joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a55b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x43a605
push ebx
push esi
push 0x60
push 8
push dword [0x4e36cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov esi, eax
xor ebx, ebx
inc ebx
or dword [esi + 4], 0xffffffff
mov dword [esi], ebx
call sub.MSVCRT.dll__wcsdup
push dword [ebp + 0x10]
mov dword [esi + 8], eax
call sub.MSVCRT.dll__wcsdup
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ecx
mov eax, dword [0x4e0efc]
mov dword [esi + 0x28], eax
mov eax, dword [0x4e3b5c]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x58], ebx
test bl, cl
je 0x43a5f3
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x43a77c
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x43a5e0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43a5e3
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43a5eb
mov edi, esi
jmp 0x43a603
push esi
call fcn.0043a21b
jmp 0x43a602
push esi
call fcn.0043a61a
push esi
mov edi, eax
call fcn.0043a21b
pop ecx
pop ecx
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
ret 0xc

Function at 0x43ac74
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
push edi
xor edi, edi
cmp dword [esp + 0xc], edi
je 0x43ad61
push ebx
push ebp
push esi
push 0x60
push 8
push dword [0x4e36cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0x18]
mov esi, eax
xor ebp, ebp
inc ebp
or dword [esi + 4], 0xffffffff
mov dword [esi], ebp
call sub.MSVCRT.dll__wcsdup
mov dword [esi + 8], eax
mov dword [esp], str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
call sub.MSVCRT.dll__wcsdup
mov ebx, dword [esp + 0x24]
pop ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ecx
mov eax, dword [0x4e0efc]
mov dword [esi + 0x28], eax
mov eax, dword [0x4e3b5c]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], eax
test cl, 1
je 0x43ad4e
test ebx, ebx
je 0x43ad18
push ebx
push edi
push dword [0x4e36cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x48], eax
test eax, eax
je 0x43ad13
push ebx
push dword [esp + 0x20]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
cmp dword [esi + 0x48], edi
je 0x43ad45
lea eax, [esp + 0x18]
push eax
push edi
push esi
push 0x43ad67
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x43ad3d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43ad41
mov ebp, dword [esp + 0x18]
test ebp, ebp
jne 0x43ad5c
push esi
call fcn.0043a21b
pop ecx
jmp 0x43ad5e
mov eax, dword [esp + 0x1c]
push esi
mov dword [esi + 0x48], eax
call fcn.0043a86b
pop ecx
mov edi, esi
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
ret 0x18
Function at 0x43af33
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x43ae82
push 0x10
push 0x2c
call fcn.00453fd2
push 0
push 0
push 8
mov dword [0x4e3b68], eax
call fcn.00453dcb
cmp word [0x4e3b60], 0
mov dword [0x4e460c], eax
jne 0x43b018
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x43af8b
mov word [0x4e3b60], di
jmp 0x43af93
xor eax, eax
mov word [0x4e3b60], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4e3b7c], eax
test eax, eax
je 0x43b017
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4bc3a4
push eax
call esi
push 0x4bc3b0
push dword [0x4e3b7c]
mov dword [0x4e3b6c], eax
call esi
push str.getnameinfo
push dword [0x4e3b7c]
mov dword [0x4e3b70], eax
call esi
push str.WSAStringToAddressA
push dword [0x4e3b7c]
mov dword [0x4e3b74], eax
call esi
cmp dword [0x4e3b6c], 0
mov dword [0x4e3b78], eax
pop esi
je 0x43b017
cmp dword [0x4e3b70], 0
je 0x43b017
cmp dword [0x4e3b74], 0
je 0x43b017
test eax, eax
je 0x43b017
mov dword [0x4e3b64], edi
pop edi
add esp, 0x190
ret

Function at 0x43b0cb
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
lea eax, [ebp - 0x100]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0xff
push eax
mov dword [0x4e4610], esi
mov dword [0x4e4620], esi
mov dword [0x4e4624], edi
mov dword [0x4e4628], esi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x43b177
cmp edi, 0x10000000
jne 0x43b153
cmp dword [0x4e3b64], esi
je 0x43b177
mov eax, dword [0x4e3b80]
test eax, eax
je 0x43b12f
push eax
call dword [0x4e3b70]
mov dword [0x4e3b80], esi
push 0x4e3b80
push esi
push esi
lea eax, [ebp - 0x100]
push eax
call dword [0x4e3b6c]
test eax, eax
jne 0x43b177
mov eax, dword [0x4e3b80]
mov dword [0x4e4628], eax
jmp 0x43b174
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x43b177
push 0x10
push eax
push 0x4e4614
call sub.MSVCRT.dll_memcpy
add esp, 0xc
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x43b816
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x4e4650]
call fcn.00453eff
mov ebx, eax
test ebx, ebx
je 0x43b87a
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x43b83f
push dword [esp + 0xc]
push ebx
call eax
jmp 0x43b87a
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00454af0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.00454e70
pop edi
pop esi
pop ebx
ret 8
Function at 0x43ba47
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 1
call edi
mov ebx, 0x8000
test bx, ax
je 0x43ba61
inc esi
push 2
call edi
test bx, ax
je 0x43ba6d
or esi, 2
push 4
call edi
test bx, ax
je 0x43ba79
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x43c05b
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x43c093
push dword [edi]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [esp + 0x10], 1
test byte [edi + 0x14], 8
je 0x43c178
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [edi], eax
jne 0x43c178
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
sub ebp, dword [esp + 0x18]
mov dword [esp + 0x28], eax
test eax, eax
jle 0x43c1a6
test ebp, ebp
jle 0x43c1a6
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x43c1a6
push ebp
push dword [esp + 0x2c]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x43c16f
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x10], 0
je 0x43c119
push 4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x10]
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x43c12e
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 2
pop eax
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
sub dword [esp + 0x1c], eax
sub dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push ebp
push dword [esp + 0x3c]
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x43c1a6
cmp dword [edi + 0x10], ebx
je 0x43c192
push 4
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 0x10]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x43c1a6
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
cmp dword [esp + 0x10], 0
je 0x43c1b6
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x43c1be
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.0043ff3e
push eax
call fcn.00440fee
push dword [0x4e3b9c]
mov dword [esp + 0x24], eax
call fcn.00454119
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x43c232
inc ebx
push 0x12
call esi
test di, ax
je 0x43c23e
or ebx, 2
push 0x11
call esi
test di, ax
je 0x43c24a
or ebx, 4
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.0043ba47
push 0x43c29f
push ebp
push dword [esp + 0x2c]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x34]
push dword [esp + 0x2c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x44]
movzx eax, ax
push 0x332c
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x18], eax
call fcn.00443f7d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x43d480
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x4e4634]
call fcn.00453d60
xor ebp, ebp
mov esi, eax
cmp dword [0x4e3d28], ebp
jne 0x43d55c
xor ebx, ebx
inc ebx
mov dword [0x4e3d28], ebx
call fcn.0043fda9
mov edi, 0xa4
push edi
push ebp
push 0x4e3d30
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x4e3d30], 0x13
lea eax, [esp + 0x10]
mov dword [0x4e3d34], edi
mov dword [0x4e3d40], 0x43d3cb
mov dword [0x4e3d44], 0x43d716
push eax
mov dword [0x4e3d98], 0x43d3a6
mov dword [0x4e3d9c], 0x43d661
mov dword [0x4e3d3c], 0x43d381
mov dword [0x4e3dc0], 0x43d3e6
mov dword [0x4e3dd4], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43d55c
cmp dword [esp + 0x20], ebx
je 0x43d544
cmp dword [esp + 0x20], 2
jne 0x43d55c
cmp dword [esp + 0x14], 5
jae 0x43d54c
mov dword [0x4e3dd4], ebp
jmp 0x43d55c
jne 0x43d55c
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x4e3dd4], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.00444e38
mov eax, dword [esp + 0x140]
push ebp
push dword [0x4e36d0]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x43d632
push dword [esp + 0x128]
push dword [0x4e4650]
call fcn.00453f3e
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x43d601
push edi
call fcn.0044f4f6
test eax, eax
je 0x43d601
push ebp
push ebp
push edi
call fcn.0044f140
mov dword [esi + 0x18], eax
jmp 0x43d604
mov dword [esi + 0x18], ebp
push 0x43d0d0
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x4e3d30
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x4e3d2c], eax
call fcn.0043ff6d
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x440d55
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x440ecb
mov eax, dword [esp + 0x24]
dec eax
je 0x440eae
dec eax
jne 0x440ecb
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.00440d0e
pop ecx
test eax, eax
je 0x440e0c
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x440dcf
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x440eaa
dec ebx
je 0x440ea6
dec ebx
je 0x440e85
dec ebx
je 0x440e3f
sub ebx, 4
jne 0x440ecb
test edi, edi
jne 0x440ecb
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x440ecb
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x440dcf
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x440dca
sub edi, 0
je 0x440e77
dec edi
je 0x440e69
dec edi
je 0x440e5b
dec edi
jne 0x440ecb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x440ecb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x440ecb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x440ecb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x440ecb
sub edi, 0
je 0x440ea2
dec edi
je 0x440e9e
dec edi
jne 0x440ecb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x440ecb
push 0x3c
jmp 0x440eca
push 0x32
jmp 0x440eca
push 0x14
jmp 0x440eca
push 5
jmp 0x440eca
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x440ec8
cmp eax, 0xa
je 0x440ec4
cmp eax, 0x5a
jne 0x440ecb
push 0x28
jmp 0x440eca
push 0x1e
jmp 0x440eca
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x4418e5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x4e4660]
call fcn.00453eff
mov esi, eax
test esi, esi
je 0x4419bf
cmp dword [ebp + 0xc], 0
je 0x441931
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x441922
cmp dword [esi + 0x1c], 0
jne 0x441922
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4419bf
test byte [ebp + 0x10], 3
je 0x44194c
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.00442273
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x441971
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x441985
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x4419a2
test ebx, ebx
je 0x441996
push 8
jmp 0x4419a8
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x4419b5
test ebx, ebx
je 0x4419ab
push 3
pop ecx
jmp 0x4419b5
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x442531
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x4425c4
push 9
call esi
test al, al
jns 0x4425c4
push 0x11
call esi
test al, al
js 0x4425c4
push 0x10
call esi
test al, al
js 0x4425c4
push 0x12
call esi
test al, al
js 0x4425c4
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
push 5
lea eax, [ebp - 0x24]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x4425a6
push 4
lea eax, [ebp - 0x24]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x4425c4
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
jne 0x4425c4
xor eax, eax
jmp 0x442645
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4425ec
push 0x11
call esi
test al, al
js 0x4425e4
push 0x10
call esi
test al, al
js 0x4425e4
push 0x12
call esi
test al, al
jns 0x4425ec
push 1
push edi
call fcn.0044264d
mov esi, dword [sym.imp.USER32.dll_GetPropW]
test ebx, ebx
je 0x442602
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x442642
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x442642
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x442642
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x442642
lea eax, [esi - 1]
push eax
push dword [0x4e4660]
call fcn.00453eff
test eax, eax
je 0x442642
mov eax, dword [eax + 8]
jmp 0x442644
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44290c
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x44291a
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 8

Function at 0x44291d
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x442946
test byte [esp + 8], 2
je 0x44293a
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x442948
xor eax, eax
ret 8

Function at 0x442959
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x4429d1
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x4429b2
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x4429af
cmp ecx, 0x5c
je 0x4429af
cmp ecx, 0x2f
jne 0x4429bc
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x44299c
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4429d3
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x442a8d
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x442bd5
xor ecx, ecx
cmp word [eax], cx
je 0x442bd5
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x442ae6
cmp eax, 3
jne 0x442b20
cmp word [esp + 0xa], 0x3a
jne 0x442b20
cmp eax, 2
jne 0x442b04
lea eax, [esp + 8]
push 0x4bc8c8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x442bd5
push 0xfffffffffffffffe
pop edi
jmp 0x442bd5
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x442b35
cmp ax, bx
jne 0x442b3f
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x442b28
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x442b7e
test byte [esp + 0x21c], 0x10
je 0x442b65
push 0xfffffffffffffffe
pop edi
jmp 0x442b75
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x442bd3
cmp word [esp + 0x10], bp
jne 0x442b8c
cmp word [esp + 0x12], bp
je 0x442bab
cmp word [esp + 0x10], bx
jne 0x442b9a
cmp word [esp + 0x12], bx
je 0x442bab
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x442bd3
cmp word [esp + 0x12], ax
jne 0x442bd3
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x442bc0
test al, 0x10
je 0x442bd3
jmp 0x442bd0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x442bd3
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x442c60
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x442c9c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x443160
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x4e4674]
call fcn.00453eff
mov esi, eax
test esi, esi
je 0x4431df
cmp dword [esi + 4], 0
je 0x4431b0
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.00443400
test eax, eax
je 0x4431a4
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4431ea
cmp dword [esp + 8], 0
je 0x4431ea
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x443400
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x443421
push esi
call fcn.00442c60
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x443495
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x443482
dec ecx
je 0x44346d
sub ecx, 2
je 0x44345a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x4434da
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x4434fb
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc