joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412610
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x5d3640]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], 0
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0051f6b0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x414]
push ecx
call fcn.0051f6b0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
mov dword [ebp - 0x424], ecx
mov edx, dword [ebp - 0x41c]
cmp dword [edx + 0x14], 7
jbe 0x412698
mov dword [ebp - 0x420], 1
jmp 0x4126a2
mov dword [ebp - 0x420], 0
mov al, byte [ebp - 0x420]
mov byte [ebp - 0x415], al
movzx ecx, byte [ebp - 0x415]
test ecx, ecx
je 0x4126d3
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx]
mov dword [ebp - 0x42c], eax
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x424], ecx
mov edx, dword [ebp - 0x424]
mov dword [ebp - 0x430], edx
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x434], eax
lea ecx, [ebp - 0x414]
push ecx
push 0
mov edx, dword [ebp - 0x434]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404440
mov edx, dword [ebp - 0x428]
or edx, 1
mov dword [ebp - 0x428], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00510479
mov esp, ebp
pop ebp
ret
Function at 0x413420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b4ad
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5d3640]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [edx], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.004125b0
add esp, 4
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x48]
or eax, dword [ebp - 0x44]
jne 0x4134c2
lea ecx, [ebp - 0x54]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040c4a0
mov edx, dword [ebp - 0x14]
or edx, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00414fb0
mov eax, dword [ebp + 8]
jmp 0x4135be
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x14], 7
jbe 0x4134e0
mov dword [ebp - 0x24], 1
jmp 0x4134e7
mov dword [ebp - 0x24], 0
mov al, byte [ebp - 0x24]
mov byte [ebp - 0xd], al
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
je 0x413503
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x57a634
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.0052ba81
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x413552
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040c4a0
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00414fb0
mov eax, dword [ebp + 8]
jmp 0x4135be
lea ecx, [ebp - 0xe]
push ecx
mov edx, dword [ebp - 0x48]
push edx
lea ecx, [ebp - 0x54]
call fcn.004147c0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x3c], eax
xor ecx, ecx
shl ecx, 0
mov edx, dword [ebp - 0x3c]
add ecx, dword [edx]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x20]
push eax
push 1
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call fcn.0052a5ee
add esp, 0x10
mov eax, dword [ebp - 0x20]
push eax
call fcn.00529d28
add esp, 4
lea ecx, [ebp - 0x54]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040c4a0
mov edx, dword [ebp - 0x14]
or edx, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00414fb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x424710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x106c
call fcn.005107b0
mov eax, dword [0x5d3640]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x42473f
push str._nUsage:_n______EXEFILE___FILENAME__n
call fcn.00424b90
add esp, 4
jmp 0x424856
push 0x57b3f4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1064]
push ecx
call fcn.0052baea
add esp, 0xc
cmp dword [ebp - 0x1064], 0
jne 0x424776
mov edx, dword [ebp + 8]
push edx
push 0x57b3f8
call fcn.00424b90
add esp, 8
jmp 0x424856
lea eax, [ebp - 0x1060]
push eax
call fcn.004214d0
add esp, 4
mov ecx, dword [ebp - 0x1064]
push ecx
push 0x1000
push 1
lea edx, [ebp - 0x1004]
push edx
call fcn.0052a5ee
add esp, 0x10
mov dword [ebp - 0x106c], eax
cmp dword [ebp - 0x106c], 0
je 0x4247d0
mov eax, dword [ebp - 0x106c]
push eax
lea ecx, [ebp - 0x1004]
push ecx
lea edx, [ebp - 0x1060]
push edx
call fcn.00424210
add esp, 0xc
jmp 0x424785
mov eax, dword [ebp - 0x1064]
push eax
call fcn.00534550
add esp, 4
test eax, eax
je 0x4247f6
mov ecx, dword [ebp + 8]
push ecx
push 0x57b40c
call fcn.00424b90
add esp, 8
jmp 0x424856
lea edx, [ebp - 0x1060]
push edx
call fcn.00424350
add esp, 4
mov eax, dword [ebp - 0x1064]
push eax
call fcn.00529d28
add esp, 4
mov dword [ebp - 0x1068], 0
jmp 0x42482f
mov ecx, dword [ebp - 0x1068]
add ecx, 1
mov dword [ebp - 0x1068], ecx
cmp dword [ebp - 0x1068], 0x14
jge 0x424856
mov edx, dword [ebp - 0x1068]
movzx eax, byte [ebp + edx - 0x1048]
push eax
push 0x57b420
call fcn.00424b90
add esp, 8
jmp 0x424820
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00510479
mov esp, ebp
pop ebp
ret
