joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fa00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push esi
push edi
mov edi, ecx
push 1
mov ecx, dword [edi + 0x500]
mov eax, dword [ecx]
call dword [eax + 0x200]
mov ecx, dword [edi + 0x93c]
mov eax, 1
sub eax, dword [ecx - 4]
or eax, dword [ecx - 8]
jge 0x43fa3d
push 0
lea ecx, [edi + 0x93c]
call fcn.00420ff0
push 3
push dword [edi + 0x93c]
lea eax, [ebp - 0x80]
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x84], eax
call fcn.00434a60
push dword [ebp - 0x84]
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x80]
cmp eax, ecx
je 0x43fa7b
push eax
call fcn.004e43de
add esp, 4
push 0
push 0
push edi
push 0x43c810
push 0
push 0
call fcn.004e5bf9
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43faa0
Capabilities:
Create process on windows
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aedf8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x624394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x94d], 0
jne 0x43fbd8
mov byte [edi + 0x94d], 1
call fcn.00442680
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x944]
lea esi, [edi + 0x944]
cmp dword [eax - 0xc], 0
je 0x43fbc2
cmp byte [ebp + 8], 0
jne 0x43fb15
cmp dword [edi + 0x484], 2
jne 0x43fb44
mov ecx, eax
mov eax, 1
sub eax, dword [ecx - 4]
or eax, dword [ecx - 8]
jge 0x43fb2d
push 0
mov ecx, esi
call fcn.00420ff0
push 1
push 0
push 0
push dword [esi]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x43fbc2
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.00421640
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push dword [esi]
push str._select__s
push eax
call fcn.00436c10
mov esi, dword [ebp - 0x14]
mov ecx, 1
add esp, 0xc
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
or eax, ecx
jge 0x43fb8c
push 0
lea ecx, [ebp - 0x14]
call fcn.00420ff0
mov esi, dword [ebp - 0x14]
push 0xa
push 0
push esi
push str.Explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43fbc2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0
push edi
push 0x43cc70
push 0
push 0
call fcn.004e5bf9
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dda5e
mov esp, ebp
pop ebp
ret 4
Function at 0x445130
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x624394]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
nop dword [eax]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x445150
mov edx, dword [esi + 0x14]
lea ebx, [esi + 0x5c]
shr edx, 3
mov ecx, 0x38
and edx, 0x3f
mov eax, 0x78
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovb eax, ecx
mov ecx, esi
push eax
push ebx
call fcn.00445060
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00445060
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
nop dword [eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
sub edi, 1
jne 0x4451c0
xor eax, eax
mov edi, esi
xorps xmm0, xmm0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
movups xmmword [ebx], xmm0
pop edi
movups xmmword [ebx + 0x10], xmm0
pop esi
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm0
mov byte [ebx], 0x80
pop ebx
call fcn.004dda5e
mov esp, ebp
pop ebp
ret 4
Function at 0x4459f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af4f3
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x624394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xc4], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0xbc], vtable.MD5_CTX.0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xb8], 0x67452301
mov dword [ebp - 0xb4], 0xefcdab89
mov dword [ebp - 0xb0], 0x98badcfe
mov dword [ebp - 0xac], 0x10325476
movups xmmword [ebp - 0x50], xmm0
mov byte [ebp - 0x60], 0x80
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0xc]
test esi, esi
jns 0x445aab
push 0x80070057
call fcn.004212c0
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x445ac8
push esi
lea ecx, [ebp + 8]
call fcn.00435050
mov eax, dword [ebp + 8]
push esi
push eax
lea ecx, [ebp - 0xbc]
call fcn.00445060
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xbc]
call fcn.00445130
push ecx
lea edx, [ebp - 0x20]
mov dword [edi], 0
mov ecx, edi
call fcn.00445950
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov esi, dword [ebp + 8]
or eax, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x445b1a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dda5e
mov esp, ebp
pop ebp
ret
Function at 0x4491f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af858
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x624394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x14], 0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4492bf
mov edx, dword [ebp - 0x14]
add edx, 2
jns 0x449258
push 0x80070057
call fcn.004212c0
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x449273
push edx
mov ecx, esi
call fcn.00420ff0
lea eax, [ebp - 0x14]
push eax
push dword [esi]
push 0
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4492bf
mov eax, dword [esi]
test eax, eax
jne 0x449296
xor ecx, ecx
jmp 0x4492a8
push dword [eax - 8]
push eax
call fcn.004e956c
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x44924e
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x44924e
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
lea esi, [edx + 1]
mov word [eax + ecx*2], dx
jmp 0x4492c1
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4492e3
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dda5e
mov esp, ebp
pop ebp
ret 8

Function at 0x44bf5d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44bf8f
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8

Function at 0x44df86
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x44dfa9
or esi, 1
push 1
call edi
test ax, ax
jns 0x44dfb5
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x44dfc1
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x44dfcd
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x450a81
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x298]
call fcn.0044b1ee
mov edi, dword [ebp + 8]
test eax, eax
jle 0x450ad7
push ebx
lea ecx, [esi + 0x298]
mov byte [ebp + 0xb], 0
call fcn.0044ad98
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x450b37
lea ecx, [esi + 0x298]
inc ebx
call fcn.0044b1ee
cmp ebx, eax
jl 0x450aa0
sub edi, 0x100
je 0x450b9d
sub edi, 4
je 0x450b3b
dec edi
sub edi, 1
jne 0x450b92
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.004edf2b
pop ecx
mov ecx, dword [esi + 0x1e4]
lea edx, [ebp + 8]
push reloc.WS2_32.dll_select
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x45239c
call dword [eax + 0x128]
mov esi, eax
test esi, esi
je 0x450b92
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x11c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x450b94
cmp dword [esi + 0x1e8], 0
je 0x450b92
xor eax, eax
lea edi, [ebp - 0x1c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x1f8]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x1fc]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.0044df86
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x1e8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x450b92
mov ecx, dword [esi + 0x1e8]
test ecx, ecx
je 0x450bf6
mov eax, dword [ecx]
call dword [eax + 0xf4]
test al, al
je 0x450bf6
mov ecx, dword [esi + 0x1e8]
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x450bf6
mov ecx, dword [esi + 0x1e8]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.004e062f
pop ecx
pop ecx
test eax, eax
je 0x450bf6
mov ecx, dword [esi + 0x1e8]
call fcn.0046ff2c
test al, al
jne 0x450b92
mov ecx, dword [esi + 0x1e8]
test ecx, ecx
je 0x450c3e
mov eax, dword [ecx]
call dword [eax + 0xf4]
test al, al
je 0x450c3e
mov ecx, dword [esi + 0x1e8]
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x450c3e
mov ecx, dword [esi + 0x1e8]
push str.WkeWebkitUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.004e062f
pop ecx
pop ecx
test eax, eax
jne 0x450b92
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.00451cce
jmp 0x450b37
Function at 0x4519c9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [ebx + 0xa8]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x4519f5
cmp esi, dword [ebx + 0x1e8]
je 0x4519f5
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebx + 0x1e8]
cmp esi, eax
je 0x451acc
push edi
test eax, eax
je 0x451a54
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x17
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x1e8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
xor edi, edi
mov ecx, ebx
push edi
push edi
push edi
push str.killfocus
push dword [ebx + 0x1e8]
call fcn.0045157c
mov dword [ebx + 0x1e8], edi
test esi, esi
je 0x451acb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x451acb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf4]
test al, al
je 0x451acb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x100]
test al, al
je 0x451acb
push 7
pop ecx
xor eax, eax
mov dword [ebx + 0x1e8], esi
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x1e8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
xor eax, eax
mov ecx, ebx
push eax
push eax
push eax
push str.setfocus
push dword [ebx + 0x1e8]
call fcn.0045157c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x452c57
Capabilities:
Terminate process

Disassembly:
push 0x2f0
mov eax, 0x5b003f
call fcn.004de33d
mov edi, ecx
push 0xfffffffffffffff0
call fcn.0044b1ee
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, edi
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.0044b1ee
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.0044b1ee
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x14]
xor esi, esi
sub eax, dword [ebp - 0x1c]
mov ecx, edi
push 0x20
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push esi
call fcn.0044b1ee
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [edi]
lea ebx, [edi + 0x30]
mov ecx, edi
call dword [eax + 0x2c]
push eax
push dword [edi + 4]
mov ecx, ebx
call fcn.0044dbc7
mov ecx, edi
lea eax, [edi + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, ebx
call fcn.0044d080
lea ecx, [ebp - 0x2f8]
call fcn.00457a3e
mov eax, dword [edi]
lea ecx, [ebp - 0x128]
push ecx
mov ecx, edi
mov dword [ebp - 4], esi
call dword [eax + 0x24]
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 1
call fcn.0044b39d
lea ecx, [ebp - 0xa4]
test al, al
mov eax, dword [edi]
push ecx
mov ecx, edi
jne 0x452d7e
call dword [eax + 0x28]
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004d7ff0
push eax
call fcn.004e51de
pop ecx
lea ecx, [ebp - 0xa4]
movzx esi, ax
mov byte [ebp - 4], 1
call fcn.0044ac9d
mov ecx, edi
lea eax, [edi + 0x28]
neg ecx
push 0
sbb ecx, ecx
and ecx, eax
push ebx
push ecx
lea ecx, [ebp - 0x128]
call fcn.004d7ff0
push eax
push esi
lea ecx, [ebp - 0x2f8]
call fcn.0045895e
mov esi, eax
jmp 0x452dbc
call dword [eax + 0x28]
mov edx, edi
mov byte [ebp - 4], 3
neg edx
lea ecx, [edi + 0x28]
push esi
sbb edx, edx
push ebx
and edx, ecx
mov ecx, eax
push edx
push esi
call fcn.004d7ff0
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp - 0x2f8]
call fcn.0045895e
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 1
mov esi, eax
call fcn.0044ac9d
test esi, esi
jne 0x452e25
push 0xffffffffffffffff
push 0x5b4c94
lea ecx, [ebp - 0xa4]
call fcn.0044abb6
mov eax, dword [edi]
lea ecx, [ebp - 0x1ac]
push ecx
mov ecx, edi
mov byte [ebp - 4], 4
call dword [eax + 0x28]
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 5
call fcn.0044ade8
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 4
call fcn.0044ac9d
push 0x10
push str.Duilib
lea ecx, [ebp - 0xa4]
call fcn.004d7ff0
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov ecx, ebx
call fcn.0044d119
mov edx, edi
lea eax, [edi + 0x20]
neg edx
mov ecx, ebx
sbb edx, edx
and edx, eax
push edx
call fcn.0044cf5f
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x128]
call fcn.0044ac9d
lea ecx, [ebp - 0x2f8]
call fcn.0045bb9f
xor eax, eax
call fcn.004de2f8
ret 0x10
Function at 0x45be0d
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x5b05c8
call fcn.004de33d
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0045c19c
call fcn.0044db50
push eax
lea ecx, [ebp - 0x94]
call fcn.0044ab91
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044db56
mov ecx, eax
call fcn.0044b39d
test al, al
je 0x45bf23
push ebx
lea ecx, [ebp - 0x94]
call fcn.0044ae05
push edi
push 0x80
push 3
push edi
push 1
push bind
lea ecx, [ebp - 0x94]
call fcn.004d7ff0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x45be94
push str.Error_opening_file
jmp 0x45c004
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x45bf9d
cmp edi, 0x400000
ja 0x45bfae
and dword [ebp - 0x2c8], 0
push edi
call fcn.004ddf90
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x45bf0c
push ebx
call fcn.004ddf99
pop ecx
mov ecx, esi
call fcn.0045c19c
push 0
push str.Could_not_read_file
jmp 0x45c004
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0045c04f
push dword [ebp - 0x2cc]
jmp 0x45c032
call fcn.0044db56
push eax
lea ecx, [ebp - 0x94]
call fcn.0044ade8
call fcn.0044de5c
test al, al
je 0x45bf44
call fcn.0044db5c
jmp 0x45bf5b
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.004d7ff0
push eax
call fcn.004728fa
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x45bf6c
push eax
push str.Error_opening_zip_file
jmp 0x45c004
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.0047233b
add esp, 0x14
test eax, eax
je 0x45bf93
push 0
push str.Could_not_find_ziped_file
jmp 0x45c004
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x45bfa6
push 0
push str.File_is_empty
jmp 0x45c004
cmp ebx, 0x400000
jbe 0x45bfb7
push 0
push 0x5b66e0
jmp 0x45c004
push ebx
call fcn.004ddf90
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.00472cba
add esp, 0x18
test eax, eax
je 0x45c00f
cmp eax, 0x600
je 0x45c00f
push dword [ebp - 0x2c8]
call fcn.004ddf99
pop ecx
call fcn.0044de5c
test al, al
jne 0x45bffd
push edi
call fcn.00472195
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0045c1c4
mov bl, al
jmp 0x45c03a
call fcn.0044de5c
test al, al
jne 0x45c01f
push edi
call fcn.00472195
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.0045c04f
push edi
mov bl, al
call fcn.004ddf99
pop ecx
lea ecx, [ebp - 0x94]
call fcn.0044ac9d
mov al, bl
call fcn.004de2f8
ret 8
Function at 0x46c0da
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x46c0fe
cmp dword [esi + 8], edi
jge 0x46c0f6
push esi
call fcn.00467a37
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x46c127
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x46c10a
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x46c141
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x46c132
xor dl, dl
jmp 0x46c137
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x46c129
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x46c176
push str.zlib_corrupt
call fcn.00467960
add esp, 4
jmp 0x46c1b6
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x46c186
push str.read_past_buffer
jmp 0x46c16c
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x46c1a0
push edi
push ecx
push esi
call fcn.0046eca3
add esp, 0xc
test eax, eax
je 0x46c1b6
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004e0bc0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x471d9a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x614], edi
je 0x471e11
cmp dword [ebp + 8], 0x100
jne 0x471e00
cmp word [ebp + 0xc], 0xd
jne 0x471e00
cmp byte [esi + 0x61a], 0
je 0x471dda
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x471e00
cmp byte [esi + 0x61b], 0
jne 0x471e00
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
test eax, eax
je 0x471dfc
mov eax, dword [esi]
mov ecx, esi
push edi
push edi
push edi
push str.return
push esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0045157c
xor eax, eax
jmp 0x471e14
mov eax, dword [esi + 0x614]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x4721e7
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x624394]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x47229d
movzx eax, word [esi]
test ax, ax
je 0x47229d
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x472227
cmp ax, 0x5c
jne 0x472229
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x47221b
cmp edi, esi
je 0x472270
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.004ee16b
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4722ad
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004721e7
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004ee12e
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004ee0bd
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004dda5e
mov esp, ebp
pop ebp
ret
call fcn.004de880
int3

Function at 0x472872
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4728ee
cmp dword [edi + 4], 0xffffffff
jne 0x4728ee
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x6135f4
push esi
call fcn.004ee0bd
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4728c0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4728c0
mov eax, 0x2000000
jmp 0x4728f3
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00474d8d
add esp, 0x10
test eax, eax
jne 0x4728de
mov eax, dword [ebp - 4]
jmp 0x4728f3
push eax
call fcn.00475495
mov dword [edi], eax
mov eax, dword [0x62f884]
pop ecx
jmp 0x4728f3
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc