joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e12b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
xor ebp, ebp
xor eax, eax
push esi
mov esi, ecx
inc eax
push edi
push 0x20
pop ebx
or dword [esi + 0x90], 0xffffffff
mov ecx, ebp
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [esi + 0x78], ebp
cmova eax, ebx
mov dword [esi + 0x7c], ebp
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x34], ebp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x70], ebp
mov dword [esi + 0x88], ebp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x60], ebp
mov dword [esi + 0x64], ebp
mov dword [esi + 0x80], ebp
mov dword [esi + 0x84], ebp
mov dword [esi + 0x58], ebp
cmp eax, dword [esi + 0x20]
je 0x42e1d4
lea edi, [esi + 0xc8]
cmp dword [edi + 8], ebp
je 0x42e1b2
mov ecx, edi
call fcn.0042defd
add edi, 0x28
sub ebx, 1
jne 0x42e1a6
cmp dword [esi + 0x5c], ebp
je 0x42e1cc
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
mov dword [esi + 0x5c], ebp
mov eax, dword [esi]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x98], eax
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x9c], ebp
mov dword [esi + 0xa0], ebp
mov dword [esi + 0xa4], ebp
mov dword [esi + 0xa8], ebp
add ebx, esi
mov dword [esi + 0xac], ebp
mov ecx, ebx
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x58], eax
call fcn.0042df5a
mov edi, eax
test edi, edi
jne 0x42e24e
lea ecx, [ebx + 0x20]
call fcn.0042ff40
mov edi, eax
test edi, edi
jne 0x42e24e
lea ecx, [ebx + 0x1c]
call fcn.0042ff40
mov edi, eax
test edi, edi
jne 0x42e24e
push ebx
call fcn.0042d25f
mov edi, eax
test edi, edi
je 0x42e24e
mov ecx, esi
mov dword [esi + 0x44], ebp
call fcn.0042dea9
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x42e262
mov dword [esi + 0x40], eax
cmp dword [esi + 0x38], ebp
jne 0x42e274
cmp dword [esi + 0x40], ebp
jne 0x42e274
cmp dword [esi + 0x3c], ebp
jne 0x42e274
mov dword [esi + 0x44], ebp
pop edi
xor ecx, ecx
cmp dword [esi + 0x44], ebp
pop esi
pop ebp
cmovne eax, ecx
pop ebx
ret

Function at 0x42e345
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
mov edi, ecx
push 4
pop ecx
mov esi, dword [edi + 8]
mov eax, dword [edi + 0x24]
movzx edx, byte [esi + 1]
mov dword [edi + 0x20], eax
add edx, ecx
mov eax, dword [edi]
add word [eax + 2], cx
mov byte [esi + 1], dl
cmp edx, 0x7c
jbe 0x42e370
mov ecx, edi
call fcn.0042e4d1
mov ecx, edi
pop edi
pop esi
jmp fcn.0042e6d6
Function at 0x42e379
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp]
movzx ecx, byte [ebx + 1]
movzx esi, word [edi + 2]
lea edx, [ecx + ecx]
cmp esi, edx
sbb eax, eax
add ecx, 4
neg eax
add dword [ebp + 0x20], eax
mov dword [ebp + 0x14], eax
lea eax, [esi + 4]
mov word [edi + 2], ax
mov byte [ebx + 1], cl
cmp ecx, 0x7c
jbe 0x42e3b5
mov ecx, ebp
call fcn.0042e4d1
pop edi
pop esi
mov ecx, ebp
pop ebp
pop ebx
jmp fcn.0042e420

Function at 0x42e420
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 8]
movzx edx, word [eax + 4]
movzx eax, word [eax + 2]
shl edx, 0x10
or edx, eax
cmp dword [ecx + 0xc], 0
jne 0x42e441
cmp edx, dword [ecx + 0x40]
jbe 0x42e441
mov dword [ecx], edx
mov dword [ecx + 4], edx
ret
jmp fcn.0042e6d6
Function at 0x42f696
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
push 0x38
pop eax
mov ecx, dword [esi + 8]
and ecx, 0x3f
mov byte [ecx + esi + 0x40], 0x80
inc ecx
cmp ecx, eax
jbe 0x42f6e0
push 0x40
pop edx
cmp ecx, edx
je 0x42f6cb
sub edx, ecx
lea eax, [esi + 0x40]
push edx
add eax, ecx
push 0
push eax
call fcn.0041c8f0
add esp, 0xc
lea ebp, [esi + 0x40]
lea edi, [esi + 0x20]
mov edx, ebp
push 1
mov ecx, edi
call dword [esi]
push 0x38
xor ecx, ecx
pop eax
jmp 0x42f6e6
lea ebp, [esi + 0x40]
lea edi, [esi + 0x20]
sub eax, ecx
push eax
lea eax, [esi + 0x40]
add eax, ecx
push 0
push eax
call fcn.0041c8f0
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, ebp
shld eax, ecx, 3
shl ecx, 3
bswap ecx
bswap eax
mov dword [esi + 0x7c], ecx
mov ecx, edi
push 1
mov dword [esi + 0x78], eax
call dword [esi]
push 4
pop edx
mov ecx, dword [edi + 4]
mov eax, dword [edi]
lea edi, [edi + 8]
bswap eax
mov dword [ebx], eax
lea ebx, [ebx + 8]
bswap ecx
mov dword [ebx - 4], ecx
sub edx, 1
jne 0x42f71b
pop edi
mov ecx, esi
pop esi
pop ebp
pop ebx
jmp fcn.0042fab7

Function at 0x42faab
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x45e798]
mov dword [ecx], eax
jmp fcn.0042fab7

Function at 0x42fab7
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 8], 0
and dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x42ff8c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
push edx
push edi
push edi
call fcn.0041ea84
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x42ffb6
call fcn.0042ff2f
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x431b18
Capabilities:
Open clipboard

Disassembly:
push 0x1c
mov eax, 0x44b795
call fcn.00426616
mov esi, edx
xor ebx, ebx
push ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
mov byte [ebp - 0xd], al
test al, al
je 0x431bdb
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x431bd5
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea eax, [eax*2 + 2]
push eax
push 0xd
pop ecx
call fcn.00431be3
push 0
mov edx, esi
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00431514
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc ecx
push ecx
mov ecx, eax
call fcn.00431be3
push 1
pop edi
test al, al
movzx ebx, bl
push edi
mov edx, esi
lea ecx, [ebp - 0x28]
cmovne ebx, edi
call fcn.00431514
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00430c70
push dword [ebp - 0x28]
call fcn.0041aea5
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc eax
pop ecx
push eax
push 7
pop ecx
call fcn.00431be3
push dword [ebp - 0x1c]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.0041aea5
pop ecx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
call fcn.004265f3
ret

Function at 0x431be3
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x18]
mov ebp, ecx
xor ebx, ebx
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov edi, edx
call fcn.004344a4
mov esi, dword [esp + 0x10]
test al, al
je 0x431c38
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x431c38
push dword [esp + 0x18]
push edi
push eax
call fcn.0041ddc0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push ebp
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x431c38
mov esi, ebx
mov bl, 1
test esi, esi
je 0x431c43
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 4
Function at 0x432742
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x348]
sub esp, 0x348
push 0xffffffffffffffff
push 0x44b8e9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x45e008]
xor eax, ebp
mov dword [ebp + 0x344], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 4], ebx
mov edi, 0x114
mov word [eax], cx
cmp byte [0x4601a1], cl
jne 0x4327e3
lea eax, [ebp + 0x22c]
mov byte [ebp + 0x22c], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4327fa
cmp eax, edi
jae 0x4327fa
lea edx, [ebp + 0x22c]
mov byte [ebp + 0x340], bl
lea ecx, [ebp - 0x1c]
call fcn.00430434
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00431214
push dword [ebp - 0x1c]
call fcn.0041aea5
mov al, 1
jmp 0x432884
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
jne 0x432801
xor al, al
jmp 0x432885
cmp esi, edi
jae 0x43281e
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ebp + 0x228], ax
lea eax, [ebp]
push eax
call fcn.0043117e
mov al, 1
jmp 0x432885
lea ecx, [ebp - 0x1c]
call fcn.0043115a
mov dword [ebp - 4], 1
cmp esi, dword [ebp - 0x14]
jbe 0x43283b
push esi
lea ecx, [ebp - 0x1c]
call fcn.00430ba4
mov edi, dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x43287c
xor eax, eax
mov word [edi + esi*2], ax
mov eax, ebx
cmp word [edi], bx
je 0x432860
inc eax
cmp word [edi + eax*2], bx
jne 0x432859
mov dword [ebp - 0x18], eax
cmp eax, ecx
jne 0x43287c
lea eax, [esi - 1]
cmp eax, ecx
jne 0x43287c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.00431214
mov bl, 1
push edi
call fcn.0041aea5
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x344]
xor ecx, ebp
call fcn.0041ae97
add ebp, 0x348
leave
ret

Function at 0x4328b3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.004337a2
cmp eax, 0xffffffff
je 0x4328e0
mov edx, eax
and dl, 0x11
cmp dl, 1
jne 0x4328e0
and eax, 0xfffffffe
mov ecx, esi
mov edx, eax
call fcn.00432c0c
test al, al
je 0x432919
cmp byte [0x4601a1], 0
jne 0x43290a
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.0043045a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0041aea5
pop ecx
test esi, esi
jmp 0x432913
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x432919
mov al, 1
jmp 0x43291b
xor al, al
pop esi
leave
ret
Function at 0x432a63
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x44b952
call fcn.00426616
mov edi, ecx
cmp byte [0x4601a1], 0
jne 0x432a9e
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.0043045a
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.0041aea5
pop ecx
test esi, esi
jmp 0x432aaa
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x432ab0
mov al, 1
jmp 0x432af6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x432ac1
xor al, al
jmp 0x432af6
lea ecx, [ebp - 0x50]
call fcn.00433371
lea ecx, [ebp - 0x28]
call fcn.0043115a
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.00433392
test al, al
je 0x432aeb
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.0041aea5
pop ecx
mov al, bl
call fcn.004265f3
ret

Function at 0x432afc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4601a1], 0
jne 0x432b30
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0043045a
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0041aea5
pop ecx
test esi, esi
pop esi
jmp 0x432b3b
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x432b41
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x432bae
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4601a1], 0
jne 0x432be0
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0043045a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0041aea5
pop ecx
test esi, esi
pop esi
jmp 0x432be9
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x432bef
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x432c0c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4601a1], 0
push esi
mov esi, edx
jne 0x432c40
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.0043045a
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0041aea5
pop ecx
test esi, esi
jmp 0x432c4a
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x432c50
mov al, 1
jmp 0x432c52
xor al, al
pop esi
leave
ret
Function at 0x432cb3
Capabilities:
Get disk information

Disassembly:
push 0x30
mov eax, 0x44b9c6
call fcn.00426616
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.0040146c
cmp byte [0x4601a1], 0
jne 0x432da6
mov ecx, ebx
call fcn.0040146c
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor ebx, ebx
push ebx
push ebx
call edi
mov esi, eax
test esi, esi
je 0x432db8
push esi
call fcn.0041afdb
pop ecx
mov dword [ebp - 0x14], eax
push eax
push esi
mov dword [ebp - 4], ebx
call edi
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x432d9e
cmp edi, esi
ja 0x432d9e
lea ecx, [ebp - 0x30]
call fcn.00431065
mov byte [ebp - 4], 1
test edi, edi
je 0x432d90
xor esi, esi
mov eax, edi
mov edi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
cmp byte [edi + esi - 1], 0
jne 0x432d81
lea eax, [edi + ebx]
push eax
lea ecx, [ebp - 0x30]
call fcn.00431274
lea edx, [ebp - 0x30]
mov ebx, esi
lea ecx, [ebp - 0x3c]
call fcn.0043040e
mov esi, eax
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00401517
mov ecx, dword [ebp - 0x10]
push esi
call fcn.004014d8
mov byte [ebp - 4], 1
push dword [ebp - 0x3c]
call fcn.0041aea5
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
pop ecx
inc esi
sub eax, 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
jne 0x432d37
mov edi, dword [ebp - 0x20]
push dword [ebp - 0x30]
cmp ebx, edi
sete bl
call fcn.0041aea5
pop ecx
push dword [ebp - 0x14]
jmp 0x432e6a
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
push ebx
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x432dbf
xor al, al
jmp 0x432e72
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041afdb
pop ecx
mov dword [ebp - 0x1c], eax
push eax
push edi
mov dword [ebp - 4], 3
call esi
mov esi, eax
test esi, esi
je 0x432e66
cmp esi, edi
ja 0x432e66
lea ecx, [ebp - 0x30]
call fcn.0043115a
mov byte [ebp - 4], 4
mov edx, ebx
mov edi, dword [ebp - 0x1c]
mov ecx, ebx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x432e56
push 2
pop eax
mov dword [ebp - 0x18], eax
cmp word [edi + eax - 2], bx
jne 0x432e45
lea eax, [edx + edi]
push eax
lea ecx, [ebp - 0x30]
call fcn.0043117e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x20], eax
call fcn.00401517
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
call fcn.004014d8
mov eax, dword [ebp - 0x18]
mov edx, eax
mov ecx, dword [ebp - 0x14]
inc ecx
add eax, 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
cmp ecx, esi
jb 0x432e0f
mov edx, dword [ebp - 0x20]
push dword [ebp - 0x30]
cmp edx, esi
sete bl
call fcn.0041aea5
pop ecx
jmp 0x432e69
mov edi, dword [ebp - 0x1c]
push edi
call fcn.0041aea5
mov al, bl
pop ecx
call fcn.004265f3
ret
Function at 0x4337a2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4601a1], 0
jne 0x4337d4
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0043045a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0041aea5
pop ecx
mov eax, esi
pop esi
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret

Function at 0x433c15
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x433c3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x433c3f
xor al, al
jmp 0x433c53
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x437063
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
cmp esi, 0xffffffff
je 0x437141
mov edx, dword [ecx + 0x78]
mov eax, dword [ecx + 0x7c]
lea ecx, [esp + 0x2c]
and dword [esp + 0x34], 0
add eax, dword [edx + esi*4]
mov dword [esp + 0x2c], eax
mov eax, dword [edx + esi*4 + 4]
sub eax, dword [edx + esi*4]
mov dword [esp + 0x30], eax
call fcn.0043986e
mov ebx, eax
test ebx, ebx
jmp 0x437137
lea ecx, [esp + 0x2c]
call fcn.00439856
mov esi, dword [esp + 0x34]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x2c]
movzx ebp, al
movlpd qword [esp + 0x20], xmm0
mov edi, dword [esp + 0x24]
mov byte [esp + 0x3c], al
lea ecx, [esi + ecx]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
and ebp, 0xf
jbe 0x43710c
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movzx eax, byte [esi + ebx]
shld edi, ecx, 8
cdq
shl ecx, 8
or edi, edx
or ecx, eax
inc esi
cmp esi, ebp
jb 0x4370eb
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x14]
mov al, byte [esp + 0x3c]
add esi, ebp
mov dword [esp + 0x34], esi
cmp ecx, 0x6f10701
jne 0x43711e
test edi, edi
je 0x43714d
test al, 0x20
je 0x437134
lea ecx, [esp + 0x2c]
call fcn.0043986e
and dword [esp + 0x24], 0
add dword [esp + 0x34], eax
sub ebx, 1
mov dword [esp + 0x14], ebx
jne 0x4370a6
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov al, 1
jmp 0x437143
Function at 0x43b99d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x43b9ad
mov dword [esi], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x43b9f3
push edi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], edi
test esi, esi
je 0x43b9e8
add dword [esi], edx
test eax, eax
jne 0x43b9f3
call fcn.0043bed7
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x445b1f
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
mov edx, ecx
cmp edx, 8
je 0x445b62
cmp edx, 0x52
je 0x445b51
cmp ecx, 0x76
jne 0x445b5e
mov ecx, esi
call fcn.00444f4b
jmp 0x445b69
test al, al
je 0x445b5e
mov ecx, esi
call fcn.00445151
jmp 0x445b69
xor al, al
jmp 0x445b6b
mov ecx, esi
call fcn.004450e6
mov al, 1
pop esi
ret 4
Function at 0x4471d9
Capabilities:
Get file system object information

Disassembly:
push 0x1c8
mov eax, 0x44d82b
call fcn.00426649
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d4]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1b0], eax
call fcn.0043115a
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x44725c
push dword [edi + 0xc]
lea ecx, [ebp - 0x1bc]
push dword [edi + 8]
call fcn.00447159
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a8]
call fcn.0044719c
push eax
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 2
call fcn.00431214
push dword [ebp - 0x1a8]
call fcn.0041aea5
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x1bc]
call fcn.0041aea5
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1ac], eax
call fcn.004306b0
mov esi, eax
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.00430ad1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c8]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.004312c5
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.00447432
lea eax, [ebp - 0x1c8]
mov ecx, ebx
push eax
call fcn.00447432
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.004311e6
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.00430816
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00430797
lea ecx, [ebp - 0x19c]
call fcn.00430816
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00430797
lea ecx, [ebp - 0x19c]
call fcn.00430816
cmp byte [edi + 1], 0
je 0x447379
mov edx, 0x3f4
lea ecx, [ebp - 0x1a8]
call fcn.004349cf
push eax
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 6
call fcn.00430797
mov byte [ebp - 4], 5
push dword [ebp - 0x1a8]
call fcn.0041aea5
lea ecx, [ebp - 0x19c]
mov dword [esp], 0x454890
call fcn.0043074b
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x10]
call fcn.00434762
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0043074b
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
mov edx, dword [ebp - 0x19c]
mov ecx, eax
call fcn.00435155
mov edx, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1a8]
push 0
call fcn.00431514
push pe_nt_image_headers32
push 0x160
lea eax, [ebp - 0x190]
push eax
push 0x80
push dword [ebp - 0x1a8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1a8]
mov esi, eax
call fcn.0041aea5
pop ecx
test esi, esi
je 0x4473fa
push dword [ebp - 0x1b0]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.0041aea5
pop ecx
push dword [ebp - 0x1c8]
call fcn.0041aea5
pop ecx
push dword [ebp - 0x1bc]
call fcn.0041aea5
pop ecx
push dword [ebp - 0x1d4]
call fcn.0041aea5
pop ecx
call fcn.00426607
ret 0xc
Function at 0x4479bf
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x4479f2
cmp dword [edx + 8], 0xffffff65
jne 0x4479f2
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x447a2c
sub eax, 0x14
je 0x4479f9
dec eax
sub eax, 1
je 0x447a2c
xor al, al
pop esi
leave
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4479f2
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
jmp 0x4479f4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4479f2
mov ecx, esi
call fcn.004478cf
jmp 0x447a28