joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46366b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x3cc]
cmp dword [edi], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
je 0x46369c
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov ebx, dword [ebp + 0x10]
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
mov dword [ebp - 4], eax
jne 0x4636e0
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x150]
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
mov dword [ebp - 4], eax
jne 0x4636e0
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x278]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x3b8]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x46382e
push eax
call fcn.004144cb
mov edi, eax
test edi, edi
pop ecx
je 0x4637ad
mov eax, dword [edi + 0x14]
push 2
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x463724
push edi
call fcn.00462f0c
movzx eax, word [ebp + 0xc]
movzx ebx, bx
shl ebx, 0x10
or ebx, eax
push ebx
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.0041804a
mov eax, dword [ebp - 4]
cmp dword [esi + 0x3b8], eax
jne 0x46377a
mov ecx, dword [edi + 0x44]
xor eax, eax
cmp ecx, eax
je 0x46376c
cmp word [ecx], ax
je 0x46376c
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4637ad
cmp dword [edi + 0x14], eax
je 0x4637ad
mov dword [ebp - 0xc], 1
jmp 0x4637ad
mov eax, dword [edi]
push 1
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x463796
push edi
call fcn.00462f0c
push ebx
push dword [ebp + 8]
mov ecx, edi
push 0x2a3
call fcn.0041804a
mov dword [ebp - 0x10], 1
xor eax, eax
cmp dword [ebp - 0xc], eax
mov dword [esi + 0x3b8], eax
je 0x4637ef
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 0x20], 1
call dword [eax + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0x4e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x46382e
cmp dword [ebp - 0x10], eax
je 0x46382e
mov ecx, dword [ebp - 8]
cmp ecx, eax
je 0x46382e
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x28]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
add esi, 0x3b4
cmp eax, dword [esi]
jne 0x46382e
and dword [esi], 0
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x463d5e
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov ecx, dword [eax + 8]
inc ebx
cmp ecx, ebx
push edi
jne 0x463e60
mov eax, dword [eax + 0xc]
cmp eax, ebx
jne 0x463d86
mov ecx, esi
call fcn.00465af4
mov eax, ebx
jmp 0x463e69
cmp eax, 2
jne 0x463d98
push 6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x463d7f
cmp eax, 0x65
jne 0x463da6
mov edi, esi
call fcn.004661aa
jmp 0x463d7f
cmp eax, 0x7d1
jne 0x463db6
mov ecx, esi
call fcn.00466278
jmp 0x463d7f
cmp eax, 0x66
jne 0x463dce
xor eax, eax
cmp dword [esi + 0x588], eax
sete al
push eax
call fcn.0046699b
jmp 0x463d7f
cmp eax, 0x191
jne 0x463ddd
push ebx
call fcn.0046647f
jmp 0x463d7f
cmp eax, 0x96
jne 0x463e06
push dword [esi + 0x5b4]
push dword [esi + 0x58c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
push eax
push eax
mov eax, esi
call fcn.00465a5d
jmp 0x463d7f
cmp eax, 0x1f5
jne 0x463e1b
xor ecx, ecx
mov eax, esi
call fcn.00468213
jmp 0x463d7f
cmp eax, 0x3e9
jne 0x463e3d
push ebx
xor eax, eax
push eax
push eax
push str.https:__clean.keniu.com_license_keniucleanerAgreement.html
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x463d7f
cmp eax, 0x3ea
jne 0x463e50
push ebx
xor eax, eax
push eax
push eax
push 0x4fb088
jmp 0x463e2c
cmp eax, 0x68
jne 0x463e60
push esi
call fcn.004666c9
jmp 0x463d7f
and dword [esi + 0x5bc], 0
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x464158
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x4641cf
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
je 0x4641cf
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], esi
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fchs
faddp st(1)
fmul qword [0x4fdb98]
fcomp qword [0x4fdb90]
fnstsw ax
test ah, 1
jne 0x4641cf
inc esi
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x4642b3
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4e0841
call fcn.004daf98
sub esp, 0x5c
mov eax, dword [0x51e6c8]
push esi
push edi
mov ecx, 0x51e6c8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str._stop__uninstall
push dword [ebp + 8]
xor esi, esi
push 0x4fa8e0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00408fb3
push 0x40
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.00497210
xor eax, eax
mov dword [ebp - 0x24], esi
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x68], 0x44
push esi
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], si
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x464356
cmp dword [ebp - 0x14], esi
je 0x464350
cmp ebx, esi
je 0x464350
mov dword [ebx], eax
jmp 0x464356
push eax
call edi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x20], esi
je 0x464363
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040763c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x46437f
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4df9a6
call fcn.004daf98
sub esp, 0x218
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x222]
push ebx
mov dword [ebp - 0x18], ebx
push eax
mov word [ebp - 0x224], bx
call fcn.00497210
mov esi, dword [ebp + 8]
mov edi, 0x51e6c8
add esp, 0xc
mov ecx, edi
call fcn.00407fec
mov dword [ebp - 4], ebx
mov eax, dword [0x51e6c8]
xor esi, esi
inc esi
mov ecx, edi
mov dword [ebp - 0x18], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.00407fa9
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x464401
lea ecx, [ebp - 0x10]
call fcn.00408623
lea eax, [ebp - 0x1c]
push str.ressrcchsuplive.svr
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b374
pop ecx
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00407a9f
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.0040763c
mov esi, dword [ebp - 0x14]
push esi
push 0x208
lea eax, [ebp - 0x224]
push eax
push 0x4f4a74
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
je 0x464467
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
call fcn.004080b5
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040763c
lea eax, [esi - 0x10]
call fcn.0040763c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4645d0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x40000000
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x4645f5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x46461e
push ebx
push edi
push 0x24
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
jne 0x464621
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x464659
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
push ebx
call esi
mov eax, edi
jmp 0x46461c
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], esi
rep stosd dword es:[edi], eax
xor edi, edi
cmp edi, dword [ebp + 0xc]
jge 0x464697
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x46468f
cmp dword [ebp - 0x1c], 1
je 0x464697
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
add edi, 0x64
jmp 0x464668
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x464611
Function at 0x464d2e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e3a3e
call fcn.004daf98
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.00478d78
lea esi, [ebp - 0x14]
call fcn.00478dbf
mov eax, dword [eax]
push 1
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x10]
call fcn.004581a5
mov ebx, eax
mov eax, dword [ebp - 0x14]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.0040763c
test bl, bl
je 0x464d84
cmp dword [ebp - 0x10], edi
jmp 0x464e5b
mov eax, dword [0x51e6c8]
mov ecx, 0x51e6c8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push str.installpath
lea ebx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040858e
test eax, eax
mov esi, dword [ebp - 0x14]
je 0x464e4f
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x464e4f
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x5b4]
lea eax, [ebp - 0x14]
call fcn.00407a9f
xor edi, edi
inc edi
mov eax, ebx
mov dword [ebx + 0x9bc], edi
call fcn.00466d4d
test eax, eax
je 0x464e06
lea eax, [esi - 0x10]
call fcn.0040763c
cmp dword [ebp - 0x10], 0
je 0x464e02
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x464e69
push 3
mov ecx, ebx
call fcn.00467526
cmp eax, edi
je 0x464deb
xor edi, edi
push edi
push edi
mov eax, ebx
call fcn.00466d4d
push eax
push dword [ebx + 0x9bc]
push 3
push ecx
call fcn.0045f77e
pop ecx
mov ecx, eax
call fcn.0045f87b
lea eax, [esi - 0x10]
call fcn.0040763c
cmp dword [ebp - 0x10], edi
je 0x464e4b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x464e69
lea eax, [esi - 0x10]
call fcn.0040763c
cmp dword [ebp - 0x10], 0
je 0x464e66
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x46573c
Capabilities:
Inspect load icon resource

Disassembly:
mov eax, 0x4e39b5
call fcn.004daf98
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebx + 0x568]
call fcn.00468664
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
and dword [ebx + 0x5bc], 0
push 0xc8
push 0x400000
call esi
push eax
push 1
push 0x80
lea edi, [ebx + 4]
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xc8
push 0x400000
call esi
push eax
push 0
push 0x80
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebx + 0x9b4]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [edi]
push edi
call fcn.00435826
lea esi, [ebx + 0x24]
lea eax, [esi - 0x24]
neg esi
sbb esi, esi
and esi, eax
push 0xa1
call fcn.004108b3
test eax, eax
mov dword [ebp - 0x14], eax
je 0x4657ea
mov edx, dword [eax]
push 0
push 4
mov ecx, eax
call dword [edx + 0x28]
push 1
push dword [ebp - 0x14]
push esi
call fcn.00468ff8
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.004649b6
push dword [eax]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040763c
mov esi, ebx
call fcn.004668a6
call fcn.004659e8
xor esi, esi
cmp dword [ebx + 0x9bc], esi
je 0x46583b
push esi
push 0x66
lea eax, [ebx + 0x24]
call fcn.00468322
push esi
push 0x258
lea eax, [ebx + 0x24]
call fcn.00468322
mov eax, ebx
call fcn.00466d4d
test eax, eax
je 0x465858
push esi
push esi
push 0x64
push dword [edi]
mov dword [ebx + 0x428], esi
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [ebp - 0x28]
push eax
push dword [edi]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
push 0x1388
push 0x3eb
push dword [edi]
call dword [sym.imp.USER32.dll_SetTimer]
push esi
mov eax, 0x466c45
push eax
push ebx
lea esi, [ebp - 0x18]
call fcn.0046b0d2
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [ebx + 0x106c]
mov edx, dword [ecx]
push 0
push ebx
push eax
call dword [edx]
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x4658b8
call fcn.0045bffb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4658c9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
inc ebx
push ebx
add esi, 0x24
push ebx
mov eax, esi
call fcn.004682d7
xor edi, edi
push edi
push 0x64
mov eax, esi
call fcn.00468322
push edi
push 0xc8
mov eax, esi
call fcn.00468322
push edi
push 0x12c
mov eax, esi
call fcn.00468322
push ebx
push 0x190
mov eax, esi
call fcn.00468322
push edi
push str.SOFTWAREkeniucleaner
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.004581a5
test eax, eax
je 0x46594f
cmp dword [ebp - 4], edi
mov dword [ebp - 8], ebx
je 0x46595d
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push str.is_boot_start
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 4], edi
je 0x46595d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
add eax, 0x9c4
call fcn.00476f16
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4661aa
Capabilities:
Create thread

Disassembly:
mov eax, 0x4e06d6
call fcn.004daf98
push ecx
push ebx
push esi
push 0
lea ebx, [edi + 0x24]
push 0x64
mov eax, ebx
call fcn.00468322
push 1
push 0xc8
mov eax, ebx
call fcn.00468322
push 0
mov esi, edi
call fcn.0046699b
push 0
push 1
mov eax, ebx
call fcn.004682d7
mov esi, ebx
add ebx, 0xffffffdc
neg esi
sbb esi, esi
and esi, ebx
push 0xa1
call fcn.004108b3
xor ebx, ebx
cmp eax, ebx
je 0x466211
mov eax, dword [eax + 0x38]
and eax, 4
sub al, 4
neg al
sbb eax, eax
inc eax
jmp 0x466213
xor eax, eax
xor ecx, ecx
mov dword [edi + 0xa8c], eax
push ecx
mov eax, 0x467b87
push eax
push edi
lea esi, [ebp - 0x10]
call fcn.0046b15e
add esp, 0xc
push ebx
lea ecx, [edi + 0x504]
push ebx
mov dword [ebp - 4], ebx
mov edx, dword [ecx]
push eax
call dword [edx + 4]
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
cmp esi, ebx
je 0x466252
call fcn.0041447e
mov dword [ebp - 0x10], ebx
push ebx
push ebx
push edi
push 0x466190
push ebx
push ebx
call fcn.0049bc8f
mov ecx, dword [ebp - 0xc]
add esp, 0x18
pop esi
mov dword [edi + 0x9b0], eax
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x466601
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [edi]
lea esi, [ebp - 4]
call fcn.0045e25a
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.0040763c
mov eax, dword [edi]
push 3
pop esi
cmp dword [eax - 0xc], esi
jl 0x4666c2
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466644
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 1
je 0x4666c2
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00408ffe
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, esi
mov eax, dword [ebp - 4]
setne bl
add eax, 0xfffffff0
call fcn.0040763c
test bl, bl
je 0x466671
push 2
pop eax
jmp 0x4666c5
push edi
call fcn.00466575
test eax, eax
pop ecx
je 0x466680
mov eax, esi
jmp 0x4666c5
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00408ffe
push dword [eax]
call fcn.00464158
mov ebx, eax
mov eax, dword [ebp - 4]
neg ebx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.0040763c
test bl, bl
je 0x4666af
push 4
jmp 0x46666e
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x4666be
push 5
jmp 0x46666e
xor eax, eax
jmp 0x4666c5
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x4666c9
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x4e14ec
call fcn.004daf98
sub esp, 0x444
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x44e]
push ebx
push eax
mov word [ebp - 0x450], bx
call fcn.00497210
add esp, 0xc
lea eax, [ebp - 0x450]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [edi + 4]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [0x51e6c8]
mov ecx, 0x51e6c8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x105
lea esi, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.004078e4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
jge 0x466756
push 0x80070057
call fcn.00407a47
mov esi, 0x4fb484
mov dword [eax - 0xc], ebx
push esi
mov word [eax], bx
call fcn.0049795c
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x10]
call fcn.00407ae0
mov eax, dword [edi + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x10]
mov dword [ebp - 0x38], eax
call fcn.0040fd1e
mov dword [ebp - 0x34], eax
xor esi, esi
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], 0x4fb490
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov ebx, eax
cmp ebx, esi
je 0x46687d
push 0x206
lea eax, [ebp - 0x246]
push esi
push eax
mov word [ebp - 0x248], si
call fcn.00497210
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [0x51e6c8]
mov ecx, 0x51e6c8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x248]
push eax
lea esi, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0045e25a
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.00408dba
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.0040763c
mov eax, dword [edi + 0x9c0]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.00408dba
mov esi, dword [ebp - 0x14]
push esi
push dword [edi + 0x58c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
add edi, 0x1070
lea eax, [ebp - 0x14]
call fcn.00407a9f
lea edi, [ebp - 0x14]
call fcn.00466601
push 0
push eax
mov eax, dword [ebp + 8]
push 0x46c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esi - 0x10]
call fcn.0040763c
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040763c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x466a22
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, eax
and dword [esi + 0x5bc], 0
cmp dword [esp + 8], 0x61
je 0x466a3a
cmp dword [esp + 8], 0x41
jne 0x466a6e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x466a6e
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
add esi, 0x58c
push dword [esi]
call edi
push 0
push 0
push 0xb7
push dword [esi]
call edi
pop edi
pop esi
ret 4

Function at 0x466a72
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4dfa4a
call fcn.004daf98
cmp dword [ebp + 8], 0x6a
push esi
push edi
jne 0x466b2c
mov eax, dword [0x51e6c8]
mov ecx, 0x51e6c8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
push 0x105
lea esi, [ebp + 8]
call fcn.004078e4
push 0x104
push eax
push dword [ebx + 0x58c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp + 8], 0
jne 0x466ac8
xor eax, eax
jmp 0x466ad1
push dword [ebp + 8]
call fcn.0049795c
pop ecx
lea edx, [ebp + 8]
call fcn.004078c3
push 0x258
lea eax, [ebx + 0x24]
call fcn.00468364
test eax, eax
jne 0x466b08
lea esi, [ebx + 0x1070]
push dword [esi]
push dword [ebx + 0x58c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, esi
lea edi, [ebp + 8]
call fcn.00407a9f
lea edi, [ebp + 8]
call fcn.00466601
push 0
push eax
push 0x46c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040763c
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 4

Function at 0x466c6c
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x4e14ca
call fcn.004daf98
sub esp, 0x20
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004070a3
and dword [ebp - 4], 0
mov eax, dword [0x51e6c8]
mov ecx, 0x51e6c8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x4fb520
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004075ba
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004080b5
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x466cd2
push eax
call fcn.00498372
pop ecx
mov dword [edi + 0xa7c], eax
push str.independent
lea eax, [ebp - 0x2c]
call fcn.004075ba
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004080b5
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x466cff
push eax
call fcn.00498372
pop ecx
mov dword [edi + 0xa80], eax
push 0x4fb540
lea eax, [ebp - 0x2c]
call fcn.004075ba
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004080b5
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
je 0x466d2c
push esi
call fcn.00498372
pop ecx
mov dword [edi + 0xa78], eax
lea eax, [esi - 0x10]
call fcn.0040763c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00407117
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret