joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc0d250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc21808
push 0xc11288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xc0d329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xc0d329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00c101d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xc0d329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xc0d329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xc0d32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00c0d351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc0dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xc0dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xc0dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xc0dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xc0dd94
push eax
push esi
call fcn.00c1020b
add esp, 8
pop esi
ret 0x10

Function at 0xc0dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xc0de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xc0de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xc26320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00c0fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xc0ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xc0de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xc0dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xc0deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xc26320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00c0fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xc0deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xc0de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xc0e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xc0e131
push esi
call fcn.00c11145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00c00080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xc0e131
push 0
push ebp
call fcn.00c003a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00c00260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xc0e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00c002f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xc0e121
push 0xc26918
push edi
call fcn.00c0f3f0
push eax
push ebx
push esi
call fcn.00c0df60
push 0xc268f8
push edi
call fcn.00c0f3f0
push eax
push ebx
push esi
call fcn.00c0df60
push 0xc268d8
push edi
call fcn.00c0f3f0
push eax
push ebx
push esi
call fcn.00c0df60
push 0xc268c0
push edi
call fcn.00c0f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00c0df60
push 0xc268a0
push edi
call fcn.00c0f3f0
push eax
push ebx
push esi
call fcn.00c0df60
push 0xc26888
push edi
call fcn.00c0f3f0
push eax
push ebx
push esi
call fcn.00c0df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xc0f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00c0f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00c0f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00c0f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00c0f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xc0fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xc0fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xc2187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xc0fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xc0fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x44bdf6
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
neg ebp
shrd ebp, ebx, 0xd8
mov ebp, esp
btc ax, 0x23
mov eax, dword [ebp + 8]
clc
cmc
xor edx, edx
test eax, 0x4000000
jmp 0x44c00f
je 0x44c01b
or edx, 0x200
test eax, 0x20000000
jmp loc.004184c1

Function at 0x44d3f4
Capabilities:
Read .ini file

Disassembly:
call fcn.00406c24
push eax
movsx eax, si
mov ax, si
mov eax, edi
jmp loc.0043c061
push ebp
adc ebp, 0x2c687e32
clc
xor ebp, 0x4b7c3817
mov ebp, esp
test esp, 0x448f3b5b
add esp, 0xfffff004
push eax
push ebx
push esi
mov bx, dx
bswap bx
push edi
cmovs edi, edi
movsx edi, cx
mov edi, ecx
movzx esi, ax
not esi
mov esi, edx
movsx ebx, bx
mov ebx, eax
cmovg eax, eax
movsx eax, ax
movzx eax, di
mov eax, ebx
jmp 0x44e2c1
call fcn.00406c24
push eax
push 0x800
cwde
lea eax, [ebp - 0x1000]
jmp 0x44e502
push eax
not eax
mov eax, dword [ebp + 0xc]
jmp 0x44c779

Function at 0x44d6ac
Capabilities:
Get disk information

Disassembly:
push eax
lahf
lea eax, [esp + 0x10]
jmp 0x44d1a8
push eax
cmovnp eax, ecx
movsx eax, si
lea eax, [esp + 0x10]
jmp loc.0043c66f
lea esp, [esp - 0x41c]
cmc
xor eax, eax
mov dword [esp], eax
movzx eax, di
mov ax, sp
push 0x104
nop
lea eax, [esp + 0x218]
jmp 0x44c1a7

Function at 0x44e11f
Capabilities:
Get file size

Disassembly:
call sub.kernel32.dll_GetFileSize_1
sub edx, edx
jmp loc.0043c01d
call fcn.0040f4dc
mov ebx, eax
jmp 0x44dc7f
push 0
push ebx
jmp 0x44baca
push ebx
add esp, 0xfffffff8
mov edx, 0x20
jmp 0x44d8f8

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401200
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
call fcn.004010e0
mov eax, dword [esp + 0x10]
push 0
push 0x80
push 2
push 0
push 0
add eax, 0xc
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x40137e
push ebp
push esi
push edi
mov ecx, 0x8be
call fcn.0040c420
mov ebp, eax
mov ecx, 0x22f
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 1
mov edx, 0x20
mov word [ebp + 2], ax
mov word [ebp + 4], ax
mov byte [ebp + 6], dl
mov byte [ebp + 7], dl
mov dword [ebp + 0xe], 0x8a8
mov dword [ebp + 0x12], 0x16
mov dword [ebp + 0x16], 0x28
mov dword [ebp + 0x1a], edx
mov dword [ebp + 0x1e], 0x40
mov word [ebp + 0x22], ax
mov word [ebp + 0x24], 8
mov dword [ebp + 0x2a], 0x400
mov eax, dword [0x432074]
mov ecx, 0xff
lea edi, [ebp + 0x42]
lea esi, [eax + 0x2c]
lea eax, [ebp + 0x43e]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx]
mov ecx, 0x100
mov edi, eax
mov esi, dword [esi + 0x14]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x400]
mov edi, 0x80
mov bl, byte [eax]
xor cl, cl
test bl, bl
jne 0x4012d7
mov cl, 0x80
mov bl, byte [eax + 1]
test bl, bl
jne 0x4012e1
or cl, 0x40
mov bl, byte [eax + 2]
test bl, bl
jne 0x4012ea
or cl, dl
mov bl, byte [eax + 3]
test bl, bl
jne 0x4012f4
or cl, 0x10
mov bl, byte [eax + 4]
test bl, bl
jne 0x4012fe
or cl, 8
mov bl, byte [eax + 5]
test bl, bl
jne 0x401308
or cl, 4
mov bl, byte [eax + 6]
test bl, bl
jne 0x401312
or cl, 2
mov bl, byte [eax + 7]
test bl, bl
jne 0x40131c
or cl, 1
add eax, 8
mov byte [esi], cl
inc esi
dec edi
jne 0x4012cd
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push 0x8be
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, ebp
call fcn.0040c490
pop edi
test esi, esi
pop esi
pop ebp
je 0x401370
cmp dword [esp + 8], 0x8be
jne 0x401370
lea ecx, [esp + 0x10]
call fcn.004064c0
mov al, 1
pop ebx
add esp, 8
ret 4
mov edx, dword [esp + 0x10]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea ecx, [esp + 0x10]
call fcn.004064c0
xor al, al
pop ebx
add esp, 8
ret 4

Function at 0x401391
Capabilities:
Delete file

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x401411
lea ecx, [esp + 4]
call fcn.00406370
lea ecx, [esp + 4]
call fcn.00406a80
push ecx
lea edx, [esp + 8]
mov ecx, esp
push edx
call fcn.00401020
mov ecx, esi
call fcn.00401200
test al, al
je 0x401400
mov eax, dword [esp + 4]
mov ecx, dword [0x4321b0]
add eax, 0xc
push 0
push eax
push ecx
call dword [sym.imp.SHELL32.DLL_ExtractIconA]
mov edx, dword [esi]
mov dword [edx + 8], eax
mov eax, dword [esi]
cmp dword [eax + 8], 1
jne 0x4013f2
mov dword [eax + 8], 0
mov eax, dword [esp + 4]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea ecx, [esp + 4]
call fcn.004064c0
mov ecx, dword [esi]
mov eax, dword [ecx + 8]
pop esi
pop ecx
ret
mov edx, dword [esi]
pop esi
mov eax, dword [edx + 8]
pop ecx
ret
Function at 0x406a80
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, 0x100
call fcn.0040c420
mov ecx, 0x200
mov esi, eax
call fcn.0040c420
mov edi, eax
push esi
mov byte [esi], 0
push 0xff
mov byte [edi], 0
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push edi
push 0
push 0x431170
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
mov edx, edi
mov ecx, ebx
call fcn.004079a0
mov ecx, esi
call fcn.0040c490
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.0040c490

Function at 0x406b60
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
jne 0x406b75
mov ecx, dword [edi]
call fcn.0040c490
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
mov esi, eax
test esi, esi
jge 0x406b88
xor esi, esi
lea ecx, [esi + 0xd]
call fcn.0040c420
mov dword [edi], eax
mov dword [eax], 1
mov dword [eax + 4], esi
mov dword [eax + 8], 0xffffffff
mov byte [eax + esi + 0xc], 0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add eax, 0xc
inc ecx
push ecx
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetWindowTextA]
pop edi
pop esi
pop ebx
ret 4

Function at 0x406bd0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
push ebx
push edi
mov edi, ecx
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.DLL_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x406c41
mov eax, dword [edi]
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
jne 0x406bfa
mov ecx, dword [edi]
call fcn.0040c490
push esi
push ebx
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
mov esi, eax
test esi, esi
jge 0x406c0a
xor esi, esi
lea ecx, [esi + 0xd]
call fcn.0040c420
mov dword [edi], eax
mov dword [eax], 1
mov dword [eax + 4], esi
mov dword [eax + 8], 0xffffffff
mov byte [eax + esi + 0xc], 0
mov eax, dword [edi]
mov edx, dword [eax + 4]
add eax, 0xc
inc edx
push edx
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetWindowTextA]
pop esi
pop edi
pop ebx
ret 8
mov ecx, edi
call fcn.00406800
pop edi
pop ebx
ret 8

Function at 0x406c80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebp
push esi
lea eax, [esp + 8]
push edi
push eax
mov ebp, ecx
push 0x104
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov esi, eax
test esi, esi
jge 0x406caa
xor esi, esi
jmp 0x406cb7
cmp esi, 0x104
jle 0x406cb7
mov esi, 0x104
mov eax, dword [ebp]
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
jne 0x406cc9
mov ecx, dword [ebp]
call fcn.0040c490
test esi, esi
mov edi, esi
jge 0x406cd1
xor edi, edi
lea ecx, [edi + 0xd]
call fcn.0040c420
mov dword [ebp], eax
mov dword [eax], 1
mov dword [eax + 4], edi
mov dword [eax + 8], 0xffffffff
mov ecx, esi
mov byte [eax + edi + 0xc], 0
mov edi, dword [ebp]
mov edx, ecx
lea esi, [esp + 0xc]
add edi, 0xc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x104
ret
Function at 0x409eb0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
lea ecx, [esp + 4]
call fcn.004069a0
lea ecx, [esp + 4]
call fcn.004069f0
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 4]
test eax, eax
je 0x409ef8
cmp byte [eax + ecx + 0xb], 0x5c
jne 0x409ef8
dec eax
push 0x7fffffff
push eax
lea ecx, [esp + 0xc]
call fcn.00406930
lea ecx, [esp + 4]
call fcn.004069f0
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x409ecd
add ecx, 0xc
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x409f17
lea ecx, [esp + 4]
call fcn.004064c0
mov eax, 1
ret
mov eax, dword [esp + 4]
push esi
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409f41
test al, 0x10
je 0x409f41
lea ecx, [esp + 8]
mov esi, 1
call fcn.004064c0
mov eax, esi
pop esi
ret
lea ecx, [esp + 8]
xor esi, esi
call fcn.004064c0
mov eax, esi
pop esi
ret

Function at 0x40ae60
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [0x43222c]
sub esp, 0x20
push ebx
mov bl, byte [esp + 0x28]
cmp bl, al
je 0x40af89
mov ecx, dword [0x432220]
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.USER32.DLL_GetWindowRect]
push eax
push ecx
mov byte [0x43222c], bl
call esi
mov eax, dword [0x432228]
lea edx, [esp + 0x18]
push edx
push eax
call esi
test bl, bl
je 0x40af30
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
sub ecx, esi
mov edx, dword [esp + 0x10]
add eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
sub eax, ecx
push 1
push eax
mov eax, dword [esp + 0x10]
sub edx, eax
push edx
push ecx
push eax
mov eax, dword [0x432220]
push eax
call dword [sym.imp.USER32.DLL_MoveWindow]
push 0
push 0
push 0
mov esi, dword [0x432230]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.004147e0
mov ecx, dword [0x432228]
add esp, 0x2c
mov dword [0x432230], eax
push 0
push eax
push 0x30
push ecx
call dword [sym.imp.USER32.DLL_SendMessageA]
mov edx, dword [0x432228]
push 5
push edx
call dword [sym.imp.USER32.DLL_ShowWindow]
push esi
call fcn.00414b70
add esp, 4
jmp 0x40af79
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
sub eax, edx
add ecx, eax
push 0
mov dword [esp + 0x18], ecx
mov ecx, dword [0x432228]
push ecx
call dword [sym.imp.USER32.DLL_ShowWindow]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
sub edx, eax
push 1
push edx
mov edx, dword [esp + 0x18]
sub edx, ecx
push edx
push eax
mov eax, dword [0x432220]
push ecx
push eax
call dword [sym.imp.USER32.DLL_MoveWindow]
mov ecx, dword [0x432180]
push ecx
call fcn.0040acd0
add esp, 4
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x40af90
Capabilities:
Set console window title

Disassembly:
mov al, byte [0x4326e0]
test al, al
je 0x40afa8
mov eax, dword [0x4321f8]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
ret
Function at 0x415b10
Capabilities:
Read file on windows

Disassembly:
push ecx
mov al, byte [0x4326e0]
push esi
test al, al
je 0x415bc3
push ebx
push edi
mov ecx, 0x2000
mov dword [esp + 0xc], 0
call fcn.0040c420
mov ecx, dword [0x4318c4]
mov edi, eax
lea eax, [esp + 0xc]
push 0
push eax
push 0x1fff
push edi
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, dword [esp + 0xc]
lea ecx, [edx + 1]
call fcn.0040c420
mov ebx, eax
mov eax, dword [esp + 0xc]
push eax
push ebx
push edi
call dword [sym.imp.USER32.DLL_OemToCharBuffA]
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.004064c0
mov ecx, dword [esp + 0xc]
push ecx
push ebx
mov ecx, esi
call fcn.00406500
mov ecx, ebx
call fcn.0040c490
mov ecx, edi
call fcn.0040c490
mov ecx, dword [esi]
pop edi
pop ebx
mov eax, dword [ecx + 4]
test eax, eax
je 0x415bcc
mov cl, byte [eax + ecx + 0xb]
cmp cl, 0xd
je 0x415ba9
cmp cl, 0xa
jne 0x415bcc
dec eax
push 0x7fffffff
push eax
mov ecx, esi
call fcn.00406930
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x415b9b
pop esi
pop ecx
ret
mov ecx, dword [esp + 0xc]
call fcn.00406800
pop esi
pop ecx
ret

Function at 0x416910
Capabilities:
Read file on windows

Disassembly:
push ecx
call fcn.00416630
test al, al
je 0x4169ed
mov ecx, dword [0x4326a0]
mov edx, dword [0x4326a8]
mov eax, ecx
sub eax, edx
mov edx, dword [0x4326ac]
cmp eax, edx
jae 0x41694a
inc ecx
mov dword [0x4326a0], ecx
mov ecx, dword [0x4326a4]
mov al, byte [ecx + eax]
pop ecx
ret
lea eax, [ecx - 0x3c00]
mov dword [0x4326ac], 0
test eax, eax
mov dword [0x4326a8], eax
jge 0x41696a
xor eax, eax
mov dword [0x4326a8], eax
mov edx, dword [0x43269c]
push 0
push 0
push eax
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x4169ad
mov ecx, dword [0x4326a4]
mov edx, dword [0x43269c]
lea eax, [esp]
push 0
push eax
push 0xf000
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4169b4
mov byte [0x432690], 1
mov edx, dword [0x4326a0]
mov ecx, dword [esp]
push esi
mov esi, dword [0x4326a8]
mov eax, edx
mov dword [0x4326ac], ecx
sub eax, esi
inc edx
cmp eax, ecx
mov dword [0x4326a0], edx
pop esi
jae 0x4169e6
mov ecx, dword [0x4326a4]
mov al, byte [ecx + eax]
pop ecx
ret
mov byte [0x432690], 1
xor al, al
pop ecx
ret
Function at 0x416a00
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.00416630
test al, al
je 0x416b75
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jg 0x416a2c
mov eax, dword [0x4326a0]
pop edi
add eax, ebp
pop esi
pop ebp
mov dword [0x4326a0], eax
pop ebx
pop ecx
ret
cmp ebp, 0xf000
mov dword [esp + 0x10], 0
jl 0x416a95
mov eax, dword [0x4326a0]
mov ecx, dword [0x43269c]
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x416a88
mov eax, dword [esp + 0x18]
mov ecx, dword [0x43269c]
lea edx, [esp + 0x10]
push 0
push edx
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x416a88
mov eax, dword [0x4326a0]
pop edi
add eax, ebp
pop esi
pop ebp
mov dword [0x4326a0], eax
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov byte [0x432690], 1
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x18]
mov eax, dword [0x4326ac]
mov dword [esp + 0x1c], 4
mov edx, dword [0x4326a0]
mov esi, dword [0x4326a8]
sub edx, esi
cmp edx, eax
jae 0x416af2
sub eax, edx
cmp eax, ebp
jle 0x416ac0
mov eax, ebp
mov esi, dword [0x4326a4]
mov ecx, eax
add esi, edx
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x4326a0]
add edx, eax
sub ebp, eax
mov dword [0x4326a0], edx
je 0x416b75
add ebx, eax
mov eax, dword [0x4326a0]
mov dword [0x4326ac], 0
add eax, 0xffffc400
test eax, eax
mov dword [0x4326a8], eax
jge 0x416b16
xor eax, eax
mov dword [0x4326a8], eax
mov ecx, dword [0x43269c]
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x416b50
mov eax, dword [0x4326a4]
mov ecx, dword [0x43269c]
lea edx, [esp + 0x10]
push 0
push edx
push 0xf000
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x416b57
mov byte [0x432690], 1
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [0x4326ac], eax
je 0x416b75
mov ecx, dword [esp + 0x1c]
dec ecx
test ecx, ecx
mov dword [esp + 0x1c], ecx
jg 0x416aa6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x419310
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x100
lea eax, [esp]
push eax
call dword [sym.imp.USER32.DLL_GetKeyboardState]
mov ecx, dword [esp + 0x104]
mov dl, byte [esp + 0x108]
lea eax, [esp + ecx]
mov cl, byte [esp + ecx]
and cl, 0xfe
test dl, dl
mov byte [eax], cl
je 0x419345
or cl, 1
mov byte [eax], cl
lea edx, [esp]
push edx
call dword [sym.imp.USER32.DLL_SetKeyboardState]
add esp, 0x100
ret

Function at 0x424cd0
Capabilities:
Delete file

Disassembly:
mov al, byte [0x43271c]
mov dword [0x431974], 0x48
test al, al
mov dword [0x431978], 0xffffffff
je 0x424d11
mov al, byte [0x43271e]
test al, al
je 0x424d0c
push 0
mov byte [0x43271d], 1
call fcn.00424d20
add esp, 4
jmp fcn.00424db0
jmp fcn.00424e40
ret