joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59efb4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax - 0x3c], 0
jle 0x59f06c
mov eax, dword [ebp + 8]
cmp dword [eax - 0x14], 4
jne 0x59f00c
call fcn.00431054
mov edx, dword [ebp + 8]
cmp dword [edx - 0x40], 0
jne 0x59eff8
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 0x3c]
sub ecx, 0x2a
mov edx, dword [0x67643c]
mov edx, dword [edx + 4]
add edx, 0x2a
call fcn.00430df8
jmp 0x59f00c
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 0x3c]
mov edx, dword [0x67643c]
mov edx, dword [edx + 4]
call fcn.00430df8
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x3c]
push eax
mov eax, dword [0x67643c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x44]
mov eax, dword [eax + 0x164]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x59f058
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x44]
mov eax, dword [eax + 0x160]
mov dl, 2
call fcn.006236a4
cmp ax, 2
jne 0x59f00c
call fcn.0065a09c
jmp 0x59f00c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x3c]
mov edx, dword [ebp + 8]
add dword [edx - 0x40], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x3c], edx
pop ecx
pop ebp
ret

Function at 0x5b1434
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b1539
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5b1550
mov eax, esi
call fcn.004c4404
mov edx, 0x5b1560
call fcn.004c43dc
mov esi, eax
lea eax, [ebp - 4]
push eax
mov edi, dword [ebx + 0x24]
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x2c]
call fcn.00622538
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fld xword [0x5b1568]
fmulp st(1)
fstp xword [ebp - 0x24]
wait
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 3
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x38]
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x30]
call fcn.00622538
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fld xword [0x5b1568]
fmulp st(1)
fstp xword [ebp - 0x34]
wait
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 3
lea edx, [ebp - 0x14]
mov eax, 0x5b1574
mov ecx, 1
call fcn.00659050
mov ecx, dword [ebp - 4]
mov edx, 0x5b1594
mov eax, esi
call fcn.004c41c0
mov edx, 0x5b15a4
mov eax, esi
call fcn.004c43dc
mov esi, eax
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.005b1244
pop ecx
mov ecx, dword [ebp - 4]
mov edx, 0x5b15b8
mov eax, esi
call fcn.004c41c0
xor ecx, ecx
mov edx, 0x5b15c8
mov eax, esi
call fcn.004c41c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b1540
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x5bcb28
Capabilities:
Set file attributes

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x3f7], 1
mov eax, ebx
call fcn.005bcb08
cmp byte [ebx + 0x3f6], 0
jne 0x5bcb5f
mov eax, dword [ebx + 0x160]
call fcn.006584d0
test al, al
je 0x5bcb5f
push 0x20
mov eax, dword [ebx + 0x160]
push eax
call sub.kernel32.dll_SetFileAttributesW
pop ebx
ret
Function at 0x5c0ee4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3cc]
push eax
call sub.gdi32.dll_GetRegionData
mov ebx, eax
mov eax, ebx
call fcn.00401e58
mov esi, eax
push esi
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3cc]
push eax
call sub.gdi32.dll_GetRegionData
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x5c0f67
lea eax, [esi + 0x20]
mov edx, ebx
shl edx, 4
add eax, edx
push 0xcc0020
mov edi, dword [eax + 4]
push edi
mov edx, dword [eax]
push edx
mov ecx, dword [0x672e78]
mov ecx, dword [ecx]
push ecx
mov ecx, dword [eax + 0xc]
sub ecx, edi
push ecx
mov ecx, dword [eax + 8]
sub ecx, edx
push ecx
push edi
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.gdi32.dll_BitBlt
dec ebx
cmp ebx, 0xffffffff
jne 0x5c0f28
mov eax, esi
call fcn.00401fac
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x60f998
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x155], 0
je 0x60f9fa
cmp dword [0x676744], 0
je 0x60f9d9
mov eax, dword [0x676744]
