joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4581d0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x8000
call fcn.004c1c60
push esi
mov esi, dword [0x4db120]
lea eax, [esp + 4]
push edi
push 0x7fff
push eax
push dword [esp + 0x8014]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
push 1
cmp edi, 0x7fff
jb 0x458295
push 1
lea ecx, [edi - 1]
push ecx
push 0
mov ecx, esi
call fcn.004b04f0
test eax, eax
jne 0x458227
pop edi
pop esi
add esp, 0x8000
ret 4
push edi
push 0
push 1
mov ecx, esi
call fcn.00401640
push eax
push dword [esp + 0x8014]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x458252
push eax
push 1
mov ecx, esi
call fcn.00401640
mov byte [eax], 0
cmp byte [esi + 0x17], 0
jne 0x45825b
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x458281
cmp dword [0x4dba88], 0
je 0x458281
push 1
mov ecx, 0x4dba7c
call fcn.00406200
pop edi
pop esi
add esp, 0x8000
ret 4
and byte [esi + 0x15], 0x86
mov eax, 1
pop edi
pop esi
add esp, 0x8000
ret 4
push 0
test edi, edi
lea eax, [esp + 0x10]
mov ecx, 0x4c3c29
cmove eax, ecx
mov ecx, esi
push edi
push eax
call fcn.004b04f0
pop edi
pop esi
add esp, 0x8000
ret 4
Function at 0x45b560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x121c
call fcn.004c1c60
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov byte [esp + 0x13], dl
push eax
push dword [0x4dc0c0]
mov dword [esp + 0x1c], eax
lea ebx, [esp + 0x230]
push 0x4cde08
mov eax, ebx
mov ebp, 0x4c3c29
push 0x800
push eax
call fcn.004abdd0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
add esp, 0x14
lea ecx, [esi + 1]
cmp ecx, 0x800
jg 0x45b5cd
lea eax, [esp + 0x229]
push eax
call edi
cmp eax, 0xffffffff
je 0x45b5cd
mov edi, dword [0x4dc0c0]
jmp 0x45b67b
xor esi, esi
lea eax, [esp + 0x18]
push esi
push ecx
push eax
push ecx
call fcn.004ad130
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x45b604
test esi, esi
jne 0x45b604
mov esi, 0x100
lea eax, [esp + 0x18]
push esi
push ecx
push eax
push ecx
call fcn.004ad130
mov edx, eax
add esp, 0x10
test edx, edx
je 0x45b5e5
xor ecx, ecx
nop word [eax + eax]
mov al, byte [esp + ecx + 0x18]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x11f], al
test al, al
jne 0x45b610
test edx, edx
je 0x45b71e
push dword [esp + 0x14]
lea eax, [esp + 0x124]
push eax
push 0x4cde08
lea eax, [esp + 0x234]
push 0x800
push eax
call fcn.004abdd0
mov esi, eax
add esp, 0x14
lea ecx, [esi + 1]
cmp ecx, 0x800
jg 0x45b71e
lea eax, [esp + 0x229]
push eax
call edi
cmp eax, 0xffffffff
je 0x45b71e
lea edi, [esp + 0x120]
cmp byte [esp + 0x13], 0
mov word [esp + esi + 0x228], 0x22
je 0x45b6f4
push 0x4cde10
push edi
push 0x4cde08
lea eax, [esp + 0xa34]
push 0x800
push eax
call fcn.004abdd0
mov esi, eax
add esp, 0x14
lea ecx, [esi + 1]
cmp ecx, 0x800
jg 0x45b6df
lea eax, [esp + 0xa29]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x45b6df
mov word [esp + esi + 0xa28], 0x22
lea ebx, [esp + 0xa28]
jmp 0x45b6ed
cmp edi, dword [0x4dc0c0]
jne 0x45b6f4
mov ebx, dword [0x4dc0bc]
lea ebp, [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push ebx
mov ecx, 0x4dba98
call fcn.0044e810
test eax, eax
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x121c
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x121c
ret
Function at 0x45f720
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
push ebx
push edi
mov edi, dword [0x4db120]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
mov ecx, dword [ebp + 8]
xor edx, edx
push 0
call fcn.0041d950
mov bh, al
add esp, 0xc
test bh, bh
jne 0x45f7ba
mov ecx, dword [ebp + 8]
lea edx, [esp + 0xc]
push 0
call fcn.004775e0
add esp, 4
test eax, eax
jne 0x45f781
push 1
push eax
push 0xffffffffffffffff
push 0x4c3c29
mov ecx, edi
call fcn.004b04f0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push 0
push ecx
mov ecx, eax
mov dword [esp + 0x20], 0
call fcn.00477900
add esp, 8
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004afd20
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov bl, byte [eax]
movzx eax, bl
test eax, 0xffffff80
jne 0x45f7dc
push 2
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
add esp, 8
test eax, eax
je 0x45f7dc
and bl, 0xdf
mov al, bl
cmp al, 0x50
je 0x45f7f0
xor ecx, ecx
mov edx, 2
cmp al, 0x54
cmovne edx, ecx
jmp 0x45f7f5
mov edx, 1
mov cl, bh
call fcn.00477860
push 1
test al, al
mov edx, 0x4ce010
push 0
mov ecx, 0x4c9e04
cmove ecx, edx
push 0xffffffffffffffff
push ecx
mov ecx, edi
call fcn.004b04f0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45f830
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
push ebx
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x4db120]
push 0
call fcn.004b04f0
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f977
cmp byte [eax], 0
je 0x45f977
push 0x103
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea ecx, [esp + 0x34]
mov byte [esp + 0x137], 0
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45f890
sub ecx, edx
cmp byte [esp + ecx + 0x27], 0x5c
je 0x45f8b5
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x45f977
mov word [esp + ecx + 0x28], 0x5c
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x45f977
cmp byte [ebp + 0xc], 0
je 0x45f8e7
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
jmp 0x45f8ef
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
shrd ebx, edi, 0x14
push 0x4c3cb0
shr edi, 0x14
call fcn.004b04f0
mov esi, dword [0x4db120]
cmp byte [esi + 0x17], 0
jne 0x45f91b
mov esi, dword [esi + 0xc]
mov al, byte [esi + 0x15]
test al, 2
je 0x45f932
and al, 0x3d
mov byte [esi + 0x15], al
mov eax, dword [esi]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov al, byte [esi + 0x15]
and al, 0x9b
mov dword [esi], ebx
or al, 0x18
mov dword [esi + 4], edi
mov byte [esi + 0x15], al
jge 0x45f959
mov ecx, esi
call fcn.004014a0
and byte [esi + 0x15], 0x8f
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x4d9984], 0
je 0x45f969
mov ecx, esi
call fcn.004014a0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4d70f4]
test byte [eax + 0xe0], 1
jne 0x45f9a4
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c40b0
call fcn.004b04f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x4c3c29
push 0
push 0x4c40b0
mov ecx, esi
call fcn.0044d1f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461920
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x110
push esi
mov esi, ecx
mov al, byte [esi]
test al, al
je 0x46194f
cmp byte [esi + 1], 0x3a
jne 0x46194f
cmp byte [esi + 2], 0
jne 0x46194f
mov byte [esp + 8], al
lea esi, [esp + 8]
mov word [esp + 9], 0x5c3a
mov byte [esp + 0xb], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4619b1
cmp byte [0x4dc0c8], al
je 0x4619f6
mov eax, dword [0x4d70f4]
test byte [eax + 0xe0], 1
jne 0x461992
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c40b0
call fcn.004b04f0
pop esi
add esp, 0x110
ret
mov ecx, dword [0x4dbe24]
push 0x4c3c29
push 0
push 0x4c40b0
call fcn.0044d1f0
pop esi
add esp, 0x110
ret
cmp byte [0x4dc0c8], 0
je 0x4619f6
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
lea ecx, [esp + 0xc]
push 0xffffffffffffffff
cmove ecx, esi
push ecx
mov ecx, 0x4d8adc
call fcn.00405d20
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c3cb0
call fcn.004b04f0
pop esi
add esp, 0x110
ret
Function at 0x4620a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x462164
cmp byte [ebx], 0
je 0x462164
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4620e8
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
shr eax, 4
and al, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5c
push ebx
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsrchr]
mov esi, eax
add esp, 8
mov dword [ebp - 4], esi
cmp esi, ebx
jbe 0x46214c
cmp byte [esi - 1], 0x3a
je 0x46214c
test edi, edi
je 0x462118
mov edx, ebx
mov byte [esi], 0
mov ecx, ebx
call fcn.004620a0
mov byte [esi], 0x5c
jmp 0x462142
mov edi, esi
sub edi, ebx
lea eax, [edi + 1]
call fcn.004c1c90
mov esi, esp
push edi
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov byte [edi + esi], 0
mov edx, esi
mov ecx, esi
call fcn.004620a0
mov esi, dword [ebp - 4]
cmp byte [esi + 1], 0
je 0x46216e
test al, al
je 0x46216e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462f90
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
push edi
