joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453cc0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.0044b300
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x453cf2
mov dword [esp + 0x2c], 0
jmp 0x453d0d
mov ecx, ebp
call fcn.0044b300
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.0044b300
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.0044b310
cmp eax, esi
jae 0x453d4d
mov ecx, ebp
call fcn.0044b310
mov dword [esp + 0x10], eax
jmp 0x453d51
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.0044b1a0
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x453dbd
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x453db8
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.0044cb20
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x453dab
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.0044ce90
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x453d78
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x453d66
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8

Function at 0x457810
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x457840
push esi
call fcn.00457d10
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x457839
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4578c3
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x4578af
mov eax, dword [esi + 8]
test eax, eax
je 0x457864
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4578ab
cmp eax, 2
je 0x4578af
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x457857
cmp eax, 3
je 0x45788a
cmp eax, 1
jne 0x457857
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x457857
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x457857
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.004578f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4578e3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004578f0
add esp, 4
pop esi
ret
Function at 0x472765
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x472785
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00477477
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4727a8
test byte [esp + 8], 2
je 0x4727a8
call fcn.004774ea
mov dword [eax], 0xd
call fcn.004774f3
mov dword [eax], 5
jmp 0x472781
xor eax, eax
ret
Function at 0x487895
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5a10
push 0x47389c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
and dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
jne 0x4878e2
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
je 0x4878e2
xor eax, eax
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
jmp 0x4878f6
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48a610
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4e379c
call fcn.00471fb4
sub esp, 0x150
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov eax, dword [ebx]
lea ecx, [ebp - 0x15c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x48a6fb
test byte [ebp - 0x15c], 0x10
push edi
mov edi, dword [ebp - 0x13c]
je 0x48a653
mov edi, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.004d31ed
pop ecx
mov dword [esi + 0x5dc], eax
mov ebx, dword [ebx]
push 0
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004b0549
and dword [ebp - 4], 0
push edi
push dword [esi + 0x5dc]
lea ecx, [ebp - 0x1c]
call fcn.004b072f
lea ecx, [ebp - 0x1c]
call fcn.004b07b0
push 3
push edi
push dword [esi + 0x5dc]
call fcn.004afcd3
add esp, 0xc
mov dword [esi + 0x5d8], eax
test eax, eax
jne 0x48a6d8
xor ecx, ecx
test edi, edi
jbe 0x48a6c1
mov eax, dword [esi + 0x5dc]
xor byte [eax + ecx], 0x50
add eax, ecx
inc ecx
cmp ecx, edi
jb 0x48a6b0
push 3
push edi
push dword [esi + 0x5dc]
call fcn.004afcd3
add esp, 0xc
mov dword [esi + 0x5d8], eax
mov eax, dword [esi + 0x5d8]
xor ecx, ecx
test eax, eax
setne cl
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
mov esi, ecx
lea ecx, [ebp - 0x1c]
call fcn.004b0588
mov eax, esi
pop edi
jmp 0x48a6fd
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x48e5d1
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [0x52ac0c], 1
call fcn.0048e71c
test byte [esp + 0x14], 1
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
je 0x48e613
call ebp
push eax
push 0
call ebx
push eax
push 0x48e8ae
push 4
call edi
mov dword [esi + 4], eax
test byte [esp + 0x14], 2
je 0x48e62e
call ebp
push eax
push 0
call ebx
push eax
push 0x48e910
push 0xc
call edi
mov dword [esi + 8], eax
test byte [esp + 0x14], 4
je 0x48e649
call ebp
push eax
push 0
call ebx
push eax
push 0x48e975
push 5
call edi
mov dword [esi + 0xc], eax
test byte [esp + 0x14], 8
je 0x48e664
call ebp
push eax
push 0
call ebx
push eax
push 0x48e9b5
push 0xb
call edi
mov dword [esi + 0x10], eax
test byte [esp + 0x14], 0x10
je 0x48e67f
call ebp
push eax
push 0
call ebx
push eax
push 0x48e9e4
push 3
call edi
mov dword [esi + 0x14], eax
test byte [esp + 0x14], 0x20
je 0x48e69a
call ebp
push eax
push 0
call ebx
push eax
push 0x48ea6c
push 2
call edi
mov dword [esi + 0x18], eax
test byte [esp + 0x14], 0x40
je 0x48e6b5
call ebp
push eax
push 0
call ebx
push eax
push 0x48eaa1
push 7
call edi
mov dword [esi + 0x1c], eax
test byte [esp + 0x14], 0x80
je 0x48e6d0
call ebp
push eax
push 0
call ebx
push eax
push 0x48ead6
push 0xffffffffffffffff
call edi
mov dword [esi + 0x20], eax
test byte [esp + 0x15], 1
je 0x48e6eb
call ebp
push eax
push 0
call ebx
push eax
push 0x48eb22
push 0xa
call edi
mov dword [esi + 0x24], eax
test byte [esp + 0x15], 2
je 0x48e706
call ebp
push eax
push 0
call ebx
push eax
push 0x48eb4e
push 6
call edi
mov dword [esi + 0x28], eax
push dword [esp + 0x1c]
lea ecx, [esi + 0x2c]
call fcn.004868ff
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x48f5fd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e3af4
call fcn.00471fb4
push ecx
push esi
mov esi, ecx
push 0x3e8
mov dword [ebp - 0x10], esi
call fcn.004a9ea6
and dword [ebp - 4], 0
push str.Pictures
lea ecx, [esi + 8]
mov dword [esi], vtable.CResPicture.0
call fcn.004868ff
push str.Picture
lea ecx, [esi + 0xc]
call fcn.004868ff
mov ecx, dword [ebp - 0xc]
and dword [esi + 0x30], 0
mov dword [esi + 0x10], 0x41c
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4982b9
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x4e5772
call fcn.00471fb4
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0048fcdd
and dword [esp + 0x1c], 0
mov ebp, 0x4917c2
mov ebx, fcn.004916e3
push ebp
push ebx
mov edi, pe_nt_image_headers32
push 2
lea eax, [esi + 0x210]
push edi
push eax
call fcn.00474a32
push ebp
push ebx
push 4
lea eax, [esi + 0x4a0]
push edi
push eax
mov byte [esp + 0x30], 1
call fcn.00474a32
push ebp
push ebx
push 4
lea eax, [esi + 0x9c0]
push edi
push eax
mov byte [esp + 0x30], 2
call fcn.00474a32
mov ecx, dword [esp + 0x14]
mov dword [esi], vtable.SkinComboBox.0
mov dword [esi + 0x208], 0x1f4
mov dword [esi + 0x20c], 0x64
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x49d363
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x4e6a22
call fcn.00471fb4
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0048fcdd
and dword [esp + 0x1c], 0
mov ebp, 0x4917c2
mov ebx, fcn.004916e3
push ebp
push ebx
mov edi, pe_nt_image_headers32
push 2
lea eax, [esi + 0x210]
push edi
push eax
call fcn.00474a32
push ebp
push ebx
push 4
lea eax, [esi + 0x4a0]
push edi
push eax
mov byte [esp + 0x30], 1
call fcn.00474a32
push ebp
push ebx
push 4
lea eax, [esi + 0x9c0]
push edi
push eax
mov byte [esp + 0x30], 2
call fcn.00474a32
mov ecx, dword [esp + 0x14]
mov dword [esi], vtable.SkinDatetime.0
mov dword [esi + 0x208], 0x1f4
mov dword [esi + 0x20c], 0x64
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x49ed57
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp dword [0x526c4c], 0xffffffff
jne 0x49ee23
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x49ee23
mov eax, dword [ebp - 0x84]
dec eax
je 0x49ede9
dec eax
jne 0x49ee23
mov eax, dword [ebp - 0x90]
push 3
pop ecx
sub eax, ecx
je 0x49ee23
dec eax
je 0x49ede1
dec eax
je 0x49edbb
mov dword [0x526c4c], 6
jmp 0x49ee23
mov eax, dword [ebp - 0x8c]
sub eax, 0
je 0x49edd5
dec eax
jne 0x49edaf
mov dword [0x526c4c], 5
jmp 0x49ee23
mov dword [0x526c4c], 4
jmp 0x49ee23
mov dword [0x526c4c], ecx
jmp 0x49ee23
cmp dword [ebp - 0x8c], 0
je 0x49ee1c
cmp dword [ebp - 0x8c], 0xa
je 0x49ee10
cmp dword [ebp - 0x8c], 0x5a
jne 0x49ee23
mov dword [0x526c4c], 2
jmp 0x49ee23
mov dword [0x526c4c], 1
jmp 0x49ee23
and dword [0x526c4c], 0
mov eax, dword [0x526c4c]
leave
ret
Function at 0x49f819
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push 0x18
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call edi
push dword [ebp + 8]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 4], eax
push eax
call esi
push ebx
mov dword [ebp - 0xc], eax
call edi
push dword [ebp - 0x2c]
mov edi, eax
push dword [ebp - 0x30]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov dword [ebp - 0x1c], eax
call esi
xor ebx, ebx
push 0xcc0020
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push ebx
push ebx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0xc]
push dword [ebp - 4]
call esi
cmp dword [ebp - 4], ebx
je 0x49f8b5
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x49f8b5
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x30]
cmp eax, ebx
lea ecx, [eax - 1]
mov dword [ebp + 8], ecx
je 0x49f957
mov eax, dword [ebp - 0x2c]
lea ebx, [eax - 1]
test eax, eax
je 0x49f947
push ebx
push dword [ebp + 8]
push edi
call dword [sym.imp.GDI32.dll_GetPixel]
cmp dword [ebp + 0xc], eax
je 0x49f942
xor edx, edx
mov ecx, eax
mov dl, ah
shr ecx, 0x10
cmp al, dl
jne 0x49f8f1
cmp dl, cl
je 0x49f942
movzx ecx, cl
mov dword [ebp - 0x10], ecx
fild dword [ebp - 0x10]
movzx ecx, dl
fmul qword [0x4f7c68]
mov dword [ebp - 0x10], ecx
fild dword [ebp - 0x10]
movzx eax, al
fmul qword [0x4f7c60]
mov dword [ebp - 0x10], eax
faddp st(1)
fild dword [ebp - 0x10]
fmul qword [str.333333]
faddp st(1)
call fcn.00472d50
movzx eax, al
mov ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, eax
push ecx
push ebx
push dword [ebp + 8]
push edi
call dword [sym.imp.GDI32.dll_SetPixelV]
mov eax, ebx
dec ebx
jmp 0x49f8cc
mov eax, dword [ebp + 8]
dec dword [ebp + 8]
test eax, eax
jne 0x49f8c6
xor ebx, ebx
push dword [ebp - 8]
push edi
call esi
cmp edi, ebx
je 0x49f96e
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x49f96e
xor edi, edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
je 0x49f98a
push dword [ebp - 8]
call esi
cmp dword [ebp - 0xc], ebx
je 0x49f994
push dword [ebp - 0xc]
call esi
cmp edi, ebx
je 0x49f99f
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x49f9b0
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x1c]
leave
ret
Function at 0x4a5551
Capabilities:
Log keystrokes via application hook

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
cmp ecx, dword [esi + 0xc0]
lea eax, [esi + 0xc0]
je 0x4a5625
push ebx
xor ebx, ebx
mov dword [eax], ecx
mov eax, dword [0x52ad14]
cmp ecx, ebx
push edi
jne 0x4a55b6
cmp eax, ebx
je 0x4a558a
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x52ad14], ebx
mov ecx, esi
xor edi, edi
call fcn.004a5427
test eax, eax
jle 0x4a560b
mov eax, dword [esi + 0x90]
push 0x20
push ebx
mov ecx, dword [eax + edi*4]
call fcn.004a40a7
mov ecx, esi
inc edi
call fcn.004a5427
cmp edi, eax
jl 0x4a5597
jmp 0x4a560b
cmp eax, ebx
je 0x4a55c1
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x4a5629
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, esi
mov dword [0x52ad14], eax
mov dword [0x52ad0c], esi
xor edi, edi
call fcn.004a5427
test eax, eax
jle 0x4a560b
mov eax, dword [esi + 0x90]
push ebx
push 0x20
mov ecx, dword [eax + edi*4]
call fcn.004a40a7
mov ecx, esi
inc edi
call fcn.004a5427
cmp edi, eax
jl 0x4a55ee
mov ecx, esi
call fcn.004a4f78
or dword [esi + 0xf4], 0xffffffff
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.004a51e5
pop edi
pop ebx
pop esi
ret 4
Function at 0x4a571e
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4e7210
call fcn.00471fb4
sub esp, 0x120
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov esi, dword [ecx + 0xa8]
mov edi, dword [sym.imp.USER32.dll_GetMenuItemCount]
and dword [ebp - 4], 0
push esi
mov dword [ebp - 0x2c], esi
call edi
and dword [ebp - 0x10], 0
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], 1
jle 0x4a577a
push dword [ebp - 0x10]
push esi
call dword [sym.imp.USER32.dll_GetMenuItemID]
cmp eax, 0xff00
jae 0x4a5776
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4a575b
jmp 0x4a577a
and dword [ebp - 0x18], 0
push esi
call edi
mov ebx, 0x400
cmp dword [ebp - 0x10], eax
jge 0x4a5797
push ebx
push dword [ebp - 0x10]
push esi
call dword [sym.imp.USER32.dll_RemoveMenu]
push esi
call edi
jmp 0x4a5782
mov eax, dword [ebp - 0x20]
push 0
push 0
push 0x229
push dword [eax + 0xc4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x28], eax
mov eax, dword [0x52411c]
mov dword [ebp - 0x14], 0xff00
mov dword [ebp - 0x1c], eax
mov edi, dword [sym.imp.USER32.dll_InsertMenuA]
mov byte [ebp - 4], 1
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
push dword [eax + 0xc4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor ecx, ecx
mov dword [ebp - 0x24], eax
cmp eax, ecx
je 0x4a5892
cmp dword [ebp - 0x18], ecx
je 0x4a5804
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
push ecx
push ecx
push 0xc00
push eax
push esi
call edi
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0xfeff]
cmp ecx, 0xa
jge 0x4a586e
lea eax, [ebp - 0x12c]
push 0xff
push eax
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0xffff0101
push eax
lea eax, [ebp - 0x1c]
push str._d__s
push eax
call fcn.00486944
add esp, 0x10
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
push esi
call edi
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], eax
jne 0x4a587b
push 0x408
push dword [ebp - 0x10]
push esi
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x4a587b
push str.More_Windows...
push eax
push ebx
push dword [ebp - 0x10]
push esi
call edi
inc dword [ebp - 0x10]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, 0xffff0101
cmp eax, 0xa
jle 0x4a57cb
and dword [ebp - 0x2c], 0
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004866d2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x4a5dc8
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], 1
push dword [esi + 0xa0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x4a5e59
push eax
push 2
mov ecx, esi
call fcn.004a51e5
and dword [esi + 0x64], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4a5d8b
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x52ad10], eax
mov eax, dword [esi + 0x68]
mov dword [esi + 0x88], 2
mov dword [0x526d60], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x90]
push dword [esi + 0xa0]
mov ecx, dword [ecx + eax*4]
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [0x52ad10]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x52ad10], 0
cmp dword [esi + 0x64], 1
je 0x4a5dd9
mov eax, dword [esi + 0xf4]
mov ecx, esi
push eax
inc eax
neg eax
sbb eax, eax
and eax, 3
push eax
call fcn.004a51e5
mov ecx, esi
call fcn.004a4f78
pop esi
ret 4

Function at 0x4a74ce
Capabilities:
Check os version

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4a74e6
cmp al, 5
sbb eax, eax
and eax, 2
add eax, 6
ret
push 8
pop eax
ret
Function at 0x4aba0f
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
and dword [esi + 0xc], 0
lea edi, [esi + 0xc]
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [esi + 4], 0
mov dword [esi], eax
je 0x4aba5b
cmp dword [esi + 8], 0
je 0x4aba5b
push dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x4aba5b
push edi
push 0x40
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop edi
pop esi
pop ebx
ret 8

Function at 0x4adde7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4addf5
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x4aded6
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x4f9f6c]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4f9f6c]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f9f6c]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4f9f6c]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f9f6c]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4f9f6c]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f9f6c]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x4f9f6c]
xor eax, esi
inc edx
dec edi
jne 0x4ade12
pop ebx
cmp dword [ebp + 0x10], 0
je 0x4adef7
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4f9f6c]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x4adedc
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x4ae6d9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4ae70d
lea eax, [ebp + 8]
push 0
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4ae708
mov byte [esi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x4ae735
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4ae71e
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00472430
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
pop edi
div dword [ebp + 0xc]
pop esi
pop ebp
ret
Function at 0x4af4ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4af573
cmp dword [esi + 4], 0xffffffff
jne 0x4af573
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x519a30
push edi
call fcn.004720b0
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x4af53c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4af53c
mov eax, 0x2000000
jmp 0x4af578
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ae4e5
add esp, 0x10
test eax, eax
jne 0x4af55a
mov eax, dword [ebp - 4]
jmp 0x4af578
push eax
call fcn.004ae991
mov dword [esi], eax
pop ecx
neg eax
sbb eax, eax
and eax, 0xfffc0000
add eax, 0x40000
jmp 0x4af578
mov eax, 0x1000000
pop esi
leave
ret 0xc

Function at 0x4af941
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4af9d8
mov cl, byte [eax]
test cl, cl
je 0x4af9d8
push esi
push edi
mov edi, eax
mov edx, eax
cmp cl, 0x2f
je 0x4af96b
cmp cl, 0x5c
jne 0x4af96d
mov edi, edx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x4af961
cmp edi, eax
mov esi, edi
je 0x4af9a8
sub esi, eax
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00475fbc
and byte [ebp + esi - 0x104], 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.004af941
add esp, 0x14
lea esi, [edi + 1]
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.004720a0
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.004720b0
add esp, 0x10
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
leave
ret