joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439b50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, ecx
push esi
push edi
xor edi, edi
lea eax, [esp + 0x14]
push eax
mov eax, edi
or eax, 1
push eax
push 0
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x439c2a
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push str.InstallDir
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x439c2a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x439c2a
dec eax
mov dword [esp + 0x10], eax
cmp byte [esp + eax + 0x18], 0
jne 0x439be6
test eax, eax
je 0x439bf7
lea ecx, [esp + 0x18]
cmp byte [ecx + eax - 1], 0
jne 0x439be0
dec eax
jne 0x439bd6
mov dword [esp + 0x10], eax
jmp 0x439bf7
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x104
jae 0x439c2a
mov byte [esp + eax + 0x18], 0
mov esi, eax
test eax, eax
je 0x439c31
test ebx, ebx
je 0x439c1d
lea edx, [esp + 0x18]
mov eax, edx
sub ebx, eax
lea esp, [esp]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [ebx + edx - 1], cl
test cl, cl
jne 0x439c10
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov byte [esp + 0x18], 0
xor esi, esi
test edi, edi
jne 0x439bfd
mov edi, 0x100
jmp 0x439b64
Function at 0x43cce0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x11c
push ebx
push edi
mov edi, dword [0x4b0840]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
mov ecx, dword [esp + 0x130]
xor edx, edx
push 0
call fcn.004134c0
mov bh, al
add esp, 0xc
test bh, bh
jne 0x43cd84
mov ecx, dword [esp + 0x128]
lea edx, [esp + 0xc]
push 0
call fcn.0044d690
add esp, 4
test eax, eax
jne 0x43cd46
push 1
push eax
push 0xffffffffffffffff
push 0x49e065
mov ecx, edi
call fcn.004759c0
pop edi
pop ebx
add esp, 0x11c
ret 8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push 0
push ecx
mov ecx, eax
mov dword [esp + 0x20], 0
call fcn.0044d8e0
add esp, 8
lea eax, [esp + 0x10]
mov ecx, edi
fstp st(0)
push eax
call fcn.004752d0
pop edi
pop ebx
add esp, 0x11c
ret 8
mov eax, dword [esp + 0x12c]
mov bl, byte [eax]
movzx eax, bl
test eax, 0xffffff80
jne 0x43cda9
push 2
push eax
call fcn.0048708c
add esp, 8
test eax, eax
je 0x43cda9
and bl, 0xdf
mov al, bl
cmp al, 0x50
je 0x43cdbd
xor ecx, ecx
mov edx, 2
cmp al, 0x54
cmovne edx, ecx
jmp 0x43cdc2
mov edx, 1
mov cl, bh
call fcn.0044d840
push 1
test al, al
mov edx, 0x4a45e4
push 0
mov ecx, 0x4a45e0
cmove ecx, edx
push 0xffffffffffffffff
push ecx
mov ecx, edi
call fcn.004759c0
pop edi
pop ebx
add esp, 0x11c
ret 8
Function at 0x43ce00
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x4b0840]
push 0
call fcn.004759c0
mov eax, dword [ebp + 8]
test eax, eax
je 0x43cf74
cmp byte [eax], 0
je 0x43cf74
push 0x104
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00488ae0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x140], 0
add esp, 0xc
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43ce60
sub ecx, edx
cmp byte [esp + ecx + 0x2f], 0x5c
je 0x43ce85
lea eax, [ecx + 1]
cmp eax, 0x105
jae 0x43cf74
mov word [esp + ecx + 0x30], 0x5c
mov eax, dword [0x4b2600]
test al, 1
jne 0x43ceb4
push str.GetDiskFreeSpaceExA
or eax, 1
push str.kernel32
mov dword [0x4b2600], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4b2604], eax
jmp 0x43ceb9
mov eax, dword [0x4b2604]
test eax, eax
je 0x43cf03
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x43cf74
cmp byte [ebp + 0xc], 0
je 0x43cef2
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
shrd esi, edi, 0x14
shr edi, 0x14
jmp 0x43cf42
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
shrd esi, edi, 0x14
shr edi, 0x14
jmp 0x43cf42
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43cf74
cmp byte [ebp + 0xc], 0
mov esi, dword [esp + 0x14]
cmovne esi, dword [esp + 0x10]
imul esi, dword [esp + 0xc]
imul esi, dword [esp + 8]
shr esi, 0x14
xor edi, edi
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x49e080
call fcn.004759c0
mov ecx, dword [0x4b0840]
push 0x18
push edi
push esi
call fcn.00402370
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4ac1d8]
test byte [eax + 0xe0], 1
jne 0x43cfa0
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x49e065
push 0
push 0x4a09f8
mov ecx, esi
call fcn.0042ddd0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x43ecc0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x43ed2b
cmp byte [0x4b0fb4], al
je 0x43edd6
mov eax, dword [0x4ac1d8]
test byte [eax + 0xe0], 1
jne 0x43ed0c
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop edi
add esp, 0x10c
ret
mov ecx, dword [0x4b0d10]
push 0x49e065
push 0
push 0x4a09f8
call fcn.0042ddd0
pop edi
add esp, 0x10c
ret
cmp byte [0x4b0fb4], 0
lea eax, [esp + 0xc]
push esi
mov esi, 0x4aef88
cmove esi, eax
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43eda0
cmp byte [edi], 0
je 0x43edb6
cmp byte [edi + 1], 0x3a
jne 0x43edb6
cmp byte [edi + 2], 0
jne 0x43edb6
push esi
push edi
call fcn.004855c8
add esp, 8
test eax, eax
je 0x43edb6
push edi
lea eax, [esp + 0xc]
push 0x4a4850
push eax
call fcn.00485e6d
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x43edb6
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x43edb6
push 0x103
push edi
push esi
call fcn.00488ae0
mov byte [esi + 0x103], 0
add esp, 0xc
cmp byte [0x4b0fb4], 0
pop esi
je 0x43edd6
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x49e080
call fcn.004759c0
pop edi
add esp, 0x10c
ret
Function at 0x43f380
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push edi
mov edi, dword [esp + 0x110]
mov ebx, ecx
test edi, edi
je 0x43f4cf
cmp byte [edi], 0
je 0x43f4cf
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43f3d0
shr eax, 4
mov ecx, ebx
not al
and al, 1
push 0xb7
movzx eax, al
push eax
call fcn.0042e020
pop edi
pop ebx
add esp, 0x104
ret 4
push ebp
push 0x5c
push edi
call fcn.00487e3e
mov ebp, eax
add esp, 8
cmp ebp, edi
jbe 0x43f4a8
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x43f3f0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43f3f0
sub ecx, edx
cmp ecx, 0x104
jb 0x43f457
mov eax, dword [0x4ac1d8]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x6f
jne 0x43f438
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop ebp
pop edi
pop ebx
add esp, 0x104
ret 4
push 0x49e065
push 0
push 0x4a09f8
mov ecx, ebx
call fcn.0042ddd0
pop ebp
pop edi
pop ebx
add esp, 0x104
ret 4
push esi
mov esi, ebp
lea eax, [esp + 0x10]
sub esi, edi
push esi
push edi
push eax
call fcn.00488ae0
add esp, 0xc
mov byte [esp + esi + 0x10], 0
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
call fcn.0043f380
cmp byte [ebp + 1], 0
pop esi
je 0x43f497
mov ecx, dword [0x4af094]
push 0
push 1
call fcn.004024d0
cmp byte [eax], 0x31
jne 0x43f4a8
pop ebp
pop edi
mov eax, 1
pop ebx
add esp, 0x104
ret 4
push 0xffffffffffffffff
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov ecx, ebx
sete al
movzx eax, al
push eax
call fcn.0042e020
pop ebp
pop edi
pop ebx
add esp, 0x104
ret 4
mov eax, dword [0x4ac1d8]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x43f505
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop edi
pop ebx
add esp, 0x104
ret 4
push 0x49e065
push 0
push 0x4a09f8
call fcn.0042ddd0
pop edi
pop ebx
add esp, 0x104
ret 4
Function at 0x440120
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
push edi
test esi, esi
je 0x440170
push 0
push 1
mov ecx, esi
call fcn.004024d0
cmp byte [esi + 0x17], 0
mov ebx, eax
jne 0x44014b
mov edi, dword [esi + 0xc]
jmp 0x44014d
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x440167
test byte [edi + 0x15], 8
je 0x440160
mov ecx, edi
call fcn.004023f0
add edi, 0xc
mov edi, dword [edi]
jmp 0x4401a7
mov edi, 0x4b1c4c
mov edi, dword [edi]
jmp 0x4401a7
lea eax, [esp + 0x14]
xor ecx, ecx
push eax
lea edx, [esp + 0x28]
call fcn.00475410
add esp, 4
test eax, eax
jne 0x44019f
mov eax, dword [0x4ac1d8]
mov dword [eax + 0x30], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x14]
xor ebp, ebp
push ebp
push ebp
push 2
push ebp
push ebp
push 0x40000000
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x4401f1
xor ecx, ecx
mov dword [esp + 0x24], ecx
test ebx, ebx
je 0x4401e4
push ecx
lea ecx, [esp + 0x28]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x24]
xor eax, eax
cmp ecx, edi
sete al
mov dword [esp + 0x24], eax
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x4ac1d8]
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x440216
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x4ac1d8]
test esi, esi
jne 0x440223
push ebx
call fcn.004858b4
add esp, 4
test ebp, ebp
je 0x440247
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x49e080
call fcn.004759c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
test byte [edi + 0xe0], 1
jne 0x440270
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esp + 0x18]
push 0x49e065
push 0
push 0x4a09f8
call fcn.0042ddd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x4403a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x128]
push edi
call fcn.0040ee90
mov edi, dword [esp + 0x128]
cmp eax, 1
je 0x440420
mov ecx, edi
call fcn.00451f80
test al, al
je 0x440420
mov eax, dword [0x4ac1d8]
test byte [eax + 0xe0], 1
jne 0x440400
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc
push 0x49e065
push 0
push 0x4a09f8
mov ecx, esi
call fcn.0042ddd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4403cf
mov edx, dword [esp + 0x124]
mov ecx, edx
lea ebx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x440450
sub ecx, ebx
mov eax, 0x103
cmp ecx, 0x104
cmovae ecx, eax
lea eax, [ecx + 1]
push eax
push edx
lea eax, [esp + 0x20]
push eax
call fcn.0048e4b0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call fcn.004883d5
add esp, 4
lea eax, [esp + 0x18]
push 0xa
push eax
push dword [0x4af0ec]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
je 0x4404e1
push ebp
push dword [0x4af0ec]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4404e1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4404e1
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push dword [0x4af0ec]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
jmp 0x4404e3
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
mov ecx, esi
sete al
movzx eax, al
push eax
call fcn.0042de70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc
Function at 0x440510
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x80
push esi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x4b0840]
push 0
call fcn.004759c0
mov eax, dword [esp + 0x88]
test eax, eax
je 0x4405f3
cmp byte [eax], 0
je 0x4405f3
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4405a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4ac1d8]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jne 0x44058b
mov ecx, dword [0x4af094]
push 1
push 0
push edi
push 0x4a09f8
call fcn.004759c0
pop edi
pop esi
add esp, 0x80
ret 4
push 0x49e065
push 0
push 0x4a09f8
mov ecx, esi
call fcn.0042ddd0
pop edi
pop esi
add esp, 0x80
ret 4
mov eax, dword [0x4ac1d8]
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x49e080
mov dword [eax + 0x30], 0
call fcn.004759c0
mov edx, edi
lea ecx, [esp + 8]
call fcn.00473a60
mov ecx, dword [0x4b0840]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.004759c0
pop edi
pop esi
add esp, 0x80
ret 4
mov eax, dword [0x4ac1d8]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x440628
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop esi
add esp, 0x80
ret 4
push 0x49e065
push 0
push 0x4a09f8
mov ecx, esi
call fcn.0042ddd0
pop esi
add esp, 0x80
ret 4
Function at 0x440fa0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
push ebx
push esi
push edi
push 1
push 0
mov esi, ecx
mov ecx, dword [0x4b0840]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x2c], esi
call fcn.004759c0
mov edi, dword [ebp + 8]
test edi, edi
je 0x4410f3
cmp byte [edi], 0
je 0x4410f3
push 0
push 0
push 3
push 0
push 7
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x441016
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x44105b
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x441042
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4ac1d8]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jmp 0x441106
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x3c]
xor eax, eax
or eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
movzx ebx, al
test ebx, 0xffffff80
jne 0x44107d
push 2
push ebx
call fcn.0048708c
add esp, 8
test eax, eax
je 0x44107d
and ebx, 0xffffffdf
movsx eax, bl
sub eax, 0x4b
je 0x441092
sub eax, 2
jne 0x4410ae
push eax
push 0x100000
jmp 0x441099
push 0
push 0x400
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.00495d70
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [0x4ac1d8]
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x49e080
mov dword [eax + 0x30], 0
call fcn.004759c0
mov ecx, dword [0x4b0840]
push 0x18
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.00402370
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4ac1d8]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x441127
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x49e065
push 0
push 0x4a09f8
mov ecx, esi
call fcn.0042ddd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44d840
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, cl
test bl, bl
jne 0x44d84b
xor al, al
pop ebx
ret
dec edx
je 0x44d86d
movzx eax, bl
push eax
dec edx
je 0x44d862
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
pop ebx
ret
mov al, bl
dec al
cmp al, 5
ja 0x44d87a
cmp bl, 3
jne 0x44d882
mov al, bl
add al, 0x66
cmp al, 5
ja 0x44d899
cmp dword [0x4af0c4], 0
movzx eax, bl
je 0x44d8cc
mov al, byte [eax + 0x4af9c0]
shr al, 7
pop ebx
ret
cmp dword [0x4af0c8], 0
je 0x44d8c9
push 0
xor edx, edx
mov cl, bl
call fcn.00412d50
add esp, 4
test al, al
je 0x44d8bb
mov cl, 1
call fcn.00412bc0
movzx eax, bl
pop ebx
mov al, byte [eax + 0x4af9c0]
shr al, 7
ret
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
Function at 0x44de60
Capabilities:
Get disk information

Disassembly:
sub esp, 0x108
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
push 0
push 0x410
mov byte [edi], 0
call ebx
mov ebp, eax
test ebp, ebp
jne 0x44dea1
push esi
push eax
push 0x1000
call ebx
mov ebp, eax
test ebp, ebp
jne 0x44dea1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
cmp byte [esp + 0x120], 0
push 0x104
push edi
push 0
push ebp
je 0x44debc
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
jmp 0x44dec2
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
mov ebx, eax
test ebx, ebx
jne 0x44dfd2
mov eax, dword [0x4a4ca4]
test eax, eax
je 0x44dfd2
push 0x104
push edi
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x44dfd2
cmp byte [esp + 0x120], 0
je 0x44df3b
push 0x5c
push edi
call fcn.00487e3e
mov edx, eax
add esp, 8
test edx, edx
je 0x44dfd2
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44df10
sub ecx, esi
lea eax, [edx + 1]
push ecx
push eax
push edi
call fcn.00486480
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
mov word [esp + 0x11], 0x3a
mov byte [esp + 0x10], 0x41
jmp 0x44df50
push 0x104
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov esi, eax
cmp esi, 2
jbe 0x44df88
sub esi, 2
lea eax, [esp + 0x14]
push esi
push edi
push eax
call fcn.00487d0f
add esp, 0xc
test eax, eax
jne 0x44df88
cmp byte [esi + edi], 0x5c
je 0x44dfaa
mov al, byte [esp + 0x10]
inc al
mov byte [esp + 0x10], al
cmp al, 0x5a
jle 0x44df50
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
movzx eax, byte [esp + 0x10]
sub ebx, esi
mov byte [edi], al
movzx eax, byte [esp + 0x11]
mov byte [edi + 1], al
lea eax, [ebx + 1]
push eax
lea eax, [esi + edi]
push eax
lea eax, [edi + 2]
push eax
call fcn.00486480
add esp, 0xc
add ebx, 2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
Function at 0x450f30
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
sub esp, 0x418
push ebx
push edi
push 0
mov edi, ecx
xor bl, bl
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
push eax
push 0x499800
push 1
push 0
push 0x499810
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4510de
mov eax, dword [esp + 8]
push dword [esp + 0x424]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [esp + 0x42c]
cmp byte [edx], bl
je 0x450f8c
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [esp + 0x430]
cmp byte [edx], 0
je 0x450fa3
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [esp + 0x434]
cmp byte [edx], 0
je 0x450fba
mov eax, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push esi
mov esi, dword [esp + 0x43c]
cmp byte [esi], 0
je 0x450feb
mov ecx, dword [esp + 0x444]
cmp byte [ecx], 0
je 0x450fdd
call fcn.0040ee90
lea edx, [eax - 1]
jmp 0x450fdf
xor edx, edx
mov eax, dword [esp + 0xc]
push edx
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov esi, dword [esp + 0x440]
cmp byte [esi], 0
je 0x45102c
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.004134c0
add esp, 0xc
test al, al
je 0x45102c
mov ecx, dword [esp + 0xc]
mov esi, 0x600
movzx eax, al
or ax, si
movzx eax, ax
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x34]
mov ecx, dword [esp + 0x448]
cmp byte [ecx], 0
je 0x45104b
mov eax, dword [esp + 0xc]
mov esi, dword [eax]
call fcn.0040ee90
push eax
push dword [esp + 0x10]
call dword [esi + 0x3c]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x499820
push eax
mov ecx, dword [eax]
call dword [ecx]
pop esi
test eax, eax
js 0x4510d4
push 0x104
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push dword [esp + 0x434]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
lea eax, [esp + 0x21c]
push eax
push 0x104
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x218]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x4510ca
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x49e080
call fcn.004759c0
mov bl, 1
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
test bl, bl
je 0x4510f8
pop edi
mov eax, 1
pop ebx
add esp, 0x418
ret 0x24
mov eax, dword [0x4ac1d8]
test byte [eax + 0xe0], 1
jne 0x451127
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop edi
pop ebx
add esp, 0x418
ret 0x24
push 0x49e065
push 0
push 0x4a09f8
mov ecx, edi
call fcn.0042ddd0
pop edi
pop ebx
add esp, 0x418
ret 0x24
Function at 0x451150
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x12c
push esi
mov esi, ecx
test eax, eax
je 0x451224
cmp byte [eax], 0
je 0x451224
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
jmp 0x451190
mov al, byte [ecx]
inc ecx
test al, al
jne 0x451190
sub ecx, edx
je 0x4511a6
cmp byte [esp + ecx + 0x27], 0x5c
jne 0x4511a6
mov byte [esp + ecx + 0x27], al
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4511b0
sub ecx, edx
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x16], 0
mov dword [esp + 4], 0
mov byte [esp + ecx + 0x29], al
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, 0x4054
mov word [esp + 0x14], ax
lea eax, [esp + 4]
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
mov ecx, esi
setne al
movzx eax, al
push eax
call fcn.0042de70
pop esi
add esp, 0x12c
ret 4
mov eax, dword [0x4ac1d8]
test byte [eax + 0xe0], 1
jne 0x451252
mov ecx, dword [0x4af094]
push 1
push 0
push 0xffffffffffffffff
push 0x4a09f8
call fcn.004759c0
pop esi
add esp, 0x12c
ret 4
push 0x49e065
push 0
push 0x4a09f8
call fcn.0042ddd0
pop esi
add esp, 0x12c
ret 4