joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ed30
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.00446370
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x44ed62
mov dword [esp + 0x2c], 0
jmp 0x44ed7d
mov ecx, ebp
call fcn.00446370
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.00446370
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.00446380
cmp eax, esi
jae 0x44edbd
mov ecx, ebp
call fcn.00446380
mov dword [esp + 0x10], eax
jmp 0x44edc1
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.00446210
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x44ee2d
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x44ee28
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.00447b90
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x44ee1b
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.00447f00
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x44ede8
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x44edd6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8

Function at 0x452880
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4528b0
push esi
call fcn.00452d80
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x4528a9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x452933
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x45291f
mov eax, dword [esi + 8]
test eax, eax
je 0x4528d4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45291b
cmp eax, 2
je 0x45291f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4528c7
cmp eax, 3
je 0x4528fa
cmp eax, 1
jne 0x4528c7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4528c7
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4528c7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00452960
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x452953
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00452960
add esp, 4
pop esi
ret
Function at 0x46d7f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x46d815
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00472514
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x46d838
test byte [esp + 8], 2
je 0x46d838
call fcn.00472587
mov dword [eax], 0xd
call fcn.00472590
mov dword [eax], 5
jmp 0x46d811
xor eax, eax
ret
Function at 0x48299a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0460
push 0x46e95c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
and dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
jne 0x4829e7
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
je 0x4829e7
xor eax, eax
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
jmp 0x4829fb
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x485715
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4de4dc
call fcn.0046d048
sub esp, 0x150
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov eax, dword [ebx]
lea ecx, [ebp - 0x15c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x485800
test byte [ebp - 0x15c], 0x10
push edi
mov edi, dword [ebp - 0x13c]
je 0x485758
mov edi, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.004ce490
pop ecx
mov dword [esi + 0x5dc], eax
mov ebx, dword [ebx]
push 0
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004ab7ac
and dword [ebp - 4], 0
push edi
push dword [esi + 0x5dc]
lea ecx, [ebp - 0x1c]
call fcn.004ab992
lea ecx, [ebp - 0x1c]
call fcn.004aba13
push 3
push edi
push dword [esi + 0x5dc]
call fcn.004aaf36
add esp, 0xc
mov dword [esi + 0x5d8], eax
test eax, eax
jne 0x4857dd
xor ecx, ecx
test edi, edi
jbe 0x4857c6
mov eax, dword [esi + 0x5dc]
xor byte [eax + ecx], 0x50
add eax, ecx
inc ecx
cmp ecx, edi
jb 0x4857b5
push 3
push edi
push dword [esi + 0x5dc]
call fcn.004aaf36
add esp, 0xc
mov dword [esi + 0x5d8], eax
mov eax, dword [esi + 0x5d8]
xor ecx, ecx
test eax, eax
setne cl
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
mov esi, ecx
lea ecx, [ebp - 0x1c]
call fcn.004ab7eb
mov eax, esi
pop edi
jmp 0x485802
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x489703
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [0x524164], 1
call fcn.0048984e
test byte [esp + 0x14], 1
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
je 0x489745
call ebp
push eax
push 0
call ebx
push eax
push 0x4899f3
push 4
call edi
mov dword [esi + 4], eax
test byte [esp + 0x14], 2
je 0x489760
call ebp
push eax
push 0
call ebx
push eax
push 0x489a55
push 0xc
call edi
mov dword [esi + 8], eax
test byte [esp + 0x14], 4
je 0x48977b
call ebp
push eax
push 0
call ebx
push eax
push 0x489aba
push 5
call edi
mov dword [esi + 0xc], eax
test byte [esp + 0x14], 8
je 0x489796
call ebp
push eax
push 0
call ebx
push eax
push 0x489afa
push 0xb
call edi
mov dword [esi + 0x10], eax
test byte [esp + 0x14], 0x10
je 0x4897b1
call ebp
push eax
push 0
call ebx
push eax
push 0x489b29
push 3
call edi
mov dword [esi + 0x14], eax
test byte [esp + 0x14], 0x20
je 0x4897cc
call ebp
push eax
push 0
call ebx
push eax
push 0x489bb1
push 2
call edi
mov dword [esi + 0x18], eax
test byte [esp + 0x14], 0x40
je 0x4897e7
call ebp
push eax
push 0
call ebx
push eax
push 0x489be6
push 7
call edi
mov dword [esi + 0x1c], eax
test byte [esp + 0x14], 0x80
je 0x489802
call ebp
push eax
push 0
call ebx
push eax
push 0x489c1b
push 0xffffffffffffffff
call edi
mov dword [esi + 0x20], eax
test byte [esp + 0x15], 1
je 0x48981d
call ebp
push eax
push 0
call ebx
push eax
push 0x489c67
push 0xa
call edi
mov dword [esi + 0x24], eax
test byte [esp + 0x15], 2
je 0x489838
call ebp
push eax
push 0
call ebx
push eax
push 0x489c93
push 6
call edi
mov dword [esi + 0x28], eax
push dword [esp + 0x1c]
lea ecx, [esi + 0x2c]
call fcn.00481a24
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x48a8c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4de834
call fcn.0046d048
push ecx
push esi
mov esi, ecx
push 0x3e8
mov dword [ebp - 0x10], esi
call fcn.004a5203
and dword [ebp - 4], 0
push 0x51eb4c
lea ecx, [esi + 8]
mov dword [esi], vtable.CResPicture.0
call fcn.00481a24
push 0x51eb44
lea ecx, [esi + 0xc]
call fcn.00481a24
mov ecx, dword [ebp - 0xc]
and dword [esi + 0x30], 0
mov dword [esi + 0x10], 0x41c
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x493577
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x4e04b2
call fcn.0046d048
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0048afa0
and dword [esp + 0x1c], 0
mov ebp, 0x48c9f7
mov ebx, fcn.0048c96e
push ebp
push ebx
mov edi, 0x148
push 2
lea eax, [esi + 0x210]
push edi
push eax
call fcn.0046fadc
push ebp
push ebx
push 4
lea eax, [esi + 0x4a0]
push edi
push eax
mov byte [esp + 0x30], 1
call fcn.0046fadc
push ebp
push ebx
push 4
lea eax, [esi + 0x9c0]
push edi
push eax
mov byte [esp + 0x30], 2
call fcn.0046fadc
mov ecx, dword [esp + 0x14]
mov dword [esi], vtable.SkinComboBox.0
mov dword [esi + 0x208], 0x1f4
mov dword [esi + 0x20c], 0x64
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x49862b
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x4e1762
call fcn.0046d048
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0048afa0
and dword [esp + 0x1c], 0
mov ebp, 0x48c9f7
mov ebx, fcn.0048c96e
push ebp
push ebx
mov edi, 0x148
push 2
lea eax, [esi + 0x210]
push edi
push eax
call fcn.0046fadc
push ebp
push ebx
push 4
lea eax, [esi + 0x4a0]
push edi
push eax
mov byte [esp + 0x30], 1
call fcn.0046fadc
push ebp
push ebx
push 4
lea eax, [esi + 0x9c0]
push edi
push eax
mov byte [esp + 0x30], 2
call fcn.0046fadc
mov ecx, dword [esp + 0x14]
mov dword [esi], vtable.SkinDatetime.0
mov dword [esi + 0x208], 0x1f4
mov dword [esi + 0x20c], 0x64
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x499fe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp dword [0x5205c4], 0xffffffff
jne 0x49a0ac
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x49a0ac
mov eax, dword [ebp - 0x84]
dec eax
je 0x49a072
dec eax
jne 0x49a0ac
mov eax, dword [ebp - 0x90]
push 3
pop ecx
sub eax, ecx
je 0x49a0ac
dec eax
je 0x49a06a
dec eax
je 0x49a044
mov dword [0x5205c4], 6
jmp 0x49a0ac
mov eax, dword [ebp - 0x8c]
sub eax, 0
je 0x49a05e
dec eax
jne 0x49a038
mov dword [0x5205c4], 5
jmp 0x49a0ac
mov dword [0x5205c4], 4
jmp 0x49a0ac
mov dword [0x5205c4], ecx
jmp 0x49a0ac
cmp dword [ebp - 0x8c], 0
je 0x49a0a5
cmp dword [ebp - 0x8c], 0xa
je 0x49a099
cmp dword [ebp - 0x8c], 0x5a
jne 0x49a0ac
mov dword [0x5205c4], 2
jmp 0x49a0ac
mov dword [0x5205c4], 1
jmp 0x49a0ac
and dword [0x5205c4], 0
mov eax, dword [0x5205c4]
leave
ret
Function at 0x49aaa2
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push 0x18
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call edi
push dword [ebp + 8]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 4], eax
push eax
call esi
push ebx
mov dword [ebp - 0xc], eax
call edi
push dword [ebp - 0x2c]
mov edi, eax
push dword [ebp - 0x30]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov dword [ebp - 0x1c], eax
call esi
xor ebx, ebx
push 0xcc0020
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push ebx
push ebx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0xc]
push dword [ebp - 4]
call esi
cmp dword [ebp - 4], ebx
je 0x49ab3e
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x49ab3e
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x30]
cmp eax, ebx
lea ecx, [eax - 1]
mov dword [ebp + 8], ecx
je 0x49abe0
mov eax, dword [ebp - 0x2c]
lea ebx, [eax - 1]
test eax, eax
je 0x49abd0
push ebx
push dword [ebp + 8]
push edi
call dword [sym.imp.GDI32.dll_GetPixel]
cmp dword [ebp + 0xc], eax
je 0x49abcb
xor edx, edx
mov ecx, eax
mov dl, ah
shr ecx, 0x10
cmp al, dl
jne 0x49ab7a
cmp dl, cl
je 0x49abcb
movzx ecx, cl
mov dword [ebp - 0x10], ecx
fild dword [ebp - 0x10]
movzx ecx, dl
fmul qword [0x4f26b8]
mov dword [ebp - 0x10], ecx
fild dword [ebp - 0x10]
movzx eax, al
fmul qword [0x4f26b0]
mov dword [ebp - 0x10], eax
faddp st(1)
fild dword [ebp - 0x10]
fmul qword [str.333333]
faddp st(1)
call fcn.0046dde0
movzx eax, al
mov ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, eax
push ecx
push ebx
push dword [ebp + 8]
push edi
call dword [sym.imp.GDI32.dll_SetPixelV]
mov eax, ebx
dec ebx
jmp 0x49ab55
mov eax, dword [ebp + 8]
dec dword [ebp + 8]
test eax, eax
jne 0x49ab4f
xor ebx, ebx
push dword [ebp - 8]
push edi
call esi
cmp edi, ebx
je 0x49abf7
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x49abf7
xor edi, edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
je 0x49ac13
push dword [ebp - 8]
call esi
cmp dword [ebp - 0xc], ebx
je 0x49ac1d
push dword [ebp - 0xc]
call esi
cmp edi, ebx
je 0x49ac28
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x49ac39
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x1c]
leave
ret
Function at 0x4a0857
Capabilities:
Log keystrokes via application hook

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
cmp ecx, dword [esi + 0xc0]
lea eax, [esi + 0xc0]
je 0x4a092b
push ebx
xor ebx, ebx
mov dword [eax], ecx
mov eax, dword [0x52426c]
cmp ecx, ebx
push edi
jne 0x4a08bc
cmp eax, ebx
je 0x4a0890
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x52426c], ebx
mov ecx, esi
xor edi, edi
call fcn.004a072d
test eax, eax
jle 0x4a0911
mov eax, dword [esi + 0x90]
push 0x20
push ebx
mov ecx, dword [eax + edi*4]
call fcn.0049f38d
mov ecx, esi
inc edi
call fcn.004a072d
cmp edi, eax
jl 0x4a089d
jmp 0x4a0911
cmp eax, ebx
je 0x4a08c7
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x4a092f
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, esi
mov dword [0x52426c], eax
mov dword [0x524264], esi
xor edi, edi
call fcn.004a072d
test eax, eax
jle 0x4a0911
mov eax, dword [esi + 0x90]
push ebx
push 0x20
mov ecx, dword [eax + edi*4]
call fcn.0049f38d
mov ecx, esi
inc edi
call fcn.004a072d
cmp edi, eax
jl 0x4a08f4
mov ecx, esi
call fcn.004a0260
or dword [esi + 0xf4], 0xffffffff
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.004a04eb
pop edi
pop ebx
pop esi
ret 4
Function at 0x4a0a24
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4e1f54
call fcn.0046d048
sub esp, 0x120
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov esi, dword [ecx + 0xa8]
mov edi, dword [sym.imp.USER32.dll_GetMenuItemCount]
and dword [ebp - 4], 0
push esi
mov dword [ebp - 0x2c], esi
call edi
and dword [ebp - 0x10], 0
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], 1
jle 0x4a0a80
push dword [ebp - 0x10]
push esi
call dword [sym.imp.USER32.dll_GetMenuItemID]
cmp eax, 0xff00
jae 0x4a0a7c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4a0a61
jmp 0x4a0a80
and dword [ebp - 0x18], 0
push esi
call edi
mov ebx, 0x400
cmp dword [ebp - 0x10], eax
jge 0x4a0a9d
push ebx
push dword [ebp - 0x10]
push esi
call dword [sym.imp.USER32.dll_RemoveMenu]
push esi
call edi
jmp 0x4a0a88
mov eax, dword [ebp - 0x20]
push 0
push 0
push 0x229
push dword [eax + 0xc4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x28], eax
mov eax, dword [0x51daac]
mov dword [ebp - 0x14], 0xff00
mov dword [ebp - 0x1c], eax
mov edi, dword [sym.imp.USER32.dll_InsertMenuA]
mov byte [ebp - 4], 1
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
push dword [eax + 0xc4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor ecx, ecx
mov dword [ebp - 0x24], eax
cmp eax, ecx
je 0x4a0b98
cmp dword [ebp - 0x18], ecx
je 0x4a0b0a
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
push ecx
push ecx
push 0xc00
push eax
push esi
call edi
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0xfeff]
cmp ecx, 0xa
jge 0x4a0b74
lea eax, [ebp - 0x12c]
push 0xff
push eax
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0xffff0101
push eax
lea eax, [ebp - 0x1c]
push 0x52079c
push eax
call fcn.00481a69
add esp, 0x10
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
push esi
call edi
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], eax
jne 0x4a0b81
push 0x408
push dword [ebp - 0x10]
push esi
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x4a0b81
push str.More_Windows...
push eax
push ebx
push dword [ebp - 0x10]
push esi
call edi
inc dword [ebp - 0x10]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, 0xffff0101
cmp eax, 0xa
jle 0x4a0ad1
and dword [ebp - 0x2c], 0
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004817f7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x4a10d7
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], 1
push dword [esi + 0xa0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x4a1168
push eax
push 2
mov ecx, esi
call fcn.004a04eb
and dword [esi + 0x64], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4a109a
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x524268], eax
mov eax, dword [esi + 0x68]
mov dword [esi + 0x88], 2
mov dword [0x5206d8], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x90]
push dword [esi + 0xa0]
mov ecx, dword [ecx + eax*4]
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [0x524268]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x524268], 0
cmp dword [esi + 0x64], 1
je 0x4a10e8
mov eax, dword [esi + 0xf4]
mov ecx, esi
push eax
inc eax
neg eax
sbb eax, eax
and eax, 3
push eax
call fcn.004a04eb
mov ecx, esi
call fcn.004a0260
pop esi
ret 4

Function at 0x4a27fb
Capabilities:
Check os version

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4a2813
cmp al, 5
sbb eax, eax
and eax, 2
add eax, 6
ret
push 8
pop eax
ret
Function at 0x4a6c7a
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
and dword [esi + 0xc], 0
lea edi, [esi + 0xc]
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [esi + 4], 0
mov dword [esi], eax
je 0x4a6cc6
cmp dword [esi + 8], 0
je 0x4a6cc6
push dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x4a6cc6
push edi
push 0x40
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop edi
pop esi
pop ebx
ret 8

Function at 0x4a904a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4a9058
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x4a9139
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x4f49bc]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4f49bc]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f49bc]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4f49bc]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f49bc]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x4f49bc]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f49bc]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x4f49bc]
xor eax, esi
inc edx
dec edi
jne 0x4a9075
pop ebx
cmp dword [ebp + 0x10], 0
je 0x4a915a
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4f49bc]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x4a913f
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x4a993c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4a9970
lea eax, [ebp + 8]
push 0
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a996b
mov byte [esi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x4a9998
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4a9981
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0046d4c0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
pop edi
div dword [ebp + 0xc]
pop esi
pop ebp
ret
Function at 0x4aa751
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4aa7d6
cmp dword [esi + 4], 0xffffffff
jne 0x4aa7d6
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x513a0c
push edi
call fcn.0046d140
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x4aa79f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4aa79f
mov eax, 0x2000000
jmp 0x4aa7db
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a9748
add esp, 0x10
test eax, eax
jne 0x4aa7bd
mov eax, dword [ebp - 4]
jmp 0x4aa7db
push eax
call fcn.004a9bf4
mov dword [esi], eax
pop ecx
neg eax
sbb eax, eax
and eax, 0xfffc0000
add eax, 0x40000
jmp 0x4aa7db
mov eax, 0x1000000
pop esi
leave
ret 0xc

Function at 0x4aaba4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4aac3b
mov cl, byte [eax]
test cl, cl
je 0x4aac3b
push esi
push edi
mov edi, eax
mov edx, eax
cmp cl, 0x2f
je 0x4aabce
cmp cl, 0x5c
jne 0x4aabd0
mov edi, edx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x4aabc4
cmp edi, eax
mov esi, edi
je 0x4aac0b
sub esi, eax
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00470e6c
and byte [ebp + esi - 0x104], 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.004aaba4
add esp, 0x14
lea esi, [edi + 1]
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.0046d130
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0046d140
add esp, 0x10
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
leave
ret
Function at 0x4ab587
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4ab5c2
mov eax, dword [esi + 0x1c]
mov edi, dword [ebp + 0xc]
lea edx, [eax + edi]
cmp edx, dword [esi + 0x20]
jb 0x4ab5ac
mov dword [esi + 0xc], 0x30000
jmp 0x4ab5e7
push edi
add eax, ecx
push dword [ebp + 8]
push eax
call fcn.0046d4c0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
jmp 0x4ab5e9
mov eax, dword [esi]
test eax, eax
je 0x4ab5e0
lea ecx, [ebp + 0xc]
push 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
jmp 0x4ab5e9
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x4aba87
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi]
push dword [esp + 0xc]
call dword [eax + 0x1c]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
ret 4