joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456b7c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov eax, 0x49ea24
push ebx
push esi
push edi
call fcn.0048dd88
cmp dword [0x4bc220], 0
je 0x456ba9
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x456ced
push 0x10
call fcn.00497944
test ah, 0x80
setne cl
and ecx, 1
mov byte [0x4bf196], cl
cmp byte [0x4bf196], 0
jne 0x456bd5
cmp dword [0x4bc218], 0
jne 0x456bd5
xor ebx, ebx
jmp 0x456bda
mov ebx, 1
push 8
call fcn.0048bf20
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x456c02
mov word [ebp - 0x1c], 0x14
mov eax, dword [ebp - 4]
call fcn.00455014
mov word [ebp - 0x1c], 8
mov esi, dword [ebp - 4]
jmp 0x456c05
mov esi, dword [ebp - 4]
push 0x4efc
call fcn.0048bf20
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x456c32
mov word [ebp - 0x1c], 0x2c
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004545f0
mov word [ebp - 0x1c], 0x20
mov edi, dword [ebp - 8]
jmp 0x456c35
mov edi, dword [ebp - 8]
mov byte [0x4bf195], 0
mov byte [0x4bf198], 0
lea eax, [ebp - 0x30]
mov byte [0x4bf194], 1
mov byte [0x4bf197], 0
push eax
test bl, bl
je 0x456c60
mov edx, 3
jmp 0x456c65
mov edx, 1
push edx
push esi
push edi
call fcn.00497b86
mov ebx, eax
mov byte [0x4bf194], 0
push edi
mov eax, dword [edi]
call dword [eax + 8]
push esi
mov ecx, dword [esi]
call dword [ecx + 8]
cmp byte [0x4bf196], 0
je 0x456cab
cmp dword [0x4bc218], 0
je 0x456cab
cmp ebx, 0x40100
jne 0x456cab
call fcn.00446428
mov eax, 0x4b98a4
call fcn.0045fbcc
cmp ebx, 0x40100
je 0x456ce3
cmp byte [0x4bf197], 0
jne 0x456ce3
call fcn.00497464
cmp eax, 0x3f0
je 0x456ce3
mov eax, 0x53c
call fcn.004116e8
push eax
call fcn.0044a224
pop ecx
mov eax, 0x4a69f4
call fcn.00429838
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ed78
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
mov ebx, eax
push eax
add esp, 0xfffffe10
mov eax, dword [ebx + 0x520]
test eax, eax
je 0x45ef69
mov edi, dword [ebx + eax*4 + 0x49c]
xor eax, eax
mov dword [esp], eax
test edi, edi
je 0x45ef69
push esp
push 0x20
push dword [ebx]
push edi
mov edx, dword [edi]
call dword [edx + 0x10]
test eax, eax
jne 0x45ef69
cmp dword [esp], 0
je 0x45ef69
xor ecx, ecx
xor ebp, ebp
mov dword [esp + 4], ecx
jmp 0x45ef42
mov dword [esp + 0xc], 0x10000000
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 8]
push edx
push 1
push edi
mov ecx, dword [edi]
call dword [ecx + 0x24]
test byte [esp + 0xf], 0x10
je 0x45ee0e
lea eax, [esp + 0x10]
xor ecx, ecx
push eax
mov eax, edi
mov edx, dword [esp + 8]
call fcn.00464e0c
test eax, eax
jne 0x45ee23
push dword [esp + 4]
mov edx, dword [0x4c11e4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
jmp 0x45ef42
mov eax, dword [ebx + 0x520]
mov edx, dword [esp + 4]
mov eax, dword [ebx + eax*4 + 0x41c]
call fcn.00464d7c
mov esi, eax
push 0x4409
push 0x160
lea eax, [esp + 0x418]
push eax
push 0
push esi
call fcn.004977d4
push esi
mov edx, dword [0x4c11e4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
mov dword [esp + 0x570], 7
mov dword [esp + 0x574], ebp
xor edx, edx
mov eax, dword [esp + 0x414]
lea ecx, [esp + 0x10]
mov dword [esp + 0x58c], eax
mov dword [esp + 0x578], edx
mov dword [esp + 0x584], ecx
push 0xc30
push 0
lea eax, [esp + 0x5a0]
push eax
call fcn.0048d768
add esp, 0xc
mov edx, dword [esp + 4]
mov dword [esp + 0x11c0], edx
mov dword [esp + 0x11b4], 0x20
push dword [esp + 0x584]
lea ecx, [esp + 0x59c]
push ecx
call fcn.0048d8e8
add esp, 8
mov eax, 0x4c04bc
mov dword [esp + 0x11a8], 0x10
lea edx, [esp + 0x598]
call fcn.00465058
mov dword [esp + 0x590], eax
lea ecx, [esp + 0x570]
push ecx
push 0
push 0x1007
push dword [ebx]
call fcn.00497ac4
