joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8142d0
Capabilities:
Encode data using xor

Disassembly:
jns 0x814312
fisttp qword [ecx - 0x451adaf]
invalid
test eax, 0xe49d06a4
adc eax, 0x4a32104a
adc byte [edx], dh
dec edx
jp 0x81432f
in al, 0x19
movsd dword es:[edi], dword [esi]
out dx, al
mov bl, 0xb5
into
inc ebp
imul eax, dword [edi - 0xb], 6
je 0x81430b
outsd dx, dword [esi]
je 0x81438c
arpl word [ecx], ax
wait
xor ecx, dword [edx]
push ebx
xor al, 0x87
sub al, 0x5b
add dword [ebx + 0x34530a33], ebx
xchg dword [ebx + ebx*2], ebp
pop esi
add dword [edi + 0x33a3bacf], edx
test eax, 0x1c8622de
push ss
mov cl, 0x68
add dword [esi + 0x7db2d030], eax
push es
add dh, al
call 0x4eaa37d2
sar ecx, 0xc5
pop ecx
ja 0x814328
push edx
add ah, byte [ebx + 0x16]
iretd
add bh, cl
push ss
xchg ebx, eax
loop 0x8143a0
cmp byte [ebx - 0x78], 0x66
and esp, dword [eax - 0x7f]
add bh, al
loopne 0x8143c5
pushal
add dword [eax], 0xa466f566
cmc
movsb byte es:[edi], byte [esi]
pushal
add dword [eax], 0x51a84e26
ljmp 0x1634
xor al, 0x16
cdq
pushal
add dword [eax], 0x609eb65a
add dword [eax], 0xe7a368a3
push esp
pushal
add dword [eax], 0x2ab8f7b1
stosd dword es:[edi], eax
enter 0xffffffffffffb410, 0xffffffffffffffa9
idiv dword [eax + 0x10c8ab2a]
mov ah, 0xa9
adc byte [edx + eax*4 + 0x593a2f00], al
adc al, 0x84
add byte [eax], 0xf7
dec esi
push cs
or bl, byte [0xd8e0b83d]
mov eax, 0x82008284
test eax, 0x44407023
add dword [eax], 0x1853f130
test byte [edx + 0x7b42b700], al
cmp byte [ecx - 0x7d7b4745], ah
add byte [edx - 0xc], ah
pushal
add dword [eax], 0x6050aa37
add dword [eax], 0x61008724
add dword [eax], 0xfec63b06
scasd eax, dword es:[edi]
push cs
push 0xffffffffffffffdb
adc dword [eax - 0x7f], esp
add byte [esp + 0x4ce861f9], bl
pop ecx
das
jge 0x8143b0
inc esi
imul eax, dword [ecx + 2], 0xd6013bba
leave
mov eax, 0xd9008284
aam 0x53
mov ecx, 0x6821977d
sbb dl, byte [edx + 0x67f1bf8f]
push ss
adc ecx, dword [esp + edi*8 - 0x37]
inc edi
aad 0xbb
salc
arpl word [edx], dx
sbb ah, 0xc6
mov esp, eax
push es
test dword [0xf11e28bf], 0x849c91fa
pushal
nop
add byte [eax], 0x6d
bound edx, qword [ecx]
nop
add byte [eax], 0x62
xchg edi, eax
xchg edi, eax
insd dword es:[edi], dx
or dword [edi + eax*8 + 0x501fc3fa], edx
mov bl, 0x29
mul byte [eax + edx*4 - 0x7e]
add dh, bl
mov ebp, 0x8a628738
int3
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x40bc0f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov ecx, eax
shr eax, 1
push edi
not ecx
and ecx, 1
and eax, 1
xor ebx, ebx
push 0x28
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 4]
pop ecx
xor edi, edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 0x400
cmp eax, ecx
jle 0x40bc5b
add eax, 7
and eax, 0xfffffff8
mov dword [ebp - 4], eax
jmp 0x40bc60
mov dword [ebp - 4], ecx
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x40bcf3
cmp byte [ecx], bl
je 0x40bcf3
mov ebx, dword [esi + 8]
inc ebx
lea eax, [ebx + ebx]
push eax
call fcn.0040188a
mov edi, eax
pop ecx
test edi, edi
jne 0x40bc90
push 7
pop eax
jmp 0x40beff
push 0x48a48c
push dword [ebp + 0xc]
call fcn.0043a390
pop ecx
pop ecx
mov byte [edi], 0
test eax, eax
jne 0x40bcaf
mov dword [ebp - 0x14], 1
jmp 0x40bcbe
push edi
push ebx
push dword [ebp + 0xc]
push esi
call dword [esi + 0x24]
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ecx, edi
call 0x3fa436
cmp dword [ebp - 0xc], 0
mov dword [ebp - 8], eax
jne 0x40bcdd
add eax, 8
cmp eax, dword [esi + 8]
jle 0x40bcee
mov dword [ebp - 0xc], 0xe
mov esi, dword [ebp - 0xc]
push edi
call 0x3fa2ae
pop ecx
mov eax, esi
jmp 0x40beff
mov eax, dword [ebp - 4]
xor ebx, ebx
mov ecx, dword [esi + 4]
add eax, dword [ebp - 8]
add ecx, 7
and ecx, 0xfffffff8
lea eax, [ecx + eax*2 + 0xea]
push eax
call fcn.00401b7c
pop ecx
cmp eax, ebx
jne 0x40bd16
push 7
pop esi
jmp 0x40bce0
mov ebx, eax
add eax, 0xb0
mov dword [ebx + 0xa8], eax
add eax, 0x30
mov dword [ebx + 0x38], eax
mov ecx, dword [esi + 4]
add ecx, 7
and ecx, 0xfffffff8
add eax, ecx
mov dword [ebx + 0x40], eax
add eax, dword [ebp - 4]
mov dword [ebx + 0x3c], eax
add eax, dword [ebp - 4]
mov dword [ebx + 0x84], eax
test edi, edi
je 0x40bd8d
mov ecx, dword [ebp - 8]
push ecx
lea edx, [eax + ecx + 1]
push edi
push eax
mov dword [ebx + 0x88], edx
call int.004389b0
push dword [ebp - 8]
push edi
push dword [ebx + 0x88]
call int.004389b0
mov eax, dword [ebx + 0x88]
add eax, dword [ebp - 8]
push 8
push 0x48a480
push eax
Function at 0x405f3a
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x58
mov eax, 0x501436
call fcn.004da7d5
mov dword [ebp - 0x54], ecx
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
and dword [edi], 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx + 4]
sub eax, 0x200
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 0xe
ja 0x405f9f
push 0x10
call esi
mov ecx, 0x8000
test cx, ax
jne 0x405f93
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jne 0x405f93
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x405f9f
xor ebx, ebx
inc ebx
mov dword [edi], ebx
mov eax, ebx
jmp 0x406078
mov eax, dword [ebx + 4]
sub eax, 0x100
cmp eax, 9
ja 0x406072
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x405fd0
cmp dword [ebx + 8], 0x58
je 0x405fd0
cmp dword [ebx + 8], 0x43
je 0x405fd0
cmp dword [ebx + 8], 0x56
jne 0x405f93
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x405fea
cmp dword [ebx + 8], 0x25
je 0x405f93
cmp dword [ebx + 8], 0x27
je 0x405f93
cmp dword [ebx + 4], 0x100
jne 0x406072
mov eax, dword [ebx + 8]
cmp eax, 8
jne 0x406063
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x14]
call fcn.0040da82
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
je 0x406015
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov byte [ebp - 4], 2
test esi, esi
je 0x406046
mov dl, bl
mov ecx, esi
call fcn.0040db1f
test al, al
je 0x406046
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
jmp 0x406066
mov dword [edi], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
test esi, esi
je 0x405f98
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x405f98
xor ebx, ebx
inc ebx
add eax, 0xffffff90
cmp eax, 0xb
jbe 0x405f96
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.004da722
ret 0x10
Function at 0x406c4e
Capabilities:
Check if file exists

Disassembly:
push 0
mov eax, 0x50188e
call fcn.004da733
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x406c6c
xor al, al
jmp 0x406d1f
mov eax, dword [0x57f3cc]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.00406df5
and dword [ebp - 4], 0
mov ecx, 0x57f3cc
push dword [eax]
call fcn.004070b8
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040d743
test esi, esi
jne 0x406ce7
mov eax, dword [0x57f3cc]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.00406ec6
mov dword [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406d27
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x406d27
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040d743
push 1
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00406e5a
mov dword [ebp - 4], 6
push 0x533024
push dword [eax]
call fcn.004e27b0
pop ecx
pop ecx
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040d743
test esi, esi
setne al
call fcn.004da6fc
ret 4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x10]
call fcn.0040d743
jmp 0x406c65

Function at 0x40d59f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40d5f8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40d5e9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x40d5e5
cmp esi, ecx
jae 0x40d5e9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x40d5d3
cmp esi, ecx
jb 0x40d5ed
xor eax, eax
jmp 0x40d5f7
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40dbd7
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x502bdc
call fcn.004da767
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x48], esi
and dword [ebp - 0x44], 0
xor edi, edi
mov eax, dword fs:[0x2c]
inc edi
mov dword [ebp - 0x54], esi
mov ecx, dword [eax]
mov eax, dword [0x58276c]
cmp eax, dword [ecx + 4]
jg 0x40dd4b
push 0x533888
lea ecx, [ebp - 0x28]
call fcn.00404362
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
push edi
lea ecx, [ebp - 0x40]
call fcn.0046b9e0
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.004056f5
push str.html
lea ecx, [ebp - 0x28]
call fcn.00404362
mov byte [ebp - 4], 5
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.0046ae80
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.004056f5
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.0046d200
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x40dc7b
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x50], 0x532e68
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
call fcn.004056f5
cmp edi, 0xffffffff
jne 0x40dcdf
xor ebx, ebx
mov dword [esi + 0x14], 7
xor eax, eax
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 4
push edi
mov dword [ebp - 0x50], 0x532e68
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], ebx
jmp 0x40dd38
lea eax, [ebp - 0x40]
mov ecx, 0x582770
push eax
call fcn.0046ed00
cmp dword [ebx + 0x14], 8
mov ecx, ebx
jb 0x40dcf7
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x10]
lea edx, [ebp - 0x48]
xor ebx, ebx
add eax, eax
push ebx
push edx
push eax
push ecx
push edi
mov dword [ebp - 0x48], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea ecx, [ebp - 0x40]
call fcn.0046d200
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 4
mov dword [ebp - 0x50], 0x532e68
test edi, edi
je 0x40dd38
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
call fcn.004056f5
mov eax, esi
call fcn.004da711
ret
push 0x58276c
call fcn.004d9fbb
cmp dword [0x58276c], 0xffffffff
pop ecx
jne 0x40dc0d
mov dword [ebp - 4], edi
mov ecx, 0x582770
call fcn.0046e360
push 0x52514a
call fcn.004d9e02
mov byte [ebp - 4], 0
mov dword [esp], 0x58276c
call fcn.004d9f71
pop ecx
jmp 0x40dc0d

Function at 0x40eea5
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [esp + 8], edx
jbe 0x40eecb
push esi
mov esi, dword [esp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [esp + 0xc]
jb 0x40eeb7
pop esi
mov eax, ecx
ret

Function at 0x410dfd
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [esp + 0xc]
lea esi, [eax + 1]
push esi
call fcn.0040d85c
push esi
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
call fcn.00410dd4
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x41c89e
Capabilities:
Parse credit card information

Disassembly:
push 0x2c
mov eax, 0x505b70
call fcn.004da767
mov ebx, ecx
mov edi, ebx
lea eax, [ebx - 0x218]
neg edi
sbb edi, edi
and edi, eax
cmp dword [ebx + 0x14], 0
jne 0x41c8c7
xor al, al
jmp 0x41c9e4
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push eax
push 0x434
push dword [edi + 0x154]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x2c]
je 0x41c8f4
mov al, 1
jmp 0x41c9e4
mov al, byte [ebp + 8]
cbw
push eax
mov dword [ebp - 0x38], eax
call fcn.004e2ce2
pop ecx
test eax, eax
je 0x41c8ed
movsx ecx, byte [ebp + 8]
movzx eax, word [ebx]
mov dword [ebp - 0x2c], ecx
cmp eax, ecx
je 0x41c8c0
call fcn.0040d439
push eax
lea ecx, [ebp - 0x34]
call fcn.0040d250
mov dword [ebp - 4], 1
lea eax, [ebp - 0x34]
push eax
lea ecx, [edi + 4]
call fcn.00410dfd
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
push esi
call fcn.00404362
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebx + 0x14]
jae 0x41c9bc
add ebx, 4
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x41c95b
mov eax, dword [ebx]
movzx eax, word [eax + ecx*2]
cmp eax, 0x3d
ja 0x41c98a
je 0x41c9c8
sub eax, 0x23
je 0x41c976
dec eax
sub eax, 1
je 0x41c976
sub eax, 1
jmp 0x41c99c
push dword [ebp - 0x38]
call fcn.004e2ccf
pop ecx
test eax, eax
jne 0x41c9c8
push 0x1056
jmp 0x41c9b4
cmp eax, 0x3f
jb 0x41c99e
cmp eax, 0x40
jbe 0x41c9c8
cmp eax, 0x5e
je 0x41c9c8
cmp eax, 0x60
je 0x41c9c8
cmp dword [ebx + 0x14], 8
jb 0x41c9a6
mov ebx, dword [ebx]
movzx eax, word [ebx + ecx*2]
cmp dword [ebp - 0x2c], eax
je 0x41c9c8
push 0x1057
push ecx
mov ecx, edi
call fcn.0041c658
push 0x10
call dword [sym.imp.USER32.dll_MessageBeep]
xor ebx, ebx
jmp 0x41c9ca
mov bl, 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004056f5
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.0040d743
mov al, bl
call fcn.004da711
ret 4

Function at 0x4203e3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506689
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x57c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.004d9b4f
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], ecx
or dword [ebp - 4], 0xffffffff
push eax
push eax
push esi
push 0x4203a0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x420449
push 8
push esi
call fcn.004d9b41
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4204c1
Capabilities:
Reference sql statements

Disassembly:
push 0x34
mov eax, 0x5066e2
call fcn.004da767
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
push str.InstallerAnalytics.dll
mov dword [edi + 0xc], eax
call fcn.00404362
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00452db1
pop ecx
mov byte [ebp - 4], 1
lea esi, [edi + 0x10]
push eax
mov ecx, esi
call fcn.0040430d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004056f5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004056f5
push 0x535248
lea ecx, [ebp - 0x28]
call fcn.00404362
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, dword [ebp + 8]
push esi
call fcn.004abf31
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004056f5
cmp dword [esi + 0x14], 8
jb 0x42054f
mov esi, dword [esi]
push 0x5c
push esi
call fcn.004ddaca
pop ecx
pop ecx
test eax, eax
je 0x420594
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
je 0x420594
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeEmbeddedUI
push ebx
call esi
push str.ShutdownEmbeddedUI
push ebx
mov dword [edi], eax
call esi
push str.EmbeddedUIHandler
push ebx
mov dword [edi + 4], eax
call esi
mov dword [edi + 8], eax
mov eax, dword [edi]
test eax, eax
je 0x4205a3
push 0
push 0
push dword [edi + 0xc]
call eax
call fcn.004da711
ret 8

Function at 0x4297d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x2e4]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
push 0xfffffffffffffff0
push esi
call edi
test eax, 0x10000000
je 0x42982f
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42982f
push 0xfffffffffffffff0
push esi
call edi
shr eax, 0x10
test al, 1
je 0x42982f
push 0
push 0
push 0x87
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x42982f
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov al, 1
jmp 0x429861
push 0
push esi
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov edi, eax
test edi, edi
je 0x42985f
cmp edi, esi
je 0x42985f
push 0
push 0
push 0x87
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x42985f
push edi
jmp 0x429825
xor al, al
pop edi
pop esi
pop ebp
ret
Function at 0x42a25b
Capabilities:
Get disk size

Disassembly:
push 0xa8
mov eax, 0x508a59
call fcn.004da7d5
mov edi, ecx
mov dword [ebp - 0x88], edi
cmp dword [ebp + 8], 1
je 0x42a286
and dword [edi + 0x1a4], 0
xor eax, eax
jmp 0x42a406
xor ecx, ecx
mov dword [ebp - 4], ecx
wait
mov esi, dword [edi + 0x258]
mov ebx, dword [edi + 0x25c]
cmp esi, ebx
jne 0x42a2a5
xor eax, eax
inc eax
wait
jmp 0x42a406
mov dword [ebp - 0x98], esi
cmp esi, ebx
je 0x42a3b1
mov eax, dword [esi + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x54aef8]
lahf
test ah, 0x44
jnp 0x42a3a9
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x42a2f7
mov eax, dword [esi]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x94]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x90]
mov dword [esi + 0x24], eax
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x94]
call fcn.00500420
mulsd xmm0, qword [0x54af10]
mov eax, dword [esi + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
xorps xmm1, xmm1
comisd xmm1, xmm0
jbe 0x42a3a7
push 0x53413c
lea ecx, [ebp - 0x48]
call fcn.00404362
mov byte [ebp - 4], 1
push str.OutOfDiskSpace
lea ecx, [ebp - 0x30]
call fcn.00404362
mov byte [ebp - 4], 2
mov ecx, dword [edi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x48]
push edx
lea edx, [ebp - 0x30]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004056f5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004056f5
jmp 0x42a29c
xor ecx, ecx
add esi, 0x30
jmp 0x42a2a5
push 0x53746c
lea ecx, [ebp - 0x30]
call fcn.00404362
mov byte [ebp - 4], 3
push str.OutOfDiskSpace
lea ecx, [ebp - 0x48]
call fcn.00404362
mov byte [ebp - 4], 4
mov ecx, dword [edi + 0x1ac]
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x48]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.004056f5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004056f5
wait
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
call fcn.004da722
ret 4
Function at 0x42c9e3
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x14
mov eax, 0x508f20
call fcn.004da733
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 0x14]
and dword [esi], 0
test al, al
jne 0x42caec
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
inc ecx
test eax, eax
push 2
pop edx
cmovne ecx, edx
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
mov edx, 0x8000
mov cx, ax
and cx, dx
cmp byte [edi + 0x18], bl
sete bl
cmp dword [ebp + 0xc], 8
jne 0x42ca52
xor ax, ax
mov dword [esi], 1
cmp ax, cx
sbb esi, esi
neg esi
add esi, 2
jmp 0x42ca70
cmp dword [ebp + 0xc], 0x14
mov esi, ebx
jne 0x42ca70
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
xor ax, ax
cmp ax, cx
sbb ebx, ebx
neg ebx
add ebx, 2
push dword [edi - 0x24]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edi, eax
mov dword [ebp + 0x14], edi
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
push eax
push esi
push eax
mov ecx, dword [ecx + 0x14]
push edi
mov edx, dword [ecx]
call dword [edx + 0x18]
mov esi, dword [ebp - 0x10]
push 0
push ebx
push 2
mov ecx, dword [esi + 0x14]
push edi
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp dword [ebp + 0xc], 8
je 0x42caaf
cmp dword [ebp + 0xc], 0x14
jne 0x42cad9
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi - 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x1c], 0x12
call dword [sym.imp.USER32.dll_TrackMouseEvent]
mov edi, dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x42caec
and dword [ebp + 0x14], 0
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
call fcn.004da6fc
ret 0x10