joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dcb5
Capabilities:
Read clipboard data

Disassembly:
push ebp
lea ebp, [esp - 0xf94]
mov eax, 0x1014
call fcn.00468c00
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0xf90], eax
mov eax, dword [ebp + 0xf9c]
push esi
xor esi, esi
and dword [ebp - 0x7c], esi
push eax
mov dword [ebp - 0x74], eax
call fcn.0040e88b
test eax, eax
je 0x44de29
push edi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x44dd31
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, eax
cmp esi, 0x1000
jae 0x44dd31
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00468fa0
mov eax, esi
shr eax, 1
add esp, 0xc
xor ecx, ecx
mov word [ebp + eax*2 - 0x70], cx
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
jne 0x44dd42
xor eax, eax
jmp 0x44de28
and dword [ebp - 0x78], 0
cmp word [ebp - 0x70], 0
movzx eax, word [ebp - 0x70]
push ebx
lea esi, [ebp - 0x70]
je 0x44de0d
cmp ax, 0x7a
ja 0x44ddff
movzx eax, al
movsx eax, byte [eax + str._AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
and eax, 0xc
je 0x44ddff
mov ebx, esi
inc esi
xor edi, edi
inc esi
inc edi
movzx eax, word [esi]
cmp ax, 0x7a
ja 0x44dd9a
movzx eax, al
movsx eax, byte [eax + str._AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
and eax, 0xc
je 0x44dd9a
inc esi
inc esi
inc edi
jmp 0x44dd7d
cmp edi, 8
je 0x44ddcf
cmp edi, 0x20
je 0x44ddc8
cmp edi, 0x28
je 0x44ddc1
cmp edi, 0x38
je 0x44ddba
cmp edi, 0x40
jne 0x44ddff
mov eax, str.sha256
jmp 0x44ddd4
mov eax, str.sha224
jmp 0x44ddd4
mov eax, str.sha1
jmp 0x44ddd4
mov eax, 0x47d1e8
jmp 0x44ddd4
mov eax, str.crc32
cmp dword [ebp + 0xfa0], 0
je 0x44de25
cmp edi, dword [ebp - 0x7c]
je 0x44ddf2
push eax
push dword [ebp - 0x74]
call fcn.0040d988
test eax, eax
jne 0x44de21
mov dword [ebp - 0x7c], edi
push edi
push ebx
push dword [ebp - 0x74]
call fcn.0044dc40
add dword [ebp - 0x78], eax
inc esi
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x44dd59
cmp dword [ebp + 0xfa0], 0
je 0x44de21
push dword [ebp - 0x78]
push dword [ebp - 0x74]
call fcn.0044c57e
xor eax, eax
jmp 0x44de27
mov eax, edi
pop ebx
pop edi
mov ecx, dword [ebp + 0xf90]
xor ecx, ebp
pop esi
call fcn.0046890b
add ebp, 0xf94
leave
ret 8
Function at 0x450721
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x32]
cmp word [edi], 0x7a
ja 0x450751
movzx eax, byte [edi]
movsx eax, byte [eax + str._AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
and eax, 0x30
jne 0x450784
push 0x258
lea eax, [ebp - 0x4b4]
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x4b4]
push eax
push str.RegCID_error_:__s
push 0
push 0
push dword [esi + 0xc]
call dword [sym.imp.PPLIB32W.DLL_XMessage]
add esp, 0x14
jmp 0x4507e5
push 0
push esi
call fcn.00423e99
push dword [esi + 0x4a68]
push dword [esi + 0x4a64]
push edi
push dword [esi + 0x4a60]
call fcn.00450695
push 0x82
lea eax, [esi + 0x584]
push eax
lea edi, [esi + 0x40]
push edi
push str._Path
call dword [sym.imp.PPLIB32W.DLL__SetCustStringTable_16]
cmp dword [esi + 0x2274], 0
jne 0x4507dd
push 0x14
lea eax, [esi + 0x2724]
push eax
push edi
push 0x473ab8
call dword [sym.imp.PPLIB32W.DLL__SetCustTable_16]
push 1
push esi
call fcn.00424e36
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046890b
leave
ret 4
Function at 0x45085b
Capabilities:
Check os version
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x48aa00
mov dword [0x48aa00], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [sym.imp.PPLIB32W.DLL__PPxCommonExtCommand_8]
xor ebx, ebx
push ebx
push 0x3fed
call esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.PPxMess
mov dword [0x48b040], eax
call edi
push str.TaskbarButtonCreated
mov dword [0x48b024], eax
call edi
push str._AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
mov dword [0x48a90c], eax
call dword [sym.imp.PPLIB32W.DLL__FixCharlengthTable_4]
push ebx
mov edi, 0xbf4d
push edi
call esi
push 0x48afe0
push edi
mov dword [0x4870c4], eax
mov dword [0x48afe0], 1
mov dword [0x48afe4], 0x34
call esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x258
mov esi, 0x48ab20
push esi
push dword [0x48ab14]
mov dword [0x489558], eax
mov dword [0x48a378], ebx
mov dword [0x48a220], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call dword [sym.imp.PPLIB32W.DLL__VFSFindLastEntry_4]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
push 0x48a9c0
mov word [eax], cx
call esi
push 0x48a920
call esi
cmp dword [0x48aa04], 6
jb 0x45096f
push 0xd
call dword [sym.imp.PPLIB32W.DLL__LoadSystemDLL_4]
mov dword [0x48972c], eax
cmp eax, ebx
je 0x45096f
push str.DwmIsCompositionEnabled
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x489564
mov dword [0x489560], eax
call eax
mov eax, dword [0x48ab14]
push 1
push eax
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x24], 0x406432
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], str.PaperPlaneCUIW
call dword [sym.imp.USER32.dll_RegisterClassW]
mov esi, dword [sym.imp.PPLIB32W.DLL__GetCustData_12]
push 4
push 0x48956c
push str.X_sps
call esi
push 4
push 0x489574
push str.X_combo
call esi
call fcn.004652f7
or dword [0x4870dc], 0x80
pop edi
pop esi
pop ebx
leave
ret
Function at 0x453f6f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
xor ebx, ebx
test byte [0x4870e0], 0x10
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], bl
je 0x453fb1
mov eax, dword [edi]
cmp dword [eax + 0x2274], ebx
je 0x453fb1
mov eax, dword [eax + 0x4a14]
mov dword [ebp + 0xc], str.CBJDLG
jmp 0x453fbd
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
mov dword [ebp + 0xc], str.CJDLG
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x20]
push ecx
push eax
call esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
push 0x14
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
push 0x473ab8
call dword [sym.imp.PPLIB32W.DLL__SetCustTable_16]
cmp dword [0x487124], ebx
je 0x454024
push 0x104
lea esi, [edi + 0x14]
push esi
push dword [edi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
movzx eax, word [0x487124]
push ebx
push ebx
push esi
push eax
call dword [sym.imp.PPLIB32W.DLL__WriteHistory_16]
push 1
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x454634
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x37f0]
cmp ecx, 0xffffffff
je 0x454680
mov edx, eax
sub edx, ecx
cmp edx, dword [0x487198]
jb 0x454675
push esi
call fcn.004544d3
xor eax, eax
jmp 0x454700
cmp ecx, 0xffffffff
je 0x454680
mov dword [esi + 0x37f0], eax
push edi
push dword [ebp + 0xc]
push esi
call fcn.004544f8
xor edi, edi
inc edi
cmp eax, edi
jne 0x4546f3
test dword [ebp + 0xc], 0x1a00
jne 0x4546f3
movzx eax, byte [ebp + 0xc]
cmp ax, 8
jb 0x4546f3
lea ecx, [eax - 0x10]
cmp cx, 0xf
jbe 0x4546f3
mov ecx, 0xe1
cmp ax, cx
ja 0x4546f3
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 0x14]
sar eax, 0x10
and eax, 0xff
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
jle 0x4546f7
cmp word [ebp - 0xc], 0x20
jb 0x4546f7
mov eax, edi
jmp 0x4546ff
push esi
call fcn.004544d3
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046890b
leave
ret 0x10
Function at 0x45470f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
call fcn.004563b4
mov esi, dword [esp + 0x10]
movzx ebx, ax
push ebx
push esi
call fcn.004544f8
cmp eax, 1
jne 0x4547cf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x37f0]
cmp ecx, 0xffffffff
je 0x45475a
mov edx, eax
sub edx, ecx
cmp edx, dword [0x487198]
jb 0x45475a
push esi
call fcn.004544d3
xor eax, eax
jmp 0x4547d2
test ebx, 0x1000
jne 0x4547cf
cmp ecx, 0xffffffff
je 0x45476d
mov dword [esi + 0x37f0], eax
cmp di, 0x20
jb 0x4547cf
cmp di, 0x7f
je 0x4547cf
lea eax, [esi + 0x3120]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x454782
sub eax, edx
sar eax, 1
mov word [esi + eax*2 + 0x3120], di
xor ecx, ecx
mov word [esi + eax*2 + 0x3122], cx
lea eax, [esi + 0x30cc]
cmp dword [eax], ecx
je 0x4547d8
and dword [eax], ecx
push esi
call fcn.0045405f
push esi
call fcn.0045396b
cmp dword [esi + 0x37f0], 0xffffffff
je 0x4547cf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x37f0], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret 8
add edi, 0x2800
mov ecx, 0x7ff
cmp di, cx
ja 0x4547ae
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, ecx
jmp 0x4547d2

Function at 0x454eec
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4

Function at 0x455703
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x455712
xor eax, eax
inc eax
jmp 0x455745
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
ret 4

Function at 0x455902
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax + 0x1c]
mov byte [ecx + eax + 0x20], dl
inc dword [eax + 0x1c]
cmp ecx, 0x38
jl 0x455935
jmp 0x45591b
mov byte [ecx + eax + 0x20], 0
inc dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
cmp ecx, 0x40
jl 0x455913
call fcn.00455748
jmp 0x455935
mov ecx, dword [eax + 0x1c]
mov byte [eax + ecx + 0x20], 0
inc dword [eax + 0x1c]
cmp dword [eax + 0x1c], 0x38
jl 0x45592a
mov ecx, dword [eax + 0x14]
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x58], dl
mov edx, ecx
shr ecx, 8
mov byte [eax + 0x5a], cl
mov cl, byte [eax + 0x14]
shr edx, 0x10
mov byte [eax + 0x5b], cl
mov ecx, dword [eax + 0x18]
mov byte [eax + 0x59], dl
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x5c], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 8
mov byte [eax + 0x5e], cl
mov cl, byte [eax + 0x18]
mov byte [eax + 0x5d], dl
mov byte [eax + 0x5f], cl
jmp fcn.00455748
Function at 0x455ad4
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
xor edx, edx
lea ecx, [eax + 0x2d]
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x120], esi
inc edx
add ecx, 4
cmp edx, 0x10
jl 0x455ae5
lea ecx, [ebp - 0xe8]
mov dword [ebp - 4], 0x30
mov edx, dword [ecx - 0x34]
mov esi, dword [ecx]
mov edi, edx
rol edi, 0xe
mov ebx, edx
shr edx, 3
ror ebx, 7
xor edi, ebx
xor edi, edx
mov edx, esi
rol edx, 0xf
mov ebx, esi
rol ebx, 0xd
xor edx, ebx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [ecx - 0x38]
add ecx, 4
add edi, dword [ecx - 0x18]
dec dword [ebp - 4]
mov dword [ecx + 4], edi
jne 0x455b20
mov ecx, dword [eax + 4]
mov edi, dword [eax]
mov ebx, dword [eax + 0x18]
mov edx, dword [eax + 0x10]
and dword [ebp - 0x14], 0
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov ecx, edx
ror ecx, 0xb
mov esi, edx
rol esi, 7
xor ecx, esi
mov esi, edx
ror esi, 6
xor ecx, esi
mov esi, edx
not esi
and esi, ebx
mov ebx, dword [ebp - 0x10]
and ebx, edx
xor esi, ebx
add ecx, esi
mov esi, dword [ebp - 0x14]
add ecx, dword [esi + 0x47f638]
mov ebx, edi
add ecx, dword [ebp + esi - 0x120]
mov esi, edi
add ecx, dword [ebp - 4]
ror esi, 0xd
rol ebx, 0xa
xor esi, ebx
mov ebx, edi
add dword [ebp - 0x14], 4
ror ebx, 2
xor esi, ebx
mov ebx, dword [ebp - 8]
xor ebx, edi
and ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
and edi, dword [ebp - 0x18]
xor ebx, edi
mov edi, dword [ebp - 0x20]
add esi, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], edi
add edx, ecx
cmp dword [ebp - 0x14], 0x100
lea edi, [esi + ecx]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
jl 0x455b8a
mov ecx, dword [eax]
mov esi, dword [ebp - 8]
add ecx, edi
mov dword [eax], ecx
mov ecx, dword [eax + 4]
add ecx, esi
mov esi, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [eax + 8]
add ecx, esi
mov esi, dword [ebp - 0x1c]
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ecx, esi
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0x10]
add ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], ecx
mov ecx, dword [eax + 0x14]
add ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x14], ecx
mov ecx, dword [eax + 0x18]
add ecx, ebx
mov dword [eax + 0x18], ecx
mov ecx, dword [eax + 0x1c]
pop edi
add ecx, edx
and dword [eax + 0x28], 0
pop esi
mov dword [eax + 0x1c], ecx
pop ebx
leave
ret
Function at 0x455c77
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [eax + 0x28]
mov byte [ecx + eax + 0x2c], dl
inc dword [eax + 0x28]
cmp ecx, 0x38
jl 0x455caa
jmp 0x455c90
mov byte [ecx + eax + 0x2c], 0
inc dword [eax + 0x28]
mov ecx, dword [eax + 0x28]
cmp ecx, 0x40
jl 0x455c88
call fcn.00455ad4
jmp 0x455caa
mov ecx, dword [eax + 0x28]
mov byte [eax + ecx + 0x2c], 0
inc dword [eax + 0x28]
cmp dword [eax + 0x28], 0x38
jl 0x455c9f
mov ecx, dword [eax + 0x20]
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x64], dl
mov edx, ecx
shr ecx, 8
mov byte [eax + 0x66], cl
mov cl, byte [eax + 0x20]
shr edx, 0x10
mov byte [eax + 0x67], cl
mov ecx, dword [eax + 0x24]
mov byte [eax + 0x65], dl
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x68], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 8
mov byte [eax + 0x6a], cl
mov cl, byte [eax + 0x24]
mov byte [eax + 0x69], dl
mov byte [eax + 0x6b], cl
jmp fcn.00455ad4
Function at 0x457449
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x7c8]
sub esp, 0x848
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x7c4], eax
push esi
mov esi, dword [ebp + 0x7d0]
push edi
push 5
push esi
call dword [sym.imp.USER32.dll_GetWindow]
xor edi, edi
mov dword [ebp - 0x80], eax
cmp eax, edi
jne 0x45748b
push edi
push edi
push 0xf
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x457508
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.USER32.dll_BeginPaint]
cmp ebx, edi
jne 0x4574bc
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.USER32.dll_EndPaint]
push edi
push edi
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x457505
push 0x400
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [0x4871f8]
push dword [ebp - 0x7c]
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [0x4895e0]
push dword [ebp - 0x7c]
call dword [sym.imp.GDI32.dll_SetBkColor]
push ebx
lea eax, [ebp - 0x3c]
push eax
push edi
push edi
push dword [ebp - 0x7c]
call dword [sym.imp.GDI32.dll_TextOutW]
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
pop ebx
mov ecx, dword [ebp + 0x7c4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046890b
add ebp, 0x7c8
leave
ret 4

Function at 0x457901
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x804]
push eax
push 0x400
push 0xd
push dword [esi + 0x14]
call edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 4]
test eax, eax
je 0x45796b
lea ecx, [ebp - 0x804]
push ecx
push 0xba60
push dword [0x48b024]
push dword [eax + 0xc]
call edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 4]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046890b
leave
ret 4
Function at 0x457aad
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x918]
sub esp, 0x998
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x914], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x920]
push edi
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 0x70], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x68], eax
mov eax, dword [0x48851c]
push eax
imul eax, eax, 0x1b
push eax
push dword [ebp - 0x70]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
push 0x47fd12
push edi
call dword [sym.imp.USER32.dll_SetPropW]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 0x64], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x74], eax
mov ebx, 0x444
mov eax, dword [ebp - 0x64]
add eax, 0x41
movzx eax, ax
push eax
lea eax, [ebp + 0x464]
push str.Network_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor eax, eax
push 0x258
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4c]
push eax
push str.RemotePath
lea eax, [ebp + 0x464]
push eax
push 0x80000001
call dword [sym.imp.PPLIB32W.DLL__GetRegString_20]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x74]
xor eax, eax
inc eax
shl eax, cl
test edx, eax
jne 0x457b8e
cmp word [ebp - 0x4c], 0
mov byte [ebp - 0x58], 0xc
je 0x457b92
mov byte [ebp - 0x58], 4
and dword [ebp - 0x54], 0
test byte [ebp - 0x58], 8
lea eax, [ecx + 0x1f60]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x57], 0x40
je 0x457bd2
lea eax, [ecx + 0x41]
mov word [ebp + 0x464], ax
push 0x2a
pop eax
mov word [ebp + 0x466], ax
xor eax, eax
mov word [ebp + 0x468], ax
mov word [ebp + 0x46a], ax
jmp 0x457bf2
lea eax, [ebp + 0x464]
push eax
push ecx
push dword [ebp - 0x68]
call fcn.00457a30
xor eax, eax
mov word [ebp + 0x466], ax
mov word [ebp + 0x468], ax
lea eax, [ebp + 0x464]
push eax
push 0
push 0x44d
push edi
call esi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x60]
push eax
push 1
push ebx
push edi
call esi
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], 0x1a
jl 0x457b2f
push 0x48ab20
push 0x1a
push dword [ebp - 0x68]
call fcn.00457a30
and dword [ebp - 0x54], 0
push 0x47fe68
push 0
push 0x44d
push edi
mov byte [ebp - 0x58], 4
mov dword [ebp - 0x60], 0x1a
mov dword [ebp - 0x5c], 0x1f7f
mov byte [ebp - 0x57], 0x40
call esi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x60]
push eax
push 1
push ebx
push edi
call esi
push dword [ebp - 0x78]
push dword [ebp - 0x68]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x68]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x70]
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x6c]
and dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x80]
push eax
push 0x1a
push 0x413
push edi
call esi
mov ecx, dword [ebp + 0x914]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0x918
leave
ret 4
Function at 0x457e9c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x804]
push eax
mov edi, 0x400
push edi
push 0xd
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.PPLIB32W.DLL__WriteHistory_16]
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x457ef7
mov ecx, dword [eax + 0xc]
jmp 0x457eff
mov ecx, dword [0x48a220]
xor eax, eax
push ebx
push ebx
lea edx, [ebp - 0x804]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.PPLIB32W.DLL__PP_ExtractMacro_24]
push 0x4739e8
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
leave
ret 4

Function at 0x45878c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push 0x40c
push dword [edi]
call esi
cmp eax, ebx
mov dword [ebp + 8], eax
jle 0x4587e8
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x41c
push dword [edi]
mov dword [ebp - 0x50], 0x50
mov dword [ebp - 0x4c], 1
call esi
mov eax, dword [ebp + 0xc]
xor dword [ebp - 0x48], eax
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x40b
push dword [edi]
call esi
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x4587b2
push edi
call fcn.004580fa
pop edi
pop esi
pop ebx
leave
ret 8