cmp ebx, dword [eax + 0x1a8]
jne 0x60f9d9
push 0
mov eax, dword [0x676744]
call fcn.00646ed0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x676744]
xor edx, edx
mov dword [eax + 0x1a8], edx
push 0
mov eax, dword [ebx + 0x15c]
call fcn.00646ed0
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x155], 0
mov eax, ebx
call fcn.0060f22c
mov eax, ebx
call fcn.0060faac
xor eax, eax
mov dword [ebx + 0x14c], eax
xor eax, eax
mov dword [ebx + 0x148], eax
pop ebx
ret

Function at 0x60faac
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x156], 0
je 0x60fac5
mov eax, dword [ebx + 0x160]
call fcn.0060faac
pop ebx
ret
xor eax, eax
mov dword [ebx + 0x12c], eax
mov eax, ebx
call fcn.0060fa78
test al, al
je 0x60fb01
push 0
mov eax, dword [0x676748]
call fcn.00646ed0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x676748]
xor edx, edx
mov dword [eax + 0x128], edx
call fcn.00466dc0
xor edx, edx
mov dword [eax + 0x38], edx
pop ebx
ret
Function at 0x61f064
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], eax
mov byte [esp + 0x10], 0
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.004036e0
mov edi, eax
mov dword [esp + 8], edi
mov eax, dword [esp + 8]
mov dword [esp + 4], eax
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.0040351c
test al, 3
jne 0x61f1c1
shr eax, 2
cmp eax, 1
jl 0x61f1c1
mov dword [esp + 0xc], eax
xor edx, edx
xor eax, eax
xor ecx, ecx
mov cl, byte [edi]
cmp ecx, 0x3d
jg 0x61f0d2
je 0x61f182
sub ecx, 0x2b
je 0x61f0ff
sub ecx, 4
je 0x61f103
dec ecx
sub ecx, 0xa
jb 0x61f0f5
jmp 0x61f107
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x61f0e4
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x61f0eb
jmp 0x61f107
mov bl, byte [edi]
sub bl, 0x41
jmp 0x61f10b
mov bl, byte [edi]
add bl, 0x1a
sub bl, 0x61
jmp 0x61f10b
mov bl, byte [edi]
add bl, 0x34
sub bl, 0x30
jmp 0x61f10b
mov bl, 0x3e
jmp 0x61f10b
mov bl, 0x3f
jmp 0x61f10b
xor edx, edx
jmp 0x61f182
mov ecx, eax
sub ecx, 1
jb 0x61f119
je 0x61f126
dec ecx
je 0x61f147
jmp 0x61f16b
mov esi, ebx
and esi, 0xff
shl esi, 2
jmp 0x61f174
mov ecx, ebx
and cl, 0xf
and ecx, 0xff
shl ecx, 0xc
mov ebp, ebx
and ebp, 0xff
shr ebp, 4
or esi, ebp
or ecx, esi
mov esi, ecx
jmp 0x61f174
mov ecx, ebx
and cl, 3
and ecx, 0xff
shl ecx, 0x16
mov ebp, ebx
and ebp, 0xff
shr ebp, 2
shl ebp, 8
or esi, ebp
or ecx, esi
mov esi, ecx
jmp 0x61f174
xor ecx, ecx
mov cl, bl
shl ecx, 0x10
or esi, ecx
add edx, 6
inc edi
inc eax
cmp eax, 4
jne 0x61f0b1
test edx, edx
jne 0x61f18d
mov byte [esp + 0x10], 0
jmp 0x61f1c1
mov eax, edx
shr eax, 3
dec eax
cmp eax, 0
jl 0x61f1ad
mov edx, esi
mov ecx, dword [esp + 8]
mov byte [ecx], dl
shr esi, 8
inc dword [esp + 8]
dec eax
cmp eax, 0xffffffff
jne 0x61f198
mov byte [esp + 0x10], 1
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0
jne 0x61f0ad
cmp byte [esp + 0x10], 0
je 0x61f1da
mov edx, dword [esp + 8]
sub edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00403804
jmp 0x61f1e2
mov eax, dword [esp]
call fcn.00403274
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x61f9f4
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x61fa54
push 0
lea eax, [esp + 8]
push eax
push 3
lea eax, [esp + 0xc]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x61fa48
cmp dword [esp + 4], 3
jne 0x61fa48
mov eax, dword [esp]
and eax, 0xffffff
cmp eax, 0xbfbbef
je 0x61fa4c
xor ebx, ebx
jmp 0x61fa4e
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x61fa5c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
xor eax, eax
push ebp
push 0x61faf6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0061feb4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.00403b24
mov ecx, 1
mov edx, 0x80000000
mov esi, dword [ebp - 4]
mov eax, esi
call fcn.0065c53c
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x61fabe
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x61fadb
mov eax, esi
call fcn.0065c55c
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x61fadb
push eax
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fafd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x620024
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x620185
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6768c4], 0
jne 0x62005e
call fcn.00650ca0
mov dword [0x6768c4], eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.00658888
mov edx, dword [ebp - 4]
mov eax, dword [0x6768c4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ebx, eax
test ebx, ebx
jge 0x620156
xor ebx, ebx
mov eax, esi
call fcn.0061ffcc
cmp eax, 2
jne 0x620094
mov bl, 1
jmp 0x620143
cmp eax, 3
jne 0x620143
lea eax, [ebp - 0x23c]
mov ecx, dword [ebp - 4]
mov edx, 0x62019c
call fcn.00403b24
mov eax, dword [ebp - 0x23c]
mov ecx, 3
mov edx, 0x80000000
call fcn.0065c53c
mov esi, eax
cmp esi, 0xffffffff
je 0x620143
lea eax, [ebp - 0x22c]
mov edx, 0x224
call fcn.0065c4dc
mov dword [ebp - 0x228], 0x224
xor eax, eax
mov dword [ebp - 0x238], eax
xor eax, eax
mov dword [ebp - 0x234], eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0xc
lea eax, [ebp - 0x238]
push eax
push 0x2d1400
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x62013d
mov edi, dword [ebp - 0x210]
cmp edi, 4
je 0x62013b
cmp edi, 7
je 0x62013b
cmp byte [ebp - 0x222], 0
je 0x62013d
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
xor ecx, ecx
mov cl, bl
mov edx, dword [ebp - 4]
mov eax, dword [0x6768c4]
call fcn.00652c78
jmp 0x620164
mov edx, ebx
mov eax, dword [0x6768c4]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62018c
lea eax, [ebp - 0x23c]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x6202fc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor eax, eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x268]
mov edx, dword [0x656638]
call fcn.00403e48
xor eax, eax
push ebp
push 0x620459
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0062a1e4
test eax, eax
jne 0x620422
lea eax, [ebp - 4]
call fcn.0061feb4
lea eax, [ebp - 0x26c]
mov ecx, 0x620468
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
lea ecx, [ebp - 0x268]
mov edx, 0x3f
call fcn.006585c8
test eax, eax
jne 0x6203e7
mov edx, dword [ebp - 0x260]
mov eax, 0x620474
call fcn.00658094
dec eax
jne 0x6203d8
test byte [ebp - 0x264], 0x10
je 0x6203b8
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
xor edx, edx
call fcn.00625670
jmp 0x6203d8
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x268]
call fcn.0065866c
test eax, eax
je 0x620379
lea eax, [ebp - 0x268]
call fcn.00658690
lea edx, [ebp - 0x270]
mov eax, 0x620480
call fcn.00658380
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x620460
lea eax, [ebp - 0x270]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x268]
mov edx, dword [0x656638]
call fcn.00403f10
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x620dac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x620e59
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x67690c], 0
je 0x620e43
push 5
push 0
mov eax, dword [0x676910]
call fcn.00403aa8
push eax
mov eax, dword [0x67690c]
push eax
push 0x620e64
push 0
call sub.shell32.dll_ShellExecuteW
call sub.kernel32.dll_GetLastError
cmp eax, 0x2e4
jne 0x620e43
lea eax, [ebp - 0x3c]
mov edx, 0x3c
call fcn.0065c4dc
mov dword [ebp - 0x3c], 0x3c
mov eax, 0x620e70
mov dword [ebp - 0x30], eax
mov eax, dword [0x67690c]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x676910]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x40]
mov eax, dword [0x67690c]
call fcn.0065885c
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x620e60
lea eax, [ebp - 0x40]
call fcn.00403880
ret
Function at 0x6230e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 7], cx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x623318
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x6767ec], 0
je 0x623125
mov word [ebp - 0xa], 2
jmp 0x6232fd
call fcn.0048e078
test eax, eax
je 0x623174
mov eax, dword [0x6729f8]
cmp dword [eax], 0
je 0x623174
mov eax, dword [0x671910]
mov ax, word [eax + 0xa9]
mov word [ebp - 0xc], ax
call fcn.00532af4
and byte [eax + 0x14], 0xfb
test byte [ebp - 0xc], 0x80
je 0x623160
call fcn.00532af4
or byte [eax + 0x14], 4
mov eax, dword [0x671910]
and word [eax + 0xa9], 0xff7f
mov byte [ebp - 0xe], 1
jmp 0x623178
mov byte [ebp - 0xe], 0
mov ebx, dword [0x672ddc]
mov bl, byte [ebx + 0x10]
cmp bl, 0xff
je 0x62319a
mov eax, dword [0x672ddc]
mov eax, ebx
call fcn.00631cfc
test al, al
jne 0x62319a
xor eax, eax
jmp 0x62319c
mov al, 1
mov ebx, eax
mov eax, dword [0x671ae4]
mov eax, dword [eax]
mov al, byte [eax + 0x16d]
xor al, 1
test al, bl
je 0x6231bd
mov eax, dword [0x671ae4]
mov eax, dword [eax]
call fcn.00640888
mov eax, dword [0x671ae4]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
push eax
call sub.user32.dll_IsWindowVisible
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
test bl, bl
je 0x6231f3
mov al, byte [ebp - 5]
sub al, 4
jae 0x6231f3
xor eax, eax
mov al, byte [ebp - 5]
add eax, 0x3e8
call fcn.004accd0
mov word [ebp - 0xa], 2
mov eax, dword [0x671ae4]
mov eax, dword [eax]
cmp byte [eax + 0x16d], 0
je 0x62321e
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x14]
call fcn.0065a024
jmp 0x623297
xor eax, eax
push ebp
push 0x62327a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0061fbf4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x672ddc]
call fcn.004032c8
mov eax, dword [0x672ddc]
mov dl, byte [ebp - 5]
mov byte [eax + 4], dl
mov eax, dword [0x672ddc]
mov dx, word [ebp - 7]
mov word [eax + 5], dx
call fcn.006316a4
mov word [ebp - 0xa], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x623297
cmp byte [ebp - 0xd], 0
jne 0x6232b2
push 0
mov eax, dword [0x671ae4]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 0xe], 0
je 0x6232d1
mov eax, dword [0x671910]
mov dx, word [ebp - 0xc]
mov word [eax + 0xa9], dx
call fcn.00532af4
and byte [eax + 0x14], 0xfb
call fcn.005093e8
test eax, eax
je 0x6232fd
call fcn.00509530
call fcn.0053c3b8
test eax, eax
je 0x6232fd
call fcn.0053c3b8
cmp byte [eax + 0x464], 0
je 0x6232fd
mov byte [eax + 0x46a], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62331f
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403298
ret
Function at 0x6237dc
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push 0
push 0x62384c
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0x24
lea eax, [ebp - 0x24]
push eax
push 4
call sub.shell32.dll_SHAppBarMessage
test al, 1
je 0x623842
lea eax, [ebp - 0x24]
push eax
push 5
call sub.shell32.dll_SHAppBarMessage
mov eax, dword [ebp - 0x18]
sub eax, 1
jb 0x62382a
je 0x623830
dec eax
je 0x623839
jmp 0x62383d
inc dword [esi]
dec dword [ebx]
jmp 0x623842
inc dword [edi]
mov eax, dword [ebp + 8]
dec dword [eax]
jmp 0x623842
dec dword [ebx]
jmp 0x623842
mov eax, dword [ebp + 8]
dec dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x624a8c
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push eax
push 0x624aa0
push 0
call sub.shell32.dll_ShellExecuteW
ret

Function at 0x624aac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x624bb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.006584d0
test al, al
je 0x624b8c
mov eax, dword [0x671f34]
cmp byte [eax], 0
je 0x624b29
mov eax, dword [0x671ca0]
cmp dword [eax], 0
jne 0x624b02
push 0x624bc0
push 0x624bd4
call sub.kernel32.dll_LoadLibraryW
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [0x671ca0]
mov dword [edx], eax
mov eax, dword [0x671a1c]
cmp dword [eax], 0
jne 0x624b29
push 0x624bec
push 0x624bd4
call sub.kernel32.dll_LoadLibraryW
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [0x671a1c]
mov dword [edx], eax
mov eax, dword [0x671ca0]
cmp dword [eax], 0
je 0x624b65
mov eax, dword [0x671a1c]
cmp dword [eax], 0
je 0x624b65
push ebx
mov eax, dword [0x671ca0]
mov eax, dword [eax]
call eax
mov ebx, eax
test ebx, ebx
je 0x624b9e
push 0
push 0
push 0
push ebx
mov eax, dword [0x671a1c]
mov eax, dword [eax]
call eax
push ebx
call sub.ole32.dll_CoTaskMemFree
jmp 0x624b9e
push 5
push 0
lea ecx, [ebp - 4]
mov eax, 0x624c08
mov edx, ebx
call fcn.006591e4
mov eax, dword [ebp - 4]
push eax
push 0x624c18
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x624b9e
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0065885c
mov eax, dword [ebp - 4]
call fcn.00624a8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x624bbb
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x624f1c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x624f99
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x624f7e
mov eax, ebx
call fcn.00624e94
test al, al
jne 0x624f7e
lea edx, [ebp - 8]
mov eax, ebx
call fcn.006250a0
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0065885c
mov eax, dword [ebp - 4]
call fcn.00403ab8
mov esi, eax
mov eax, ebx
call fcn.00403ab8
cmp esi, eax
jge 0x624f76
mov eax, dword [ebp - 4]
call fcn.00624f1c
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x624fa0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x625164
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
call fcn.0061f2ac
mov eax, ebx
call fcn.0065c550
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
call sub.kernel32.dll_GetDiskFreeSpaceW
call fcn.0061f308
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x10
pop ebx
ret

Function at 0x6254c4
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403e48
xor eax, eax
push ebp
push 0x6255b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00625074
lea eax, [ebp - 0x270]
mov ecx, 0x6255c8
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.006585c8
test eax, eax
jne 0x625575
test byte [ebp - 0x268], 0x10
je 0x625566
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 8]
call fcn.00624fa8
test al, al
je 0x625566
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
lea eax, [ebp - 0x26c]
call fcn.0065866c
test eax, eax
je 0x625537
lea eax, [ebp - 0x26c]
call fcn.00658690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6255be
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x6255d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x625659
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x671848]
cmp byte [eax], 0
jne 0x625601
mov eax, dword [0x671910]
test byte [eax + 0xd], 0x80
je 0x625609
push ebx
call sub.kernel32.dll_DeleteFileW
jmp 0x625643
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
lea eax, [ebp - 4]
mov ecx, 0x62566c
mov edx, ebx
call fcn.00403b24
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], 0x54
xor eax, eax
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0x24]
push eax
call sub.shell32.dll_SHFileOperationW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625660
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x625670
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
xor ecx, ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403e48
xor eax, eax
push ebp
push 0x62577d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00625074
lea eax, [ebp - 0x270]
mov ecx, 0x625790
mov edx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x3f
call fcn.006585c8
test eax, eax
jne 0x625732
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b24
test byte [ebp - 0x268], 0x10
jne 0x625719
test bl, bl
je 0x62570e
mov eax, dword [ebp - 8]
call fcn.006255d0
jmp 0x625723
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x625723
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00625670
lea eax, [ebp - 0x26c]
call fcn.0065866c
test eax, eax
je 0x6256e6
lea eax, [ebp - 0x26c]
call fcn.00658690
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625784
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x656638]
call fcn.00403f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret