joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430ac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ce574]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00440706
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x430b24
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x430b24
lea edx, [ebp - 0x108]
push edx
call dword [0x4ce00c]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043badd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0043badd
mov esp, ebp
pop ebp
ret

Function at 0x430b40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00430ac0

Function at 0x435600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x4c489c
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x43561f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadLibraryExW
push esi
call edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x4b0f4c
push eax
call fcn.00440b8b
add esp, 8
test eax, eax
je 0x435673
mov eax, dword [ebp - 4]
test eax, eax
je 0x435660
mov ecx, dword [ebp + 8]
push 8
push 0
push ecx
call eax
pop edi
pop esi
mov ebx, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
mov ebx, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], ebx
je 0x43569b
push str.AddDllDirectory
push esi
call edi
test eax, eax
je 0x43569b
mov eax, dword [ebp + 8]
push 0x800
push 0
push eax
call dword [ebp - 4]
pop edi
pop esi
mov ebx, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test edi, edi
je 0x435772
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4356b5
sub eax, edx
sar eax, 1
add eax, edi
lea ecx, [eax + eax + 2]
push ecx
call dword [section..data]
mov esi, eax
add esp, 4
test esi, esi
je 0x435768
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x435768
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4356f0
sub eax, edx
sar eax, 1
mov ecx, 0x4c3930
lea edx, [esi + eax*2]
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x435710
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435724
mov ecx, dword [ebp + 8]
sub eax, edx
sar eax, 1
lea edx, [esi + eax*2]
sub edx, ecx
jmp 0x435740
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x435740
mov eax, dword [ebp - 4]
test eax, eax
je 0x43575f
push 8
push 0
push esi
call eax
jmp 0x435766
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
push esi
call dword [0x4ce004]
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4357b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebx + 0x1ec]
push esi
push edi
mov esi, ecx
test ecx, ecx
jne 0x4357d1
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.00414da0
push edx
push eax
call fcn.00414dd0
mov ecx, eax
mov eax, esi
mov dword [ebp + 8], edx
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov esi, edx
sbb esi, dword [ebp + 8]
cmp dword [ebx + 0x1e0], 0
je 0x43583d
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x184]
mov eax, dword [eax + 0x180]
push edx
push eax
call fcn.00414da0
push edx
push eax
call fcn.00414dd0
mov ecx, eax
mov eax, dword [ebx + 0x1e0]
mov dword [ebp + 8], edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, dword [ebp + 8]
cmp esi, edx
jl 0x43583d
jg 0x435841
cmp edi, eax
jae 0x435841
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4368d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x436903
push 0x2e
push esi
call fcn.0043eb70
add esp, 8
test eax, eax
je 0x436901
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x436a70
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ce574]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov esi, 8
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x436b01
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0xc]
mov eax, ebx
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
call fcn.004369e0
mov ecx, esi
push 8
push ecx
call fcn.0043a800
mov ecx, dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x436b12
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043badd
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0043badd
mov esp, ebp
pop ebp
ret
Function at 0x436cb0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x436cc1
sub eax, edx
mov esi, eax
lea eax, [esi + esi]
push eax
mov dword [ebp - 0xc], eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x436cec
pop edi
pop esi
lea eax, [ebx + 0x1b]
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.00436c50
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x436d6b
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x8002
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x436d5f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
push 0
push eax
push ebx
push ecx
mov dword [ebp - 0x10], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov eax, dword [ebp - 4]
push 0
lea edx, [ebp - 0x10]
push edx
push esi
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [ebp - 8]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [esi + 0x10], eax
push ebx
mov byte [esi + 0x14], al
call dword [0x4ce004]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437050
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x437083
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret
Function at 0x43a850
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x43a87b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x43a8c2
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x43a8c5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x43a926
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x43a8f0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x43a95f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x4b176c
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x4b176d
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x43a930
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43badd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ce574]
jne 0x43bae7
repz ret
jmp fcn.004415b9
Function at 0x44f31c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ce574]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004445f0
and dword [ebp - 0x14], 0
cmp dword [0x4d1fb4], 0
mov dword [ebp - 0x18], eax
jne 0x44f3cf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44f477
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b3c6c
push ebx
call edi
test eax, eax
je 0x44f477
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4b3c5c
push ebx
mov dword [0x4d1fb4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4d1fb8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4d1fbc], eax
call edi
push eax
call esi
mov dword [0x4d1fc4], eax
test eax, eax
je 0x44f3cf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4d1fc0], eax
mov eax, dword [0x4d1fc0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x44f428
cmp dword [0x4d1fc4], ecx
je 0x44f428
push eax
call esi
push dword [0x4d1fc4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x44f428
test ebx, ebx
je 0x44f428
call edi
test eax, eax
je 0x44f41f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x44f41f
test byte [ebp - 8], 1
jne 0x44f428
or dword [ebp + 0x10], 0x200000
jmp 0x44f45b
mov eax, dword [0x4d1fb8]
cmp eax, dword [ebp - 0x18]
je 0x44f45b
push eax
call esi
test eax, eax
je 0x44f45b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44f45b
mov eax, dword [0x4d1fbc]
cmp eax, dword [ebp - 0x18]
je 0x44f45b
push eax
call esi
test eax, eax
je 0x44f45b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4d1fb4]
call esi
test eax, eax
je 0x44f477
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44f479
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043badd
leave
ret
Function at 0x454e4a
Capabilities:
Terminate process

Disassembly:
push 0x364
mov eax, 0x4a4c3f
call fcn.00441168
push 0xfffffffffffffff0
mov esi, ecx
call fcn.00491a5b
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
mov ecx, esi
call fcn.00491a5b
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi]
mov ecx, esi
lea edi, [esi + 0x30]
call dword [eax + 0x30]
push eax
push dword [esi + 4]
mov ecx, edi
call fcn.0045c53c
lea eax, [esi + 0x24]
push eax
mov ecx, edi
call fcn.004560c8
lea ecx, [ebp - 0x36c]
call fcn.0045d927
mov eax, dword [esi]
lea ecx, [ebp - 0x118]
push ecx
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
call dword [eax + 0x28]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.00453ce3
test al, al
mov eax, dword [esi]
jne 0x454f38
lea ecx, [ebp - 0x94]
push ecx
mov ecx, esi
call dword [eax + 0x2c]
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00453bcf
push eax
call fcn.004a1207
movzx eax, ax
pop ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x370], eax
mov byte [ebp - 4], 1
call fcn.00453bb5
push ebx
lea eax, [esi + 0x28]
push edi
push eax
lea ecx, [ebp - 0x118]
call fcn.00453bcf
push eax
push dword [ebp - 0x370]
lea ecx, [ebp - 0x36c]
call fcn.0045e8e8
mov dword [ebp - 0x370], eax
jmp 0x454f81
lea ecx, [ebp - 0x19c]
push ecx
mov ecx, esi
call dword [eax + 0x2c]
push ebx
push edi
lea edx, [esi + 0x28]
push edx
push ebx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00453bcf
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp - 0x36c]
mov dword [ebp - 0x370], esp
call fcn.0045e8e8
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x370], eax
mov byte [ebp - 4], 1
call fcn.00453bb5
cmp dword [ebp - 0x370], ebx
jne 0x454fee
push 0xffffffffffffffff
push 0x4b3d38
lea ecx, [ebp - 0x94]
call fcn.00453fd3
mov eax, dword [esi]
lea ecx, [ebp - 0x220]
push ecx
mov ecx, esi
mov byte [ebp - 4], 4
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.00453d5f
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 4
call fcn.00453bb5
push 0x10
push str.Duilib
lea ecx, [ebp - 0x94]
call fcn.00453bcf
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp - 0x370]
mov ecx, edi
call fcn.0045c17a
lea eax, [esi + 0x20]
push eax
mov ecx, edi
call fcn.00456078
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], bl
call fcn.00453bb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x36c]
call fcn.0045ce8d
xor eax, eax
call fcn.004411b2
ret 0x10

Function at 0x455645
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jns 0x45565b
push 8
pop edi
push 1
call esi
test ax, ax
jns 0x455667
or edi, 1
push 2
call esi
test ax, ax
jns 0x455673
or edi, 2
push 0x10
call esi
test ax, ax
jns 0x45567f
or edi, 4
push 0x12
call esi
test ax, ax
jns 0x45568b
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret
Function at 0x4594e6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0xac]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x459512
cmp ebx, dword [esi + 0x10c]
je 0x459512
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x10c]
cmp ebx, eax
je 0x4595e9
push edi
test eax, eax
je 0x459571
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x17
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x10c]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x134]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x10c]
mov ecx, esi
call fcn.00459446
mov dword [esi + 0x10c], edi
test ebx, ebx
je 0x4595e8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x4595e8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xf4]
test al, al
je 0x4595e8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + pe_nt_image_headers32]
test al, al
je 0x4595e8
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x10c], ebx
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x10c]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x134]
xor eax, eax
push eax
push eax
push eax
push 0x4b4020
push dword [esi + 0x10c]
mov ecx, esi
call fcn.00459446
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x459793
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x49c]
xor ebx, ebx
call fcn.00491a5b
test eax, eax
jle 0x4597e8
push ebx
lea ecx, [esi + 0x49c]
mov byte [ebp - 1], 0
call fcn.00453b7e
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x45984c
lea ecx, [esi + 0x49c]
inc ebx
call fcn.00491a5b
cmp ebx, eax
jl 0x4597af
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x4598b1
sub eax, 4
je 0x459850
dec eax
dec eax
jne 0x4598a8
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.0043cd03
pop ecx
mov ecx, dword [esi + 0x108]
push reloc.WS2_32.dll_select
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x4570bb
call dword [eax + 0x128]
mov esi, eax
test esi, esi
je 0x4598a8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x11c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x4598aa
cmp dword [esi + 0x10c], 0
je 0x4598a8
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x120]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x124]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.00455645
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x10c]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x134]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4598a8
cmp dword [esi + 0x10c], 0
je 0x459960
mov ecx, dword [esi + 0x10c]
mov eax, dword [ecx]
call dword [eax + 0xf4]
test al, al
je 0x459913
mov ecx, dword [esi + 0x10c]
mov eax, dword [ecx]
call dword [eax + pe_nt_image_headers32]
test al, al
je 0x459913
mov ecx, dword [esi + 0x10c]
mov eax, dword [ecx]
push 0x4b3ff0
call dword [eax + 0xc]
push eax
call fcn.0043d51f
pop ecx
pop ecx
test eax, eax
je 0x459913
mov ecx, dword [esi + 0x10c]
call fcn.00479dd6
test al, al
jne 0x4598a8
cmp dword [esi + 0x10c], 0
je 0x459960
mov ecx, dword [esi + 0x10c]
mov eax, dword [ecx]
call dword [eax + 0xf4]
test al, al
je 0x459960
mov ecx, dword [esi + 0x10c]
mov eax, dword [ecx]
call dword [eax + pe_nt_image_headers32]
test al, al
je 0x459960
mov ecx, dword [esi + 0x10c]
mov eax, dword [ecx]
push str.WkeWebkitUI
call dword [eax + 0xc]
push eax
call fcn.0043d51f
pop ecx
pop ecx
test eax, eax
jne 0x4598a8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns al
movzx eax, al
push eax
mov ecx, esi
call fcn.004596b3
jmp 0x45984c
Function at 0x4639eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x463a10
cmp eax, esi
jge 0x463a08
mov eax, edi
call fcn.0046346e
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
mov esi, dword [edi + 8]
xor ecx, ecx
test esi, esi
jle 0x463a3d
mov eax, dword [edi + 0xc]
push ebx
mov dl, byte [edi + 0xc]
sub esi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, esi
inc ecx
mov dword [edi + 0xc], eax
test ebx, ebx
jg 0x463a1d
mov dword [edi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x463a59
mov esi, dword [edi + 4]
mov eax, dword [edi]
cmp eax, esi
jb 0x463a4a
xor dl, dl
jmp 0x463a4f
mov dl, byte [eax]
inc eax
mov dword [edi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x463a40
movzx esi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl esi, 8
add esi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, esi
xor ecx, 0xffff
cmp eax, ecx
je 0x463a8b
mov eax, str.zlib_corrupt
call fcn.0045f1d6
jmp 0x463ac7
mov eax, dword [edi]
add eax, esi
cmp eax, dword [edi + 4]
jbe 0x463a9b
mov eax, str.read_past_buffer
jmp 0x463a84
mov eax, dword [edi + 0x10]
lea ecx, [eax + esi]
cmp ecx, dword [edi + 0x18]
jbe 0x463ab1
push esi
call fcn.0046354b
pop ecx
test eax, eax
je 0x463ac7
push esi
push dword [edi]
push dword [edi + 0x10]
call fcn.0043e7f0
add dword [edi], esi
add dword [edi + 0x10], esi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret