joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448051
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x100
push ebx
push esi
mov esi, dword [esp + 0x10c]
test eax, 0x200
je 0x44806f
or dword [esi + 0x10], 8
test eax, 0x400
je 0x44807a
or dword [esi + 0x10], 1
test eax, 0x100
je 0x448085
or dword [esi + 0x10], 2
mov eax, dword [esi + 0x10]
test al, 8
je 0x448099
test eax, 0x800
je 0x448099
xor eax, 8
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test al, 1
je 0x4480ad
test eax, 0x100
je 0x4480ad
xor eax, 1
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test al, 2
je 0x4480c1
test eax, 0x200
je 0x4480c1
xor eax, 2
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test al, 0x10
je 0x4480d5
test eax, 0x1000
je 0x4480d5
xor eax, 0x10
mov dword [esi + 0x10], eax
xor ebx, ebx
cmp dword [esi + 0x14], ebx
je 0x448133
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [esi + 0x10]
test eax, 0x800
jne 0x4480f5
mov byte [esp + 0x19], bl
test eax, 0x100
jne 0x448100
mov byte [esp + 0x1a], bl
test eax, 0x200
jne 0x448112
mov ecx, dword [esi + 0x20]
mov byte [esp + 0x18], bl
mov byte [esp + ecx + 8], bl
test eax, 0x1000
jne 0x44811d
mov byte [esp + 0x63], bl
lea edx, [esp + 8]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
pop esi
pop ebx
add esp, 0x100
ret 8
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x44815d
push 0x11
call ebp
mov edx, 0x8000
test dx, ax
je 0x44816f
test dword [esi + 0x10], 0x800
jne 0x44816f
push ebx
push 0x11
push esi
call fcn.004479ec
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
jne 0x44818b
push 0x12
call ebp
mov edx, 0x8000
test dx, ax
je 0x44819d
test dword [esi + 0x10], 0x100
jne 0x44819d
push ebx
push 0x12
push esi
call fcn.004479ec
mov eax, dword [esi + 0x20]
push eax
call edi
mov ecx, 0x8000
test cx, ax
jne 0x4481bd
mov edx, dword [esi + 0x20]
push edx
call ebp
mov ecx, 0x8000
test cx, ax
je 0x4481d1
test dword [esi + 0x10], 0x200
jne 0x4481d1
mov edx, dword [esi + 0x20]
push ebx
push edx
push esi
call fcn.004479ec
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
jne 0x4481f3
push 0xa1
call ebp
mov edx, 0x8000
test dx, ax
je 0x448208
test dword [esi + 0x10], 0x400
jne 0x448208
push ebx
push 0xa1
push esi
call fcn.004479ec
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
jne 0x448224
push 0x5b
call ebp
mov edx, 0x8000
test dx, ax
je 0x448236
test dword [esi + 0x10], 0x1000
jne 0x448236
push ebx
push 0x5b
push esi
call fcn.004479ec
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x100
ret 8
Function at 0x448284
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [esp + 0x14], bl
je 0x4482eb
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_keybd_event]
push 0
mov byte [esp + 0x20], al
mov eax, dword [esp + 0x20]
push 0
push eax
push esi
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00439fdc
push 0
push esi
call edi
push 0
mov byte [esp + 0x20], al
mov edx, dword [esp + 0x20]
push 2
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
call fcn.00439ff3
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
ret 0xc

Function at 0x448310
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
lea ecx, [eax + 4]
push edi
mov edi, dword [eax + edx]
mov dword [esi], ecx
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412aaa
mov ebx, eax
mov eax, dword [esi]
add eax, dword [esp + 0x18]
lea ebp, [edi + edi]
push ebp
push eax
push ebx
call fcn.00412300
add dword [esi], ebp
xor ecx, ecx
add esp, 0x10
xor eax, eax
mov word [ebx + ebp], cx
test edi, edi
jle 0x44836c
xor word [ebx + eax*2], di
inc eax
cmp eax, edi
jl 0x448363
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 8

Function at 0x4489b1
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4489cd
mov eax, dword [esp + 0x10]
cmp byte [eax + 5], 1
jne 0x448a25
push 0
push 0
push 0xe
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jne 0x4489e5
mov edi, 0x7fff
push ebp
xor ecx, ecx
lea ebp, [edi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412aaa
add esp, 4
mov esi, eax
push esi
push ebp
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov word [esi + edi*2], cx
pop ebp
test eax, eax
jg 0x448a30
push esi
call fcn.004127bd
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov edi, dword [esp + 0x10]
cmp byte [edi + 0xc], 0
jne 0x448a4b
push esi
call fcn.00412665
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [edi + 0x24]
push eax
push esi
call fcn.00414b02
add esp, 8
push esi
test eax, eax
je 0x448a1d
mov byte [edi + 0xf0], 1
call fcn.004127bd
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x448f91
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
push edi
push 1
push eax
call fcn.00448bea
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x25
call ebx
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x18], 0
push eax
jge 0x448ff4
mov ecx, dword [esi]
push 0x25
push 0x100
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov edx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
push 0x101
push edx
jmp 0x449023
mov eax, dword [esi]
push 0x27
push 0x100
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov ecx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push ecx
call ebp
push 0
call edi
mov edx, dword [esi]
push 0
push edx
call fcn.00448bea
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x44aacc
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
push 0x4a5de0
call fcn.00436009
mov ecx, dword [0x4a5e40]
mov edx, dword [ecx + eax*4]
mov edi, dword [edx]
cmp ebx, esi
jne 0x44ab53
cmp dword [edi + 0x194], 0
je 0x44ab2f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edi + 0x194]
push 0
push esi
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
movzx edx, word [esp + 0x28]
movzx eax, word [esp + 0x24]
shl edx, 0x10
or edx, eax
push edx
push ebx
push 0x7b
push esi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
push ebx
push 0x4a5de0
call fcn.00444ba2
mov ebp, eax
cmp ebp, 0xffffffff
je 0x44ab2f
mov ecx, dword [0x4a5e54]
mov edx, dword [ecx + ebp*4]
mov ecx, dword [edx]
mov al, byte [ecx + 0x88]
cmp al, 0xe
je 0x44ab2f
cmp al, 0xf
je 0x44ab2f
cmp al, 0x13
je 0x44ab2f
cmp al, 0x10
je 0x44ab2f
cmp dword [ecx + 8], 0
je 0x44ab2f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push ecx
mov ecx, dword [0x4a5e54]
push edx
mov edx, dword [ecx + ebp*4]
push eax
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x44bfdc
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
push 0x4a5de0
call fcn.00444b1c
test al, al
je case.0x44c065.8
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4a5e40]
mov edx, dword [ecx + eax*4]
mov eax, dword [esp + 0x14]
mov ebx, dword [edx]
mov ecx, dword [0x4a5e54]
mov edx, dword [ecx + eax*4]
mov esi, dword [edx]
mov al, byte [esi + 0x88]
mov edi, dword [esi]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x24], al
call fcn.00437cad
mov eax, dword [esi + 0x44]
add esp, 4
test eax, eax
jl 0x44c04c
push eax
call fcn.004443ce
movzx eax, byte [esp + 0x20]
cmp eax, 0x1b
ja case.0x44c065.8
movzx edx, byte [eax + 0x44c20c]
mov ebp, dword [esp + 0x24]
jmp dword [edx*4 + 0x44c1e8]
mov ebp, dword [esp + 0x24]
cmp ebp, 0xfffffffe
je case.0x44c065.8
cmp ebp, 0xfe000000
jne 0x44c091
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.0044445b
jmp 0x44c1b0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push 0
push 0x1001
push edi
call ebx
push ebp
push 0
push 0x1026
push edi
call ebx
mov eax, dword [esp + 0x18]
push 1
push esi
push eax
call fcn.00435f73
jmp 0x44c1b0
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44c065.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.0044445b
jmp 0x44c1b0
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44c065.8
push eax
push 0
push 0x2001
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44c1b0
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44c065.8
push eax
push 0
push 0x111d
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44c1b0
mov eax, dword [esp + 0x24]
test eax, eax
jl case.0x44c065.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.0044445b
mov ecx, dword [esi + 0x30]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x44c1b0
test ebp, ebp
jl case.0x44c065.8
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push ebp
mov dword [esi + 0x44], ebp
call fcn.0044445b
push 1
push esi
push ebx
call fcn.00435f73
jmp 0x44c1b0
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
jl case.0x44c065.8
push 1
push eax
mov dword [esi + 0x44], eax
call fcn.0044445b
test byte [esi + 0x8a], 0x20
jne 0x44c1b0
mov edx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call edi
mov eax, dword [esi]
push 5
push eax
call edi
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [0x494cc4], 0
je 0x44c1cd
cmp byte [esp + 0x20], 8
jne 0x44c1cd
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x44dbe1
Capabilities:
Connect to http server

Disassembly:
sub esp, 0xc
cmp byte [esp + 0x18], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
je 0x44dc0d
mov eax, dword [esp + 0x2c]
push eax
push esi
push edi
call fcn.0044daa4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
mov ebp, dword [edi + 0x54]
push 0
push 0
push ebx
push eax
push ecx
movzx ecx, word [esi + 0x78]
push ecx
push edx
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44dc52
push 0xdeadbeef
push 0x15
push edi
call fcn.00445207
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov esi, dword [esi + 0x60]
push ebp
push SysReAllocString
push esi
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileW]
