joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
call fcn.00411ec0
mov dword [ebp - 4], eax
push 0x510024
push 0x84
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d95f6
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d95f1
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.004a7d10
add esp, 0xc
lea ecx, [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 0x44]
call fcn.00408060
mov ecx, dword [ebp - 0x44]
add ecx, 0x31c
call fcn.00401640
push eax
push 0x505488
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4d9739
push 0x60
push 0x3f3
mov ecx, dword [ebp - 0x44]
call fcn.004d94a0
push 0x60
push 0x3f7
mov ecx, dword [ebp - 0x44]
call fcn.004d94a0
push 0x60
push 0x3f4
mov ecx, dword [ebp - 0x44]
call fcn.004d94a0
push 0x60
push 0x3f8
mov ecx, dword [ebp - 0x44]
call fcn.004d94a0
push 0x60
push 0x3f5
mov ecx, dword [ebp - 0x44]
call fcn.004d94a0
push 0x60
push 0x3ec
mov ecx, dword [ebp - 0x44]
call fcn.004d94a0
lea ecx, [ebp - 0x30]
call fcn.00401640
lea ecx, [ebp - 0x40]
call fcn.00401640
lea ecx, [ebp - 0x30]
call fcn.00401640
push eax
push 0x3ec
mov ecx, dword [ebp - 0x44]
call fcn.0048f2b3
mov ecx, eax
call fcn.00402210
lea ecx, [ebp - 0x30]
call fcn.00401640
push eax
mov ecx, dword [ebp - 0x44]
call fcn.00490349
mov edx, dword [ebp - 0x28]
add edx, 0x60
mov dword [ebp - 0x28], edx
push 0x206
lea ecx, [ebp - 0x30]
call fcn.004021f0
push eax
lea ecx, [ebp - 0x30]
call fcn.004021d0
push eax
push 0
push 0
push 0
push 0x3ec
mov ecx, dword [ebp - 0x44]
call fcn.0048f2b3
mov ecx, eax
call fcn.0048f6f4
lea ecx, [ebp - 0x30]
call fcn.00401640
push eax
push 0x3f7
mov ecx, dword [ebp - 0x44]
call fcn.0048f2b3
mov ecx, eax
call fcn.00402210
lea ecx, [ebp - 0x40]
call fcn.00401640
push eax
push 0x3f0
mov ecx, dword [ebp - 0x44]
call fcn.0048f2b3
mov ecx, eax
call fcn.00402210
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
push 0x206
lea ecx, [ebp - 0x30]
call fcn.004021f0
push eax
lea ecx, [ebp - 0x30]
call fcn.004021d0
push eax
push 0
push 0
push 0
push 0x3f7
mov ecx, dword [ebp - 0x44]
call fcn.0048f2b3
mov ecx, eax
call fcn.0048f6f4
mov esp, ebp
pop ebp
ret
Function at 0x4d9b50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e66cb
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x52d4d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x270], ecx
push 0x510030
lea ecx, [ebp - 0x23c]
call fcn.004012b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x220], 0
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x258]
call fcn.004012b0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x258]
call fcn.004032f0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4d9cc6
mov eax, dword [ebp - 0x10]
push eax
call fcn.00488736
add esp, 4
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x264], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x264]
push eax
call fcn.004a7be0
add esp, 0xc
mov ecx, dword [ebp - 0x264]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
lea ecx, [ebp - 0x258]
call fcn.004032f0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [ebp - 0x25c], 0
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x260]
push ecx
push str.StringFileInfo040904E4ProductVersion
mov edx, dword [ebp - 0x264]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4d9cab
mov eax, dword [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x260]
push ecx
lea ecx, [ebp - 0x23c]
call fcn.00401860
lea ecx, [ebp - 0x23c]
call fcn.004032f0
push eax
push 0x3ed
mov ecx, dword [ebp - 0x270]
call fcn.0048f306
mov edx, dword [ebp - 0x264]
mov dword [ebp - 0x26c], edx
mov eax, dword [ebp - 0x26c]
push eax
call fcn.00488741
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.004012f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.004012f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a58c9
mov esp, ebp
pop ebp
ret
Function at 0x4d9d00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6853
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x52d4d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x258], 0
push 0x51035c
lea ecx, [ebp - 0x2c]
call fcn.004012b0
mov dword [ebp - 4], 0
call fcn.00419760
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], edx
cmp dword [ebp - 0x260], 0x60000
jb 0x4d9e0d
ja 0x4d9d82
cmp dword [ebp - 0x264], 0x17700000
jb 0x4d9e0d
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4d9e0d
