joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e76e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.0048e8c4
push 0xc
push ebx
lea edx, [esp + 8]
push edx
call fcn.00497a70
add esp, 0xc
xor ebx, ebx
call fcn.0048e83c
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.0048e860
inc ebx
cmp ebx, 0xc
jl 0x48e78e
mov edx, dword [0x4d5d50]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x28], 2
je 0x48e7c7
movzx ecx, word [0x4e5db6]
sar ecx, 8
jmp 0x48e7d3
mov ecx, dword [0x4e5dbc]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x48e7df
or eax, 0xffffffff
jmp 0x48e833
mov eax, dword [0x4e5d64]
cdq
cmp edx, dword [0x4d5228]
jne 0x48e7f8
cmp eax, dword [0x4d5224]
jbe 0x48e804
jmp 0x48e7fa
jle 0x48e804
mov eax, dword [0x4d5224]
mov ebx, eax
jmp 0x48e80c
mov eax, dword [0x4e5d64]
mov ebx, eax
mov esi, dword [0x4e5d60]
jmp 0x48e828
call fcn.0048e83c
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0048e860
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x48e814
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x48e860
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x4e607c]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4b3a24]
xor ecx, edx
mov dword [0x4e607c], ecx
and ecx, 0xff
add dword [0x4e6080], ecx
imul edx, dword [0x4e6080], 0x8088405
inc edx
mov dword [0x4e6080], edx
shr edx, 0x18
mov ecx, dword [0x4e6084]
xor edx, ecx
and edx, 0xff
shr ecx, 8
mov edx, dword [edx*4 + 0x4b3a24]
xor edx, ecx
mov dword [0x4e6084], edx
ret

Function at 0x48ebd9
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, 0x4e6100
push ebx
mov ecx, dword [edx]
mov ebx, ecx
xor ebx, eax
and ebx, 0xff
shr ecx, 8
mov ebx, dword [ebx*4 + 0x4b3a24]
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul ecx, dword [edx + 4], 0x8088405
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
mov ebx, dword [edx + 8]
xor ecx, ebx
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x4b3a24]
xor ecx, ebx
mov dword [edx + 8], ecx
pop ebx
ret

Function at 0x48ed3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x4bb590], 0
je 0x48ed81
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0xc]
test esi, esi
je 0x48ed81
call fcn.0048ebb8
mov edi, eax
xor eax, eax
mov al, byte [ebx]
call fcn.0048ebd9
mov edx, edi
dec esi
xor dl, byte [ebx]
mov byte [ebx], dl
inc ebx
test esi, esi
jne 0x48ed65
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00499fb0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48eed1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4e6124
mov edi, 0x4e611c
xor ebx, ebx
mov dword [0x4e6120], 2
jmp 0x48f061
mov edx, dword [0x4adbf8]
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [edx + eax + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e610c]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
and eax, 0x7fff
mov edx, dword [0x4adbfc]
mov word [edx + eax*2], bp
mov eax, dword [0x4e610c]
mov ecx, dword [edi]
mov dx, word [esi]
mov word [eax + ecx*2], dx
test ebp, ebp
je 0x48ef59
mov eax, dword [esi]
sub eax, ebp
cmp eax, 0x7efa
ja 0x48ef59
mov eax, ebp
call fcn.0048f2c4
mov ebx, eax
mov eax, dword [0x4e6130]
cmp ebx, eax
jbe 0x48ef59
mov ebx, eax
cmp ebx, 3
jb 0x48f003
mov edx, ebx
sub edx, 3
mov eax, dword [esi]
sub eax, dword [0x4e6128]
call fcn.00490eec
sub dword [0x4e6130], ebx
cmp ebx, dword [0x4e6138]
ja 0x48efd5
dec ebx
inc dword [esi]
mov ecx, dword [0x4adbf8]
mov edx, dword [esi]
movzx ecx, byte [ecx + edx + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e610c]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
mov edx, dword [esi]
and edx, 0x7fff
mov ecx, dword [0x4adbfc]
mov word [ecx + edx*2], bp
mov edx, dword [0x4e610c]
mov ecx, dword [edi]
mov bp, word [esi]
mov word [edx + ecx*2], bp
dec ebx
jne 0x48ef83
inc dword [esi]
jmp 0x48f01d
add dword [esi], ebx
xor ebx, ebx
mov ecx, dword [esi]
mov edx, dword [0x4adbf8]
movzx edx, byte [edx + ecx]
mov dword [edi], edx
mov ebp, dword [esi]
mov ecx, dword [0x4adbf8]
shl edx, 5
movzx ecx, byte [ecx + ebp + 1]
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
jmp 0x48f01d
mov eax, dword [0x4adbf8]
mov edx, dword [esi]
movzx edx, byte [eax + edx]
xor eax, eax
call fcn.00490eec
dec dword [0x4e6130]
inc dword [esi]
test eax, eax
je 0x48f050
mov edx, dword [esi]
sub edx, dword [0x4e6114]
cmp dword [0x4e6114], 0
jl 0x48f03f
mov eax, dword [0x4adbf8]
add eax, dword [0x4e6114]
jmp 0x48f041
xor eax, eax
xor ecx, ecx
call fcn.00490d10
mov edx, dword [esi]
mov dword [0x4e6114], edx
cmp dword [0x4e6130], 0x106
jae 0x48f061
call fcn.0048eda0
cmp dword [0x4e6130], 0
jne 0x48eef0
mov edx, dword [esi]
sub edx, dword [0x4e6114]
cmp dword [0x4e6114], 0
jl 0x48f08c
mov eax, dword [0x4adbf8]
add eax, dword [0x4e6114]
jmp 0x48f08e
xor eax, eax
mov ecx, 1
call fcn.00490d10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48f0a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov ebx, eax
mov esi, 0x4e611c
cmp ebx, 1
jl 0x48f0b7
cmp ebx, 9
jle 0x48f0c1
mov eax, 0x4adc50
call fcn.00492e6c
xor edx, edx
mov dword [0x4e6118], edx
cmp dword [0x4e6110], 0
jne 0x48f0e6
mov dword [0x4e6118], 1
mov dword [0x4e6110], 0x10000
cmp dword [0x4adbf8], 0
jne 0x48f123
push 2
push 0x8000
call fcn.00496238
add esp, 8
mov edi, eax
mov dword [0x4adbf8], edi
test edi, edi
jne 0x48f123
mov eax, 0x4b1ad4
call fcn.0042d570
mov edx, 0x4adc50
mov eax, 4
call fcn.00492d0c
cmp dword [0x4adbfc], 0
jne 0x48f186
push 2
push 0x8000
call fcn.00496238
add esp, 8
mov dword [0x4adbfc], eax
push 2
push 0x8000
call fcn.00496238
add esp, 8
mov dword [0x4e610c], eax
cmp dword [0x4adbfc], 0
je 0x48f166
cmp dword [0x4e610c], 0
jne 0x48f186
mov eax, 0x1ff
call fcn.004125b4
push eax
call fcn.00486908
pop ecx
mov edx, 0x4adc50
mov eax, 4
call fcn.00492d0c
mov eax, dword [0x4e610c]
mov word [eax + 0xfffe], 0
push 0xfffe
push 0
push eax
call fcn.00497ae0
movzx edx, word [ebx*8 + 0x4adc02]
mov dword [0x4e6138], edx
add esp, 0xc
movzx ecx, word [ebx*8 + 0x4adc00]
mov dword [0x4e613c], ecx
cmp ebx, 2
movzx eax, word [ebx*8 + 0x4adc04]
mov dword [0x4e6140], eax
movzx edx, word [ebx*8 + 0x4adc06]
mov dword [0x4e6134], edx
jg 0x48f1e7
or word [ebp], 4
jmp 0x48f1f1
cmp ebx, 8
jl 0x48f1f1
or word [ebp], 2
xor ecx, ecx
xor eax, eax
mov dword [0x4e6124], ecx
mov ebx, 0x8000
add ebx, ebx
mov dword [0x4e6114], eax
mov eax, dword [0x4adbf8]
mov edx, ebx
call dword [0x4ae110]
mov dword [0x4e6130], eax
mov eax, dword [0x4e6130]
test eax, eax
je 0x48f227
cmp eax, 0xffffffff
jne 0x48f23b
mov dword [0x4e612c], 1
xor edx, edx
mov dword [0x4e6130], edx
jmp 0x48f279
xor ecx, ecx
mov dword [0x4e612c], ecx
cmp dword [0x4e6130], 0x106
jae 0x48f254
call fcn.0048eda0
xor eax, eax
xor ebx, ebx
mov dword [esi], eax
mov edx, dword [0x4adbf8]
mov eax, dword [esi]
shl eax, 5
xor ecx, ecx
mov cl, byte [edx + ebx]
inc ebx
xor eax, ecx
and eax, 0x7fff
cmp ebx, 2
mov dword [esi], eax
jb 0x48f25a
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49749c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x498cd8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x498cf4
call fcn.0049a43c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x498d10
test bl, 1
je 0x498d10
call fcn.0049e520
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x498ef4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00499ff8
test byte [ebp + 0xd], 0xc0
jne 0x498f18
mov eax, dword [0x4aec18]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x498f25
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x498f52
je 0x498f64
sub ecx, 0x100
je 0x498f72
sub ecx, 0x100
je 0x498f79
sub ecx, 0x100
je 0x498f6b
jmp 0x498f80
sub ecx, 0x600
je 0x498f79
sub ecx, 0x100
je 0x498f64
jmp 0x498f80
mov edi, 1
jmp 0x498f85
mov edi, 2
jmp 0x498f85
mov edi, 4
jmp 0x498f85
mov edi, 5
jmp 0x498f85
mov edi, 3
test byte [ebp + 0xd], 1
je 0x498fac
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4ae690]
test al, 0x80
je 0x498fa5
mov ebx, 0x80
jmp 0x498fbe
mov ebx, 1
jmp 0x498fbe
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x498fbe
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x498fd0
je 0x498fd9
dec eax
je 0x498fe2
jmp 0x498feb
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x498ffa
mov dword [ebp - 4], 0x40000000
jmp 0x498ffa
mov dword [ebp - 4], 0xc0000000
jmp 0x498ffa
push 1
call fcn.0049a3d0
pop ecx
mov ebx, eax
jmp 0x4990ea
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x499016
sub eax, 0x10
je 0x49901d
sub eax, 0x10
je 0x499026
sub eax, 0x10
je 0x49902f
jmp 0x49902f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x499036
mov dword [ebp - 8], 1
jmp 0x499036
mov dword [ebp - 8], 2
jmp 0x499036
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4990a3
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x499098
test byte [ebp + 0xd], 1
je 0x499093
mov ebx, 0x50
jmp 0x499098
mov ebx, 2
push ebx
call fcn.0049a3d0
pop ecx
mov ebx, eax
jmp 0x4990ea
mov edi, esi
push edi
call fcn.00498e58
pop ecx
test eax, eax
je 0x4990b7
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4990c3
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0049a0f8
add esp, 8
mov ebx, eax
inc eax
jne 0x4990ea
push 4
call fcn.0049a3d0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0049a02c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4995f4
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x499610
call fcn.0049a43c
jmp 0x49967f
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x49962c
call fcn.0049a43c
jmp 0x49967f
cmp dword [0x4ea048], 1
je 0x49967d
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0049e3f4
pop ecx
cmp al, 0x41
jl 0x49967d
cmp al, 0x5a
jg 0x49967d
cmp byte [ebp - 0x107], 0x3a
jne 0x49967d
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x49967d
call fcn.0049a43c
jmp 0x49967f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49e4b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x49e51a
call fcn.0049e468
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00497c90
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00497c90
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49e598
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4afb70], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x49e672
cmp dword [0x4afb6c], 0
jne 0x49e672
cmp dword [0x4afd98], 0
je 0x49e62c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0049e39c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49e612
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0049e39c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49e612
lea ebx, [ebp - 0x84]
jmp 0x49e613
inc ebx
call fcn.0049e554
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x49e6ad
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4afb74
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00497c90
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4afb77
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x49e6ad
cmp dword [0x4afb6c], 0
je 0x49e68c
cmp dword [0x4afb6c], 0xffffffff
je 0x49e6ad
push esi
call dword [0x4afb6c]
pop ecx
mov eax, dword [0x4afb70]
test eax, eax
je 0x49e6ad
cmp dword [0x4afb70], 0xffffffff
je 0x49e6ad
cmp byte [eax], 0
je 0x49e6ad
push esi
push eax
call fcn.0049e4b8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49fe3c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x49fe62
test esi, esi
je 0x49fe62
call fcn.0049e520
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x49fed4
call fcn.0049fb54
mov ebx, eax
test eax, eax
jne 0x49fe7d
call fcn.0049e520
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x49fed4
mov edx, dword [ebp + 0x10]
mov dword [ebx + 4], edx
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x54], eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
push 0x49fd98
push esi
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x49fec8
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x49fec1
push 0x59
call fcn.0049a3d0
pop ecx
jmp 0x49fed4
call fcn.0049a43c
jmp 0x49fed4
mov dword [ebx + 8], eax
test edi, edi
je 0x49fed4
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x401130
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x56a638
push 0x503c60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x572980]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x20], edi
or ebx, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], edi
push edi
push 0x80
push 3
push edi
push 3
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x938], eax
cmp eax, ebx
jne 0x401199
mov dword [ebp - 0x1c], ebx
jmp 0x4011e4
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x93c], eax
cmp eax, edi
je 0x401194
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x940], eax
cmp eax, edi
je 0x401194
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [esi + 0x938]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x944], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.00401207
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x401320
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, eax
xor ecx, ecx
push esi
mov esi, dword [ebx + 0x940]
mov eax, 0x5a4d
mov dword [ebx + 0x968], ecx
cmp word [esi], ax
je 0x401347
pop esi
mov dword [ebx + 0x968], ecx
xor eax, eax
pop ebx
ret
push edi
mov edi, dword [ebx + 0x944]
mov dword [ebx + 0x968], 1
cmp edi, dword [esi + 0x3c]
jb 0x40136c
mov edx, dword [esi + 0x3c]
cmp dword [edx + esi], 0x4550
lea eax, [edx + esi]
je 0x40137c
pop edi
pop esi
mov dword [ebx + 0x968], 3
xor eax, eax
pop ebx
ret
push ebp
mov dword [ebx + 0x960], eax
mov dword [ebx + 0x964], eax
movzx ebp, word [eax + 0x18]
mov ecx, 0x10b
cmp bp, cx
jne 0x4013a3
mov dword [ebx + 0x968], 5
jmp 0x4013bd
xor ecx, ecx
mov edx, 0x20b
cmp bp, dx
setne cl
lea ecx, [ecx*8 + 9]
mov dword [ebx + 0x968], ecx
mov edx, dword [eax + 0x28]
mov dword [ebx + 0x954], edx
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
lea edx, [edi + esi]
pop ebp
cmp ecx, edx
ja 0x401409
cmp ecx, esi
jb 0x401409
mov dword [ebx + 0x95c], ecx
movzx eax, word [eax + 6]
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*8]
cmp ecx, edx
ja 0x401409
call fcn.004012d0
mov edx, dword [ebx + 0x944]
cmp edx, dword [ebx + 0x948]
pop edi
sbb eax, eax
and eax, 0xfffffffe
pop esi
inc eax
pop ebx
ret
or dword [ebx + 0x968], 0x20
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
Function at 0x402120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402139
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402174
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402170
lea ebx, [ebx]
cmp esi, eax
jae 0x402174
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402160
cmp esi, eax
jb 0x40217a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00407810

Function at 0x405234
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x40527c
call fcn.00409960
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40527c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4052bf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4052a8
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4052a8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4052bc
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x407779
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00409960
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4077b2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004073c5
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x41134e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x411395
call fcn.00409960
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x411395
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4113b1
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00410ec6
mov esi, eax
test edi, edi
je 0x4113af
test ebx, ebx
je 0x4113af
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x411b7b
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x526d88
call fcn.005017b0
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x411ba0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x411be6
lea ecx, [ebp - 0x10]
call fcn.004037bb
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405f52
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402410
mov eax, esi
call fcn.00501888
ret 8
Function at 0x4167ea
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x572980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
mov ebx, 0x8000
cmp eax, 9
ja 0x416823
push 0x12
call esi
mov ecx, ebx
test cx, ax
je 0x41684a
cmp dword [0x576138], 0
jne 0x41684a
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x41683d
push 0x12
call esi
test bx, ax
je 0x416841
mov eax, edi
jmp 0x4168b9
push edi
call fcn.00504a8b
pop ecx
jmp 0x4168b9
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00502090
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x416873
call fcn.004067a2
call fcn.00407fa0
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00500dd2
leave
ret 4