joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cb80
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [0x40dc90]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0xadc198fb
jmp 0x40cbd0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0x2d528a1e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x24]
cmp eax, 0x75996cc6
jg 0x40cc10
cmp eax, 0x55223fe2
jg 0x40cc20
cmp eax, 0x9f001f13
jg 0x40cc79
cmp eax, 0x8c40c024
jne 0x40cbd0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0x9f001f14
jmp 0x40cbd0
cmp eax, 0x75996cc7
jne 0x40cbd0
jmp 0x40cbb3
cmp eax, 0x55223fe3
jne 0x40cbd0
mov dword [esp], 0
call fcn.0040cda0
mov dword [esp], eax
call fcn.00416a62
mov eax, dword [ebp - 0x18]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.00404240
mov ecx, dword [ebp - 0x18]
movzx edi, word [ecx + eax*2 - 2]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
neg eax
sub eax, edi
neg eax
mov dword [ebp - 0x1c], eax
mov ecx, 0x1ffeb240
cmp eax, dword [ebp - 0x20]
je 0x40cc71
mov ecx, 0x75996cc7
mov dword [ebp - 0x24], ecx
jmp 0x40cbd0
cmp eax, 0x3da0727e
jg 0x40cc97
cmp eax, 0xad438483
jg 0x40ccae
cmp eax, 0x9f001f14
jne 0x40cbd0
jmp 0x40cd96
cmp eax, 0x3da0727f
jne 0x40cbd0
mov dword [ebp - 0x24], 0x2d528a1e
jmp 0x40cbd0
cmp eax, 0x2d528a1d
jg 0x40ccf8
cmp eax, 0x1ffeb23f
jg 0x40cd0f
cmp eax, 0x1619e50
jg 0x40cd26
cmp eax, 0xb98a000e
jg 0x40cd36
cmp eax, 0xad438484
je 0x40cd60
cmp eax, 0xadc198fb
jne 0x40cd7f
mov eax, 0x1619e51
cmp dword [ebp - 0x10], 0
je 0x40ccf0
mov eax, 0x55223fe3
mov dword [ebp - 0x24], eax
jmp 0x40cbd0
cmp eax, 0x2d528a1e
jne 0x40cbd0
mov dword [ebp - 0x24], 0x8c40c024
jmp 0x40cbd0
cmp eax, 0x1ffeb240
jne 0x40cbd0
mov dword [ebp - 0x24], 0xad438484
jmp 0x40cbd0
cmp eax, 0x1619e51
jne 0x40cbd0
jmp 0x40cbb3
cmp eax, 0xb98a000f
jne 0x40cbd0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4b90f8], eax
call fcn.00416a3f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xad438484
jmp 0x40cbd0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4b90f8], eax
call fcn.00416a3f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x3da0727f
jmp 0x40cbd0
cmp eax, 0xb0db28b5
jne 0x40cbd0
mov dword [ebp - 0x24], 0x8c40c024
jmp 0x40cbd0
mov eax, dword [ebp - 0xc]
add esp, 0x20
pop esi
pop edi
pop ebp
ret
Function at 0x41ea8a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4cc3e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041b8db
mov dword [ebp - 0x14], eax
cmp dword [0x4cdc7c], edi
jne 0x41eb7b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41eb08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41ec5b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41ec5b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41ec5b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4cdc7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4cdc80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4cdc84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cdc8c], eax
test eax, eax
je 0x41eb78
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cdc88], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41eba0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41eb93
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41ebb5
push 4
pop eax
jmp 0x41ec5d
cmp dword [ebp - 0x14], edi
je 0x41ebb5
push dword [0x4cdc7c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41eb9a
mov eax, dword [0x4cdc88]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41ec13
cmp dword [0x4cdc8c], esi
je 0x41ec13
push eax
call ebx
push dword [0x4cdc8c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41ec13
test eax, eax
je 0x41ec13
call ecx
test eax, eax
je 0x41ec08
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41ec08
test byte [ebp - 8], 1
jne 0x41ec13
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41ec43
mov eax, dword [0x4cdc80]
cmp eax, esi
je 0x41ec40
push eax
call ebx
test eax, eax
je 0x41ec40
call eax
mov edi, eax
test edi, edi
je 0x41ec40
mov eax, dword [0x4cdc84]
cmp eax, esi
je 0x41ec40
push eax
call ebx
test eax, eax
je 0x41ec40
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4cdc7c]
call ebx
test eax, eax
je 0x41ec5b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41ec5d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004189e9
leave
ret
Function at 0x405128
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0047be50
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405195
push 0x2a
push 0x4090b02
push 6
call fcn.0047a2f0
add esp, 0xc
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4051a5
push ebx
call fcn.0047a2ea
add esp, 4
cmp dword [ebp - 4], 0
jg 0x4051b6
mov dword [ebp - 4], 0x100
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0047d030
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4051e9
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405222
push 0x125
push 0x4090b02
push 6
call fcn.0047a2f0
add esp, 0xc
push OleUIBusyA
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x405235
mov eax, 0x49d2b0
push eax
push 1
mov ebx, 0x174
call fcn.0047d1a0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40525f
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x49d2b0
push dword [ebp - 8]
call fcn.00401420
add esp, 8
cmp eax, 0
jne 0x40529c
call fcn.004052d4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x405298
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4052b8
push eax
mov ebx, eax
call fcn.00401358
inc eax
push eax
call fcn.0047a2e4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4052bd
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4052ce
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4065e8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push OleUIBusyA
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.0047d0c0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x406632
mov eax, 0
jmp 0x40669b
mov dword [ebp - 0xc], esp
push dword [ebp + 0x24]
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x406671
push 0x100
push 0x409089a
push 6
call fcn.0047a2f0
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp + 0x18], 0
jne 0x40668b
push dword [ebp - 8]
call fcn.00403040
jmp 0x406693
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
jmp 0x40669b
mov esp, ebp
pop ebp
ret 0x24
Function at 0x40cd28
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x40cd58
mov edx, 0xffffffff
mov eax, 0xffffffff
jmp 0x40cd93
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40cd88
push 0xa0
push 0x4090532
push 6
call fcn.0047a2f0
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x40cd93
mov esp, ebp
pop ebp
ret 4

Function at 0x40eb10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x40eb3b
mov eax, 0x49d39c
jmp 0x40ec9d
cmp dword [ebp + 0xc], 0
jg 0x40eb93
mov dword [ebp - 0xc], esp
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40eb7f
push 0xe2
push 0x4090531
push 6
call fcn.0047a2f0
add esp, 0xc
cmp dword [ebp + 0xc], 0
jg 0x40eb93
mov eax, 0x49d39c
jmp 0x40ec9d
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call fcn.0040ecb8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40ebca
mov eax, 0x49d39c
jmp 0x40ec9d
mov dword [ebp - 0xc], esp
push 0
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40ec04
push 0x2a4
push 0x4090531
push 6
call fcn.0047a2f0
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40ec1b
mov eax, 0x49d39c
jmp 0x40ec9d
push 0x80000301
push 0
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.0047cf70
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40ec5a
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040ed48
mov eax, dword [ebp - 8]
test eax, eax
je 0x40ec98
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0047a2e4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40ec9d
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40ecae
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4138c8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x413917
cmp dword [ebp - 8], 0
je 0x413917
xor eax, eax
jmp 0x41391c
mov eax, 1
test eax, eax
je 0x41392e
mov eax, 0
jmp 0x413b71
cmp dword [ebp - 8], 0
jne 0x413a3a
mov dword [ebp - 8], 0x530000
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x49dcd8]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.00401870
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.0047e4a0
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x413991
mov eax, 1
jmp 0x413b71
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x49dce0]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.00401870
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.0047e4a0
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x4139e3
mov eax, 2
jmp 0x413b71
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x49dce8]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.00401870
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.0047e4a0
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x413a35
mov eax, 3
jmp 0x413b71
jmp 0x413b67
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0xa8]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xa4]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jne 0x413a68
mov eax, 4
jmp 0x413b71
cmp dword [ebp - 8], 5
jne 0x413ac2
cmp dword [ebp - 4], 0
jne 0x413a8b
mov eax, 5
jmp 0x413b71
cmp dword [ebp - 4], 1
jne 0x413aa4
mov eax, 6
jmp 0x413b71
cmp dword [ebp - 4], 2
jne 0x413abd
mov eax, 7
jmp 0x413b71
jmp 0x413b67
cmp dword [ebp - 8], 6
jne 0x413b4e
cmp dword [ebp - 4], 0
jne 0x413ae5
mov eax, 8
jmp 0x413b71
cmp dword [ebp - 4], 1
jne 0x413afe
mov eax, 9
jmp 0x413b71
cmp dword [ebp - 4], 2
jne 0x413b17
mov eax, 0xa
jmp 0x413b71
cmp dword [ebp - 4], 3
jne 0x413b30
mov eax, 0xb
jmp 0x413b71
cmp dword [ebp - 4], 4
jne 0x413b49
mov eax, 0xc
jmp 0x413b71
jmp 0x413b67
cmp dword [ebp - 8], 0xa
jne 0x413b67
mov eax, 0xc
jmp 0x413b71
mov eax, 0
jmp 0x413b71
mov esp, ebp
pop ebp
ret
Function at 0x41b394
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x41b3ae
mov dword [ebp + 8], 1
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp + 8]
push 2
mov ebx, 0xc8
call fcn.0047cbf0
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x80000301
push 0
push SysReAllocString
push 0x80000301
push 0
push 3
push 0x80000301
push 0
push 0x20000
push 3
mov ebx, 0xc8
call fcn.0047cbf0
add esp, 0x28
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41b441
push 0xdd
push 0x4090ab7
push 6
call fcn.0047a2f0
add esp, 0xc
jmp 0x41b446
mov esp, ebp
pop ebp
ret 8

Function at 0x41b704
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x41b721
mov eax, 0
jmp 0x41b755
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 4], esp
je 0x41b750
push 0xac
push 0x4090ae9
push 6
call fcn.0047a2f0
add esp, 0xc
jmp 0x41b755
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c8fc
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x41c919
mov eax, 0
jmp 0x41c964
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x41c948
push 0xac
push 0x4090874
push 6
call fcn.0047a2f0
add esp, 0xc
test eax, eax
je 0x41c95a
mov eax, 1
jmp 0x41c964
mov eax, 0
jmp 0x41c964
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41d04c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x49d2b0
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.00401420
add esp, 8
cmp eax, 0
jne 0x41d0b4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0047be50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41d0ae
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
push 0x49d2b0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
call fcn.00401420
add esp, 8
cmp eax, 0
jne 0x41d10c
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0047be50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41d106
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
cmp dword [ebp + 0x1c], 0
jne 0x41d11d
mov dword [ebp + 0x18], 1
mov ebx, dword [ebp + 0x28]
mov eax, dword [ebx]
test eax, eax
je 0x41d13b
push eax
mov ebx, eax
call fcn.00401358
inc eax
push eax
call fcn.0047a2e4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d14c
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x49d2b0
push dword [ebp - 4]
call fcn.00401420
add esp, 8
cmp eax, 0
jne 0x41d183
mov eax, str.open
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d17f
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x49d2b0
mov ebx, dword [ebp + 0x30]
push dword [ebx]
call fcn.00401420
add esp, 8
cmp eax, 0
jne 0x41d1db
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0047be50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 0x30]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41d1d5
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov ebx, dword [ebp + 0x30]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp + 0x18]
mov ebx, dword [ebp + 0x30]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
push dword [ebp + 0x20]
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 8], esp
je 0x41d21c
push 0x35e
push 0x4090a29
push 6
call fcn.0047a2f0
add esp, 0xc
jmp 0x41d221
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d232
push ebx
call fcn.0047a2ea
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x30
Function at 0x462fe4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x463029
push 0x59
push 0x408b654
push 6
call fcn.0047a2f0
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00480560
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46308c
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0047cbf0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x4630ba
push 0xfb
push 0x408b654
push 6
call fcn.0047a2f0
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00480560
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46311d
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0047cbf0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x46314b
push 0x19d
push 0x408b654
push 6
call fcn.0047a2f0
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00480560
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4631ae
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0047cbf0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4631b6
mov esp, ebp
pop ebp
ret
Function at 0x47c920
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00481e00
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x496884
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x47c9e2
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x47c9db
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x47c9c6
lea edx, [esi + 1]
push edx
call fcn.0047bab0
mov edi, eax
add esp, 4
test edi, edi
je 0x47c9b8
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.00482090
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x47c972
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x47c9f5
push eax
call fcn.00482230
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.0047bab0
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x496880
call fcn.00482000
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x47cae0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.0048e7ae
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x47cb4a
push esi
lea edi, [eax + 0x400]
call fcn.0048e7d7
push edi
call fcn.0048e7ae
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x47cb1a
push esi
xor edi, edi
call dword [0x4a2798]
add esp, 4
test eax, eax
je 0x47cb66
push eax
push esi
call fcn.00482290
add esp, 8
mov edi, eax
push esi
call fcn.0048e7d7
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x47cb80
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x47cbe9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0047bab0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x47d400
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret
Function at 0x47e070
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x47e08e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x47e083
pop esi
ret