push str.SHGetKnownFolderPath
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4d9e03
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0
push 0x5053a8
call dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x4d9e03
call fcn.00402b10
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x30]
push edx
call fcn.00403c70
add esp, 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401590
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x2c]
call fcn.00405e90
movzx edx, al
cmp edx, 1
jne 0x4d9e5d
xor eax, eax
mov word [ebp - 0x254], ax
push 0x206
push 0
lea ecx, [ebp - 0x252]
push ecx
call fcn.004a7be0
add esp, 0xc
lea edx, [ebp - 0x254]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404ee0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004032b0
mov edx, dword [ebp - 0x258]
or edx, 1
mov dword [ebp - 0x258], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004012f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a58c9
mov esp, ebp
pop ebp
ret 4
Function at 0x4ded00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7de2
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x52d4d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x17c], ecx
push 1
mov ecx, dword [ebp - 0x17c]
call fcn.0048bc67
mov eax, dword [ebp - 0x17c]
movzx ecx, word [eax + 0x278]
push ecx
lea edx, [ebp - 0x174]
push edx
mov ecx, dword [ebp - 0x17c]
add ecx, 0x320
call fcn.004e28a0
mov dword [ebp - 0x180], eax
mov ecx, dword [ebp - 0x180]
call fcn.00401990
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x155], al
lea ecx, [ebp - 0x174]
call fcn.004012f0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x4dee31
push 0
lea ecx, [ebp - 0x154]
call fcn.004e06e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x17c]
add ecx, 0x280
call fcn.004032f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x178], esp
push eax
call fcn.004012b0
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x17c]
movzx edx, word [ecx + 0x278]
push edx
lea ecx, [ebp - 0x154]
call fcn.00408130
lea ecx, [ebp - 0x154]
call fcn.00488ee0
cmp eax, 2
jne 0x4dee1f
mov ecx, dword [ebp - 0x17c]
call fcn.004db920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.004e0650
jmp 0x4dee4d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.004e0650
push 0
push 0
mov eax, dword [ebp - 0x17c]
push eax
push 0x4dde70
push 0
push 0
call fcn.004a82c6
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a58c9
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434008]
jne 0x40100a
repz ret
jmp fcn.00401671

Function at 0x40482b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402cea
and dword [ebp - 4], 0
cmp dword [0x435cb0], 0
mov ebx, eax
jne 0x4048dc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40498d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40498d
push eax
call fcn.00402c78
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435cb0], eax
call esi
push eax
call fcn.00402c78
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435cb4], eax
call esi
push eax
call fcn.00402c78
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435cb8], eax
call esi
push eax
call fcn.00402c78
pop ecx
mov dword [0x435cc0], eax
test eax, eax
je 0x4048dc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402c78
pop ecx
mov dword [0x435cbc], eax
mov eax, dword [0x435cbc]
cmp eax, ebx
je 0x404934
cmp dword [0x435cc0], ebx
je 0x404934
push eax
call fcn.00402cf3
push dword [0x435cc0]
mov esi, eax
call fcn.00402cf3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404934
test edi, edi
je 0x404934
call esi
test eax, eax
je 0x40492b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40492b
test byte [ebp - 0xc], 1
jne 0x404934
or dword [ebp + 0x10], 0x200000
jmp 0x40496d
mov eax, dword [0x435cb4]
cmp eax, ebx
je 0x40496d
push eax
call fcn.00402cf3
pop ecx
test eax, eax
je 0x40496d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40496d
mov eax, dword [0x435cb8]
cmp eax, ebx
je 0x40496d
push eax
call fcn.00402cf3
pop ecx
test eax, eax
je 0x40496d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435cb0]
call fcn.00402cf3
pop ecx
test eax, eax
je 0x40498d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40498f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431650
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x434008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x50e3dc]
push ebx
push esi
mov esi, dword [0x50e224]
mov ebx, eax
cmp eax, 0x5dd
jne 0x43168a
push 0
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x434c60]
call fcn.00431550
cmp dword [0x50e3dc], 0x2f
jne 0x4316a5
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.00431590
add esp, 4
cmp dword [0x50e3dc], 0x568
pop esi
pop ebx
jne 0x4316cc
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x4095f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540858
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d6024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5dc798]
cmp eax, dword [ecx + 4]
jle 0x4096b8
push 0x5dc798
call fcn.00522631
add esp, 4
cmp dword [0x5dc798], 0xffffffff
jne 0x4096b8
mov dword [ebp - 4], 1
xor eax, eax
mov dword [0x5dc7ac], 0
mov dword [0x5dc7b0], 0
mov dword [0x5dc7ac], 0
mov dword [0x5dc7b0], 7
mov word [0x5dc79c], ax
mov byte [ebp - 4], 1
push 0x576820
call fcn.005224e9
add esp, 4
mov byte [ebp - 4], 0
push 0x5dc798
call fcn.005225e7
add esp, 4
cmp dword [0x5dc7ac], 0
jne 0x40976d
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40976d
add eax, eax
cmp eax, 0x208
jae 0x4097a6
xor ecx, ecx
mov dword [ebp - 0x220], ecx
mov word [ebp + eax - 0x218], cx
xor eax, eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x230], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409724
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00407c60
mov dword [ebp - 4], 4
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x5dc79c
call fcn.00486f00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00407f30
push 0x5dc79c
mov ecx, esi
call fcn.00406c50
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052223b
mov esp, ebp
pop ebp
ret
call fcn.00522829
int3
Function at 0x409880
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5409d9
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d6024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x238], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x234], 0
cmp dword [edx + 0x14], 8
jb 0x4098d0
mov edx, dword [edx]
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40990f
xorps xmm0, xmm0
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x234], 1
jmp 0x4099f0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409965
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00407c60
mov dword [ebp - 4], 3
lea eax, [ebp - 0x230]
push 1
sub esp, 0x18
mov dword [ebp - 0x238], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
call fcn.00406c50
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00486fd0
add esp, 0x18
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.00487400
mov byte [ebp - 4], 3
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00407f30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052223b
mov esp, ebp
pop ebp
ret
Function at 0x409fe0
Capabilities:
Create directory
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540cfb
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5d6024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x5dc7b4]
cmp eax, dword [esi + 4]
jle 0x40a06b
push 0x5dc7b4
call fcn.00522631
add esp, 4
cmp dword [0x5dc7b4], 0xffffffff
jne 0x40a06b
mov dword [ebp - 4], 0
mov ecx, 0x5dc7b8
call fcn.0040a200
mov byte [ebp - 4], 0
push 0x576870
call fcn.005224e9
mov dword [ebp - 4], 0xffffffff
push 0x5dc7b4
call fcn.005225e7
add esp, 8
mov eax, dword [0x5dc77c]
cmp eax, dword [esi + 4]
jle 0x40a0e7
push 0x5dc77c
call fcn.00522631
add esp, 4
cmp dword [0x5dc77c], 0xffffffff
jne 0x40a0e7
mov dword [ebp - 4], 2
xor eax, eax
mov dword [0x5dc790], 0
mov dword [0x5dc794], 0
mov dword [0x5dc790], 0
mov dword [0x5dc794], 7
mov word [0x5dc780], ax
mov byte [ebp - 4], 2
push 0x5767d0
call fcn.005224e9
mov dword [ebp - 4], 0xffffffff
push 0x5dc77c
call fcn.005225e7
add esp, 8
cmp dword [edi + 0x14], 8
mov esi, edi
mov ebx, dword [edi + 0x10]
jb 0x40a0f4
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x40a111
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x40a100
push edx
push edi
lea eax, [ebp - 0x6c]
mov ecx, 0x5dc7b8
push eax
call fcn.0040ad70
mov esi, dword [eax + 4]
test esi, esi
je 0x40a135
cmp esi, dword [0x5dc7bc]
je 0x40a135
add esi, 0x20
jmp 0x40a13a
mov esi, 0x5dc780
cmp dword [esi + 0x10], 0
je 0x40a15a
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40a14a
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, esi
jmp 0x40a1e2
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x40a164
mov edx, dword [edi]
push ecx
lea ecx, [ebp - 0x58]
call fcn.004097b0
add esp, 4
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x40]
push edi
call fcn.00406c50
mov byte [ebp - 4], 6
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x58]
push eax
call fcn.00406c50
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x60]
mov ecx, 0x5dc7b8
push eax
call fcn.0040a480
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x28]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0xb
mov ecx, eax
call fcn.00407f30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00407f30
mov esi, dword [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00407f30
lea eax, [esi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052223b
mov esp, ebp
pop ebp
ret
Function at 0x40b830
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54117d
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5d6024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov dword [edi], 0
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 4]
sub eax, 0x200
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 0xe
ja 0x40b8b4
push 0x10
call ebx
bt ax, 0xf
jb 0x40b958
push 0x11
call ebx
bt ax, 0xf
jb 0x40b958
push 0x12
call ebx
bt ax, 0xf
jb 0x40b958
mov eax, dword [esi + 4]
sub eax, 0x100
cmp eax, 9
ja 0x40b99e
push 0x11
call ebx
bt ax, 0xf
jae 0x40b8e2
mov eax, dword [esi + 8]
cmp eax, 0x58
je 0x40b8e2
cmp eax, 0x43
je 0x40b8e2
cmp eax, 0x56
jne 0x40b958
push 0x12
call ebx
bt ax, 0xf
jae 0x40b8fa
mov eax, dword [esi + 8]
cmp eax, 0x25
je 0x40b958
cmp eax, 0x27
je 0x40b958
cmp dword [esi + 4], 0x100
jne 0x40b99e
mov eax, dword [esi + 8]
cmp eax, 8
jne 0x40b950
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x14]
call fcn.00415580
mov dword [ebp - 0x54], eax
test eax, eax
je 0x40b927
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x40b965
mov dl, 1
call fcn.00415660
test al, al
je 0x40b965
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040b5e0
mov eax, dword [esi + 8]
add eax, 0xffffff90
cmp eax, 0xb
ja 0x40b99e
mov dword [edi], 1
mov eax, 1
jmp 0x40b9a7
mov dword [edi], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040b5e0
mov eax, 1
jmp 0x40b9a7
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052223b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cc30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5417ed
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d6024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x40cd6a
mov eax, dword [0x5dc4c8]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0040d0a0
mov dword [ebp - 4], 0
mov edx, eax
mov ecx, 0x5dc4c8
call fcn.0040d000
mov bl, al
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov ecx, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40ccb1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x40cd0a
mov eax, dword [0x5dc4c8]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0040d230
mov dword [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40cd4b
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40cd4b
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cd0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0040d160
mov dword [ebp - 4], 5
mov ecx, 0x5838bc
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cd80
test dx, dx
je 0x40cd47
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cd80
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cd25
xor edi, edi
jmp 0x40cd85
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40cd6a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sbb edi, edi
or edi, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40cda4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x40cd6a
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5401d0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5d6024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4152b5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4152b5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x415297
cmp esi, edx
jae 0x4152b5
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x415285
cmp esi, edx
jae 0x4152b5
cmp word [esi], 0
je 0x4152b5
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret