joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4614f2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a9930
call fcn.004a7a94
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
fld1
fstp qword [esi + 0x10]
mov dword [esi], vtable.CBkPngSkin.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov eax, vtable.CBkBitmap.0
mov dword [esi + 0x48], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x70], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov byte [ebp - 4], 2
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
call fcn.0046d5b4
lea ecx, [esi + 0x80]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x84], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x464e7f
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov ecx, dword [eax + 8]
inc edi
cmp ecx, edi
jne 0x464f7b
mov eax, dword [eax + 0xc]
cmp eax, edi
jne 0x464ea7
mov ecx, esi
call fcn.00467c4d
mov eax, edi
jmp 0x464f84
cmp eax, 2
jne 0x464eb9
push 6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x464ea0
cmp eax, 0x65
jne 0x464ec7
mov eax, esi
call fcn.004682a3
jmp 0x464ea0
cmp eax, 0x6c
jne 0x464ed3
call fcn.00468353
jmp 0x464ea0
cmp eax, 0x66
jne 0x464eeb
xor eax, eax
cmp dword [esi + 0x510], eax
sete al
push eax
call fcn.00468cee
jmp 0x464ea0
cmp eax, 0x191
jne 0x464efa
push edi
call fcn.004686ac
jmp 0x464ea0
cmp eax, 0x96
jne 0x464f20
push dword [esi + 0x53c]
push dword [esi + 0x514]
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
push eax
push eax
mov eax, esi
call fcn.00467bb4
jmp 0x464ea0
cmp eax, 0x1f5
jne 0x464f35
xor ecx, ecx
mov eax, esi
call fcn.0042f388
jmp 0x464ea0
cmp eax, 0x3e9
jne 0x464f57
push edi
xor eax, eax
push eax
push eax
push str.https:__www.imeitools.com_drvmaster_master_license.html
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x464ea0
cmp eax, 0x3ea
jne 0x464f6a
push edi
xor eax, eax
push eax
push eax
push 0x4bef90
jmp 0x464f46
cmp eax, 0x68
jne 0x464f7b
mov ebx, esi
call fcn.00468a3d
jmp 0x464ea0
and dword [esi + 0x54c], 0
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x465237
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4652ae
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4652ae
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], esi
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fchs
faddp st(1)
fmul qword [0x4c0f60]
fcomp qword [0x4c0f58]
fnstsw ax
test ah, 1
jne 0x4652ae
inc esi
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x465d28
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4acafd
call fcn.004a7a94
sub esp, 0x5c
mov eax, dword [0x4daedc]
push esi
push edi
mov ecx, 0x4daedc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str._stop__uninstall
push dword [ebp + 8]
xor esi, esi
push 0x4be948
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00406942
push 0x40
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.00479900
xor eax, eax
mov dword [ebp - 0x24], esi
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x68], 0x44
push esi
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], si
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x465dcb
cmp dword [ebp - 0x14], esi
je 0x465dc5
cmp ebx, esi
je 0x465dc5
mov dword [ebx], eax
jmp 0x465dcb
push eax
call edi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x20], esi
je 0x465dd8
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bf2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x465df4
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4ab2f5
call fcn.004a7a94
sub esp, 0x218
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x222]
push ebx
mov dword [ebp - 0x18], ebx
push eax
mov word [ebp - 0x224], bx
call fcn.00479900
mov esi, dword [ebp + 8]
mov edi, 0x4daedc
add esp, 0xc
mov ecx, edi
call fcn.00405ea5
mov dword [ebp - 4], ebx
mov eax, dword [0x4daedc]
xor esi, esi
inc esi
mov ecx, edi
mov dword [ebp - 0x18], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.00405e62
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x465e76
lea ecx, [ebp - 0x10]
call fcn.00435be2
lea eax, [ebp - 0x1c]
push 0x4be540
push eax
lea ecx, [ebp - 0x10]
call fcn.0040917d
pop ecx
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00405209
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405bf2
mov esi, dword [ebp - 0x14]
push esi
push 0x208
lea eax, [ebp - 0x224]
push eax
push 0x4b94e4
push str.TryNo
push 0x4be488
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x465edc
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
call fcn.0040607d
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bf2
lea eax, [esi - 0x10]
call fcn.00405bf2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x466652
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 0x544], 0
jne 0x46668e
push esi
lea esi, [ebp - 4]
call fcn.00466696
push dword [eax]
push 2
push 0x4b9ba0
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0x544], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405bf2
pop esi
mov eax, dword [edi + 0x544]
leave
ret
Function at 0x466b63
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4acb17
call fcn.004a7a94
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.004768d6
lea esi, [ebp - 0x14]
call fcn.00476921
mov eax, dword [eax]
push 1
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x10]
call fcn.004060b0
mov ebx, eax
mov eax, dword [ebp - 0x14]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00405bf2
test bl, bl
jne 0x466ca0
mov eax, dword [0x4daedc]
mov ecx, 0x4daedc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push str.installpath
mov eax, esi
push eax
mov byte [ebp - 4], 1
call fcn.004060fe
test eax, eax
mov ebx, dword [ebp - 0x14]
je 0x466c98
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466c98
mov esi, dword [ebp + 8]
lea edi, [esi + 0x53c]
lea eax, [ebp - 0x14]
call fcn.00405209
xor edi, edi
inc edi
mov eax, esi
mov dword [esi + 0x950], edi
call fcn.00469460
test eax, eax
je 0x466c37
lea eax, [ebx - 0x10]
call fcn.00405bf2
cmp dword [ebp - 0x10], 0
je 0x466c33
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x466cb1
call fcn.0045cfd4
push 3
mov ecx, esi
call fcn.00469bc4
cmp eax, edi
jne 0x466c50
call fcn.0045cfd4
jmp 0x466c1c
cmp eax, 2
je 0x466c59
test eax, eax
jne 0x466c5e
call fcn.0045cfd4
call fcn.0045cfd4
mov edx, eax
push 0
mov eax, esi
call fcn.00469460
push eax
push dword [esi + 0x950]
push 3
push edx
call fcn.0045c781
lea eax, [ebx - 0x10]
call fcn.00405bf2
cmp dword [ebp - 0x10], 0
je 0x466c94
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x466cb1
lea eax, [ebx - 0x10]
call fcn.00405bf2
cmp dword [ebp - 0x10], edi
je 0x466cae
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x46732c
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4acaeb
call fcn.004a7a94
sub esp, 0x1c
mov eax, dword [0x4daedc]
push ebx
push esi
push edi
mov ecx, 0x4daedc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str._x_
lea eax, [ebp - 0x14]
call fcn.00406942
pop ecx
pop ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.004670dc
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040668e
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov esi, dword [ebp + 8]
lea edi, [esi + 0x570]
mov dword [ebp - 0x10], edi
call fcn.00405209
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405bf2
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405bf2
add esi, 0x550
call fcn.004758a0
test eax, eax
je 0x4674bb
cmp dword [esi + 8], 0x100000
jb 0x4674bb
call fcn.0047594f
test eax, eax
jne 0x4673ee
mov ebx, esi
call fcn.004759a7
test eax, eax
je 0x4674bb
push dword [edi]
mov ecx, esi
push 0
call fcn.00475702
lea eax, [ebp - 0x18]
push 0x4b948c
push eax
mov ecx, edi
call fcn.0040917d
lea ecx, [ebp - 0x1c]
push 0x4db308
push ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0040668e
add esp, 0x10
push eax
push ecx
mov byte [ebp - 4], 4
call fcn.004768d6
pop ecx
mov ecx, eax
call fcn.0047693a
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405bf2
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405bf2
push dword [edi]
lea eax, [ebp - 0x28]
push eax
call fcn.00465df4
pop ecx
pop ecx
mov byte [ebp - 4], 5
mov esi, dword [eax]
call fcn.004768d6
mov ebx, dword [eax + 0x14]
call fcn.004768d6
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
call fcn.004768d6
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
call fcn.004768d6
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.004768d6
mov eax, dword [eax + 4]
push esi
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.0045cfd4
mov ecx, dword [ebp - 0x24]
call fcn.0045ca8f
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.00405bf2
call fcn.0047339d
mov ecx, edi
mov edx, eax
call fcn.004733df
mov ebx, dword [ebp + 8]
call fcn.0046934e
mov edi, ebx
push edi
call fcn.0046947c
call fcn.00466a3b
push edi
call fcn.004671a2
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 8]
push str._res
push eax
call fcn.0040917d
pop ecx
pop ecx
mov byte [ebp - 4], 6
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x467522
push dword [ebp + 8]
call fcn.0040e354
push eax
call fcn.0040607d
call fcn.0040e8b2
mov ebx, eax
call fcn.0040e8dd
call fcn.004647b4
call fcn.00464af8
call fcn.00464c82
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405bf2
push edi
call fcn.00468f4b
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405bf2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x4682a3
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
push edi
lea ebp, [esi + 0x24]
push 0xa1
mov eax, ebp
call fcn.0046a37b
test eax, eax
je 0x4682c9
mov eax, ebp
call fcn.0046a304
mov dword [0x4d67bc], eax
xor ebx, ebx
cmp dword [0x4d67bc], ebx
jne 0x4682de
push esi
call fcn.004692c6
mov dword [0x4d67bc], eax
push ebx
push 0xc
mov eax, ebp
call fcn.0042f594
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 0x32
push 0x3eb
push dword [esi + 4]
call edi
push ebx
push 0x50
push 0x3ed
push dword [esi + 4]
call edi
push ebx
push 0x1e
push 1
push dword [esi + 4]
call edi
push ebx
push 0x64
mov eax, ebp
call fcn.0042f594
push 1
push 0xc8
mov eax, ebp
call fcn.0042f594
push ebx
call fcn.00468cee
push ebx
push ebx
push esi
push 0x468289
push ebx
push ebx
call fcn.0047e41f
add esp, 0x18
mov dword [esi + 0x944], eax
call fcn.0045cfd4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x468975
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [edi]
lea esi, [ebp - 4]
call fcn.0045b072
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.00405bf2
mov eax, dword [edi]
push 3
pop esi
cmp dword [eax - 0xc], esi
jl 0x468a36
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4689b8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x468a36
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00406652
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, esi
mov eax, dword [ebp - 4]
setne bl
add eax, 0xfffffff0
call fcn.00405bf2
test bl, bl
je 0x4689e5
push 2
pop eax
jmp 0x468a39
push edi
call fcn.004688e9
test eax, eax
pop ecx
je 0x4689f4
mov eax, esi
jmp 0x468a39
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00406652
push dword [eax]
call fcn.00465237
mov ebx, eax
mov eax, dword [ebp - 4]
neg ebx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.00405bf2
test bl, bl
je 0x468a23
push 4
jmp 0x4689e2
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x468a32
push 5
jmp 0x4689e2
xor eax, eax
jmp 0x468a39
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x468a3d
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x4aaa25
call fcn.004a7a94
sub esp, 0x44c
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x452]
push esi
push eax
mov word [ebp - 0x454], si
call fcn.00479900
add esp, 0xc
lea eax, [ebp - 0x454]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1c]
push eax
push 0x11
push dword [ebx + 4]
mov dword [ebp - 0x1c], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [0x4daedc]
mov edi, 0x4daedc
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], esi
push 0x105
lea esi, [ebp - 0x18]
call fcn.00405d23
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp dword [eax - 8], ecx
jge 0x468aca
push 0x80070057
call fcn.00405d0b
mov dword [eax - 0xc], ecx
mov word [eax], cx
push 0x4bfda0
lea eax, [ebp - 0x18]
push eax
call fcn.0040607d
mov eax, dword [ebx + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x18]
mov dword [ebp - 0x3c], eax
call fcn.0040d278
mov dword [ebp - 0x38], eax
xor esi, esi
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x34], 0x4bfdac
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x468bd7
push 0x206
lea eax, [ebp - 0x24a]
push esi
push eax
mov word [ebp - 0x24c], si
call fcn.00479900
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [0x4daedc]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24c]
push eax
lea esi, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0045b072
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.004069cb
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00405bf2
mov eax, dword [ebx + 0x954]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.004069cb
mov esi, dword [ebp - 0x14]
push esi
push dword [ebx + 0x514]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edi, [ebp - 0x14]
call fcn.00468975
push 0
push eax
push 0x46c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esi - 0x10]
call fcn.00405bf2
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405bf2
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x468f4b
Capabilities:
Get common file path
Get disk information
Get program files directory

Disassembly:
mov eax, 0x4aa9e1
call fcn.004a7a94
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x26
lea edi, [ebx + 0x53c]
push 0x104
mov esi, edi
call fcn.00405d23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x468f8a
push eax
call fcn.0047a638
pop ecx
mov edx, edi
call fcn.00405cea
test esi, esi
jne 0x468fa0
push 0x4bfe24
push edi
call fcn.0040607d
push 0x4b948c
push edi
call fcn.0040648c
mov eax, dword [ebx + 0x954]
push dword [eax - 0xc]
push eax
mov eax, edi
call fcn.004069cb
call fcn.0047339d
push eax
call fcn.0047466b
test al, al
je 0x468ff6
lea eax, [ebp - 0x10]
push eax
push ecx
call fcn.0047339d
pop ecx
push eax
mov ecx, edi
call fcn.00474a8d
and dword [ebp - 4], 0
call fcn.00405209
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bf2
call fcn.00468975
neg eax
sbb eax, eax
inc eax
jne 0x469097
xor ebx, ebx
lea eax, [ebx + 0x41]
movzx esi, ax
mov eax, dword [0x4daedc]
mov ecx, 0x4daedc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
movzx eax, si
push eax
push str._c:_
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040cc70
mov esi, dword [ebp - 0x10]
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x469077
lea eax, [ebp - 0x10]
call fcn.0040524a
mov eax, dword [ebp + 8]
push dword [eax + 0x954]
mov esi, dword [ebp - 0x10]
push esi
push str._sprogram_files_s
mov eax, edi
call fcn.00406942
add esp, 0xc
call fcn.00468975
test eax, eax
je 0x46908f
or dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
call fcn.00405bf2
inc ebx
cmp ebx, 0x1a
jne 0x469008
jmp 0x469097
lea eax, [esi - 0x10]
call fcn.00405bf2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x4690a8
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, eax
and dword [esi + 0x54c], 0
cmp dword [esp + 8], 0x61
je 0x4690c0
cmp dword [esp + 8], 0x41
jne 0x4690f4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4690f4
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
add esi, 0x514
push dword [esi]
call edi
push 0
push 0
push 0xb7
push dword [esi]
call edi
pop edi
pop esi
ret 4
Function at 0x4690f8
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4acafd
call fcn.004a7a94
push ecx
mov eax, dword [0x4daedc]
push esi
push edi
mov ecx, 0x4daedc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x105
lea esi, [ebp - 0x10]
call fcn.00405d23
push 0x104
push eax
push dword [ebx + 0x514]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x469146
xor eax, eax
jmp 0x46914d
push esi
call fcn.0047a638
pop ecx
lea edx, [ebp - 0x10]
call fcn.00405cea
lea edi, [ebp - 0x10]
call fcn.00468975
push 0
push eax
push 0x46c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esi - 0x10]
call fcn.00405bf2
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x469deb
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4acafd
call fcn.004a7a94
push ecx
push 0
push str.drvmaster_9C20A70B_E65D_4ef5_9744_A0D0B52A1BEE
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x469e51
lea eax, [ebp - 0x10]
push eax
call fcn.004063d9
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.00408cb3
pop ecx
pop ecx
push str.wmtray.exe
lea eax, [ebp - 0x10]
push eax
call fcn.0040648c
push 1
push 0
push str._from:autorun
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405bf2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x46a771
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [0x4db3e0]
xor esi, esi
cmp eax, esi
push edi
mov dword [esp + 0x1c], esi
je 0x46a78e
mov ebp, dword [eax + 4]
jmp 0x46a790
xor ebp, ebp
cmp ebp, esi
jne 0x46a7a0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, eax
cmp ebp, esi
je 0x46a7c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebp, eax
je 0x46a7c5
push ebp
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x46a7c5
push esi
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push ecx
mov eax, esp
mov dword [ebx + 0x4dc], esi
push ebp
mov dword [eax], esi
call fcn.0046b297
mov ecx, eax
cmp ecx, esi
mov dword [esp + 0x18], ecx
jne 0x46a7f0
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x46a8df
mov eax, dword [0x4db3e0]
cmp eax, esi
mov dword [esp + 0x20], esi
je 0x46a807
mov edx, dword [eax + 4]
mov dword [esp + 0x20], edx
mov dword [eax + 4], ecx
mov eax, ebp
call fcn.0042fe32
cmp dword [ebx + 0x4d0], esi
je 0x46a87e
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp edi, dword [esp + 0x14]
je 0x46a862
push 1
push edi
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp edi, dword [esp + 0x14]
je 0x46a87e
push esi
push edi
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, ebx
call fcn.0046b479
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x4dc], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x46a8c3
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebp, esi
je 0x46a8c3
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x46a8c3
push ebp
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x4db3e0]
cmp eax, esi
je 0x46a8d3
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret