joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x4060b4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x4060b8]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.00402968
jmp 0x4011d3
mov eax, dword [0x4060b8]
test eax, eax
jne 0x4011c9
mov dword [0x4060b8], 1
mov dword [esp + 4], 0x408014
mov dword [esp], 0x40800c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011d3
mov dword [0x40601c], 1
mov eax, dword [0x4060b8]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x408008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x4060b8], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x4060b4
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.00401e55
mov dword [esp], 0x401f70
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x406074], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.004017f4
mov eax, dword [0x406004]
mov dword [esp + 4], 0x406008
mov dword [esp], eax
call fcn.004013c8
call fcn.00401630
mov eax, dword [0x403024]
mov edx, dword [0x40600c]
mov dword [eax], edx
mov ecx, dword [0x40600c]
mov edx, dword [0x406008]
mov eax, dword [0x406004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00401590
mov dword [0x406014], eax
mov eax, dword [0x406018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x406014]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x40601c]
test eax, eax
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x406014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40604c], 1
mov dword [0x406050], 1
mov dword [0x406054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x4017fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004027d8
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x4023d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4023ef
mov eax, 0
jmp 0x402433
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402412
mov eax, 0
jmp 0x402433
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40242e
mov eax, 0
jmp 0x402433
mov eax, 1
leave
ret
Function at 0x402435
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x402494
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40248c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40248c
mov eax, dword [ebp - 4]
jmp 0x4024a8
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402469
mov eax, 0
leave
ret
Function at 0x4016fa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x164
lea edx, [ebp - 0x13c]
mov eax, 0
mov ecx, 0xb
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x13c], 0x2c
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetWindowTextA_12
sub esp, 0xc
test eax, eax
je 0x40180f
mov dword [esp + 4], str.Chromium
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x40180f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._SetForegroundWindow_4
sub esp, 4
mov dword [esp], 0
call sym._GetSystemMetrics_4
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [esp], 1
call sym._GetSystemMetrics_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [esp + 0x18], 0x40
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._SetWindowPos_28
sub esp, 0x1c
lea eax, [ebp - 0x13c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetWindowPlacement_8
sub esp, 8
mov eax, dword [ebp - 0x134]
cmp eax, 3
je 0x40180f
mov dword [esp + 4], 3
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
mov eax, 1
mov edi, dword [ebp - 4]
leave
ret 8

Function at 0x40181b
Capabilities:
Enumerate gui resources

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call sym.___main
call dbg.hide_taskbar
call dbg.CreateBlackWindow
mov dword [ebp - 0xc], str.ungoogled_chromium_portablepchrome.exe
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.open_exe
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], dbg.EnumWindowsProc@8
call sym._EnumWindows_8
sub esp, 8
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._TranslateMessage_4
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._DispatchMessageA_4
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], dbg.EnumWindowsProc@8
call sym._EnumWindows_8
sub esp, 8
mov dword [esp], 0x64
call sym._Sleep_4
sub esp, 4
jmp 0x401873
Function at 0x401f00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x401f4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401f44
test esi, esi
je 0x401f44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f20
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402130
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402180
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402258
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4021be
cmp eax, 4
jne 0x4021e0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4021ce
cmp edx, 4
je 0x4021ce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402130

Function at 0x480428
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x480447
cmp eax, dword [esp + 0x28]
je 0x48045e
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x48043e
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
mov dword [esp + 0x1c], edx
popal
ret 8
Function at 0x40107b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x4522b0
push dword [ebp + 8]
call fcn.0043ea47
mov esi, eax
xor ebx, ebx
pop ecx
pop ecx
cmp esi, ebx
jne 0x4010b1
push ebx
push 0x4522b4
push str.Error:_Can_not_open_report_file._In_ReadReport
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0043e923
push esi
call fcn.00445ee4
push eax
call fcn.00451000
mov edi, eax
push edi
push 1
call fcn.0043e660
add esp, 0x10
mov dword [0x475928], eax
cmp eax, ebx
jne 0x4010ee
push ebx
push str.BMSIM
push str.Error:_Out_of_Memory._In_ReadReport
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0043e5ec
pop ecx
jmp 0x4010aa
push esi
push edi
push 1
push eax
call fcn.0043e562
mov ecx, dword [0x475928]
push esi
mov byte [ecx + eax], bl
call fcn.0043e5ec
mov eax, dword [0x475928]
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4011d2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 8]
call esi
push 5
push dword [ebp + 8]
call esi
pop esi
pop ebp
ret

Function at 0x401308
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop ebp
ret
Function at 0x401adf
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48bb40]
sub esp, 0x28
push ebx
mov ebx, dword [eax*4 + 0x4c3658]
push esi
xor esi, esi
cmp dword [0x4a1288], esi
je 0x401cc6
xor eax, eax
cmp dword [ebp + 8], 1
sete al
cmp dword [ebp + 0xc], 0x1b
mov dword [0x4b722c], eax
jne 0x401b2b
push dword [0x4c3658]
call dword [sym.imp.USER32.dll_GetMenu]
mov dword [0x481394], eax
jmp 0x401cc6
cmp dword [ebp + 0xc], 0xd
push edi
jne 0x401b42
cmp dword [ebp + 8], esi
jne 0x401b3c
cmp dword [ebp + 0x10], ebx
jne 0x401bb2
push ebx
jmp 0x401cba
cmp dword [ebp + 8], 3
jne 0x401bac
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [ebp - 8], 0
jne 0x401bb2
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x10]
call edi
cmp dword [0x4a1288], esi
jle 0x401bb2
lea eax, [ebp - 0x18]
push eax
push dword [esi*4 + 0x4c3658]
call edi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffc
cmp eax, dword [ebp - 0x24]
jne 0x401b97
mov eax, dword [ebp - 0x18]
add eax, 0xfffffffc
cmp eax, dword [ebp - 0x28]
je 0x401ba2
inc esi
cmp esi, dword [0x4a1288]
jl 0x401b74
jmp 0x401bb2
mov eax, dword [esi*4 + 0x4c3658]
mov dword [ebp + 0x10], eax
cmp dword [ebp + 8], 4
je 0x401c28
push 4
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
cmp byte [ebp - 8], 0x45
jne 0x401bd9
cmp dword [ebp + 8], 5
je 0x401be1
push dword [0x4e33c0]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x401be1
push 0
call fcn.004016f2
pop ecx
cmp dword [ebp + 8], 3
je 0x401bf8
cmp dword [ebp + 8], 5
je 0x401bf3
cmp dword [ebp + 8], 0
jne 0x401c28
cmp dword [ebp + 0x10], ebx
je 0x401c28
mov eax, dword [0x4a1288]
xor ecx, ecx
test eax, eax
jle 0x401c6b
mov edx, dword [ecx*4 + 0x4c3658]
cmp edx, dword [ebp + 0x10]
je 0x401c16
inc ecx
cmp ecx, eax
jl 0x401c03
jmp 0x401c6b
cmp dword [ebp + 8], 5
mov dword [0x48bb40], ecx
je 0x401cc5
jmp 0x401c6b
mov ecx, dword [0x4a1288]
xor esi, esi
test ecx, ecx
jle 0x401c6b
cmp dword [ebp + 0xc], 0x26
mov eax, dword [0x48bb40]
jne 0x401c45
lea eax, [ecx + eax - 1]
jmp 0x401c46
inc eax
cdq
idiv ecx
push dword [edx*4 + 0x4c3658]
mov dword [0x48bb40], edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x401c6b
mov ecx, dword [0x4a1288]
inc esi
cmp esi, ecx
jl 0x401c34
mov eax, dword [0x48bb40]
mov esi, dword [eax*4 + 0x4c3658]
push 4
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
cmp byte [ebp - 8], 0x45
je 0x401c94
push 1
call fcn.004016f2
pop ecx
jmp 0x401cab
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp + 0xc], 0xd
jne 0x401cc5
cmp dword [ebp + 8], 0
jne 0x401cc5
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetMenu]
mov dword [0x481394], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d6a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, 0x4cdce8
push edi
call fcn.0043f520
mov ebx, dword [ebp + 8]
mov dword [esp], 0x4a2b60
mov esi, eax
push ebx
shr esi, 1
add esi, dword [ebp + 0x10]
inc dword [0x48138c]
lea eax, [ebp - 0x28]
push str.__s______s
push eax
call fcn.0043ee44
add esp, 0x10
cmp dword [0x4bfeac], 0
jne 0x402dea
mov eax, dword [ebx]
cmp eax, dword [0x4a29d8]
je 0x402dea
push dword [0x48138c]
mov dword [0x4a29d8], eax
mov eax, dword [0x4e33c4]
push dword [ebp + 0xc]
imul eax, eax, 0x7a
push ebx
add eax, 0x49ff78
inc dword [0x4e33c4]
push str.__s:__s____Page__d
push eax
call fcn.0043ee44
add esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 0xc]
call fcn.0043f520
pop ecx
shr eax, 1
add eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x7a
pop eax
sub eax, esi
push eax
push edi
mov edi, 0x4def10
push edi
call fcn.0043f520
pop ecx
sub esi, eax
push esi
push edi
push str._n_s_s_s_n_s_n
mov esi, 0x4debb0
push esi
call fcn.0043ee44
push dword [0x4cdd1c]
mov edi, eax
push edi
push 1
push esi
call fcn.0043ffdf
add esp, 0x34
cmp dword [0x4a25a4], 0
je 0x402e7e
mov byte [edi + 0x4debaf], 0
push 0xa
mov edi, 0x4debb1
push edi
call fcn.0043d2a0
mov ebx, eax
push edi
push 0x45273c
mov byte [ebx], 0
call fcn.004015cb
inc ebx
push ebx
push 0x452740
call fcn.004015cb
add esp, 0x18
add dword [0x4bfea8], 2
cmp dword [ebp + 0x14], 0
je 0x402ed8
push dword [ebp + 0x14]
push dword [ebp + 0x14]
call fcn.0043f520
shr eax, 1
add eax, dword [ebp + 0x10]
pop ecx
push eax
push str._s_n
push esi
call fcn.0043ee44
push dword [0x4cdd1c]
mov edi, eax
push edi
push 1
push esi
call fcn.0043ffdf
add esp, 0x20
cmp dword [0x4a25a4], 0
je 0x402ed8
push esi
push 0x45274c
mov byte [edi + 0x4debaf], 0
call fcn.004015cb
inc dword [0x4bfea8]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415b97
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
xor ebx, ebx
cmp dword [0x49f370], ebx
je 0x415c7e
cmp dword [ebp + 8], ebx
je 0x415c7e
push esi
push edi
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x12c]
push eax
call fcn.0044039b
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push 0x48e09c
push 0x190
mov edi, 0x4c7050
push edi
push ebx
call fcn.004402cd
add esp, 0xc
push eax
push str._s_s_s.XLS
mov esi, 0x4debb0
push esi
call fcn.0043ee44
push 0x457eac
push esi
call fcn.0043ea47
add esp, 0x1c
mov dword [0x4c3654], eax
cmp eax, ebx
je 0x415c48
push eax
call fcn.0043e5ec
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x415c48
call fcn.00415b2a
push str._Warning:__No_XLS_files_will_be_created..._nPlease_check_your_task_list__Ctrl_Alt_Del__nTo_see_if_a__Hidden__copy_of__Excel__is_running._nIf_so__Please__End_Task__it.
mov dword [0x49e298], ebx
mov dword [0x47cf78], ebx
call fcn.004017a0
pop ecx
jmp 0x415c7c
push dword [ebp + 0x10]
push 0x457f5c
push edi
call fcn.0043ee44
push esi
push edi
call fcn.00401308
push esi
push str.Open
push dword [0x49f370]
call fcn.0040156c
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x46a5b8]
add esp, 0x20
mov dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415f79
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push dword [0x4e33c0]
call dword [sym.imp.USER32.dll_SetFocus]
xor edi, edi
mov dword [0x481394], edi
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
cmp dword [ebp - 0x18], 0xa1
mov eax, dword [ebp - 0x14]
jne 0x415fb7
cmp eax, 0x14
je 0x41609f
cmp dword [ebp - 0x18], 0x201
jne 0x415ffa
xor eax, eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax*4 + 0x49f358]
je 0x4160a9
inc eax
cmp eax, 5
jl 0x415fc2
mov eax, dword [ebp - 0x10]
mov dword [0x49e2c4], eax
shr eax, 0x10
cwde
cmp eax, dword [0x49e2c8]
jg 0x41608d
mov eax, 0xfe
jmp 0x4160a2
cmp dword [ebp - 0x18], 0x100
jne 0x416079
lea ecx, [eax - 0x60]
mov esi, eax
cmp ecx, 9
ja 0x416012
add eax, 0xffffffd0
jmp 0x41601b
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [0x4b388c], eax
cmp eax, edi
jne 0x4160b2
cmp esi, 0x26
je 0x4160f9
cmp esi, 0x28
je 0x4160f9
cmp esi, 0x21
je 0x4160f9
cmp esi, 0x22
je 0x4160f9
cmp esi, 0x25
je 0x4160f9
cmp esi, 0x27
je 0x4160f9
cmp esi, 0x2e
je 0x4160f9
cmp esi, 0x24
je 0x4160f9
cmp esi, 0x23
je 0x4160f9
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [0x481394], edi
je 0x415f95
xor eax, eax
pop edi
pop esi
leave
ret
push 0x1b
pop eax
mov dword [0x4b388c], eax
jmp 0x41609b
mov eax, dword [eax*4 + 0x466ed4]
jmp 0x4160a2
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x4160d9
cmp dword [0x4b388c], 9
jne 0x4160d9
mov dword [0x4b388c], 0x109
push 0x11
call esi
test di, ax
je 0x4160f2
cmp dword [0x4b388c], 0x40
jle 0x4160f2
sub dword [0x4b388c], 0x40
mov eax, dword [0x4b388c]
jmp 0x41609b
lea eax, [esi + 0x100]
jmp 0x4160a2
Function at 0x4164d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [0x47cf7c]
call fcn.0043f0db
xor edi, edi
pop ecx
mov dword [0x47cf7c], edi
cmp dword [ebp + 8], edi
jne 0x4165d7
push 0x45b70c
mov esi, 0x4a3294
push esi
call fcn.0043ea47
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x41652d
push esi
push str.Cant_W_Open:___s_
push 0x4debb0
call fcn.0043ee44
add esp, 0xc
xor eax, eax
jmp 0x4165da
fild dword [0x4815f4]
mov eax, dword [0x4815f4]
push edi
mov dword [0x4c9b8c], eax
fmul qword [0x45ce80]
fadd qword [0x45ce78]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fmul qword [0x45d248]
call fcn.0043f5b0
push eax
push ebx
call fcn.004404fd
mov eax, dword [0x4c9b8c]
mov esi, dword [eax*4 + 0x466280]
push esi
call fcn.0043f481
mov edi, eax
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
add esp, 0x10
xor ecx, ecx
test eax, eax
jle 0x41659c
mov edx, 0x48ce7c
fld dword [edx]
add edx, 0x24
fstp dword [edi + ecx*4]
inc ecx
cmp ecx, eax
jl 0x41658f
push ebx
push esi
push 1
push edi
call fcn.0043ffdf
push edi
call fcn.0043f0db
push 0
push 0x5c3c
push ebx
mov dword [ebp + 8], 0xddcceeab
call fcn.004404fd
push ebx
push 4
lea eax, [ebp + 8]
push 1
push eax
call fcn.0043ffdf
push ebx
call fcn.0043e5ec
add esp, 0x34
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret