joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40204a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push esi
push edi
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
lea ebx, [ebp - 0xc]
mov dword [ebx], eax
mov dword [ebx + 4], eax
push dword [ebp + 0xc]
call fcn.00401ea0
cmp eax, 0xffffffff
je 0x4021b9
mov dword [ebp - 4], eax
push ebx
push dword [ebp - 4]
call sub.KERNEL32.dll_GetFileSizeEx
mov edi, 6
lea esi, [0x4566c8]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [esi]
or eax, eax
jne 0x4020a3
add esi, 0x20
dec edi
jne 0x40208e
je 0x4021a4
test dword [esi + 0x14], 1
jne 0x4020ef
mov edi, eax
push 0
push dword [ebp - 4]
call fcn.00401f28
or eax, eax
jne 0x4020d8
cmp edi, dword [ebx]
jb 0x4020cc
cmp dword [ebx + 4], 0
je 0x4020d8
push edi
push dword [ebp - 4]
call fcn.00401f28
inc dword [ebp - 0x30]
or eax, eax
je 0x40218f
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x2c]
push 0x1c
push edx
push eax
call sub.KERNEL32.dll_VirtualQuery
push dword [esi + 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401fa3
or eax, eax
je 0x402172
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x1c], eax
mov ecx, dword [ebp - 0x20]
mov dword [edi + 0x24], ecx
add eax, ecx
mov dword [edi + 0x20], eax
mov dword [edi + 0x18], esi
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov ebx, dword [ebp + 0x14]
cmp dword [ebp - 0x30], 0
je 0x402142
or ecx, ecx
je 0x402142
or edx, edx
jne 0x40213f
cmp eax, ecx
jbe 0x402142
or ebx, 0x10
mov dword [edi + 0x28], ebx
test ebx, 0x10
je 0x40215a
push 0x200f3cd
push edi
call fcn.00401f7c
jmp 0x402165
push 0xf3ca
push edi
call fcn.00401f7c
push edi
call dword [esi + 4]
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x10
push dword [ebp - 0x10]
call fcn.00401f67
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xf35f
mov edx, dword [ebp + 8]
and dword [edx], 0
jmp 0x40216b
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xf35d
mov edx, dword [ebp + 8]
and dword [edx], 0
jmp 0x40216b
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xf360
mov edx, dword [ebp + 8]
and dword [edx], 0
jmp 0x40216b
mov eax, 0xf35c
mov edx, dword [ebp + 8]
and dword [edx], 0
jmp 0x40216b
Function at 0x4023cd
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
push ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
or eax, eax
je 0x4023e6
push eax
call fcn.0040398e
and dword [esi], 0
mov eax, dword [esi + 8]
or eax, eax
je 0x402495
add eax, eax
dec eax
mov edx, eax
shr edx, 1
or eax, edx
mov edx, eax
shr edx, 2
or eax, edx
mov edx, eax
shr edx, 4
or eax, edx
mov edx, eax
shr edx, 8
or eax, edx
mov edx, eax
shr edx, 0x10
or eax, edx
inc eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
shl eax, 2
push eax
lea eax, [esi]
push eax
call fcn.00403940
or eax, eax
je 0x402495
mov edi, eax
or eax, 0xffffffff
cld
mov ecx, dword [esi + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x10]
add eax, 0x14
imul eax, dword [esi + 0xc]
push eax
lea eax, [esi + 4]
push eax
call fcn.0040396a
mov eax, dword [esi + 4]
or eax, eax
je 0x402495
mov ebx, eax
xor edi, edi
jmp 0x402490
push ebx
xor edx, edx
lea ebx, [ebx + 4]
xor ecx, ecx
movzx eax, byte [ecx + ebx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 0x10
jne 0x402461
mov eax, edx
pop ebx
mov edx, dword [esi + 8]
dec edx
and eax, edx
shl eax, 2
add eax, dword [esi]
mov ecx, edi
xchg dword [eax], ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x10]
add eax, 0x14
add ebx, eax
inc edi
cmp edi, dword [esi + 0x18]
jb 0x402459
