joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418ba6
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1f0
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, ecx
mov dword [ebp + 0x64], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x418bd4
push 0x64
lea ecx, [ebp - 0x80]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x418bd8
mov byte [ebp - 0x80], 0
push edi
push 0x1f
mov byte [ebp - 0x1c], 0
xor eax, eax
pop ecx
lea edi, [ebp - 0x1b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esi + 0x46c]
jmp 0x418c12
cmp byte [edi + 0x14], 0
je 0x418c0f
mov eax, dword [edi]
push dword [eax]
lea eax, [ebp - 0x1c]
push 0x4590a0
push 0x7d
push eax
call fcn.0040aa5c
add esp, 0x10
mov edi, dword [edi + 0x18]
test edi, edi
jne 0x418bf2
cmp byte [ebp - 0x1c], 0
je 0x418c53
lea eax, [ebp - 0x1c]
push eax
call fcn.00453b00
cmp eax, 0x7b
pop ecx
jbe 0x418c47
mov ecx, 0x80
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x1c]
push 0x4580a8
push eax
call fcn.00438c34
add esp, 0xc
jmp 0x418c53
lea eax, [ebp + eax - 0x1d]
cmp byte [eax], 0x20
jne 0x418c53
mov byte [eax], 0
mov eax, dword [0x4634b4]
cmp eax, 1
mov dword [ebp + 0x78], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
jg 0x418d3b
and dword [ebp + 0x6c], 0
mov dword [ebp + 0x78], 0x4565d8
cmp dword [0x463494], 0
mov edi, 0x457a74
mov eax, 0x457a78
mov dword [ebp + 0x68], edi
je 0x418c8c
mov dword [ebp + 0x68], eax
cmp dword [0x463490], 0
je 0x418c97
mov edi, eax
lea eax, [ebp - 0x180]
push eax
push 1
call fcn.00410780
pop ecx
push eax
call fcn.0041158d
push eax
push dword [0x4634b0]
lea eax, [ebp - 0x1c]
push dword [0x4634b4]
push dword [0x4634b8]
push dword [ebp + 0x78]
push dword [ebp + 0x6c]
push eax
push dword [esi + 0x474]
lea eax, [ebp - 0x80]
push dword [esi + 0x478]
push dword [ebp + 0x68]
push edi
push eax
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
push dword [ebp + 0x7c]
push ebx
call fcn.0040a9c1
mov esi, dword [ebp + 0x64]
add ebx, eax
mov eax, esi
sub eax, ebx
add eax, dword [ebp + 0x7c]
add esp, 0x44
push eax
push ebx
call fcn.004441f1
push ebx
call fcn.00453b00
add esp, 0xc
add ebx, eax
cmp dword [0x463d8c], 0
pop edi
mov eax, str._r_nPress__F5__to_refresh.
jne 0x418d20
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
sub esi, ebx
add esi, dword [ebp + 0x7c]
push eax
push esi
push ebx
call fcn.0040a9c1
add esp, 0xc
pop esi
add eax, ebx
pop ebx
add ebp, 0x70
leave
ret 8
dec eax
mov dword [ebp + 0x6c], eax
jmp 0x418c73
Function at 0x4195be
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x463c78]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x457f24
call fcn.00401525
cmp dword [ebp + 8], ebx
je 0x4195fc
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x419600
mov eax, edi
jmp 0x41967e
push esi
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x41963f
cmp byte [esi], bl
je 0x41963f
push str.ahk_default
push esi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
jne 0x419622
mov esi, 0x4565d8
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x419669
mov eax, edi
jmp 0x41967d
push dword [ebp - 4]
call fcn.00419910
pop ecx
push dword [ebp - 4]
mov byte [ebp + 0x13], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0x13], bl
je 0x41963b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jmp 0x419639
mov ecx, dword [0x463c78]
push edi
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x419910
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
mov edi, 0x103
jmp 0x4199b5
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4199bd
push dword [ebp - 0xc]
call fcn.00419910
pop ecx
push dword [ebp - 0xc]
mov byte [ebp - 1], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x4199bd
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4199bd
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
cmp eax, edi
jne 0x41994a
mov al, 1
jmp 0x4199bf
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421ca1
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x463c78]
push 0x457f24
call fcn.00401525
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043a4f2
mov esi, eax
test esi, esi
je 0x421d90
push dword [ebp + 8]
push esi
call fcn.0043a5d3
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x421d90
push ebx
push edi
push 0
push esi
mov byte [ebp + 0x1b], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
test ebx, ebx
je 0x421d2f
cmp ebx, dword [0x463d9c]
je 0x421d2f
push esi
call fcn.0043b4d6
test al, al
pop ecx
jne 0x421d2f
push 1
push ebx
push dword [0x463d9c]
call edi
test eax, eax
setne byte [ebp + 0x1b]
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x421d7d
mov ecx, dword [0x463c78]
push 1
push 0
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
mov eax, dword [0x463270]
cmp eax, 0xffffffff
jle 0x421d7d
cmp eax, 0x19
jge 0x421d73
cmp byte [0x464499], 0
je 0x421d73
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x421d7d
push 1
push eax
call fcn.0040bd90
pop ecx
pop ecx
cmp byte [ebp + 0x1b], 0
je 0x421d8e
push 0
push ebx
push dword [0x463d9c]
call edi
pop edi
pop ebx
xor eax, eax
inc eax
pop esi
pop ebp
ret 0x14
Function at 0x421d98
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x463c78]
push 0x457f24
call fcn.00401525
mov ecx, dword [0x466148]
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401525
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043a4f2
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x421e80
push edi
push ebx
push eax
mov byte [ebp + 0x17], bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
cmp edi, ebx
je 0x421e29
cmp edi, dword [0x463d9c]
je 0x421e29
push dword [ebp + 0x10]
call fcn.0043b4d6
test al, al
pop ecx
jne 0x421e29
push 1
push edi
push dword [0x463d9c]
call esi
test eax, eax
setne byte [ebp + 0x17]
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0x17], bl
mov dword [ebp - 4], eax
je 0x421e41
push ebx
push edi
push dword [0x463d9c]
call esi
cmp dword [ebp - 4], ebx
pop edi
je 0x421e80
lea eax, [ebp - 0x410]
push 0x3fb
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x421e80
lea eax, [ebp - 0x10]
push eax
push 0x43a83a
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
mov byte [ebp - 0xc], bl
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [ebp - 0xc], bl
jne 0x421e85
xor eax, eax
inc eax
jmp 0x421ecd
push dword [ebp - 8]
lea eax, [ebp - 0x410]
push 0x45674c
push 0x400
push eax
call fcn.0040aa5c
mov ecx, dword [0x463c78]
add esp, 0x10
push 1
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
mov ecx, dword [0x466148]
push 1
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x410]
push eax
call fcn.00401525
pop esi
pop ebx
leave
ret 0x10
Function at 0x423207
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov ecx, dword [0x463c78]
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x457f24
call fcn.00401525
mov ecx, dword [0x466148]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401525
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x423368
cmp byte [eax], bl
je 0x423368
mov esi, 0x105
push esi
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00438c34
lea eax, [ebp - 0x120]
push eax
call fcn.00453b00
add esp, 0x10
cmp byte [ebp + eax - 0x121], 0x5c
je 0x423295
lea ecx, [eax + 1]
cmp ecx, esi
jae 0x423368
mov byte [ebp + eax - 0x120], 0x5c
mov byte [ebp + eax - 0x11f], bl
push edi
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
test byte [0x466d90], 1
jne 0x4232c7
or dword [0x466d90], edi
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x466d8c], eax
mov eax, dword [0x466d8c]
cmp eax, ebx
je 0x423309
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x120]
push ecx
call eax
test eax, eax
je 0x423368
cmp byte [ebp + 0xc], bl
je 0x4232f6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
jmp 0x4232fc
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
shrd ecx, eax, 0x14
shr eax, 0x14
mov esi, ecx
mov edi, eax
jmp 0x423344
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x423368
cmp byte [ebp + 0xc], bl
mov eax, dword [ebp + 8]
jne 0x423335
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 4]
imul eax, dword [ebp - 0xc]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x463c78]
push 1
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
mov ecx, dword [0x466148]
push edi
push esi
call fcn.004018bb
jmp 0x42336a
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4235f9
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
push 0
push 0xffffffffffffffff
mov dword [ebp - 4], ecx
mov ecx, dword [0x463c78]
mov ebx, 0x457f24
push ebx
call fcn.00401525
mov esi, dword [ebp + 8]
test esi, esi
je 0x423652
cmp byte [esi], 0
je 0x423652
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42365b
test al, 0x10
je 0x423652
mov ecx, dword [0x463c78]
push edi
push 0
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
push 0x5c
push esi
call fcn.00454340
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4236b9
push esi
call fcn.00453b00
cmp eax, 0x104
pop ecx
jae 0x4236b4
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00438c34
mov ecx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.004235f9
cmp byte [edi + 1], 0
je 0x4236b4
mov ecx, dword [0x463c78]
call fcn.00401c84
cmp byte [eax], 0x31
jne 0x4236b9
xor eax, eax
inc eax
jmp 0x423654
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x4236cb
mov ebx, 0x45671c
mov ecx, dword [0x463c78]
push 1
push 0
push 0xffffffffffffffff
push ebx
call fcn.00401525
jmp 0x423654
Function at 0x4236e2
Capabilities:
Check for time delay via gettickcount
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
push esi
mov esi, dword [0x4660f8]
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x463c78]
push 0x457f24
call fcn.00401525
cmp byte [esi], bl
je 0x423754
push 0x45b17c
push esi
call fcn.00438ef0
test eax, eax
pop ecx
pop ecx
jne 0x423744
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x423754
mov ecx, dword [0x463c78]
push 1
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
jmp 0x423754
push 1
mov ecx, edi
call fcn.0041d507
cmp eax, 0x104
jb 0x42375c
xor eax, eax
inc eax
jmp 0x423870
lea eax, [ebp - 0x26c]
push eax
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x42377b
push ebx
jmp 0x423865
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.004538d0
lea eax, [ebp - 0x12c]
push 0x5c
push eax
call fcn.00454340
add esp, 0x10
cmp eax, ebx
je 0x4237af
mov byte [eax + 1], bl
lea eax, [ebp - 0x12c]
push eax
call fcn.00453b00
pop ecx
jmp 0x4237b7
mov byte [ebp - 0x12c], bl
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea ecx, [ebp + eax - 0x12c]
mov esi, 0x103
mov dword [ebp - 0xc], ecx
sub esi, eax
call edi
sub eax, dword [0x4642ac]
cmp eax, dword [0x463340]
jbe 0x423802
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4237fb
push 1
push 0xffffffffffffffff
call fcn.0040bd90
pop ecx
pop ecx
call edi
mov dword [0x4642ac], eax
test byte [ebp - 0x26c], 0x10
jne 0x423841
lea eax, [ebp - 0x240]
push eax
call fcn.00453b00
cmp eax, esi
pop ecx
ja 0x42383e
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0xc]
call fcn.004538d0
pop ecx
pop ecx
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x423841
inc dword [ebp - 4]
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4237ce
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp - 4]
mov ecx, dword [0x463c78]
call fcn.0040185b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423875
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov ecx, dword [0x463c78]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x457f24
call fcn.00401525
mov ecx, dword [0x466148]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401525
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4238f7
cmp byte [eax], bl
je 0x4238f7
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4238f7
mov ecx, dword [0x463c78]
push edi
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [ebp - 0x80]
push eax
call fcn.0043943c
pop ecx
pop ecx
mov ecx, dword [0x466148]
push eax
call fcn.00401525
jmp 0x4238f9
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x423e53
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10030
call fcn.004540a0
mov eax, dword [0x466148]
mov ecx, dword [0x463c78]
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x457f24
mov dword [ebp - 0xc], eax
call fcn.00401525
push dword [ebp + 0xc]
call fcn.004019fb
mov edi, edx
cmp edi, ebx
pop ecx
mov dword [ebp - 0x14], eax
jg 0x423ea4
jl 0x423f7e
cmp eax, esi
jb 0x423f7e
push 0x45937c
push dword [ebp + 8]
call fcn.0043dee8
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
je 0x423f7e
cmp edi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jl 0x423f3e
jg 0x423ecf
cmp dword [ebp - 0x14], ebx
jbe 0x423f3e
push dword [ebp + 0xc]
lea eax, [ebp - 0x10030]
push 0xffff
push eax
call fcn.0043de67
add esp, 0xc
test eax, eax
je 0x423f75
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4642ac]
cmp eax, dword [0x463340]
jbe 0x423f29
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x423f1e
push esi
push 0xffffffffffffffff
call fcn.0040bd90
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4642ac], eax
add dword [ebp - 8], esi
adc dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jl 0x423ecf
jg 0x423f3e
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
jb 0x423ecf
push dword [ebp + 0xc]
call fcn.0043dd70
lea eax, [ebp - 0x10030]
push eax
call fcn.00453b00
cmp eax, ebx
pop ecx
pop ecx
je 0x423f6e
cmp byte [ebp + eax - 0x10031], 0xa
jne 0x423f6a
dec eax
mov byte [ebp + eax - 0x10030], bl
cmp eax, ebx
jne 0x423f82
push esi
push ebx
push 0xffffffffffffffff
push ebx
jmp 0x423f8c
push dword [ebp + 0xc]
call fcn.0043dd70
pop ecx
mov eax, esi
jmp 0x423fac
push esi
push ebx
push eax
lea eax, [ebp - 0x10030]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00401525
test eax, eax
je 0x423fac
mov ecx, dword [0x463c78]
push esi
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x425389
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [0x466148]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push ebx
push ebx
push dword [ebp + 8]
call fcn.00413b50
add esp, 0x14
cmp al, bl
mov byte [ebp - 4], al
jne 0x425406
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.0042287b
add esp, 0xc
cmp eax, ebx
jne 0x4253da
push 1
push ebx
push 0xffffffffffffffff
push 0x4565d8
jmp 0x425448
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x14], ecx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
push eax
call fcn.004185cf
fstp st(0)
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.00401786
jmp 0x42544f
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
push eax
call fcn.00441cd7
cmp eax, 0x50
pop ecx
je 0x425426
cmp eax, 0x54
je 0x425421
xor eax, eax
jmp 0x425429
push 2
pop eax
jmp 0x425429
xor eax, eax
inc eax
push eax
push dword [ebp - 4]
call fcn.004189a1
pop ecx
test al, al
pop ecx
mov eax, 0x45b4b4
jne 0x425442
mov eax, 0x45b4b0
push 1
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00401525
pop esi
pop ebx
leave
ret 8
Function at 0x42ae63
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov ecx, dword [0x463c78]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x457f24
call fcn.00401525
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x45c8c4
push edi
push ebx
push 0x45c8d4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42afc7
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0x10]
cmp byte [eax], bl
je 0x42aec9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
mov ecx, dword [ebp + 0x14]
cmp byte [ecx], bl
je 0x42aeda
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2c]
mov ecx, dword [ebp + 0x18]
cmp byte [ecx], bl
je 0x42aeeb
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x1c]
push esi
mov esi, dword [ebp + 0x1c]
cmp byte [esi], bl
je 0x42af11
mov eax, dword [ebp + 0x24]
cmp byte [eax], bl
je 0x42af04
push eax
call fcn.0040198d
pop ecx
dec eax
jmp 0x42af06
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push eax
push esi
push ecx
call dword [edx + 0x44]
mov esi, dword [ebp + 0x20]
cmp byte [esi], bl
je 0x42af43
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push edi
push ebx
push ebx
push esi
call fcn.00413b50
add esp, 0x14
cmp al, bl
je 0x42af43
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
movzx ax, al
or eax, 0x600
push eax
push ecx
call dword [edx + 0x34]
mov eax, dword [ebp + 0x28]
cmp byte [eax], bl
je 0x42af5d
mov ecx, dword [ebp - 4]
mov esi, dword [ecx]
push eax
call fcn.0040198d
pop ecx
push eax
push dword [ebp - 4]
call dword [esi + 0x3c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push 0x45c8f4
push eax
call dword [ecx]
test eax, eax
pop esi
jl 0x42afbe
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x42afb5
mov ecx, dword [0x463c78]
push edi
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop ebx
leave
ret 0x24
Function at 0x42b2c6
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov ecx, dword [0x463c78]
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x457f24
call fcn.00401525
mov ecx, dword [0x466148]
push esi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401525
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x42b3c7
cmp byte [edi], bl
je 0x42b3c7
lea eax, [ebp - 8]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x42b3c7
push eax
call fcn.0043e9ea
pop ecx
mov esi, eax
push esi
push dword [ebp + 8]
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x458b44
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x42b35a
push esi
call fcn.0043dfa7
xor eax, eax
pop ecx
inc eax
jmp 0x42b3c9
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edi, ecx
mov edx, 0xffff
and edi, edx
push edi
shr ecx, 0x10
push ecx
mov ecx, eax
and ecx, edx
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
lea eax, [ebp - 0x8c]
push 0x80
push eax
call fcn.0040a9c1
push esi
call fcn.0043dfa7
mov ecx, dword [0x463c78]
add esp, 0x20
push 1
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
mov ecx, dword [0x466148]
push 1
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x8c]
push eax
call fcn.00401525
jmp 0x42b3c9
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42b3d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x42b44f
cmp byte [eax], bl
je 0x42b44f
lea ecx, [ebp - 0x128]
push ecx
push eax
call fcn.0042bf7f
lea eax, [ebp - 0x128]
push eax
call fcn.00453b00
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x54
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
mov eax, 0x457f24
jne 0x42b447
mov eax, 0x45671c
push 1
push ebx
push 0xffffffffffffffff
push eax
jmp 0x42b459
push 1
push ebx
push 0xffffffffffffffff
push 0x457f24
mov ecx, dword [0x463c78]
call fcn.00401525
pop ebx
leave
ret 4