, 1
jne 0x4451fa
push 3
jmp 0x4451fc
push 2
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.004457c4
jmp 0x445239
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
xor eax, eax
mov word [ebp - 0x20], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x1e], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x24]
inc ecx
push eax
push ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 6
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00444161
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x445264
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x445295
cmp byte [esi + 1], 0
jne 0x445295
cmp byte [esi + 2], 0
jne 0x445295
cmp byte [esi + 3], 0
jne 0x445295
cmp byte [esi + 4], 0
je 0x445443
cmp dword [edi + 0x20], 0
push ebx
je 0x4453cb
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4453cb
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x44531f
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x4452dd
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x4452ee
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x4452fa
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x445306
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x445312
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x445330
cmp byte [esi + 1], 0
je 0x445347
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x445364
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x4453a8
cmp byte [esi + 2], 0
jne 0x44538d
cmp byte [edi + 0x1c], 0
jne 0x44538d
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x4453a3
test al, al
je 0x4453a8
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x44543b
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x44543b
xor ebx, ebx
cmp byte [esi], bl
je 0x4453e4
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.004457c4
cmp byte [esi + 1], bl
je 0x4453fc
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.004457c4
cmp byte [esi + 2], bl
je 0x445411
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.004457c4
cmp byte [esi + 3], bl
je 0x445426
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.004457c4
cmp byte [esi + 4], bl
je 0x44543b
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.004457c4
mov ecx, edi
call fcn.0044417c
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x445449
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x44547a
cmp byte [esi + 1], 0
jne 0x44547a
cmp byte [esi + 2], 0
jne 0x44547a
cmp byte [esi + 3], 0
jne 0x44547a
cmp byte [esi + 4], 0
je 0x445636
cmp dword [edi + 0x20], 0
push ebx
je 0x4455b8
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4455b8
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x445504
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x4454c2
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x4454d3
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x4454df
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x4454eb
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x4454f7
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x445515
cmp byte [esi + 1], 0
je 0x44552e
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x44554d
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x445593
cmp byte [esi + 2], 0
jne 0x445576
cmp byte [edi + 0x1c], 0
jne 0x445576
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x44558e
test al, al
je 0x445593
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x44562e
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x44562e
cmp byte [esi], 0
push 2
pop ebx
je 0x4455d3
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.004457c4
cmp byte [esi + 1], 0
je 0x4455ec
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.004457c4
cmp byte [esi + 2], 0
je 0x445602
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.004457c4
cmp byte [esi + 3], 0
je 0x445618
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.004457c4
cmp byte [esi + 4], 0
je 0x44562e
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.004457c4
mov ecx, edi
call fcn.00444161
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x44563c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x4456c8
jne 0x445650
push 0
jmp 0x4456c2
cmp esi, 0xf
jae 0x4456c1
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
test eax, eax
je 0x4456c1
movd xmm0, esi
cvtdq2pd xmm0, xmm0
shr esi, 0x1f
addsd xmm0, qword [esi*8 + 0x4b7590]
movsd qword [ebp - 0x28], xmm0
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.0041f7d3
movsd xmm1, qword [ebp - 0x20]
divsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x28]
comisd xmm0, xmm1
ja 0x44567c
jmp 0x4456c8
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
pop esi
leave
ret 4

Function at 0x445818
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 4], eax
mov byte [esi + 0xa], al
mov eax, dword [ebp + 8]
mov dword [esi], 0xff
mov word [esi + 8], ax
test ax, ax
jne 0x44583c
xor al, al
jmp 0x445881
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x445838
push ebx
mov ebx, eax
mov byte [esi], al
movzx eax, al
push 0
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x44586c
mov byte [esi + 1], 1
test bl, 2
je 0x445875
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x44587f
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x4474c2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00447293
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
leave
ret 8
Function at 0x447669
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push esi
mov esi, edx
lea edx, [ebp - 0x438]
call fcn.00405119
lea edx, [ebp - 0x22c]
mov ecx, esi
call fcn.00405119
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
pop esi
test eax, eax
jne 0x4476e0
cmp byte [ebp + 8], al
je 0x4476dc
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.00422e73
pop ecx
pop ecx
test eax, eax
je 0x4476d8
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov al, 1
leave
ret
xor al, al
leave
ret
lea ecx, [ebp - 0x438]
call fcn.00448883
test al, al
je 0x4476dc
lea ecx, [ebp - 0x22c]
call fcn.00448883
test al, al
je 0x44778a
cmp byte [ebp + 8], 0
je 0x4476dc
lea eax, [ebp - 0x438]
push 0x4b47b4
push eax
call fcn.00422584
lea eax, [ebp - 0x438]
push eax
call fcn.0042256b
xor ecx, ecx
mov word [ebp + eax*2 - 0x436], cx
lea eax, [ebp - 0x22c]
push eax
call fcn.0042256b
xor ecx, ecx
mov word [ebp + eax*2 - 0x22a], cx
lea eax, [ebp - 0x438]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0x20], eax
mov eax, 0x614
add esp, 0x10
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
leave
ret
lea ecx, [ebp - 0x22c]
call fcn.004479dd
test al, al
je 0x4476dc
lea ecx, [ebp - 0x22c]
call fcn.00448883
test al, al
jmp 0x447706
Function at 0x4477af
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b8
call fcn.004312b0
push ebx
push esi
mov esi, edx
xor ebx, ebx
lea edx, [ebp - 0x640]
mov byte [ebp - 1], bl
call fcn.00405119
lea edx, [ebp - 0x850]
mov ecx, esi
call fcn.00405119
lea edx, [ebp - 0x850]
lea ecx, [ebp - 0x640]
call fcn.00448816
lea ecx, [ebp - 0x640]
mov byte [ebp - 3], al
call fcn.00448883
mov esi, 0x4b47b4
test al, al
je 0x447814
lea eax, [ebp - 0x640]
push esi
push eax
call fcn.00422584
pop ecx
pop ecx
lea ecx, [ebp - 0x850]
call fcn.00448883
test al, al
je 0x447832
lea eax, [ebp - 0x850]
push esi
push eax
call fcn.00422584
pop ecx
pop ecx
lea eax, [ebp - 0x10b8]
push eax
lea eax, [ebp - 0xca8]
push eax
lea eax, [ebp - 0xeb0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x640]
push eax
call fcn.004235e0
add esp, 0x14
lea eax, [ebp - 0xaa0]
push eax
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [ebp - 2], al
cmp esi, 0xffffffff
je 0x4479cd
cmp al, 1
jne 0x4479cd
test byte [ebp - 0xaa0], 0x10
jne 0x44799f
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x10b8]
push eax
lea edx, [ebp - 0xca8]
lea ecx, [ebp - 0xa74]
call fcn.00447fa4
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.004225b3
lea eax, [ebp - 0xeb0]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00422584
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00422584
add esp, 0x18
lea ecx, [ebp - 0x430]
call fcn.00403c72
test al, al
je 0x447932
cmp byte [ebp + 8], bl
je 0x4479c2
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
lea eax, [ebp - 0x430]
push eax
je 0x447953
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp byte [ebp + 0xc], 1
lea eax, [ebp - 0x430]
jne 0x447988
cmp byte [ebp - 3], bl
jne 0x447966
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
jmp 0x447997
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
je 0x4479d0
jmp 0x44799b
push ebx
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x4479c2
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x447997
push ebx
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x4479c2
mov byte [ebp - 1], 1
lea eax, [ebp - 0xaa0]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov al, byte [ebp - 2]
jne 0x44787e
mov al, bl
mov byte [ebp - 2], al
jmp 0x44787e
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
jmp 0x4479d9
mov bl, byte [ebp - 1]
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x4479dd
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov edx, ecx
push ebx
push esi
push 0x104
lea ecx, [ebp - 0x20c]
call fcn.0040637a
lea eax, [ebp - 0x20c]
push eax
call fcn.0042256b
pop ecx
pop ecx
push 0x5c
pop ebx
test eax, eax
je 0x447a23
cmp word [ebp + eax*2 - 0x20e], bx
jne 0x447a23
xor ecx, ecx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x447ab0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x447a57
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x447a5c
mov al, 1
jmp 0x447ab6
cmp eax, 3
jne 0x447ab4
lea ecx, [ebp - 0x20c]
call fcn.004051dd
mov esi, eax
push ebx
push esi
call fcn.00423dd7
pop ecx
pop ecx
test eax, eax
jne 0x447a7f
push esi
call fcn.00420dee
pop ecx
jmp 0x447ab4
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
call fcn.004479dd
push esi
mov bl, al
call fcn.00420dee
pop ecx
test bl, bl
je 0x447aac
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
setne bl
mov al, bl
jmp 0x447ab6
test al, 0x10
jne 0x447a53
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x447aba
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x678
push ebx
xor ebx, ebx
push esi
lea edx, [esp + 0x18]
mov byte [esp + 0xf], bl
call fcn.00405119
lea ecx, [esp + 0x18]
call fcn.00448883
test al, al
je 0x447af5
lea eax, [esp + 0x18]
push 0x4b47b4
push eax
call fcn.00422584
pop ecx
pop ecx
push ebx
push ebx
lea eax, [esp + 0x480]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004235e0
add esp, 0x14
lea eax, [esp + 0x228]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x447ba8
cmp al, 1
jne 0x447ba8
test byte [esp + 0x228], 0x10
jne 0x447b89
mov byte [esp + 0xf], al
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004225b3
lea eax, [esp + 0x480]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00422584
lea eax, [esp + 0x264]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00422584
add esp, 0x18
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp eax, 1
jne 0x447bac
lea eax, [esp + 0x228]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x447b31
mov al, bl
mov byte [esp + 0xe], al
jmp 0x447b31
mov bl, byte [esp + 0xf]
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x447bcb
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
push ebx
push esi
push edi
push 0
mov ebx, ecx
push 2
mov dword [ebp - 4], edx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x234], 0x22c
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
mov esi, dword [ebp + 8]
mov ecx, ebx
mov byte [esi], 0
call fcn.00448632
mov ebx, eax
jmp 0x447c8c
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
cmp eax, 1
jne 0x447c91
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x438]
push eax
push 0
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004235e0
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.00422584
push dword [ebp - 8]
lea eax, [ebp - 0x438]
push eax
call fcn.00422837
add esp, 0x24
test eax, eax
jne 0x447c76
mov eax, dword [ebp - 0x22c]
jmp 0x447c84
test ebx, ebx
je 0x447c8c
mov eax, dword [ebp - 0x22c]
cmp ebx, eax
jne 0x447c8c
mov ecx, dword [ebp - 4]
mov byte [esi], 1
mov dword [ecx], eax
cmp byte [esi], 0
je 0x447c14
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
leave
ret

Function at 0x447c9f
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor esi, esi
push esi
mov eax, 0x80
push eax
push 3
push esi
push 3
mov ebx, edx
push eax
push ecx
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edx, eax
mov dword [ebp - 8], edx
cmp edx, 0xffffffff
jne 0x447cd0
xor al, al
jmp 0x447d19
push 0xa
pop ecx
xor eax, eax
push esi
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x28
lea eax, [ebp - 0x3c]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
push edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x447ccc
mov eax, dword [ebp - 0x20]
mov dword [ebx], eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x447d1e
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4c336c]
sub esp, 0x1c
cmp byte [eax + 0x25], 0
jne 0x447d36
mov eax, 0x80004005
leave
ret
push ebx
push esi
xor esi, esi
push esi
mov eax, 0x80
push eax
push 3
push esi
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x447d99
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push ebx
mov dword [ebp - 0x10], 7
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
test esi, esi
jne 0x447da0
mov eax, 0x80004005
jmp 0x447da8
xor eax, eax
cmp byte [ebp - 0x14], al
setne al
pop esi
pop ebx
leave
ret