joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dd80
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push str.NewFilmEveryday
lea esi, [esp + 8]
mov dword [esp + 8], 0
call fcn.00415340
add esp, 4
test al, al
je 0x40de32
mov eax, dword [esp + 4]
push ebx
push edi
push 0x800
push 0xf060
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, 0x480be4
call fcn.0040bf30
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40de30
call fcn.0040c000
mov esi, eax
test esi, esi
je 0x40de30
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x2710
push esi
call edi
cmp eax, 0x102
jne 0x40de30
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
push 0x24
push 0x480b70
push str._Y_Y_vw_N_vz
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x40de2b
push ebx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x40de2b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40de30
push 0xffffffffffffffff
push esi
call edi
pop edi
pop ebx
pop esi
pop ecx
ret 4
Function at 0x410000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474cf8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48c0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4100e4
cmp dword [edi + 0x5c], 0x10
jb 0x410041
mov edi, dword [edi + 0x48]
jmp 0x410044
add edi, 0x48
test edi, edi
je 0x410083
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
inc ebx
cmp ebx, 0x3fffffff
jg 0x410083
lea eax, [ebx + ebx]
call fcn.0045dfe0
mov esi, esp
test esi, esi
je 0x410083
push ebx
push esi
push 0xffffffffffffffff
xor eax, eax
push edi
push eax
push 3
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x410085
xor eax, eax
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x270]
push ecx
mov ebx, eax
lea esi, [ebp - 0x2c]
call fcn.00409790
add esp, 4
xor esi, esi
push 0xffffffffffffffff
push esi
lea ecx, [edi + 0x414]
mov dword [ebp - 4], esi
call fcn.004090c0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x4100c8
mov edx, dword [ebp - 0x28]
push edx
call fcn.00457a6e
add esp, 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, dword [edx + 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], esi
call eax
jmp 0x4100e7
mov edi, dword [ebp + 8]
push 0
push 0
push edi
push 0x40e260
push 0
push 0
call fcn.00458f54
add esp, 0x18
mov dword [edi + 0x410], eax
xor eax, eax
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457a79
mov esp, ebp
pop ebp
ret 8

Function at 0x410130
Capabilities:
Create thread

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x2d4], 0
jbe 0x4101ff
movzx eax, word [esi + 0x26c]
test ax, ax
jne 0x410187
call fcn.0040ac50
cmp dword [esi + 0x3c4], 8
jb 0x410162
mov eax, dword [esi + 0x3b0]
jmp 0x410168
lea eax, [esi + 0x3b0]
mov ecx, dword [esi + 0x3e8]
push 0
push eax
call fcn.0043f5ae
mov ecx, dword [esi + 0x3d8]
push 1
call fcn.0043dcc5
xor eax, eax
pop esi
ret
cmp ax, 1
jne 0x4101f0
mov eax, dword [esi + 4]
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 4]
push 0x40000
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [esi + 0x3c4], 8
jb 0x4101bb
mov eax, dword [esi + 0x3b0]
jmp 0x4101c1
lea eax, [esi + 0x3b0]
mov ecx, dword [esi + 0x3e8]
push 0
push eax
call fcn.0043f5ae
mov ecx, dword [esi + 0x3d8]
push 1
call fcn.0043dcc5
push 1
push 1
mov ecx, esi
call fcn.0042d9c5
call fcn.0040ac50
xor eax, eax
pop esi
ret
cmp ax, 2
jne 0x41021c
call fcn.0040b420
xor eax, eax
pop esi
ret
push 0
push 0
push esi
push 0x40bef0
push 0
push 0
call fcn.00458f54
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
Function at 0x4131e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp dword [eax + 0x18], 0x10
push esi
jb 0x4131ec
mov ecx, dword [eax + 4]
jmp 0x4131ef
lea ecx, [eax + 4]
mov edx, dword [eax + 0x14]
add edx, ecx
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x413210
lea ecx, [ecx]
movsx esi, byte [ecx]
imul eax, eax, 0x1000193
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x413200
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.0045919a
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x41323a
add eax, 0x7fffffff
pop esi
ret

Function at 0x414d90
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [ecx + 0x14]
mov eax, 0xcccccccd
mul ebx
push ebp
push esi
mov esi, edx
shr esi, 3
push edi
inc esi
xor edi, edi
mov ebp, 0x811c9dc5
cmp esi, ebx
jae 0x414db5
sub ebx, esi
test ebx, ebx
jbe 0x414dee
lea esp, [esp]
cmp edi, dword [ecx + 0x14]
jbe 0x414dce
call fcn.0045808d
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x18], 8
jb 0x414dd9
mov eax, dword [ecx + 4]
jmp 0x414ddc
lea eax, [ecx + 4]
movzx eax, word [eax + edi*2]
imul ebp, ebp, 0x1000193
add edi, esi
xor ebp, eax
cmp edi, ebx
jb 0x414dc0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4

Function at 0x414e00
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [ecx + 0x14]
mov eax, 0xcccccccd
mul ebx
push ebp
push esi
mov esi, edx
shr esi, 3
push edi
inc esi
xor edi, edi
mov ebp, 0x811c9dc5
cmp esi, ebx
jae 0x414e25
sub ebx, esi
test ebx, ebx
jbe 0x414e5e
lea esp, [esp]
cmp edi, dword [ecx + 0x14]
jbe 0x414e3e
call fcn.0045808d
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x18], 0x10
jb 0x414e49
mov eax, dword [ecx + 4]
jmp 0x414e4c
lea eax, [ecx + 4]
movsx eax, byte [eax + edi]
imul ebp, ebp, 0x1000193
add edi, esi
xor ebp, eax
cmp edi, ebx
jb 0x414e30
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4

Function at 0x415740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x415757
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x415788
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x415784
cmp esi, eax
jae 0x415788
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x415774
cmp esi, eax
jb 0x41578e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x415900
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x47409d
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x19c], eax
push ebx
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
lea ecx, [esp + 0xd]
lea eax, [esi + 4]
push ecx
push eax
mov dword [esp + 0x18], esi
call fcn.00419e10
lea edx, [esp + 0xe]
lea eax, [esi + 0x4c]
push edx
xor ebx, ebx
push eax
mov dword [esp + 0x1b8], ebx
call fcn.00419ef0
mov dword [esi + 0xac], ebx
xor eax, eax
mov dword [esi + 0xc8], 7
mov dword [esi + 0xc4], ebx
mov word [esi + 0xb4], ax
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xec], 0xf
mov dword [esi + 0xe8], ebx
lea eax, [esp + 0x14]
mov byte [esi + 0xd8], bl
push eax
xor ecx, ecx
mov edx, 1
push 0x202
mov word [esi + 0xf0], cx
mov word [esi + 0xf2], dx
mov byte [esi + 0xf4], bl
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete al
mov byte [0x48ec38], al
cmp al, bl
je 0x4159e2
mov byte [esi + 0xf4], 1
lea ecx, [esi + 0x94]
push ecx
call fcn.00415860
mov eax, esi
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.00457a79
add esp, 0x1ac
ret
Function at 0x416170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472c88
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
lea ebp, [edi + 0x94]
push ebp
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [edi + 4]
push edx
call fcn.00411980
mov eax, dword [edi + 0xc]
mov esi, dword [edi + 0x20]
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x4161d3
cmp eax, ebx
je 0x4161d8
call fcn.0045808d
cmp esi, dword [esp + 0x1c]
je 0x416312
test ebx, ebx
jne 0x416298
call fcn.0045808d
xor eax, eax
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [eax + 0x14]
jne 0x4161ff
call fcn.0045808d
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x60]
cmp word [eax + 0xd0], 2
je 0x4162f3
test ebx, ebx
jne 0x41629f
call fcn.0045808d
xor eax, eax
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [eax + 0x14]
jne 0x416231
call fcn.0045808d
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x60]
cmp byte [eax + 0xbe2], 0
jne 0x4162f3
test ebx, ebx
jne 0x4162a3
call fcn.0045808d
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [ebx + 0x14]
jne 0x41625c
call fcn.0045808d
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x60]
cmp byte [eax + 0xbe3], 0
lea esi, [esp + 0x18]
jne 0x4162a7
call fcn.00410e20
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x34]
call fcn.00404250
xor eax, eax
jmp 0x416332
mov eax, dword [ebx]
jmp 0x4161f1
mov eax, dword [ebx]
jmp 0x416223
mov ebx, dword [ebx]
jmp 0x41624e
call fcn.00410e20
mov ecx, dword [eax + 0x58]
mov edx, 2
add edi, 0xac
push edi
mov word [ecx + 0xd0], dx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea esi, [esp + 0x18]
call fcn.00410e20
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x34]
call fcn.00404250
mov eax, esi
jmp 0x416332
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x4c], 0x10
jb 0x41630e
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00457a6e
add esp, 4
xor eax, eax
jmp 0x416332
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x4c], 0x10
jb 0x41632d
mov edx, dword [esp + 0x38]
push edx
call fcn.00457a6e
add esp, 4
mov eax, 0x20000002
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x1c
Function at 0x416700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x473228
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x94]
push eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x1c]
lea eax, [esi + 4]
push edx
push eax
mov dword [esp + 0x30], eax
call fcn.00411980
mov eax, dword [esi + 0xc]
mov ebp, dword [esi + 0x20]
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x41676b
cmp eax, ebx
je 0x416770
call fcn.0045808d
mov edi, dword [esp + 0x1c]
cmp ebp, edi
je 0x4168dc
xor ebp, ebp
cmp ebx, ebp
jne 0x416825
call fcn.0045808d
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x416797
call fcn.0045808d
cmp dword [edi + 0x60], ebp
je 0x4167ff
cmp ebx, ebp
jne 0x41682c
call fcn.0045808d
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x4167b5
call fcn.0045808d
mov eax, dword [edi + 0x60]
cmp word [eax + 0xd0], 1
jne 0x416833
cmp byte [esp + 0x54], 0
je 0x4167ff
lea esi, [esp + 0x18]
call fcn.00410e20
mov eax, dword [eax + 0x58]
cmp eax, ebp
je 0x4167e3
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
lea esi, [esp + 0x18]
call fcn.00410e20
push edi
push ebx
lea ecx, [esp + 0x20]
mov dword [eax + 0x58], ebp
mov eax, dword [esp + 0x2c]
push ecx
call fcn.00412750
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x50], 0x10
jb 0x41681e
mov eax, dword [esp + 0x3c]
push eax
call fcn.00457a6e
add esp, 4
xor eax, eax
jmp 0x416900
mov eax, dword [ebx]
jmp 0x41678d
