joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40650a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40652e
xor eax, eax
test eax, eax
je 0x406541
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406541
xor ecx, ecx
jmp 0x406544
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40662b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43192c], 0
push esi
jne 0x406662
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40663c
mov dword [ecx*4 + 0x431928], eax
inc ecx
cmp ecx, 0x100
jl 0x406637
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406693
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431928]
xor eax, esi
inc ecx
dec edx
jne 0x406675
pop edi
not eax
pop esi
ret 0xc
Function at 0x40adf4
Capabilities:
Get graphical window text

Disassembly:
sub dword [esp + 4], 4
jmp fcn.0040b170

Function at 0x40b170
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add dword [ebp + 8], 4
pop ebp
jmp fcn.004249a0

Function at 0x4104af
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a57a
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5d061c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x64]
cmp eax, dword [0x5d002c]
jl 0x410550
mov ecx, dword [0x5d0030]
test ecx, ecx
je 0x410506
push dword [edi + 0x6c]
push dword [edi + 0x74]
push dword [edi + 0x78]
push dword [edi + 0x70]
push dword [edi + 0x68]
push eax
lea eax, [edi + 0x7c]
push eax
push edi
call ecx
add esp, 0x20
jmp 0x410550
cmp byte [0x5d0028], 0
je 0x410550
push 0x465
call fcn.004fa51d
push dword [edi + 0x78]
lea ecx, [edi + 0x7c]
mov esi, eax
push dword [edi + 0x70]
push dword [edi + 0x74]
push ecx
push edi
push 0x5699ec
push 0xffffffffffffffff
push 0x464
push esi
call fcn.0041090e
add esp, 0x28
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.004f5b30
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x428830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x56f7e0
push dword [ebp + 8]
call fcn.00508392
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42888d
push ebx
push edi
push esi
call fcn.00508459
push eax
call fcn.0050875a
mov edi, eax
pop ecx
pop ecx
cmp edi, dword [ebp + 0x10]
jbe 0x42886c
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x428882
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.004f73a9
xor ebx, ebx
add esp, 0x10
cmp edi, eax
sete bl
push esi
call fcn.004f7817
pop ecx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x4288e2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00429480
mov edi, eax
test edi, edi
je 0x42891b
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x42891b
cmp dword [ebp + 0x18], ebx
jae 0x428924
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x42891b
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x42891b
push ebx
push eax
push dword [ebp + 0x14]
call fcn.004ce9e0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
jmp 0x42891d

Function at 0x428a61
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x144
mov eax, 0x55c888
call fcn.004cca4a
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x128], esi
test eax, eax
jne 0x428aff
push 0x56f7d0
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.00428400
and dword [ebp - 4], 0
push ebx
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.00428400
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 2
call fcn.0040d1d0
lea ecx, [ebp - 0x124]
call fcn.0040d2f9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x428ad6
test al, 0x20
jne 0x428ae6
push 0x5698e0
lea ecx, [ebp - 0x124]
call fcn.0040d293
lea eax, [ebp - 0x124]
mov ecx, esi
push eax
call fcn.0040cf77
lea ecx, [ebp - 0x124]
jmp 0x428b82
push ebx
push eax
lea ecx, [ebp - 0x118]
call fcn.004281dd
lea eax, [ebp - 0x118]
push eax
lea ecx, [edi + 0x14]
call fcn.00429462
mov ebx, eax
test ebx, ebx
jne 0x428b2f
push 0x5698e0
mov ecx, esi
call fcn.0040cfed
jmp 0x428b87
push 0x56f7d0
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.00428400
lea ecx, [ebx + 0x108]
mov dword [ebp - 4], 3
push ecx
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.004283aa
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 5
call fcn.0040d1d0
lea eax, [ebp - 0x138]
mov ecx, esi
push eax
call fcn.0040cf77
lea ecx, [ebp - 0x138]
call fcn.0040d1d0
mov eax, esi
call fcn.004cc9f9
ret 0xc
Function at 0x429805
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x288
mov eax, 0x55c90f
call fcn.004cca4a
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x288]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x264], eax
call fcn.0040d0ce
and dword [ebp - 4], 0
lea eax, [ebx + 8]
test edi, edi
je 0x42989a
push 0x56f7d0
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00428400
push edi
push eax
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 1
push eax
call fcn.00428400
push str..
push eax
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 2
push eax
call fcn.00428400
push eax
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 3
call fcn.0040d22c
lea ecx, [ebp - 0x270]
call fcn.0040d1d0
lea ecx, [ebp - 0x294]
call fcn.0040d1d0
jmp 0x4298bc
push str..
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00428400
push eax
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 4
call fcn.0040d22c
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0
call fcn.0040d1d0
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.0040e626
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x429a1f
lea ecx, [ebp - 0x270]
call fcn.0040d0ce
mov byte [ebp - 4], 5
test edi, edi
jne 0x429917
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x270]
call fcn.0040d293
jmp 0x42996d
lea ecx, [ebp - 0x294]
call fcn.0040d0ce
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 6
push ecx
push edi
push str._s_s
lea ecx, [ebp - 0x27c]
push ecx
push eax
call fcn.0040d9bb
add esp, 0x14
push eax
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 7
call fcn.0040d22c
lea ecx, [ebp - 0x27c]
call fcn.0040d1d0
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 5
call fcn.0040d1d0
test byte [ebp - 0x260], 0x10
je 0x4299c3
lea eax, [ebp - 0x234]
push 0x56f834
push eax
call fcn.004f82f7
pop ecx
pop ecx
test eax, eax
je 0x4299e6
lea eax, [ebp - 0x234]
push 0x56f838
push eax
call fcn.004f82f7
pop ecx
pop ecx
test eax, eax
je 0x4299e6
push dword [ebp + 0x10]
lea eax, [ebp - 0x270]
push dword [ebp - 0x264]
push eax
call fcn.0040e626
push eax
mov ecx, ebx
call fcn.00429805
jmp 0x4299e6
test byte [ebp - 0x260], 0xa1
je 0x4299e6
push dword [ebp + 0x10]
lea eax, [ebp - 0x270]
push eax
call fcn.0040e626
push eax
call dword [ebp - 0x264]
test eax, eax
je 0x429a0d
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0
call fcn.0040d1d0
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4298f0
jmp 0x429a18
lea ecx, [ebp - 0x270]
call fcn.0040d1d0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x288]
call fcn.0040d1d0
call fcn.004cc9f9
ret 0xc

Function at 0x42c3ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp method.SOUI::SHostWnd.2.virtual_44
Function at 0x431b95
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xc
mov eax, 0x55d226
call fcn.004cca17
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x58]
call fcn.00534fdc
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00431c9a
push dword [ebp + 0x10]
test eax, eax
je 0x431beb
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00428400
lea ecx, [ebp - 0x18]
call fcn.0040d2f9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
lea ecx, [ebp - 0x18]
cmp eax, 0xffffffff
setne bl
call fcn.0040d1d0
jmp 0x431bfb
push dword [ebp + 0xc]
mov ecx, edi
call fcn.004316a5
neg eax
sbb ebx, ebx
neg ebx
lea ecx, [edi + 0x58]
mov dword [ebp - 4], 1
call fcn.00534fe7
mov eax, ebx
call fcn.004cc9e5
ret 0xc
Function at 0x446d15
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 1
push edi
mov eax, dword [edi]
call dword [eax + 0x30]
mov dx, word [edi + 0x348]
xor ebx, ebx
add dx, word [ebp + 0xc]
mov dword [ebp - 4], eax
movsx eax, dx
cdq
push 0x78
pop ecx
idiv ecx
movzx eax, ax
mov dword [ebp + 0xc], eax
cwde
mov word [edi + 0x348], dx
cdq
xor eax, edx
sub eax, edx
movzx esi, ax
xor eax, eax
cmp ax, si
jge 0x446dc0
xor ecx, ecx
cmp word [ebp + 0xc], ax
setle cl
mov dword [ebp - 8], ecx
mov eax, dword [edi]
push 0
push ecx
push dword [ebp - 4]
mov ecx, edi
call dword [eax + 0x38]
test eax, eax
je 0x446d8a
mov ecx, edi
call fcn.00447c30
mov ecx, dword [ebp - 8]
inc ebx
cmp bx, si
jl 0x446d69
cmp bx, si
jge 0x446dc5
push dword [ebp + 0x14]
sub esi, ebx
push dword [ebp + 0x10]
mov eax, esi
neg eax
cmp word [ebp + 0xc], 0
movzx ecx, ax
movzx eax, si
cmovg ecx, eax
movsx eax, cx
lea ecx, [edi + 4]
imul eax, eax, 0x78
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.00443904
jmp 0x446dc5
test si, si
je 0x446e00
lea eax, [edi + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
movzx edx, word [ebp + 0x14]
mov edi, eax
movzx ecx, word [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
shl edx, 0x10
or edx, ecx
push edx
push dword [ebp + 8]
push 0x200
push edi
call esi
push 0x2000001
push edi
push 0x20
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x44b17a
Capabilities:
Create process on windows

Disassembly:
push 0x18
mov eax, 0x55f781
call fcn.004cca17
mov edi, ecx
push dword [ebp + 0x10]
lea eax, [edi + 0x24c]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x44b1aa
mov eax, dword [edi]
push edi
call dword [eax + 0x114]
jmp 0x44b220
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044374a
lea esi, [edi + 0x25c]
push esi
lea ecx, [ebp - 0x18]
call fcn.0040cf77
mov eax, dword [esi]
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call dword [eax + 0x10]
test eax, eax
je 0x44b1ff
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ebx
push ecx
mov ecx, edi
call dword [eax + 0x228]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0040d22c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.0040d1d0
push 1
push ebx
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040d2f9
push eax
push 0x579db0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.0040d1d0
call fcn.004cc9e5
ret 0xc
Function at 0x44dd69
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5d061c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.004cf7f0
add esp, 0xc
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x44ddc4
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x44ddd8
cmp byte [ebp - 6], 1
jne 0x44ddd8
xor eax, eax
cmp dword [ebp - 0x11c], 6
sete al
jmp 0x44ddda
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004cc144
leave
ret
Function at 0x462522
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
push edi
lea edi, [ebp - 0xc]
mov esi, dword [ebx + 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 9
je 0x4625b7
sub eax, 1
je 0x46259a
sub eax, 3
je 0x46259a
test dword [ebx + 0x4b8], 0x2000
je 0x462570
push esi
call fcn.00509760
pop ecx
test eax, eax
jne 0x462570
cmp esi, 0x2d
je 0x462570
cmp esi, 0x2e
je 0x462570
cmp esi, 0x2c
jne 0x4625e9
mov ecx, dword [ebx + 0x4b8]
test cl, 8
je 0x462588
lea eax, [esi - 0x61]
cmp eax, 0x19
ja 0x462588
add esi, 0xffffffe0
jmp 0x4625d2
test cl, 0x10
je 0x4625cf
lea eax, [esi - 0x41]
cmp eax, 0x19
ja 0x4625cf
add esi, 0x20
jmp 0x4625d2
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x4625cf
test dword [ebx + 0x4b8], 0x1000
je 0x4625e9
jmp 0x4625cf
test byte [ebx + 0x4bc], 0x80
jne 0x4625cf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x4625e9
mov esi, dword [ebp - 8]
mov eax, dword [ebx + 0x4d0]
push 0
push dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push esi
push dword [ebp - 0xc]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x462968
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x30
mov eax, 0x561284
call fcn.004cca4a
mov esi, ecx
xor ecx, ecx
lea edi, [esi + 8]
test esi, esi
mov eax, edi
cmove eax, ecx
lea ecx, [ebp - 0x3c]
push eax
call fcn.0041e1f3
mov dword [ebp - 0x3c], 0x57efd0
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x3c]
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
push ecx
push edi
mov dword [ebp - 0x1c], ebx
call dword [eax + 0x1f0]
cmp dword [ebp - 0x14], 0
jne 0x4629f6
cmp ebx, 0xd
jne 0x4629d9
test dword [esi + 0x4b8], 0x1000
jne 0x4629d9
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x4629f6
mov eax, dword [esi + 0x4d0]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x70]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
jmp 0x4629ff
push 0
mov ecx, edi
call fcn.00444c0c
lea ecx, [ebp - 0x3c]
call fcn.0041ea49
call fcn.004cc9f9
ret 0xc
Function at 0x465e53
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x28
mov eax, 0x5616bf
call fcn.004cca17
mov dword [ebp - 0x10], ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
push 0x11
mov edi, eax
call esi
mov ebx, eax
push 0x10
and ebx, 0x8000
call esi
and eax, 0x8000
test edi, 0x8000
jne 0x465ea3
test ebx, ebx
jne 0x465e97
test eax, eax
je 0x465ebd
push 4
jmp 0x465ebc
test eax, eax
jne 0x465e9f
push 2
jmp 0x465ebc
push 6
jmp 0x465ebc
test ebx, ebx
jne 0x465eb2
test eax, eax
jne 0x465eae
inc eax
jmp 0x465ebd
push 5
jmp 0x465ebc
test eax, eax
jne 0x465eba
push 3
jmp 0x465ebc
push 7
pop eax
mov ebx, dword [ebp - 0x10]
cmp ax, word [ebx + 0x258]
jne 0x465ed2
movzx eax, word [ebx + 0x25a]
jmp 0x465ed5
movzx eax, ax
xor ecx, ecx
mov word [ebx + 0x254], ax
lea esi, [ebx + 4]
test ebx, ebx
mov eax, esi
cmove eax, ecx
lea ecx, [ebp - 0x34]
push eax
call fcn.0041e1f3
mov dword [ebp - 0x34], 0x58071c
mov ax, word [ebx + 0x254]
lea ecx, [ebp - 0x34]
and dword [ebp - 4], 0
mov word [ebp - 0x12], ax
mov ax, word [ebx + 0x256]
mov word [ebp - 0x14], ax
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x1f0]
lea ecx, [ebp - 0x34]
call fcn.0041ea49
call fcn.004cc9e5
ret

Function at 0x47bc92
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
push edi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x47bd1a
push edi
call fcn.004fa51d
mov esi, eax
pop ecx
test esi, esi
je 0x47bd1a
push esi
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x56f7d0
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x47bd0e
cmp dword [ebp - 8], 0x34
jb 0x47bd0e
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x18]
mov cx, word [edx + 0xc]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov cx, word [edx + 0xe]
mov word [eax], cx
mov eax, dword [ebp + 0x10]
mov cx, word [edx + 8]
mov word [eax], cx
mov eax, dword [ebp + 0xc]
mov cx, word [edx + 0xa]
mov word [eax], cx
push esi
call fcn.004f5b30
xor eax, eax
pop ecx
inc eax
jmp 0x47bd1c
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x47c496
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563297
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5d061c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x70]
call fcn.00533a3f
lea ecx, [esi + 0x64]
call fcn.0040d1d0
lea ecx, [esi + 0x58]
call fcn.0040d1d0
lea ecx, [esi + 0x44]
call fcn.0043108c
lea ecx, [esi + 0x30]
call fcn.004310cd
lea ecx, [esi + 0x1c]
call fcn.0043104b
and dword [ebp - 4], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47c4ff
add eax, 0xc
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], 1
test eax, eax
je 0x47c516
add eax, 0xc
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], 2
test eax, eax
je 0x47c52d
add eax, 0xc
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [esi + 8]
mov dword [ebp - 4], 3
test eax, eax
je 0x47c544
add eax, 0xc
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov dword [esi], vtable.SOUI::TObjRefImpl_struct_SOUI::IUiDefInfo_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x48be44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 9
jne 0x48be7c
push dword [ecx + 4]
call fcn.004363be
pop ecx
test eax, eax
je 0x48be67
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14c]
test al, 2
jne 0x48be7c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor eax, 0x8000
shr eax, 0xf
jmp 0x48be7e
xor eax, eax
pop ebp
ret 4

Function at 0x48bfb7
Capabilities:
Log keystrokes via polling

Disassembly:
push 8
mov eax, 0x564118
call fcn.004cca17
mov ebx, ecx
mov edi, dword [ebp + 8]
push edi
call fcn.0048be44
test eax, eax
je 0x48bff2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, ebx
and al, 1
movzx eax, al
push eax
call fcn.0048b8aa
xor eax, eax
inc eax
jmp 0x48c0f9
push dword [ebx + 4]
call fcn.004363be
mov esi, eax
mov dword [ebp + 8], esi
pop ecx
test esi, esi
je 0x48c0a3
mov ecx, dword [esi]
push esi
call dword [ecx + 0x1cc]
test eax, eax
je 0x48c0a3
cmp edi, 0x25
je 0x48c031
cmp edi, 0x27
je 0x48c02d
cmp edi, 0x26
je 0x48c031
cmp edi, 0x28
jne 0x48c0a3
push 3
jmp 0x48c033
push 2
pop edi
jmp 0x48c043
mov ecx, dword [esi]
push esi
call dword [ecx + 0x1cc]
test eax, eax
jne 0x48c064
push edi
mov ecx, esi
call fcn.00441566
mov esi, eax
test esi, esi
jne 0x48c036
mov ecx, dword [ebp + 8]
cmp edi, 3
setne al
push eax
call fcn.0044105c
mov ecx, eax
jmp 0x48c07e
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x58]
jmp 0x48c096
mov ecx, dword [esi]
push esi
call dword [ecx + 0x1cc]
test eax, eax
jne 0x48c08e
push edi
mov ecx, esi
call fcn.00441566
mov esi, eax
test esi, esi
jne 0x48c06e
jmp 0x48bfea
mov ecx, dword [esi]
push 1
push esi
call dword [ecx + 0x58]
push eax
mov ecx, ebx
call fcn.0048c3eb
jmp 0x48bfea
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x12
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
shr eax, 0xf
lea ecx, [ebp - 0x14]
and al, 1
movzx eax, al
push eax
push edi
call fcn.004929d2
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.0048c14d
xor ebx, ebx
lea ecx, [ebp - 0x14]
test al, al
setne bl
call fcn.00492a3c
mov eax, ebx
call fcn.004cc9e5
ret 4
Function at 0x492b3f
Capabilities:
Log keystrokes

Disassembly:
push 0x10
mov eax, 0x5646f8
call fcn.004cca17
xor esi, esi
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0040d0ce
mov ecx, dword [ebp + 0xc]
movzx edx, cx
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
push 3
pop esi
cmp edx, 0x25
ja 0x492bf0
je 0x492be6
mov eax, edx
sub eax, 0xd
je 0x492bdc
sub eax, 0xe
je 0x492bd2
sub eax, 5
je 0x492bc8
sub eax, 1
je 0x492bbe
sub eax, 1
je 0x492bb4
sub eax, 1
je 0x492baa
sub eax, 1
jne 0x492c28
push str.Home
jmp 0x492d3d
push 0x58a068
jmp 0x492d3d
push str.PageDown
jmp 0x492d3d
push str.PageUp
jmp 0x492d3d
push str.Space
jmp 0x492d3d
push 0x58a01c
jmp 0x492d3d
push 0x58a024
jmp 0x492d3d
push str.Left
jmp 0x492d3d
mov eax, edx
sub eax, 0x26
je 0x492d38
sub eax, 1
je 0x492d31
sub eax, 1
je 0x492d2a
dec eax
sub eax, 1
je 0x492d23
sub eax, esi
je 0x492d1c
sub eax, 1
je 0x492d15
cmp cx, 0x30
jb 0x492c34
cmp cx, 0x39
jbe 0x492c3d
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x492c4a
push ecx
mov ecx, edi
call fcn.0040d2d0
jmp 0x492d44
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x492c5e
lea eax, [edx - 0x60]
push eax
push str.Num__d
jmp 0x492ca0
cmp cx, 0x6a
jne 0x492c6e
push 0x58a0dc
jmp 0x492d3d
cmp cx, 0x6b
jne 0x492c7e
push str.Num_
jmp 0x492d3d
cmp cx, 0x6e
jne 0x492c8e
push str.Num_Del
jmp 0x492d3d
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x492cc0
lea eax, [edx - 0x6f]
push eax
push 0x58a104
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.0040d9bb
mov ecx, esi
add esp, 0x10
mov esi, eax
rep lodsd eax, dword [esi]
lea ecx, [ebp - 0x1c]
call fcn.0040d1d0
jmp 0x492d44
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movsx ecx, al
cmp ecx, 0x3b
jg 0x492cee
je 0x492d06
sub ecx, 0x27
je 0x492d06
sub ecx, 5
je 0x492d06
sub ecx, 1
je 0x492d06
sub ecx, 1
je 0x492d06
sub ecx, 1
je 0x492d06
jmp 0x492d44
sub ecx, 0x3d
je 0x492d06
sub ecx, 0x1e
je 0x492d06
sub ecx, 1
je 0x492d06
sub ecx, 1
je 0x492d06
sub ecx, esi
jne 0x492d44
cbw
mov ecx, edi
movzx eax, ax
push eax
call fcn.0040d342
jmp 0x492d44
push str.Delete
jmp 0x492d3d
push str.Insert
jmp 0x492d3d
push str.Print
jmp 0x492d3d
push str.Down
jmp 0x492d3d
push str.Right
jmp 0x492d3d
push 0x58a030
mov ecx, edi
call fcn.0040d293
mov eax, edi
call fcn.004cc9e5
ret