joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443fdc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 1
call edi
mov ebx, 0x8000
test bx, ax
je 0x443ff6
inc esi
push 2
call edi
test bx, ax
je 0x444002
or esi, 2
push 4
call edi
test bx, ax
je 0x44400e
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4445a4
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x4445dc
push dword [edi]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [esp + 0x10], 1
push dword [edi]
push esi
call fcn.0044aa2d
test byte [edi + 0x14], 8
mov dword [esp + 0x14], eax
je 0x4446cd
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [edi], eax
jne 0x4446cd
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
sub ebp, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
test eax, eax
jle 0x4446fb
test ebp, ebp
jle 0x4446fb
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x4446fb
push ebp
push dword [esp + 0x30]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x30], eax
test eax, eax
je 0x4446c4
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x10], 0
je 0x44466e
push 4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x10]
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x444683
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 2
pop eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
sub dword [esp + 0x20], eax
sub dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push ebp
push dword [esp + 0x40]
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x4446fb
cmp dword [edi + 0x10], ebx
je 0x4446e7
push 4
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 0x10]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x4446fb
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
push dword [esp + 0x14]
push esi
call fcn.0044aa0b
cmp dword [esp + 0x10], 0
je 0x444715
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x44471d
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.0044a91a
push eax
call fcn.0044bd23
push dword [0x672224]
mov dword [esp + 0x24], eax
call fcn.004656d1
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x444791
inc ebx
push 0x12
call esi
test di, ax
je 0x44479d
or ebx, 2
push 0x11
call esi
test di, ax
je 0x4447a9
or ebx, 4
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.00443fdc
push 0x4447fe
push ebp
push dword [esp + 0x2c]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x34]
push dword [esp + 0x2c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x44]
movzx eax, ax
push 0x332c
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x18], eax
call fcn.0044f801
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x447631
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push dword [0x6737a4]
call fcn.0046527b
xor ebx, ebx
mov ebp, eax
cmp dword [0x6727f8], ebx
jne 0x4476c5
mov esi, 0xa4
push esi
push ebx
push 0x672800
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x672804], esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x672800], 0xa
mov dword [0x672808], 0x4471c6
push 0x7f89
push ebx
mov dword [0x672878], 0x44ac69
mov dword [0x67287c], 0x44ac43
mov dword [0x67280c], 0x4471e5
mov dword [0x672890], 0x447205
call esi
mov dword [0x6727f8], eax
test eax, eax
jne 0x4476c5
push 0x7f00
push ebx
call esi
mov dword [0x6727f8], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00450613
push ebx
push dword [0x671728]
push 0xffffffffffffffff
push dword [ebp]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x40000000
push dword [esp + 0x48]
push str.STATIC
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x447791
push edi
push dword [esp + 0x14]
push dword [0x6733b8]
call fcn.00465566
mov edi, eax
push 8
or dword [edi + 0x10], 0xffffffff
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
push 0
mov dword [edi + 0x14], eax
push dword [0x671724]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0x672800
push ebx
push edi
push dword [esp + 0x20]
mov dword [esi], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], ecx
mov byte [esi + 0x10], 0
mov dword [edi + 0x1c], esi
call fcn.0044a949
push 0x4472eb
push 0xfffffffffffffffc
push dword [edi]
mov ebx, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0x20
Function at 0x449f30
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x6737a4]
call fcn.0046527b
xor ebp, ebp
mov esi, eax
cmp dword [0x672ac0], ebp
jne 0x44a00c
xor ebx, ebx
inc ebx
mov dword [0x672ac0], ebx
call fcn.0044acfa
mov edi, 0xa4
push edi
push ebp
push 0x672ac8
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x672ac8], 0x13
lea eax, [esp + 0x10]
mov dword [0x672acc], edi
mov dword [0x672ad8], 0x449e7b
mov dword [0x672adc], 0x44a1c6
push eax
mov dword [0x672b30], 0x449e56
mov dword [0x672b34], 0x44a111
mov dword [0x672ad4], 0x449e31
mov dword [0x672b58], 0x449e96
mov dword [0x672b6c], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44a00c
cmp dword [esp + 0x20], ebx
je 0x449ff4
cmp dword [esp + 0x20], 2
jne 0x44a00c
cmp dword [esp + 0x14], 5
jae 0x449ffc
mov dword [0x672b6c], ebp
jmp 0x44a00c
jne 0x44a00c
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x672b6c], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.00450613
mov eax, dword [esp + 0x140]
push ebp
push dword [0x671728]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x44a0e2
push dword [esp + 0x128]
push dword [0x6733b8]
call fcn.00465566
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x44a0b1
push edi
call fcn.0045df87
test eax, eax
je 0x44a0b1
push ebp
push ebp
push edi
call fcn.0045dbf6
mov dword [esi + 0x18], eax
jmp 0x44a0b4
mov dword [esi + 0x18], ebp
push 0x449b80
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x672ac8
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x672ac4], eax
call fcn.0044a949
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c

Function at 0x44a28f
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x6733b8]
call fcn.00465527
mov ebx, eax
test ebx, ebx
je 0x44a2f3
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x44a2b8
push dword [esp + 0xc]
push ebx
call eax
jmp 0x44a2f3
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.004664c0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.004665d0
pop edi
pop esi
pop ebx
ret 8
Function at 0x44ba0a
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44bb80
mov eax, dword [esp + 0x24]
dec eax
je 0x44bb63
dec eax
jne 0x44bb80
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.0044b9c3
pop ecx
test eax, eax
je 0x44bac1
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x44ba84
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x44bb5f
dec ebx
je 0x44bb5b
dec ebx
je 0x44bb3a
dec ebx
je 0x44baf4
sub ebx, 4
jne 0x44bb80
test edi, edi
jne 0x44bb80
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x44bb80
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x44ba84
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x44ba7f
sub edi, 0
je 0x44bb2c
dec edi
je 0x44bb1e
dec edi
je 0x44bb10
dec edi
jne 0x44bb80
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x44bb80
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x44bb80
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x44bb80
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x44bb80
sub edi, 0
je 0x44bb57
dec edi
je 0x44bb53
dec edi
jne 0x44bb80
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x44bb80
push 0x3c
jmp 0x44bb7f
push 0x32
jmp 0x44bb7f
push 0x14
jmp 0x44bb7f
push 5
jmp 0x44bb7f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44bb7d
cmp eax, 0xa
je 0x44bb79
cmp eax, 0x5a
jne 0x44bb80
push 0x28
jmp 0x44bb7f
push 0x1e
jmp 0x44bb7f
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x44c0eb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x6733bc]
call fcn.00465527
mov esi, eax
test esi, esi
je 0x44c1c5
cmp dword [ebp + 0xc], 0
je 0x44c137
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x44c128
cmp dword [esi + 0x1c], 0
jne 0x44c128
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x44c1c5
test byte [ebp + 0x10], 3
je 0x44c152
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.0044d199
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x44c177
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x44c18b
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x44c1a8
test ebx, ebx
je 0x44c19c
push 8
jmp 0x44c1ae
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x44c1bb
test ebx, ebx
je 0x44c1b1
push 3
pop ecx
jmp 0x44c1bb
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x44d461
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x44d4f9
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x44d4f6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x44d4f6
lea eax, [esi - 1]
push eax
push dword [0x6733bc]
call fcn.00465527
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x44d4f8
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x44d4ed
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x44d5e0
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x44d4d3
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x44d59f
push eax
call esi
test al, al
jns 0x44d59f
push 0x11
call esi
test al, al
js 0x44d59f
push 0x10
call esi
test al, al
js 0x44d59f
push 0x12
call esi
test al, al
js 0x44d59f
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x44d59f
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x44d573
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x44d58a
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x44d5ea
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x44d5ea
test ebp, ebp
je 0x44d5c3
push 0x11
call esi
test al, al
js 0x44d5bb
push 0x10
call esi
test al, al
js 0x44d5bb
push 0x12
call esi
test al, al
jns 0x44d5c3
push 1
push ebp
call fcn.0044d5f6
test ebx, ebx
je 0x44d5d7
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x44d5ea
test edi, edi
je 0x44d5ea
mov eax, dword [edi + 8]
jmp 0x44d5ec
and dword [esp + 0x14], 0
jmp 0x44d4f8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x44d755
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x44d89d
xor ecx, ecx
cmp word [eax], cx
je 0x44d89d
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x44d7ae
cmp eax, 3
jne 0x44d7e8
cmp word [esp + 0xa], 0x3a
jne 0x44d7e8
cmp eax, 2
jne 0x44d7cc
lea eax, [esp + 8]
push 0x4e98a8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x44d89d
push 0xfffffffffffffffe
pop edi
jmp 0x44d89d
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x44d7fd
cmp ax, bx
jne 0x44d807
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x44d7f0
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x44d846
test byte [esp + 0x21c], 0x10
je 0x44d82d
push 0xfffffffffffffffe
pop edi
jmp 0x44d83d
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x44d89b
cmp word [esp + 0x10], bp
jne 0x44d854
cmp word [esp + 0x12], bp
je 0x44d873
cmp word [esp + 0x10], bx
jne 0x44d862
cmp word [esp + 0x12], bx
je 0x44d873
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x44d89b
cmp word [esp + 0x12], ax
jne 0x44d89b
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x44d888
test al, 0x10
je 0x44d89b
jmp 0x44d898
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x44d89b
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x44d9fa
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x44da23
test byte [esp + 8], 2
je 0x44da17
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x44da25
xor eax, eax
ret 8
Function at 0x44daf3
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x672bc0]
push esi
test eax, eax
jne 0x44db18
push fcn.0044dc20
push 0x10
push 0x258
call fcn.004655fa
mov dword [0x672bc0], eax
push dword [esp + 0xc]
push eax
call fcn.00465566
mov esi, eax
test esi, esi
je 0x44dc19
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x44db3a
mov edi, 0x4d5074
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x44db4a
xor eax, eax
cmp word [ebx], ax
jne 0x44db4f
mov ebx, 0x4e98ac
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x671724]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x44dc00
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x44dbb0
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x44dbb4
push 0x4e98a8
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x44dbb4
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x44dbd8
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x44dbee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x44dbec
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x671724]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x44dc17
cmp dword [esp + 0x14], 0xffffffff
je 0x44dc0b
mov esi, dword [esp + 0x14]
push esi
push dword [0x672bc0]
call fcn.004654d8
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc

Function at 0x44dc96
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x44dcac
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44dcaf
or eax, 0xffffffff
ret 4

Function at 0x44dcb2
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x44dcc0
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 8
Function at 0x44df98
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x44e010
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x44dff1
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x44dfee
cmp ecx, 0x5c
je 0x44dfee
cmp ecx, 0x2f
jne 0x44dffb
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x44dfdb
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x44e012
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x44e018
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x44e0ed
push ebx
push edi
push pe_nt_image_headers32
push 3
push edi
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44e0ec
push esi
mov esi, dword [ebp + 0x10]
push esi
call fcn.00450668
push esi
mov word [ebp - 0x20], ax
call fcn.0045068e
push esi
mov word [ebp - 0x1e], ax
call fcn.004506b0
push esi
mov word [ebp - 0x1c], ax
call fcn.004506d1
push esi
mov word [ebp - 0x1a], ax
call fcn.004506f2
push esi
mov word [ebp - 0x18], ax
call fcn.00450713
push esi
mov word [ebp - 0x16], ax
call fcn.00450734
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp dword [ebp + 0xc], 1
mov eax, edi
mov ecx, edi
pop esi
jne 0x44e0cb
lea eax, [ebp - 8]
jmp 0x44e0d9
cmp dword [ebp + 0xc], 2
jne 0x44e0d6
lea ecx, [ebp - 8]
jmp 0x44e0d9
lea edi, [ebp - 8]
push ecx
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44e280
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x44e2bc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x44e750
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x44e7b5
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44e7ad
push dword [esp + 0x10]
push dword [0x6737dc]
call fcn.00465527
test eax, eax
je 0x44e7a3
cmp dword [eax + 4], 0
je 0x44e792
push edi
push esi
push eax
call fcn.0044ecb0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x44e7c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x6737dc]
call fcn.00465527
mov esi, eax
test esi, esi
je 0x44e83f
cmp dword [esi + 4], 0
je 0x44e810
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.0044edc0
test eax, eax
je 0x44e804
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44e84a
cmp dword [esp + 8], 0
je 0x44e84a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4