joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416f2e
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
jne 0x416f47
lea esi, [ebp - 0x104]
cmp byte [ebp + 8], 0
mov byte [esi], 0
mov ebx, 0x104
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
je 0x416f74
push ebx
push esi
push str.Common_Programs
push edi
push CreateStatusWindowA
call fcn.0043850b
add esp, 0x14
cmp byte [esi], 0
jne 0x416f89
push ebx
push esi
push str.Programs
push edi
push 0x80000001
call fcn.0043850b
add esp, 0x14
push esi
call fcn.00454880
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41700f
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
jne 0x417028
lea esi, [ebp - 0x104]
cmp byte [ebp + 8], 0
mov byte [esi], 0
mov ebx, 0x104
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
je 0x417055
push ebx
push esi
push str.Common_Start_Menu
push edi
push CreateStatusWindowA
call fcn.0043850b
add esp, 0x14
cmp byte [esi], 0
jne 0x41706a
push ebx
push esi
push str.Start_Menu
push edi
push 0x80000001
call fcn.0043850b
add esp, 0x14
push esi
call fcn.00454880
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x417078
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
jne 0x417091
lea esi, [ebp - 0x104]
cmp byte [ebp + 8], 0
mov byte [esi], 0
mov ebx, 0x104
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
je 0x4170be
push ebx
push esi
push str.Common_Startup
push edi
push CreateStatusWindowA
call fcn.0043850b
add esp, 0x14
cmp byte [esi], 0
jne 0x4170d3
push ebx
push esi
push str.Startup
push edi
push 0x80000001
call fcn.0043850b
add esp, 0x14
push esi
call fcn.00454880
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x418372
Capabilities:
Check for time delay via gettickcount
Log keystrokes

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
jne 0x418385
push 0x14
pop eax
jmp 0x4184bd
test byte [0x467c24], 1
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
jne 0x4183a3
or dword [0x467c24], 1
call esi
mov dword [0x467c20], eax
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
jne 0x4183ba
mov byte [ebx], 0
xor eax, eax
jmp 0x4184bb
call esi
cmp edi, dword [0x467c1c]
mov dword [esp + 0x10], eax
jne 0x4183e2
sub eax, dword [0x467c20]
cmp eax, 5
ja 0x4183e2
cmp dword [0x467c18], 0
jne 0x418498
jmp 0x4183b0
push ebp
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, eax
test esi, esi
je 0x41841d
cmp esi, dword [0x464dbc]
je 0x41841d
push edi
call fcn.0043b0bc
test al, al
pop ecx
jne 0x41841d
push 1
push esi
push dword [0x464dbc]
call ebp
test eax, eax
setne bl
push 0x467c10
call dword [sym.imp.USER32.dll_GetCaretPos]
mov dword [0x467c18], eax
call dword [sym.imp.USER32.dll_GetFocus]
test bl, bl
mov dword [esp + 0x10], eax
je 0x418446
push 0
push esi
push dword [0x464dbc]
call ebp
cmp dword [0x467c18], 0
pop ebp
jne 0x41845c
mov eax, dword [esp + 0x1c]
mov byte [eax], 0
jmp 0x4183b3
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x418466
mov eax, edi
mov esi, 0x467c10
push esi
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
test byte [0x464370], 8
jne 0x418485
push edi
push esi
call fcn.004385ae
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov dword [0x467c1c], edi
mov dword [0x467c20], eax
cmp byte [esp + 0x18], 0x44
mov eax, dword [0x467c10]
je 0x4184a9
mov eax, dword [0x467c14]
push 0xa
push ebx
push eax
call fcn.004017e8
push ebx
call fcn.00454880
add esp, 0x10
pop edi
pop esi
pop ebx
pop ecx
pop ecx
ret 8
Function at 0x4184c3
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x4184d9
push 0x3f
pop eax
jmp 0x4186bc
test byte [0x467c68], 1
jne 0x418505
or dword [0x467c68], 1
push str.GetCursorInfo
push str.user32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x467c64], eax
mov eax, dword [0x467c64]
cmp eax, ebx
push esi
push edi
je 0x418528
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 0x28], 0x14
call eax
mov edi, eax
neg edi
sbb edi, edi
and edi, dword [ebp - 0x20]
jmp 0x41859a
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_WindowFromPoint]
push ebx
push eax
mov dword [ebp - 8], eax
mov byte [ebp - 1], bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0xc], edi
je 0x418581
cmp edi, dword [0x464dbc]
je 0x418581
push dword [ebp - 8]
call fcn.0043b0bc
test al, al
pop ecx
jne 0x418581
push 1
push edi
push dword [0x464dbc]
call esi
test eax, eax
setne byte [ebp - 1]
call dword [sym.imp.USER32.dll_GetCursor]
cmp byte [ebp - 1], bl
mov edi, eax
je 0x41859a
push ebx
push dword [ebp - 0xc]
push dword [0x464dbc]
call esi
cmp edi, ebx
jne 0x4185aa
push 0x40
push str.Unknown
jmp 0x4186a7
test byte [0x467c68], 2
jne 0x418687
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
or dword [0x467c68], 2
push 0x7f8a
push ebx
call esi
push 0x7f00
push ebx
mov dword [0x467c28], eax
call esi
push 0x7f03
push ebx
mov dword [0x467c2c], eax
call esi
push 0x7f8b
push ebx
mov dword [0x467c30], eax
call esi
push 0x7f01
push ebx
mov dword [0x467c34], eax
call esi
push 0x7f81
push ebx
mov dword [0x467c38], eax
call esi
push 0x7f88
push ebx
mov dword [0x467c3c], eax
call esi
push 0x7f80
push ebx
mov dword [0x467c40], eax
call esi
push 0x7f86
push ebx
mov dword [0x467c44], eax
call esi
push 0x7f83
push ebx
mov dword [0x467c48], eax
call esi
push 0x7f85
push ebx
mov dword [0x467c4c], eax
call esi
push 0x7f82
push ebx
mov dword [0x467c50], eax
call esi
push 0x7f84
push ebx
mov dword [0x467c54], eax
call esi
push 0x7f04
push ebx
mov dword [0x467c58], eax
call esi
push 0x7f02
push ebx
mov dword [0x467c5c], eax
call esi
mov dword [0x467c60], eax
mov eax, dword [0x463230]
cmp eax, ebx
jle 0x41869e
cmp dword [ebx*4 + 0x467c28], edi
je 0x41869e
inc ebx
cmp ebx, eax
jl 0x418690
push 0x40
push dword [ebx*4 + 0x4631f0]
push dword [ebp + 8]
call fcn.0043880f
push dword [ebp + 8]
call fcn.00454880
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x418ac0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test bl, bl
jne 0x418acd
xor al, al
pop ebx
ret
mov eax, dword [esp + 0xc]
dec eax
je 0x418b2b
dec eax
je 0x418b1c
cmp byte [0x4654b9], 0
jne 0x418af8
cmp byte [0x4654ba], 0
jne 0x418af8
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x418b7d
push esi
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
js 0x418b16
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
js 0x418b16
xor eax, eax
jmp 0x418b19
xor eax, eax
inc eax
pop esi
pop ebx
ret
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
pop ebx
and eax, 1
ret
push ebx
call fcn.004440c9
test al, al
pop ecx
je 0x418b4d
cmp dword [0x4644b4], 0
movzx eax, bl
je 0x418b76
mov al, byte [eax + 0x4643a0]
shr al, 7
pop ebx
ret
xor eax, eax
cmp dword [0x4644b0], eax
je 0x418b73
push eax
push eax
push ebx
call fcn.00411546
add esp, 0xc
test al, al
je 0x418b6e
push 1
call fcn.004108a5
pop ecx
movzx eax, bl
jmp 0x418b42
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret

Function at 0x418bae
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x418bc7
push 0x1f
pop eax
jmp 0x418c5b
lea eax, [ebp - 0x290]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x418be3
mov byte [esi], 0
xor eax, eax
jmp 0x418c5b
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
call sub.WSOCK32.dll_gethostname
lea eax, [ebp - 0x100]
push eax
call sub.WSOCK32.dll_gethostbyname
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x418c14
mov ecx, eax
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x418c0b
mov ecx, dword [ebp + 8]
cmp ecx, edx
jl 0x418c2a
push str.0.0.0.0
push esi
call fcn.00454650
pop ecx
pop ecx
jmp 0x418c4f
push 4
push dword [eax + ecx*4]
lea eax, [ebp + 0xc]
push eax
call fcn.00454280
add esp, 0xc
push 0x20
push dword [ebp + 0xc]
call sub.WSOCK32.dll_inet_ntoa
push eax
push esi
call fcn.0043880f
add esp, 0xc
call sub.WSOCK32.dll_WSACleanup
push esi
call fcn.00454880
pop ecx
pop esi
leave
ret 8
Function at 0x418cc5
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1f0
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, ecx
mov dword [ebp + 0x64], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x418cf3
push 0x64
lea ecx, [ebp - 0x80]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x418cf7
mov byte [ebp - 0x80], 0
push edi
push 0x1f
mov byte [ebp - 0x1c], 0
xor eax, eax
pop ecx
lea edi, [ebp - 0x1b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esi + 0x46c]
jmp 0x418d31
cmp byte [edi + 0x14], 0
je 0x418d2e
mov eax, dword [edi]
push dword [eax]
lea eax, [ebp - 0x1c]
push 0x45a0a0
push 0x7d
push eax
call fcn.0040ab07
add esp, 0x10
mov edi, dword [edi + 0x18]
test edi, edi
jne 0x418d11
cmp byte [ebp - 0x1c], 0
je 0x418d72
lea eax, [ebp - 0x1c]
push eax
call fcn.00454880
cmp eax, 0x7b
pop ecx
jbe 0x418d66
mov ecx, 0x80
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x1c]
push 0x4590a8
push eax
call fcn.0043880f
add esp, 0xc
jmp 0x418d72
lea eax, [ebp + eax - 0x1d]
cmp byte [eax], 0x20
jne 0x418d72
mov byte [eax], 0
mov eax, dword [0x4644d4]
cmp eax, 1
mov dword [ebp + 0x78], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
jg 0x418e5a
and dword [ebp + 0x6c], 0
mov dword [ebp + 0x78], 0x4575d8
cmp dword [0x4644b4], 0
mov edi, 0x458a74
mov eax, 0x458a78
mov dword [ebp + 0x68], edi
je 0x418dab
mov dword [ebp + 0x68], eax
cmp dword [0x4644b0], 0
je 0x418db6
mov edi, eax
lea eax, [ebp - 0x180]
push eax
push 1
call fcn.004108a5
pop ecx
push eax
call fcn.004116b2
push eax
push dword [0x4644d0]
lea eax, [ebp - 0x1c]
push dword [0x4644d4]
push dword [0x4644d8]
push dword [ebp + 0x78]
push dword [ebp + 0x6c]
push eax
push dword [esi + 0x474]
lea eax, [ebp - 0x80]
push dword [esi + 0x478]
push dword [ebp + 0x68]
push edi
push eax
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
push dword [ebp + 0x7c]
push ebx
call fcn.0040aa6c
mov esi, dword [ebp + 0x64]
add ebx, eax
mov eax, esi
sub eax, ebx
add eax, dword [ebp + 0x7c]
add esp, 0x44
push eax
push ebx
call fcn.00443de0
push ebx
call fcn.00454880
add esp, 0xc
add ebx, eax
cmp dword [0x464dac], 0
pop edi
mov eax, str._r_nPress__F5__to_refresh.
jne 0x418e3f
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
sub esi, ebx
add esi, dword [ebp + 0x7c]
push eax
push esi
push ebx
call fcn.0040aa6c
add esp, 0xc
pop esi
add eax, ebx
pop ebx
add ebp, 0x70
leave
ret 8
dec eax
mov dword [ebp + 0x6c], eax
jmp 0x418d92
Function at 0x4196dd
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x464c98]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x458f24
call fcn.0040152b
cmp dword [ebp + 8], ebx
je 0x41971b
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41971f
mov eax, edi
jmp 0x41979d
push esi
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x41975e
cmp byte [esi], bl
je 0x41975e
push str.ahk_default
push esi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
jne 0x419741
mov esi, 0x4575d8
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x419788
mov eax, edi
jmp 0x41979c
push dword [ebp - 4]
call fcn.00419a2f
pop ecx
push dword [ebp - 4]
mov byte [ebp + 0x13], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0x13], bl
je 0x41975a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jmp 0x419758
mov ecx, dword [0x464c98]
push edi
push ebx
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x419a2f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
mov edi, 0x103
jmp 0x419ad4
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419adc
push dword [ebp - 0xc]
call fcn.00419a2f
pop ecx
push dword [ebp - 0xc]
mov byte [ebp - 1], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x419adc
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x419adc
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
cmp eax, edi
jne 0x419a69
mov al, 1
jmp 0x419ade
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42176e
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x464c98]
push 0x458f24
call fcn.0040152b
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043a0d7
mov esi, eax
test esi, esi
je 0x42185d
push dword [ebp + 8]
push esi
call fcn.0043a1b8
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x42185d
push ebx
push edi
push 0
push esi
mov byte [ebp + 0x1b], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
test ebx, ebx
je 0x4217fc
cmp ebx, dword [0x464dbc]
je 0x4217fc
push esi
call fcn.0043b0bc
test al, al
pop ecx
jne 0x4217fc
push 1
push ebx
push dword [0x464dbc]
call edi
test eax, eax
setne byte [ebp + 0x1b]
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x42184a
mov ecx, dword [0x464c98]
push 1
push 0
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
mov eax, dword [0x464290]
cmp eax, 0xffffffff
jle 0x42184a
cmp eax, 0x19
jge 0x421840
cmp byte [0x4654b9], 0
je 0x421840
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x42184a
push 1
push eax
call fcn.0040be3b
pop ecx
pop ecx
cmp byte [ebp + 0x1b], 0
je 0x42185b
push 0
push ebx
push dword [0x464dbc]
call edi
pop edi
pop ebx
xor eax, eax
inc eax
pop esi
pop ebp
ret 0x14
Function at 0x421865
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x464c98]
push 0x458f24
call fcn.0040152b
mov ecx, dword [0x467168]
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040152b
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043a0d7
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x42194d
push edi
push ebx
push eax
mov byte [ebp + 0x17], bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
cmp edi, ebx
je 0x4218f6
cmp edi, dword [0x464dbc]
je 0x4218f6
push dword [ebp + 0x10]
call fcn.0043b0bc
test al, al
pop ecx
jne 0x4218f6
push 1
push edi
push dword [0x464dbc]
call esi
test eax, eax
setne byte [ebp + 0x17]
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0x17], bl
mov dword [ebp - 4], eax
je 0x42190e
push ebx
push edi
push dword [0x464dbc]
call esi
cmp dword [ebp - 4], ebx
pop edi
je 0x42194d
lea eax, [ebp - 0x410]
push 0x3fb
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x42194d
lea eax, [ebp - 0x10]
push eax
push 0x43a41f
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
mov byte [ebp - 0xc], bl
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [ebp - 0xc], bl
jne 0x421952
xor eax, eax
inc eax
jmp 0x42199a
push dword [ebp - 8]
lea eax, [ebp - 0x410]
push 0x45774c
push 0x400
push eax
call fcn.0040ab07
mov ecx, dword [0x464c98]
add esp, 0x10
push 1
push ebx
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
mov ecx, dword [0x467168]
push 1
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x410]
push eax
call fcn.0040152b
pop esi
pop ebx
leave
ret 0x10
Function at 0x422cd4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov ecx, dword [0x464c98]
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x458f24
call fcn.0040152b
mov ecx, dword [0x467168]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040152b
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x422e35
cmp byte [eax], bl
je 0x422e35
mov esi, 0x105
push esi
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0043880f
lea eax, [ebp - 0x120]
push eax
call fcn.00454880
add esp, 0x10
cmp byte [ebp + eax - 0x121], 0x5c
je 0x422d62
lea ecx, [eax + 1]
cmp ecx, esi
jae 0x422e35
mov byte [ebp + eax - 0x120], 0x5c
mov byte [ebp + eax - 0x11f], bl
push edi
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
test byte [0x467db0], 1
jne 0x422d94
or dword [0x467db0], edi
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x467dac], eax
mov eax, dword [0x467dac]
cmp eax, ebx
je 0x422dd6
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x120]
push ecx
call eax
test eax, eax
je 0x422e35
cmp byte [ebp + 0xc], bl
je 0x422dc3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
jmp 0x422dc9
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
shrd ecx, eax, 0x14
shr eax, 0x14
mov esi, ecx
mov edi, eax
jmp 0x422e11
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x422e35
cmp byte [ebp + 0xc], bl
mov eax, dword [ebp + 8]
jne 0x422e02
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 4]
imul eax, dword [ebp - 0xc]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x464c98]
push 1
push ebx
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
mov ecx, dword [0x467168]
push edi
push esi
call fcn.004018c1
jmp 0x422e37
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4230c6
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
push 0
push 0xffffffffffffffff
mov dword [ebp - 4], ecx
mov ecx, dword [0x464c98]
mov ebx, 0x458f24
push ebx
call fcn.0040152b
mov esi, dword [ebp + 8]
test esi, esi
je 0x42311f
cmp byte [esi], 0
je 0x42311f
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x423128
test al, 0x10
je 0x42311f
mov ecx, dword [0x464c98]
push edi
push 0
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
push 0x5c
push esi
call fcn.004550c0
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x423186
push esi
call fcn.00454880
cmp eax, 0x104
pop ecx
jae 0x423181
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0043880f
mov ecx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.004230c6
cmp byte [edi + 1], 0
je 0x423181
mov ecx, dword [0x464c98]
call fcn.00401c8a
cmp byte [eax], 0x31
jne 0x423186
xor eax, eax
inc eax
jmp 0x423121
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x423198
mov ebx, 0x45771c
mov ecx, dword [0x464c98]
push 1
push 0
push 0xffffffffffffffff
push ebx
call fcn.0040152b
jmp 0x423121
Function at 0x4231af
Capabilities:
Check for time delay via gettickcount
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
push esi
mov esi, dword [0x467118]
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x464c98]
push 0x458f24
call fcn.0040152b
cmp byte [esi], bl
je 0x423221
push 0x45c17c
push esi
call fcn.00438acb
test eax, eax
pop ecx
pop ecx
jne 0x423211
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x423221
mov ecx, dword [0x464c98]
push 1
push ebx
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
jmp 0x423221
push 1
mov ecx, edi
call fcn.0041cfa7
cmp eax, 0x104
jb 0x423229
xor eax, eax
inc eax
jmp 0x42333d
lea eax, [ebp - 0x26c]
push eax
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x423248
push ebx
jmp 0x423332
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.00454650
lea eax, [ebp - 0x12c]
push 0x5c
push eax
call fcn.004550c0
add esp, 0x10
cmp eax, ebx
je 0x42327c
mov byte [eax + 1], bl
lea eax, [ebp - 0x12c]
push eax
call fcn.00454880
pop ecx
jmp 0x423284
mov byte [ebp - 0x12c], bl
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea ecx, [ebp + eax - 0x12c]
mov esi, 0x103
mov dword [ebp - 0xc], ecx
sub esi, eax
call edi
sub eax, dword [0x4652cc]
cmp eax, dword [0x464360]
jbe 0x4232cf
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4232c8
push 1
push 0xffffffffffffffff
call fcn.0040be3b
pop ecx
pop ecx
call edi
mov dword [0x4652cc], eax
test byte [ebp - 0x26c], 0x10
jne 0x42330e
lea eax, [ebp - 0x240]
push eax
call fcn.00454880
cmp eax, esi
pop ecx
ja 0x42330b
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0xc]
call fcn.00454650
pop ecx
pop ecx
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x42330e
inc dword [ebp - 4]
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42329b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp - 4]
mov ecx, dword [0x464c98]
call fcn.00401861
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423342
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov ecx, dword [0x464c98]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x458f24
call fcn.0040152b
mov ecx, dword [0x467168]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040152b
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4233c4
cmp byte [eax], bl
je 0x4233c4
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4233c4
mov ecx, dword [0x464c98]
push edi
push ebx
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [ebp - 0x80]
push eax
call fcn.00439021
pop ecx
pop ecx
mov ecx, dword [0x467168]
push eax
call fcn.0040152b
jmp 0x4233c6
mov eax, edi
pop edi
pop ebx
leave
ret 4