test esi, esi
je 0x462fdf
push 0
push 1
mov ecx, esi
call fcn.00401640
cmp byte [esi + 0x17], 0
mov ebx, eax
jne 0x462fba
mov edi, dword [esi + 0xc]
jmp 0x462fbc
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x462fd6
test byte [edi + 0x15], 8
je 0x462fcf
mov ecx, edi
call fcn.004014a0
add edi, 0xc
mov edi, dword [edi]
jmp 0x463015
mov edi, 0x4dd524
mov edi, dword [edi]
jmp 0x463015
lea eax, [esp + 0xc]
xor ecx, ecx
push eax
lea edx, [esp + 0x20]
call fcn.004aff30
add esp, 4
test eax, eax
jne 0x46300d
mov eax, dword [0x4d70f4]
pop edi
pop esi
pop ebx
mov dword [eax + 0x30], 0
xor eax, eax
add esp, 8
ret 8
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0xc]
push ebp
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x46307a
xor ecx, ecx
mov dword [esp + 0x20], ecx
test ebx, ebx
je 0x463053
push ecx
lea eax, [esp + 0x24]
push eax
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x20]
xor eax, eax
cmp ecx, edi
sete al
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d70f4]
push ebp
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
jmp 0x46308b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d70f4]
xor edi, edi
mov dword [ecx + 0x30], eax
pop ebp
test esi, esi
jne 0x46309a
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
test edi, edi
je 0x4630bd
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c3cb0
call fcn.004b04f0
pop edi
pop esi
pop ebx
add esp, 8
ret 8
mov eax, dword [0x4d70f4]
test byte [eax + 0xe0], 1
jne 0x4630ea
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c40b0
call fcn.004b04f0
pop edi
pop esi
pop ebx
add esp, 8
ret 8
mov ecx, dword [esp + 0x10]
push 0x4c3c29
push 0
push 0x4c40b0
call fcn.0044d1f0
pop edi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x4634a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x80
push esi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x4db120]
push 0
call fcn.004b04f0
mov eax, dword [esp + 0x88]
test eax, eax
je 0x4635f7
cmp byte [eax], 0
je 0x4635f7
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x463539
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d70f4]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jne 0x46351b
mov ecx, dword [0x4d995c]
push 1
push 0
push ebx
push 0x4c40b0
call fcn.004b04f0
pop ebx
pop esi
add esp, 0x80
ret 4
push 0x4c3c29
push 0
push 0x4c40b0
mov ecx, esi
call fcn.0044d1f0
pop ebx
pop esi
add esp, 0x80
ret 4
mov eax, dword [0x4d70f4]
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c3cb0
mov dword [eax + 0x30], 0
call fcn.004b04f0
movzx eax, byte [esp + 8]
mov ecx, ebx
and ecx, 1
mov edx, 0x52
cmovne eax, edx
mov byte [esp + 8], al
test bl, 0x20
je 0x46357c
mov byte [esp + ecx + 8], 0x41
inc ecx
test bl, 4
je 0x463587
mov byte [esp + ecx + 8], 0x53
inc ecx
test bl, 2
je 0x463592
mov byte [esp + ecx + 8], 0x48
inc ecx
test bl, bl
jns 0x46359c
mov byte [esp + ecx + 8], 0x4e
inc ecx
test bl, 0x10
je 0x4635a7
mov byte [esp + ecx + 8], 0x44
inc ecx
test ebx, 0x1000
je 0x4635b5
mov byte [esp + ecx + 8], 0x4f
inc ecx
test ebx, 0x800
je 0x4635c3
mov byte [esp + ecx + 8], 0x43
inc ecx
test ebx, 0x100
je 0x4635d1
mov byte [esp + ecx + 8], 0x54
inc ecx
push 1
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x14]
mov byte [esp + ecx + 0x14], 0
mov ecx, dword [0x4db120]
push eax
call fcn.004b04f0
pop ebx
pop esi
add esp, 0x80
ret 4
mov eax, dword [0x4d70f4]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x46362c
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c40b0
call fcn.004b04f0
pop esi
add esp, 0x80
ret 4
push 0x4c3c29
push 0
push 0x4c40b0
mov ecx, esi
call fcn.0044d1f0
pop esi
add esp, 0x80
ret 4
Function at 0x463650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov bl, byte [esi]
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], edi
test bl, bl
je 0x463743
movzx eax, bl
test eax, 0xffffff80
je 0x463693
xor eax, eax
jmp 0x4636a3
push 2
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov edi, dword [esp + 0x24]
add esp, 8
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
movsx eax, dl
add eax, 0xffffffd5
cmp eax, 0x33
ja case.0x4636c5.44
movzx eax, byte [eax + 0x46378c]
jmp dword [eax*4 + 0x463768]
movsx eax, byte [esi]
mov dword [esp + 0x10], eax
jmp case.0x4636c5.44
mov ecx, 1
jmp 0x463704
mov ecx, 0x20
jmp 0x463704
mov ecx, 4
jmp 0x463704
mov ecx, 2
jmp 0x463704
mov ecx, 0x80
jmp 0x463704
mov ecx, 0x1000
jmp 0x463704
mov ecx, 0x100
mov eax, dword [esp + 0x10]
sub eax, 0x2b
je 0x463725
sub eax, 2
je 0x46371b
sub eax, 0x31
jne case.0x4636c5.44
xor edi, ecx
jmp 0x46372f
not ecx
and dword [esp + 0x18], ecx
and edi, ecx
jmp 0x46372f
mov eax, ecx
not eax
and dword [esp + 0x18], eax
or edi, ecx
mov dword [esp + 0x1c], edi
mov bl, byte [esi + 1]
inc esi
test bl, bl
jne 0x463685
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x4637c0
push dword [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00463800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x464010
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
push ebx
push esi
push edi
push 1
push 0
mov esi, ecx
mov ecx, dword [0x4db120]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x2c], esi
call fcn.004b04f0
mov edi, dword [ebp + 8]
test edi, edi
je 0x4641cc
cmp byte [edi], 0
je 0x4641cc
push 0
push 0
push 3
push 0
push 7
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464090
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x46408c
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
jmp 0x4640d5
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x4640bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d70f4]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jmp 0x4641df
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x3c]
xor edi, edi
or edi, dword [esp + 0x40]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
mov eax, dword [ebp + 0xc]
mov bl, byte [eax]
movzx eax, bl
test eax, 0xffffff80
je 0x4640e8
xor eax, eax
jmp 0x4640fc
push 2
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov esi, dword [esp + 0x1c]
add esp, 8
mov edi, dword [esp + 0x10]
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
movsx eax, dl
sub eax, 0x4b
je 0x464121
sub eax, 2
jne 0x464137
push eax
push 0x100000
jmp 0x464128
push 0
push 0x400
push esi
push edi
call fcn.004c1b70
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [0x4d70f4]
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c3cb0
mov dword [eax + 0x30], 0
call fcn.004b04f0
mov esi, dword [0x4db120]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp byte [esi + 0x17], 0
jne 0x464170
mov esi, dword [esi + 0xc]
mov al, byte [esi + 0x15]
test al, 2
je 0x464187
and al, 0x3d
mov byte [esi + 0x15], al
mov eax, dword [esi]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov al, byte [esi + 0x15]
and al, 0x9b
mov dword [esi], edi
or al, 0x18
mov dword [esi + 4], ebx
mov byte [esi + 0x15], al
jge 0x4641ae
mov ecx, esi
call fcn.004014a0
and byte [esi + 0x15], 0x8f
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x4d9984], 0
je 0x4641be
mov ecx, esi
call fcn.004014a0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4d70f4]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x464200
mov ecx, dword [0x4d995c]
push 1
push 0
push 0xffffffffffffffff
push 0x4c40b0
call fcn.004b04f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x4c3c29
push 0
push 0x4c40b0
mov ecx, esi
call fcn.0044d1f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x465d40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push ebx
push esi
mov esi, dword [esp + 0x118]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov bl, byte [esi + 2]
movzx eax, bl
test eax, 0xffffff80
je 0x465d67
xor eax, eax
jmp 0x465d6f
push 2
push eax
call edi
add esp, 8
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
movsx eax, dl
add eax, 0xffffffbf
cmp eax, 0x12
ja case.0x465d95.66
movzx eax, byte [eax + 0x465ed8]
jmp dword [eax*4 + 0x465ec4]
mov bl, byte [esi + 9]
movzx eax, bl
test eax, 0xffffff80
je 0x465dad
xor eax, eax
jmp 0x465db5
push 2
push eax
call edi
add esp, 8
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
cmp dl, 0x53
jne 0x465de0
cmp byte [esi + 0xa], 0
mov eax, 2
mov ecx, 0x17
cmovne eax, ecx
jmp 0x465e65
mov eax, 0x26
jmp 0x465e65
cmp byte [esi + 9], 0
mov eax, 0x1a
mov ecx, 0x23
cmovne eax, ecx
jmp 0x465e65
cmp byte [esi + 9], 0
mov eax, 0x10
mov ecx, 0x19
cmovne eax, ecx
jmp 0x465e65
mov bl, byte [esi + 7]
movzx eax, bl
test eax, 0xffffff80
je 0x465e1e
xor eax, eax
jmp 0x465e26
push 2
push eax
call edi
add esp, 8
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
cmp dl, 0x4d
jne 0x465e4e
cmp byte [esi + 0xb], 0
mov eax, 0xb
mov ecx, 0x16
cmovne eax, ecx
jmp 0x465e65
cmp byte [esi + 9], 0
mov eax, 7
mov ecx, 0x18
cmovne eax, ecx
jmp 0x465e65
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
movzx ecx, byte [esp + 0x10]
xor edx, edx
test eax, eax
pop edi
cmovne ecx, edx
mov edx, dword [esp + 0x114]
mov byte [esp + 0xc], cl
pop esi
pop ebx
test edx, edx
je 0x465ead
lea ecx, [esp + 4]
mov eax, ecx
sub edx, eax
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x465ea0
lea eax, [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x465eb4
sub eax, edx
add esp, 0x108
ret

Function at 0x465ef0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
movzx ecx, byte [esp]
xor edx, edx
test eax, eax
lea eax, [esp]
cmovne ecx, edx
lea edx, [eax + 1]
mov byte [esp], cl
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x465f20
sub eax, edx
je 0x465f38
cmp byte [esp + eax - 1], 0x5c
jne 0x465f38
mov byte [esp + eax - 1], 0
dec eax
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x465f5d
lea edx, [esp + 4]
mov ecx, edx
sub esi, ecx
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], cl
test cl, cl
jne 0x465f50
pop esi
add esp, 0x104
ret
Function at 0x477860
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, cl
test bl, bl
jne 0x47786b
xor al, al
pop ebx
ret
sub edx, 1
je 0x477890
movzx eax, bl
push eax
sub edx, 1
je 0x477886
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
pop ebx
ret
mov al, bl
dec al
cmp al, 5
ja 0x47789d
cmp bl, 3
jne 0x4778a5
mov al, bl
add al, 0x66
cmp al, 5
ja 0x4778bc
cmp dword [0x4d9994], 0
movzx eax, bl
je 0x4778ed
mov al, byte [eax + 0x4da2e8]
shr al, 7
pop ebx
ret
cmp dword [0x4d9998], 0
je 0x4778ea
push 0
xor edx, edx
call fcn.0041d310
add esp, 4
test al, al
je 0x4778dc
mov cl, 1
call fcn.0041d100
movzx eax, bl
pop ebx
mov al, byte [eax + 0x4da2e8]
shr al, 7
ret
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret

Function at 0x477f70
Capabilities:
Get disk information

Disassembly:
sub esp, 0x108
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
push 0
push 0x410
mov byte [edi], 0
call ebx
mov ebp, eax
test ebp, ebp
jne 0x477fb1
push esi
push eax
push 0x1000
call ebx
mov ebp, eax
test ebp, ebp
jne 0x477fb1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
cmp byte [esp + 0x120], 0
push 0x104
push edi
push 0
push ebp
je 0x477fcc
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
jmp 0x477fd2
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
mov ebx, eax
test ebx, ebx
jne 0x4780e3
mov eax, dword [0x4ce7a8]
test eax, eax
je 0x4780e3
push 0x104
push edi
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x4780e3
cmp byte [esp + 0x120], 0
je 0x47804c
push 0x5c
push edi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsrchr]
mov edx, eax
add esp, 8
test edx, edx
je 0x4780e3
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x478021
sub ecx, esi
lea eax, [edx + 1]
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
mov word [esp + 0x11], 0x3a
mov byte [esp + 0x10], 0x41
nop dword [eax + eax]
push 0x104
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov esi, eax
cmp esi, 2
jbe 0x47809c
sub esi, 2
lea eax, [esp + 0x14]
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcmp]
add esp, 0xc
test eax, eax
jne 0x47809c
cmp byte [esi + edi], 0x5c
lea ecx, [esi + edi]
je 0x4780be
mov al, byte [esp + 0x10]
inc al
mov byte [esp + 0x10], al
cmp al, 0x5a
jle 0x478060
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
movzx eax, byte [esp + 0x10]
sub ebx, esi
mov byte [edi], al
movzx eax, byte [esp + 0x11]
mov byte [edi + 1], al
lea eax, [ebx + 1]
push eax
push ecx
lea eax, [edi + 2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
add ebx, 2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret