joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43aee0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59da38
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x30
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
jg 0x43af1b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
cmp dword [0x608644], 0xffffffff
jne 0x43b0d8
mov ecx, dword [esp + 0x54]
mov edx, dword [0x614cb0]
mov dword [0x64f980], ecx
mov dword [esp + 0x50], edx
inc eax
mov dword [esp + 0x48], ebx
push eax
lea eax, [esp + 0x54]
push str..COM_i
push eax
call fcn.0056d732
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
xor esi, esi
mov ecx, dword [esp + 0x50]
push ebx
push 0x40000000
push 3
push ebx
push ebx
push 0xc0000000
push ecx
call edi
cmp eax, 0xffffffff
mov dword [0x608644], eax
jne 0x43af8e
push 0x64
call ebp
inc esi
cmp esi, 0x32
jl 0x43af62
jmp 0x43af93
cmp esi, 0x32
jl 0x43afb9
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], 0xffffffff
call fcn.00575ae8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
push 0x10000
push 0x10000
push eax
call dword [sym.imp.KERNEL32.dll_SetupComm]
mov eax, dword [0x608644]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov ecx, dword [esp + 0x2c]
mov eax, dword [0x608644]
and ecx, 0xffff9091
lea edx, [esp + 0x24]
or ecx, 0x1011
push edx
push eax
mov dword [esp + 0x2c], 0x1c
mov dword [esp + 0x30], 0x1c200
mov dword [esp + 0x34], ecx
mov byte [esp + 0x3e], 8
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], bl
mov byte [esp + 0x43], bl
call dword [sym.imp.KERNEL32.dll_SetCommState]
mov edx, dword [0x608644]
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov eax, dword [0x608644]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push ebx
push ebx
call ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x43ab00
mov dword [0x619168], eax
mov dword [0x619160], ebx
mov dword [0x619164], ebx
call fcn.0057738c
push ebx
push ebx
push ebx
push ebx
call ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x43ae10
mov dword [0x619094], eax
call fcn.0057738c
mov esi, 0x6190c0
mov edi, 0x619098
push ebx
push ebx
push ebx
push ebx
call ebp
mov dword [esi + 8], eax
mov dword [edi], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
add edi, 4
add esi, 0x14
cmp edi, 0x6190b8
jl 0x43b0a9
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], 0xffffffff
call fcn.00575ae8
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x43b150
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [0x608644]
cmp ecx, 0xffffffff
jne 0x43b15e
xor eax, eax
ret
mov eax, dword [0x64f998]
lea eax, [eax + eax*4]
lea edx, [eax*4 + 0x6190b8]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x43b1a3
call fcn.0043b0f0
mov dword [0x64f984], 1
xor eax, eax
ret
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x43b1d9
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x43b1ba
mov eax, dword [0x64f998]
jmp 0x43b1cf
mov edx, dword [0x64f998]
lea eax, [edx + 1]
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x43b1cf
dec eax
or eax, 0xfffffff8
inc eax
push ecx
push eax
call fcn.0043ae90
add esp, 8
mov eax, dword [0x64f998]
inc eax
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x43b1eb
dec eax
or eax, 0xfffffff8
inc eax
mov dword [0x64f998], eax
mov eax, 1
ret
Function at 0x4429d0
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0xeac]
mov eax, dword [esi + 0x1004]
lea ecx, [esi + 0x1004]
push edx
call dword [eax + 0xc]
mov edx, dword [esi + 0xea4]
lea ecx, [esi + 0x1020]
mov ebx, eax
push edx
mov eax, dword [ecx]
mov dword [esp + 0x18], ebx
call dword [eax + 0xc]
mov ebp, eax
mov eax, dword [esi + 0xff4]
mov dword [esp + 0x10], ebp
fild dword [esp + 0x10]
fild dword [esp + 0x14]
mov ecx, dword [esi + eax*4 + 0xf30]
lea edi, [esi + eax*4 + 0xf30]
mov eax, dword [esi + 0xff0]
fpatan
sub eax, ecx
mov dword [esi + 0xff0], eax
fmul qword [0x5bab20]
call fcn.00556a00
mov ecx, dword [esi + 0xffc]
mov dword [esi + 0xffc], eax
sub ecx, eax
mov eax, 0x431bde83
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 0xc8
jle 0x442a72
mov edx, 0xc8
jmp 0x442a7f
cmp edx, 0xffffff38
jge 0x442a7f
mov edx, 0xffffff38
mov dword [edi], edx
mov edi, dword [esi + 0xff0]
mov eax, dword [esi + 0xff4]
add edi, edx
inc eax
mov ecx, 0xc
cdq
idiv ecx
sar ebx, 0x10
sar ebp, 0x10
mov dword [esi + 0xff0], edi
mov dword [esi + 0x140], edi
mov dword [esi + 0xeb0], ebx
mov dword [esi + 0xeb4], ebp
mov dword [esi + 0xff4], edx
mov edx, dword [esi + 0xf24]
cmp edx, edi
jg 0x442ac8
mov edx, edi
mov ebx, dword [esi + 0xf20]
mov dword [esi + 0xf24], edx
cmp ebx, edi
jl 0x442ada
mov ebx, edi
mov eax, edx
lea ecx, [ebx + edx]
shl eax, 7
sar ecx, 1
sub eax, edx
mov ebp, dword [esi + 0xf2c]
add eax, ecx
mov dword [esi + 0x144], 0
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
mov dword [esi + 0xf24], eax
mov eax, ebx
shl eax, 7
sub eax, ebx
xor ebx, ebx
add eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
cmp edi, ecx
mov dword [esi + 0xf20], eax
mov eax, dword [esi + 0xf28]
setg bl
xor edx, edx
mov dx, word [esi + 0xf02]
add ebp, edx
cmp eax, ebx
mov dword [esi + 0xf2c], ebp
mov ecx, ebp
je 0x442b96
test ebx, ebx
je 0x442b4f
mov dword [esi + 0xf24], edi
jmp 0x442b55
mov dword [esi + 0xf20], edi
lea edi, [ecx + 0x8000]
sar edi, 0x10
test edi, edi
jle 0x442b75
mov ebp, edi
mov eax, dword [esi + 0xf28]
mov ecx, esi
push eax
call fcn.00442da0
dec ebp
jne 0x442b64
mov ecx, dword [esi + 0xf2c]
mov dword [esi + 0xf28], ebx
shl edi, 0x10
sub ecx, edi
pop edi
sar ecx, 1
mov dword [esi + 0xf2c], ecx
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp ecx, 0x20000
jle 0x442bb0
push eax
mov ecx, esi
call fcn.00442da0
add dword [esi + 0xf2c], 0xffff0000
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x442bc0
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0xeac]
mov eax, dword [esi + 0x103c]
lea ecx, [esi + 0x103c]
push edx
call dword [eax + 0xc]
mov edx, dword [esi + 0xea4]
lea ecx, [esi + 0x1058]
mov dword [esp + 0x14], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xec]
fild dword [esp + 0x10]
fild dword [esp + 0x14]
mov ecx, dword [esi + eax*4 + 0x28]
mov ebx, dword [esi + 0xe8]
lea edi, [esi + eax*4 + 0x28]
sub ebx, ecx
fpatan
mov dword [esi + 0xe8], ebx
fmul qword [0x5bab20]
call fcn.00556a00
mov ecx, dword [esi + 0x114]
mov dword [esi + 0x114], eax
sub ecx, eax
mov eax, 0x431bde83
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 0xc8
jle 0x442c58
mov edx, 0xc8
jmp 0x442c65
cmp edx, 0xffffff38
jge 0x442c65
mov edx, 0xffffff38
mov dword [edi], edx
mov edi, dword [esi + 0xe8]
mov eax, dword [esi + 0xec]
add edi, edx
inc eax
mov ecx, 6
cdq
idiv ecx
mov eax, dword [esi + 0x10]
mov ebx, edi
cmp eax, ebx
mov dword [esi + 0xe8], edi
mov dword [esi + 0x140], ebx
mov dword [esi + 0xec], edx
jg 0x442c9b
mov eax, ebx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x10], eax
cmp ecx, ebx
jl 0x442ca7
mov ecx, ebx
lea edx, [eax*8]
lea edi, [ecx + eax]
sub edx, eax
mov ebp, dword [esi + 0x24]
sar edi, 1
lea edx, [edx + edx*4]
mov dword [esi + 0x144], 0
lea edx, [eax + edx*8]
lea edx, [eax + edx*2]
add eax, edi
lea edx, [eax + edx*2]
mov eax, 0x3a196b1f
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [ecx*8]
sub eax, ecx
mov dword [esi + 0x10], edx
lea edx, [eax + eax*4]
lea eax, [ecx + edx*8]
lea edx, [ecx + eax*2]
lea eax, [edi + ecx]
lea ecx, [eax + edx*2]
mov eax, 0x3a196b1f
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [esi + 0xc], edx
xor edx, edx
cmp ebx, edi
setg dl
xor eax, eax
mov edi, edx
mov ax, word [esi + 0xf02]
shl eax, 1
add ebp, eax
mov eax, dword [esi + 0x20]
cmp eax, edi
mov dword [esi + 0x24], ebp
mov ecx, ebp
je 0x442d73
test edi, edi
je 0x442d3b
mov dword [esi + 0x10], ebx
jmp 0x442d3e
mov dword [esi + 0xc], ebx
lea ebx, [ecx + 0x8000]
sar ebx, 0x10
test ebx, ebx
jle 0x442d5b
mov ebp, ebx
mov ecx, dword [esi + 0x20]
push ecx
mov ecx, esi
call fcn.00442ff0
dec ebp
jne 0x442d4d
mov edx, dword [esi + 0x24]
mov dword [esi + 0x20], edi
shl ebx, 0x10
sub edx, ebx
pop edi
sar edx, 1
mov dword [esi + 0x24], edx
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp ecx, 0x20000
jle 0x442d8a
push eax
mov ecx, esi
call fcn.00442ff0
add dword [esi + 0x24], 0xffff0000
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4520e1
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push esi
mov esi, ecx
push 8
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x452178
mov ecx, esi
call fcn.00455810
mov ebp, eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x452178
mov ecx, esi
call fcn.00451fe0
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x452167
mov ecx, dword [esi + 0xb90]
test ecx, ecx
je 0x452167
push ebx
push edi
push 0
push eax
call fcn.004f4e00
add esp, 8
mov ecx, esi
mov edi, eax
mov ebx, 0x140
call fcn.00455c20
xor edx, edx
push eax
xor ecx, ecx
push ebx
push edx
push ecx
push edi
mov ecx, esi
call fcn.004534d0
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop ebx
test eax, eax
jne 0x452167
mov ecx, esi
call fcn.00454300
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebp, ebp
je 0x452178
mov ecx, esi
call fcn.004533b0
pop esi
pop ebp
ret

Function at 0x452cf0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
cmp eax, 0x8000
jne 0x452d2b
mov eax, dword [esi + 0x3abc]
mov ecx, esi
neg eax
sbb eax, eax
and al, 0xfc
add eax, 4
mov dword [esi + 0x3abc], eax
call fcn.00451f60
pop esi
add esp, 8
ret
mov ecx, dword [0x64fe78]
push ebx
call fcn.00473f00
mov ecx, dword [0x64fe78]
call fcn.0046d6d0
mov eax, dword [esi + 0x66c]
xor ebx, ebx
cmp eax, ebx
je 0x452e09
mov eax, dword [esi + 0xf34]
cmp eax, 0x64
jle 0x452e09
fld qword [0x5bb338]
mov ecx, eax
cmp ecx, ebx
mov dword [esp + 8], ecx
je 0x452d87
cmp ecx, ebx
jle 0x452d83
mov eax, dword [esi + 0xf28]
fadd qword [eax]
add eax, 8
dec ecx
jne 0x452d7b
fidiv dword [esp + 8]
fdiv qword [esi + 0xf7d30]
fst qword [esp + 8]
fsub qword [0x5bab28]
fabs
fcomp qword [0x5bafe8]
fnstsw ax
test ah, 1
je 0x452ddc
mov ecx, esi
call fcn.00454a60
fld qword [esi + 0xb40]
fmul qword [esp + 8]
mov ecx, esi
fstp qword [esi + 0xb40]
fld qword [esi + 0xb40]
fmul qword [esi + 0xb70]
fdivr qword [0x5be9d0]
fstp qword [esi + 0xf7d28]
call fcn.00451f60
mov ecx, dword [esi + 0xf2c]
push edi
mov edi, dword [esi + 0xf28]
xor eax, eax
shl ecx, 3
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov dword [esi + 0xf30], ebx
mov dword [esi + 0xf34], ebx
pop edi
mov eax, dword [esi + 0xf7d10]
mov ecx, 1
cmp eax, 0xc8
jle 0x452e21
mov dword [esi + 0xf88], ecx
cmp eax, 0x100
jl 0x452e34
mov dword [esi + 0xf5c], 3
jmp 0x452e3a
mov dword [esi + 0xf5c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0xdb0]
call fcn.00464c00
mov dword [esi + 0xf7d18], ebx
mov dword [esi + 0xf48], ebx
mov dword [esi + 0xf4c], ebx
mov dword [esi + 0xf54], ebx
mov dword [esi + 0xf80], ebx
mov dword [esi + 0xf7d14], ebx
mov dword [esi + 0xf7d10], ebx
mov dword [esi + 0xf7d0c], ebx
mov dword [esi + 0xf7d1c], ebx
mov dword [esi + 0xf7c], ebx
pop ebx
pop esi
add esp, 8
ret
Function at 0x454180
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
fld qword [esp + 0x10]
fdiv qword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x14], ebp
fadd qword [0x5baea0]
call fcn.00556a00
mov ebx, eax
lea esi, [ebx*4]
push esi
call fcn.0057110b
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esp + 0x14], edi
mov esi, 0xf423f
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, ebx
and ecx, 3
add esp, 4
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
imul edx, ecx
sub eax, edx
add eax, 0xf423f
cdq
idiv esi
test ecx, ecx
mov esi, edx
jle 0x4542b3
mov dword [esp + 0x28], ecx
xor edi, edi
test ebx, ebx
mov dword [esp + 0x1c], edi
jle 0x4542a4
mov cl, byte [esi + ebp + 0x3ac0]
mov eax, dword [ebp + 0xb68]
inc esi
mov byte [esp + 0x30], cl
test eax, eax
je 0x454222
or al, 0xff
sub al, cl
mov cl, al
mov byte [esp + 0x30], cl
mov eax, esi
mov esi, 0xf423f
cdq
idiv esi
cmp cl, 0x28
mov dword [esp + 0x20], edx
jae 0x454293
cmp cl, 0x18
jbe 0x454244
mov dl, 0x28
sub dl, cl
mov byte [esp + 0x30], dl
jmp 0x45424e
cmp cl, 0x10
jbe 0x45424e
mov byte [esp + 0x30], 0x10
mov esi, dword [esp + 0x30]
mov ecx, 1
and esi, 0xff
sub ecx, esi
cmp ecx, esi
jge 0x454293
lea ebp, [ecx + edi]
add ebp, ebx
mov eax, ebp
cdq
idiv ebx
mov eax, dword [esp + 0x10]
lea edi, [eax + edx*4]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, esi
sub edx, eax
mov eax, dword [edi]
add eax, edx
inc ecx
inc ebp
cmp ecx, esi
mov dword [edi], eax
jl 0x454268
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
inc edi
cmp edi, ebx
mov dword [esp + 0x1c], edi
jl 0x454202
mov eax, dword [esp + 0x28]
dec eax
mov dword [esp + 0x28], eax
jne 0x4541f4
mov ebp, dword [esp + 0x10]
xor edi, edi
xor eax, eax
mov edx, dword [ebp]
test ebx, ebx
jle 0x4542d6
mov esi, ebp
mov ecx, dword [esi]
cmp ecx, edx
jle 0x4542ce
mov edx, ecx
mov edi, eax
inc eax
add esi, 4
cmp eax, ebx
jl 0x4542c4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4542e0
mov dword [eax], edx
push ebp
call fcn.00571134
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x1c

Function at 0x454340
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x45434f
xor eax, eax
pop ebx
ret 0xc
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
jle 0x4543a6
push ebp
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x18]
mov ebx, 0xf423f
add eax, esi
mov ebp, 0xf423f
cdq
idiv ebx
xor eax, eax
mov al, byte [edx + ecx + 0x3ac0]
mov ebx, eax
mov eax, esi
cdq
idiv ebp
xor eax, eax
mov al, byte [edx + ecx + 0x3ac0]
sub eax, ebx
inc esi
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x454360
mov ebx, dword [esp + 0x1c]
pop ebp
mov eax, edi
pop edi
cdq
idiv ebx
pop esi
pop ebx
ret 0xc
Function at 0x471cf0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0xa458]
cmp dword [eax + 0x98], 0x64
jl 0x471d04
jmp 0x4a1940
push 5
push str.sndvol32.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
ret

Function at 0x471d20
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0xa458]
cmp dword [eax + 0x98], 0x64
jl 0x471d34
jmp 0x4a1940
push 5
push str.sndvol32.exe__r
call dword [sym.imp.KERNEL32.dll_WinExec]
ret
mov ecx, dword [ecx + 0xa458]
test ecx, ecx
je 0x4a194f
mov eax, dword [ecx]
jmp dword [eax + 0x4c]
ret
Function at 0x474240
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x8348]
test eax, eax
jne 0x474258
call fcn.00475200
jmp 0x47425e
fld qword [ebp + 0xa788]
call fcn.00556a00
mov ecx, dword [ebp + 0x94f8]
push eax
call fcn.004e23d0
fld qword [ebp + 0xa788]
call fcn.00556a00
mov edx, dword [ebp + 0xa770]
mov ebx, eax
mov ecx, ebp
sub ebx, edx
call fcn.00477760
cmp eax, 2
jne 0x474292
neg ebx
mov eax, dword [ebp + 0xa76c]
test eax, eax
jne 0x474408
test ebx, ebx
je 0x474408
mov eax, ebx
cdq
mov ecx, eax
mov eax, dword [ebp + 0xa070]
xor ecx, edx
sub ecx, edx
cdq
sub eax, edx
sar eax, 1
cmp ecx, eax
jge 0x474408
mov ecx, ebp
call fcn.00477760
test eax, eax
je 0x474408
push 0x91
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x474408
push esi
push edi
mov edi, dword [0x650390]
cmp edi, 0x64
jg 0x4742f8
mov edi, 0x64
mov eax, dword [ebp + 0xa070]
mov ecx, dword [0x60f464]
cdq
sub eax, edx
sar eax, 1
add eax, 0xffffff9c
cmp ecx, eax
jge 0x474318
mov esi, ecx
mov dword [esp + 0x10], esi
jmp 0x47431e
mov dword [esp + 0x10], eax
mov esi, eax
mov ecx, dword [ebp + 0xa454]
test ecx, ecx
je 0x474388
mov edx, dword [ecx]
push 0
push 0
push 0
push 0x40
call dword [edx + 4]
sub eax, ebx
cmp eax, edi
jge 0x47433d
mov eax, edi
cmp eax, esi
jle 0x474343
mov eax, esi
mov ecx, dword [ebp + 0xa454]
push 0
push 0
push eax
mov edx, dword [ecx]
push 0x3f
call dword [edx + 4]
mov ecx, dword [ebp + 0xa454]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0x3e
call dword [eax + 4]
sub eax, ebx
cmp eax, edi
jge 0x474370
mov eax, edi
cmp eax, esi
jle 0x474376
mov eax, esi
mov ecx, dword [ebp + 0xa454]
push 0
push 0
push eax
mov edx, dword [ecx]
push 0x3d
call dword [edx + 4]
lea esi, [ebp + 0xa45c]
mov dword [esp + 0x14], 0x27
mov ecx, dword [esi]
test ecx, ecx
je 0x4743f8
mov eax, dword [ecx]
push 0
push 0
push 0
push 0x40
call dword [eax + 4]
sub eax, ebx
cmp eax, edi
jge 0x4743b1
mov eax, edi
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jle 0x4743bb
mov eax, ecx
mov ecx, dword [esi]
push 0
push 0
push eax
mov edx, dword [ecx]
push 0x3f
call dword [edx + 4]
mov ecx, dword [esi]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0x3e
call dword [eax + 4]
sub eax, ebx
cmp eax, edi
jge 0x4743e0
mov eax, edi
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jle 0x4743ea
mov eax, ecx
mov ecx, dword [esi]
push 0
push 0
push eax
mov edx, dword [ecx]
push 0x3d
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add esi, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x474396
pop edi
pop esi
fld qword [ebp + 0xa788]
call fcn.00556a00
mov dword [ebp + 0xa770], eax
sub esp, 8
fld qword [ebp + 0xa788]
fstp qword [esp]
mov ecx, ebp
call fcn.00479db0
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4946e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a6f9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x45c
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x47c]
lea eax, [esp + 0x28]
mov edi, 1
push eax
push ecx
mov dword [esp + 0x478], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.0056fd23
xor eax, eax
cmp ebx, 0xffffffff
setne al
test eax, eax
mov byte [esp + 0x470], 2
jne 0x494760
mov esi, dword [esp + 0x478]
push 0x618f40
mov ecx, esi
call fcn.00575b56
mov dword [esp + 0xc], edi
jmp 0x49489c
mov edi, dword [esp + 0x480]
push ebp
test dword [esp + 0x2c], 0x1356
jne 0x494806
test edi, edi
je 0x4947f3
lea edx, [esp + 0x16c]
lea eax, [esp + 0x36c]
push edx
lea ecx, [esp + 0x270]
push eax
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x64]
push edx
push eax
call fcn.00558754
mov al, byte [esp + 0x180]
add esp, 0x14
cmp al, 0x2e
lea ebp, [esp + 0x16c]
jne 0x4947bd
lea ebp, [esp + 0x16d]
mov eax, dword [edi + 8]
xor esi, esi
test eax, eax
jle 0x494806
mov ecx, dword [edi + 4]
push ebp
lea eax, [ecx + esi*4]
mov eax, dword [ecx + esi*4]
push eax
call fcn.005591b6
add esp, 8
test eax, eax
je 0x4947e7
mov eax, dword [edi + 8]
inc esi
cmp esi, eax
jl 0x4947c6
jmp 0x494806
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x58]
push edx
push eax
jmp 0x4947fd
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x58]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.0056feff
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x494768
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x1c]
pop ebp
test eax, eax
jne 0x494847
mov esi, dword [esp + 0x478]
push 0x618f40
mov ecx, esi
call fcn.00575b56
mov dword [esp + 0xc], 1
jmp 0x49489c
mov edi, 1
cmp eax, edi
jne 0x494856
mov ecx, dword [esp + 0x14]
jmp 0x494889
mov esi, eax
call fcn.00557842
cdq
idiv esi
cmp edx, dword [0x60dcb4]
jne 0x49487c
mov esi, dword [esp + 0x18]
call fcn.00557842
cdq
idiv esi
cmp edx, dword [0x60dcb4]
je 0x494868
mov eax, dword [esp + 0x14]
mov dword [0x60dcb4], edx
lea ecx, [eax + edx*4]
mov esi, dword [esp + 0x478]
push ecx
mov ecx, esi
call fcn.0057585d
mov dword [esp + 0xc], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x470], 1
call fcn.0056fd56
lea ecx, [esp + 0x47c]
mov byte [esp + 0x470], 0
call fcn.00575ae8
mov ecx, dword [esp + 0x468]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x468
ret
Function at 0x4a4a40
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x5a8b18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x9a14]
call fcn.004ab520
mov ebx, eax
test ebx, ebx
jne 0x4a4ab9
mov eax, dword [esi + 0x8dcc]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4a4ab9
mov ecx, dword [esi + 0x8e38]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4a4ab9
mov edx, dword [esi + 0x8e3c]
mov eax, dword [edx - 8]
test eax, eax
jne 0x4a4ab9
mov eax, dword [esi + 0x8e28]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4a4ab9
mov ecx, dword [esi + 0x8e2c]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4a4ab9
mov edx, dword [esi + 0x8e40]
mov eax, dword [edx - 8]
test eax, eax
je 0x4a4b2e
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
test ah, 0x80
jne 0x4a4ad6
push 0x11
call edi
test ah, 0x80
jne 0x4a4ad6
xor eax, eax
jmp 0x4a4adb
mov eax, 1
test ebx, ebx
pop edi
je 0x4a4b27
test eax, eax
jne 0x4a4b27
lea eax, [esp + 8]
push 0xcd7f
push eax
call fcn.005054c0
add esp, 8
mov eax, dword [eax]
push 0x31
push 0
push eax
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.005737b9
cmp eax, 1
lea ecx, [esp + 8]
setne bl
mov dword [esp + 0x14], 0xffffffff
call fcn.00575ae8
test bl, bl
jne 0x4a4b2e
mov ecx, esi
call fcn.004a4b40
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4a7c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a9060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.005760db
mov eax, dword [esp + 0x30]
push 0
push 0
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0
call fcn.00576150
test eax, eax
je 0x4a7d3e
mov eax, dword [0x614cb0]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov byte [esp + 0x28], 2
push ecx
lea ecx, [esp + 0x10]
call fcn.00576333
test eax, eax
je 0x4a7d0d
lea edx, [esp + 4]
push 0x600f14
lea eax, [esp + 0x34]
push edx
push eax
call fcn.00575d7d
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.00575f00
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 2
call fcn.00575ae8
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x10]
call fcn.00576333
test eax, eax
jne 0x4a7cca
lea ecx, [esp + 0xc]
call fcn.00576480
mov edx, dword [esp + 8]
mov ecx, esi
push edx
call fcn.004a7ba0
lea ecx, [esp + 4]
mov byte [esp + 0x28], 1
call fcn.00575ae8
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.00575ae8
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0057610d
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4