joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565de4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x565e12
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x565e30
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00565d4a
jmp 0x565e30
mov eax, dword [esi + 0x14]
test eax, eax
je 0x565e30
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00565d4a
test edi, edi
mov eax, edi
jne 0x565e1a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401c45
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x608ee0
cmp edx, dword [eax]
je 0x401c67
add eax, 8
inc ecx
cmp eax, 0x608f70
jl 0x401c58
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x608ee0]
jne 0x401d95
mov eax, dword [0x61eee8]
cmp eax, 1
je 0x401d6f
test eax, eax
jne 0x401c98
cmp dword [0x608e34], 1
je 0x401d6f
cmp edx, 0xfc
je 0x401d95
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401ccf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004021f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402360
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x401d12
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402360
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5fc6d0
push edi
call fcn.004032e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004021f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402200
lea eax, [ebp - 0xa0]
push 0x5fc6b0
push eax
call fcn.00402200
push dword [esi + 0x608ee4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402200
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403254
add esp, 0x2c
pop edi
jmp 0x401d95
lea eax, [ebp + 8]
lea esi, [esi + 0x608ee4]
push 0
push eax
push dword [esi]
call fcn.00402360
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x405330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [ecx + 0x458]
push edi
mov dword [esp + 0x10], ecx
xor ebx, ebx
jmp 0x40534b
mov ecx, dword [esp + 0x10]
cmp esi, dword [ecx + 0x45c]
je 0x40538c
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x405385
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp], eax
mov ecx, dword [esi]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
add esi, 4
test ebx, ebx
je 0x405347
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x409be0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
sub esp, 0xc
push ebx
mov ebx, dword [ecx]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [eax]
push edi
mov edi, dword [ebp]
call fcn.00409cf0
push eax
push 0x400
push 0x620248
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [0x620244]
test al, al
je 0x409c83
xor ebx, ebx
lea edx, [esp + 0x2c]
push ebx
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0046fe80
mov edi, 0x620248
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x620248
push ecx
push 0x620248
lea ecx, [esp + 0x18]
call fcn.00406380
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
push ebp
push ecx
call fcn.0040a0b0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
add esp, 0xc
sub edx, eax
lea ecx, [esp + 0x18]
push edx
push eax
call fcn.0041d810
jmp 0x409c85
xor ebx, ebx
mov esi, dword [esp + 0x20]
mov edi, 0x620248
or ecx, 0xffffffff
xor eax, eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
mov ecx, esi
add edi, 0x620248
mov ebx, edi
sub ebx, 0x620248
lea eax, [ebx + 1]
push eax
call fcn.00405f20
mov ebp, dword [esi]
push ebx
push 0x620248
push ebp
call fcn.00403770
sub ebp, 0x620248
add esp, 0xc
add edi, ebp
mov eax, esi
mov dword [esi + 4], edi
mov byte [edi], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x40a1f0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x118
push ebx
push esi
xor ebx, ebx
call fcn.0045e0e0
mov eax, dword [eax + 0x448]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x40a302
push esi
call fcn.005f0c55
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0x1c]
mov dword [0x62074c], eax
push eax
push esi
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40a302
mov edx, dword [0x62074c]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push str.VarFileInfoTranslation
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40a302
push edi
push str.StringFileInfo_
push 0x620648
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
xor esi, esi
test eax, 0xfffffffe
jbe 0x40a2d9
mov ecx, dword [esp + 0x10]
xor eax, eax
lea edx, [esp + 0x18]
mov ax, word [ecx + esi*2]
push eax
push str._04x
push edx
call fcn.005f106c
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x620648
call edi
mov ecx, dword [esp + 0xc]
inc esi
shr ecx, 1
cmp esi, ecx
jb 0x40a2a5
push 0x609640
push 0x620648
call edi
push 0x620648
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
mov word [0x620748], ax
pop esi
mov al, 1
pop ebx
add esp, 0x118
ret
mov al, bl
pop esi
pop ebx
add esp, 0x118
ret
Function at 0x40a590
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x200
mov ecx, 8
xor eax, eax
mov dword [0x60967c], 0x400
push esi
push edi
mov edi, 0x620950
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
rep stosd dword es:[edi], eax
mov dword [0x620950], eax
lea eax, [esp + 8]
push 0x200
push eax
push 0x18
push 0x400
call esi
lea ecx, [esp + 8]
push ecx
call fcn.005f099b
add esp, 4
lea edx, [esp + 8]
mov dword [0x620958], eax
mov eax, dword [0x60967c]
push 0x200
push edx
push 0x12
push eax
call esi
lea ecx, [esp + 8]
push ecx
call fcn.005f099b
add esp, 4
mov dword [0x620954], eax
push 0x620b74
push 0x5654
call fcn.0045e0e0
mov ecx, eax
call fcn.00404ab0
push 0x61f1e0
push 0x620b74
call fcn.005f10be
add esp, 8
test eax, eax
je 0x40a648
push 0x609694
push 0x620b74
call fcn.005f10be
add esp, 8
test eax, eax
jne 0x40a65d
mov edx, dword [0x60967c]
push 0x200
push 0x620b74
push 0x14
push edx
call esi
mov eax, dword [0x60967c]
push 0x200
push 0x620750
push 0x16
push eax
mov dword [0x62096c], 0x620b74
call esi
mov ecx, dword [0x60967c]
push 0x200
push 0x620d74
push 0x17
push ecx
mov dword [0x62095c], 0x620750
call esi
mov eax, dword [0x60967c]
lea edx, [esp + 8]
push 0x200
push edx
push 0x1c
push eax
mov dword [0x620960], 0x620d74
call esi
lea ecx, [esp + 8]
push ecx
call fcn.005f099b
add esp, 4
lea edx, [esp + 8]
mov dword [0x620964], eax
mov eax, dword [0x60967c]
push 0x200
push edx
push 0x1b
push eax
call esi
lea ecx, [esp + 8]
push ecx
call fcn.005f099b
mov dword [0x620968], eax
add esp, 4
mov ecx, 6
xor eax, eax
mov edi, 0x621178
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
mov dword [0x621178], eax
mov eax, dword [0x60967c]
push 0x200
push edx
push 0x10
push eax
call esi
lea ecx, [esp + 8]
push ecx
call fcn.005f099b
add esp, 4
lea edx, [esp + 8]
mov dword [0x621180], eax
mov eax, dword [0x60967c]
push 0x200
push edx
push 0x12
push eax
call esi
lea ecx, [esp + 8]
push ecx
call fcn.005f099b
mov edx, dword [0x60967c]
add esp, 4
mov dword [0x62117c], eax
push 0x200
push 0x620750
push 0xe
push edx
call esi
mov eax, dword [0x60967c]
push 0x200
push 0x620d74
push 0xf
push eax
mov dword [0x621184], 0x620750
call esi
mov edx, dword [0x60967c]
lea ecx, [esp + 8]
push 0x200
push ecx
push 0x1010
push edx
mov dword [0x621188], 0x620d74
call esi
lea eax, [esp + 8]
push eax
call fcn.005f099b
add esp, 4
mov dword [0x62118c], eax
push 0x621194
push 0x55fc
call fcn.0045e0e0
mov ecx, eax
call fcn.00404ab0
push 0x621394
push 0x55fd
call fcn.0045e0e0
mov ecx, eax
call fcn.00404ab0
push 0x621594
push 0x55fe
call fcn.0045e0e0
mov ecx, eax
call fcn.00404ab0
pop edi
pop esi
add esp, 0x200
ret
Function at 0x40aed0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x23c
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x248]
push ebx
push ebp
push esi
mov dword [esp + 0x10], eax
lea edx, [esp + 0x38]
push edi
lea eax, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x54], 0
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x40af90
lea ecx, [esp + 0x2c]
push 0x10
push ecx
push 0x1009
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 1
lea edx, [esp + 0x20]
push 0x60963c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x1009
push 0x800
call esi
mov edx, dword [esp + 0x25c]
lea ecx, [esp + 0x4c]
shl edx, 9
push 0x200
add edx, 0x621194
push ecx
mov ecx, dword [0x60967c]
lea eax, [esp + 0x44]
push edx
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea edx, [esp + 0x2c]
push edx
push 0x1009
push 0x800
call esi
xor eax, eax
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
mov ebp, dword [esp + 0x250]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
lea ebx, [esp + ecx + 0x4c]
lea eax, [esp + 0x4c]
mov dword [esp + 0x10], ebx
sub ebx, eax
lea edi, [ebx + 1]
cmp edi, 0xffffffff
ja 0x40b00b
test edi, edi
jbe 0x40b00b
push edi
call fcn.004064d0
mov esi, eax
lea edx, [esp + 0x50]
push ebx
push edx
lea ecx, [esi + edi]
push esi
mov dword [ebp], esi
mov dword [ebp + 4], esi
mov dword [ebp + 8], ecx
call fcn.00403770
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x5c]
add esp, 0x10
sub esi, eax
lea eax, [esi + ecx]
pop edi
mov dword [ebp + 4], eax
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
add esp, 0x23c
ret
jmp fcn.005f0840

Function at 0x40b010
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x204
lea eax, [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x218]
push edi
push eax
lea ecx, [esi + 0x5655]
push ecx
call fcn.0045e0e0
mov ecx, eax
call fcn.00404ab0
test eax, eax
je 0x40b05e
mov al, byte [esp + 0x14]
test al, al
jne 0x40b05e
lea edx, [esp + 0x14]
push 0x200
add esi, 0x44
push edx
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
mov ebp, dword [esp + 0x218]
dec ecx
lea eax, [esp + 0x14]
lea ebx, [esp + ecx + 0x14]
mov dword [ebp], edx
mov dword [esp + 0x10], ebx
sub ebx, eax
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
lea edi, [ebx + 1]
cmp edi, 0xffffffff
ja 0x40b0db
cmp edi, edx
jbe 0x40b0db
push edi
call fcn.004064d0
mov esi, eax
lea edx, [esp + 0x18]
push ebx
push edx
lea ecx, [esi + edi]
push esi
mov dword [ebp], esi
mov dword [ebp + 4], esi
mov dword [ebp + 8], ecx
call fcn.00403770
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
add esp, 0x10
sub esi, eax
lea eax, [esi + ecx]
pop edi
mov dword [ebp + 4], eax
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
add esp, 0x204
ret
jmp fcn.005f0840
Function at 0x40b120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x14
push esi
push edi
xor edi, edi
lea eax, [esp + 0xb]
push edi
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.0046fe80
push 8
lea ecx, [esp + 0x14]
call fcn.00405f20
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
cmp eax, edi
mov byte [ecx], 0
je 0x40b23f
cmp byte [eax], 0
je 0x40b23f
lea edx, [esp + 0x24]
mov dword [esp + 0x24], edi
push edx
push eax
push str.TEXT
call fcn.0045e0e0
mov ecx, eax
call fcn.00405330
cmp eax, edi
mov dword [esp + 0xc], eax
je 0x40b23f
push ebx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [esp + 0x2c]
lea ebx, [eax + 1]
push ebx
call fcn.005f0c55
lea ecx, [ebx - 1]
mov ebp, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebx + ebp - 1]
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov byte [eax], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [esp + 0x18]
mov eax, ebp
not ecx
dec ecx
add ecx, ebp
cmp ebp, ecx
je 0x40b1ed
mov edx, dword [esp + 0x1c]
cmp esi, edx
je 0x40b211
mov dl, byte [eax]
inc eax
mov byte [esi], dl
inc esi
cmp eax, ecx
jne 0x40b1db
mov edx, dword [esp + 0x1c]
cmp esi, edx
mov edi, edx
je 0x40b227
push 1
push edx
push esi
call fcn.00403770
mov eax, dword [esp + 0x28]
sub esi, edi
add esp, 0xc
add eax, esi
mov dword [esp + 0x1c], eax
jmp 0x40b227
cmp eax, ecx
jne 0x40b217
jmp 0x40b1f1
mov edx, dword [esp + 0x2c]
push edx
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.00406ae0
push ebp
call fcn.005f0905
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
xor edi, edi
pop ebx
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push edi
push ecx
lea ecx, [esi + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.0046fe80
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00406710
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub edx, eax
lea ecx, [esp + 0x18]
push edx
push eax
call fcn.0041d810
mov eax, esi
pop edi
pop esi
add esp, 0x14
ret
Function at 0x43f6e0
Capabilities:
Create directory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov esi, ecx
push ebp
mov dword [esp + 0x14], esi
call fcn.0043f5e0
add esp, 4
test al, al
jne 0x43f706
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
push ebp
mov ecx, esi
call fcn.0043f430
mov ebx, eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x43f721
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
mov al, byte [esp + 0x24]
mov dword [ebx + 8], ebp
test al, al
je 0x43f7e4
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x6234f0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x6234f0]
mov esi, 0x6234f0
test al, al
je 0x43f782
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp byte [esi], 0x2f
jne 0x43f77a
push 0
push 0x6234f0
mov byte [esi], 0
call edi
mov byte [esi], 0x2f
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x43f766
push 0x60ac24
push ebp
call fcn.005f190a
mov esi, eax
add esp, 8
test esi, esi
je 0x43f7b1
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push esi
push 1
push ecx
push edx
call fcn.005f1564
push esi
call fcn.005f1894
add esp, 0x14
mov ebp, dword [esp + 0x10]
mov esi, 0
mov edi, dword [ebp + 4]
mov ecx, dword [ebp]
sub edi, ecx
sar edi, 2
je 0x43f7e4
mov eax, dword [ebp]
push 1
mov ecx, dword [eax + esi*4]
mov eax, dword [0x623714]
push eax
push ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
test al, al
jne 0x43f80a
inc esi
cmp esi, edi
jb 0x43f7c7
mov eax, dword [str.createMemory::]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
pop edi
mov dword [ebx + 4], eax
pop esi
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], edx
mov dword [ebx], 0
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
pop edi
pop esi
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], edx
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4515d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4515db
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4516de
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5fcf84]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5fcf84]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5fcf84]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5fcf84]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5fcf84]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5fcf84]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5fcf84]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5fcf84]
xor eax, edx
inc ecx
dec edi
jne 0x4515f6
pop edi
test esi, esi
je 0x451700
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5fcf84]
xor eax, edx
inc ecx
dec esi
jne 0x4516e2
pop esi
pop ebx
not eax
ret
Function at 0x45eea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
xor esi, esi
xor bl, bl
call fcn.004985c0
test eax, eax
je 0x45eeb7
test byte [eax + 0x7c], 1
jne 0x45eeb7
mov bl, 1
mov eax, dword [esp + 0xc]
cmp eax, 0x13
je 0x45eeee
cmp eax, 0x70
je 0x45eed2
cmp eax, 0x79
je 0x45ef10
pop esi
mov eax, 1
pop ebx
ret
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x45eeca
push 0xffffffffffffffff
call fcn.0049be60
add esp, 4
mov eax, esi
pop esi
pop ebx
ret
test bl, bl
je 0x45ef10
call fcn.0045e0e0
mov cl, byte [eax + 0x440]
test cl, cl
je 0x45ef0b
call fcn.0049a940
mov eax, esi
pop esi
pop ebx
ret
call fcn.0049a8e0
mov eax, esi
pop esi
pop ebx
ret
Function at 0x462a20
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x108
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x78]
mov ebp, eax
test ebp, ebp
je 0x462b62
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x61f094
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov al, byte [esi + 0x4a4]
test al, al
je 0x462a87
mov al, byte [0x6248c0]
test al, al
je 0x462a87
mov al, byte [0x624aec]
test al, al
jne 0x462a87
mov byte [0x6248c0], 0
mov al, byte [ebp + 4]
test al, al
je 0x462a87
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0x54]
mov eax, dword [ebp + 0x13c]
push edi
lea edi, [ebp + 0xbc]
test eax, eax
je 0x462b56
mov al, byte [esi + 0x508]
mov ecx, 0x628700
push eax
push edi
call fcn.005cc370
test al, al
jne 0x462ac0
mov al, byte [esi + 0x508]
test al, al
je 0x462b56
mov al, byte [esi + 0x509]
push ebx
test al, al
mov bl, 0xff
je 0x462af9
mov ecx, dword [esi + 0x510]
mov edx, dword [esi + 0x50c]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], bl
call fcn.00462b70
push eax
mov ecx, edi
call fcn.005bec70
mov al, byte [esi + 0x442]
test al, al
je 0x462b24
push 0
lea ecx, [esp + 0x14]
push 0x23
push ecx
push str.developer_mode
mov ecx, edi
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
call fcn.005bec70
mov eax, dword [0x6298bc]
test eax, eax
jne 0x462b47
mov ecx, edi
call fcn.005bef30
mov ebx, eax
push ebx
call fcn.00409ae0
add esp, 4
mov ecx, edi
push ebx
call fcn.005befa0
mov ecx, ebp
call fcn.005bf600
mov byte [esi + 0x508], 0
pop ebx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
pop ebp
add esp, 0x108
ret
Function at 0x4631c0
Capabilities:
Create directory
Enumerate files on windows

Disassembly:
sub esp, 0x378
lea eax, [esp + 0x178]
push esi
push eax
push 0x55f6
xor esi, esi
call fcn.00404ab0
test eax, eax
je 0x4632d1
push ebx
lea ecx, [esp + 0x180]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [esp + 0x388]
lea eax, [esp + 0x180]
push edx
push eax
lea ecx, [esp + 0x14]
push str._s_Zoo._s
push ecx
mov byte [esp + 0x1b], 0
call fcn.005f106c
add esp, 0x10
lea edx, [esp + 0x40]
lea eax, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46329f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push edi
lea edi, [esp + 0x74]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x74]
mov cl, byte [esp + ecx + 0x6d]
mov byte [esp + 0x10], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x74]
mov dl, byte [esp + ecx + 0x6e]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x11], dl
mov al, byte [esp + ecx + 0x6f]
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x16], al
call fcn.005f099b
add esp, 4
cmp eax, esi
jle 0x46328a
mov esi, eax
lea edx, [esp + 0x48]
push edx
push ebx
call ebp
test eax, eax
jne 0x463239
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebp
inc esi
pop ebx
cmp esi, 0x3e7
jle 0x4632ab
xor esi, esi
mov eax, dword [esp + 0x384]
mov edx, dword [esp + 0x380]
push eax
lea ecx, [esp + 0x180]
push esi
push ecx
push str._s_Zoo_03d._s
push edx
call fcn.005f106c
add esp, 0x14
pop esi
add esp, 0x378
ret 8