Function at 0x424870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x106c
call fcn.005107b0
mov eax, dword [0x5d3640]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4248b1
cmp dword [ebp + 0x10], 0
je 0x4248a9
push str.FileNameInPut_Is_NULL
push 0x57b440
mov eax, dword [ebp + 0x10]
push eax
call fcn.00424bf0
add esp, 0xc
mov eax, dword [ebp + 0xc]
jmp 0x4249ff
push 0x57b444
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1068]
push edx
call fcn.0052baea
add esp, 0xc
cmp dword [ebp - 0x1068], 0
jne 0x4248f5
cmp dword [ebp + 0x10], 0
je 0x4248ed
mov eax, dword [ebp + 8]
push eax
push 0x57b448
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00424bf0
add esp, 0xc
mov eax, dword [ebp + 0xc]
jmp 0x4249ff
lea edx, [ebp - 0x1060]
push edx
call fcn.004214d0
add esp, 4
mov eax, dword [ebp - 0x1068]
push eax
push 0x1000
push 1
lea ecx, [ebp - 0x1004]
push ecx
call fcn.0052a5ee
add esp, 0x10
mov dword [ebp - 0x106c], eax
cmp dword [ebp - 0x106c], 0
je 0x42494f
mov edx, dword [ebp - 0x106c]
push edx
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x1060]
push ecx
call fcn.00424210
add esp, 0xc
jmp 0x424904
mov edx, dword [ebp - 0x1068]
push edx
call fcn.00534550
add esp, 4
test eax, eax
je 0x424982
cmp dword [ebp + 0x10], 0
je 0x42497d
mov eax, dword [ebp + 8]
push eax
push 0x57b45c
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00424bf0
add esp, 0xc
mov eax, dword [ebp + 0xc]
jmp 0x4249ff
lea edx, [ebp - 0x1060]
push edx
call fcn.00424350
add esp, 4
mov eax, dword [ebp - 0x1068]
push eax
call fcn.00529d28
add esp, 4
mov dword [ebp - 0x1064], 0
jmp 0x4249bb
mov ecx, dword [ebp - 0x1064]
add ecx, 1
mov dword [ebp - 0x1064], ecx
cmp dword [ebp - 0x1064], 0x14
jge 0x4249ef
mov edx, dword [ebp - 0x1064]
movzx eax, byte [ebp + edx - 0x1048]
push eax
push str._02x
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
push eax
call fcn.00424bf0
add esp, 0xc
jmp 0x4249ac
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx*2], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00510479
mov esp, ebp
pop ebp
ret
Function at 0x4323f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0x811c9dc5
mov dword [ebp - 8], 0
jmp 0x43240f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jae 0x432432
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], ecx
jmp 0x432406
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x432830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d2ad
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5d3640]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x60], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.00433d60
add esp, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x64], ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x44], edx
lea eax, [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.00437e10
mov dword [ebp - 0x54], 0x4324e0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
push 0
push 0
call fcn.005346d8
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x43293a
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x58]
mov dword [ecx], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x68], eax
jmp 0x43294b
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
push 6
call fcn.0050f76a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00437e10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x43f180
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56da5d
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5d3640]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00496bc2
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x70]
call fcn.004968fa
mov ecx, dword [ebp - 0x7c]
cmp dword [ecx + 0xc], 0
jne 0x43f1df
mov dword [ebp - 0x80], 0
jmp 0x43f1e5
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x8c], eax
push 0
mov ecx, dword [ebp - 0x8c]
push ecx
lea edx, [ebp + 0x20]
push edx
lea ecx, [ebp - 0x70]
call fcn.00497165
test eax, eax
je 0x43f23a
mov byte [ebp - 0x71], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00496c2d
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00405e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.00405e70
mov al, byte [ebp - 0x71]
jmp 0x43f2eb
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x43f2bd
lea ecx, [ebp + 0x20]
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x78]
cmp dword [eax + 0x14], 7
jbe 0x43f266
mov dword [ebp - 0x84], 1
jmp 0x43f270
mov dword [ebp - 0x84], 0
mov cl, byte [ebp - 0x84]
mov byte [ebp - 0x72], cl
movzx edx, byte [ebp - 0x72]
test edx, edx
je 0x43f298
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x98]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov byte [ebp - 0x73], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00496c2d
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00405e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.00405e70
mov al, byte [ebp - 0x73]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00510479
mov esp, ebp
pop ebp
ret 0x34
Function at 0x456040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x584828
push dword [ebp + 8]
call fcn.0052ba81
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45609d
push ebx
push edi
push esi
call fcn.00538033
push eax
call fcn.00538178
mov edi, eax
pop ecx
pop ecx
cmp edi, dword [ebp + 0x10]
jbe 0x45607c
push 0x7a
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor ebx, ebx
jmp 0x456092
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.0052a5ee
xor ebx, ebx
add esp, 0x10
cmp edi, eax
sete bl
push esi
call fcn.00529d28
pop ecx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x4560f7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
call fcn.00456c12
mov ebx, eax
test ebx, ebx
je 0x45612d
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
test edi, edi
je 0x45612d
cmp dword [ebp + 0x14], edi
jae 0x456136
push 0x7a
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
je 0x45612d
push esi
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
je 0x45612d
push edi
push eax
push dword [ebp + 0x10]
call fcn.0051f130
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
xor eax, eax
inc eax
jmp 0x45612f
Function at 0x45a852
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov ecx, dword [edi + 8]
call fcn.0045a9f7
test eax, eax
jne 0x45a964
mov ecx, dword [0x5dbbc4]
test ecx, ecx
je 0x45a880
call fcn.004455b8
mov esi, eax
jmp 0x45a882
xor esi, esi
push ebx
push 0x2800
call fcn.00534202
mov edi, eax
mov dword [esp], 0x5000
call fcn.00534202
mov ebx, eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
push dword [eax]
push str.Warning:_no_object__s_of_type:_d_in_SOUI__
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.0044fe02
add esp, 0x1c
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x45a8e3
xor ecx, ecx
push ecx
push ecx
push eax
push edi
push 0xffffffffffffffff
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
call fcn.005231b0
pop ecx
test esi, esi
je 0x45a91f
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
call dword [eax + 0x2c]
test al, al
je 0x45a91f
push dword [ebp + 4]
mov eax, dword [esi]
mov ecx, esi
push str.SOUI::SObjectFactoryMgr::CreateObject
push 0x3d
push str.E:_suohaonekeyfun_souiSOUI_srccoreSObjectFactory.cpp
push edi
push str.soui
push 1
push 0
call dword [eax + 0x34]
jmp 0x45a958
mov ebx, 0x2800
push ebx
call fcn.00534202
push 0x3d
push str.E:_suohaonekeyfun_souiSOUI_srccoreSObjectFactory.cpp
push str.SOUI::SObjectFactoryMgr::CreateObject
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push ebx
push esi
call fcn.0044fde3
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push esi
call fcn.005231b0
pop ecx
push edi
call fcn.005231b0
pop ecx
xor eax, eax
pop ebx
jmp 0x45a980
mov ecx, dword [edi + 8]
push esi
call fcn.0045a6a4
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
mov ecx, edi
push esi
call fcn.0045ac11
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x45f269
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0x78
pop ecx
mov ax, word [edi + 0x210]
add ax, word [ebp + 0xc]
cwde
cdq
idiv ecx
movzx eax, ax
mov dword [ebp + 0xc], eax
cwde
mov word [edi + 0x210], dx
cdq
xor eax, edx
sub eax, edx
movzx esi, ax
xor eax, eax
cmp ax, si
jge 0x45f30c
xor ecx, ecx
cmp word [ebp + 0xc], ax
setle cl
mov dword [ebp - 4], ecx
movzx eax, bx
push 0
mov dword [ebp - 8], eax
mov eax, dword [edi]
push ecx
push 1
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
je 0x45f2db
mov ecx, edi
call fcn.00460a96
mov ecx, dword [ebp - 4]
inc ebx
cmp bx, si
jl 0x45f2b0
jmp 0x45f311
sub esi, dword [ebp - 8]
push dword [ebp + 0x14]
mov eax, esi
push dword [ebp + 0x10]
neg eax
cmp word [ebp + 0xc], 0
movzx ecx, ax
movzx eax, si
cmovg ecx, eax
movsx eax, cx
mov ecx, edi
imul eax, eax, 0x78
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.0044de2d
jmp 0x45f311
test si, si
je 0x45f34b
mov ecx, edi
call fcn.0044bd81
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
movzx edx, word [ebp + 0x14]
mov edi, eax
movzx ecx, word [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
shl edx, 0x10
or edx, ecx
push edx
push dword [ebp + 8]
push 0x200
push edi
call esi
push 0x2000001
push edi
push 0x20
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x462fdc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
lea eax, [esi + 0x170]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, esi
test eax, eax
jne 0x463002
call fcn.0044e7f9
jmp 0x46302e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044dc8b
mov eax, dword [esi + 0x180]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x46302e
push 1
push ecx
push ecx
push eax
push 0x5870b4
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 0xc

Function at 0x465220
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5d3640]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.0051f6b0
add esp, 0xc
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x46527b
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x46528f
cmp byte [ebp - 6], 1
jne 0x46528f
cmp dword [ebp - 0x11c], 6
jne 0x46528f
xor eax, eax
inc eax
jmp 0x465291
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00510479
leave
ret
Function at 0x4712c1
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x5c
mov eax, 0x570883
call fcn.00510e9f
mov esi, ecx
push esi
lea ecx, [ebp - 0x68]
call fcn.0044a5c1
mov dword [ebp - 0x68], 0x588dc4
mov dword [ebp - 0x60], 0x588dd8
mov eax, dword [esi]
lea ecx, [ebp - 0x68]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x40], 0
push ecx
mov ecx, esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], edi
call dword [eax + 0x94]
cmp dword [ebp - 0x40], 0
jne 0x4714ad
cmp dword [ebp + 0x10], 0
je 0x47133a
cmp edi, 0xffffffff
je 0x47147e
imul ecx, edi, 0xc
xor eax, eax
add ecx, dword [esi + 0x26c]
cmp dword [ecx + 8], eax
sete al
mov dword [ecx + 8], eax
jmp 0x471470
cmp dword [esi + 0x264], 0
jne 0x47134c
cmp dword [esi + 0x260], 0
je 0x471359
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x471318
cmp dword [esi + 0x264], 0
jne 0x47136f
cmp dword [esi + 0x260], 0
je 0x471404
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x471404
cmp edi, 0xffffffff
je 0x47147e
xor eax, eax
cmp ebx, 0xffffffff
cmovne eax, ebx
mov ebx, eax
mov eax, edi
cmp ebx, edi
mov dword [ebp + 8], ebx
mov ecx, ebx
cmovg eax, ebx
cmp eax, ebx
mov dword [ebp - 0x14], eax
cmove ecx, edi
and dword [ebp + 0x10], 0
mov dword [ebp - 0x10], ecx
mov ecx, esi
call fcn.00470fc8
test eax, eax
jle 0x47147e
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov ecx, dword [esi + 0x26c]
mov edx, dword [ecx + ebx + 8]
cmp edi, dword [ebp - 0x10]
jl 0x4713db
cmp edi, dword [ebp - 0x14]
jg 0x4713db
xor eax, eax
inc eax
jmp 0x4713dd
xor eax, eax
mov dword [ecx + ebx + 8], eax
cmp edx, eax
je 0x4713ed
push edi
mov ecx, esi
call fcn.0047197f
mov ecx, esi
inc edi
add ebx, 0xc
call fcn.00470fc8
cmp edi, eax
jl 0x4713c2
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
jmp 0x47147e
or dword [esi + 0x220], 0xffffffff
mov ecx, esi
and dword [ebp + 0x10], 0
call fcn.00470fc8
test eax, eax
jle 0x47145b
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + 0x26c]
cmp ebx, edi
je 0x471443
cmp dword [eax + ecx + 8], 0
je 0x471443
and dword [eax + ecx + 8], 0
mov ecx, esi
push ebx
call fcn.0047197f
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
inc ebx
mov dword [ebp + 0xc], ecx
mov ecx, esi
call fcn.00470fc8
mov ecx, dword [ebp + 0xc]
cmp ebx, eax
jl 0x471422
mov ebx, dword [ebp + 8]
cmp edi, 0xffffffff
je 0x47147e
imul eax, edi, 0xc
add eax, dword [esi + 0x26c]
mov dword [eax + 8], 1
push edi
mov ecx, esi
mov dword [esi + 0x220], edi
call fcn.0047197f
push esi
lea ecx, [ebp - 0x3c]
call fcn.0044a5c1
mov dword [ebp - 0x3c], 0x588e48
mov dword [ebp - 0x34], 0x588e5c
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
call dword [eax + 0x94]
call fcn.00510e6d
ret 0xc
Function at 0x474979
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
mov edi, ecx
sub eax, 9
je 0x4749d9
sub eax, 1
je 0x4749bc
sub eax, 3
je 0x4749bc
test dword [edi + 0x370], 0x2000
je 0x4749f1
push esi
call fcn.00533430
pop ecx
test eax, eax
jne 0x4749f1
cmp esi, 0x2d
je 0x4749f1
cmp esi, 0x2e
je 0x4749f1
cmp esi, 0x2c
je 0x4749f1
jmp 0x474a0c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x4749f1
test dword [edi + 0x370], 0x1000
je 0x474a0c
jmp 0x4749f1
test byte [edi + 0x374], 0x80
jne 0x4749f1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x474a0c
mov eax, dword [edi + 0x380]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x474cb0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x2c
mov eax, 0x56edb0
call fcn.00510e9f
mov esi, ecx
push esi
lea ecx, [ebp - 0x38]
call fcn.0044a5c1
mov dword [ebp - 0x38], 0x5894b0
mov dword [ebp - 0x30], 0x5894c4
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], bl
mov dword [ebp - 0x18], edi
call dword [eax + 0x94]
cmp byte [ebp - 0x10], bl
jne 0x474d38
cmp edi, 0xd
jne 0x474d1c
test dword [esi + 0x370], 0x1000
jne 0x474d1c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x474d38
mov eax, dword [esi + 0x380]
push ebx
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
jmp 0x474d3b
mov dword [esi + 0x10], ebx
call fcn.00510e6d
ret 0xc