joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a230
Capabilities:
Get file attributes

Disassembly:
call fcn.004049b0
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40a244
dec eax
and al, 0x10
sete al
ret

Function at 0x40a2a0
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00403540
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00404fd4
ret

Function at 0x40a300
Capabilities:
Read .ini file

Disassembly:
or eax, 0
je 0x40a2f2
lea eax, [esi + 4]
call fcn.00404e7c
mov dword [esi], eax
lea edx, [esi + 4]
inc eax
add esi, eax
mov eax, edi
call fcn.004090ec
cmp byte [esi + 4], 0
jne 0x40a2d5
pop eax
call fcn.004027f0
pop ecx
pop ebx
pop edi
pop esi
ret
push esi
push edi
push ebx
push ecx
mov ebx, eax
mov eax, 0x8003
mov edi, edx
call fcn.004027c0
mov esi, eax
push eax
or byte [ebx + 0x18], 0
jne 0x40a335
push dword [ebx + 0x19]
mov eax, 0x7fff
push eax
lea eax, [esi + 4]
push eax
push dword [ebx + 0x1d]
call sub.kernel32.dll_GetPrivateProfileSectionA
jmp 0x40a2d0
push ebx
push esi
push edx
push ebp
mov edx, 0
mov ebp, dword [edi + 0x1c]
mov ebx, 0x7ffd
or ebp, ebp
je 0x40a376
or ebx, ebx
je 0x40a376
push edx
mov eax, edi
call fcn.0040613c
push eax
call fcn.00404e7c
pop eax
xor ecx, 0xffffffff
mov edx, esi
sub ebx, ecx
ja 0x40a36a
add ecx, ebx
xor ebx, ebx
add esi, ecx
call fcn.004028d4
pop edx
inc edx
dec ebp
jmp 0x40a348
mov word [esi], 0
pop ebp
pop edx
pop esi
pop ebx
mov eax, ebx
call fcn.00405430
push dword [ebx + 0x19]
push esi
push dword [ebx + 0x1d]
call sub.kernel32.dll_WritePrivateProfileSectionA
pop eax
call fcn.004027f0
pop ecx
pop ebx
pop edi
pop esi
ret

Function at 0x40a710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov eax, 0xb945c6c8
cmpsd dword [esi], dword es:[edi]
call fcn.0040a478
inc ecx
sub dword [ebp - 0x64], esi
lea eax, [ebp - 0x58]
push eax
call fcn.0040a488
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040a43d
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40a766
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [di - 0x38], 0x66
Function at 0x40b370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040a456
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040a488
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040a43d
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040a478
test dword [esi + 0x46856d8], ebp
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x40e310
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4179c4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x40e332
shr eax, 1
xor eax, 0xedb88320
jmp 0x40e334
shr eax, 1
dec edx
jne 0x40e320
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40e319
mov byte [0x417dc4], 1
pop esi
pop ebx
ret

Function at 0x40e350
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x417dc4], 0
jne 0x40e367
call fcn.0040e310
mov eax, edi
dec eax
test eax, eax
jl 0x40e390
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4179c4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x40e371
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4124dc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403778
xor eax, eax
push ebp
push 0x41254d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407aec
mov edx, dword [ebp - 8]
mov eax, 0x417fe8
call fcn.00403464
xor eax, eax
mov dword [0x417fe4], eax
push 0
push 0x4123f0
call sub.user32.dll_EnumWindows
mov ebx, dword [0x417fe4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412554
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403434
ret

Function at 0x41255c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push ecx
xor ebx, ebx
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push esp
push esi
call sub.kernel32.dll_GetExitCodeProcess
test esi, esi
je 0x41258b
mov eax, dword [esp]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x412fac
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x413040
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov bl, 1
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00404fe8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00407aec
mov esi, 8
mov edi, 0x417fec
mov eax, dword [ebp - 0xc]
mov edx, dword [edi]
call fcn.004036d4
jne 0x413004
xor ebx, ebx
jmp 0x41300a
add edi, 4
dec esi
jne 0x412ff4
test bl, bl
je 0x413025
mov eax, dword [ebp - 4]
call fcn.00403788
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413047
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403434
ret

Function at 0x413054
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403778
xor eax, eax
push ebp
push 0x413138
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x41311d
test bl, bl
je 0x4130b4
mov ebx, 8
mov eax, dword [ebp - 4]
call fcn.00403788
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
test al, 1
je 0x4130ac
push 0x80
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
jmp 0x4130c1
mov ebx, 0xa
mov eax, dword [ebp - 4]
call fcn.00412fac
mov eax, dword [0x417fcc]
push dword [eax + ebx*4]
push 0x413150
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403648
mov edx, dword [ebp - 8]
mov eax, dword [0x417fc8]
call fcn.00412e38
mov ebx, 0xa
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00404ffc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00404fe8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004034a8
mov eax, dword [ebp - 4]
call fcn.00412fac
test al, al
jne 0x4130c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41313f
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403434
ret
Function at 0x42d2c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x2d], 0
je 0x42d335
mov ecx, dword [esi + 0x3c]
mov eax, ecx
test ecx, ecx
je 0x42d2ef
cmp dword [esi + 0x40], edi
jae 0x42d2ef
push ecx
call fcn.0044d22f
and dword [esi + 0x3c], 0
pop ecx
jmp 0x42d2f3
test eax, eax
jne 0x42d303
lea eax, [edi + edi]
push eax
call fcn.0044d7e1
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push eax
call fcn.00451310
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x42d332
lea ecx, [esi + 0x30]
mov eax, dword [esi + 0x3c]
mov dl, byte [ebx + eax]
call fcn.0042ce5f
mov cl, al
mov eax, dword [esi + 0x3c]
mov byte [ebx + eax], cl
inc ebx
lea ecx, [esi + 0x30]
cmp ebx, edi
jb 0x42d317
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42d364
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x42d350
mov dword [esi + 0x14], 0x30000
jmp 0x42d386
push edi
add ecx, edx
push ebx
push ecx
call fcn.00451310
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
jmp 0x42d388
mov eax, dword [esi + 4]
test eax, eax
je 0x42d37f
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.kerNeL32.dLL_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x42d388
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42d7a9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x42d7ff
mov eax, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp eax, esi
jae 0x42d83a
sub esi, eax
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
add eax, ecx
push esi
push eax
push dword [ebp + 8]
call fcn.00451310
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
call fcn.0042cd32
add esp, 0x10
mov dword [edi + 0x78], eax
mov eax, esi
jmp 0x42d83c
cmp dword [edi + 0x7c], 0
je 0x42d833
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x7c]
call dword [sym.imp.kerNeL32.dLL_ReadFile]
test eax, eax
je 0x42d83a
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
call fcn.0042cd32
pop ecx
jmp 0x42d7f8
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x43e669
Capabilities:
Encode data using xor

Disassembly:
push 0x58
mov eax, 0x46ce46
call fcn.0046bbe6
mov eax, edx
mov dword [ebp - 0x5c], eax
mov esi, ecx
mov dword [ebp - 0x54], esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x64], esi
cmp edi, 0xffffffff
je 0x43e7fa
cmp byte [0x486f8c], bl
jne 0x43e7fa
mov al, 0x4c
mov dword [ebp - 0x20], 0x3c353e0f
movsx ecx, al
mov byte [ebp - 0x48], al
mov dword [ebp - 0x1c], 0x627e7f38
mov dword [ebp - 0x18], 0x202028
call fcn.0043cfd7
mov dword [ebp - 0x54], eax
mov edx, ebx
push edx
lea ecx, [ebp - 0x54]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x44], eax
inc edx
pop ecx
cmp edx, 8
jl 0x43e6c3
push 0xb
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0043d333
movsx ecx, byte [ebp - 0x48]
mov dword [ebp - 0x24], eax
call fcn.0043cfd7
mov dword [ebp - 0x54], eax
mov edx, ebx
push edx
lea ecx, [ebp - 0x54]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x44], eax
inc edx
pop ecx
cmp edx, 8
jl 0x43e6f7
push dword [0x487200]
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x24]
call fcn.0043d3a9
test eax, eax
jne 0x43e725
mov eax, ebx
jmp 0x43e736
mov dl, byte [ebp - 0x48]
mov ecx, ebx
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jb 0x43e72a
mov byte [eax + 0xb], bl
push eax
call dword [sym.imp.kerNeL32.dLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43e7f4
movaps xmm0, xmmword [0x47f300]
mov al, 0x46
movsx ecx, al
mov byte [ebp - 0x50], al
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x2732
mov byte [ebp - 0x16], bl
call fcn.0043cfd7
mov dword [ebp - 0x54], eax
mov edx, ebx
push edx
lea ecx, [ebp - 0x54]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x4c], eax
inc edx
pop ecx
cmp edx, 8
jl 0x43e76d
push 0x12
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0043d333
movsx ecx, byte [ebp - 0x50]
mov dword [ebp - 0x2c], eax
call fcn.0043cfd7
mov dword [ebp - 0x54], eax
mov edx, ebx
push edx
lea ecx, [ebp - 0x54]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x4c], eax
inc edx
pop ecx
cmp edx, 8
jl 0x43e7a1
push dword [0x487200]
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x2c]
call fcn.0043d3a9
test eax, eax
jne 0x43e7cf
mov eax, ebx
jmp 0x43e7e0
mov dl, byte [ebp - 0x50]
mov ecx, ebx
xor byte [ecx + eax], dl
inc ecx
cmp ecx, 0x12
jb 0x43e7d4
mov byte [eax + 0x12], bl
push eax
push edi
call dword [sym.imp.kerNeL32.dLL_GetProcAddress]
mov dword [0x486f88], eax
mov byte [0x486f8c], 1
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x5c]
cmp byte [0x486f8c], 1
jne 0x43e853
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x486f88]
push ecx
mov dword [ebp - 0x60], edi
call eax
test eax, eax
je 0x43e83e
cmp edi, 0xffffffff
je 0x43e83e
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
mov byte [ecx + edx], bl
mov ecx, esi
push dword [ebp - 0x54]
call fcn.0044b51b
jmp 0x43e86d
or dword [ebp - 4], 0xffffffff
jmp 0x43e853
mov dword [esi], ebx
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
push 0x47a7c4
mov byte [esi], bl
call fcn.0044b945
mov eax, esi
call fcn.0046bb38
ret
Function at 0x43f3d3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push ebx
cmovae eax, dword [ebp + 8]
push esi
push 0x47ed9c
push eax
call fcn.00455f72
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x43f41a
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp + 0x20]
push esi
cmovae ecx, dword [ebp + 0x20]
xor ebx, ebx
inc ebx
push ebx
push dword [ebp + 0x30]
push ecx
call fcn.004562a3
push esi
call fcn.00456000
add esp, 0x14
jmp 0x43f41c
xor bl, bl
lea ecx, [ebp + 8]
call fcn.0044b89e
lea ecx, [ebp + 0x20]
call fcn.0044b89e
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x43f432
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x4c
mov eax, 0x46cf32
call fcn.0046bbe6
mov esi, ecx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], bl
push ebx
push 0x80
push 3
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
push ebx
cmovae eax, dword [ebp + 8]
push 7
push 1
push eax
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.kerNeL32.dLL_CreateFileA]
mov dword [ebp - 0x50], eax
cmp eax, 0xffffffff
je 0x43f500
push ebx
push eax
call dword [sym.imp.kerNeL32.dLL_GetFileSize]
mov dword [ebp - 0x58], eax
test eax, eax
je 0x43f4f7
inc eax
push eax
call fcn.00455bac
mov edi, eax
pop ecx
test edi, edi
je 0x43f4f7
push ebx
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x58]
push edi
push dword [ebp - 0x50]
call dword [sym.imp.kerNeL32.dLL_ReadFile]
push dword [ebp - 0x4c]
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], bl
call fcn.0044b966
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x48]
call fcn.0044b499
push edi
call fcn.00455244
pop ecx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0044b89e
push dword [ebp - 0x50]
call dword [sym.imp.kerNeL32.dLL_CloseHandle]
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
call fcn.0044b4e8
lea ecx, [ebp - 0x48]
call fcn.0044b89e
lea ecx, [ebp + 8]
call fcn.0044b89e
mov eax, esi
jmp 0x43f549
call fcn.0046bb38
ret
Function at 0x440105
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x48500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x134], ecx
push esi
push 2
call dword [sym.imp.kerNeL32.dLL_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44013a
xor eax, eax
jmp 0x4401c3
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push edi
call dword [sym.imp.kerNeL32.dLL_Process32First]
jmp 0x4401ab
lea eax, [ebp - 0x10c]
push str.lsass.exe
push eax
call fcn.0045633f
pop ecx
pop ecx
test eax, eax
jne 0x44019d
push dword [ebp - 0x128]
push esi
push 0x1000
call dword [sym.imp.kerNeL32.dLL_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x44019d
push dword [ebp - 0x134]
push 0xb
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push ebx
test eax, eax
jne 0x4401b1
call dword [sym.imp.kerNeL32.dLL_CloseHandle]
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.kerNeL32.dLL_Process32Next]
test eax, eax
jne 0x440154
jmp 0x4401ba
call dword [sym.imp.kerNeL32.dLL_CloseHandle]
xor esi, esi
inc esi
push edi
call dword [sym.imp.kerNeL32.dLL_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d024
leave
ret
Function at 0x448819
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ecx
push esi
push edi
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x448881
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x448881
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x44887b
push esi
call dword [sym.imp.kerNeL32.dLL_GlobalLock]
mov edx, eax
test edx, edx
je 0x448874
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448854
sub ecx, edi
push 3
push ecx
mov ecx, dword [0x486fbc]
push edx
mov edx, str.ClipText.txt
call fcn.0042e156
add esp, 0xc
push esi
call dword [sym.imp.kerNeL32.dLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ecx
ret
Function at 0x44af64
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Get common file path
Get startup folder
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
mov eax, dword [0x48500c]
xor eax, esp
mov dword [esp + 0x320], eax
push ebx
push esi
push edi
push str.20dksm01pejgq0fneok1nsmqka2jcy30
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.kerNeL32.dLL_CreateMutexA]
mov edi, eax
test edi, edi
je 0x44b0b9
push ebx
push edi
call dword [sym.imp.kerNeL32.dLL_WaitForSingleObject]
test eax, eax
jne 0x44b0b9
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x44afaa
call fcn.0042a0eb
push eax
call fcn.00455ea9
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [esp + 0x14]
pop ecx
push eax
push ebx
push ebx
push 0x1c
push ebx
call esi
lea eax, [esp + 0x10]
mov ebx, 0x485b58
push eax
mov ecx, ebx
call fcn.0044b490
lea eax, [esp + 0x118]
push eax
push 0x104
call dword [sym.imp.kerNeL32.dLL_GetTempPathA]
lea eax, [esp + 0x118]
mov ecx, 0x485b70
push eax
call fcn.0044b490
lea eax, [esp + 0x220]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call esi
lea eax, [esp + 0x220]
mov esi, 0x485af8
push eax
mov ecx, esi
call fcn.0044b490
push ecx
call fcn.0042e14c
pop ecx
mov dword [0x486fbc], eax
call fcn.00448527
call fcn.00444949
call fcn.0044705c
call fcn.0044612a
sub esp, 0x18
mov ecx, esp
push esi
call fcn.0044b564
sub esp, 0x18
mov ecx, esp
push esi
call fcn.0044b564
call fcn.0044252b
add esp, 0x18
mov ecx, esp
push ebx
call fcn.0044b564
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.0044b564
call fcn.0044252b
add esp, 0x30
call fcn.00445d5f
call fcn.00446de7
call fcn.00448819
call fcn.00443c43
call fcn.0044770b
call fcn.0044abab
call fcn.00448965
call fcn.0042e18b
push edi
call dword [sym.imp.kerNeL32.dLL_ReleaseMutex]
xor ebx, ebx
push ebx
call fcn.00455e72
int3

Function at 0x463c2b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00463aa1
Function at 0x405d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x405e08
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x405df7
jg 0x405d60
test edx, edx
je 0x405df7
nop dword [eax]
call fcn.004082e0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x405db4
jg 0x405d77
test esi, esi
je 0x405db4
cmp ebx, eax
jg 0x405d87
jl 0x405d81
cmp edi, esi
jae 0x405d87
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0041b7e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x405ddb
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x405df1
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x405d60
jl 0x405df1
test edi, edi
jne 0x405d60
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x405e2a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x405e2c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x405eaa
jg 0x405e3f
test esi, esi
je 0x405eaa
test eax, eax
jl 0x405e8e
jg 0x405e49
test ebx, ebx
je 0x405e8e
cmp edi, eax
jg 0x405e59
jl 0x405e53
cmp esi, ebx
jae 0x405e59
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.0041b7e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x405eaa
jg 0x405e91
test esi, esi
je 0x405eaa
jmp 0x405e91
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x405eaa
push eax
push esi
push 1
push edx
call fcn.0041f10e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc