joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435563
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 4
push dword [ebp + 8]
or ebx, 0xffffffff
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x435583
inc eax
jmp 0x43572f
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
call fcn.004536b5
push edi
call fcn.0045ec43
lea eax, [ebp + 8]
xor esi, esi
push eax
push 0x72
push 0x64
push dword [edi + 0x26]
mov dword [0x48cd14], esi
call fcn.0043c164
test eax, eax
jne 0x4355c8
push dword [ebp + 8]
call fcn.0043d8ec
mov dword [0x48cd14], 1
push 0xfffe
push 2
mov dword [0x48cd04], esi
mov dword [0x48cd08], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x48cd04], eax
call fcn.0046bf87
mov esi, eax
test esi, esi
jne 0x4356c4
push dword [0x48cd04]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x1002
push dword [ebp + 0xc]
mov dword [0x48cd00], eax
call fcn.0046b716
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x435625
mov esi, 0x2713
jmp 0x4356c4
mov eax, dword [edi + 0xe6]
test eax, eax
je 0x43564c
push eax
call fcn.00439914
mov esi, eax
test esi, esi
je 0x43564c
cmp dword [ebp + 0x10], 0
jne 0x435647
push esi
call fcn.00453811
or esi, 0xffffffff
jmp 0x4356c4
cmp dword [ebp + 0x14], 0
je 0x435664
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push edi
call fcn.00435ea2
mov esi, eax
jmp 0x435674
push 0
push dword [edi + 0xde]
push 0
push edi
call fcn.00435ea2
test esi, esi
jne 0x4356c4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
call fcn.00435e2b
mov esi, eax
test esi, esi
jne 0x4356c4
push ebx
call fcn.00437aba
mov esi, eax
test esi, esi
jne 0x4356c4
push ebx
push edi
call fcn.004373d1
mov esi, eax
test esi, esi
jne 0x4356c4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
call fcn.004390bc
mov esi, eax
test esi, esi
jne 0x4356c4
push ebx
call fcn.00437376
mov esi, eax
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call edi
mov eax, dword [0x48cd04]
test eax, eax
je 0x4356ee
push eax
call edi
push dword [0x48cd04]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [0x48cd04], 0
cmp ebx, 0xffffffff
je 0x4356fa
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x435722
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
cmp esi, 0xffffffff
push 6
pop ecx
cmovne eax, ecx
cmp dword [ebp + 0x10], 0
jne 0x435722
test eax, eax
je 0x435722
push eax
call fcn.0044af27
push 0
push 2
call fcn.004671eb
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x43bfdb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x49edf0]
push ebx
push esi
imul esi, dword [ebp + 8], 0xca
xor ebx, ebx
push edi
push ebx
push ebx
push dword [esi + eax + 6]
mov edi, dword [esi + eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x43c00c
mov eax, 0x2713
jmp 0x43c041
push ebx
lea eax, [ebp + 8]
push eax
mov eax, dword [0x49edf0]
add eax, 2
push 0xca
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43c005
mov eax, dword [0x49edf0]
push ebx
add eax, 0xa
push 1
add eax, esi
push eax
call fcn.0046bafd
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x43c1f8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
imul ecx, dword [ebp + 0xc], 0xca
mov eax, dword [0x49edf0]
push ebx
push esi
xor ebx, ebx
and dword [ebp - 8], ebx
push edi
mov edx, dword [ecx + eax + 6]
mov eax, dword [ecx + eax + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov edi, dword [eax + 0xa]
test edi, edi
je 0x43c29e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
push ebx
pop esi
mov ecx, 0x4000
push 1
test cx, ax
pop eax
push edi
cmovne esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
call fcn.0044bde7
test eax, eax
jne 0x43c260
test esi, esi
jne 0x43c264
mov eax, 0x2714
jmp 0x43c398
test esi, esi
je 0x43c27d
mov eax, dword [ebp + 8]
push 2
push dword [eax + 6]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov edi, eax
test edi, edi
je 0x43c256
xor ebx, ebx
jmp 0x43c2b6
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov esi, dword [eax + 0xa]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
cmp esi, dword [eax + 6]
je 0x43c2b9
push 3
pop eax
jmp 0x43c398
push dword [eax + 6]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x43c256
mov dword [ebp - 8], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 2]
add eax, dword [ebp - 0xc]
push 0
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x43c2dc
mov ebx, 0x2713
jmp 0x43c379
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
lea eax, [ebp - 0x10]
push 0
push eax
mov eax, dword [ebp + 8]
push dword [eax + 6]
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43c2d2
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 6]
cmp eax, dword [ecx + 2]
je 0x43c30e
push 4
jmp 0x43c325
mov eax, dword [esi + 0xa]
cmp eax, dword [ecx + 6]
je 0x43c31a
push 3
jmp 0x43c325
movsx eax, word [esi + 2]
cmp eax, dword [ebp + 0x10]
je 0x43c328
push 5
pop ebx
jmp 0x43c36e
test byte [esi + 0xe], 8
mov eax, dword [ebp + 0xc]
mov word [esi + 4], ax
je 0x43c33a
push 8
pop eax
jmp 0x43c33c
xor eax, eax
cmp dword [ebp + 0x10], 0
mov word [esi + 0xe], ax
jge 0x43c36e
cmp dword [ebp - 8], 0
je 0x43c36e
cmp word [ecx], 0xfffd
je 0x43c36e
xor eax, eax
xor edx, edx
cmp ax, word [esi + 0x10]
jge 0x43c36e
lea ecx, [esi + 0x1c]
and dword [ecx], 0
inc edx
movsx eax, word [esi + 0x10]
lea ecx, [ecx + 0xe]
cmp edx, eax
jl 0x43c35f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
je 0x43c390
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 8]
and dword [eax + 0xa], 0
jmp 0x43c396
mov eax, dword [ebp + 8]
mov dword [eax + 0xa], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43ca2f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x49edf0]
push ebx
push esi
xor esi, esi
movsx ecx, word [eax]
mov ebx, esi
push edi
test ecx, ecx
jle 0x43ca57
add eax, 0xa
cmp word [eax], si
je 0x43ca61
inc ebx
add eax, 0xca
cmp ebx, ecx
jl 0x43ca48
push 2
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
test ebx, ebx
js 0x43ca57
mov eax, dword [ebp + 0x10]
push 2
pop ecx
mov dword [eax], ebx
cmp dword [ebp + 8], esi
je 0x43ca8c
push ecx
push dword [ebp + 8]
call fcn.0046b716
mov edi, eax
mov dword [ebp + 0x10], eax
cmp edi, 0xffffffff
jne 0x43ca92
mov eax, 0x2713
jmp 0x43ca5a
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x10], edi
push esi
push esi
push dword [ebp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x43caad
mov edi, 0x2713
jmp 0x43cbbd
push 0
lea eax, [ebp + 0xc]
imul esi, ebx, 0xca
push eax
mov eax, dword [0x49edf0]
add eax, 2
push 0xca
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43caa3
mov eax, dword [0x49edf0]
push 2
pop ecx
cmp word [esi + eax + 2], cx
je 0x43caeb
push 7
pop edi
jmp 0x43cbbd
mov ecx, dword [ebp + 0x14]
cmp dword [esi + eax + 6], ecx
je 0x43caf8
push 6
jmp 0x43cae5
or ecx, 0xffffffff
cmp word [esi + eax + 4], cx
jne 0x43cae3
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov eax, dword [0x49edf0]
test byte [esi + eax + 0xa], 4
je 0x43cb17
push 0xc
jmp 0x43cb19
push 8
pop ecx
mov word [esi + eax + 0xa], cx
xor ecx, ecx
mov eax, dword [0x49edf0]
push 0xfffffffffffffffc
push ebx
mov dword [esi + eax + 0xc], edi
mov eax, dword [0x49edf0]
mov dword [esi + eax + 0x40], ecx
mov eax, dword [0x49edf0]
mov dword [esi + eax + 0x24], ecx
mov eax, dword [0x49edf0]
mov dword [esi + eax + 0x32], ecx
mov eax, dword [0x49edf0]
add eax, 0x36
add eax, esi
push eax
call fcn.0043c1f8
mov edi, eax
test edi, edi
jne 0x43cb95
mov eax, dword [0x49edf0]
push dword [esi + eax + 0x40]
call fcn.0043d8ec
mov eax, dword [0x49edf0]
push 0xfffffffffffffffc
add eax, 0x1a
push ebx
add eax, esi
push eax
call fcn.0043c1f8
mov edi, eax
test edi, edi
jne 0x43cb95
mov eax, dword [0x49edf0]
push dword [esi + eax + 0x24]
call fcn.0043d8ec
jmp 0x43cbde
mov eax, dword [0x49edf0]
mov eax, dword [esi + eax + 0x40]
test eax, eax
je 0x43cba9
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x49edf0]
mov eax, dword [esi + eax + 0x24]
test eax, eax
je 0x43cbbd
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp + 8], 0
je 0x43cbcc
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x49edf0]
imul ecx, ebx, 0xca
xor edx, edx
mov word [ecx + eax + 0xa], dx
mov eax, edi
jmp 0x43ca5a
Function at 0x43d920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x43da10
push esi
call fcn.0046b21c
test eax, eax
jne 0x43da10
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp + 8], eax
test eax, eax
je 0x43da10
cmp eax, 0x10
jae 0x43d963
push 0xd
pop eax
jmp 0x43da13
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
lea ebx, [edi + 0xe]
test byte [ebx], 1
je 0x43da07
movsx ecx, word [edi + 4]
push ecx
call fcn.0043d71a
mov dword [ebp - 4], eax
test eax, eax
jne 0x43da07
movsx eax, word [edi + 4]
imul ecx, eax, 0xca
mov eax, dword [0x49edf0]
push 0
push 0
mov edx, dword [ecx + eax + 0xc]
mov eax, dword [ecx + eax + 6]
add eax, dword [edi + 6]
push eax
push edx
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x43d9c2
mov dword [ebp - 4], 0x2713
jmp 0x43da07
mov eax, dword [edi + 0xa]
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp + 8]
jbe 0x43d9d6
mov dword [ebp - 4], 0x19
jmp 0x43da07
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
call fcn.0046bf08
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43d9b9
and dword [ebp - 4], 0
push 0
push 1
push ebx
call fcn.0046bafd
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4445a7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [ebp + 0x14], esi
jae 0x4445be
mov eax, 0x2713
jmp 0x444677
cmp dword [0x49cd2c], 0
je 0x444653
mov ecx, dword [0x48cd20]
lea eax, [esi + ecx]
cmp eax, 0xfffe
jbe 0x44462e
mov eax, dword [0x48cd24]
push 0
push 0
add eax, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x48cd24]
mov edi, eax
add ecx, dword [0x48cd20]
cmp edi, ecx
jne 0x4445b4
push 0
lea eax, [ebp + 0xc]
push eax
push 0xfffe
push dword [0x49cd28]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4445b4
xor ecx, ecx
mov dword [0x48cd24], edi
mov dword [0x48cd20], ecx
mov eax, dword [0x49cd28]
push esi
add eax, ecx
push eax
push dword [ebp + 0x10]
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
push esi
call fcn.0044bde7
add dword [0x48cd20], eax
xor eax, eax
jmp 0x444677
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4445b4
xor eax, eax
cmp dword [ebp + 0xc], esi
sete al
dec eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x4456f5
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x478b78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 4
pop eax
mov dword [ebp - 0x6c], eax
mov edi, ebx
push 0x52
lea eax, [ebp - 0x58]
mov dword [ebp - 0x60], ebx
push eax
push str.UOCF
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x70], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call fcn.004445a7
mov dword [ebp - 0x5c], eax
test eax, eax
jne 0x4458a5
lea eax, [ebp - 0x58]
mov byte [ebp - 0x54], bl
push eax
push str.UOCF
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [ebp - 0x5c]
test eax, eax
mov edx, 0x5dd
cmovne ecx, edx
mov dword [ebp - 0x5c], ecx
test ecx, ecx
je 0x44576e
mov eax, ecx
jmp 0x4458aa
lea eax, [ebp - 0x60]
push eax
push 0x20019
push ebx
push dword [0x47c2e0]
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x5c], eax
test eax, eax
jne 0x4457b4
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push str.OrgchartSkipCRC
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x68], ebx
jne 0x4457ca
push esi
call fcn.004433c7
mov dword [ebp - 0x5c], eax
test eax, eax
jne 0x4458aa
push 0xfffe
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x49cd2c], eax
call fcn.0046bf87
mov dword [ebp - 0x5c], eax
test eax, eax
jne 0x4458aa
push dword [0x49cd2c]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 1
push ebx
push ebx
push esi
mov dword [0x49cd28], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
mov dword [0x48cd24], eax
lea eax, [ebp - 0x5c]
push eax
push 0xfffe
push dword [0x49cd28]
mov dword [0x48cd20], ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x445834
or eax, 0xffffffff
jmp 0x4458aa
mov dword [ebp - 0x64], ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.004466ff
mov dword [ebp - 0x5c], eax
test eax, eax
jne 0x44589d
mov ecx, dword [ebp - 0x64]
sub ecx, 1
je 0x44588a
sub ecx, 1
je 0x445871
sub ecx, 1
jne 0x445894
mov eax, 0x3e9
cmp word [0x48cd2a], ax
ja 0x4458bd
xor edi, edi
inc edi
jmp 0x445837
xor eax, eax
push 4
pop ecx
cmp word [0x48cd2a], cx
setne al
xor ebx, ebx
mov dword [0x47c2dc], eax
inc ebx
jmp 0x445837
cmp word [0x48cd2a], 0
jne 0x4458c4
cmp dword [ebp - 0x64], 0x4002
jne 0x445837
test ebx, ebx
je 0x4458a5
test edi, edi
jne 0x4458aa
mov eax, 0x5dd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475d95
mov esp, ebp
pop ebp
ret 4
mov eax, 0x5e4
jmp 0x4458aa
mov eax, 0x5df
jmp 0x4458aa
Function at 0x44ec87
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
and dword [0x49d5dc], 0
push eax
push ecx
push eax
push ecx
push 0x49e3a0
mov dword [0x49d5e8], ecx
mov dword [0x49d5ec], eax
mov dword [0x49e378], ecx
mov dword [0x49e37c], eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp + 0xc]
push dword [eax + 0x5a]
push dword [eax + 0x56]
push 0
push 0
push 0x49e390
call dword [sym.imp.USER32.dll_SetRect]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
push dword [ebp + 8]
shr eax, 8
movzx eax, al
neg eax
sbb eax, eax
add eax, 0x18
mov dword [0x49cd90], eax
call dword [sym.imp.USER32.dll_SetCapture]
pop ebp
ret 0x10
Function at 0x451293
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
call fcn.0044bc76
mov edi, dword [ebp + 8]
push 0
push dword [0x47c4f8]
mov dword [0x49da10], edi
push 0x68
push edi
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push dword [0x47c4fc]
push 0x69
push edi
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 1
push 0x68
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x28
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [0x49d9fc]
push edi
call fcn.0046aecc
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x454334
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
and dword [ebp - 0x10], eax
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], eax
jne 0x45436e
push eax
push dword [ebp + 8]
call fcn.0046b716
mov edi, eax
cmp edi, 0xffffffff
jne 0x454365
mov eax, 0x2713
jmp 0x454496
mov dword [ebp - 0x10], 1
jmp 0x454371
mov edi, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x10]
push eax
push edi
call fcn.0046bf08
mov esi, eax
test esi, esi
jne 0x454486
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call fcn.0046bf9b
mov esi, eax
test esi, esi
jne 0x454486
mov eax, dword [ebp + 0x10]
mov ecx, 0x7530
cmp eax, ecx
push ebx
cmovg eax, ecx
push eax
push 2
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call fcn.0046bf87
mov esi, eax
test esi, esi
jne 0x454485
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4543ec
mov esi, 0x2713
jmp 0x45447e
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4543e2
cmp dword [ebp + 0x18], 0
je 0x45441c
mov eax, dword [ebp + 0x10]
cdq
idiv dword [ebp + 0xc]
push 1
push 0
inc eax
push eax
push dword [ebp + 0x18]
push 2
call fcn.004670aa
cmp dword [ebp + 0x10], 0
jle 0x454477
inc dword [ebp - 4]
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4543e2
mov eax, dword [ebp - 8]
add eax, dword [ebp + 8]
push 0
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4543e2
cmp dword [ebp + 0x18], 0
je 0x45446f
mov eax, dword [ebp - 4]
push eax
push 2
call fcn.0046716d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jl 0x454422
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
cmp dword [ebp - 0x10], 0
je 0x454493
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x454ee1
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebx, eax
test ebx, ebx
je 0x454f49
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
cmp dword [edi], 0
je 0x454f18
mov ecx, dword [0x49cd84]
cmp dword [edi], ecx
jne 0x454f2a
dec ecx
mov dword [0x49cd84], ecx
jmp 0x454f2a
mov eax, dword [edi + 0x210]
cmp eax, 0xffffffff
je 0x454f2a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi + 0x218]
call fcn.0043cbe5
lea eax, [edi + 0x10a]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ebx, ebx
push ebx
push dword [ebp + 8]
call fcn.0046b044
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 2
push dword [ebp + 8]
call edi
test eax, eax
jne 0x454fa4
push 3
push dword [ebp + 8]
call edi
test eax, eax
jne 0x454fa4
push ebx
push ebx
call fcn.0044c6a1
cmp dword [0x49cdcc], ebx
je 0x454fa4
cmp dword [0x49dea8], ebx
jne 0x454fa4
push ebx
push dword [0x49d9fc]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
push 0x10
push dword [0x49d9fc]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop ebx
pop ebp
ret 4

Function at 0x456257
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x478b78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x214]
push esi
mov esi, 0x106
push esi
push ecx
push esi
lea ecx, [ebp - 0x31c]
push ecx
push esi
lea ecx, [ebp - 0x424]
push ecx
push esi
lea ecx, [ebp - 0x10c]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath_s]
add esp, 0x24
lea eax, [ebp - 0x10c]
push 0x4786ac
push esi
push eax
call fcn.0041c82c
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
pop esi
cmp eax, 3
je 0x4562cb
cmp eax, 4
je 0x4562cb
xor eax, eax
jmp 0x4562ce
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475d95
mov esp, ebp
pop ebp
ret 4
Function at 0x456d97
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
mov eax, dword [0x478b78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x3e8
push edi
mov edi, dword [ebp + 0xc]
push 0x63
pop eax
cmp edi, eax
je 0x456ff1
mov ecx, 0x106
lea eax, [ebp - 0x5fc]
push ecx
push eax
push ecx
lea eax, [ebp - 0x704]
push eax
push ecx
lea eax, [ebp - 0x80c]
push eax
push ecx
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath_s]
add esp, 0x24
lea eax, [ebp - 0x5fb]
push 0x4786e0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x456e10
push 0x32
pop eax
jmp 0x456ff1
push 0
push esi
call fcn.0046b716
mov dword [ebp - 0xc2c], eax
cmp eax, 0xffffffff
jne 0x456e7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x456fef
mov edi, 0x105
lea eax, [ebp - 0xa18]
push edi
push eax
push 0xffffffffffffffff
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0xa18]
push eax
push 0x79
call fcn.0046be71
push 0
lea eax, [ebp - 0xc24]
push eax
push dword [0x49d9fc]
call fcn.0044bc43
xor eax, eax
jmp 0x456ff1
lea ecx, [ebp - 0xc28]
push ecx
push eax
call fcn.0046bf08
mov dword [ebp - 0xc30], eax
test eax, eax
jne 0x456fe3
cmp dword [ebp - 0xc28], ebx
push eax
cmovl ebx, dword [ebp - 0xc28]
lea eax, [ebp - 0xc30]
push eax
push ebx
lea eax, [ebp - 0x4f4]
push eax
push dword [ebp - 0xc2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x456fe3
mov ecx, dword [ebp - 0x4f4]
push 2
pop esi
cmp ebx, 0xe
jbe 0x456f05
cmp cx, si
jne 0x456f05
cmp dword [ebp - 0x4f0], 0
jne 0x456f05
movsx eax, word [ebp - 0x4f2]
cmp eax, 0xffff
jne 0x456f05
push 0x62
pop eax
push 3
cmp edi, eax
pop ecx
cmovne eax, ecx
mov edi, eax
jmp 0x456fe3
cmp ebx, 4
jbe 0x456fb7
push 4
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
mov byte [ebp - 0x108], 0
lea eax, [ebp - 0x10c]
push eax
push str.UOCF
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x456f54
push 0x5b
cmp edi, 0x62
pop eax
cmove esi, eax
mov edi, esi
jmp 0x456fe3
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x4786e4
call esi
push eax
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
push 0x4786e4
call esi
cmp eax, 0x106
jae 0x457004
mov byte [ebp + eax - 0x10c], 0
lea eax, [ebp - 0x10c]
push 0x4786e4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x456fa9
push 4
jmp 0x456fe2
mov ecx, dword [ebp - 0x4f4]
cmp edi, 4
jne 0x456fb7
push 3
pop edi
cmp ebx, 0xe
jbe 0x456fd3
mov eax, 0x4d42
cmp cx, ax
jne 0x456fd3
cmp dword [ebp - 0x4d6], 0
jne 0x456fd3
push 9
jmp 0x456fe2
cmp ebx, 0x20
jbe 0x456fe3
cmp ecx, 0x9ac6cdd7
jne 0x456fe3
push 0xa
pop edi
push dword [ebp - 0xc2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475d95
mov esp, ebp
pop ebp
ret 8
call fcn.004761b0
int3