joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a86d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
mov esi, ecx
je 0x46a889
mov byte [esi + 0x14], 1
mov cl, 1
jmp 0x46a88c
mov cl, byte [esi + 0x14]
cmp byte [eax + 2], 0
je 0x46a896
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x46a8a0
mov byte [esi + 0x17], 1
xor eax, eax
test cl, cl
je 0x46a8ae
cmp byte [esi + 0x1a], al
je 0x46a8ae
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x46a8bb
cmp byte [esi + 0x1b], al
je 0x46a8bb
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x46a8c8
cmp byte [esi + 0x1c], al
je 0x46a8c8
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x46a8d5
cmp byte [esi + 0x1d], al
je 0x46a8d5
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x46a8e2
cmp byte [esi + 0x1e], al
je 0x46a8e2
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x46a964
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46aa9c
mov cl, byte [esi + 0x1a]
mov dl, byte [esi + 0x1b]
test cl, cl
sete al
dec al
and byte [ebp - 0x6c], al
test dl, dl
sete al
dec al
and byte [ebp - 0x6b], al
test cl, cl
jne 0x46a927
test dl, dl
sete al
dec al
and byte [ebp - 0xfc], al
cmp byte [esi + 0x1c], 0
sete al
dec al
and byte [ebp - 0xfb], al
cmp byte [esi + 0x1d], 0
sete al
dec al
and byte [ebp - 0xfa], al
test cl, cl
sete al
dec al
and byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x46aa9c
push ebx
push edi
lea ecx, [ebp - 0xc]
call fcn.0046a4d7
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46a99c
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x46a9ba
cmp byte [esi + 0x1a], 0
jne 0x46a9ba
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.0046bbbb
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b478
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x46a9dc
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x46a9fa
cmp byte [esi + 0x1b], 0
jne 0x46a9fa
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.0046bbbb
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b478
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x46aa16
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x46aa31
cmp byte [esi + 0x1c], 0
jne 0x46aa31
push 0x11
lea ecx, [ebp - 0xc]
call fcn.0046bbbb
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b478
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x46aa4d
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x46aa68
cmp byte [esi + 0x1d], 0
jne 0x46aa68
push 0x12
lea ecx, [ebp - 0xc]
call fcn.0046bbbb
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b478
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x46aa7f
push 0x5b
call edi
test bx, ax
je 0x46aa9a
cmp byte [esi + 0x1e], 0
jne 0x46aa9a
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.0046bbbb
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b478
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x46b2c9
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bx, 1
cmp byte [ebp + 0xc], bl
je 0x46b32b
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0046bb02
mov ecx, dword [ebp - 4]
call fcn.0046a531
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0046bb02
mov ecx, dword [ebp - 4]
call fcn.0046a51a
pop esi
pop edi
mov al, bl
pop ebx
leave
ret 8

Function at 0x46b333
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x46b41a
cmp bl, 0x14
je 0x46b41a
cmp bl, 0x90
je 0x46b41a
cmp bl, 0x91
je 0x46b41a
cmp bl, 0xff
je 0x46b407
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46b3aa
movzx eax, bl
or byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, bh
mov ecx, edi
shl eax, 0x10
mov edx, eax
mov dword [ebp + 8], eax
or edx, 1
call fcn.0046a75e
cmp al, 1
jne 0x46b3cc
mov edx, dword [ebp + 8]
or edx, 0x1000001
cmp byte [esi + 0x17], 0
jne 0x46b3dd
cmp byte [esi + 0x1d], 0
jne 0x46b3dd
cmp bl, 0x12
jne 0x46b3fb
cmp byte [esi + 0x16], 0
jne 0x46b3fb
cmp byte [esi + 0x1c], 0
jne 0x46b3fb
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x104
jmp 0x46b40f
push edx
movzx eax, bl
push eax
push 0x100
jmp 0x46b40f
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46b46a
cmp bl, 0xff
je 0x46b440
mov ecx, edi
call fcn.0046a75e
push ecx
mov ecx, esi
cmp al, 1
jne 0x46b431
push 1
jmp 0x46b433
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0046bb02
jmp 0x46b46a
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.0046a531
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46b478
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x46b558
cmp bl, 0x14
je 0x46b558
cmp bl, 0x90
je 0x46b558
cmp bl, 0x91
je 0x46b558
cmp bl, 0xff
je 0x46b5a8
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46b4ef
movzx eax, bl
xor byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, bh
mov ecx, edi
shl eax, 0x10
mov edx, eax
mov dword [ebp + 8], eax
or edx, 0xc0000001
call fcn.0046a75e
cmp al, 1
jne 0x46b514
mov edx, dword [ebp + 8]
or edx, 0xc1000001
cmp byte [esi + 0x17], 0
jne 0x46b525
cmp byte [esi + 0x1d], 0
jne 0x46b525
cmp bl, 0x12
jne 0x46b543
cmp byte [esi + 0x16], 0
jne 0x46b543
cmp byte [esi + 0x1c], 0
jne 0x46b543
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x105
jmp 0x46b54d
push edx
movzx eax, bl
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46b5a8
cmp bl, 0xff
je 0x46b57e
mov ecx, edi
call fcn.0046a75e
push ecx
mov ecx, esi
cmp al, 1
jne 0x46b56f
push 3
jmp 0x46b571
push 2
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0046bb02
jmp 0x46b5a8
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 6
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.0046a51a
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46b5b6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x46b5e7
cmp byte [esi + 1], 0
jne 0x46b5e7
cmp byte [esi + 2], 0
jne 0x46b5e7
cmp byte [esi + 3], 0
jne 0x46b5e7
