joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487e10
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x63f070]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x414], ax
push 0x206
push 0
lea ecx, [ebp - 0x412]
push ecx
call fcn.0057a870
add esp, 0xc
xor edx, edx
mov word [ebp - 0x824], dx
push 0x206
push 0
lea eax, [ebp - 0x822]
push eax
call fcn.0057a870
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x61c], cx
push 0x206
push 0
lea edx, [ebp - 0x61a]
push edx
call fcn.0057a870
add esp, 0xc
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.0057a870
add esp, 0xc
push 0x100
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0
push 0
push 0
push 0
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0x104
lea ecx, [ebp - 0x824]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.0058cf9f
add esp, 0x24
mov dword [ebp - 0x830], eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x824]
push ecx
push str._s_sts_downloader.cfg
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x487f63
lea ecx, [ebp - 0x20c]
push ecx
push 0
push str.SkipLimit
push 0x613bc0
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 1
jne 0x487f51
mov dword [ebp - 0x828], 1
jmp 0x487f5b
mov dword [ebp - 0x828], 0
mov al, byte [ebp - 0x828]
jmp 0x487f65
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6edb
mov esp, ebp
pop ebp
ret
Function at 0x488cc0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x63f070]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x245], 1
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x244], 0xffffffff
mov eax, dword [0x614114]
mov dword [ebp - 0x20c], eax
mov ecx, dword [0x614118]
mov dword [ebp - 0x208], ecx
mov edx, dword [0x61411c]
mov dword [ebp - 0x204], edx
mov ax, word [0x614120]
mov word [ebp - 0x200], ax
push 0x1fa
push 0
lea ecx, [ebp - 0x1fe]
push ecx
call fcn.0057a870
add esp, 0xc
mov dword [ebp - 0x250], 0
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], edx
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
movzx ecx, word [ebp + 8]
cmp ecx, 0x41
jl 0x488da2
movzx edx, word [ebp + 8]
cmp edx, 0x5a
jle 0x488db4
movzx eax, word [ebp + 8]
cmp eax, 0x61
jl 0x488db6
movzx ecx, word [ebp + 8]
cmp ecx, 0x7a
jg 0x488db6
jmp 0x488dbd
xor eax, eax
jmp 0x488e7e
mov edx, 2
shl edx, 2
mov ax, word [ebp + 8]
mov word [ebp + edx - 0x20c], ax
push 0
push 0x80
push 3
push 0
push 3
push Ordinal_1
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0x488e03
jmp 0x488e58
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
push 0
lea edx, [ebp - 0x250]
push edx
push 0x28
lea eax, [ebp - 0x240]
push eax
push 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0x2d1400
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x488e4c
jmp 0x488e58
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x244], 0xffffffff
je 0x488e78
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x244], 0xffffffff
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6edb
mov esp, ebp
pop ebp
ret
Function at 0x492ca0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x496039
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.00495f43
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00583d5b
push edi
call fcn.0058279d
add esp, 0x10
cmp eax, 0xffffffff
jne 0x496088
push edi
call fcn.0058d07f
pop ecx
test eax, eax
je 0x496088
lea ecx, [esi + 0x40]
mov dword [esi + 0x38], 5
call fcn.004947b1
lea ecx, [esi + 0x4c]
call fcn.004947b1
mov dword [esi + 0x58], ebx
jmp 0x496105
push 2
push ebx
push edi
call fcn.00583d5b
push edi
call fcn.0058cc89
push 0
push 0
push edi
mov ebx, eax
call fcn.00583d5b
add esp, 0x1c
cmp ebx, 0xffffffff
jne 0x4960c8
mov dword [esi + 0x38], 5
lea ecx, [esi + 0x40]
call fcn.004947b1
lea ecx, [esi + 0x4c]
call fcn.004947b1
and dword [esi + 0x58], 0
jmp 0x496105
cmp ebx, 0xffffffff
jae 0x4960ab
test ebx, ebx
jne 0x4960da
mov dword [esi + 0x38], 0xf
jmp 0x4960b2
lea eax, [ebx + 1]
push eax
call fcn.004a74f9
push edi
push ebx
push 1
push eax
mov dword [esi + 0x5c], eax
call fcn.0058d276
add esp, 0x14
cmp eax, ebx
jne 0x4960ab
mov eax, dword [esi + 0x5c]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.004962cd
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4a2dd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2c5f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63f070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 8]
mov dword [esi], vtable.Json::BuiltStyledStreamWriter.0
call fcn.004185d0
lea ecx, [esi + 0x14]
call fcn.0042a5c0
push dword [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x30]
mov dword [esi + 0x2c], 0x4a
call fcn.0042a610
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x4c]
push dword [ebp + 0x10]
mov byte [ebp - 4], 3
mov dword [esi + 0x48], eax
call fcn.0042a610
push dword [ebp + 0x14]
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.0042a610
push dword [ebp + 0x18]
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 5
call fcn.0042a610
mov cl, byte [ebp + 0x1c]
mov al, byte [esi + 0x94]
and cl, 1
and al, 0xf8
shl cl, 2
or cl, al
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x9c], eax
mov eax, esi
mov byte [esi + 0x94], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4aa7ec
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x4aa80f
or esi, 1
push 2
call edi
test ax, ax
jns 0x4aa81b
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x4aa827
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x4aa833
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4adb16
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x4b4]
call fcn.004b4671
mov edi, dword [ebp + 8]
test eax, eax
jle 0x4adb6e
push ebx
lea ecx, [esi + 0x4b4]
mov byte [ebp + 0xb], 0
call fcn.004b36f2
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
mov ecx, eax
jne 0x4adbd2
lea ecx, [esi + 0x4b4]
inc ebx
call fcn.004b4671
cmp ebx, eax
jl 0x4adb35
sub edi, 0x100
je 0x4adc47
sub edi, 4
je 0x4adbde
dec edi
sub edi, 1
jne 0x4add01
push dword [ebp + 0xc]
and dword [ebp + 8], edi
call fcn.005890f4
pop ecx
mov ecx, dword [esi + 0x104]
lea edx, [ebp + 8]
push reloc.WS2_32.dll_select
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x4af59b
call dword [eax + 0x134]
mov esi, eax
test esi, esi
je 0x4add01
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x128]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
jmp 0x4adbd7
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov al, 1
jmp 0x4add03
cmp dword [esi + 0x108], 0
je 0x4add01
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x120]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x124]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.004aa7ec
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
jmp 0x4add01
cmp dword [ebp + 0xc], 9
jne 0x4add01
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x4adca4
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x4adca4
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 0x10c]
test al, al
je 0x4adca4
mov ecx, dword [esi + 0x108]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0057c638
pop ecx
pop ecx
test eax, eax
je 0x4adca4
mov ecx, dword [esi + 0x108]
call fcn.004d9ba9
test al, al
jne 0x4add01
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x4adce8
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x4adce8
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 0x10c]
test al, al
je 0x4adce8
mov ecx, dword [esi + 0x108]
push str.WkeWebkitUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0057c638
pop ecx
pop ecx
test eax, eax
jne 0x4add01
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.004aed3a
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4ae9ae
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xa8]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x4ae9da
cmp esi, dword [edi + 0x108]
je 0x4ae9da
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x108]
cmp esi, eax
je 0x4aeac0
test eax, eax
je 0x4aea41
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x17
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0x108]
call fcn.004ae609
and dword [edi + 0x108], 0
test esi, esi
je 0x4aeac0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x4aeac0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x100]
test al, al
je 0x4aeac0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
test al, al
je 0x4aeac0
xorps xmm0, xmm0
mov dword [edi + 0x108], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0x108]
call fcn.004ae609
pop edi
pop esi
leave
ret 4
Function at 0x4b005a
Capabilities:
Terminate process

Disassembly:
push 0x2e0
mov eax, 0x5b3622
call fcn.004a7792
mov edi, ecx
push 0xfffffffffffffff0
call fcn.004b4671
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, edi
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.004b4671
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [edi]
lea ebx, [edi + 0x30]
mov ecx, edi
call dword [eax + 0x30]
push eax
push dword [edi + 4]
mov ecx, ebx
call fcn.004aa4ba
mov ecx, edi
lea eax, [edi + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, ebx
call fcn.004a9848
lea ecx, [ebp - 0x2e8]
call fcn.004cca14
mov eax, dword [edi]
lea ecx, [ebp - 0x118]
push ecx
xor esi, esi
mov ecx, edi
mov dword [ebp - 4], esi
call dword [eax + 0x28]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.004b3cee
lea ecx, [ebp - 0x94]
test al, al
mov eax, dword [edi]
push ecx
mov ecx, edi
jne 0x4b014a
call dword [eax + 0x2c]
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004b3701
push eax
call fcn.00582b71
pop ecx
lea ecx, [ebp - 0x94]
movzx esi, ax
mov byte [ebp - 4], 1
call fcn.004b3603
mov ecx, edi
lea eax, [edi + 0x28]
neg ecx
push 0
sbb ecx, ecx
and ecx, eax
push ebx
push ecx
lea ecx, [ebp - 0x118]
call fcn.004b3701
push eax
push esi
lea ecx, [ebp - 0x2e8]
call fcn.004cda59
mov esi, eax
jmp 0x4b0188
call dword [eax + 0x2c]
mov edx, edi
mov byte [ebp - 4], 3
neg edx
lea ecx, [edi + 0x28]
push esi
sbb edx, edx
push ebx
and edx, ecx
mov ecx, eax
push edx
push esi
call fcn.004b3701
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp - 0x2e8]
call fcn.004cda59
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
mov esi, eax
call fcn.004b3603
test esi, esi
jne 0x4b01f1
push 0xffffffffffffffff
push 0x5be624
lea ecx, [ebp - 0x94]
call fcn.004b3501
mov eax, dword [edi]
lea ecx, [ebp - 0x19c]
push ecx
mov ecx, edi
mov byte [ebp - 4], 4
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.004b373c
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 4
call fcn.004b3603
push 0x10
push str.Duilib
lea ecx, [ebp - 0x94]
call fcn.004b3701
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push esi
mov ecx, ebx
call fcn.004a98e1
mov edx, edi
lea eax, [edi + 0x20]
neg edx
mov ecx, ebx
sbb edx, edx
and edx, eax
push edx
call fcn.004a978e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x118]
call fcn.004b3603
lea ecx, [ebp - 0x2e8]
call fcn.004cf5db
xor eax, eax
call fcn.004a774d
ret 0x10
Function at 0x4b49f1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4b4aa0
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4b4aa4
cmp dword [ebp - 0x1c], 0x10
jne 0x4b4a6f
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 4]
jne 0x4b4a6f
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call fcn.004af2e0
pop ecx
test al, al
jne 0x4b4a91
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x4b4aa4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4b4a3c
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x4b4ac2
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4b4ac7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b4af9
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x4c4053
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x4c4081
cmp eax, edi
jge 0x4c4075
push esi
call fcn.004bf6c5
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x4c40a4
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4c408a
mov dword [esi + 8], edx
jmp 0x4c40b9
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x4c40af
xor dl, dl
jmp 0x4c40b4
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4c40a4
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4c40f1
push str.zlib_corrupt
call fcn.004bf5ea
pop ecx
jmp 0x4c4131
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4c4101
push str.read_past_buffer
jmp 0x4c40e9
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x4c411b
push edi
push ecx
push esi
call fcn.004c7326
add esp, 0xc
test eax, eax
je 0x4c4131
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0057a2f0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x4d1a75
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x63f070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4d1aa9
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4d1aa9
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x4d1b5f
push esi
mov esi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x4d1ac8
cmp dx, 0x5c
jne 0x4d1aca
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x4d1abc
cmp esi, ebx
je 0x4d1b12
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.0057a2f0
add esp, 0xc
cmp esi, 0x208
jae 0x4d1b6d
xor eax, eax
mov word [ebp + esi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.004d1a75
pop ecx
pop ecx
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x4d1b2f
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0059204e
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0059201d
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4d1b5f
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004a6edb
leave
ret
call fcn.004a7aaf
int3

Function at 0x4d2198
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4d2244
cmp dword [esi + 4], 0xffffffff
jne 0x4d2244
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push edi
call fcn.00592070
pop ecx
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x4d21eb
cmp eax, 0x2f
je 0x4d21eb
push 0x5be470
push edi
call fcn.0059201d
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x4d220d
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4d220d
mov eax, 0x2000000
jmp 0x4d2249
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004d4927
add esp, 0x10
test eax, eax
jne 0x4d222b
mov eax, dword [ebp - 4]
jmp 0x4d2249
push eax
call fcn.004d5004
pop ecx
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x4d2249
mov eax, 0x1000000
pop esi
leave
ret 0xc
Function at 0x4d26f8
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x5c32f0]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x4d4a24
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4d4a57
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4d4a52
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4d4a81
mov edx, dword [edi + 0x1c]
push esi
mov esi, dword [edi + 0x18]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ecx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.0057a2f0
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x4d4bb1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4d4bbf
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4d4c7e
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
sub edi, 1
jne 0x4d4bd7
pop edi
test esi, esi
je 0x4d4c9a
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5c32f0]
inc edx
sub esi, 1
jne 0x4d4c82
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4db910
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x6a4], edi
je 0x4db979
cmp dword [ebp + 8], 0x100
jne 0x4db968
cmp dword [ebp + 0xc], 0xd
jne 0x4db968
cmp byte [esi + 0x6aa], 0
je 0x4db94f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4db968
cmp byte [esi + 0x6ab], 0
jne 0x4db968
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x4db964
push edi
push edi
push edi
push str.return
push esi
call fcn.004ae609
xor eax, eax
jmp 0x4db97c
mov eax, dword [esi + 0x6a4]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x4dea5f
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x6c8
jmp fcn.004e257c