joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414b40
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471780
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x4950d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x4995e8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
test eax, eax
jne 0x414bb5
push 0x550
call fcn.0041508d
add esp, 4
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x414ba7
mov ecx, eax
call fcn.0040ac50
jmp 0x414ba9
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x4995e8], eax
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.0041aa25
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x4995e8]
test eax, eax
jne 0x414c05
push 0x550
call fcn.0041508d
add esp, 4
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x414bf7
mov ecx, eax
call fcn.0040ac50
jmp 0x414bf9
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x4995e8], eax
push 1
push 0x190
push 0x258
push dword [ebp - 0x24]
mov ecx, eax
push dword [ebp - 0x28]
call fcn.0041aa25
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [edi + 0x540]
lea edx, [ebp - 0xac]
xor eax, eax
mov word [ebp - 0x18], ax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
mov eax, dword [ecx]
push edx
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.0041aa12
mov esi, eax
lea eax, [esi + 2]
mov cx, word [esi]
add esi, 2
test cx, cx
jne 0x414c57
sub esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
sar esi, 1
call fcn.0041a4c7
cmp esi, 3
jl 0x414cbe
mov ecx, dword [edi + 0x540]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
push 3
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.0041aa12
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045f59a
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.0041a4c7
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [edi + 0x528]
xor ecx, ecx
mov esi, dword [edi + 0x524]
mov ebx, eax
sub ebx, esi
xor edi, edi
add ebx, 3
shr ebx, 2
cmp esi, eax
cmova ebx, ecx
test ebx, ebx
je 0x414d12
mov ecx, dword [esi]
test ecx, ecx
je 0x414d0a
mov eax, dword [ecx]
call dword [eax]
inc edi
add esi, 4
cmp edi, ebx
jne 0x414d00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415020
mov esp, ebp
pop ebp
ret
Function at 0x416650
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471853
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4950d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x49a1cc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x49a1cc
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x477704
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0041a1a0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b7b9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41b7eb
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x42049e
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x471ef9
call fcn.0046ef76
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0042082d
call fcn.00424550
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a38c
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00424556
mov ecx, eax
call fcn.0041ab70
test al, al
je 0x4205b4
push ebx
lea ecx, [ebp - 0x94]
call fcn.0041a5c9
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.0041aa12
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x420525
push str.Error_opening_file
jmp 0x420695
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x42062e
cmp edi, 0x400000
ja 0x42063f
and dword [ebp - 0x2c8], 0
push edi
call fcn.004150ce
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x42059d
push ebx
call fcn.004150d7
pop ecx
mov ecx, esi
call fcn.0042082d
push 0
push str.Could_not_read_file
jmp 0x420695
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.004206e0
push dword [ebp - 0x2cc]
jmp 0x4206c3
call fcn.00424556
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a5ac
call fcn.00424682
test al, al
je 0x4205d5
call fcn.0042455c
jmp 0x4205ec
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0041aa12
push eax
call fcn.00432cea
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4205fd
push eax
push str.Error_opening_zip_file
jmp 0x420695
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.0043272b
add esp, 0x14
test eax, eax
je 0x420624
push 0
push str.Could_not_find_ziped_file
jmp 0x420695
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x420637
push 0
push str.File_is_empty
jmp 0x420695
cmp ebx, 0x400000
jbe 0x420648
push 0
push str.File_too_large
jmp 0x420695
push ebx
call fcn.004150ce
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.004330aa
add esp, 0x18
test eax, eax
je 0x4206a0
cmp eax, 0x600
je 0x4206a0
push dword [ebp - 0x2c8]
call fcn.004150d7
pop ecx
call fcn.00424682
test al, al
jne 0x42068e
push edi
call fcn.00432585
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.00420855
mov bl, al
jmp 0x4206cb
call fcn.00424682
test al, al
jne 0x4206b0
push edi
call fcn.00432585
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.004206e0
push edi
mov bl, al
call fcn.004150d7
pop ecx
lea ecx, [ebp - 0x94]
call fcn.0041a4c7
mov al, bl
call fcn.0046ef31
ret 8
Function at 0x42479b
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x4247be
or esi, 1
push 1
call edi
test ax, ax
jns 0x4247ca
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x4247d6
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x4247e2
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret

Function at 0x426c94
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [ebx + 4]
je 0x426cc7
cmp esi, dword [ebx + 0x60]
je 0x426d89
cmp byte [ebx + 0xc4], 0
jne 0x426cc7
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp esi, dword [ebx + 0x60]
je 0x426d89
cmp dword [ebx + 0x60], 0
push edi
je 0x426d1a
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x60]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x118]
xor edi, edi
mov ecx, ebx
push edi
push edi
push edi
push str.killfocus
push dword [ebx + 0x60]
call fcn.00426a4c
mov dword [ebx + 0x60], edi
test esi, esi
je 0x426d88
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
cmp eax, ebx
jne 0x426d88
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd8]
test al, al
je 0x426d88
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xe4]
test al, al
je 0x426d88
push 7
pop ecx
xor eax, eax
mov dword [ebx + 0x60], esi
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x60]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x118]
xor eax, eax
mov ecx, ebx
push eax
push eax
push eax
push str.setfocus
push dword [ebx + 0x60]
call fcn.00426a4c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4325d7
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4950d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43268d
movzx eax, word [esi]
test ax, ax
je 0x43268d
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x432617
cmp ax, 0x5c
jne 0x432619
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x43260b
cmp edi, esi
je 0x432660
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.00462751
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x43269d
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004325d7
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00462714
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004626a3
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00415020
mov esp, ebp
pop ebp
ret
call fcn.004157c6
int3

Function at 0x432c62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x432cde
cmp dword [edi + 4], 0xffffffff
jne 0x432cde
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4747a0
push esi
call fcn.004626a3
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x432cb0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x432cb0
mov eax, 0x2000000
jmp 0x432ce3
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043517d
add esp, 0x10
test eax, eax
jne 0x432cce
mov eax, dword [ebp - 4]
jmp 0x432ce3
push eax
call fcn.00435885
mov dword [edi], eax
mov eax, dword [0x49a8e4]
pop ecx
jmp 0x432ce3
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43528a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4352be
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4352b9
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4352e5
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x4352ce
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.00456d50
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x435458
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x435466
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x435525
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x479fe8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x479fe8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x479fe8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x479fe8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x479fe8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x479fe8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x479fe8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x479fe8]
sub edi, 1
jne 0x43547e
pop edi
test esi, esi
je 0x435541
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x479fe8]
inc edx
sub esi, 1
jne 0x435529
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x443be4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4950d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x24], 0
je 0x443c51
cmp dword [esi + 0x1c], 0
je 0x443c51
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0046eef0
mov ebx, esp
test ebx, ebx
je 0x443c51
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x1c]
push ebx
add ecx, 0x1bc
call fcn.0041a565
mov ecx, dword [esi + 0x1c]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x2c]
mov ecx, eax
call fcn.00426a4c
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415020
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4449ef
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x473256
call fcn.0046ef76
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.00424550
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a38c
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00424556
mov ecx, eax
call fcn.0041ab70
test al, al
je 0x444add
push ebx
lea ecx, [ebp - 0x94]
call fcn.0041a5c9
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.0041aa12
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x444a80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0041a4c7
jmp 0x444bbe
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x444a6c
push esi
mov dword [ebp - 0x2c8], edi
call fcn.004150ce
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x444ba9
push edi
call fcn.004150d7
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0041a4c7
jmp 0x444bbc
call fcn.00424556
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a5ac
call fcn.00424682
test al, al
je 0x444afe
call fcn.0042455c
jmp 0x444b15
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0041aa12
push eax
call fcn.00432cea
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x444a6c
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.0043272b
add esp, 0x14
test eax, eax
jne 0x444a6c
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x444a6c
push esi
call fcn.004150ce
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.004330aa
add esp, 0x18
test eax, eax
je 0x444b99
cmp eax, 0x600
je 0x444b99
push edi
call fcn.004150d7
pop ecx
call fcn.00424682
test al, al
jne 0x444ac9
push ebx
call fcn.00432585
jmp 0x444ac8
call fcn.00424682
test al, al
jne 0x444ba9
push ebx
call fcn.00432585
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0041a4c7
test edi, edi
jne 0x444c30
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x444c2c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x444c2c
push esi
mov dword [ebp - 0x2d0], edi
call fcn.004150ce
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x444c28
push edi
call fcn.004150d7
pop ecx
xor edi, edi
test edi, edi
jne 0x444c30
xor eax, eax
jmp 0x444c4b
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.00444c53
push 1
push edi
mov esi, eax
call fcn.004150c0
pop ecx
pop ecx
mov eax, esi
call fcn.0046ef31
ret 4
Function at 0x4481f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x448204
xor eax, eax
pop ebp
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x448216
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x448200
push esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x448231
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x448268
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call fcn.00456d50
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x44826c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x44826f
xor eax, eax
inc eax
pop esi
pop ebp
ret

Function at 0x44a1d4
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x88
mov eax, 0x471e8b
call fcn.0046ef76
mov esi, ecx
cmp dword [esi + 0x4f0], 0
mov ebx, dword [ebp + 0x14]
je 0x44a2c8
cmp dword [ebp + 8], 0x100
jne 0x44a2ae
cmp word [ebp + 0xc], 0xd
jne 0x44a247
cmp byte [esi + 0x4f6], 0
je 0x44a228
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x44a247
cmp byte [esi + 0x4f7], 0
jne 0x44a247
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x44a240
push 0
push 0
push 0
push str.return
push esi
call fcn.00426a4c
xor eax, eax
jmp 0x44a2cb
cmp dword [ebp + 0xc], 0x43
jne 0x44a2ae
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x44a2ae
lea eax, [ebp - 0x94]
mov ecx, esi
push eax
call fcn.004489ff
and dword [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.0041aa1c
lea ecx, [ebp - 0x94]
lea eax, [eax*2 + 2]
push eax
call fcn.0041aa12
mov ecx, dword [esi + 0x40]
push eax
push 0x2042
call fcn.0041aa25
push eax
call fcn.004481f0
add esp, 0x10
lea ecx, [ebp - 0x94]
call fcn.0041a4c7
jmp 0x44a240
mov eax, dword [esi + 0x4f0]
push ebx
push dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x44a2cb
xor eax, eax
inc eax
call fcn.0046ef31
ret 0x10
Function at 0x451cff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x451d23
cmp dword [esi + 8], edi
jge 0x451d1b
push esi
call fcn.0044ffa0
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x451d4c
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x451d2f
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x451d69
mov edx, dword [esi]
cmp edx, dword [esi + 4]
jb 0x451d57
xor eax, eax
jmp 0x451d5f
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx + 8], al
inc ecx
cmp ecx, 4
jl 0x451d4e
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x451d9e
push str.zlib_corrupt
call fcn.0044fe5b
add esp, 4
jmp 0x451ddb
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x451dae
push str.read_past_buffer
jmp 0x451d94
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x451dc5
push edi
push esi
call fcn.0044fe6a
pop ecx
pop ecx
test eax, eax
je 0x451ddb
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00456d50
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x45575f
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00462736
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004150ce
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.00462714
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x4557d9
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x4557d0
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4557c6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4557d7
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x4557a3
jmp 0x4557d9
xor edi, edi
push esi
call fcn.004150d7
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4557e9
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x47372c
call fcn.0046ef76
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.004572d0
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.004572d0
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x4558c7
cmp word [edi], dx
jne 0x455858
mov eax, edx
jmp 0x45585f
push edi
call fcn.00462736
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.0040a200
cmp dword [ebp - 0x30], 0
je 0x4558c7
mov edi, 0x48099c
push edi
call fcn.00462736
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040a200
xor edi, edi
cmp word [esi], di
jne 0x455890
mov eax, edi
jmp 0x455897
push esi
call fcn.00462736
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00409fb0
mov esi, 0x4809a0
push esi
call fcn.00462736
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00409fb0
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409ea0
jmp 0x4558e3
xor edi, edi
cmp word [esi], di
jne 0x4558d2
mov eax, edi
jmp 0x4558d9
push esi
call fcn.00462736
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040a200
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push 1
push edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x455910
mov esi, edi
jmp 0x45593b
cmp byte [ebp + 0x10], 0
je 0x455928
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.0044325c
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.0044325c
mov eax, esi
call fcn.0046ef31
ret