joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407250
Capabilities:
Get disk information

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
xor ebp, ebp
call fcn.00407430
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x407278
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx]
lea eax, [edx*4 + 4]
push eax
call fcn.00408b50
mov esi, dword [esp + 0x20]
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi], edi
jne 0x4072a2
pop edi
pop esi
mov dword [ebx], eax
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [ebx]
xor eax, eax
push 0x8000
lea ecx, [ecx*4 + 4]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00408b50
add esp, 4
mov ebx, eax
mov ecx, 0x2000
xor eax, eax
mov edi, ebx
push 0x8000
push ebx
push eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407305
mov eax, dword [esp + 0x20]
push ebx
mov dword [eax], 0
call fcn.00409590
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0x8000]
cmp eax, ecx
jae 0x40740b
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x407407
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push edx
call fcn.00415aa0
add esp, 0xc
test eax, eax
jne 0x4073e6
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 8
push ecx
call fcn.00408b50
mov ecx, dword [esi]
mov edi, ebx
add esp, 4
mov dword [ecx + ebp*4], eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi]
repne scasb al, byte es:[edi]
mov edi, dword [edx + ebp*4]
not ecx
add ecx, 3
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi]
mov edi, ebx
not ecx
mov edx, dword [eax + ebp*4]
add ecx, 3
mov dword [edx], ecx
mov eax, dword [esi]
mov edx, dword [str.._]
mov ecx, dword [eax + ebp*4]
add ecx, 4
mov dword [ecx], edx
mov al, byte [0x43a104]
mov byte [ecx + 4], al
mov ecx, dword [esi]
xor eax, eax
mov edx, dword [ecx + ebp*4]
or ecx, 0xffffffff
add edx, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
add eax, 0x8000
lea ebx, [ebx + ecx + 1]
cmp ebx, eax
jb 0x407317
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push eax
mov dword [ecx], ebp
call fcn.00409590
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x405204
Capabilities:
Create process on windows

Disassembly:
push ebp
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40520a
call fcn.00411dc0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00407000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00407000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00407000
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov eax, str.runas
push eax
pop eax
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 4]
push eax
pop eax
mov dword [ebp + 0x14], eax
mov eax, dword [esp]
push eax
pop eax
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
push eax
pop eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], 1
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
jmp 0x405286
push dword [esp + 4]
call fcn.00411e20
push dword [esp]
call fcn.00411e20
push dword [esp + 8]
call fcn.00411e20
add esp, 0x48
pop ebp
ret 0xc

Function at 0x4052a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00411dc0
push dword [esp + 0x28]
call fcn.004071b0
mov edx, dword [esp + 0x20]
lea ecx, [esp]
call fcn.00407000
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
call fcn.00407000
mov dword [esp + 8], 0
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push 0xff
call fcn.00407d30
lea eax, [esp + 0x10]
push eax
call fcn.00411cc0
mov dword [esp + 0x10], 0xff
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push dword [esp + 0xc]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegOpenKeyExA
and eax, eax
je 0x40533a
mov edx, str.Error_Opening_Key
lea ecx, [esp + 0xc]
call fcn.00407008
jmp 0x4053a1
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegQueryValueExA
and eax, eax
je 0x40536f
mov edx, str.Error_Reading_Key
lea ecx, [esp + 0xc]
call fcn.00407008
jmp 0x405398
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov ebx, dword [esp + 0x18]
dec ebx
push ebx
push dword [esp + 0x18]
call fcn.004076d0
lea eax, [esp + 0x10]
push eax
call fcn.00411cc0
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [esp + 0xc]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
pop eax
push eax
call fcn.00407140
pop edx
add eax, edx
jmp 0x4053c7
push dword [esp + 0xc]
call fcn.00411e20
push dword [esp]
call fcn.00411e20
push dword [esp + 4]
call fcn.00411e20
add esp, 0x14
pop ebx
ret 0xc
Function at 0x4053e8
Capabilities:
Get storage device properties

Disassembly:
push ebp
push ebx
mov edx, 0x10
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4053ef
call fcn.00411dc0
mov edx, dword [esp + 0x4c]
lea ecx, [esp]
call fcn.00407000
push dword [esp]
mov edx, 0x43f01e
pop ecx
call fcn.00407180
je 0x405427
xor eax, eax
movsx eax, al
jmp 0x405567
push 0
push 0
push 3
push 0
push 3
push 0
push dword [esp + 0x18]
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 0xffffffff
je 0x40555b
lea ebp, [esp + 0x10]
mov dword [ebp], 8
mov dword [ebp + 4], 0
mov dword [esp + 8], 0
push 0
lea eax, [esp + 0xc]
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x2d1400
push dword [esp + 0x20]
call sub.KERNEL32.dll_DeviceIoControl
and eax, eax
je 0x4054b9
mov ebx, dword [esp + 8]
cmp ebx, 0xc
jne 0x4054b9
mov eax, 1
jmp 0x4054bb
xor eax, eax
and eax, eax
je 0x4054d8
lea ebp, [esp + 0x1c]
movsx ebx, byte [ebp + 8]
cmp ebx, 1
jne 0x4054d8
movsx ebx, byte [esp + 0xc]
inc ebx
push ebx
pop eax
mov byte [esp + 0xc], al
lea ebp, [esp + 0x28]
mov dword [ebp], 7
mov dword [ebp + 4], 0
mov dword [esp + 8], 0
push 0
lea eax, [esp + 0xc]
push eax
push 0xc
lea eax, [esp + 0x40]
push eax
push 0xc
lea eax, [esp + 0x3c]
push eax
push 0x2d1400
push dword [esp + 0x20]
call sub.KERNEL32.dll_DeviceIoControl
and eax, eax
je 0x405532
mov ebx, dword [esp + 8]
cmp ebx, 0xc
jne 0x405532
mov eax, 1
jmp 0x405534
xor eax, eax
and eax, eax
je 0x405552
lea ebp, [esp + 0x34]
movsx ebx, byte [ebp + 8]
and ebx, ebx
jne 0x405552
movsx ebx, byte [esp + 0xc]
add ebx, 2
push ebx
pop eax
mov byte [esp + 0xc], al
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
movsx eax, byte [esp + 0xc]
movsx eax, al
jmp 0x405567
push dword [esp]
call fcn.00411e20
add esp, 0x40
pop ebx
pop ebp
ret 4