mov esi, eax
mov eax, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
test esi, esi
jne 0x44dc80
push esi
push 0xdeadbeef
push 0x16
jmp 0x44dcc9
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.WININET.dll_FtpGetFileSize]
mov edx, dword [esp + 0x28]
xor ecx, ecx
xor ebx, ebx
or ecx, eax
or edx, ebx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], edx
cmp byte [esp + 0x2c], bl
je 0x44dcc3
push esi
push edi
call fcn.0044541e
mov bl, al
lea eax, [esp + 0x14]
push eax
call fcn.004368c7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
push 1
push 0
push 0
push edi
call fcn.00445207
lea ecx, [esp + 0x14]
push ecx
mov bl, al
call fcn.004368c7
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret 0x10
Function at 0x44dce7
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
cmp dword [esi + 0x74], 4
push edi
mov edi, dword [esp + 0x40]
mov ebp, dword [edi + 0x54]
jne 0x44dd05
or ebp, 0x800000
mov ebx, dword [esi + 0x70]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
push 0
push 0
push ebx
push eax
movzx eax, word [esi + 0x78]
push ecx
mov ecx, dword [edi + 4]
push eax
push edx
push ecx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
push 0
test eax, eax
jne 0x44dd47
push 0xdeadbeef
push 0xb
push edi
call fcn.00445207
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ecx, dword [esi + 0x60]
push ebp
push 0
push 0
push 0
push ecx
push 0
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
test ebx, ebx
jne 0x44dd95
push eax
push 0xdeadbeef
push 0xc
push edi
call fcn.00445207
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004368c7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
cmp byte [esp + 0x48], 0
je 0x44dda4
push esi
push ebx
push edi
call fcn.00445446
test ebp, 0x1000
je 0x44dddf
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0x1f
push ebx
mov dword [esp + 0x54], 4
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [esp + 0x48], 0x100
push 4
lea eax, [esp + 0x4c]
push eax
push 0x1f
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x44de8c
push ebx
call fcn.00436955
cmp eax, 0xc8
jne 0x44de8c
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x20]
push eax
push 5
push ebx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0x20
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea ecx, [esp + 0x18]
push ecx
call fcn.004147cc
add esp, 4
cmp byte [esp + 0x4c], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
je 0x44de68
push ebx
push edi
call fcn.0044541e
lea edx, [esp + 0x10]
push edx
mov bl, al
call fcn.004368c7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 1
push 0
push 0
push edi
call fcn.00445207
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004368c7
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 0
push 0xdeadbeef
push 0xd
push edi
call fcn.00445207
lea ecx, [esp + 0x10]
push ecx
mov bl, al
call fcn.004368c7
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x2c
ret 0x10

Function at 0x44e1c7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp + 0xe4]
push esi
push edi
mov edi, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push eax
call fcn.00445f76
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00445ed0
xor esi, esi
test edi, edi
jbe 0x44e219
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call fcn.00445f48
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44e207
pop edi
pop esi
pop ebx
add esp, 0xdc
ret 0xc
Function at 0x44e4d4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
sub dword [0x49321c], 1
jne 0x44e4e3
call fcn.00446126
mov ecx, dword [0x4a4ce4]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a4ce4], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
test edx, edx
jge 0x44e52c
fadd qword [0x48d2f0]
fmul qword [0x48d2f8]
pop ecx
ret

Function at 0x44e918
Capabilities:
Delete directory
Delete file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x22c
lea eax, [esp + 0x20]
call fcn.0040fdc0
lea eax, [esp + 0x20]
push eax
call fcn.00438baa
add esp, 4
test al, al
jne 0x44e943
add esp, 0x22c
ret
push ebx
xor ebx, ebx
cmp byte [esp + 0x238], bl
jne 0x44e967
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
setne al
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x24]
push edx
call fcn.00412665
xor ecx, ecx
mov word [esp + eax*2 + 0x2a], cx
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x22c
ret
Function at 0x44e9c1
Capabilities:
Copy file
Move file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x438
push ebx
mov bl, byte [esp + 0x448]
lea eax, [esp + 0x230]
call fcn.0040fdc0
mov ecx, dword [esp + 0x444]
lea eax, [esp + 0x24]
call fcn.0040fdc0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x44ea40
test bl, bl
je 0x44ea69
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x234]
push eax
call fcn.00414774
add esp, 8
test eax, eax
je 0x44ea36
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov al, 1
pop ebx
add esp, 0x438
ret
lea eax, [esp + 0x230]
push eax
call fcn.00438baa
add esp, 4
test al, al
je 0x44ea69
lea ecx, [esp + 0x24]
push ecx
call fcn.00438baa
add esp, 4
test al, al
je 0x44ea73
test bl, bl
jne 0x44ea95
xor al, al
pop ebx
add esp, 0x438
ret
lea edx, [esp + 0x24]
push edx
call fcn.004387a4
add esp, 4
test al, al
je 0x44ea69
lea eax, [esp + 0x24]
push eax
call fcn.00438baa
add esp, 4
test al, al
je 0x44ea69
lea ecx, [esp + 0x230]
push 0x487f98
push ecx
call fcn.004129f3
lea edx, [esp + 0x238]
push edx
call fcn.00412665
lea edx, [esp + 0x30]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x242], cx
call fcn.00412665
xor ecx, ecx
mov word [esp + eax*2 + 0x36], cx
lea edx, [esp + 0x240]
lea eax, [esp + 0x34]
mov dword [esp + 0x1c], edx
add esp, 0x10
mov dword [esp + 0x10], eax
xor eax, eax
lea edx, [esp + 4]
mov ecx, 0x614
push edx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x438
ret
Function at 0x44eb21
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10b4
call fcn.0041fe20
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea eax, [esp + 0x438]
xor bl, bl
call fcn.0040fdc0
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x648]
call fcn.0040fdc0
lea eax, [esp + 0x648]
push eax
lea ecx, [esp + 0x43c]
push ecx
call fcn.00438b03
lea edx, [esp + 0x440]
push edx
mov byte [esp + 0x1b], al
call fcn.00438baa
add esp, 0xc
test al, al
je 0x44eb96
lea eax, [esp + 0x438]
push 0x487f98
push eax
call fcn.004129f3
add esp, 8
lea ecx, [esp + 0x648]
push ecx
call fcn.00438baa
add esp, 4
test al, al
je 0x44ebbf
lea edx, [esp + 0x648]
push 0x487f98
push edx
call fcn.004129f3
add esp, 8
lea eax, [esp + 0xcb0]
push eax
lea ecx, [esp + 0xebc]
push ecx
lea edx, [esp + 0xab0]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x448]
push ecx
call fcn.00415140
add esp, 0x14
lea edx, [esp + 0x858]
push edx
lea eax, [esp + 0x43c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
mov byte [esp + 0xe], 1
cmp esi, 0xffffffff
je 0x44ed75
mov edi, dword [sym.imp.KERNEL32.DLL_CopyFileW]
cmp byte [esp + 0xe], 1
jne 0x44ed75
test byte [esp + 0x858], 0x10
jne 0x44ed55
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x64c]
push edx
lea eax, [esp + 0xcb8]
push eax
lea ecx, [esp + 0xec4]
push ecx
lea edx, [esp + 0x894]
push edx
call fcn.0043895f
add esp, 0x14
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00412a21
lea edx, [esp + 0xab0]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004129f3
lea ecx, [esp + 0x894]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.004129f3
lea eax, [esp + 0x240]
push eax
call fcn.00438c08
add esp, 0x1c
test al, al
je 0x44ecd3
cmp byte [ebp + 0x10], 0
je 0x44ed2c
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
je 0x44ed3c
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp byte [ebp + 0x14], 1
jne 0x44ed17
cmp byte [esp + 0xf], 0
jne 0x44ecf5
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
jmp 0x44ed28
push 0
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
je 0x44ed2c
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x44ed28
push 0
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
jne 0x44ed53
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
je 0x44ed2c
mov bl, 1
lea ecx, [esp + 0x858]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x44ec18
mov byte [esp + 0xe], al
jmp 0x44ec18
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ed85
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa88
mov ecx, dword [ebp + 8]
push ebx
push esi
lea eax, [esp + 0x18]
mov byte [esp + 0xf], 0
call fcn.0040fdc0
lea eax, [esp + 0x18]
push eax
call fcn.00438baa
add esp, 4
test al, al
je 0x44edc7
lea ecx, [esp + 0x18]
push 0x487f98
push ecx
call fcn.004129f3
add esp, 8
lea edx, [esp + 0x680]
push edx
lea eax, [esp + 0x88c]
push eax
lea ecx, [esp + 0x480]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00415140
add esp, 0x14
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
mov bl, 1
cmp esi, 0xffffffff
je 0x44ee8c
cmp bl, 1
jne 0x44ee8c
test byte [esp + 0x228], 0x10
jne 0x44ee66
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x17], bl
call fcn.00412a21
lea edx, [esp + 0x480]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004129f3
lea ecx, [esp + 0x264]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.004129f3
add esp, 0x18
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp eax, 1
jne 0x44ee7d
lea ecx, [esp + 0x228]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x44ee0d
xor bl, bl
jmp 0x44ee0d
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, byte [esp + 0xf]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret