joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434aa0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x5c3138]
push ebp
push esi
push edi
push eax
call fcn.004ff96a
mov ebp, dword [esp + 0x14]
mov eax, ebp
add esp, 4
mov dword [0x5c3138], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434ac4
sub eax, edx
sar eax, 1
mov esi, eax
xor ecx, ecx
lea edi, [esi + 1]
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff95f
push esi
push ebp
push edi
push eax
mov dword [0x5c3138], eax
call fcn.0044c530
mov edx, dword [esp + 0x28]
add esp, 0x14
test edx, edx
jne 0x434b0d
xor eax, eax
jmp 0x434b21
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434b12
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, 0x5c3168
call fcn.00401e40
mov edx, dword [esp + 0x18]
test edx, edx
jne 0x434b39
xor eax, eax
jmp 0x434b4f
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434b40
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, 0x5c3160
call fcn.00401e40
mov edx, dword [esp + 0x1c]
test edx, edx
jne 0x434b67
xor eax, eax
jmp 0x434b7f
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434b70
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, 0x5c3164
call fcn.00401e40
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x24]
movzx edx, byte [esp + 0x28]
mov dword [0x5c315c], eax
movzx eax, byte [esp + 0x2c]
mov dword [0x5c3158], ecx
movzx ecx, byte [esp + 0x30]
mov dword [0x5c3154], edx
movzx edx, byte [esp + 0x34]
mov dword [0x5c314c], eax
movzx eax, byte [esp + 0x38]
pop edi
mov dword [0x5c3148], ecx
mov ecx, dword [0x5ed0c0]
pop esi
mov dword [0x5c3144], edx
mov dword [0x5c313c], eax
add ecx, 0x5fc
pop ebp
jmp fcn.004b8ed0
Function at 0x435350
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x55ff6b
mov eax, dword fs:[0]
push eax
sub esp, 0xa7c
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0xa78], eax
push ebp
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0xa8c]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa9c]
mov ecx, esi
mov dword [esp + 0x10], esi
call fcn.004b41d0
mov eax, dword [0x5b3490]
xor edi, edi
mov dword [0x5c3130], 0
mov dword [0x5c3134], 0
mov dword [esp + 0x14], eax
test eax, eax
jle 0x43551d
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea esp, [esp]
cmp dword [esi + 0x114], 0
jne 0x43551d
mov eax, dword [0x5b348c]
mov ecx, dword [eax + edi*4]
mov esi, dword [ecx + 4]
push esi
call fcn.00412410
add esp, 4
push esi
test eax, eax
je 0x435506
lea edx, [esp + 0x26c]
push 0x208
push edx
call fcn.0053fe1c
lea eax, [esp + 0x274]
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435420
sub eax, edx
sar eax, 1
mov esi, eax
test esi, esi
jle 0x435458
cmp word [esp + esi*2 + 0x266], 0x5c
je 0x435458
mov eax, 0x5c
mov word [esp + esi*2 + 0x268], ax
inc esi
xor ecx, ecx
mov word [esp + esi*2 + 0x268], cx
lea edx, [esp + 0x268]
push edx
lea eax, [esp + 0x67c]
push 0x208
push eax
call fcn.0053fe1c
mov ecx, 0x208
push 0x5752d4
sub ecx, esi
push ecx
lea edx, [esp + esi*2 + 0x68c]
push edx
call fcn.0053fe1c
add esp, 0x18
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x67c]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x43550e
test byte [esp + 0x18], 0x10
jne 0x4354ed
lea edx, [esp + 0x268]
push edx
lea eax, [esp + 0x67c]
push 0x208
push eax
call fcn.0053fe1c
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x688]
push 0x208
push edx
call fcn.0053fd9f
lea eax, [esp + 0x690]
push eax
call fcn.00434cc0
add esp, 0x1c
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4354a5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x43550e
call fcn.00434cc0
add esp, 4
mov esi, dword [esp + 0x10]
inc edi
cmp edi, dword [esp + 0x14]
jl 0x4353d0
mov ecx, esi
call fcn.004b72a0
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43553e
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
push 0xe001
mov dword [esp + 0xa98], 0
call fcn.00508953
test eax, eax
je 0x43557a
push 0xe001
push eax
lea ecx, [esp + 0x18]
call fcn.00401d70
mov esi, dword [esp + 0x10]
mov ecx, dword [0x5ed0c0]
mov edx, dword [ecx + 0x10c]
push esi
push 0
push 0x40b
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esi - 0x10]
mov dword [esp + 0xa94], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4355bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xa8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xa78]
xor ecx, esp
call fcn.0053f73f
add esp, 0xa88
ret
Function at 0x439090
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0xf0000000
push 0xd
push 0
mov esi, ecx
push 0
push esi
call edi
test eax, eax
jne 0x4390af
pop edi
pop esi
ret
push 0xf0000000
push 0x18
push 0
push 0
add esi, 4
push esi
call edi
test eax, eax
jne 0x4390c6
mov dword [esi], eax
pop edi
mov eax, 1
pop esi
ret

Function at 0x4390d0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
lea eax, [esp + 4]
push eax
mov eax, dword [ecx]
xor esi, esi
push esi
push esi
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x439129
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
push esi
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x439129
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 4]
push esi
push ecx
push edx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x439138
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, esi
pop esi
pop ecx
ret 0x14
Function at 0x439140
Capabilities:
Encrypt data using aes via winapi
Encrypt data using des via winapi

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
mov ebp, ecx
xor ecx, ecx
push esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x14], 8
mov byte [esp + 0x15], 2
mov word [esp + 0x16], cx
cmp dword [esp + 0x28], eax
je 0x439181
mov esi, 0x10
mov dword [ebp], esi
mov ebx, dword [0x5ec790]
mov dword [esp + 0x18], 0x660e
jmp 0x43919b
mov dword [ebp], 8
mov ebx, dword [0x5ec78c]
mov dword [esp + 0x18], 0x6603
mov esi, 0x18
mov dword [esp + 0x28], esi
cmp ebx, eax
jne 0x4391ae
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
push edi
add esi, 0xc
push esi
call fcn.004ff95f
push 8
lea edx, [esp + 0x20]
push edx
mov edi, eax
push esi
push edi
call fcn.0053f74e
push 4
lea eax, [esp + 0x44]
push eax
lea ecx, [esi - 8]
push ecx
lea edx, [edi + 8]
push edx
call fcn.0053f74e
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x48]
push eax
push ecx
lea edx, [esi - 0xc]
push edx
lea eax, [edi + 0xc]
push eax
call fcn.0053f74e
add esp, 0x34
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x439213
mov esi, 1
jmp 0x43922a
push 0
push 0
push 0
push 0x54b9
call fcn.0044ef40
mov esi, dword [esp + 0x24]
add esp, 0x10
push edi
call fcn.004ff96a
add esp, 4
pop edi
test esi, esi
je 0x439274
cmp dword [esp + 0x24], 0
je 0x43925f
mov eax, dword [ebp + 4]
test eax, eax
je 0x43924d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword [ebp + 4], edx
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x43926d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [esp + 0xc]
mov dword [ebp + 8], eax
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc

Function at 0x439280
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
jne 0x43928a
ret 8
mov edx, dword [esp + 4]
push esi
lea ecx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov esi, eax
test esi, esi
jne 0x4392b8
push eax
push eax
push eax
push 0x5530
call fcn.0044ef40
add esp, 0x10
mov eax, esi
pop esi
ret 8
Function at 0x4394b0
Capabilities:
Authenticate hmac

Disassembly:
push ecx
cmp dword [esp + 0xc], 0
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x10], ebp
je 0x4394cd
lea edi, [ebp + 8]
lea ebx, [ebp + 0x88]
jmp 0x4394d6
lea edi, [ebp + 0x48]
lea ebx, [ebp + 0xc8]
xor eax, eax
cmp dword [esp + 0x20], eax
push 0x40
sete al
push 0x36
push edi
lea eax, [eax*4 + 0x10]
mov esi, eax
call fcn.0053ff80
add esp, 0xc
xor ecx, ecx
test esi, esi
jle 0x439517
mov ebp, dword [esp + 0x18]
mov eax, edi
sub ebp, edi
cmp ecx, 0x40
jge 0x439513
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x439503
mov ebp, dword [esp + 0x10]
push 0x40
push 0x5c
push ebx
call fcn.0053ff80
add esp, 0xc
xor ecx, ecx
test esi, esi
jle 0x439542
mov edi, dword [esp + 0x18]
mov eax, ebx
sub edi, ebx
cmp ecx, 0x40
jge 0x439542
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x439532
pop edi
pop esi
mov dword [ebp + 4], 1
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x43a470
Capabilities:
Encrypt or decrypt via wincrypt
Generate random numbers via winapi

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [eax]
cmp ecx, 8
push edi
jge 0x43a489
mov ecx, 8
mov ebx, dword [esi + 8]
lea eax, [ebx + 9]
cdq
idiv ecx
mov eax, ecx
sub eax, edx
cdq
idiv ecx
mov eax, dword [esp + 0x24]
add dl, 4
mov byte [esi + 0x14], dl
cmp dword [eax + 4], 0
je 0x43a4ad
mov edi, dword [eax]
jmp 0x43a4af
xor edi, edi
movzx ecx, dl
add ecx, ebx
lea ebx, [ecx + edi + 5]
push ebx
call fcn.004ff95f
mov edx, ebx
sub edx, edi
sub edx, 4
push edx
mov ebp, eax
push ebx
push ebp
call fcn.00438e30
mov al, byte [esi + 0x14]
mov byte [ebp + 4], al
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x20]
push ecx
push edx
lea eax, [ebx - 5]
push eax
lea ecx, [ebp + 5]
push ecx
call fcn.0053f74e
movzx eax, byte [esi + 0x14]
mov edi, dword [esi + 8]
push eax
add edi, 5
mov dword [esp + 0x34], eax
call fcn.004ff95f
mov edx, dword [esp + 0x34]
add esp, 0x24
push eax
mov dword [esp + 0x18], eax
mov eax, dword [0x5ec78c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
movzx ecx, byte [esi + 0x14]
mov eax, dword [esp + 0x14]
push ecx
push eax
mov edx, ebx
sub edx, edi
mov dword [esi + 0x18], eax
push edx
lea eax, [edi + ebp]
push eax
call fcn.0053f74e
movzx ecx, byte [esi + 0x14]
add edi, ecx
mov ecx, dword [esp + 0x34]
add esp, 0x10
cmp dword [ecx + 4], 0
je 0x43a559
mov eax, dword [esp + 0x2c]
push 1
lea edx, [edi + ebp]
push edx
mov edx, dword [eax]
push edx
push edi
push ebp
call fcn.004392c0
mov eax, dword [esp + 0x2c]
inc dword [eax]
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], edi
test eax, eax
je 0x43a582
push edi
lea ecx, [esp + 0x28]
push ecx
push ebp
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ecx, dword [esp + 0x28]
push 0
push ebx
push ebp
call fcn.004aef50
push ebp
mov edi, eax
call fcn.004ff96a
mov edx, dword [esi + 0x20]
push edx
call fcn.004ff96a
mov eax, dword [esi + 0x18]
push eax
call fcn.004ff96a
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.004ff96a
add esp, 0x10
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov byte [esi + 0x14], al
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14
Function at 0x43f490
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x560518
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x40]
mov eax, dword [esi + 0xc]
push eax
call fcn.004ff96a
xor eax, eax
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], al
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x20], al
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0xc], eax
push eax
push eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.0043eda0
test eax, eax
jne 0x43f548
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x28]
push edx
call fcn.004ff96a
mov eax, dword [esp + 0x30]
push eax
call fcn.004ff96a
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
jge 0x43f563
mov cl, byte [edx + eax]
inc eax
mov dword [esp + 0x1c], eax
cmp cl, 0x5e
je 0x43f596
push edx
call fcn.004ff96a
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x30]
push edx
call fcn.004ff96a
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
lea ecx, [esp + 0xc]
call fcn.0043a660
cmp eax, dword [edi + 0x1e80]
je 0x43f5de
mov eax, dword [esp + 0x2c]
push eax
call fcn.004ff96a
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004ff96a
mov edx, dword [esp + 0x30]
push edx
call fcn.004ff96a
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
lea ecx, [esp + 0xc]
call fcn.0043a660
mov dword [esp + 0x40], eax
lea eax, [esp + 0x40]
push eax
push esi
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.0043f2b0
mov edx, dword [esp + 0x2c]
push edx
mov esi, eax
call fcn.004ff96a
mov eax, dword [esp + 0x28]
push eax
call fcn.004ff96a
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004ff96a
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x440870
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x56060b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x250]
mov edi, dword [esp + 0x24c]
xor ebx, ebx
mov ebp, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x28], bl
push ebx
mov dword [esp + 0x248], ebx
call fcn.004ff96a
push 0x1000
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0x28], 0x1000
call fcn.004ff95f
add esp, 8
push 1
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x30], 0xb
call fcn.0043a6f0
push 4
mov dword [esp + 0x18], 0x456
call fcn.004ff95f
movzx edx, byte [esp + 0x1b]
mov esi, eax
mov byte [esi], dl
mov al, byte [esp + 0x1a]
mov byte [esi + 1], al
mov cl, byte [esp + 0x19]
push 4
mov byte [esi + 2], cl
movzx edx, byte [esp + 0x1c]
push esi
lea eax, [esp + 0x20]
push 4
push eax
mov byte [esi + 3], dl
call fcn.0053f74e
push esi
call fcn.004ff96a
add esp, 0x18
push 4
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
call fcn.0043a6f0
mov eax, edi
lea edx, [eax + 2]
jmp 0x440980
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x440980
push ebx
push ebx
sub eax, edx
push 0x207
sar eax, 1
lea edx, [esp + 0x3c]
push edx
push eax
mov eax, dword [ebp + 0xa8]
neg eax
push edi
sbb eax, eax
push ebx
and eax, 0xfde9
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
lea ecx, [esp + 0x1c]
mov byte [esp + esi + 0x34], bl
call fcn.0043a770
push esi
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x20]
call fcn.0043a6f0
lea edx, [esp + 0x18]
push edx
mov ecx, ebp
call fcn.0043fc20
test eax, eax
je 0x440a30
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.0043f490
test eax, eax
jne 0x440a07
mov edx, dword [esp + 0x24]
push edx
call fcn.004ff96a
add esp, 4
xor eax, eax
jmp 0x440a9e
movzx eax, byte [esp + 0x28]
cmp eax, 0x66
je 0x440a41
cmp eax, 0x65
jne 0x440a30
lea ecx, [esp + 0x18]
call fcn.0043a7f0
lea ecx, [esp + 0x18]
call fcn.0043a7f0
push eax
mov ecx, ebp
call fcn.0043bc90
mov eax, dword [esp + 0x24]
push eax
call fcn.004ff96a
add esp, 4
xor eax, eax
jmp 0x440a9e
lea ecx, [esp + 0x18]
call fcn.0043a7f0
cmp eax, 0x456
je 0x440a62
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004ff96a
add esp, 4
xor eax, eax
jmp 0x440a9e
mov edi, dword [esp + 0x2c]
push edi
lea ecx, [esp + 0x1c]
call fcn.0043a860
mov ebp, eax
cmp ebp, ebx
je 0x4409f3
mov eax, dword [edi]
push eax
call fcn.004ff95f
mov esi, eax
mov eax, dword [edi]
push eax
push ebp
push eax
push esi
call fcn.0053f74e
mov ecx, dword [esp + 0x38]
push ecx
call fcn.004ff96a
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0053f73f
add esp, 0x234
ret 8
Function at 0x445a30
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x104], 0
jne 0x445aeb
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x445a66
mov ecx, dword [0x5ed0c0]
push 6
mov dword [0x5ed0b4], 1
call fcn.005070b1
pop esi
ret
mov eax, dword [esi + 0x124]
mov dword [esi + 0x104], 1
test eax, eax
jl 0x445add
mov ecx, dword [esi + 0xcc]
lea eax, [eax + eax*2]
mov ecx, dword [ecx + eax*8]
test ecx, ecx
jl 0x445add
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
mov eax, dword [eax*4 + 0x5b9068]
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x1ee8
push 0
push 0x1f4
mov dword [ecx + eax + 0xc0], 1
mov ecx, dword [esi + 0x20]
push 0x1f5
push ecx
mov dword [esi + 0x128], 0
call dword [sym.imp.USER32.dll_SetTimer]
push 0xffffffffffffffff
push 0
push 0x4e2d
call fcn.0050c4d3
pop esi
ret
Function at 0x445ee0
Capabilities:
Check if file exists
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x560bd0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov edi, ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x446072
mov eax, dword [esp + 0x2c]
mov esi, dword [eax]
test esi, esi
jne 0x44603c
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x445f43
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push edi
lea ecx, [esp + 0x14]
push 0x5461
push ecx
mov dword [esp + 0x2c], 0
call fcn.00402140
add esp, 0xc
test ebp, ebp
je 0x445ff1
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x445f8c
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
push 0x54c8
mov byte [esp + 0x24], 1
call fcn.00508953
test eax, eax
je 0x445fc2
push 0x54c8
push eax
lea ecx, [esp + 0x1c]
call fcn.00401d70
mov esi, dword [esp + 0x14]
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00401fb0
lea eax, [esi - 0x10]
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x445ff1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x10]
push 0
push 0x23
push edi
call fcn.0050c485
mov esi, eax
test ebp, ebp
je 0x446018
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x446018
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44603c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, 2
jne 0x446057
or eax, 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
xor eax, eax
cmp esi, 6
sete al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x44c420
Capabilities:
Get common file path

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push esi
lea eax, [esp + 4]
push eax
push ecx
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 0xc]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
push edx
sbb esi, esi
push eax
inc esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x44c470
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x14]
mov dword [ebx], 0
push eax
mov dword [esi], 0
push edi
mov dword [ebp], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0x28], eax
test eax, eax
jbe 0x44c526
push eax
call fcn.004ff95f
mov ecx, dword [esp + 0x2c]
add esp, 4
push eax
push ecx
push 0
push edi
mov dword [esp + 0x30], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44c519
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x14]
push eax
push str.StringFileInfo040904b0ProductVersion
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44c519
mov eax, dword [esp + 0x10]
push ebx
lea edx, [esp + 0x28]
push edx
push esi
push ebp
push str._d___d___d___d
push eax
mov dword [esp + 0x3c], 0
call fcn.00540b9b
mov eax, dword [esi]
mov edx, dword [esp + 0x3c]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*2]
add esp, 0x18
mov dword [esi], eax
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004ff96a
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x44c5c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
xor esi, esi
mov edi, eax
cmp dword [0x5ec7c0], esi
je 0x44c5f4
push edi
call fcn.0044b0c0
mov esi, eax
add esp, 4
test esi, esi
je 0x44c5f4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push 0
push edx
push edi
mov ecx, ebx
call fcn.00500304
mov edi, eax
test esi, esi
je 0x44c61c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc