joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d5a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
push ebx
push esi
push edi
and dword [ebp - 0x19c], 0
xor edi, edi
mov dword [ebp - 0x2a4], 0x10a3
mov eax, dword [ebp - 0x2a4]
or eax, eax
jl 0x401d99
cmp eax, dword [0x4040e0]
jge 0x401d99
cmp byte [eax + 0x4040e4], 0x54
jl 0x401e5f
mov dword [ebp - 0x2a8], 0xd32
mov eax, dword [ebp - 0x2a8]
or eax, eax
jl 0x401dc3
cmp eax, dword [0x4040e0]
jge 0x401dc3
cmp byte [eax + 0x4040e4], 0x19
jge 0x401e48
mov dword [ebp - 0x2ac], 0x140a
jmp 0x401e1b
mov eax, dword [ebp - 0x2ac]
or eax, eax
jl 0x401df0
cmp eax, dword [0x4040e0]
jge 0x401df0
movsx eax, byte [eax + 0x4040e4]
cmp eax, 0xc8
jle 0x401e31
mov eax, dword [ebp - 0x2ac]
or eax, eax
jl 0x401e11
cmp eax, dword [0x4040e0]
jge 0x401e11
movsx eax, byte [eax + 0x4040e4]
cmp eax, 0xe6
jge 0x401e31
add dword [ebp - 0x2ac], 0x10f
mov eax, dword [ebp - 0x2ac]
cmp eax, dword [ebp - 0x2a4]
jle 0x401e31
cmp eax, dword [0x4040e0]
jl 0x401dcf
sub dword [ebp - 0x2a8], 0x1e9
cmp dword [ebp - 0x2a8], 0x5d
jg 0x401da3
sub dword [ebp - 0x2a4], 0x1f3
cmp dword [ebp - 0x2a4], 0x3e
jg 0x401d79
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
and dword [ebp - 0x198], 0
lea eax, [ebp - 0x198]
push eax
call sub.KERNEL32.dll_GetVersionExA
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
mov byte [ebp - 0x104], 0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [ebp - 0x2a4], 0x252e
mov eax, dword [ebp - 0x2a4]
or eax, eax
jl 0x401ed8
cmp eax, dword [0x4040e0]
jge 0x401ed8
cmp byte [eax + 0x4040e4], 0x12
jge 0x401f9f
mov dword [ebp - 0x2a8], 0x164b
mov eax, dword [ebp - 0x2a8]
or eax, eax
jl 0x401f02
cmp eax, dword [0x4040e0]
jge 0x401f02
cmp byte [eax + 0x4040e4], 0x54
jg 0x401f88
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2ac], eax
jmp 0x401f5f
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2b0], eax
jmp 0x401f46
mov eax, dword [ebp - 0x2b0]
or eax, eax
jl 0x401f3f
cmp eax, dword [0x4040e0]
jge 0x401f3f
movsx eax, byte [eax + 0x4040e4]
cmp eax, 0x86
jle 0x401f58
add dword [ebp - 0x2b0], 0x43
mov eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0x2ac]
jge 0x401f58
or eax, eax
jg 0x401f1e
add dword [ebp - 0x2ac], 0x46
mov eax, dword [ebp - 0x2ac]
cmp eax, dword [ebp - 0x2a8]
jge 0x401f71
or eax, eax
jg 0x401f10
add dword [ebp - 0x2a8], 0xfffffccb
cmp dword [ebp - 0x2a8], 0x25
jg 0x401ee2
add dword [ebp - 0x2a4], 0xfffffd33
cmp dword [ebp - 0x2a4], 0x44
jg 0x401eb8
mov edi, esi
sub edi, 3
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4019e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4460d0]
jne 0x4019ea
repz ret
jmp fcn.00402886

Function at 0x40f868
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040340a
and dword [ebp - 4], 0
cmp dword [0x44f100], 0
mov ebx, eax
jne 0x40f919
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f9ca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40f9ca
push eax
call fcn.00403398
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44f100], eax
call esi
push eax
call fcn.00403398
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44f104], eax
call esi
push eax
call fcn.00403398
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44f108], eax
call esi
push eax
call fcn.00403398
pop ecx
mov dword [0x44f110], eax
test eax, eax
je 0x40f919
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403398
pop ecx
mov dword [0x44f10c], eax
mov eax, dword [0x44f10c]
cmp eax, ebx
je 0x40f971
cmp dword [0x44f110], ebx
je 0x40f971
push eax
call fcn.00403413
push dword [0x44f110]
mov esi, eax
call fcn.00403413
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f971
test edi, edi
je 0x40f971
call esi
test eax, eax
je 0x40f968
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f968
test byte [ebp - 0xc], 1
jne 0x40f971
or dword [ebp + 0x10], 0x200000
jmp 0x40f9aa
mov eax, dword [0x44f104]
cmp eax, ebx
je 0x40f9aa
push eax
call fcn.00403413
pop ecx
test eax, eax
je 0x40f9aa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f9aa
mov eax, dword [0x44f108]
cmp eax, ebx
je 0x40f9aa
push eax
call fcn.00403413
pop ecx
test eax, eax
je 0x40f9aa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f100]
call fcn.00403413
pop ecx
test eax, eax
je 0x40f9ca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f9cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4418e0
Capabilities:
Create pipe

Disassembly:
mov eax, dword [eax]
sub esp, 0x18
push ebx
mov ebx, dword [0x44f5ac]
push esi
mov esi, dword [0x44f4f4]
call fcn.00441836
cmp dword [0x44f5ac], 0x2f
jne 0x441925
push edi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DebugBreakProcess]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
pop edi
push esi
call fcn.00441859
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x441c30
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, 0x1540bf
xor esi, esi
cmp dword [0x44f5ac], 0xbf9
jne 0x441c4b
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
cmp dword [0x44f5ac], 0x3dc
mov dword [0x44f5a0], 0x8e468c6a
jne 0x441c7a
push esi
push 0x444800
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.nokiwubuferugenalef
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
dec edi
jne 0x441c39
cmp esi, 0x8465cb
jne 0x441c94
mov eax, dword [0x44e564]
add eax, 0xa231
mov dword [0x44f5ac], eax
cmp dword [0x44f5ac], 0x141
jne 0x441cb1
or dword [0x44f274], 0xffffffff
mov dword [0x44f270], 0xec58acac
inc esi
cmp esi, 0x123c19c
jl 0x441c7d
call fcn.00441932
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x4057c6
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x58
mov eax, 0x4f6de6
call fcn.004d0e85
mov dword [ebp - 0x54], ecx
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
and dword [edi], 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx + 4]
sub eax, 0x200
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 0xe
ja 0x40582b
push 0x10
call esi
mov ecx, 0x8000
test cx, ax
jne 0x40581f
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jne 0x40581f
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x40582b
xor ebx, ebx
inc ebx
mov dword [edi], ebx
mov eax, ebx
jmp 0x405902
mov eax, dword [ebx + 4]
sub eax, 0x100
cmp eax, 9
ja 0x4058fc
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x40585c
cmp dword [ebx + 8], 0x58
je 0x40585c
cmp dword [ebx + 8], 0x43
je 0x40585c
cmp dword [ebx + 8], 0x56
jne 0x40581f
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x405876
cmp dword [ebx + 8], 0x25
je 0x40581f
cmp dword [ebx + 8], 0x27
je 0x40581f
cmp dword [ebx + 4], 0x100
jne 0x4058fc
cmp dword [ebx + 8], 8
jne 0x4058e7
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x14]
call fcn.0040d2ac
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
je 0x40589f
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov byte [ebp - 4], 2
test esi, esi
je 0x4058ca
mov dl, bl
mov ecx, esi
call fcn.0040d349
test al, al
je 0x4058ca
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x4058ea
mov dword [edi], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
test esi, esi
je 0x405824
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x405824
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
sub eax, 0x70
cmp eax, 0xb
jbe 0x405822
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.004d0dd2
ret 0x10
Function at 0x4064c3
Capabilities:
Check if file exists

Disassembly:
push 0
mov eax, 0x4f723e
call fcn.004d0de3
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x4064e1
xor al, al
jmp 0x406594
mov eax, dword [0x5733cc]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0040666a
and dword [ebp - 4], 0
mov ecx, 0x5733cc
push dword [eax]
call fcn.004068f0
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040cf54
test esi, esi
jne 0x40655c
mov eax, dword [0x5733cc]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.00406713
mov dword [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40659c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40659c
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040cf54
push 1
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.004066bb
mov dword [ebp - 4], 6
push 0x528014
push dword [eax]
call fcn.004d87a0
pop ecx
pop ecx
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040cf54
test esi, esi
setne al
call fcn.004d0dac
ret 4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x10]
call fcn.0040cf54
jmp 0x4064da

Function at 0x40cdb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40ce09
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40cdfa
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x40cdf6
cmp esi, ecx
jae 0x40cdfa
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x40cde4
cmp esi, ecx
jb 0x40cdfe
xor eax, eax
jmp 0x40ce08
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40d401
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x4f84ea
call fcn.004d0e17
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x48], esi
and dword [ebp - 0x44], 0
xor edi, edi
mov eax, dword fs:[0x2c]
inc edi
mov dword [ebp - 0x54], esi
mov ecx, dword [eax]
mov eax, dword [0x57675c]
cmp eax, dword [ecx + 4]
jle 0x40d46f
push 0x57675c
call fcn.004d067c
cmp dword [0x57675c], 0xffffffff
pop ecx
jne 0x40d46f
mov dword [ebp - 4], edi
mov ecx, 0x576760
call fcn.0046a4f0
push 0x519b42
call fcn.004d04cc
mov byte [ebp - 4], 0
mov dword [esp], 0x57675c
call fcn.004d063d
pop ecx
push 0x528878
lea ecx, [ebp - 0x28]
call fcn.004042a7
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
push edi
lea ecx, [ebp - 0x40]
call fcn.004677d0
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.004050c4
push str.html
lea ecx, [ebp - 0x28]
call fcn.004042a7
mov byte [ebp - 4], 5
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00466a00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.004050c4
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00469200
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x40d4dd
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x50], 0x527e68
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
call fcn.004050c4
cmp edi, 0xffffffff
jne 0x40d541
xor ebx, ebx
mov dword [esi + 0x14], 7
xor eax, eax
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 4
push edi
mov dword [ebp - 0x50], 0x527e68
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], ebx
jmp 0x40d59a
lea eax, [ebp - 0x40]
mov ecx, 0x576760
push eax
call fcn.0046ad90
cmp dword [ebx + 0x14], 8
mov ecx, ebx
jb 0x40d559
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x10]
lea edx, [ebp - 0x48]
xor ebx, ebx
add eax, eax
push ebx
push edx
push eax
push ecx
push edi
mov dword [ebp - 0x48], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea ecx, [ebp - 0x40]
call fcn.00469200
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 4
mov dword [ebp - 0x50], 0x527e68
test edi, edi
je 0x40d59a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
call fcn.004050c4
mov eax, esi
call fcn.004d0dc1
ret

Function at 0x40e57a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [esp + 8], edx
jbe 0x40e5a0
push esi
mov esi, dword [esp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [esp + 0xc]
jb 0x40e58c
pop esi
mov eax, ecx
ret

Function at 0x410427
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [esp + 0xc]
lea esi, [eax + 1]
push esi
call fcn.0040d06d
push esi
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
call fcn.004103fe
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x41b284
Capabilities:
Parse credit card information

Disassembly:
push 0x2c
mov eax, 0x4fb2ab
call fcn.004d0e17
mov ebx, ecx
mov edi, ebx
lea eax, [ebx - 0x1f4]
neg edi
sbb edi, edi
and edi, eax
cmp dword [ebx + 0x14], 0
jne 0x41b2ad
xor al, al
jmp 0x41b3ca
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push eax
push 0x434
push dword [edi + 0x154]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x2c]
je 0x41b2da
mov al, 1
jmp 0x41b3ca
mov al, byte [ebp + 8]
cbw
push eax
mov dword [ebp - 0x38], eax
call fcn.004d8cd2
pop ecx
test eax, eax
je 0x41b2d3
movsx ecx, byte [ebp + 8]
movzx eax, word [ebx]
mov dword [ebp - 0x2c], ecx
cmp eax, ecx
je 0x41b2a6
call fcn.0040cc51
push eax
lea ecx, [ebp - 0x34]
call fcn.0040ca68
mov dword [ebp - 4], 1
lea eax, [ebp - 0x34]
push eax
lea ecx, [edi + 4]
call fcn.00410427
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
push esi
call fcn.004042a7
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebx + 0x14]
jae 0x41b3a2
add ebx, 4
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x41b341
mov eax, dword [ebx]
movzx eax, word [eax + ecx*2]
cmp eax, 0x3d
ja 0x41b370
je 0x41b3ae
sub eax, 0x23
je 0x41b35c
dec eax
sub eax, 1
je 0x41b35c
sub eax, 1
jmp 0x41b382
push dword [ebp - 0x38]
call fcn.004d8cbf
pop ecx
test eax, eax
jne 0x41b3ae
push 0x1056
jmp 0x41b39a
cmp eax, 0x3f
jb 0x41b384
cmp eax, 0x40
jbe 0x41b3ae
cmp eax, 0x5e
je 0x41b3ae
cmp eax, 0x60
je 0x41b3ae
cmp dword [ebx + 0x14], 8
jb 0x41b38c
mov ebx, dword [ebx]
movzx eax, word [ebx + ecx*2]
cmp dword [ebp - 0x2c], eax
je 0x41b3ae
push 0x1057
push ecx
mov ecx, edi
call fcn.0041b03e
push 0x10
call dword [sym.imp.USER32.dll_MessageBeep]
xor ebx, ebx
jmp 0x41b3b0
mov bl, 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004050c4
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.0040cf54
mov al, bl
call fcn.004d0dc1
ret 4

Function at 0x41eac4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbda4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x570074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.004d0228
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], ecx
or dword [ebp - 4], 0xffffffff
push eax
push eax
push esi
push 0x41eaa2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x41eb2a
push 8
push esi
call fcn.004d0258
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ebc2
Capabilities:
Reference sql statements

Disassembly:
push 0x34
mov eax, 0x4fbdfd
call fcn.004d0e17
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
push str.InstallerAnalytics.dll
mov dword [edi + 0xc], eax
call fcn.004042a7
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0044ea2a
pop ecx
mov byte [ebp - 4], 1
lea esi, [edi + 0x10]
push eax
mov ecx, esi
call fcn.00404252
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004050c4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004050c4
push str.SELECT__Data__FROM__Binary__WHERE__Name___InstallerAnalytics.dll
lea ecx, [ebp - 0x28]
call fcn.004042a7
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, dword [ebp + 8]
push esi
call fcn.004a4771
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004050c4
cmp dword [esi + 0x14], 8
jb 0x41ec50
mov esi, dword [esi]
mov ecx, esi
call fcn.0041eb3d
mov ebx, eax
test ebx, ebx
je 0x41ec83
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeEmbeddedUI
push ebx
call esi
push str.ShutdownEmbeddedUI
push ebx
mov dword [edi], eax
call esi
push str.EmbeddedUIHandler
push ebx
mov dword [edi + 4], eax
call esi
mov dword [edi + 8], eax
mov eax, dword [edi]
test eax, eax
je 0x41ec92
push 0
push 0
push dword [edi + 0xc]
call eax
call fcn.004d0dc1
ret 8

Function at 0x427611
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x2e4]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
push 0xfffffffffffffff0
push esi
call edi
test eax, 0x10000000
je 0x427670
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x427670
push 0xfffffffffffffff0
push esi
call edi
shr eax, 0x10
test al, 1
je 0x427670
push 0
push 0
push 0x87
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x427670
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov al, 1
jmp 0x4276a2
push 0
push esi
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov edi, eax
test edi, edi
je 0x4276a0
cmp edi, esi
je 0x4276a0
push 0
push 0
push 0x87
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x4276a0
push edi
jmp 0x427666
xor al, al
pop edi
pop esi
pop ebp
ret
Function at 0x427fb7
Capabilities:
Get disk size

Disassembly:
push 0xa8
mov eax, 0x4fe033
call fcn.004d0e85
mov edi, ecx
mov dword [ebp - 0x88], edi
cmp dword [ebp + 8], 1
je 0x427fe2
and dword [edi + 0x1a4], 0
xor eax, eax
jmp 0x42816d
and dword [ebp - 4], 0
wait
mov ecx, dword [edi + 0x258]
cmp ecx, dword [edi + 0x25c]
jne 0x427ffe
xor eax, eax
inc eax
wait
jmp 0x42816d
mov esi, ecx
mov dword [ebp - 0x98], esi
mov ebx, dword [edi + 0x25c]
cmp esi, ebx
je 0x428118
mov eax, dword [esi + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x53f6d8]
lahf
test ah, 0x44
jnp 0x42810a
xor ecx, ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x42805a
mov eax, dword [esi]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x94]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x90]
mov dword [esi + 0x24], eax
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x94]
call fcn.004f5e00
mulsd xmm0, qword [0x53f6f0]
mov eax, dword [esi + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
xorps xmm1, xmm1
comisd xmm1, xmm0
jbe 0x42810a
push 0x529110
lea ecx, [ebp - 0x48]
call fcn.004042a7
mov byte [ebp - 4], 1
push str.OutOfDiskSpace
lea ecx, [ebp - 0x30]
call fcn.004042a7
mov byte [ebp - 4], 2
mov ecx, dword [edi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x48]
push edx
lea edx, [ebp - 0x30]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004050c4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004050c4
jmp 0x427ff5
add esi, 0x30
mov dword [ebp - 0x98], esi
jmp 0x42800c
push 0x52c27c
lea ecx, [ebp - 0x30]
call fcn.004042a7
mov byte [ebp - 4], 3
push str.OutOfDiskSpace
lea ecx, [ebp - 0x48]
call fcn.004042a7
mov byte [ebp - 4], 4
mov ecx, dword [edi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x48]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.004050c4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004050c4
wait
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
call fcn.004d0dd2
ret 4
Function at 0x42a41e
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x1c
mov eax, 0x4fe521
call fcn.004d0de3
mov edi, ecx
mov dword [ebp - 0x14], edi
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx]
call dword [eax + 4]
test al, al
je 0x42a446
mov eax, dword [ebp + 0x14]
and dword [eax], 0
jmp 0x42a53a
mov esi, dword [ebp + 0x14]
push 0x17
and dword [esi], 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
inc ecx
test eax, eax
push 2
pop edx
cmovne ecx, edx
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
mov ecx, 0x8000
and ax, cx
cmp byte [edi + 0x18], bl
sete bl
cmp dword [ebp + 0xc], 8
jne 0x42a491
xor cx, cx
mov dword [esi], 1
cmp cx, ax
sbb esi, esi
neg esi
add esi, 2
jmp 0x42a4af
cmp dword [ebp + 0xc], 0x14
mov esi, ebx
jne 0x42a4af
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 1
xor cx, cx
cmp cx, ax
sbb ebx, ebx
neg ebx
add ebx, 2
push 4
pop ecx
test edi, edi
lea eax, [edi - 0x24]
cmove eax, ecx
mov dword [ebp - 0x18], eax
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edi, eax
mov dword [ebp + 0x14], edi
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
push eax
push esi
push eax
mov ecx, dword [ecx + 0x14]
push edi
mov edx, dword [ecx]
call dword [edx + 0x18]
mov eax, dword [ebp - 0x14]
push 0
push ebx
push 2
mov ecx, dword [eax + 0x14]
push edi
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp dword [ebp + 0xc], 8
je 0x42a4fb
cmp dword [ebp + 0xc], 0x14
jne 0x42a527
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x24], 0x12
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TrackMouseEvent]
mov edi, dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x42a53a
and dword [ebp + 0x14], 0
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
call fcn.004d0dac
ret 0x10