joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446900
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov esi, ecx
call edi
push 0x10
shr eax, 0xf
and al, 1
mov byte [esp + 0x12], al
call edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
shr eax, 0xf
and al, 1
mov byte [esp + 0x1b], al
mov eax, dword [esi + 0x20]
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0x110f
push ecx
mov dword [esp + 0x24], eax
call edi
push eax
call fcn.00533854
test eax, eax
jne 0x4469a5
mov edx, dword [ebp + 8]
lea eax, [esp + 0xe]
push eax
push ecx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 0x54]
mov dword [esp + 0x1c], edx
call fcn.00447e70
add esp, 4
mov ecx, eax
call fcn.00448130
lea ebx, [esp + 0xf]
call fcn.00448240
mov eax, dword [eax]
test eax, eax
je 0x4469a5
mov edx, dword [esp + 0x14]
push edx
mov ecx, esi
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 8]
cmp ebx, 0xd
je 0x4469cf
cmp ebx, 0x1b
jne 0x446a18
cmp dword [esi + 0x6c], 0
je 0x4469cf
mov eax, dword [esi]
mov edx, dword [eax + 0x180]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x110f
push eax
call edi
push eax
call fcn.00533854
test eax, eax
je 0x446a18
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0x110f
push ecx
call edi
push eax
call fcn.00533854
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
push edx
push ebx
push 0x100
push eax
call edi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x446f80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
lea eax, [esp + 0xc]
mov esi, ecx
push eax
mov eax, esi
call fcn.00446d40
mov ecx, dword [esi + 0x6c]
mov dword [esi + 0x70], 1
cmp byte [ecx + 0x1c], 0
mov edi, eax
je 0x446fd0
cmp dword [esp + 0xc], 3
je 0x446fff
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi]
mov edx, dword [edx + 0x18c]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call edx
jmp 0x44700b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 0xc]
shr eax, 0xf
and al, 1
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
mov eax, dword [eax + 0x188]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
mov edx, dword [ecx + 0xc]
push edi
push edx
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x180]
mov ecx, esi
call eax
mov eax, dword [esi + 0x78]
test eax, eax
je 0x447024
mov ecx, dword [esi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x78], 0
push 0
push 0
push 0x8080
mov ecx, esi
call fcn.00537c98
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4470c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x575df8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], vtable.CMenu.0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [esp + 0x10]
call fcn.005396c4
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
push str.Copy_Here
push 0xf
push 0
push eax
call esi
mov ecx, dword [esp + 0x10]
push str.Move_Here
push 0x10
push 0
push ecx
call esi
mov edx, dword [esp + 0x10]
push 0
push 0
push 0x800
push edx
call esi
mov eax, dword [esp + 0x10]
push str.Cancel
push 0x11
push 0
push eax
call esi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 0x10]
push 0
shr eax, 0xf
and al, 1
neg al
sbb eax, eax
add eax, 0x10
push eax
push ecx
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push 0
push edi
push edx
push eax
push 0
lea ecx, [esp + 0x20]
call fcn.005325ee
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.CMenu.0
call fcn.00539717
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x450c60
Capabilities:
Enumerate process modules

Disassembly:
push edi
lea edi, [esi + 4]
mov dword [esi + 8], 0xffffffff
mov dword [edi], 0
mov eax, dword [esi]
push eax
call fcn.005308f6
xor ecx, ecx
mov eax, 0x400
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005308fb
add esp, 8
push edi
push 0x1000
push eax
mov dword [esi], eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x450cb3
shr dword [edi], 2
mov dword [esi + 8], 1
cmp dword [edi], 0x400
jae 0x450c71
mov eax, dword [esi]
test eax, eax
je 0x450cd3
mov ecx, dword [esi + 8]
cmp ecx, dword [edi]
jae 0x450cd3
mov eax, dword [eax + ecx*4]
add ecx, 1
mov dword [esi + 8], ecx
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x450d00
Capabilities:
Enumerate process modules

Disassembly:
cmp dword [esi], 0
push edi
lea edi, [esi + 8]
mov dword [edi], 0
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 4], 0
je 0x450d89
lea ecx, [ecx]
mov eax, dword [esi + 4]
push eax
call fcn.005308f6
xor ecx, ecx
mov eax, 0x400
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005308fb
add esp, 8
push edi
push 0x1000
push eax
mov dword [esi + 4], eax
mov eax, dword [esi]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x450d67
shr dword [edi], 2
mov dword [esi + 0xc], 0
cmp dword [edi], 0x400
jae 0x450d20
cmp dword [esi], 0
je 0x450d89
mov ecx, dword [esi + 0xc]
cmp ecx, dword [edi]
jae 0x450d89
mov edx, dword [esi + 4]
mov eax, dword [edx + ecx*4]
add ecx, 1
mov dword [esi + 0xc], ecx
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x450d90
Capabilities:
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x575d36
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x264]
mov dword fs:[0], eax
mov eax, dword [esp + 0x274]
xor ebx, ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x26c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea esi, [esp + 0x14]
mov dword [esp + 0x38], eax
call fcn.00450c60
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp edi, ebx
je 0x450ea8
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [esp + 0x1c]
cmp edi, dword [esp + 0x38]
je 0x450e8c
push edi
push ebx
push 0x410
call ebp
mov dword [esp + 0x44], eax
lea esi, [esp + 0x44]
mov byte [esp + 0x26c], 1
call fcn.00450d00
cmp eax, ebx
je 0x450e65
push 0x104
lea edx, [esp + 0x58]
push edx
push eax
mov eax, dword [esp + 0x50]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov ecx, dword [esp + 0x40]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.005522fc
add esp, 8
test eax, eax
je 0x450edb
mov byte [esp + 0x26c], bl
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x48]
push ecx
call fcn.005308f6
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, ebx
je 0x450ea8
cmp eax, dword [esp + 0x18]
jae 0x450ea8
mov edi, dword [ecx + eax*4]
add eax, 1
cmp edi, ebx
mov dword [esp + 0x1c], eax
jne 0x450e12
push ecx
call fcn.005308f6
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x264]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.00552101
add esp, 0x25c
ret
xor ecx, ecx
mov eax, 0x400
mov edx, 4
mul edx
seto cl
mov esi, vtable.CWindowIterator.0
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
neg ecx
or ecx, eax
push ecx
call fcn.005308fb
add esp, 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push 0x450bb0
mov dword [esp + 0x30], 0x400
mov dword [esp + 0x28], vtable.CMainWindowIterator.0
mov dword [esp + 0x3c], edi
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov dword [esp + 0x30], ebx
je 0x450f58
cmp dword [esp + 0x2c], ebx
jbe 0x450f58
mov ecx, dword [eax]
cmp ecx, ebx
mov dword [esp + 0x30], 1
je 0x450f58
mov edx, dword [esp + 0x3c]
mov dword [edx], ecx
push eax
mov dword [esp + 0x24], esi
call fcn.005308f6
mov eax, dword [esp + 0x48]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x48]
push ecx
call fcn.005308f6
mov edx, dword [esp + 0x18]
push edx
call fcn.005308f6
add esp, 8
mov eax, 1
jmp 0x450eb3
Function at 0x454870
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x580e28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push str._favorites3.txt
lea eax, [esp + 0xc]
push 0x5f287c
push eax
call fcn.00401ba0
add esp, 0xc
mov dword [esp + 0x20], 0
cmp dword [edi + 8], 0
jne 0x45490d
push str._favorites3.bak
lea ecx, [esp + 0x14]
push 0x5f287c
push ecx
mov dword [edi + 8], 1
call fcn.00401ba0
mov eax, dword [eax]
mov edx, dword [esp + 0x14]
add esp, 0xc
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45490d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.00530e1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x454927
push 0x80004005
call fcn.00401f70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push 0
lea ecx, [edi + 0x18]
push ecx
push edi
lea esi, [esp + 0x18]
mov byte [esp + 0x2c], 1
call fcn.00454fe0
mov edx, dword [esp + 8]
push 1
mov ecx, esi
call fcn.0045fed0
add esp, 4
test eax, eax
je 0x454993
mov ecx, dword [esp + 8]
call fcn.00466290
test eax, eax
jg 0x45497d
mov edx, dword [esp + 8]
push 1
mov ecx, esi
call fcn.0045fed0
add esp, 4
mov ecx, dword [esp + 8]
call fcn.00466290
test eax, eax
jle 0x454993
mov dword [edi + 0x54], 0
jmp 0x454a08
call fcn.00530e1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4549ad
push 0x80004005
call fcn.00401f70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x20], 2
mov ecx, dword [esp + 8]
push ecx
lea edx, [esp + 0x14]
push 0x5a6bac
push edx
call fcn.00405480
mov esi, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0
push esi
call fcn.00539414
lea eax, [esi - 0x10]
mov byte [esp + 0x20], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x454a08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x454a2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x454a55
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x457340
Capabilities:
Create thread

Disassembly:
push esi
mov esi, eax
call fcn.004572b0
xor eax, eax
lea ecx, [esi + 0x280]
push ecx
push eax
push esi
push 0x457380
push eax
push eax
mov dword [esi + 0x284], eax
mov dword [esi + 0x288], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x27c], eax
pop esi
ret

Function at 0x457c90
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x28c], 0
jne 0x457cee
push 0x5a6f88
push 0
push 0
push 0
mov dword [esi + 0x2a0], 0
mov dword [esi + 0x29c], 0
mov dword [esi + 0x298], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x290], eax
lea eax, [esi + 0x294]
push eax
push 0
push esi
push 0x457f30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28c], eax
ret
mov ecx, dword [esi + 0x290]
push ecx
mov dword [esi + 0x298], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
ret

Function at 0x458eb0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x2b4], eax
mov eax, dword [esp + 0x2bc]
cmp dword [eax + 0x2ac], 0
push ebx
mov ebx, ecx
je 0x458efc
push edi
lea edi, [eax + 0x1f4]
call fcn.0045c640
pop edi
pop ebx
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.00552101
add esp, 0x2b8
ret 4
push 0x4001
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 4]
test eax, eax
je 0x458f23
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [esp + 0x2b8]
mov eax, dword [esp + 8]
pop ebx
xor ecx, esp
call fcn.00552101
add esp, 0x2b8
ret 4
Function at 0x4598c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
test eax, eax
push ebx
je 0x459943
push esi
lea ecx, [eax + eax + 2]
push ecx
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov eax, dword [edi]
mov edx, dword [eax - 0xc]
add edx, edx
push edx
push eax
push esi
call fcn.0055cb00
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
mov byte [esi + ecx*2], 0
mov edx, dword [edi]
mov eax, dword [edx - 0xc]
add esp, 0xc
push ebx
mov byte [esi + eax*2 + 1], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop esi
je 0x459943
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
pop ebx
ret 4
xor eax, eax
pop ebx
ret 4

Function at 0x45ab60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov esi, ecx
call edi
push 0x11
movsx ebx, ax
call edi
test ebx, ebx
movsx eax, ax
jl 0x45ac27
test eax, eax
jl 0x45ac27
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0053c8f0
mov edi, eax
test edi, edi
je 0x45ac27
push 1
lea eax, [esp + 0x1c]
push eax
push edi
mov ecx, esi
call fcn.0053c741
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x45ac27
push edi
mov ecx, esi
call fcn.0053c7d8
test eax, eax
je 0x45ac27
mov eax, dword [eax]
cmp dword [eax + 0x1c], 0
jne 0x45ac27
mov ecx, dword [esi + 0x26c]
mov ecx, dword [ecx + 0x308]
test ecx, ecx
je 0x45ac27
mov edx, dword [eax + 0xc]
push 1
push edx
call ecx
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45b550
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov esi, ecx
call edi
push 0x11
movsx ebx, ax
call edi
test ebx, ebx
movsx eax, ax
jl 0x45b62d
test eax, eax
jl 0x45b62d
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0053c8f0
mov edi, eax
test edi, edi
je 0x45b62d
push 1
lea eax, [esp + 0x1c]
push eax
push edi
mov ecx, esi
call fcn.0053c741
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x45b62d
push edi
mov ecx, esi
call fcn.0053c7d8
test eax, eax
je 0x45b62d
mov eax, dword [eax]
cmp dword [eax + 0x1c], 0
jne 0x45b620
mov ecx, dword [esi + 0x26c]
mov ecx, dword [ecx + 0x308]
test ecx, ecx
je 0x45b62d
mov edx, dword [eax + 0xc]
push 1
push edx
call ecx
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
mov edx, dword [eax + 0x194]
push edi
mov ecx, esi
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45bf40
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5792f5
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov ecx, esi
mov dword [esp + 0xc], esi
call fcn.00538d38
lea ecx, [esi + 0x14]
mov dword [esp + 0x224], 0
call fcn.005394b8
mov byte [esp + 0x224], 1
lea edi, [esi + 0x28]
call fcn.00530e1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45bfbc
push 0x80004005
call fcn.00401f70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x224], 2
lea ebx, [esi + 0x2c]
call fcn.00530e1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45bfef
push 0x80004005
call fcn.00401f70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
push 0
push 0x25
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x230], 3
push 0
mov dword [esi + 0x30], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45c04c
lea eax, [esp + 0x10]
lea edx, [eax + 2]
jmp 0x45c030
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45c030
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.00402250
push 0
push 0x24
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45c08c
lea eax, [esp + 0x10]
lea edx, [eax + 2]
jmp 0x45c070
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45c070
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00402250
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00552101
add esp, 0x21c
ret
Function at 0x45f4d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
push 0x11c
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00557890
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call edi
test eax, eax
jne 0x45f53e
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call edi
test eax, eax
jne 0x45f53e
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00552101
add esp, 0x120
ret
mov eax, dword [esp + 0x18]
sub eax, 1
je 0x45f592
sub eax, 1
jne 0x45f597
mov eax, dword [esp + 0xc]
cmp eax, 6
jb 0x45f55a
mov esi, 6
cmp eax, 5
jne 0x45f586
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x45f56f
mov esi, 5
jmp 0x45f597
cmp eax, 1
jne 0x45f57b
mov esi, 4
jmp 0x45f597
test eax, eax
jne 0x45f597
mov esi, 3
jmp 0x45f597
cmp eax, 4
ja 0x45f597
mov esi, 2
jmp 0x45f597
mov esi, 1
mov ecx, dword [esp + 0x124]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00552101
add esp, 0x120
ret

Function at 0x45f5b0
Capabilities:
Timestomp file

Disassembly:
sub esp, 0xc
push esi
push edi
push 0
push 0x2000000
push 3
push 0
push 5
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45f5dd
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 8]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x460570
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x57c618
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x5a7d14
lea ecx, [esp + 0x14]
xor ebp, ebp
call fcn.00402390
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
call fcn.00530e1f
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x4605cc
push 0x80004005
call fcn.00401f70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
cmp ebx, ebp
mov byte [esp + 0x24], 1
je 0x4606a9
lea esp, [esp]
test bl, 1
je 0x46069c
mov eax, dword [esp + 0x10]
mov esi, dword [eax - 0xc]
test esi, esi
jle 0x460709
cmp dword [eax - 4], 1
jle 0x46061e
mov ecx, esi
push ecx
lea ecx, [esp + 0x14]
call fcn.00402010
mov eax, dword [esp + 0x10]
test esi, esi
lea edx, [ebp + 0x41]
mov word [eax], dx
jl 0x460709
mov eax, dword [esp + 0x10]
cmp esi, dword [eax - 8]
jg 0x460709
mov dword [eax - 0xc], esi
mov eax, dword [esp + 0x10]
mov word [eax + esi*2], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x46069c
push 2
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
call fcn.0040dce0
mov byte [esp + 0x24], 2
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.00539068
mov byte [esp + 0x24], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46069c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
shr ebx, 1
add ebp, 1
test ebx, ebx
jne 0x4605f0
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4606ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4606f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x80070057
call fcn.00401f70
int3