joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cb49
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1040
call fcn.00401200
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp word [esi], bx
je 0x40cd80
push esi
call fcn.0040b0af
cmp eax, 0x3f6
jae 0x40cd80
push edi
push 0x3c
pop edi
push edi
push ebx
lea eax, [ebp - 0x40]
push eax
call fcn.0040ad80
movzx ecx, word [esi]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], 0x5c0
cmp cx, 0x22
jne 0x40cba0
lea eax, [esi + 2]
mov dword [ebp - 0x30], eax
jmp 0x40cba3
mov dword [ebp - 0x30], esi
xor eax, eax
cmp cx, bx
je 0x40cbf9
mov ecx, esi
cmp word [ecx], 0x22
jne 0x40cbcb
jmp 0x40cbbb
cmp word [esi + eax*2], 0x22
je 0x40cbc4
inc eax
cmp word [esi + eax*2], bx
jne 0x40cbb4
jmp 0x40cbcb
push 0x20
pop ecx
mov word [esi + eax*2], cx
cmp word [esi + eax*2], 0x20
je 0x40cbe5
cmp word [esi + eax*2 + 2], 0x2f
je 0x40cbe5
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x40cbac
jmp 0x40cbf9
lea eax, [esi + eax*2]
cmp word [eax], 0x20
jne 0x40cbf3
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x2c], eax
cmp byte [ebp + 8], bl
jne 0x40cc0e
cmp word [0x41ca12], bx
je 0x40cc0e
mov dword [ebp - 0x2c], 0x41ca12
push dword [ebp - 0x30]
mov dword [ebp - 0x24], 1
call fcn.00407f51
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40cc3a
push str..inf
push eax
call fcn.0040f257
test eax, eax
jne 0x40cc3a
mov dword [ebp - 0x34], 0x413838
push dword [ebp - 0x30]
call fcn.00405e39
mov bl, al
test bl, bl
je 0x40cc60
lea eax, [ebp - 0x1040]
push eax
push dword [ebp - 0x30]
call fcn.00407a78
lea eax, [ebp - 0x1040]
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], 0
je 0x40cc9e
test bl, bl
jne 0x40cc9e
push dword [ebp - 0x30]
lea eax, [ebp - 0x840]
push eax
call fcn.0040b0d9
push str..exe
lea eax, [ebp - 0x840]
push eax
call fcn.0040b146
lea eax, [ebp - 0x840]
push eax
call fcn.00405e39
test al, al
je 0x40cd7f
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x40]
push eax
call edi
test eax, eax
setne al
test al, al
jne 0x40ccd0
and dword [ebp - 0x3c], 0xfffffbff
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x30], esi
call edi
test eax, eax
setne al
test al, al
je 0x40cd7f
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor bl, bl
cmp byte [0x41c208], bl
jne 0x40cce5
cmp byte [ebp + 8], bl
je 0x40cd1b
mov eax, dword [0x41c200]
test eax, eax
je 0x40cd05
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40cd05
push 0
push dword [0x41c200]
call esi
mov bl, 1
push 0x7d0
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 8]
call fcn.0040c418
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x40cd3b
push str..exe
push dword [ebp - 4]
call fcn.0040f257
test eax, eax
je 0x40cd6b
cmp byte [0x41c208], 0
je 0x40cd51
cmp byte [ebp + 8], 0
jne 0x40cd51
push 0x1b58
jmp 0x40cd65
xor eax, eax
cmp byte [ebp + 8], al
sete al
dec eax
and eax, 0xfffffce0
add eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x40cd7f
cmp byte [ebp + 8], 0
je 0x40cd7f
push 1
push dword [0x41c200]
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40e244
Capabilities:
Accept command line arguments
Read file via mapping
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
call fcn.0040ed1d
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x424cf8
call fcn.0040f411
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp esi, ebx
je 0x40e2d2
push esi
call fcn.0040c19f
cmp byte [0x41c211], bl
je 0x40e2ca
push str.winrarsfxmappingfile.tmp
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40e2bf
push 0x20000
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x40e2b8
push esi
push str.sfxcmd
call edi
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e2d2
push esi
push str.sfxcmd
call edi
push 0x400
mov esi, 0x41b8e0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push str.sfxname
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0x64
push edi
mov dword [0x415e74], edi
mov dword [0x415e78], edi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x65
push dword [0x415e78]
mov dword [0x41b8dc], eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
lea ecx, [ebp - 8]
mov dword [0x41b8d8], eax
call fcn.0041280f
push esi
mov ecx, 0x415e88
call fcn.0040a3d4
lea ecx, [ebp - 0x40]
call fcn.00406af3
lea ecx, [ebp - 0x24]
call fcn.00406af3
push 0x64
call fcn.0040b813
push 0x64
mov dword [ebp - 0x28], eax
call fcn.0040b813
push ebx
push 0x40da95
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x40]
mov dword [0x41b0d4], eax
push str.STARTDLG
lea eax, [ebp - 0x24]
push edi
mov dword [0x41b0d0], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [ebp - 0x24]
mov dword [0x41b0d0], ebx
mov dword [0x41b0d4], ebx
call fcn.00406b09
lea ecx, [ebp - 0x40]
call fcn.00406b09
lea ecx, [ebp - 8]
call fcn.00412861
cmp byte [0x41c208], bl
je 0x40e3ad
call fcn.0040c457
push 0x100
push ebx
push 0x41c0f0
call fcn.0040ad80
cmp dword [0x41d324], ebx
jbe 0x40e3d0
push dword [0x41d318]
call fcn.0040acfc
push dword [0x41b8dc]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x41b8d8]
cmp eax, ebx
je 0x40e3ea
push eax
call esi
cmp dword [0x415e7c], ebx
jne 0x40e409
cmp byte [0x41c1f2], bl
je 0x40e409
push 0xff
mov ecx, 0x415e7c
call fcn.0040347e
mov eax, dword [0x41d32c]
mov byte [0x41c1f2], 1
cmp eax, ebx
je 0x40e41f
push eax
call fcn.0040c418
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [0x415e7c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e791
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x41279f
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x406886
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [esp + 0xc]
lea esi, [eax + 1]
push esi
call fcn.00406800
push esi
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
call fcn.0040685d
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x4097b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40980a
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4097fb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4097f7
cmp esi, ecx
jae 0x4097fb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x4097e5
cmp esi, ecx
jb 0x4097ff
xor eax, eax
jmp 0x409809
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4113f7
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [esp + 8], edx
jbe 0x41141d
push esi
mov esi, dword [esp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [esp + 0xc]
jb 0x411409
pop esi
mov eax, ecx
ret

Function at 0x414f80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4ace
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x569078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.004cb6eb
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], ecx
or dword [ebp - 4], 0xffffffff
push eax
push eax
push esi
push 0x414f5e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x414fe6
push 8
push esi
call fcn.004cb9a3
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415141
Capabilities:
Reference sql statements

Disassembly:
push 0x4c
mov eax, 0x4f4b27
call fcn.004cc2a7
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, str.InstallerAnalytics.dll
push 7
mov dword [edi + 0xc], eax
xor eax, eax
pop ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
call fcn.004d163d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00407b30
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
call fcn.0045106f
pop ecx
mov byte [ebp - 4], 1
lea esi, [edi + 0x10]
push eax
mov ecx, esi
call fcn.0040f13f
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
push 0
push 1
call fcn.0040487e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0040487e
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
mov ebx, str.SELECT__Data__FROM__Binary__WHERE__Name___InstallerAnalytics.dll
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x40], ax
cmp word [str.SELECT__Data__FROM__Binary__WHERE__Name___InstallerAnalytics.dll], ax
je 0x4151e9
push ebx
call fcn.004d163d
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00407b30
mov dword [ebp - 4], 2
lea edx, [ebp - 0x40]
mov ecx, dword [ebp + 8]
push esi
call fcn.0049f1fb
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push 0
push 1
call fcn.0040487e
cmp dword [esi + 0x14], 8
jb 0x41521f
mov esi, dword [esi]
mov ecx, esi
call fcn.004150b6
mov ebx, eax
test ebx, ebx
je 0x415252
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeEmbeddedUI
push ebx
call esi
push str.ShutdownEmbeddedUI
push ebx
mov dword [edi], eax
call esi
push str.EmbeddedUIHandler
push ebx
mov dword [edi + 4], eax
call esi
mov dword [edi + 8], eax
mov eax, dword [edi]
test eax, eax
je 0x415261
push 0
push 0
push dword [edi + 0xc]
call eax
call fcn.004cc251
ret 8

Function at 0x41e6ee
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x2e4]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
push 0xfffffffffffffff0
push esi
call edi
test eax, 0x10000000
je 0x41e74d
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41e74d
push 0xfffffffffffffff0
push esi
call edi
shr eax, 0x10
test al, 1
je 0x41e74d
push 0
push 0
push 0x87
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x41e74d
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov al, 1
jmp 0x41e77f
push 0
push esi
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov edi, eax
test edi, edi
je 0x41e77d
cmp edi, esi
je 0x41e77d
push 0
push 0
push 0x87
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x41e77d
push edi
jmp 0x41e743
xor al, al
pop edi
pop esi
pop ebp
ret
Function at 0x41f137
Capabilities:
Get disk size

Disassembly:
push 0xa8
mov eax, 0x4f6d8c
call fcn.004cc315
mov esi, ecx
mov dword [ebp - 0x88], esi
cmp dword [ebp + 8], 1
je 0x41f162
and dword [esi + 0x1a4], 0
xor eax, eax
jmp 0x41f313
xor ebx, ebx
mov dword [ebp - 4], ebx
wait
mov ecx, dword [esi + 0x258]
cmp ecx, dword [esi + 0x25c]
jne 0x41f17f
xor eax, eax
inc eax
wait
jmp 0x41f313
mov edi, ebx
mov dword [ebp - 0x9c], edi
mov eax, dword [esi + 0x25c]
sub eax, dword [esi + 0x258]
cdq
push 0x30
pop ecx
idiv ecx
cmp edi, eax
jae 0x41f2b9
imul ecx, edi, 0x30
add ecx, dword [esi + 0x258]
mov dword [ebp - 0x98], ecx
mov eax, dword [ecx + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x538aa8]
lahf
test ah, 0x44
jnp 0x41f2b3
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
cmp dword [ecx + 0x14], 8
jb 0x41f1f2
mov ecx, dword [ecx]
push ebx
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x94]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x98]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x90]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x94]
call fcn.004f1010
mulsd xmm0, qword [0x538ac0]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
xorps xmm1, xmm1
comisd xmm1, xmm0
jbe 0x41f2b3
push 0x5224ec
lea ecx, [ebp - 0x48]
call fcn.00407bc3
mov byte [ebp - 4], 1
push str.OutOfDiskSpace
lea ecx, [ebp - 0x30]
call fcn.00407bc3
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x48]
push edx
lea edx, [ebp - 0x30]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.0040487e
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040487e
jmp 0x41f176
inc edi
jmp 0x41f181
push 0x52547c
lea ecx, [ebp - 0x30]
call fcn.00407bc3
mov byte [ebp - 4], 3
push str.OutOfDiskSpace
lea ecx, [ebp - 0x48]
call fcn.00407bc3
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x48]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040487e
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.0040487e
wait
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
call fcn.004cc262
ret 4
Function at 0x4218e8
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x14
mov eax, 0x4f7365
call fcn.004cc273
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [edi + 0x14]
lea eax, [edi - 0x28]
mov esi, edi
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ecx]
call dword [eax + 4]
test al, al
mov eax, dword [ebp + 0x14]
je 0x42191b
and dword [eax], 0
jmp 0x4219ed
and dword [eax], 0
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
inc ecx
test eax, eax
push 2
pop edx
cmovne ecx, edx
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
and ax, cx
seta cl
xor ebx, ebx
cmp byte [edi + 0x18], bl
sete bl
cmp dword [ebp + 0xc], 8
jne 0x421960
xor cx, cx
cmp cx, ax
sbb edi, edi
neg edi
add edi, 2
jmp 0x421972
cmp dword [ebp + 0xc], 0x14
mov edi, ebx
jne 0x42197b
xor ebx, ebx
test cl, cl
setne bl
add ebx, 2
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov dword [ebp + 0x14], eax
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
push 0
push edi
push 0
mov ecx, dword [ecx + 0x14]
push eax
mov edx, dword [ecx]
call dword [edx + 0x18]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 0x14]
push 0
push ebx
mov ecx, dword [eax + 0x14]
push 2
push edi
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp dword [ebp + 0xc], 8
je 0x4219bc
cmp dword [ebp + 0xc], 0x14
jne 0x4219da
mov eax, dword [esi + 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x1c], 0x12
call dword [sym.imp.USER32.dll_TrackMouseEvent]
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4219ed
and dword [ebp + 0x14], 0
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
call fcn.004cc23c
ret 0x10
Function at 0x4259e5
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x4c
mov eax, 0x4f7e23
call fcn.004cc2a7
lea ecx, [ebp - 0x28]
call fcn.00465e10
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.00459f30
mov byte [ebp - 4], 1
mov edx, 0x525a00
push eax
lea ecx, [ebp - 0x58]
call fcn.0040fd99
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.00425c19
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push ebx
push 1
call fcn.0040487e
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.0040487e
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00467040
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x425a63
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0040487e
add bl, 1
je 0x425ac5
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00467040
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x425a9d
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0040487e
add bl, 1
je 0x425ac5
xor bl, bl
jmp 0x425ad5
lea eax, [ebp - 0x28]
mov ecx, 0x56f4a4
push eax
call fcn.004703a0
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0040487e
mov al, bl
call fcn.004cc251
ret

Function at 0x42eb9b
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x569078]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 4
mov eax, 0x4f9b24
call fcn.004cc273
mov esi, ecx
mov edi, 0x105
lea eax, [ebp]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42ec1c
cmp eax, edi
jae 0x42ec1c
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00409a3c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0x52686c
call fcn.0040706a
push esi
lea ecx, [ebp - 0x10]
call fcn.0040706a
mov ecx, dword [ebp - 0x10]
call fcn.004150b6
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406ba9
mov eax, esi
jmp 0x42ec1e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004cb6da
lea esp, [ebp + 0x210]
pop ebp
ret
Function at 0x435d5d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov ecx, dword [edi + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x435da9
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [edi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call esi
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x4e
push eax
jmp 0x435dd4
shr ecx, 2
test cl, 1
je 0x435ddc
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
mov ecx, eax
movzx eax, si
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x435e0b
push 1
xor esi, esi
push esi
push esi
push dword [edi + 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x435e0b
or byte [edi + 0x58], 2
push 1
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436767
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x569078]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x12c]
xor ebp, ebp
push edi
push 0x30
pop edi
push edi
mov ebx, ecx
push ebp
push ebx
call fcn.004cd4d0
push 0x110
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x114
push ebp
push eax
call fcn.004cd4d0
add esp, 0x18
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4367c6
cmp dword [esp + 0x14], 6
jae 0x4367c9
push 0x2c
pop edi
mov eax, dword [esp + 0x134]
mov dword [ebx], edi
mov dword [ebx + 4], ebp
test eax, eax
jne 0x4367ec
push esi
call dword [sym.imp.USER32.dll_GetParent]
or dword [ebx + 4], 1
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], esi
jmp 0x4367f2
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], eax
mov esi, dword [esp + 0x138]
test esi, esi
je 0x436804
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x56e360]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x134]
mov dword [ebx + 0x28], ebp
pop ebp
mov dword [ebx + 0x24], eax
pop ebx
xor ecx, esp
call fcn.004cb6da
add esp, 0x118
ret 0x18
Function at 0x4466f0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x74
mov eax, 0x4fd831
call fcn.004cc315
mov eax, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
and dword [edi], 0
mov ebx, dword [ebp + 0x10]
cmp dword [ebx + 4], 0x200
jb 0x44675f
cmp dword [ebx + 4], 0x20e
ja 0x44675f
push 0x10
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
mov ecx, 0x8000
test cx, ax
jne 0x446753
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jne 0x446753
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x446765
xor ebx, ebx
inc ebx
mov dword [edi], ebx
mov eax, ebx
jmp 0x44684d
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebx + 4], 0x100
jb 0x446847
cmp dword [ebx + 4], 0x109
ja 0x446847
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x44679f
cmp dword [ebx + 8], 0x58
je 0x44679f
cmp dword [ebx + 8], 0x43
je 0x44679f
cmp dword [ebx + 8], 0x56
jne 0x446753
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x4467b9
cmp dword [ebx + 8], 0x25
je 0x446753
cmp dword [ebx + 8], 0x27
je 0x446753
cmp dword [ebx + 4], 0x100
jne 0x446847
cmp dword [ebx + 8], 8
jne 0x446831
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 0x168]
call fcn.0044d3f4
mov esi, eax
mov dword [ebp - 0x70], esi
test esi, esi
je 0x4467e9
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov byte [ebp - 4], 2
test esi, esi
je 0x446814
mov dl, bl
mov ecx, esi
call fcn.0044d491
test al, al
je 0x446814
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x446834
mov dword [edi], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
test esi, esi
je 0x446758
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x446758
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 8], 0x70
jb 0x446847
cmp dword [eax + 8], 0x7b
jbe 0x446756
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.004cc262
ret 0x10