cmp byte [esi + 4], 0
je 0x46b790
cmp dword [edi + 0x20], 0
push ebx
je 0x46b718
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x46b718
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46b671
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x46b62f
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x46b640
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x46b64c
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x46b658
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x46b664
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x46b682
cmp byte [esi + 1], 0
je 0x46b699
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x46b6b6
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 3], 0
je 0x46b6f5
cmp byte [esi + 2], 0
jne 0x46b6de
cmp byte [edi + 0x1c], 0
jne 0x46b6de
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x46b6f0
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x46b788
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x46b788
xor ebx, ebx
cmp byte [esi], bl
je 0x46b731
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0046bb02
cmp byte [esi + 1], bl
je 0x46b749
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0046bb02
cmp byte [esi + 2], bl
je 0x46b75e
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0046bb02
cmp byte [esi + 3], bl
je 0x46b773
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0046bb02
cmp byte [esi + 4], bl
je 0x46b788
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0046bb02
mov ecx, edi
call fcn.0046a531
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x46b796
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x46b7c7
cmp byte [esi + 1], 0
jne 0x46b7c7
cmp byte [esi + 2], 0
jne 0x46b7c7
cmp byte [esi + 3], 0
jne 0x46b7c7
cmp byte [esi + 4], 0
je 0x46b97e
cmp dword [edi + 0x20], 0
push ebx
je 0x46b900
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x46b900
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46b851
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x46b80f
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x46b820
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x46b82c
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x46b838
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x46b844
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x46b862
cmp byte [esi + 1], 0
je 0x46b87b
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x46b89a
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 3], 0
je 0x46b8db
cmp byte [esi + 2], 0
jne 0x46b8c2
cmp byte [edi + 0x1c], 0
jne 0x46b8c2
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x46b8d6
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x46b976
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x46b976
cmp byte [esi], 0
push 2
pop ebx
je 0x46b91b
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0046bb02
cmp byte [esi + 1], 0
je 0x46b934
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0046bb02
cmp byte [esi + 2], 0
je 0x46b94a
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0046bb02
cmp byte [esi + 3], 0
je 0x46b960
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0046bb02
cmp byte [esi + 4], 0
je 0x46b976
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0046bb02
mov ecx, edi
call fcn.0046a51a
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x46b984
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
test esi, esi
js 0x46ba08
jne 0x46b997
push 0
jmp 0x46ba02
cmp esi, 0xf
jae 0x46ba01
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x46ba01
mov dword [ebp - 4], esi
fild dword [ebp - 4]
test esi, esi
jns 0x46b9ba
fadd qword [0x4c91e0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sbb eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
fild qword [ebp - 8]
fstp qword [ebp - 0x20]
call fcn.0041f0c5
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x46b9c3
jmp 0x46ba08
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret

Function at 0x46bb56
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.0046a85a
mov eax, dword [ebp + 8]
mov word [esi + 8], ax
test ax, ax
je 0x46bbb4
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x46bbb4
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x46bb9d
mov byte [esi + 1], 1
test bl, 2
je 0x46bba6
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x46bbb0
mov byte [esi + 4], 1
mov al, 1
jmp 0x46bbb6
xor al, al
pop esi
pop ebp
ret 4

Function at 0x46d4bf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 8], edi
je 0x46d4d9
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.0046d3f7
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], edi
pop edi
pop esi
leave
ret 8
Function at 0x46d6c0
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20034
call fcn.004422f0
push ebx
push esi
lea eax, [ebp - 0x20034]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.0046e60c
lea eax, [ebp - 0x10034]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.0046e60c
pop ecx
pop ecx
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x46d74a
cmp byte [ebp + 8], al
je 0x46d76e
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call fcn.004255c2
pop ecx
pop ecx
test eax, eax
je 0x46d82f
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x46d82f
lea ecx, [ebp - 0x20034]
call fcn.0046e9c5
test al, al
je 0x46d76e
lea ecx, [ebp - 0x10034]
call fcn.0046e9c5
test al, al
je 0x46d774
cmp byte [ebp + 8], 0
jne 0x46d7ad
xor al, al
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x10034]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040b25f
lea ecx, [ebp - 0x34]
call fcn.0046da81
mov bl, al
lea ecx, [ebp - 0x34]
neg bl
sbb bl, bl
call fcn.0040bd2c
add bl, 1
jne 0x46d76e
lea ecx, [ebp - 0x10034]
call fcn.0046e9c5
test al, al
je 0x46d76e
lea eax, [ebp - 0x20034]
push str..
push eax
call fcn.004293c8
lea eax, [ebp - 0x20034]
push eax
call fcn.00424cf3
xor ecx, ecx
mov word [ebp + eax*2 - 0x20032], cx
lea eax, [ebp - 0x10034]
push eax
call fcn.00424cf3
xor ecx, ecx
mov dword [ebp - 0x20], 2
add esp, 0x10
mov word [ebp + eax*2 - 0x10032], cx
lea eax, [ebp - 0x20034]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10034]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0x24], eax
mov eax, 0x614
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x46d76e
mov al, 1
jmp 0x46d770
Function at 0x46da81
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
mov dword [esp], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
mov eax, dword [ecx + 8]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 4]
push esi
push 0x49dc30
mov dword [esp + 0x18], eax
inc dword [eax]
call fcn.004079ed
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46db4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 2
jne 0x46dae5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46daea
jmp 0x46db52
cmp eax, 3
jne 0x46db56
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
push 0x49dc30
inc dword [eax]
call fcn.004062a0
cmp eax, 0xffffffff
je 0x46db43
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x20]
call fcn.004096d9
lea ecx, [esp + 0x18]
call fcn.0046da81
test al, al
je 0x46db41
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
mov bl, al
lea ecx, [esp + 0x18]
call fcn.0040bd2c
jmp 0x46db58
test al, 0x10
je 0x46db56
mov bl, 1
jmp 0x46db58
xor bl, bl
lea ecx, [esp + 8]
call fcn.0040bd2c
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46db69
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.0040bf07
lea ecx, [esp + 0x30]
call fcn.0040bf07
lea ecx, [esp + 0x20]
call fcn.0040bf07
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.0040557e
mov ecx, dword [esp + 0x10]
call fcn.0046e9c5
test al, al
je 0x46dbc0
push str..
lea ecx, [esp + 0x14]
call fcn.004065a4
push ebx
lea eax, [esp + 0x24]
push ebx
push eax
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x1c]
call fcn.0040694e
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x46dc60
cmp al, 1
jne 0x46dc60
test byte [esp + 0x40], 0x10
jne 0x46dc3b
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x30]
push eax
call fcn.0040be6d
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
call fcn.00407af4
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.004065a4
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x46dc57
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x46dbf3
mov al, bl
mov byte [esp + 0xe], al
jmp 0x46dbf3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x46dc6b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x20]
call fcn.0040bd2c
lea ecx, [esp + 0x30]
call fcn.0040bd2c
lea ecx, [esp + 0x10]
call fcn.0040bd2c
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46dc9c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
push ebx
push esi
push edi
push 0
mov ebx, ecx
mov dword [esp + 0x18], edx
push 2
mov dword [esp + 0x18], ebx
mov dword [esp + 0x50], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [esp + 0x48]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, dword [ebp + 8]
mov ecx, dword [ebx]
mov byte [esi], 0
call fcn.0046e723
mov ebx, eax
jmp 0x46dd92
lea eax, [esp + 0x48]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x46dd9b
lea ecx, [esp + 0x18]
call fcn.0040bf07
lea ecx, [esp + 0x28]
call fcn.0040bf07
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x3c]
call fcn.0040b25f
lea eax, [esp + 0x28]
xor edx, edx
push eax
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0x44]
call fcn.0040694e
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.0040bd2c
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
call fcn.00407af4
mov eax, dword [esp + 0x10]
push 0
push dword [eax + 4]
push dword [eax]
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.0041e2e5
test eax, eax
mov eax, dword [esp + 0x50]
je 0x46dd77
test ebx, ebx
je 0x46dd80
cmp ebx, eax
jne 0x46dd80
mov ecx, dword [esp + 0x14]
mov byte [esi], 1
mov dword [ecx], eax
lea ecx, [esp + 0x28]
call fcn.0040bd2c
lea ecx, [esp + 0x18]
call fcn.0040bd2c
cmp byte [esi], 0
je 0x46dce9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ddab
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor esi, esi
mov eax, 0x80
push esi
push eax
push 3
push esi
push 3
mov ebx, edx
push eax
push ecx
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, eax
mov dword [ebp - 8], edx
cmp edx, 0xffffffff
je 0x46de23
push 0xa
pop ecx
xor eax, eax
mov dword [ebp - 0x14], esi
push esi
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], esi
push eax
push 0x28
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], esi
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x46de23
mov eax, dword [ebp - 0x20]
mov dword [ebx], eax
mov al, 1
jmp 0x46de25
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46de2a
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [0x4d23c5], 0
push ebx
push esi
je 0x46dea6
xor esi, esi
mov eax, 0x80
push esi
push eax
push 3
push esi
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46dea6
push edi
xor eax, eax
mov dword [ebp - 0x10], 7
lea edi, [ebp - 0x1c]
mov dword [ebp - 0xc], esi
stosd dword es:[edi], eax
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test esi, esi
je 0x46dea6
xor eax, eax
cmp byte [ebp - 0x14], al
setne al
jmp 0x46deab
mov eax, 0x80004005
pop esi
pop ebx
leave
ret

Function at 0x46e387
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x22
je 0x46e3cf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46e3d2
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x46e3cf
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
jmp 0x46e3d2
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret