joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f010
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4791c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x497650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.0045cf44
add esp, 4
cmp eax, ebx
je 0x40f10a
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
lea edi, [esi + 0x18]
push 8
mov dword [edi], ebx
call fcn.0045cf44
add esp, 4
cmp eax, ebx
je 0x40f0e6
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [esi + 0x40], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov byte [esi + 0x30], bl
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov dword [esi + 0x7c], 1
mov byte [esi + 0x80], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call fcn.0045d05d
push 0x491888
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.0045edba
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
call fcn.0045d05d
push 0x491888
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x2c], vtable.std::bad_alloc.0
call fcn.0045edba
int3

Function at 0x4187e1
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jns 0x4187f7
push 8
pop edi
push 2
call esi
test ax, ax
jns 0x418803
or edi, 1
push 1
call esi
test ax, ax
jns 0x41880f
or edi, 2
push 0x10
call esi
test ax, ax
jns 0x41881b
or edi, 4
push 0x12
call esi
test ax, ax
jns 0x418827
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret
Function at 0x41b85f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x6c]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x41b888
cmp ebx, dword [esi + 0x164]
je 0x41b888
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x164]
cmp ebx, eax
je 0x41b95f
push edi
test eax, eax
je 0x41b8e7
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x17
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x164]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x124]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x164]
mov ecx, esi
call fcn.0041afcb
mov dword [esi + 0x164], edi
test ebx, ebx
je 0x41b95e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x41b95e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xe4]
test al, al
je 0x41b95e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xf0]
test al, al
je 0x41b95e
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x164], ebx
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x164]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x124]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x164]
mov ecx, esi
call fcn.0041afcb
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41bb10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x2d8]
xor ebx, ebx
call fcn.00452a93
test eax, eax
jle 0x41bb65
push ebx
lea ecx, [esi + 0x2d8]
mov byte [ebp - 1], 0
call fcn.0041f710
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x41bbc6
lea ecx, [esi + 0x2d8]
inc ebx
call fcn.00452a93
cmp ebx, eax
jl 0x41bb2c
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x41bc29
sub eax, 4
je 0x41bbca
dec eax
dec eax
jne 0x41bc20
push dword [ebp + 0xc]
mov byte [ebp + 8], al
lea edi, [ebp + 9]
stosb byte es:[edi], al
call fcn.0045ddd2
pop ecx
mov ecx, dword [esi + 0x160]
push 0x80000012
lea edx, [ebp + 8]
push edx
mov byte [ebp + 8], al
mov eax, dword [ecx]
push 0x41a03e
call dword [eax + 0x118]
mov esi, eax
test esi, esi
je 0x41bc20
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x41bc22
cmp dword [esi + 0x164], 0
je 0x41bc20
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x10], al
mov eax, dword [esi + 0x174]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x178]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.004187e1
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x164]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x124]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x41bc20
cmp dword [esi + 0x164], 0
je 0x41bc87
mov ecx, dword [esi + 0x164]
mov eax, dword [ecx]
call dword [eax + 0xe4]
test al, al
je 0x41bc87
mov ecx, dword [esi + 0x164]
mov eax, dword [ecx]
call dword [eax + 0xf0]
test al, al
je 0x41bc87
mov ecx, dword [esi + 0x164]
mov eax, dword [ecx]
call dword [eax + 0xc]
push str.RichEditUI
push eax
call fcn.0045e9fb
pop ecx
pop ecx
test eax, eax
je 0x41bc87
mov ecx, dword [esi + 0x164]
call fcn.0043c259
test al, al
jne 0x41bc20
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns al
movzx eax, al
push eax
mov ecx, esi
call fcn.0041ba26
jmp 0x41bbc6
Function at 0x424986
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x424994
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x424a4f
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47cae0]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47cae0]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47cae0]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47cae0]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47cae0]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47cae0]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47cae0]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47cae0]
add edx, 8
sub edi, 8
dec esi
jne 0x4249b2
pop ebx
test edi, edi
je 0x424a68
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x47cae0]
inc edx
dec edi
jne 0x424a53
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x424ebf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x424ef3
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x424eee
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x424f1b
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x424f04
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0045ee20
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x425d38
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x497650]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x425dcc
mov al, byte [esi]
test al, al
je 0x425dcc
push edi
mov edi, esi
mov ecx, esi
cmp al, 0x2f
je 0x425d6a
cmp al, 0x5c
jne 0x425d6c
mov edi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x425d62
cmp edi, esi
je 0x425d9f
sub edi, esi
push edi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00462409
lea eax, [ebp - 0x108]
push eax
push ebx
mov byte [ebp + edi - 0x108], 0
call fcn.00425d38
add esp, 0x14
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00462a20
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00462a30
add esp, 0x10
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cc1a
leave
ret
Function at 0x42724f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4272ca
cmp dword [esi + 4], 0xffffffff
jne 0x4272ca
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x48a84c
push edi
call fcn.00462a30
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x42729c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x42729c
mov eax, 0x2000000
jmp 0x4272cf
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00424ccc
add esp, 0x10
test eax, eax
jne 0x4272ba
mov eax, dword [ebp + 0x10]
jmp 0x4272cf
push eax
call fcn.00426e3e
mov dword [esi], eax
mov eax, dword [0x4993e8]
pop ecx
jmp 0x4272cf
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x42e56f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x42e594
cmp eax, esi
jge 0x42e58c
mov eax, edi
call fcn.0042dff2
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
mov esi, dword [edi + 8]
xor ecx, ecx
test esi, esi
jle 0x42e5c1
mov eax, dword [edi + 0xc]
push ebx
mov dl, byte [edi + 0xc]
sub esi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, esi
inc ecx
mov dword [edi + 0xc], eax
test ebx, ebx
jg 0x42e5a1
mov dword [edi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x42e5dd
mov esi, dword [edi + 4]
mov eax, dword [edi]
cmp eax, esi
jb 0x42e5ce
xor dl, dl
jmp 0x42e5d3
mov dl, byte [eax]
inc eax
mov dword [edi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x42e5c4
movzx esi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl esi, 8
add esi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, esi
xor ecx, 0xffff
cmp eax, ecx
je 0x42e60f
mov eax, str.zlib_corrupt
call fcn.00429d5a
jmp 0x42e64b
mov eax, dword [edi]
add eax, esi
cmp eax, dword [edi + 4]
jbe 0x42e61f
mov eax, str.read_past_buffer
jmp 0x42e608
mov eax, dword [edi + 0x10]
lea ecx, [eax + esi]
cmp ecx, dword [edi + 0x18]
jbe 0x42e635
push esi
call fcn.0042e0cf
pop ecx
test eax, eax
je 0x42e64b
push esi
push dword [edi]
push dword [edi + 0x10]
call fcn.0045ee20
add dword [edi], esi
add dword [edi + 0x10], esi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x43c4d1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3bc], ebx
je 0x43c538
cmp dword [ebp + 8], 0x100
jne 0x43c527
cmp byte [ebp + 0xc], 0xd
jne 0x43c527
cmp byte [esi + 0x3c2], bl
je 0x43c50e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x43c527
cmp byte [esi + 0x3c3], bl
jne 0x43c527
mov ecx, dword [esi + 0x44]
cmp ecx, ebx
je 0x43c523
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.0041afcb
xor eax, eax
jmp 0x43c53b
mov eax, dword [esi + 0x3bc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x43f3a3
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x180
mov eax, 0x476742
call fcn.0045f5ce
mov edi, dword [ebp + 8]
mov ebx, ecx
call fcn.0043e9d8
call fcn.004189c5
push eax
lea ecx, [ebp - 0x54]
call fcn.0041fdf4
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004189cb
mov ecx, eax
call fcn.0041f7dc
test al, al
je 0x43f4df
push edi
lea ecx, [ebp - 0x54]
call fcn.0041f831
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea ecx, [ebp - 0x54]
call fcn.0041f802
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18c], eax
push esi
cmp eax, 0xffffffff
jne 0x43f43b
push str.Error_opening_file
mov ecx, ebx
call fcn.0043eb97
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0041f741
mov al, bl
call fcn.0045f618
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
jne 0x43f450
push esi
push str.File_is_empty
jmp 0x43f41c
cmp edi, 0x400000
jbe 0x43f460
push esi
push str.File_too_large
jmp 0x43f41c
push edi
mov dword [ebp - 0x188], esi
call fcn.00417314
pop ecx
push esi
lea ecx, [ebp - 0x188]
push ecx
push edi
push eax
push dword [ebp - 0x18c]
mov dword [ebp - 0x184], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x18c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x188], edi
je 0x43f4bb
push dword [ebp - 0x184]
call fcn.0045cf39
pop ecx
mov ecx, ebx
call fcn.0043e9d8
push esi
push str.Could_not_read_file
jmp 0x43f41c
push dword [ebp + 0xc]
mov ecx, ebx
push edi
push dword [ebp - 0x184]
call fcn.0043f1f1
push dword [ebp - 0x184]
mov bl, al
call fcn.0045cf39
pop ecx
jmp 0x43f425
call fcn.004189cb
push eax
lea ecx, [ebp - 0x54]
call fcn.0041f814
call fcn.004189d1
test al, al
je 0x43f4fd
call fcn.004189d7
jmp 0x43f511
push 2
push esi
lea ecx, [ebp - 0x54]
call fcn.0041f802
push eax
call fcn.004275f2
add esp, 0xc
mov dword [ebp - 0x184], eax
cmp eax, esi
jne 0x43f526
push esi
push str.Error_opening_zip_file
jmp 0x43f41c
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x18c]
push eax
push 1
push edi
push dword [ebp - 0x184]
call fcn.00425dda
add esp, 0x14
test eax, eax
je 0x43f554
push esi
push str.Could_not_find_ziped_file
jmp 0x43f41c
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x188], eax
cmp eax, esi
je 0x43f448
cmp eax, 0x400000
ja 0x43f458
push eax
call fcn.00417314
push 3
push dword [ebp - 0x188]
mov edi, eax
push edi
push dword [ebp - 0x18c]
push dword [ebp - 0x184]
call fcn.00427650
add esp, 0x18
cmp eax, esi
je 0x43f5c7
cmp eax, 0x600
je 0x43f5c7
push edi
call fcn.0045cf39
pop ecx
call fcn.004189d1
test al, al
jne 0x43f5bc
push dword [ebp - 0x184]
call fcn.00427688
pop ecx
push esi
push str.Could_not_unzip_file
jmp 0x43f41c
call fcn.004189d1
test al, al
jne 0x43f5dc
push dword [ebp - 0x184]
call fcn.00427688
pop ecx
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp - 0x188]
push edi
call fcn.0043f1f1
push edi
jmp 0x43f4d2

Function at 0x447a0b
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x3e0
jmp fcn.0044fb4d

Function at 0x44d8f2
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x3e0
jmp method.DuiLib::CMenuUI.2.virtual_296
Function at 0x44e168
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x497650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
and dword [ebx + 0x458], 0
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x1c]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x28], ecx
mov ecx, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebx + 0x454], eax
mov dword [ebx + 0x45c], ecx
test eax, eax
jne 0x44e1d0
call fcn.0044e06a
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0xc]
test esi, esi
je 0x44e1d0
call fcn.0044e06a
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0x14]
lea esi, [ebx + 0x10]
call fcn.0044e06a
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx]
mov ecx, dword [ebx + 0x454]
test ecx, ecx
jne 0x44e1ed
mov ecx, edi
jmp 0x44e1f4
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00418b6c
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.0041f451
push 0
sub esp, 0x10
mov edi, esp
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x88
push SysReAllocString
movsd dword es:[edi], dword [esi]
push 0
push dword [ebp - 0x18]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
call fcn.0041f3ee
mov edi, dword [ebx + 4]
mov esi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x44e237
push edi
call esi
mov edi, eax
push edi
call esi
test eax, eax
jne 0x44e232
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cc1a
leave
ret 0x1c

Function at 0x454eba
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x497650]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x454ee6
xor eax, eax
jmp 0x454f65
push 0xfe
lea eax, [ebp - 0x103]
push 0
push eax
mov byte [ebp - 0x104], 0
call fcn.0045ed40
add esp, 0xc
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x454ee2
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 0x298]
push eax
call fcn.0045ee20
movzx eax, byte [ebp - 0x298]
movzx ecx, byte [ebp - 0x297]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x296]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x295]
shl eax, 8
add esp, 0xc
add eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045cc1a
leave
ret
Function at 0x4560ba
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x18c
mov eax, 0x4774d1
call fcn.0045f5ce
mov dword [ebp - 0x198], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x194], esi
call fcn.004189c5
push eax
lea ecx, [ebp - 0x54]
call fcn.0041fdf4
xor edi, edi
mov dword [ebp - 4], edi
call fcn.004189cb
mov ecx, eax
call fcn.0041f7dc
test al, al
je 0x456197
push esi
lea ecx, [ebp - 0x54]
call fcn.0041f831
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x54]
call fcn.0041f802
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x184], eax
cmp eax, 0xffffffff
jne 0x456143
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0041f741
jmp 0x45627d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
je 0x456132
push esi
mov dword [ebp - 0x18c], edi
call fcn.00417314
pop ecx
push edi
mov ebx, eax
lea eax, [ebp - 0x18c]
push eax
push esi
push ebx
push dword [ebp - 0x184]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x184]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18c], esi
je 0x45626d
push ebx
call fcn.0045cf39
pop ecx
jmp 0x456132
call fcn.004189cb
push eax
lea ecx, [ebp - 0x54]
call fcn.0041f814
call fcn.004189d1
test al, al
je 0x4561b5
call fcn.004189d7
jmp 0x4561c9
push 2
push edi
lea ecx, [ebp - 0x54]
call fcn.0041f802
push eax
call fcn.004275f2
add esp, 0xc
mov dword [ebp - 0x184], eax
cmp eax, edi
je 0x456132
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x190]
push eax
push 1
push esi
push dword [ebp - 0x184]
call fcn.00425dda
add esp, 0x14
test eax, eax
jne 0x456132
mov esi, dword [ebp - 0x58]
cmp esi, edi
je 0x456132
push esi
call fcn.00417314
push 3
push esi
mov ebx, eax
push ebx
push dword [ebp - 0x190]
push dword [ebp - 0x184]
call fcn.00427650
add esp, 0x18
cmp eax, edi
je 0x456258
cmp eax, 0x600
je 0x456258
push ebx
call fcn.0045cf39
pop ecx
call fcn.004189d1
test al, al
jne 0x456132
push dword [ebp - 0x184]
call fcn.00427688
jmp 0x456194
call fcn.004189d1
test al, al
jne 0x45626d
push dword [ebp - 0x184]
call fcn.00427688
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0041f741
cmp ebx, edi
jne 0x4562fc
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x194]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x184], eax
cmp eax, 0xffffffff
je 0x4562f8
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
je 0x4562f8
push esi
mov dword [ebp - 0x188], edi
call fcn.00417314
pop ecx
push edi
mov ebx, eax
lea eax, [ebp - 0x188]
push eax
push esi
push ebx
push dword [ebp - 0x184]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x184]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x188], esi
je 0x4562f4
push ebx
call fcn.0045cf39
pop ecx
xor ebx, ebx
cmp ebx, edi
jne 0x4562fc
xor eax, eax
jmp 0x456314
mov ecx, dword [ebp - 0x198]
push esi
push ebx
call fcn.00455e80
push ebx
mov esi, eax
call fcn.0045cc0f
pop ecx
mov eax, esi
call fcn.0045f618
ret 4
Function at 0x456ae1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x497650]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x456b6c
cmp dword [esi + 0x10], ebx
je 0x456b6c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea edi, [eax + 1]
mov eax, edi
call fcn.00462b40
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x456b6c
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x144
call fcn.0041fa15
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0041afcb
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00418d32
test al, al
je 0x456b6c
mov ecx, dword [esi + 0x10]
call fcn.00427f93
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045cc1a
leave
ret 0x10