joyce8/EMBER2024-capa huggingface dataset:
Function at 0x626620
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor eax, eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x268]
mov edx, dword [0x65ad54]
call fcn.00403e48
xor eax, eax
push ebp
push 0x62677b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.006303c4
test eax, eax
jne 0x626744
lea eax, [ebp - 4]
call fcn.006261cc
lea eax, [ebp - 0x26c]
mov ecx, 0x62678c
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
lea ecx, [ebp - 0x268]
mov edx, 0x3f
call fcn.0065cd4c
test eax, eax
jne 0x626709
mov edx, dword [ebp - 0x260]
mov eax, 0x626798
call fcn.0065c750
dec eax
jne 0x6266fa
test byte [ebp - 0x264], 0x10
je 0x6266da
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
call fcn.0062b708
jmp 0x6266fa
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x268]
call fcn.0065cdf0
test eax, eax
je 0x62669d
lea eax, [ebp - 0x268]
call fcn.0065ce14
lea edx, [ebp - 0x270]
mov eax, 0x6267a4
call fcn.0065ca3c
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x626782
lea eax, [ebp - 0x270]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x268]
mov edx, dword [0x65ad54]
call fcn.00403f10
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x6270a4
Capabilities:
Create process on windows

Disassembly:
add esp, 0xffffffc4
mov eax, esp
mov edx, 0x3c
call fcn.00660d08
mov dword [esp], 0x3c
mov eax, 0x6270f4
mov dword [esp + 0xc], eax
mov eax, dword [0x672258]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [0x6726ac]
mov eax, dword [eax]
call fcn.00403aa8
mov dword [esp + 0x14], eax
mov eax, dword [0x6726f4]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
push esp
call sub.shell32.dll_ShellExecuteExW
add esp, 0x3c
ret
Function at 0x627100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x6271ad
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6757a8], 0
je 0x627197
push 5
push 0
mov eax, dword [0x6757ac]
call fcn.00403aa8
push eax
mov eax, dword [0x6757a8]
push eax
push 0x6271b8
push 0
call sub.shell32.dll_ShellExecuteW
call sub.kernel32.dll_GetLastError
cmp eax, 0x2e4
jne 0x627197
lea eax, [ebp - 0x3c]
mov edx, 0x3c
call fcn.00660d08
mov dword [ebp - 0x3c], 0x3c
mov eax, 0x6271c4
mov dword [ebp - 0x30], eax
mov eax, dword [0x6757a8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x6757ac]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x40]
mov eax, dword [0x6757a8]
call fcn.0065cfe0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6271b4
lea eax, [ebp - 0x40]
call fcn.00403880
ret
Function at 0x62941c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 7], cx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x629653
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x67569c], 0
je 0x629459
mov word [ebp - 0xa], 2
jmp 0x629638
call fcn.004796d0
test eax, eax
je 0x6294a8
mov eax, dword [0x672640]
cmp dword [eax], 0
je 0x6294a8
mov eax, dword [0x672428]
mov ax, word [eax + 0xb5]
mov word [ebp - 0xc], ax
call fcn.0052ddf4
and byte [eax + 0x14], 0xfb
test byte [ebp - 0xc], 0x80
je 0x629494
call fcn.0052ddf4
or byte [eax + 0x14], 4
mov eax, dword [0x672428]
and word [eax + 0xb5], 0xff7f
mov byte [ebp - 0xe], 1
jmp 0x6294ac
mov byte [ebp - 0xe], 0
mov eax, dword [0x672764]
mov al, byte [eax + 0x10]
cmp al, 0xff
je 0x6294d7
mov edx, dword [0x672764]
and eax, 0x7f
mov edx, dword [0x672428]
mov edx, dword [edx + 0x71]
mov edx, dword [edx + 4]
test byte [edx + eax], 0x80
je 0x6294d7
xor ebx, ebx
jmp 0x6294d9
mov bl, 1
mov eax, dword [0x672094]
mov eax, dword [eax]
mov al, byte [eax + 0x16d]
xor al, 1
test al, bl
je 0x6294f8
mov eax, dword [0x672094]
mov eax, dword [eax]
call fcn.00643e30
mov eax, dword [0x672094]
mov eax, dword [eax]
mov eax, dword [eax + 0x14c]
push eax
call sub.user32.dll_IsWindowVisible
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
test bl, bl
je 0x62952e
mov al, byte [ebp - 5]
sub al, 4
jae 0x62952e
xor eax, eax
mov al, byte [ebp - 5]
add eax, 0x3e8
call fcn.0049dbf8
mov word [ebp - 0xa], 2
mov eax, dword [0x672094]
mov eax, dword [eax]
cmp byte [eax + 0x16d], 0
je 0x629559
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x14]
call fcn.0065e78c
jmp 0x6295d2
xor eax, eax
push ebp
push 0x6295b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00625e98
mov edx, dword [ebp - 0x14]
mov eax, dword [0x672764]
call fcn.004032c8
mov eax, dword [0x672764]
mov dl, byte [ebp - 5]
mov byte [eax + 4], dl
mov eax, dword [0x672764]
mov dx, word [ebp - 7]
mov word [eax + 5], dx
call fcn.006381fc
mov word [ebp - 0xa], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6295d2
cmp byte [ebp - 0xd], 0
jne 0x6295ed
push 0
mov eax, dword [0x672094]
mov eax, dword [eax]
mov eax, dword [eax + 0x14c]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 0xe], 0
je 0x62960c
mov eax, dword [0x672428]
mov dx, word [ebp - 0xc]
mov word [eax + 0xb5], dx
call fcn.0052ddf4
and byte [eax + 0x14], 0xfb
call fcn.00501d74
test eax, eax
je 0x629638
call fcn.00501d7c
call fcn.005397f4
test eax, eax
je 0x629638
call fcn.005397f4
cmp byte [eax + 0x45c], 0
je 0x629638
mov byte [eax + 0x462], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62965a
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403298
ret
Function at 0x62a510
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
xor eax, eax
push ebp
push 0x62a71d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0065b970
mov eax, dword [ebp - 4]
call fcn.0062a484
test al, al
je 0x62a63d
mov dx, 0x40
mov eax, dword [ebp - 4]
call fcn.0065b694
test eax, eax
je 0x62a56b
mov edx, dword [ebp - 4]
mov eax, 0x62a72c
call fcn.0065c750
test eax, eax
je 0x62a5de
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0062a4d0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004038bc
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x62a734
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x62a6fa
cmp eax, 2
je 0x62a6fa
call fcn.00535954
xor edx, edx
call fcn.0053484c
call fcn.00535954
mov edx, dword [ebp - 4]
call fcn.005356f8
call fcn.00535954
call fcn.00534a0c
mov eax, 0x62a740
mov edx, dword [ebp - 4]
call fcn.00629744
jmp 0x62a6fa
lea ecx, [ebp - 8]
mov edx, 7
mov eax, dword [ebp - 4]
call fcn.0065c454
mov eax, dword [ebp - 8]
mov edx, 0x62a7c4
call fcn.0065ce24
test al, al
jne 0x62a60f
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x62a7c4
call fcn.00403b24
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x62a734
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x62a6fa
mov eax, 0x62a7d4
call fcn.00629730
jmp 0x62a6fa
call fcn.005397ec
mov cl, 1
mov edx, dword [ebp - 4]
call fcn.00537bbc
test eax, eax
je 0x62a65a
call fcn.0059a5e8
jmp 0x62a6fa
mov eax, dword [0x672428]
test byte [eax + 0x209], 1
je 0x62a68f
mov eax, dword [ebp - 4]
call fcn.00539ba0
test al, al
jne 0x62a680
mov eax, dword [ebp - 4]
call fcn.00539bcc
cmp al, 0xff
je 0x62a68f
call fcn.005397ec
mov edx, dword [ebp - 4]
call fcn.00536890
jmp 0x62a6fa
mov eax, dword [0x672764]
mov byte [eax + 7], 1
mov eax, dword [ebp - 4]
call fcn.00539bcc
cmp al, 0xff
jne 0x62a6d2
mov eax, dword [ebp - 4]
call fcn.00539c84
test al, al
jne 0x62a6d2
lea ecx, [ebp - 0xc]
mov eax, 0x62a7f4
mov edx, dword [ebp - 4]
call fcn.0065d968
mov eax, dword [ebp - 0xc]
mov cl, 0xf
mov dl, 3
call fcn.00629794
cmp ax, 6
jne 0x62a6fa
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x62a734
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x62a6fa
mov eax, 0x62a8b8
mov edx, dword [ebp - 4]
call fcn.00629744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62a724
lea eax, [ebp - 0xc]
call fcn.00403274
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x62af48
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
xor eax, eax
push ebp
push 0x62afb8
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0062551c
lea eax, [ebp - 4]
call fcn.0062b120
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [ebp - 8]
call fcn.006254ec
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0065ce24
mov ebx, eax
call fcn.00625578
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62afbf
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x62afc8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x62b045
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x62b02a
mov eax, ebx
call fcn.0062af48
test al, al
jne 0x62b02a
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0062b14c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0065cfe0
mov eax, dword [ebp - 4]
call fcn.00403ab8
mov esi, eax
mov eax, ebx
call fcn.00403ab8
cmp esi, eax
jge 0x62b022
mov eax, dword [ebp - 4]
call fcn.0062afc8
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b04c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x62b210
Capabilities:
Get disk size
Set current directory

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
call fcn.0062551c
push ebx
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
call sub.kernel32.dll_GetDiskFreeSpaceW
call fcn.00625578
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x10
pop ebx
ret

Function at 0x62b57c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x65ad54]
call fcn.00403e48
xor eax, eax
push ebp
push 0x62b66f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0062b120
lea eax, [ebp - 0x270]
mov ecx, 0x62b680
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.0065cd4c
test eax, eax
jne 0x62b62d
test byte [ebp - 0x268], 0x10
je 0x62b61e
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 8]
call fcn.0062b054
test al, al
je 0x62b61e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
lea eax, [ebp - 0x26c]
call fcn.0065cdf0
test eax, eax
je 0x62b5ef
lea eax, [ebp - 0x26c]
call fcn.0065ce14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b676
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x65ad54]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x62b688
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62b6f4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
lea eax, [ebp - 4]
mov ecx, 0x62b704
mov edx, ebx
call fcn.00403b24
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], 0x54
xor eax, eax
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0x24]
push eax
call sub.shell32.dll_SHFileOperationW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b6fb
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x62b708
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x65ad54]
call fcn.00403e48
xor eax, eax
push ebp
push 0x62b802
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0062b120
lea eax, [ebp - 0x270]
mov ecx, 0x62b814
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.0065cd4c
test eax, eax
jne 0x62b7b7
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
test byte [ebp - 0x268], 0x10
jne 0x62b7a0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x62b7a8
mov eax, dword [ebp - 8]
call fcn.0062b708
lea eax, [ebp - 0x26c]
call fcn.0065cdf0
test eax, eax
je 0x62b77b
lea eax, [ebp - 0x26c]
call fcn.0065ce14
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b809
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x65ad54]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x62b92c
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd84
xor ecx, ecx
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 8]
call fcn.00403e28
lea eax, [ebp - 0x274]
mov edx, dword [0x65ad54]
call fcn.00403e48
xor eax, eax
push ebp
push 0x62bade
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0062b120
lea eax, [ebp - 8]
call fcn.0062b120
lea eax, [ebp - 0x278]
mov ecx, 0x62baf0
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x274]
mov edx, 0x3f
call fcn.0065cd4c
jmp 0x62ba80
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00403b24
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 8]
call fcn.00403b24
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
je 0x62ba75
test byte [ebp - 0x270], 0x10
je 0x62ba19
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0062b92c
pop ecx
jmp 0x62ba75
mov eax, dword [ebp + 8]
cmp byte [eax - 6], 0
jne 0x62ba2e
mov eax, dword [ebp - 0x10]
call fcn.0065cc54
test al, al
jne 0x62ba75
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x62ba75
lea ecx, [ebp - 0x27c]
mov eax, 0x62baf8
mov edx, dword [ebp - 0x10]
call fcn.0065d968
mov eax, dword [ebp - 0x27c]
mov cx, word [0x62bb14]
mov dl, 1
call fcn.0062941c
cmp ax, 2
jne 0x62ba2e
mov eax, dword [ebp + 8]
mov byte [eax - 5], 0
lea eax, [ebp - 0x274]
call fcn.0065cdf0
test eax, eax
jne 0x62ba91
mov eax, dword [ebp + 8]
cmp byte [eax - 5], 0
jne 0x62b9bc
lea eax, [ebp - 0x274]
call fcn.0065ce14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62bae5
lea eax, [ebp - 0x27c]
call fcn.00403274
lea eax, [ebp - 0x278]
call fcn.00403880
lea eax, [ebp - 0x274]
mov edx, dword [0x65ad54]
call fcn.00403f10
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403898
ret
Function at 0x62bb18
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x65ad54]
call fcn.00403e48
xor eax, eax
push ebp
push 0x62bc28
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0062b120
lea eax, [ebp - 0x270]
mov ecx, 0x62bc38
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.0065cd4c
test eax, eax
jne 0x62bbe6
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
je 0x62bbd7
test byte [ebp - 0x268], 0x10
je 0x62bbce
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.0062bb18
pop ecx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x62bbd7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x26c]
call fcn.0065cdf0
test eax, eax
je 0x62bb8b
lea eax, [ebp - 0x26c]
call fcn.0065ce14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62bc2f
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x65ad54]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x62bea8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x62bef0]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x62bebe
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x62becd
or bl, 4
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x62bedc
or bl, 8
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x62beeb
or bl, 0x10
mov eax, ebx
pop ebx
ret

Function at 0x62f904
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov word [ebp - 2], dx
push ecx
push edx
call sub.user32.dll_VkKeyScanExW
mov ebx, eax
movzx esi, bx
cmp esi, 0xffff
je 0x62f985
lea eax, [ebp - 0x104]
mov edx, pe_nt_image_headers32
call fcn.00660d08
mov eax, esi
shr eax, 8
test al, 1
je 0x62f948
mov byte [ebp - 0xf4], 0xff
mov edi, dword [ebp + 8]
push edi
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call sub.user32.dll_ToAsciiEx
mov ebx, eax
test bx, bx
jbe 0x62f985
push 1
lea eax, [ebp - 2]
push eax
movzx eax, bx
push eax
lea eax, [ebp - 4]
push eax
push 1
mov eax, edi
call fcn.0065b4c0
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov ax, word [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x62f99c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x62fb60
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.006562d0
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov edi, 1
cmp edi, 0x7f
je 0x62fa60
xor eax, eax
mov dword [ebp - 0xc], eax
inc dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
shl esi, 0xa
add esi, edi
push 0
push 0
push 2
push esi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403de4
test ebx, ebx
jle 0x62fa14
push ebx
mov eax, dword [ebp - 8]
push eax
push 2
push esi
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 8]
call fcn.0065c7b8
cmp dword [ebp - 8], 0
je 0x62fa2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, esi
mov edx, dword [ebp - 8]
call fcn.0065779c
jmp 0x62f9d8
cmp esi, 0x476
jne 0x62fa56
lea edx, [ebp - 0x10]
mov eax, 0x62fb70
call fcn.0065ca3c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, 0x476
call fcn.0065779c
jmp 0x62fa60
cmp dword [ebp - 0xc], 1
jle 0x62f9d8
inc edi
cmp edi, 0x93
jne 0x62f9ca
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00659018
call fcn.004796d0
call fcn.0047a45c
mov esi, eax
call fcn.00656a10
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov edx, 0x62fb80
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
push 8
push 0xffffffffffffffff
xor ecx, ecx
mov edx, 0x62fb94
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jge 0x62fb03
mov edx, dword [0x6729b0]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.0062fea0
call fcn.0052ddf4
mov esi, eax
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x18]
dec ebx
cmp ebx, 0
jl 0x62fb3a
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
cmp byte [edi + 0x14], 0
jne 0x62faea
mov eax, edi
call fcn.0052032c
cmp byte [edi + 0x14], 0
je 0x62fafb
mov edx, dword [edi + 0x18]
mov eax, dword [ebp - 4]
call fcn.0062fea0
dec ebx
cmp ebx, 0xffffffff
jne 0x62fad4
jmp 0x62fb3a
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x62fb3a
lea eax, [ebp - 0x14]
mov edx, ebx
add dl, 0x41
call fcn.00403418
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x6729b0]
mov ecx, dword [ecx]
mov eax, esi
call fcn.00621104
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0062fea0
dec ebx
cmp ebx, 0xffffffff
jne 0x62fb0b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62fb67
lea eax, [ebp - 0x14]
call fcn.00403274
lea eax, [ebp - 0x10]
call fcn.00403880
lea eax, [ebp - 8]
call fcn.00403880
ret

Function at 0x6303c4
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
mov dword [esp + 4], edx
mov byte [esp], al
mov eax, esp
push eax
push 0x630354
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret