joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x104
ret

Function at 0x412175
Capabilities:
Encode data using xor

Disassembly:
inc ecx
dec edx
lea edx, [ebp + edx + 0x7a9a774a]
rdtsc
pop esi
ret
add dword [ebp - 0x256], 1
push dword [esp + 0x54]
push 0
inc edx
push esp
push dword [esp]
and ch, 0x73
call dword [esp + 0xc]
inc ecx
push esp
push dword [esp]
call dword [esp + 0x64]
push esp
push dword [esp]
call dword [esp + 0x64]
push esp
push dword [esp]
xchg edx, eax
call dword [esp + 0x64]
push esp
sub ah, bl
mov ecx, esi
push dword [esp]
dec edx
sub dh, al
call dword [esp + 0x64]
xor ch, dh
not ecx
pop ecx
pop edx
cmp al, 0x89
call edi
cmp eax, esi
nop
je fcn.00412175
and al, 0xff
xor al, 0
xchg ecx, edx
mov edx, 0xa89318f5
push eax
jmp 0x411d78

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404dc8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405278
mov byte [esp], al
cmp byte [esp], 0
jne 0x404f51
test edi, edi
je 0x404f51
mov byte [esp + 1], 0
test ebp, ebp
jle 0x404e91
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x404e6c
cmp edi, 0xffffffff
je 0x404e2d
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x404e2d
mov byte [esp], 0
jmp 0x404f51
cmp dword [esi], 1
jg 0x404e6c
cmp dword [esi], 0
jne 0x404e5e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x404e5e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x404f51
lea eax, [esp + 0xc]
call fcn.00404a84
dec ebp
test ebp, ebp
jg 0x404e12
cmp edi, 0xffffffff
je 0x404e91
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x404e8f
mov byte [esp], 0
jmp 0x404f51
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x404dd6
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x404e91
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00404fcc
mov edx, eax
mov ebx, dword [0x40d8e0]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x404ef5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x404ef3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x404ef5
xor edi, edi
cmp byte [esp], 0
je 0x404f1b
mov ebx, dword [esi]
test bl, 1
jne 0x404f31
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x404efb
mov byte [esp + 1], 1
jmp 0x404f31
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x404f1b
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x404ea8
cmp byte [esp], 0
je 0x404f51
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x405a90
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40d040], 0
je 0x405af7
cmp word [0x40d32c], 0xd7b2
jne 0x405ab9
cmp dword [0x40d334], 0
jbe 0x405ab9
mov eax, 0x40d328
call dword [0x40d344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x405b24
call fcn.00405ed0
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40c01a], 0
jne 0x405b13
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x407cec
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x403840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x74b1ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4038e3
cmp byte [esi + 0x3d], 0
je 0x4038e3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x403899
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4038ab
sub eax, 1
je 0x4038af
sub eax, 2
je 0x4038e3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd30a
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4038cc
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004e9413
add esp, 0x10
cmp edi, eax
jne 0x403899
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd30a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004cd30a
mov esp, ebp
pop ebp
ret
Function at 0x406810
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66bd9b
mov eax, dword fs:[0]
push eax
mov eax, 0x28d8
call fcn.004ce320
mov eax, dword [0x74b1ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28e4], esi
mov dword [ebp - 0x28e4], esi
mov dword [ebp - 0x28d0], 0
mov dword [ebp - 0x28cc], 0xf
mov byte [ebp - 0x28e0], 0
lea eax, [ebp - 0x28e4]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x28b0]
mov dword [ebp - 0x28e4], 0x2880
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x4068b8
lea eax, [ebp - 0x28b0]
nop dword [eax + eax]
cmp dword [eax + 0x1a0], 6
jne 0x4068b2
cmp dword [eax + 0x190], 6
je 0x4068e5
mov eax, dword [eax]
test eax, eax
jne 0x4068a0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd30a
mov esp, ebp
pop ebp
ret
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
lea eax, [ebp - 0x30]
push str._02x_02x_02x_02x_02x_02x
push eax
call fcn.0040b3d0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x28b8], 0
add esp, 0x20
mov dword [ebp - 0x28b4], 0xf
mov byte [ebp - 0x28c8], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406947
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x28c8]
call fcn.004036b0
movups xmm0, xmmword [ebp - 0x28c8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x28b8]
movq qword [esi + 0x10], xmm0
jmp 0x4068c9
Function at 0x407f20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ebx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407f43
test al, 0x10
je 0x407f43
mov bl, 1
jmp 0x407f5c
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x407f92
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407f88
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407f97
push edx
push ecx
call fcn.004cd516
add esp, 8
mov al, bl
pop ebx
pop ebp
ret
call fcn.004e9059
int3
Function at 0x408c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x408d78
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x408d67
jg 0x408cd0
test edx, edx
je 0x408d67
nop dword [eax]
call fcn.0040a030
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x408d24
jg 0x408ce7
test esi, esi
je 0x408d24
cmp ebx, eax
jg 0x408cf7
jl 0x408cf1
cmp edi, esi
jae 0x408cf7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004e5340
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x408d4b
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x408d61
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x408cd0
jl 0x408d61
test edi, edi
jne 0x408cd0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x408d9a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x408d9c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x408e1a
jg 0x408daf
test esi, esi
je 0x408e1a
test eax, eax
jl 0x408df4
jg 0x408db9
test ebx, ebx
je 0x408df4
cmp edi, eax
jg 0x408dc9
jl 0x408dc3
cmp esi, ebx
jae 0x408dc9
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.004e5340
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x408df7
mov edx, dword [ebp + 8]
test edi, edi
jl 0x408e1a
jg 0x408e01
test esi, esi
je 0x408e1a
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x408e1a
push eax
push esi
push 1
push edx
call fcn.004e9413
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408e30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x408f1b
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x408f0a
jg 0x408e70
test edx, edx
je 0x408f0a
nop dword [eax]
call fcn.00403aa0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x408ec7
jg 0x408e87
test esi, esi
je 0x408ec7
cmp ebx, eax
jg 0x408e97
jl 0x408e91
cmp edi, esi
jae 0x408e97
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.004e5340
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x408eec
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x408f04
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x408e70
jl 0x408f04
test edi, edi
jne 0x408e70
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x408f3d
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x408f3f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x408ff5
jg 0x408f5a
test esi, esi
je 0x408ff5
test eax, eax
jl 0x408fa3
jg 0x408f64
test ebx, ebx
je 0x408fa3
cmp edi, eax
jg 0x408f74
jl 0x408f6e
cmp esi, ebx
jae 0x408f74
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.004e5340
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x408faa
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x408ff5
jg 0x408fb4
test esi, esi
je 0x408ff5
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x408ff5
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x408fe0
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.004ede13
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x74b1ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x409360
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd30a
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40939c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40939c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd30a
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x409483
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4093c4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4093f7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004e9636
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd30a
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x409483
cmp eax, 1
jle 0x409456
cmp eax, 3
jne 0x409483
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00404a50
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd30a
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x409473
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004e9413
add esp, 0x10
cmp edi, eax
jne 0x409483
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x409387
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cd30a
mov esp, ebp
pop ebp
ret 4
Function at 0x40e1a0
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66c478
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x74b1ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call sym._1.0.0.4_10001.exe_public:_void___thiscall_DuiLib::CWindowWnd::CenterWindow_void_
mov ecx, edi
call fcn.00411a90
test eax, eax
jne 0x40e299
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
push 0x708fec
mov word [ecx], ax
call fcn.00409b90
mov dword [ebp - 4], 0
xor esi, esi
movups xmm0, xmmword [0x70a65c]
mov ax, word [0x70a66c]
mov word [ebp - 0x14], ax
movups xmmword [ebp - 0x24], xmm0
nop
mov eax, 0xa0a0a0a1
mov ecx, esi
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x33
sub ecx, eax
add ecx, 0x36
xor word [ebp + esi*2 - 0x24], cx
inc esi
cmp esi, 9
jl 0x40e220
sub esp, 0x18
lea ecx, [ebp - 0x24]
mov edx, esp
lea esi, [ecx + 2]
xor eax, eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e266
sub ecx, esi
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00409b90
mov dword [ebp - 4], 0xffffffff
call fcn.00404cb0
add esp, 0x30
mov ecx, edi
push 1
call sym._1.0.0.4_10001.exe_public:_void___thiscall_DuiLib::CWindowWnd::Close_unsigned_int_
mov ecx, edi
call fcn.0040e2f0
push 0
push 0
push edi
push 0x40d8c0
push 0
push 0
call fcn.004ee388
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd30a
mov esp, ebp
pop ebp
ret
Function at 0x412f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8d4
mov eax, dword [0x74b1ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
call sym._1.0.0.4_10001.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetInstance_struct_HINSTANCE____
push 4
call sym._1.0.0.4_10001.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourceType_int_
push 0x709184
call sym._1.0.0.4_10001.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourcePath_wchar_t_const__
add esp, 0xc
push 0x70a6f0
push 0x74
call sym._1.0.0.4_10001.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41303d
push edi
push esi
call sym._1.0.0.4_10001.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41303c
push esi
call sym._1.0.0.4_10001.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x41303c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x8d4]
lea ecx, [eax + esi]
push ecx
push eax
push dword [0x802694]
mov ecx, 0x802690
call fcn.00412d70
mov eax, dword [0x802694]
mov ecx, dword [0x802690]
sub eax, ecx
push 0
push eax
push ecx
call sym._1.0.0.4_10001.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourceZip_void___unsigned_int__wchar_t_const__
add esp, 0xc
pop edi
lea ecx, [ebp - 0x8d0]
call fcn.0040da70
push 0
push closesocket
push closesocket
push closesocket
push closesocket
push 0x100
push 0x10cf0000
push str.FrameWndWnd
push 0
lea ecx, [ebp - 0x8d0]
call sym._1.0.0.4_10001.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____
lea ecx, [ebp - 0x8d0]
call sym._1.0.0.4_10001.exe_public:_unsigned_int___thiscall_DuiLib::CWindowWnd::ShowModal_void_
lea ecx, [ebp - 0x8d0]
call fcn.0040dc90
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004cd30a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x414ec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x74b1ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.004e5e40
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call sym._1.0.0.4_10001.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004cd30a
leave
ret

Function at 0x416282
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x4162a5
or esi, 1
push 2
call edi
test ax, ax
jns 0x4162b1
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x4162bd
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x4162c9
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret