joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415058
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
cmp dword [0x466a98], 0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
je 0x415083
lea eax, [ebp - 0x400]
push eax
push 0x465fe5
call fcn.0041eca0
jmp 0x415094
lea edx, [ebp - 0x400]
push edx
push 0x400
call sub.KERNEL32.dll_GetCurrentDirectoryA
xor eax, eax
lea edi, [ebp - 0x400]
or ecx, 0xffffffff
mov esi, 0x46f598
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
mov eax, dword [0x4656d8]
push 0x415150
push eax
mov edx, dword [0x466a00]
push 0x45fc0d
push edx
call sub.USER32.dll_DialogBoxParamA
test eax, eax
je 0x4150e9
push 0x46f598
push ebx
call fcn.00414dc4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4169f4
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4169fd
mov eax, dword [esp + 0x4000]
add esp, 0xfffffffc
mov esi, 0x46fa8c
lea edi, [esp + 8]
xor eax, eax
mov dword [esi], eax
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
jmp 0x416a71
xor eax, eax
mov edx, edi
mov dword [edx], eax
inc eax
add edx, 4
cmp eax, 0x1000
jl 0x416a2b
xor edx, edx
lea eax, [edi + 4]
mov ecx, dword [eax]
xor dword [eax - 4], ecx
inc edx
add eax, 4
cmp edx, 0xfff
jl 0x416a3d
xor edx, edx
mov eax, edi
mov ecx, dword [eax + 4]
add ecx, dword [eax + 8]
cmp ecx, dword [eax]
jne 0x416a63
call sub.KERNEL32.dll_GetTickCount
jmp 0x416a6f
inc edx
add eax, 4
cmp edx, 0xffe
jl 0x416a52
inc dword [esi]
call sub.KERNEL32.dll_GetTickCount
sub eax, ebx
cmp eax, 0xc8
jb 0x416a27
add esp, 0xfffffff8
push 1
lea eax, [esp + 4]
push eax
call fcn.004262cc
add esp, 0xfffffff8
push 0x2d
add esp, 0xfffffff8
mov edx, dword [esi]
push edx
lea ecx, [esp + 4]
push ecx
call fcn.004262cc
lea eax, [esp + 0xc]
push eax
call fcn.00416d6c
lea edx, [esp + 0x10]
push edx
call fcn.00426694
mov ecx, esp
push ecx
call fcn.0041844c
mov dword [esi], eax
add esp, 0x4008
pop edi
pop esi
pop ebx
ret
Function at 0x4173cc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff298
mov dword [0x466aac], 1
lea eax, [ebp - 0x408]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push 0x400
call sub.KERNEL32.dll_GetTempPathA
lea edx, [ebp - 0x408]
push edx
call fcn.004080c8
lea ecx, [ebp - 0x408]
lea eax, [ebp - 0x808]
push ecx
push 0x45fc90
push eax
call fcn.00456f9c
add esp, 0xc
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
lea ecx, [ebp - 0x948]
push ecx
lea eax, [ebp - 0x808]
push eax
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp eax, 0xffffffff
sete al
and eax, 1
jmp 0x417539
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x940]
push esi
cmp edx, 0xa
push edi
seta bl
and ebx, 1
xor eax, eax
lea edi, [ebp - 0x408]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0xd48]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x91c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0xd48]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push eax
push edx
call fcn.00452e5c
add esp, 8
test byte [ebp - 0x948], 0x10
je 0x417514
lea ecx, [ebp - 0xd48]
push ecx
call sub.KERNEL32.dll_RemoveDirectoryA
test eax, eax
jne 0x417524
test ebx, ebx
je 0x417524
test edi, edi
jne 0x417524
lea eax, [ebp - 0xd48]
push eax
call fcn.00452eec
pop ecx
lea edx, [ebp - 0xd68]
mov byte [ebp + eax - 0xd47], 0
push 0x1e
push 0
push edx
call fcn.00452e2c
mov dword [ebp - 0xd64], 3
mov word [ebp - 0xd58], 0x14
add esp, 0xc
lea ecx, [ebp - 0xd48]
mov dword [ebp - 0xd60], ecx
lea eax, [ebp - 0xd68]
push eax
call sub.SHELL32.DLL_SHFileOperationA
jmp 0x417524
test ebx, ebx
je 0x417524
lea edx, [ebp - 0xd48]
push edx
call sub.KERNEL32.dll_DeleteFileA
lea ecx, [ebp - 0x948]
push ecx
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
sete al
and eax, 1
test eax, eax
jne 0x41754a
cmp dword [0x466aac], 1
je 0x417449
push esi
call sub.KERNEL32.dll_FindClose
test edi, edi
jne 0x417576
cmp byte [0x460c80], 0
je 0x417576
push 0
call sub.KERNEL32.dll_GetCurrentThread
push eax
call sub.KERNEL32.dll_SetThreadPriority
push 1
call fcn.00437800
mov byte [0x460c80], al
xor edx, edx
mov dword [0x466aac], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417ecc
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
add esp, 0xfffffb38
cmp byte [0x460c80], 0
jne 0x417f9e
push 0x400
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push esp
call fcn.0040809c
mov edi, eax
mov esi, 0x45fd9a
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push esp
push 0x64
lea edx, [esp + 0x408]
push edx
push 0x45fdb7
push 0x45fdaf
push 0x45fda2
call sub.KERNEL32.dll_GetPrivateProfileStringA
push esp
push 0x64
lea ecx, [esp + 0x46c]
push ecx
push 0x45fdcd
push 0x45fdc5
push 0x45fdb8
call sub.KERNEL32.dll_GetPrivateProfileStringA
push esp
push 0
push 0x45fddb
push 0x45fdce
call sub.KERNEL32.dll_GetPrivateProfileIntA
cmp byte [esp + 0x400], 0
je 0x417f9e
cmp byte [esp + 0x464], 0
je 0x417f9e
test eax, eax
jne 0x417f9e
push esp
push 0x45fdfa
push 0x45fdf1
push 0x45fde4
call sub.KERNEL32.dll_WritePrivateProfileStringA
push 0
mov eax, dword [0x4656d8]
push 0x40b80c
push eax
mov edx, dword [0x466a00]
push 0x45fdfc
push edx
call sub.USER32.dll_DialogBoxParamA
add esp, 0x4c8
pop edi
pop esi
ret

Function at 0x418ce0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
je 0x418cf4
test ebx, ebx
jne 0x418cf8
xor eax, eax
jmp 0x418d4d
push ebx
push 0x104
call sub.KERNEL32.dll_GetTempPathA
push esi
push ebx
call sub.KERNEL32.dll_lstrcatA
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x418d2d
xor eax, eax
jmp 0x418d4d
push 0
lea edx, [ebp - 4]
push edx
push ebx
call fcn.00452eec
pop ecx
push eax
push ebx
push esi
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, 1
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x41d128
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x41d131
mov eax, dword [ebp - 4]
add esp, 0xfffff7f4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x1810], 0xffffffff
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
jne 0x41d17b
push 0x3ac
call fcn.00408028
push eax
mov edx, dword [ebp + 0x18]
push edx
call fcn.00408c78
add esp, 8
jmp 0x41d309
xor esi, esi
cmp esi, dword [ebp + 0x10]
jge 0x41d1d9
lea eax, [esi + esi*8]
mov edx, 0x460640
shl eax, 3
sub eax, esi
lea eax, [esi + eax*4]
shl eax, 2
add eax, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x41d1d3
test cl, cl
je 0x41d1b3
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x41d1d3
add eax, 2
add edx, 2
test cl, cl
jne 0x41d197
jne 0x41d1d3
lea eax, [esi + esi*8]
shl eax, 3
sub eax, esi
lea eax, [esi + eax*4]
shl eax, 2
add eax, edi
push esi
push edi
mov edi, eax
mov esi, 0x460642
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
inc esi
cmp esi, dword [ebp + 0x10]
jl 0x41d182
mov dword [ebx], edi
lea ecx, [ebx + 8]
mov edx, dword [ebp + 0x10]
mov esi, ecx
mov dword [ebx + 4], edx
mov eax, dword [ebp + 0x18]
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebx + 0x408]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, eax
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00408878
lea eax, [ebx + 0x808]
mov edx, dword [ebp + 0x20]
mov esi, eax
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebx + 0xc08]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
push 0x400
call sub.KERNEL32.dll_GetTempPathA
mov byte [ebx + 0x1410], 0
mov dword [ebx + 0x1408], 0xffffffff
mov byte [ebx + 0x1008], 0
mov dword [ebx + 0x140c], 0xffffffff
mov edx, dword [ebp + 0x14]
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x8810]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x8810]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x24]
push eax
push edx
push ebx
call fcn.0041d314
test eax, eax
jne 0x41d2dc
mov dword [ebx + 0x1408], 0xffffffff
cmp byte [ebx + 0x1410], 0
je 0x41d2f9
lea ecx, [ebx + 0x1410]
push ecx
call fcn.0045593c
pop ecx
mov byte [ebx + 0x1410], 0
mov eax, dword [ebx + 0x1408]
cmp eax, 0xffffffff
je 0x41d309
cmp eax, dword [ebp + 0x10]
jl 0x41d28b
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x41e164
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x41e16d
mov eax, dword [ebp - 4]
add esp, 0xffffffac
push 0x44
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.00452e2c
add esp, 0xc
lea edx, [ebp - 0x8058]
mov dword [ebp - 0x48], 0x44
push 0x8000
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
push eax
push edx
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x8058]
push 0
push ecx
push 0
call sub.KERNEL32.dll_CreateProcessA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41e200
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp - 0x58]
push ecx
call sub.KERNEL32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x54]
push eax
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x58]
push edx
call sub.KERNEL32.dll_CloseHandle
jmp 0x41e21a
lea ecx, [ebp - 0x8058]
push ecx
push 0x201
call fcn.00408028
push eax
call fcn.00414028
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x41f304
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov byte [ebx], 0
push 0x400
push 0x46076e
lea eax, [ebp - 0x400]
push eax
push 0x460763
push 0x46075d
call fcn.0040ba80
cmp byte [ebp - 0x400], 0
je 0x41f3d7
push 1
push 0x460775
push 0x46076f
call fcn.0040bb50
test eax, eax
je 0x41f3b2
lea edx, [ebp - 0x800]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004080f8
cmp byte [ebp - 0x800], 0
jne 0x41f375
xor eax, eax
jmp 0x41f37b
lea eax, [ebp - 0x800]
push eax
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
je 0x41f38b
cmp eax, 5
jne 0x41f3d7
xor eax, eax
lea edi, [ebp - 0x400]
or ecx, 0xffffffff
mov esi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41f3d7
xor eax, eax
lea edi, [ebp - 0x400]
or ecx, 0xffffffff
mov esi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x420ad0
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov byte [esi], 0
cmp dword [ebx + 0xc], 0
je 0x420b65
push 0x501
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
cmp byte [ebp - 0x54], 0
je 0x420b31
xor eax, eax
push esi
lea edi, [ebp - 0x54]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x420b5a
push 0x2e
push edi
call fcn.00453124
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x420b5a
push 0x69
call fcn.00408028
push eax
inc ebx
push ebx
push 0x4609f4
push esi
call fcn.00456f9c
add esp, 0x10
mov eax, dword [ebp - 0x164]
jmp 0x420c2d
test byte [ebp + 0x10], 0x10
je 0x420b7c
push esi
push 0x4609fa
push ebx
call fcn.00420c38
jmp 0x420c2d
push 0x2e
push edi
call fcn.00453124
add esp, 8
mov edi, eax
test edi, edi
jne 0x420b9b
mov edx, dword [ebx + 0x10]
push edx
call sub.USER32.dll_CopyIcon
jmp 0x420c2d
push 0x69
call fcn.00408028
push eax
lea ecx, [edi + 1]
push ecx
push 0x460a01
push esi
call fcn.00456f9c
add esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 4], pe_nt_image_headers32
push eax
lea edx, [ebp - 0x264]
push edx
push edi
push 0x80000000
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
je 0x420be1
mov ecx, dword [ebx + 0x10]
push ecx
call sub.USER32.dll_CopyIcon
jmp 0x420c2d
push esi
lea eax, [ebp - 0x264]
push eax
push ebx
call fcn.00420c38
mov esi, eax
test esi, esi
je 0x420bf9
mov eax, esi
jmp 0x420c2d
push 0x460a07
push edi
call fcn.00453000
add esp, 8
test eax, eax
jne 0x420c1c
cmp dword [ebx + 0x14], 0
je 0x420c1c
mov edx, dword [ebx + 0x14]
push edx
call sub.USER32.dll_CopyIcon
mov esi, eax
test esi, esi
je 0x420c24
mov eax, esi
jmp 0x420c2d
mov edx, dword [ebx + 0x10]
push edx
call sub.USER32.dll_CopyIcon
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x421854
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [0x466a98], 0
je 0x42196b
lea eax, [ebp - 0x400]
push eax
push 0x465fe5
call fcn.0041ec64
mov eax, esi
mov edx, 0x460a77
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4218a8
test cl, cl
je 0x4218fa
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4218a8
add eax, 2
add edx, 2
test cl, cl
jne 0x42188c
je 0x4218fa
push esi
push 0x465fe5
call fcn.0041eb90
test eax, eax
je 0x4218fa
mov eax, esi
mov edx, 0x460a79
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4218ec
test cl, cl
je 0x4218dc
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4218ec
add eax, 2
add edx, 2
test cl, cl
jne 0x4218c0
jne 0x4218ec
lea eax, [ebp - 0x400]
push eax
call fcn.0040809c
jmp 0x4218ee
xor eax, eax
push eax
push ebx
call fcn.0042009c
jmp 0x4219cd
push ebx
call fcn.004236f8
lea edx, [ebp - 0x800]
push edx
push 0x465fe5
call fcn.0041eca0
xor eax, eax
lea edi, [ebp - 0x800]
or ecx, 0xffffffff
lea esi, [ebp - 0xc00]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0xc00]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0040809c
mov byte [eax], 0
lea edx, [ebp - 0xc00]
push edx
call fcn.00457f40
pop ecx
lea ecx, [ebp - 0x800]
push ecx
call fcn.0040809c
push eax
push ebx
call fcn.0041f7c4
jmp 0x4219cd
lea eax, [ebp - 0x1000]
push eax
push 0x400
call sub.KERNEL32.dll_GetCurrentDirectoryA
push esi
call fcn.00457f40
pop ecx
inc eax
jne 0x421991
push 0x460a7c
call fcn.00457f40
pop ecx
mov eax, esi
mov edx, 0x460a7e
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4219c4
test cl, cl
je 0x4219b4
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4219c4
add eax, 2
add edx, 2
test cl, cl
jne 0x421998
jne 0x4219c4
lea eax, [ebp - 0x1000]
push eax
call fcn.0040809c
jmp 0x4219c6
xor eax, eax
push eax
push ebx
call fcn.0041f7c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4226bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call sub.USER32.dll_GetCursorPos
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebx]
push ecx
call sub.USER32.dll_ScreenToClient
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1012
mov edx, dword [ebx]
push edx
call sub.USER32.dll_SendMessageA
push 0x10
call sub.USER32.dll_GetKeyState
test ah, 0x80
setne bl
and ebx, 1
push 0x12
call sub.USER32.dll_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x11
mov esi, eax
call sub.USER32.dll_GetKeyState
test ah, 0x80
setne al
and eax, 1
test byte [ebp - 0xc], 1
jne 0x422733
test ebx, ebx
jne 0x422733
test esi, esi
jne 0x422733
test eax, eax
je 0x422737
xor edx, edx
jmp 0x42273c
mov edx, 1
mov eax, edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x423b58
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa0
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [0x4706e0], esi
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x460c6c
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
test ebx, ebx
jne 0x423bc1
lea eax, [ebp - 0x560]
push eax
push 0x400
call sub.KERNEL32.dll_GetLogicalDriveStringsA
push 0x4001
lea edx, [ebp - 0x160]
push 0x160
push edx
lea ecx, [ebp - 0x560]
push 0
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
push ebx
push 0
push 0x1109
push esi
call sub.USER32.dll_SendMessageA
call fcn.00423ef4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4243a0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
mov eax, dword [ebp + 0xc]
push eax
push 0x160
lea edx, [ebp - 0x160]
push edx
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [ebp - 0x15c]
mov esp, ebp
pop ebp
ret 8

Function at 0x4259ac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x464e1d], 0xc
je 0x4259e0
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0x3a
jne 0x4259e0
push edx
push 0x461e44
lea eax, [ebp - 0xc]
push eax
call fcn.00456f9c
add esp, 0xc
jmp 0x4259e4
mov byte [ebp - 0xc], 0
cmp byte [ebp - 0xc], 0
je 0x4259ef
lea eax, [ebp - 0xc]
jmp 0x4259f1
xor eax, eax
push eax
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
je 0x425a05
cmp eax, 5
je 0x425a05
xor edx, edx
jmp 0x425a0a
mov edx, 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4

Function at 0x425ad8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x464e1d], 0xc
je 0x425b10
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0x3a
jne 0x425b10
push edx
push 0x461e49
lea eax, [ebp - 0xc]
push eax
call fcn.00456f9c
add esp, 0xc
jmp 0x425b14
mov byte [ebp - 0xc], 0
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x18]
push eax
push edx
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x10]
push ecx
push eax
cmp byte [ebp - 0xc], 0
je 0x425b2f
lea edx, [ebp - 0xc]
jmp 0x425b31
xor edx, edx
push edx
call sub.KERNEL32.dll_GetDiskFreeSpaceA
test eax, eax
jne 0x425b4a
push 0x163dc0
push ebx
call fcn.004262cc
mov eax, ebx
jmp 0x425ba3
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x14]
push ecx
lea eax, [ebp - 0x24]
push eax
call fcn.004262cc
add esp, 0xfffffff8
add esp, 0xfffffff8
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [esp + 4]
push ecx
call fcn.004262cc
add esp, 0xfffffff8
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
lea ecx, [esp + 0x10]
push ecx
call fcn.00426500
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.004262f8
mov ecx, dword [ebp - 0x24]
mov dword [ebx], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebx + 4], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x425be4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop ebp
ret 4

Function at 0x426030
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x460ecc], 0
jne 0x426049
call fcn.0045c2ec
mov dword [0x460ec8], eax
inc byte [0x460ecc]
call fcn.0045c2ec
sub eax, dword [0x460ec8]
cmp eax, 0x64
jle 0x426073
cmp dword [0x466aa4], 0
je 0x42606e
push 0xff
push 0xffffffffffffffff
call fcn.0043fb04
call fcn.0040853c
ret
Function at 0x426120
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.00452eec
pop ecx
mov dword [ebp - 4], eax
push 0x461e59
push ebx
call fcn.00452e5c
add esp, 8
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov edx, dword [ebp - 4]
cmp edi, 0xffffffff
sete al
and eax, 1
lea esi, [ebx + edx + 1]
test eax, eax
jne 0x426229
lea eax, [ebp - 0x118]
mov edx, 0x461e5e
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x426199
test cl, cl
je 0x42620c
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x426199
add eax, 2
add edx, 2
test cl, cl
jne 0x426179
je 0x42620c
lea eax, [ebp - 0x118]
mov edx, 0x461e60
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4261c4
test cl, cl
je 0x4261c2
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4261c4
add eax, 2
add edx, 2
test cl, cl
jne 0x4261a6
je 0x42620c
mov byte [esi], 0
lea eax, [ebp - 0x118]
push eax
push ebx
call fcn.00452e5c
add esp, 8
test byte [ebp - 0x144], 0x10
je 0x4261e8
push ebx
call fcn.00426120
jmp 0x42620c
xor edx, edx
mov dl, byte [ebx + 1]
cmp edx, 0x3a
jne 0x426203
push 0
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
push ebx
call fcn.0045593c
pop ecx
jmp 0x42620c
push 2
push 0xffffffffffffffff
call fcn.0043fb04
lea ecx, [ebp - 0x144]
push ecx
push edi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
sete al
and eax, 1
test eax, eax
je 0x42616e
mov edx, dword [ebp - 4]
mov byte [ebx + edx], 0
xor ecx, ecx
mov cl, byte [ebx + 1]
cmp ecx, 0x3a
je 0x426243
push 2
push 0xffffffffffffffff
call fcn.0043fb04
push ebx
call fcn.004585c4
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4262ac
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_SetFileAttributesA
pop ebp
ret 8

Function at 0x426ad8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, 0x80000000
cmp byte [ebp + 0x14], 0
mov ebx, dword [ebp + 8]
je 0x426af2
or esi, 0x40000000
mov edi, 1
cmp dword [0x47242c], 0
jne 0x426b06
cmp byte [ebp + 0x10], 0
je 0x426b09
or edi, 2
push 0
push 0x8000000
push 3
push 0
push edi
push esi
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [ebx + 4], eax
cmp dword [ebx + 4], 0xffffffff
jne 0x426b41
mov esi, 2
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x426b3a
add esi, 0xfffffffe
call fcn.0045a0a8
mov dword [eax], esi
mov byte [ebx + 8], 0
mov byte [ebx + 0xa], 0
mov byte [ebx + 0xb], 0
lea eax, [ebx + 0xc]
mov edx, dword [ebp + 0xc]
mov esi, eax
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebx + 4], 0xffffffff
setne al
and eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x10