pop ecx
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x402580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
or eax, eax
je 0x40265f
xor edx, edx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
movzx eax, byte [ecx + ebx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 0x10
jne 0x40259d
mov eax, edx
mov dword [ebp - 8], eax
mov edx, dword [esi + 8]
dec edx
and eax, edx
mov dword [ebp - 4], eax
mov ecx, dword [esi]
or ecx, ecx
cmove eax, ecx
je 0x40265f
mov ecx, dword [ecx + eax*4]
jmp 0x4025f6
mov eax, dword [esi + 0x10]
add eax, 0x14
imul eax, ecx
add eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax + 4]
cmpeqps xmm0, xmm1
movmskps edx, xmm0
sub edx, 0xf
cmove eax, edx
je 0x40265f
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x4025cf
mov ecx, dword [esi + 0x14]
cmp ecx, 0xffffffff
je 0x402616
mov eax, dword [esi + 0x10]
add eax, 0x14
imul eax, ecx
add eax, dword [esi + 4]
mov edx, dword [eax]
mov dword [esi + 0x14], edx
jmp 0x402643
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0xc]
jne 0x402634
push esi
call fcn.004023cd
or eax, eax
je 0x40265f
mov eax, dword [ebp - 8]
mov edx, dword [esi + 8]
dec edx
and eax, edx
mov dword [ebp - 4], eax
inc dword [esi + 0x18]
mov eax, dword [esi + 0x10]
add eax, 0x14
imul eax, ecx
add eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
movups xmm0, xmmword [edx]
movups xmmword [eax + 4], xmm0
mov edx, dword [ebp - 4]
shl edx, 2
add edx, dword [esi]
xchg dword [edx], ecx
mov dword [eax], ecx
add eax, 0x14
inc dword [esi + 0x1c]
pop ebx
pop esi
leave
ret 8
Function at 0x402750
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
or eax, eax
je 0x40282c
xor edx, edx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
movzx eax, byte [ecx + ebx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 0x10
jne 0x40276d
mov eax, edx
mov dword [ebp - 8], eax
mov edx, dword [esi + 8]
dec edx
and eax, edx
mov dword [ebp - 4], eax
mov ecx, dword [esi]
or ecx, ecx
cmove eax, ecx
je 0x40282c
mov ecx, dword [ecx + eax*4]
jmp 0x4027c3
mov eax, dword [esi + 0x10]
add eax, 0x14
imul eax, ecx
add eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax + 4]
cmpeqps xmm0, xmm1
movmskps edx, xmm0
sub edx, 0xf
je 0x402829
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x40279f
mov ecx, dword [esi + 0x14]
cmp ecx, 0xffffffff
je 0x4027e3
mov eax, dword [esi + 0x10]
add eax, 0x14
imul eax, ecx
add eax, dword [esi + 4]
mov edx, dword [eax]
mov dword [esi + 0x14], edx
jmp 0x402810
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0xc]
jne 0x402801
push esi
call fcn.004023cd
or eax, eax
je 0x40282c
mov eax, dword [ebp - 8]
mov edx, dword [esi + 8]
dec edx
and eax, edx
mov dword [ebp - 4], eax
inc dword [esi + 0x18]
mov eax, dword [esi + 0x10]
add eax, 0x14
imul eax, ecx
add eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
movups xmm0, xmmword [edx]
movups xmmword [eax + 4], xmm0
mov edx, dword [ebp - 4]
shl edx, 2
add edx, dword [esi]
xchg dword [edx], ecx
mov dword [eax], ecx
inc dword [esi + 0x1c]
add eax, 0x14
pop ebx
pop esi
leave
ret 8

Function at 0x402aba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
push ecx
push edx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
or ecx, ecx
jne 0x402adb
cmp word [esi + 8], 0
je 0x402b52
movzx eax, byte [esi + 6]
or eax, eax
je 0x402b02
mov cl, byte [esi + 7]
shl eax, cl
mov ecx, dword [esi]
and eax, dword [ebp + 0xc]
cmp eax, ecx
jne 0x402b45
movzx eax, byte [esi + 6]
mov cl, byte [esi + 7]
shl eax, cl
mov ecx, dword [esi]
not eax
and edx, eax
jmp 0x402b16
mov eax, ecx
and eax, edx
je 0x402b0c
cmp eax, ecx
je 0x402b14
or ecx, ecx
jne 0x402b45
or edx, edx
jne 0x402b45
xor edx, eax
cmp edi, dword [ebp + 0x10]
je 0x402b29
sub ebx, 6
jbe 0x402b75
mov dword [edi], 0x20002c
add edi, 4
movzx eax, word [esi + 4]
sub ebx, eax
jb 0x402b75
sub eax, 2
mov ecx, edi
add edi, eax
push edx
push eax
lea eax, [esi + 8]
push eax
push ecx
call sub.KERNEL32.dll_RtlMoveMemory
pop edx
movzx eax, word [esi + 4]
lea esi, [eax + esi + 8]
jmp 0x402ace
or edx, edx
je 0x402b75
sub ebx, 0x1c
jbe 0x402b75
mov dword [edi], 0x2b0020
mov word [edi + 4], 0x20
add edi, 6
push 1
push edi
push edx
call fcn.00405b40
add edi, eax
mov word [edi], 0
mov eax, edi
sub eax, dword [ebp + 0x10]
pop edx
pop ecx
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x402f27
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
xor edx, edx
cmp edx, dword [ebp + 0xc]
je 0x402f49
mov esi, dword [ebp + 8]
xor ecx, ecx
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, dword [ebp + 0xc]
jne 0x402f37
mov eax, edx
pop esi
leave
ret 8

Function at 0x402f50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
xor edx, edx
cmp edx, dword [ebp + 0xc]
je 0x402f7d
mov esi, dword [ebp + 8]
xor ecx, ecx
movzx eax, byte [ecx + esi]
cmp al, 0x41
jb 0x402f6f
cmp al, 0x5a
ja 0x402f6f
add eax, 0x20
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, dword [ebp + 0xc]
jne 0x402f60
mov eax, edx
pop esi
leave
ret 8
Function at 0x4035a2
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd94
push esi
push edi
push 4
push 0x47d100
call fcn.00403330
push 0x14
lea eax, [ebp - 4]
push eax
call fcn.00403940
push 0x14
push 0x450112
push dword [ebp - 4]
call sub.KERNEL32.dll_RtlMoveMemory
push dword [ebp - 4]
push 0x47d100
call fcn.00403460
push 0x208
lea eax, [ebp - 0x268]
push eax
call fcn.00403940
push 0x208
lea eax, [ebp - 0x26c]
push eax
call fcn.00403940
mov edi, dword [ebp - 0x268]
push 0x100
push edi
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
movups xmm0, xmmword [str._.dll]
movups xmmword [edi + eax*2 - 8], xmm0
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x268]
call sub.KERNEL32.dll_FindFirstFileW
or eax, eax
je 0x403778
mov dword [ebp - 0x14], eax
push 0x22
push 0
lea eax, [ebp - 0x238]
push eax
call sub.KERNEL32.dll_LoadLibraryExW
or eax, eax
je 0x403759
mov dword [ebp - 8], eax
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x403590
push 0xd
push 6
push dword [ebp - 8]
call sub.KERNEL32.dll_EnumResourceLanguagesW
cmp dword [ebp - 0xc], 0
jne 0x40368d
lea eax, [ebp - 0xc]
push eax
push 0x403590
push 1
push 0x10
push dword [ebp - 8]
call sub.KERNEL32.dll_EnumResourceLanguagesW
cmp dword [ebp - 0xc], 0
je 0x403751
push 0x47d100
call fcn.00403450
mov esi, eax
jmp 0x4036bc
dec esi
push esi
push 0x47d100
call fcn.004034e0
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
je 0x403751
or esi, esi
jne 0x4036a5
push 0x40
push dword [ebp - 0x26c]
push dword [ebp - 0xc]
call fcn.004037ca
inc eax
add eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x238]
push eax
call sub.KERNEL32.dll_lstrlenW
inc eax
add eax, eax
mov esi, eax
add eax, dword [ebp - 0x10]
add eax, 0x14
push eax
lea eax, [ebp - 4]
push eax
call fcn.00403940
push dword [ebp - 4]
push 0x47d100
call fcn.00403460
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [edi], edx
lea eax, [edi + 0x14]
mov dword [edi + 8], eax
add eax, esi
mov dword [edi + 0x10], eax
mov dword [edi + 4], esi
push esi
lea eax, [ebp - 0x238]
push eax
push dword [edi + 8]
call sub.KERNEL32.dll_RtlMoveMemory
push dword [ebp - 0x10]
push dword [ebp - 0x26c]
push dword [edi + 0x10]
call sub.KERNEL32.dll_RtlMoveMemory
mov edx, dword [edi + 8]
sub esi, 2
je 0x40374e
cmp word [esi + edx], 0x5c
jne 0x40373e
lea edx, [esi + edx + 2]
mov dword [edi + 0xc], edx
push dword [ebp - 8]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.dll_FindNextFileW
or eax, eax
jne 0x40363e
push dword [ebp - 0x14]
call sub.KERNEL32.dll_FindClose
push dword [ebp - 0x268]
call fcn.0040398e
push dword [ebp - 0x26c]
call fcn.0040398e
pop edi
pop esi
leave
ret
Function at 0x4037ca
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x403802
cmp dword [0x47ea24], 0x3d
jb 0x4037ee
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x6f
push dword [ebp + 8]
call sub.KERNEL32.dll_GetLocaleInfoW
jmp 0x4037fe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 2
push dword [ebp + 8]
call sub.KERNEL32.dll_GetLocaleInfoW
or eax, eax
jne 0x40381a
cmp dword [ebp + 0xc], 0
je 0x403817
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405b40
jmp 0x40381a
add eax, 0xb
leave
ret 0xc

Function at 0x403e36
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
push 0x208
lea eax, [ebp - 4]
push eax
call fcn.00403940
push 0x208
lea eax, [ebp - 8]
push eax
call fcn.00403940
mov esi, dword [ebp - 8]
push esi
push 0
push 0
push 0x1a
push 0
call sub.SHELL32.dll_SHGetFolderPathW
push 0x104
push dword [ebp - 4]
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
mov edx, dword [ebp - 4]
mov dword [edx + eax*2 - 6], 0x660063
mov dword [edx + eax*2 - 2], 0x67
dec eax
je 0x403e97
cmp word [edx + eax*2], 0x5c
jne 0x403e8d
lea eax, [edx + eax*2]
push eax
push esi
call sub.KERNEL32.dll_lstrcatW
xor edi, edi
push esi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x403eb2
inc edi
mov esi, dword [ebp - 4]
cmp dword [ebp + 8], 1
je 0x403ed2
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push esi
call sub.KERNEL32.dll_CreateFileW
jmp 0x403eea
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.dll_CreateFileW
mov esi, eax
or edi, edi
je 0x403f42
cmp eax, 0xffffffff
jne 0x403f42
cmp dword [ebp + 8], 1
jne 0x403f26
push dword [ebp - 4]
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x403f42
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 8]
call sub.KERNEL32.dll_CreateFileW
mov esi, eax
jmp 0x403f42
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp - 8]
call sub.KERNEL32.dll_CreateFileW
mov esi, eax
push dword [ebp - 4]
call fcn.0040398e
push dword [ebp - 8]
call fcn.0040398e
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x404623
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
xor eax, eax
mov dword [0x47d12c], eax
mov dword [0x47d130], eax
mov dword [0x47d134], eax
mov dword [0x47d138], eax
mov dword [0x47d13c], eax
mov esi, dword [ebp + 8]
push 0x16f4
push dword [ebp + 0xc]
push esi
call sub.KERNEL32.dll_RtlMoveMemory
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
lea eax, [0x47d11c]
mov dword [esi + 0x10], eax
mov eax, dword [0x47d110]
mov dword [esi + 4], eax
mov eax, dword [0x47d114]
mov dword [esi + 8], eax
mov eax, dword [0x47d118]
mov dword [esi + 0xc], eax
push 0
call fcn.00403e36
cmp eax, 0xffffffff
je 0x4046b5
mov dword [ebp - 4], eax
push esi
push eax
call fcn.004040aa
or eax, eax
je 0x4046a0
push dword [esi]
push esi
call fcn.004043c8
jmp 0x4046ab
call sub.KERNEL32.dll_GetUserDefaultUILanguage
mov dword [esi + 0xb0], eax
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
jmp 0x4046c0
call sub.KERNEL32.dll_GetUserDefaultUILanguage
mov dword [esi + 0xb0], eax
pop esi
leave
ret 8
Function at 0x404a1a
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x47d118]
cmp word [eax], 0
jne 0x404a29
xor eax, eax
jmp 0x404a3f
push eax
call sub.KERNEL32.dll_GetFileAttributesW
test eax, 0x10
jne 0x404a3a
xor eax, eax
jmp 0x404a3f
mov eax, dword [0x47d118]
ret

Function at 0x404a60
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push esi
push str.PEAnatomist.IPC.SharedSection.Lock
push 0
push 0
call sub.KERNEL32.dll_CreateMutexW
mov dword [0x47d024], eax
push str.PEAnatomist.IPC.SharedSection
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.dll_CreateFileMappingW
or eax, eax
je 0x404abf
mov dword [0x47d020], eax
call sub.KERNEL32.dll_GetLastError
mov esi, eax
push 0x1000
push 0
push 0
push 6
push dword [0x47d020]
call sub.KERNEL32.dll_MapViewOfFile
mov dword [0x47d028], eax
cmp esi, 0xb7
cmove eax, esi
pop esi
ret

Function at 0x404c3f
Capabilities:
List drag and drop files
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0xf
call sub.USER32.dll_IsClipboardFormatAvailable
or eax, eax
je 0x404c89
push dword [ebp + 8]
call sub.USER32.dll_OpenClipboard
push 0xf
call sub.USER32.dll_GetClipboardData
mov esi, eax
xor edi, edi
push esi
call sub.KERNEL32.dll_GlobalLock
or eax, eax
je 0x404c82
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push eax
call sub.SHELL32.dll_DragQueryFileW
mov edi, eax
push esi
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x404f10
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.SHELL32.dll_CommandLineToArgvW
or eax, eax
je 0x404f7d
mov esi, eax
xor ebx, ebx
inc ebx
cmp ebx, dword [ebp - 4]
jae 0x404f73
mov edi, dword [esi + ebx*4]
or edi, edi
je 0x404f6d
push edi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x404f6d
push edi
call sub.KERNEL32.dll_lstrlenW
inc eax
cmp eax, dword [ebp + 0x10]
ja 0x404f6d
add eax, eax
mov ebx, eax
push eax
push edi
push dword [ebp + 0xc]
call sub.KERNEL32.dll_RtlMoveMemory
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
call fcn.00404dd7
jmp 0x404f7b
inc ebx
cmp ebx, dword [ebp - 4]
jne 0x404f33
push esi
call sub.KERNEL32.dll_LocalFree
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x40500d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push esi
push edi
push ebx
push 5
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_FindResourceW
or eax, eax
je 0x4051db
mov esi, eax
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_SizeofResource
mov ebx, eax
push esi
push dword [ebp + 8]
call sub.KERNEL32.dll_LoadResource
push eax
call sub.KERNEL32.dll_LockResource
mov esi, eax
cmp dword [0x47d394], 0
je 0x4051c9
mov edi, eax
cmp dword [esi], 0xffff0001
jne 0x4051c9
test dword [esi + 0xc], 0x48
je 0x4051c9
mov dword [ebp - 0x204], 0x1f4
push 0
lea eax, [ebp - 0x204]
push eax
push 0
push 0x29
call sub.USER32.dll_SystemParametersInfoW
or eax, eax
je 0x4051c9
cld
add edi, 0x1a
mov ecx, ebx
sub ecx, 0x1a
shr ecx, 1
xor eax, eax
cmp word [edi], 0xffff
jne 0x4050b3
add edi, 4
sub ecx, 2
jmp 0x4050be
repne scasw ax, word es:[edi]
or ecx, ecx
je 0x4051c9
cmp word [edi], 0xffff
jne 0x4050cc
add edi, 4
sub ecx, 2
jmp 0x4050d7
repne scasw ax, word es:[edi]
or ecx, ecx
je 0x4051c9
repne scasw ax, word es:[edi]
jne 0x4051c9
mov edx, edi
sub edx, esi
mov dword [ebp - 8], edx
add edx, 6
mov dword [ebp - 0xc], edx
or ecx, ecx
je 0x405106
test dword [esi + 0xc], 0x40
je 0x405106
add edi, 6
repne scasw ax, word es:[edi]
jne 0x4051c9
sub edi, esi
mov dword [ebp - 0x10], edi
mov ecx, 0x20
lea edi, [ebp - 0x50]
repne scasw ax, word es:[edi]
lea eax, [ebp - 0x50]
sub edi, eax
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
lea eax, [edi + eax + 4]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00403940
mov eax, dword [ebp - 0xc]
cmp eax, ebx
cmova eax, ebx
push eax
push esi
push dword [ebp - 4]
call sub.KERNEL32.dll_RtlMoveMemory
call fcn.00404f84
or eax, eax
jne 0x405151
add eax, 0x60
mov edx, dword [ebp - 0x6c]
neg edx
push eax
push 0x48
push edx
call sub.KERNEL32.dll_MulDiv
mov edx, dword [ebp - 4]
or dword [edx + 0xc], 0x40
add edx, dword [ebp - 8]
mov word [edx], ax
mov al, byte [ebp - 0x55]
mov byte [edx + 5], al
add edx, 6
push edi
lea eax, [ebp - 0x50]
push eax
push edx
call sub.KERNEL32.dll_RtlMoveMemory
mov eax, dword [ebp - 0x10]
sub ebx, eax
jle 0x4051a7
add eax, esi
mov edx, dword [ebp - 0xc]
add edx, edi
add edx, dword [ebp - 4]
test edx, 3
je 0x40519f
and edx, 0xfffffffc
add edx, 4
push ebx
push eax
push edx
call sub.KERNEL32.dll_RtlMoveMemory
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call sub.USER32.dll_CreateDialogIndirectParamW
mov esi, eax
push dword [ebp - 4]
call fcn.0040398e
mov eax, esi
jmp 0x4051db
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.USER32.dll_CreateDialogIndirectParamW
pop ebx
pop edi
pop esi
leave
ret 0x14
Function at 0x4052a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push esi
push edi
push ebx
mov eax, dword [ebp + 0x18]
or eax, eax
je 0x4053d3
mov edx, dword [ebp + 0x14]
mov ecx, eax
sub eax, 2
je 0x4052cd
cmp word [eax + edx], 0x2e
jne 0x4052c1
or eax, eax
cmove eax, ecx
sub ecx, eax
add edx, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
sub ebx, esi
add esi, dword [ebp + 8]
mov edi, esi
cmp dword [ebp + 0x18], ebx
jbe 0x4052f5
mov eax, ebx
sub eax, ecx
mov edx, edi
add edi, eax
push eax
push dword [ebp + 0x14]
push edx
call sub.KERNEL32.dll_RtlMoveMemory
mov eax, dword [ebp - 8]
add eax, 2
push eax
push dword [ebp - 4]
push edi
call sub.KERNEL32.dll_RtlMoveMemory
and dword [ebp - 0x10], 0
push dword [ebp + 8]
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x405344
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x4053d0
cmp eax, 3
je 0x4053d0
cmp eax, 5
je 0x4053d0
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 0x18], ebx
jbe 0x405351
mov eax, ebx
sub eax, dword [ebp - 8]
mov ecx, 6
cmp dword [ebp - 0x10], 0xa
jb 0x405361
add ecx, 2
jmp 0x405378
cmp dword [ebp - 0x10], 0x64
jb 0x40536c
add ecx, 4
jmp 0x405378
cmp dword [ebp - 0x10], 0x3e8
jb 0x405378
add ecx, 0x14
lea edx, [eax + ecx]
add edx, dword [ebp - 8]
cmp edx, ebx
jbe 0x40538b
xor edx, edx
sub eax, ecx
cmovle eax, edx
jle 0x4053d3
mov edi, esi
mov edx, edi
add edi, eax
push eax
push dword [ebp + 0x14]
push edx
call sub.KERNEL32.dll_RtlMoveMemory
mov word [edi], 0x5b
add edi, 2
push 1
push edi
push dword [ebp - 0x10]
call fcn.004059c0
add edi, eax
mov word [edi], 0x5d
add edi, 2
mov eax, dword [ebp - 8]
add eax, 2
push eax
push dword [ebp - 4]
push edi
call sub.KERNEL32.dll_RtlMoveMemory
inc dword [ebp - 0x10]
jmp 0x405317
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret 0x14

Function at 0x40640c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push 0x12
call sub.USER32.dll_GetAsyncKeyState
shr eax, 0xf
and eax, 1
mov ebx, eax
push 0x11
call sub.USER32.dll_GetAsyncKeyState
shr eax, 0xe
and eax, 2
or ebx, eax
push 0x10
call sub.USER32.dll_GetAsyncKeyState
shr eax, 0xd
and eax, 4
or eax, ebx
pop ebx
ret