joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438670
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, ecx
push esi
push edi
xor edi, edi
lea eax, [esp + 0x14]
push eax
mov eax, edi
or eax, 1
push eax
push 0
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x43874a
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push str.InstallDir
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43874a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43874a
dec eax
mov dword [esp + 0x10], eax
cmp byte [esp + eax + 0x18], 0
jne 0x438706
test eax, eax
je 0x438717
lea ecx, [esp + 0x18]
cmp byte [ecx + eax - 1], 0
jne 0x438700
dec eax
jne 0x4386f6
mov dword [esp + 0x10], eax
jmp 0x438717
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x104
jae 0x43874a
mov byte [esp + eax + 0x18], 0
mov esi, eax
test eax, eax
je 0x438751
test ebx, ebx
je 0x43873d
lea edx, [esp + 0x18]
mov eax, edx
sub ebx, eax
lea esp, [esp]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [ebx + edx - 1], cl
test cl, cl
jne 0x438730
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov byte [esp + 0x18], 0
xor esi, esi
test edi, edi
jne 0x43871d
mov edi, 0x100
jmp 0x438684
Function at 0x43b800
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x11c
push ebx
push edi
mov edi, dword [0x4ae860]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
mov ecx, dword [esp + 0x130]
xor edx, edx
push 0
call fcn.00412340
mov bh, al
add esp, 0xc
test bh, bh
jne 0x43b8a4
mov ecx, dword [esp + 0x128]
lea edx, [esp + 0xc]
push 0
call fcn.0044c1b0
add esp, 4
test eax, eax
jne 0x43b866
push 1
push eax
push 0xffffffffffffffff
push 0x49bc4d
mov ecx, edi
call fcn.004744e0
pop edi
pop ebx
add esp, 0x11c
ret 8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push 0
push ecx
mov ecx, eax
mov dword [esp + 0x20], 0
call fcn.0044c400
add esp, 8
lea eax, [esp + 0x10]
mov ecx, edi
fstp st(0)
push eax
call fcn.00473df0
pop edi
pop ebx
add esp, 0x11c
ret 8
mov eax, dword [esp + 0x12c]
mov bl, byte [eax]
movzx eax, bl
test eax, 0xffffff80
jne 0x43b8c9
push 2
push eax
call fcn.00485bac
add esp, 8
test eax, eax
je 0x43b8c9
and bl, 0xdf
mov al, bl
cmp al, 0x50
je 0x43b8dd
xor ecx, ecx
mov edx, 2
cmp al, 0x54
cmovne edx, ecx
jmp 0x43b8e2
mov edx, 1
mov cl, bh
call fcn.0044c360
push 1
test al, al
mov edx, 0x4a21f4
push 0
mov ecx, 0x4a21f0
cmove ecx, edx
push 0xffffffffffffffff
push ecx
mov ecx, edi
call fcn.004744e0
pop edi
pop ebx
add esp, 0x11c
ret 8
Function at 0x43b920
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x4ae860]
push 0
call fcn.004744e0
mov eax, dword [ebp + 8]
test eax, eax
je 0x43ba94
cmp byte [eax], 0
je 0x43ba94
push 0x104
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00487600
lea ecx, [esp + 0x3c]
mov byte [esp + 0x140], 0
add esp, 0xc
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43b980
sub ecx, edx
cmp byte [esp + ecx + 0x2f], 0x5c
je 0x43b9a5
lea eax, [ecx + 1]
cmp eax, 0x105
jae 0x43ba94
mov word [esp + ecx + 0x30], 0x5c
mov eax, dword [0x4b05d0]
test al, 1
jne 0x43b9d4
push str.GetDiskFreeSpaceExA
or eax, 1
push str.kernel32
mov dword [0x4b05d0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4b05d4], eax
jmp 0x43b9d9
mov eax, dword [0x4b05d4]
test eax, eax
je 0x43ba23
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x43ba94
cmp byte [ebp + 0xc], 0
je 0x43ba12
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
shrd esi, edi, 0x14
shr edi, 0x14
jmp 0x43ba62
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
shrd esi, edi, 0x14
shr edi, 0x14
jmp 0x43ba62
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43ba94
cmp byte [ebp + 0xc], 0
mov esi, dword [esp + 0x14]
cmovne esi, dword [esp + 0x10]
imul esi, dword [esp + 0xc]
imul esi, dword [esp + 8]
shr esi, 0x14
xor edi, edi
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49bca8
call fcn.004744e0
mov ecx, dword [0x4ae860]
push 0x18
push edi
push esi
call fcn.00401330
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
jne 0x43bac0
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x49bc4d
push 0
push 0x49e628
mov ecx, esi
call fcn.0042c8f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x43d7e0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x43d84b
cmp byte [0x4aefc4], al
je 0x43d8f6
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
jne 0x43d82c
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop edi
add esp, 0x10c
ret
mov ecx, dword [0x4aed20]
push 0x49bc4d
push 0
push 0x49e628
call fcn.0042c8f0
pop edi
add esp, 0x10c
ret
cmp byte [0x4aefc4], 0
lea eax, [esp + 0xc]
push esi
mov esi, 0x4acfc0
cmove esi, eax
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43d8c0
cmp byte [edi], 0
je 0x43d8d6
cmp byte [edi + 1], 0x3a
jne 0x43d8d6
cmp byte [edi + 2], 0
jne 0x43d8d6
push esi
push edi
call fcn.00484212
add esp, 8
test eax, eax
je 0x43d8d6
push edi
lea eax, [esp + 0xc]
push 0x4a2460
push eax
call fcn.0048498d
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x43d8d6
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x43d8d6
push 0x103
push edi
push esi
call fcn.00487600
mov byte [esi + 0x103], 0
add esp, 0xc
cmp byte [0x4aefc4], 0
pop esi
je 0x43d8f6
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49bca8
call fcn.004744e0
pop edi
add esp, 0x10c
ret
Function at 0x43dea0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push edi
mov edi, dword [esp + 0x110]
mov ebx, ecx
test edi, edi
je 0x43dfef
cmp byte [edi], 0
je 0x43dfef
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43def0
shr eax, 4
mov ecx, ebx
not al
and al, 1
push 0xb7
movzx eax, al
push eax
call fcn.0042cb40
pop edi
pop ebx
add esp, 0x104
ret 4
push ebp
push 0x5c
push edi
call fcn.0048695e
mov ebp, eax
add esp, 8
cmp ebp, edi
jbe 0x43dfc8
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x43df10
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43df10
sub ecx, edx
cmp ecx, 0x104
jb 0x43df77
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x6f
jne 0x43df58
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop ebp
pop edi
pop ebx
add esp, 0x104
ret 4
push 0x49bc4d
push 0
push 0x49e628
mov ecx, ebx
call fcn.0042c8f0
pop ebp
pop edi
pop ebx
add esp, 0x104
ret 4
push esi
mov esi, ebp
lea eax, [esp + 0x10]
sub esi, edi
push esi
push edi
push eax
call fcn.00487600
add esp, 0xc
mov byte [esp + esi + 0x10], 0
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
call fcn.0043dea0
cmp byte [ebp + 1], 0
pop esi
je 0x43dfb7
mov ecx, dword [0x4ad0c8]
push 0
push 1
call fcn.00401490
cmp byte [eax], 0x31
jne 0x43dfc8
pop ebp
pop edi
mov eax, 1
pop ebx
add esp, 0x104
ret 4
push 0xffffffffffffffff
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov ecx, ebx
sete al
movzx eax, al
push eax
call fcn.0042cb40
pop ebp
pop edi
pop ebx
add esp, 0x104
ret 4
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x43e025
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop edi
pop ebx
add esp, 0x104
ret 4
push 0x49bc4d
push 0
push 0x49e628
call fcn.0042c8f0
pop edi
pop ebx
add esp, 0x104
ret 4
Function at 0x43ec40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
push edi
test esi, esi
je 0x43ec90
push 0
push 1
mov ecx, esi
call fcn.00401490
cmp byte [esi + 0x17], 0
mov ebx, eax
jne 0x43ec6b
mov edi, dword [esi + 0xc]
jmp 0x43ec6d
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x43ec87
test byte [edi + 0x15], 8
je 0x43ec80
mov ecx, edi
call fcn.004013b0
add edi, 0xc
mov edi, dword [edi]
jmp 0x43ecc7
mov edi, 0x4afc18
mov edi, dword [edi]
jmp 0x43ecc7
lea eax, [esp + 0x14]
xor ecx, ecx
push eax
lea edx, [esp + 0x28]
call fcn.00473f30
add esp, 4
test eax, eax
jne 0x43ecbf
mov eax, dword [0x4aa1d8]
mov dword [eax + 0x30], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x14]
xor ebp, ebp
push ebp
push ebp
push 2
push ebp
push ebp
push 0x40000000
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x43ed11
xor ecx, ecx
mov dword [esp + 0x24], ecx
test ebx, ebx
je 0x43ed04
push ecx
lea ecx, [esp + 0x28]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x24]
xor eax, eax
cmp ecx, edi
sete al
mov dword [esp + 0x24], eax
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x4aa1d8]
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x43ed36
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x4aa1d8]
test esi, esi
jne 0x43ed43
push ebx
call fcn.004843d4
add esp, 4
test ebp, ebp
je 0x43ed67
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49bca8
call fcn.004744e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
test byte [edi + 0xe0], 1
jne 0x43ed90
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esp + 0x18]
push 0x49bc4d
push 0
push 0x49e628
call fcn.0042c8f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x43eec0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x128]
push edi
call fcn.0040dd10
mov edi, dword [esp + 0x128]
cmp eax, 1
je 0x43ef40
mov ecx, edi
call fcn.00450aa0
test al, al
je 0x43ef40
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
jne 0x43ef20
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc
push 0x49bc4d
push 0
push 0x49e628
mov ecx, esi
call fcn.0042c8f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x43eeef
mov edx, dword [esp + 0x124]
mov ecx, edx
lea ebx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43ef70
sub ecx, ebx
mov eax, 0x103
cmp ecx, 0x104
cmovae ecx, eax
lea eax, [ecx + 1]
push eax
push edx
lea eax, [esp + 0x20]
push eax
call fcn.0048cfd0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call fcn.00486ef5
add esp, 4
lea eax, [esp + 0x18]
push 0xa
push eax
push dword [0x4ad120]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
je 0x43f001
push ebp
push dword [0x4ad120]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43f001
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x43f001
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push dword [0x4ad120]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
jmp 0x43f003
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
mov ecx, esi
sete al
movzx eax, al
push eax
call fcn.0042c990
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc
Function at 0x43f030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x80
push esi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x4ae860]
push 0
call fcn.004744e0
mov eax, dword [esp + 0x88]
test eax, eax
je 0x43f113
cmp byte [eax], 0
je 0x43f113
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43f0c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4aa1d8]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jne 0x43f0ab
mov ecx, dword [0x4ad0c8]
push 1
push 0
push edi
push 0x49e628
call fcn.004744e0
pop edi
pop esi
add esp, 0x80
ret 4
push 0x49bc4d
push 0
push 0x49e628
mov ecx, esi
call fcn.0042c8f0
pop edi
pop esi
add esp, 0x80
ret 4
mov eax, dword [0x4aa1d8]
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49bca8
mov dword [eax + 0x30], 0
call fcn.004744e0
mov edx, edi
lea ecx, [esp + 8]
call fcn.00472580
mov ecx, dword [0x4ae860]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.004744e0
pop edi
pop esi
add esp, 0x80
ret 4
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x43f148
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop esi
add esp, 0x80
ret 4
push 0x49bc4d
push 0
push 0x49e628
mov ecx, esi
call fcn.0042c8f0
pop esi
add esp, 0x80
ret 4
Function at 0x43fac0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
push ebx
push esi
push edi
push 1
push 0
mov esi, ecx
mov ecx, dword [0x4ae860]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x2c], esi
call fcn.004744e0
mov edi, dword [ebp + 8]
test edi, edi
je 0x43fc13
cmp byte [edi], 0
je 0x43fc13
push 0
push 0
push 3
push 0
push 7
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43fb36
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x43fb7b
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x43fb62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4aa1d8]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jmp 0x43fc26
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x3c]
xor eax, eax
or eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
movzx ebx, al
test ebx, 0xffffff80
jne 0x43fb9d
push 2
push ebx
call fcn.00485bac
add esp, 8
test eax, eax
je 0x43fb9d
and ebx, 0xffffffdf
movsx eax, bl
sub eax, 0x4b
je 0x43fbb2
sub eax, 2
jne 0x43fbce
push eax
push 0x100000
jmp 0x43fbb9
push 0
push 0x400
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.00494890
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [0x4aa1d8]
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49bca8
mov dword [eax + 0x30], 0
call fcn.004744e0
mov ecx, dword [0x4ae860]
push 0x18
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.00401330
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x43fc47
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x49bc4d
push 0
push 0x49e628
mov ecx, esi
call fcn.0042c8f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44c360
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, cl
test bl, bl
jne 0x44c36b
xor al, al
pop ebx
ret
dec edx
je 0x44c38d
movzx eax, bl
push eax
dec edx
je 0x44c382
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
pop ebx
ret
mov al, bl
dec al
cmp al, 5
ja 0x44c39a
cmp bl, 3
jne 0x44c3a2
mov al, bl
add al, 0x66
cmp al, 5
ja 0x44c3b9
cmp dword [0x4ad0f8], 0
movzx eax, bl
je 0x44c3ec
mov al, byte [eax + 0x4ad9f8]
shr al, 7
pop ebx
ret
cmp dword [0x4ad0fc], 0
je 0x44c3e9
push 0
xor edx, edx
mov cl, bl
call fcn.00411bd0
add esp, 4
test al, al
je 0x44c3db
mov cl, 1
call fcn.00411a40
movzx eax, bl
pop ebx
mov al, byte [eax + 0x4ad9f8]
shr al, 7
ret
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
Function at 0x44c980
Capabilities:
Get disk information

Disassembly:
sub esp, 0x108
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
push 0
push 0x410
mov byte [edi], 0
call ebx
mov ebp, eax
test ebp, ebp
jne 0x44c9c1
push esi
push eax
push 0x1000
call ebx
mov ebp, eax
test ebp, ebp
jne 0x44c9c1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
cmp byte [esp + 0x120], 0
push 0x104
push edi
push 0
push ebp
je 0x44c9dc
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
jmp 0x44c9e2
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
mov ebx, eax
test ebx, ebx
jne 0x44caf2
mov eax, dword [0x4a28b4]
test eax, eax
je 0x44caf2
push 0x104
push edi
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x44caf2
cmp byte [esp + 0x120], 0
je 0x44ca5b
push 0x5c
push edi
call fcn.0048695e
mov edx, eax
add esp, 8
test edx, edx
je 0x44caf2
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44ca30
sub ecx, esi
lea eax, [edx + 1]
push ecx
push eax
push edi
call fcn.00484fa0
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
mov word [esp + 0x11], 0x3a
mov byte [esp + 0x10], 0x41
jmp 0x44ca70
push 0x104
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov esi, eax
cmp esi, 2
jbe 0x44caa8
sub esi, 2
lea eax, [esp + 0x14]
push esi
push edi
push eax
call fcn.0048682f
add esp, 0xc
test eax, eax
jne 0x44caa8
cmp byte [esi + edi], 0x5c
je 0x44caca
mov al, byte [esp + 0x10]
inc al
mov byte [esp + 0x10], al
cmp al, 0x5a
jle 0x44ca70
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
movzx eax, byte [esp + 0x10]
sub ebx, esi
mov byte [edi], al
movzx eax, byte [esp + 0x11]
mov byte [edi + 1], al
lea eax, [ebx + 1]
push eax
lea eax, [esi + edi]
push eax
lea eax, [edi + 2]
push eax
call fcn.00484fa0
add esp, 0xc
add ebx, 2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
Function at 0x44fa50
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
sub esp, 0x418
push ebx
push edi
push 0
mov edi, ecx
xor bl, bl
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
push eax
push 0x4977a0
push 1
push 0
push 0x4977b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44fbfe
mov eax, dword [esp + 8]
push dword [esp + 0x424]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [esp + 0x42c]
cmp byte [edx], bl
je 0x44faac
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [esp + 0x430]
cmp byte [edx], 0
je 0x44fac3
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [esp + 0x434]
cmp byte [edx], 0
je 0x44fada
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push esi
mov esi, dword [esp + 0x43c]
cmp byte [esi], 0
je 0x44fb0b
mov ecx, dword [esp + 0x444]
cmp byte [ecx], 0
je 0x44fafd
call fcn.0040dd10
lea edx, [eax - 1]
jmp 0x44faff
xor edx, edx
mov eax, dword [esp + 0xc]
push edx
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov esi, dword [esp + 0x440]
cmp byte [esi], 0
je 0x44fb4c
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.00412340
add esp, 0xc
test al, al
je 0x44fb4c
mov ecx, dword [esp + 0xc]
mov esi, 0x600
movzx eax, al
or ax, si
movzx eax, ax
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x34]
mov ecx, dword [esp + 0x448]
cmp byte [ecx], 0
je 0x44fb6b
mov eax, dword [esp + 0xc]
mov esi, dword [eax]
call fcn.0040dd10
push eax
push dword [esp + 0x10]
call dword [esi + 0x3c]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x4977c0
push eax
mov ecx, dword [eax]
call dword [ecx]
pop esi
test eax, eax
js 0x44fbf4
push 0x104
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push dword [esp + 0x434]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
lea eax, [esp + 0x21c]
push eax
push 0x104
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x218]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x44fbea
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49bca8
call fcn.004744e0
mov bl, 1
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
test bl, bl
je 0x44fc18
pop edi
mov eax, 1
pop ebx
add esp, 0x418
ret 0x24
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
jne 0x44fc47
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop edi
pop ebx
add esp, 0x418
ret 0x24
push 0x49bc4d
push 0
push 0x49e628
mov ecx, edi
call fcn.0042c8f0
pop edi
pop ebx
add esp, 0x418
ret 0x24
Function at 0x44fc70
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x12c
push esi
mov esi, ecx
test eax, eax
je 0x44fd44
cmp byte [eax], 0
je 0x44fd44
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
jmp 0x44fcb0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44fcb0
sub ecx, edx
je 0x44fcc6
cmp byte [esp + ecx + 0x27], 0x5c
jne 0x44fcc6
mov byte [esp + ecx + 0x27], al
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44fcd0
sub ecx, edx
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x16], 0
mov dword [esp + 4], 0
mov byte [esp + ecx + 0x29], al
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, 0x4054
mov word [esp + 0x14], ax
lea eax, [esp + 4]
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
mov ecx, esi
setne al
movzx eax, al
push eax
call fcn.0042c990
pop esi
add esp, 0x12c
ret 4
mov eax, dword [0x4aa1d8]
test byte [eax + 0xe0], 1
jne 0x44fd72
mov ecx, dword [0x4ad0c8]
push 1
push 0
push 0xffffffffffffffff
push 0x49e628
call fcn.004744e0
pop esi
add esp, 0x12c
ret 4
push 0x49bc4d
push 0
push 0x49e628
call fcn.0042c8f0
pop esi
add esp, 0x12c
ret 4