mov dword [esp + 0x11d0], 2
lea edx, [esp + 0x520]
lea ecx, [esp + 0x11c8]
mov dword [esp + 0x11dc], edx
push ecx
push eax
push 0x102e
push dword [ebx]
call fcn.00497ac4
inc ebp
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 1
mov edx, dword [esp + 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 0xc]
test eax, eax
je 0x45edd7
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
add esp, 0x11f0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x461c04
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffff7f8
mov ebp, ecx
mov edi, edx
mov esi, eax
push 0x49f8b8
push edi
call fcn.0048d89c
add esp, 8
test eax, eax
sete bl
and ebx, 1
cmp byte [esi + 0x41d], 0
je 0x461c85
xor eax, eax
test bl, bl
mov dword [esp], eax
je 0x461c4a
mov dword [esp], 1
push 0x49fa72
push edi
call fcn.0048d89c
add esp, 8
test eax, eax
jne 0x461c65
mov edx, dword [esi + 0x520]
mov dword [esp], edx
cmp dword [esp], 0
je 0x461c85
xor ecx, ecx
mov edx, dword [esp]
mov eax, esi
call fcn.004630b4
xor edx, edx
mov eax, esi
call fcn.0045e350
jmp 0x461e70
mov eax, esi
call fcn.00464048
cmp dword [0x4bc218], 0
je 0x461d77
mov edx, str.FlatView
mov eax, 0x49f8bb
xor ecx, ecx
call fcn.00465b48
test eax, eax
je 0x461cb6
test bl, bl
je 0x461e70
lea edx, [esp + 8]
mov eax, 0x4ba5d4
xor ecx, ecx
call fcn.0045d244
push 0x49fa72
push edi
call fcn.0048d89c
add esp, 8
test eax, eax
je 0x461d09
mov eax, 0x4ba5d4
mov ecx, ebp
mov edx, edi
call fcn.0045d158
test eax, eax
je 0x461d09
test bl, bl
je 0x461cfb
lea eax, [esp + 8]
call fcn.0040b578
mov edx, eax
jmp 0x461cfd
xor edx, edx
mov eax, esi
call fcn.0045f0f8
jmp 0x461e70
lea edx, [esp + 0x408]
mov eax, 0x4ba5d4
xor ecx, ecx
call fcn.0045d270
lea eax, [esp + 0x408]
push eax
lea edx, [esp + 0x80c]
push edx
call fcn.0048d8e8
add esp, 8
lea eax, [esp + 0x808]
call fcn.0040bb00
lea eax, [esp + 0x808]
xor edx, edx
call fcn.0046830c
mov eax, esi
call fcn.00463b8c
test al, al
je 0x461e70
lea eax, [esp + 0x408]
call fcn.0040b578
mov edx, eax
mov eax, esi
call fcn.0045e350
jmp 0x461e70
lea edx, [esp + 0xc08]
push edx
push 0x400
call fcn.004973fe
test bl, bl
je 0x461e3a
lea ecx, [esp + 0xc08]
push ecx
lea eax, [esp + 0x100c]
push eax
call fcn.0048d8e8
add esp, 8
lea edx, [esp + 0x1408]
lea eax, [esp + 0xc08]
call fcn.0040bfc4
lea eax, [esp + 0x1008]
call fcn.0040ba60
lea eax, [esp + 0x1408]
call fcn.0040ba60
lea edx, [esp + 0x1408]
lea eax, [esp + 0x1008]
call fcn.0040e624
test eax, eax
jne 0x461e3a
cmp dword [esi + 0x520], 0
jle 0x461dfd
mov byte [esi + 0x41d], 1
jmp 0x461e2f
xor edx, edx
mov dword [esp + 4], edx
lea ecx, [esp + 4]
push ecx
push 0x11
push dword [esi]
call fcn.004977e0
mov eax, 0x4b98a4
mov edx, dword [esp + 4]
call fcn.00463fa8
push dword [esp + 4]
mov ecx, dword [0x4c11e4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
xor edx, edx
mov eax, esi
call fcn.0045e350
jmp 0x461e70
mov edx, ebp
mov eax, edi
call fcn.0046830c
test al, al
jne 0x461e53
mov eax, 0x49fa72
xor edx, edx
call fcn.0046830c
test bl, bl
je 0x461e67
lea eax, [esp + 0xc08]
call fcn.0040b578
mov edx, eax
jmp 0x461e69
xor edx, edx
mov eax, esi
call fcn.0045e350
add esp, 0x1808
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46278c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
push esp
call fcn.0049790e
push esp
push dword [ebx]
call fcn.00497ab2
mov eax, esp
push eax
push 0
push 0x1012
push dword [ebx]
call fcn.00497ac4
push 0x10
call fcn.00497944
test ah, 0x80
setne bl
and ebx, 1
push 0x12
call fcn.00497944
test ah, 0x80
setne al
and eax, 1
push 0x11
mov esi, eax
call fcn.00497944
test ah, 0x80
setne al
and eax, 1
test byte [esp + 8], 1
jne 0x4627f7
test ebx, ebx
jne 0x4627f7
test esi, esi
jne 0x4627f7
test eax, eax
je 0x4627fb
xor edx, edx
jmp 0x462800
mov edx, 1
mov eax, edx
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x462808
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffa78
mov ebx, eax
push 0
push 0
push 0x1004
push dword [ebx]
call fcn.00497ac4
mov esi, eax
mov eax, esp
mov edx, 0x400
call fcn.00468290
push 0x4001
push 0x160
lea ecx, [esp + 0x408]
push ecx
push 0
lea eax, [esp + 0x10]
push eax
call fcn.004977d4
push 0x28
push 0
lea edx, [esp + 0x568]
push edx
call fcn.0048d768
add esp, 0xc
xor eax, eax
mov dword [esp + 0x560], 3
mov ecx, dword [esp + 0x404]
mov dword [esp + 0x57c], ecx
mov dword [esp + 0x564], esi
mov dword [esp + 0x568], eax
mov eax, 0x3d4
call fcn.004116e8
mov dword [esp + 0x574], eax
lea edx, [esp + 0x560]
push edx
push 0
push 0x1007
push dword [ebx]
call fcn.00497ac4
push dword [ebx]
call fcn.00497aee
mov byte [ebx + 0x1c], 1
push 0
push esi
push 0x1017
push dword [ebx]
call fcn.00497ac4
add esp, 0x588
pop esi
pop ebx
ret
Function at 0x462c40
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff178
mov ebx, eax
cmp dword [0x4bc218], 0
je 0x462c5c
mov edx, str.ArcSort
jmp 0x462c61
mov edx, str.FileSort
mov eax, 0x49f8bb
xor ecx, ecx
call fcn.00465b48
mov edi, eax
mov eax, edi
and eax, 0x1f
cmp eax, 2
jne 0x462da0
xor esi, esi
mov dword [esp + 8], esi
xor eax, eax
mov dword [esp + 0xc], eax
lea edx, [esp + 4]
mov dword [esp + 4], 4
push edx
push 0
push 0x1005
push dword [ebx]
call fcn.00497ac4
test eax, eax
je 0x462da0
mov eax, 0x4c04bc
mov edx, dword [esp + 0x24]
call fcn.004653dc
mov ebp, esi
mov dword [eax + 8], ebp
mov eax, dword [0x4bc218]
test eax, eax
jne 0x462d9a
mov byte [esp + 0x2c], 0
add eax, 2
lea edx, [esp + 0x2c]
mov dword [esp + 0x84], eax
lea ecx, [esp + 0x7c]
mov dword [esp + 0x94], 0x50
mov dword [esp + 0x90], edx
push ecx
push ebp
push 0x102d
push dword [ebx]
call fcn.00497ac4
cmp byte [esp + 0x2c], 0
jne 0x462d9a
lea ecx, [esp + 0xa4]
mov eax, 0x4c04bc
mov edx, dword [esp + 0x24]
call fcn.00465240
push 0x400
push 0x160
lea eax, [esp + 0xcdc]
push eax
push 0
lea edx, [esp + 0xb4]
push edx
call fcn.004977d4
test eax, eax
je 0x462d9a
cmp byte [esp + 0xde4], 0
jne 0x462d67
lea ecx, [esp + 0xde4]
lea edx, [esp + 0xa4]
mov eax, ebx
call fcn.0046290c
mov ecx, dword [0x4bc218]
lea eax, [esp + 0xde4]
add ecx, 2
lea edx, [esp + 0xe34]
mov dword [esp + 0xe3c], ecx
mov dword [esp + 0xe48], eax
push edx
push ebp
push 0x102e
push dword [ebx]
call fcn.00497ac4
inc esi
jmp 0x462c7f
mov edx, 0x49fad5
mov eax, 0x49f8bb
mov ecx, 1
call fcn.00465b48
test eax, eax
je 0x462dbb
or edi, 0x40
mov edx, str.FlatView
mov eax, 0x49f8bb
xor ecx, ecx
call fcn.00465b48
test eax, eax
je 0x462dd6
or edi, 0x80
push 0x45dc8b
push edi
push 0x1030
push dword [ebx]
call fcn.00497ac4
cmp dword [ebx + 4], 0
je 0x462ef2
test edi, 0x20
setne al
and eax, 1
and edi, 0x1f
or ebp, 0xffffffff
mov byte [esp], al
xor eax, eax
mov edx, eax
shl edx, 3
sub edx, eax
cmp edi, dword [edx*4 + 0x49f748]
jne 0x462e22
mov ebp, dword [edx*4 + 0x49f744]
jmp 0x462e28
inc eax
cmp eax, 7
jl 0x462e09
push 0
push ebp
push 0x108c
push dword [ebx]
call fcn.00497ac4
mov dword [esp + 0xe5c], 0x24
xor esi, esi
lea eax, [esp + 0xe5c]
push eax
mov edi, esi
push edi
push 0x1203
push dword [ebx + 4]
call fcn.00497ac4
test eax, eax
je 0x462e93
test byte [esp + 0xe71], 8
je 0x462e8d
and dword [esp + 0xe70], 0xffffe7ff
lea eax, [esp + 0xe5c]
push eax
push edi
push 0x1204
push dword [ebx + 4]
call fcn.00497ac4
jmp 0x462e93
inc esi
cmp esi, 0x10
jl 0x462e44
push dword [ebx + 0xc]
push 0
push 0x1208
push dword [ebx + 4]
call fcn.00497ac4
lea edx, [esp + 0xe5c]
push edx
push ebp
push 0x1203
push dword [ebx + 4]
call fcn.00497ac4
or dword [esp + 0xe70], 0x1800
cmp byte [esp], 0
je 0x462ed3
mov ecx, 1
jmp 0x462ed5
xor ecx, ecx
mov dword [esp + 0xe78], ecx
lea eax, [esp + 0xe5c]
push eax
push ebp
push 0x1204
push dword [ebx + 4]
call fcn.00497ac4
add esp, 0xe88
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4644b1
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffb6c
mov edi, 0x4c0dd0
xor eax, eax
mov dword [esp], eax
push esp
call fcn.004977ce
test eax, eax
jl 0x4646cc
mov dword [esp + 4], 0xf0000000
push 0xffff0000
push 0
push 0x1101
push dword [edi]
call fcn.00497ac4
lea edx, [esp + 8]
push edx
push 0
push 0
call fcn.004977e0
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0xc]
push eax
push 1
mov edx, dword [esp + 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x24]
push 0x28
push 0
lea eax, [esp + 0x18]
push eax
call fcn.0048d768
add esp, 0xc
mov dword [esp + 0x10], 0x27
test byte [esp + 7], 0x80
je 0x46453f
mov dword [esp + 0x30], 1
or dword [esp + 0x10], 0x40
push 0xc
mov edx, dword [0x4c11e4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x46455a
xor eax, eax
jmp 0x4646dd
lea edx, [esp + 0x6c]
push edx
mov ecx, 1
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
call fcn.00464e0c
lea ecx, [esp + 0x6c]
xor eax, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x104
mov edx, dword [esp + 8]
call fcn.00464d7c
mov ebp, eax
mov eax, dword [esp + 8]
call fcn.00464ddc
mov dword [esi + 4], eax
lea edx, [esp + 0x10]
mov eax, ebp
call fcn.00464769
mov edx, dword [esp]
mov dword [esi], edx
mov ecx, dword [esp]
push ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 8]
xor eax, eax
call fcn.00464d7c
mov dword [esi + 8], eax
mov dword [esp + 0x34], esi
push edi
lea esi, [esp + 0x14]
lea edi, [esp + 0x44]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
pop edi
xor eax, eax
mov dword [esp + 0x3c], eax
lea edx, [esp + 0x38]
mov dword [esp + 0x38], 0xffff0000
push edx
push 0
push 0x1100
push dword [edi]
call fcn.00497ac4
mov ebx, eax
push ebx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov eax, dword [edi]
call fcn.00464790
mov esi, ebx
push esi
push 2
push 0x1102
push dword [edi]
call fcn.00497ac4
lea eax, [esp + 0xc]
push eax
push 0x11
push 0
call fcn.004977e0
push esi
push 4
push 0x110a
push dword [edi]
call fcn.00497ac4
mov ebx, eax
test ebx, ebx
je 0x4646af
mov dword [esp + 0x46c], 4
mov dword [esp + 0x470], ebx
lea edx, [esp + 0x46c]
push edx
push 0
push 0x110c
push dword [edi]
call fcn.00497ac4
mov esi, dword [esp + 0x490]
push dword [esi + 8]
push dword [esp + 0x10]
push 0
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
test eax, eax
jne 0x46469a
push ebx
push 2
push 0x1102
push dword [edi]
call fcn.00497ac4
mov dword [0x4c0dd4], ebx
jmp 0x4646af
push ebx
push 1
push 0x110a
push dword [edi]
call fcn.00497ac4
mov ebx, eax
test ebx, ebx
jne 0x46463d
push ebp
mov ecx, dword [0x4c11e4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
push dword [esp + 8]
mov edx, dword [0x4c11e4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
cmp dword [esp], 0
je 0x4646db
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
add esp, 0x494
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x464745
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
push edx
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call fcn.004977d4
mov eax, dword [esp + 4]
add esp, 0x160
ret

Function at 0x464b40
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffaa0
mov esi, eax
mov dword [0x4c0dd0], esi
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x49fd70
call fcn.004977d4
mov ebx, eax
test ebx, ebx
jne 0x464ba3
lea eax, [esp + 0x160]
push eax
push 0x400
call fcn.00497476
push 0x4001
push 0x160
lea edx, [esp + 8]
push edx
push 0
lea ecx, [esp + 0x170]
push ecx
call fcn.004977d4
mov ebx, eax
push ebx
push 0
push 0x1109
push esi
call fcn.00497ac4
call fcn.004644b1
add esp, 0x560
pop esi
pop ebx
ret

Function at 0x465058
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov eax, 0x49fddc
call fcn.0048dd88
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov edx, 1
add eax, 0xf8
call fcn.00465190
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul edx, dword [eax + 0x104], 0x38
mov esi, dword [ecx + 0xf8]
add esi, edx
cmp word [ebx + 0x400], 0
je 0x4650af
lea ecx, [ebx + 0x400]
jmp 0x4650b1
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0040efdc
mov word [ebp - 0x14], 0
jmp 0x465101
mov edx, dword [ebx + 0xc2c]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0xc00]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xc04]
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0xc08]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xc0c]
mov dword [esi + 0x18], eax
mov edx, dword [ebx + 0xc10]
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0xc14]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 0xc18]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0xc1c]
mov dword [esi + 0x28], eax
mov edx, dword [ebx + 0xc20]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 0xc24]
mov dword [esi + 0x30], ecx
mov eax, dword [ebx + 0xc28]
mov dword [esi + 0x34], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x104]
inc dword [edx + 0x104]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4677d4
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4a2ff8
push 1
push 0
push 0x4a3028
call fcn.00497b80
test eax, eax
jl 0x46789f
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x467820
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x467834
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x467846
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4a3058
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x467896
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call fcn.00497578
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x46788d
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4678ac
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call fcn.004977da
lea eax, [esp + 4]
push eax
push 0x10
push 0
call fcn.004977e0
push ebx
push dword [esp + 8]
call fcn.004977f8
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x4678e4
Capabilities:
Delete file
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call fcn.0049743a
cmp eax, 0xffffffff
jne 0x4678f9
xor eax, eax
jmp 0x467937
push ebx
call fcn.0048d918
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.0048d768
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call fcn.004977c8
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret
Function at 0x4680c4
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
call fcn.0049791a
mov ebp, eax
push ebp
call fcn.00497914
mov edi, eax
push edi
call fcn.004976ee
mov ebx, eax
push edi
call fcn.004976ee
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push dword [esp + 8]
call fcn.00497730
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call fcn.004976e8
mov dword [esp + 4], eax
push dword [esp]
push ebx
call fcn.0049776c
mov dword [esp + 8], eax
push dword [esp + 4]
push esi
call fcn.0049776c
mov dword [esp + 0xc], eax
push 0xcc0020
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
neg ecx
push ecx
mov ecx, eax
dec ecx
push 0
push ecx
push ebx
push edx
push eax
push 0
push 0
push esi
call fcn.0049778a
push 0xcc0020
push 0
push 0
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push 0
push ebx
call fcn.004976dc
push dword [esp + 8]
push ebx
call fcn.0049776c
push dword [esp + 0xc]
push esi
call fcn.0049776c
push dword [esp + 4]
call fcn.00497718
push ebx
call fcn.00497712
push esi
call fcn.00497712
push edi
push ebp
call fcn.00497aa6
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x469907
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.0048c0c4
pop ecx
mov edi, eax
test edi, edi
jne 0x46992a
mov eax, 1
xor edx, edx
jmp 0x4699bd
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.004974e8
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x469981
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x469950
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call fcn.004974e8
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x46994b
push edi
call fcn.0048beec
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00491e60
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x46dde0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff6cc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0x10]
lea esi, [ebp - 0x44]
push 0x3c
push 0
push esi
call fcn.0048d768
add esp, 0xc
mov dword [esi], 0x3c
mov dword [esi + 4], 0x500
test bl, bl
jne 0x46de23
or dword [esi + 4], 0x40
mov dword [esi + 0x10], edi
cmp dword [ebp + 8], 0
je 0x46de34
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
jmp 0x46de58
lea edx, [ebp - 0x94]
mov ecx, 0x50
mov eax, dword [esi + 0x10]
call fcn.0046c974
test al, al
je 0x46de53
lea edx, [ebp - 0x94]
jmp 0x46de55
xor edx, edx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x14], ecx
call fcn.0040b578
cmp edi, eax
jne 0x46de8d
push edi
push str.._s
lea edx, [ebp - 0x894]
push edx
call fcn.004908b8
add esp, 0xc
lea ecx, [ebp - 0x894]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], 1
call fcn.0040f820
test eax, eax
je 0x46df4a
mov eax, dword [ebp - 4]
call fcn.0040e5d4
cmp word [eax], 0
je 0x46df4a
xor edi, edi
push str.shell32.dll
call fcn.00497488
test eax, eax
je 0x46ded0
push str.ShellExecuteExW
push eax
call fcn.004974ac
mov edi, eax
test edi, edi
jne 0x46dedb
xor eax, eax
jmp 0x46dff2
mov edx, dword [ebp - 4]
mov dword [esi + 0x10], edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x46df01
lea edx, [ebp - 0x934]
mov ecx, 0x10000000
call fcn.0040f898
lea edx, [ebp - 0x934]
mov dword [esi + 0xc], edx
cmp dword [ebp - 8], 0
je 0x46df23
lea edx, [ebp - 0x1134]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.0040f898
lea eax, [ebp - 0x1134]
mov dword [esi + 0x18], eax
cmp dword [ebp + 0x14], 0
je 0x46df45
lea edx, [ebp - 0x1934]
mov ecx, 0x10000000
mov eax, dword [ebp + 0x14]
call fcn.0040f898
lea edx, [ebp - 0x1934]
mov dword [esi + 0x14], edx
push esi
call edi
jmp 0x46df50
push esi
call fcn.004977ec
test eax, eax
je 0x46df60
call fcn.00497464
cmp eax, 0x483
jne 0x46df67
xor eax, eax
jmp 0x46dff2
test bl, bl
jne 0x46dff0
mov eax, dword [esi + 0x38]
test eax, eax
je 0x46dfaf
mov edx, dword [0x4a0bfc]
mov dword [edx*4 + 0x4c12f0], eax
mov ecx, dword [0x4a0bfc]
mov eax, dword [esi + 0x20]
mov dword [ecx*4 + 0x4c1330], eax
mov edx, dword [0x4a0bfc]
inc edx
and edx, 0x8000000f
jns 0x46dfa7
dec edx
or edx, 0xfffffff0
inc edx
mov dword [0x4a0bfc], edx
jmp 0x46dfe2
xor ebx, ebx
mov eax, dword [ebx*4 + 0x4c1330]
cmp eax, dword [esi + 0x20]
jne 0x46dfdc
push 0
push dword [ebx*4 + 0x4c12f0]
call fcn.0049765c
cmp eax, 0x102
jne 0x46dfdc
mov edx, dword [ebx*4 + 0x4c12f0]
mov dword [esi + 0x38], edx
inc ebx
cmp ebx, 0x10
jl 0x46dfb1
cmp dword [ebp + 0xc], 0
je 0x46dff0
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x38]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10