Function at 0x4081ce
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x408223
push dword [esp + 0x10]
push 0x40814d
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x441ce0]
test esi, esi
je 0x40827c
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40821b
cmp byte [esi + 0x10], 0
je 0x40821b
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4081f7
jmp 0x40827c
mov esi, dword [0x441ce0]
test esi, esi
je 0x40827c
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x408275
cmp byte [esi + 0x11], 0
je 0x408251
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x408268
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x441ce0
call fcn.00411b85
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x408230
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x408a50
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x441cec], 0
jne 0x408a5e
call fcn.004089f0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x441cf0]
call esi
test eax, eax
jne 0x408a81
call fcn.004089f0
push dword [0x441cf0]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x408a90
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x408af0
mov ebx, 0x10
test edi, edi
jns 0x408af9
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x408ac2
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x408b10
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x441cec], 0
jne 0x408b1e
call fcn.004089f0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x441cf0]
call esi
mov edx, eax
test edx, edx
jne 0x408b45
call fcn.004089f0
push dword [0x441cf0]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x408b78
mov ebx, 0x10
test esi, esi
jns 0x408b81
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x408b90
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x408bff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x408c89
cmp dword [ebp + 0xc], edi
je 0x408c89
push esi
push 0x28
push 8
push dword [0x441b78]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov esi, eax
or dword [esi + 4], 0xffffffff
mov dword [esi], edi
call sub.MSVCRT.dll__strdup
push dword [ebp + 0xc]
mov dword [esi + 8], eax
call sub.MSVCRT.dll__strdup
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
pop ecx
pop ecx
test al, 1
je 0x408c78
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x408d8d
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x408c70
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
jmp 0x408c88
push esi
call fcn.00408faa
jmp 0x408c87
push esi
call fcn.00408ca2
push esi
mov edi, eax
call fcn.00408faa
pop ecx
pop ecx
pop esi
mov eax, edi
pop edi
pop ebp
ret 0xc
Function at 0x408ca2
Capabilities:
Delete file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov eax, dword [esi + 8]
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebp
call fcn.00412410
mov edi, eax
test edi, edi
je 0x408d72
push dword [esp + 0x18]
call fcn.004375c0
push ebx
push pe_nt_image_headers32
push 2
push ebx
push 1
push 0xc0000000
push ebp
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x408d62
test byte [esi + 0x1c], 2
mov dword [esi + 0x10], ebp
jne 0x408d0b
push 1
push 0x34
push edi
call fcn.004124a0
add esp, 0xc
push dword [esp + 0x18]
push 0x2712
push edi
call fcn.004124a0
push 0x408d9c
push 0x4e2b
push edi
call fcn.004124a0
push esi
push 0x2711
push edi
call fcn.004124a0
push edi
call fcn.00412490
add esp, 0x28
test eax, eax
jne 0x408d4d
xor ebx, ebx
mov dword [esi + 4], 0xfffffffe
inc ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x408d62
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 0x18]
call fcn.004375b0
push edi
call fcn.004123f0
pop ecx
cmp dword [esi + 4], 0xfffffffe
je 0x408d85
cmp dword [esi + 4], 0xfffffffc
je 0x408d85
mov dword [esi + 4], 0xfffffffd
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x40908f
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push edi
xor edi, edi
inc edi
cmp dword [0x441d00], 0
jne 0x4090bb
push 0x408fde
push 0x10
push 0x2c
mov dword [0x441d00], edi
call fcn.00411550
mov dword [0x441cfc], eax
cmp word [0x441cf4], 0
jne 0x409157
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x4090e6
mov word [0x441cf4], di
jmp 0x4090ee
xor eax, eax
mov word [0x441cf4], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x441d10], eax
test eax, eax
je 0x409157
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x438020
push eax
call esi
push 0x43802c
push dword [0x441d10]
mov dword [0x441d04], eax
call esi
push str.getnameinfo
push dword [0x441d10]
mov dword [0x441d08], eax
call esi
cmp dword [0x441d04], 0
mov dword [0x441d0c], eax
pop esi
je 0x409157
cmp dword [0x441d08], 0
je 0x409157
test eax, eax
je 0x409157
mov dword [0x441cf8], edi
movsx eax, word [0x441cf4]
pop edi
add esp, 0x190
ret
Function at 0x409735
Capabilities:
Check os version

Disassembly:
sub esp, 0x24c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push eax
mov esi, 0xc8
xor ebx, ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40988d
mov eax, dword [esp + 0x20]
dec eax
je 0x409870
dec eax
jne 0x40988d
lea eax, [esp + 0x140]
xor ebp, ebp
push eax
call fcn.004096ee
pop ecx
test eax, eax
je 0x4097a1
mov ebx, dword [esp + 0x144]
mov edi, dword [esp + 0x148]
cmp byte [esp + 0x25a], 1
jmp 0x4097ce
lea eax, [esp + 0xa4]
mov dword [esp + 0xa4], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4097d3
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp byte [esp + 0x13e], 1
jne 0x4097d3
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x40986c
dec ebx
je 0x409868
dec ebx
je 0x409847
dec ebx
je 0x409801
sub ebx, 4
jne 0x40988d
test edi, edi
jne 0x40988d
push 0x6e
jmp 0x40988c
sub edi, 0
je 0x409839
dec edi
je 0x40982b
dec edi
je 0x40981d
dec edi
jne 0x40988d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x40988d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x40988d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x40988d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x40988d
sub edi, 0
je 0x409864
dec edi
je 0x409860
dec edi
jne 0x40988d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x40988d
push 0x3c
jmp 0x40988c
push 0x32
jmp 0x40988c
push 0x14
jmp 0x40988c
push 5
jmp 0x40988c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40988a
cmp eax, 0xa
je 0x409886
cmp eax, 0x5a
jne 0x40988d
push 0x28
jmp 0x40988c
push 0x1e
jmp 0x40988c
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret

Function at 0x4098f3
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
lea eax, [ebp - 0x64]
push esi
push 0x40
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
cmp esi, 6
jne 0x409921
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
jmp 0x40997c
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40997a
sub esi, 0
je 0x409972
dec esi
je 0x40996a
dec esi
je 0x409962
dec esi
je 0x40995a
dec esi
je 0x409952
dec esi
jne 0x40997a
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
jmp 0x40997e
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
jmp 0x40997e
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
jmp 0x40997e
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
jmp 0x40997e
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
jmp 0x40997e
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
jmp 0x40997e
xor eax, eax
xor edx, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40aa73
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x40aaed
push 9
call esi
test al, al
jns 0x40aaed
push 0x11
call esi
test al, al
js 0x40aaed
push 0x10
call esi
test al, al
js 0x40aaed
push 0x12
call esi
test al, al
js 0x40aaed
push 5
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40aaed
push eax
push eax
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x40aaed
xor eax, eax
jmp 0x40ab6e
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40ab15
push 0x11
call esi
test al, al
js 0x40ab0d
push 0x10
call esi
test al, al
js 0x40ab0d
push 0x12
call esi
test al, al
jns 0x40ab15
push 1
push edi
call fcn.0040ab76
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test ebx, ebx
je 0x40ab2b
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x40ab6b
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x40ab6b
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40ab6b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x40ab6b
lea eax, [esi - 1]
push eax
push dword [0x4420d4]
call fcn.0041147d
test eax, eax
je 0x40ab6b
mov eax, dword [eax + 8]
jmp 0x40ab6d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c19e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x441dfc], eax
test eax, eax
je 0x40c1ce
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x441df8], eax
lea eax, [ebp - 0x1c]
mov dword [0x441e00], 1
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40c21e
cmp dword [ebp - 0xc], 1
jne 0x40c1fc
and dword [0x441e00], 0
jmp 0x40c236
cmp dword [ebp - 0xc], 2
jne 0x40c21e
cmp dword [ebp - 0x18], 5
jb 0x40c1f3
jne 0x40c21e
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, dword [0x441e00]
mov dword [0x441e00], eax
jmp 0x40c223
mov eax, dword [0x441e00]
test eax, eax
je 0x40c236
call fcn.0040c009
neg eax
sbb eax, eax
and dword [0x441e00], eax
lea esp, [ebp + 0x78]
pop ebp
ret

Function at 0x40d390
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40d3c2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d3bd
cmp dword [esp + 0xc], esi
je 0x40d3d9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x40f69c
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x40f726
cmp byte [eax], 0
je 0x40f726
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 0
push eax
call sub.MSVCRT.dll_strlen
mov ecx, eax
add esp, 0x10
lea eax, [ebp + ecx - 0x109]
cmp ecx, 2
je 0x40f6f0
cmp ecx, 3
jne 0x40f732
cmp byte [ebp - 0x107], 0x3a
jne 0x40f732
cmp ecx, 2
jne 0x40f711
lea eax, [ebp - 0x108]
push 0x4382e8
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x40f726
push 0xfffffffffffffffe
pop edi
mov eax, edi
mov edx, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov cl, byte [eax]
cmp cl, 0x5c
je 0x40f73e
cmp cl, 0x2f
jne 0x40f744
mov byte [eax], 0
dec eax
jmp 0x40f732
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, esi
je 0x40f781
test byte [ebp - 0x248], 0x10
je 0x40f76a
push 0xfffffffffffffffe
pop edi
jmp 0x40f778
mov esi, dword [ebp - 0x22c]
xor edi, edi
or edi, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40f726
mov cl, byte [ebp - 0x108]
mov al, byte [ebp - 0x107]
cmp cl, 0x5c
jne 0x40f796
cmp al, 0x5c
je 0x40f79f
cmp cl, 0x2e
jne 0x40f726
cmp al, cl
jne 0x40f726
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, esi
je 0x40f711
test al, 0x10
je 0x40f726
jmp 0x40f723

Function at 0x40f7c1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x40f832
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 0
push eax
call sub.MSVCRT.dll_strlen
lea ecx, [ebp - 0x108]
add esp, 0x10
add eax, ecx
jmp 0x40f814
mov cl, byte [eax - 1]
cmp cl, 0x20
je 0x40f813
cmp cl, 0x5c
je 0x40f813
cmp cl, 0x2f
jne 0x40f81e
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x40f801
mov byte [eax], 0
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x40f834
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40f83a
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x40f863
test byte [esp + 8], 2
je 0x40f857
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40f865
xor eax, eax
ret 8

Function at 0x40faa0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x40fadc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4