mov eax, dword [ebx]
jmp 0x4167ab
cmp ebx, ebp
jne 0x4168cd
call fcn.0045808d
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x41684c
call fcn.0045808d
mov ecx, dword [edi + 0x60]
mov edx, 1
mov word [ecx + 0xd0], dx
cmp ebx, ebp
jne 0x4168d4
call fcn.0045808d
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x416870
call fcn.0045808d
mov eax, dword [edi + 0x60]
cmp byte [eax + 0xbe3], 1
jne 0x416889
add esi, 0xac
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp ebx, ebp
jne 0x4168d8
call fcn.0045808d
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x41689e
call fcn.0045808d
mov ecx, dword [edi + 0x60]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp byte [esp + 0x54], 0
je 0x4167ff
lea esi, [esp + 0x18]
call fcn.00410e20
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x28]
call eax
jmp 0x4167c9
mov eax, dword [ebx]
jmp 0x416842
mov eax, dword [ebx]
jmp 0x416866
mov eax, dword [ebx]
jmp 0x416894
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x50], 0x10
jb 0x4168fb
mov edx, dword [esp + 0x3c]
push edx
call fcn.00457a6e
add esp, 4
mov eax, 0x20000002
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x20
Function at 0x41a560
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x472a1b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x48c0d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0042c9b3
push 4
mov dword [esp + 0x24], 0
call fcn.00457d00
mov edi, eax
add esp, 4
test edi, edi
je 0x41a5e2
call fcn.0042cd03
mov dword [edi], eax
call fcn.0042cb31
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0042ca55
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x41a5d7
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0042ca7d
jmp 0x41a5e4
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x41c5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x485e40
push 0x459fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x48c0d0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x1c], edi
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], edi
push edi
push 0x80
push 4
push edi
push 3
push 0xc0000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x41c659
push edi
push edi
mov edx, dword [ebp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x41c659
push edi
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41c662
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0041c688
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x41c6a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x485e20
push 0x459fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x48c0d0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x1c], edi
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], edi
push edi
push 0x80
push 4
push edi
push 3
push 0xc0000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x41c73a
push 2
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x41c73a
push edi
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41c743
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0041c769
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41c780
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x485e00
push 0x459fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x48c0d0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x41c812
push 2
push ebx
neg edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x41c812
push ebx
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41c81b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0041c843
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41e9c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0
lea ecx, [esi + 0xbe4]
mov eax, 2
push ecx
mov word [esi + 0xd0], ax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [esi + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push esi
push 0x41d6b0
mov eax, 1
push 0
push 0
mov word [esi + 0xc74], ax
mov dword [esi + 0xdc], 0
call fcn.00458f54
mov dword [esi + 0xc78], eax
mov eax, dword [esi + 0xdc]
add esp, 0x18
pop esi
ret
Function at 0x41f740
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
push eax
mov byte [esi + 0xbe2], 1
mov dword [esi + 0xdc], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
lea ecx, [esi + 0xbe4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
push 0
push esi
push 0x41eb10
push 0
push 0
call fcn.00458f54
mov dword [esi + 0xc7c], eax
mov eax, dword [esi + 0xdc]
add esp, 0x18
pop esi
ret

Function at 0x42e4d2
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x42e4e8
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x42e4f4
or edi, 1
push 1
call esi
test ax, ax
jge 0x42e500
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x42e50c
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x42e518
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x42fe56
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x42fe7c
cmp ebx, dword [esi + 0x60]
je 0x42fe7c
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x60]
cmp ebx, eax
je 0x42ff3e
push edi
test eax, eax
je 0x42fecf
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x60]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x60]
mov ecx, esi
call fcn.0042f982
mov dword [esi + 0x60], edi
test ebx, ebx
je 0x42ff3d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x42ff3d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc0]
test al, al
je 0x42ff3d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xcc]
test al, al
je 0x42ff3d
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x60], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x60]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x60]
mov ecx, esi
call fcn.0042f982
pop edi
pop esi
pop ebx
leave
ret 4