joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008e96
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10008ebd
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10008ec0
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10008e72
pop esi
leave
ret 8

Function at 0x1000a9c9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10016ca6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100238fe
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10031340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov ebx, str.advapi32.dll
push 0x800
push eax
push ebx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10016d18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10016da0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10016da0
push str.RegisterTraceGuidsW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.1000ad0e
mov dword [esp], str.UnregisterTraceGuids
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.1000ad0e
mov dword [esp], str.TraceEvent
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.1000ad0e
mov dword [esp], str.GetTraceLoggerHandle
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.1000ad0e
mov dword [esp], str.GetTraceEnableLevel
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.1000ad0e
mov dword [esp], str.GetTraceEnableFlags
push edi
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.1000ad0e
pop ecx
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100205a0
Capabilities:
Get process heap force flags

Disassembly:
call fcn.100204d0
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x100205ca
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x100205d6
add eax, 0x78
ret
add eax, 0x88
ret
Function at 0x100205e0
Capabilities:
Get process heap force flags

Disassembly:
call fcn.100204d0
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x1002060a
add eax, 0x7c
ret
add eax, 0x8c
ret

Function at 0x100208a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x10031340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x100208c7
mov ecx, 5
int 0x29
push 2
call fcn.1001fe7b
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x100209d2
test esi, esi
jne 0x100209d2
push 2
call fcn.1001fe7b
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001f4e4
mov esp, ebp
pop ebp
ret
Function at 0x10020fa0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x10031340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1002109b
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x1002109b
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x10020ffa
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x10020fd8
jmp 0x1002109b
cmp edx, 0x200
jae 0x10021101
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x1002109b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x1002109a
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x1002109a
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x100210e3
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x10021080
pop edi
mov eax, dword [0x10033020]
test eax, eax
jne 0x100210c1
push str.setlocale
call fcn.10021ce0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100210bc
or eax, 0xffffffff
mov dword [0x10033020], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x100210ef
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f4e4
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x1002109a
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f4e4
mov esp, ebp
pop ebp
ret
call fcn.1001ffa5
int3

Function at 0x10021420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.10021450
mov esi, dword [ebp + 8]
test al, al
je 0x1002143e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10021460
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10022e60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10022e8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022e8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401c66
pop dword [ebp - 0x2c]
mov eax, 0xba528d83
sub eax, 0xba12711d
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x44b4db5d
add dword [ebp - 0x3c], 0x99d69ee
mov dword [ebp - 0x38], 0x3384cef8
add dword [ebp - 0x38], 0xfeae7d4d
mov dword [ebp - 0x34], 0xf53d6fd0
add dword [ebp - 0x34], 0x570ed45e
mov dword [ebp - 0x30], 0x48ff118f
add dword [ebp - 0x30], 0xb700ee71
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xadc559b8
sub eax, 0xad852964
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xbc82dd5a
add dword [ebp - 0x3c], 0xb7ef8bfc
mov dword [ebp - 0x38], 0x83026b96
sub dword [ebp - 0x38], 0x41960a21
mov dword [ebp - 0x34], 0x80541b8e
add dword [ebp - 0x34], 0xe31b50de
mov dword [ebp - 0x30], 0xba9f3d26
sub dword [ebp - 0x30], 0xba9f3d26
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x4f9670cc
add eax, 0xb0a9bf60
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c0f6
push 0
call eax
mov ecx, 0xd12a198
add ecx, 0xf2edbcb9
xor edi, edi
add edi, eax
mov ebx, 0xfac281ee
sub ebx, 0xfa8211ee
add ebx, dword [ebp - 0x2c]
mov esi, 0xd3f1cce7
mov dword [ebp - 0xc], 0x335f27c8
mov edx, dword [ebx]
add dword [ebp - 0xc], esi
sub edx, esi
xor dword [ebp - 0x1c], esi
mov dword [edi], edx
xor dword [ebp - 0xc], edx
add edi, 0x4fd2b3fe
add edi, 0xb02d4c06
add ebx, 0x672e69f8
add ebx, 0x98d1960c
loop 0x401d84
add eax, 0xa38dc6fd
sub eax, 0xa38c5ae6
xor ebx, ebx
add ebx, eax
add eax, 0x867182ec
sub eax, 0x867182e7
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401920
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x5c
mov eax, dword [0x422f80]
xor eax, esp
mov dword [esp + 0x58], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1548], 0
je 0x4019eb
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
lea edx, [esi + 0x15c4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esi + 0x1504], eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea edx, [esp + 0x14]
push edx
mov eax, edx
push eax
mov ecx, edx
mov edx, dword [esi + 0x1504]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [esi + 0x1504]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x12]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0xe]
push eax
movzx eax, word [esp + 0x10]
push ecx
push edx
push eax
lea ecx, [esp + 0x4c]
push str._02d:_02d:_02d__d
push ecx
call fcn.0040a5fa
add esp, 0x18
mov ecx, dword [esp + 0x5c]
pop esi
xor ecx, esp
call fcn.0040a675
add esp, 0x5c
ret
Function at 0x4036c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov esi, ecx
call fcn.00409000
cmp eax, dword [esi + 0x2004]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
jge 0x4036ed
mov eax, dword [esi + 0x2008]
mov ecx, dword [esi + eax*4 + 4]
push edi
push ecx
call ebx
jmp 0x4036ef
xor eax, eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov ecx, esi
call fcn.00409000
cmp eax, dword [esi + 0x2004]
jge 0x403718
mov edx, dword [esi + 0x2008]
mov eax, dword [esi + edx*4 + 4]
push edi
push eax
call ebx
jmp 0x40371a
xor eax, eax
pop edi
pop esi
pop ebx
mov dword [esp + 4], eax
jmp dword [sym.imp.USER32.dll_UpdateWindow]

Function at 0x403730
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
mov esi, ecx
call fcn.00409000
cmp eax, dword [esi + 0x2004]
jne 0x403750
pop edi
mov eax, 0x41d66e
pop esi
ret 4
push edi
mov ecx, esi
call fcn.00409000
cmp eax, dword [esi + 0x2004]
jge 0x403774
mov eax, dword [esi + 0x2008]
mov ecx, dword [esi + eax*4 + 4]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x403776
xor eax, eax
push 0xff
lea edi, [esi + 0x2010]
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push edi
mov ecx, esi
call fcn.00408f40
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x404aa0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [0x4244ac]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
add ecx, 0x314
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edx, dword [esp]
imul edx, dword [esp + 4]
test edx, edx
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
jge 0x404ae4
fadd qword [0x41d6e0]
mov eax, dword [esp + 8]
fild dword [esp + 8]
test eax, eax
jge 0x404af6
fadd qword [0x41d6e0]
fmulp st(1)
fst qword [0x4244b0]
add esp, 0x10
ret
Function at 0x4071d0
Capabilities:
Accept command line arguments
Create process on windows
Set current directory

Disassembly:
sub esp, 0x258
mov eax, dword [0x422f80]
xor eax, esp
mov dword [esp + 0x254], eax
mov eax, dword [esp + 0x264]
test eax, eax
push ebx
mov ebx, dword [esp + 0x260]
push esi
push edi
mov dword [0x4244b8], ebx
mov dword [0x4244bc], 8
je 0x407218
cmp byte [eax], 0x38
jne 0x407218
mov dword [0x4244bc], 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [esp + 0x60]
mov cl, byte [eax]
mov byte [edx], cl
add eax, 1
add edx, 1
test cl, cl
jne 0x407222
cmp byte [esp + 0x60], 0x22
jne 0x40724c
lea eax, [esp + 0x61]
jmp 0x407240
mov cl, byte [eax]
mov byte [eax - 1], cl
add eax, 1
test cl, cl
jne 0x407240
lea eax, [esp + 0x60]
push 0x22
push eax
call fcn.0040acb0
add esp, 8
test eax, eax
je 0x407262
mov byte [eax], 0
lea ecx, [esp + 0x60]
push 0x5c
push ecx
call fcn.0040ad70
add esp, 8
test eax, eax
je 0x407278
mov byte [eax], 0
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x104
call fcn.0040b694
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
add esp, 4
test esi, esi
je 0x4072c9
push 0x41d658
push str.Trace
call fcn.0040b391
push 0x41d63c
push eax
mov dword [esi], eax
call fcn.0040b3d3
mov eax, dword [esi]
push eax
call fcn.0040ae10
add esp, 0x14
push 0x14
call edi
jmp 0x4072cb
xor esi, esi
cmp dword [0x4244bc], 8
mov dword [0x424508], esi
jne 0x4072ef
push 0
push 0x4060a0
push 0
push str.DEVS8CFG
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, dword [0x4244a8]
test ecx, ecx
je 0x407318
cmp dword [ecx + 0x90], 0
je 0x407318
mov ecx, dword [0x424508]
push 0x41d9d8
call fcn.00403310
mov ecx, dword [0x4244a8]
mov eax, dword [0x4244ac]
test eax, eax
je 0x407330
push eax
call fcn.0040b631
mov ecx, dword [0x4244a8]
add esp, 4
test ecx, ecx
je 0x407344
mov esi, ecx
call fcn.00407410
push esi
call fcn.0040b631
add esp, 4
mov eax, dword [0x424508]
test eax, eax
je 0x407356
push eax
call fcn.0040b631
add esp, 4
cmp dword [0x42450c], 0
je 0x4073b5
push 0x3e8
call edi
push 0x44
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.0040a8b0
add esp, 0xc
mov eax, 1
lea edx, [esp + 0x50]
push edx
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x2c], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x260]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040a675
add esp, 0x258
ret 0x10
Function at 0x4075d0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x41c31b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x422f80]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
push 0x8a8
call fcn.0040b694
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
test esi, esi
mov dword [esp + 0x1c], 0
je 0x407504
mov eax, dword [edi + 0x84]
mov dword [esi + 8], eax
lea eax, [edi + 0x88]
mov ecx, esi
mov dword [esi + 0x850], eax
mov dword [esi], 1
mov dword [esi + 0x8a4], 0
call fcn.00407fb0
jmp 0x407506
xor esi, esi
mov dword [0x424420], esi
cmp dword [esi], 0
mov dword [esp + 0x1c], 0xffffffff
jne 0x407579
mov ecx, dword [edi + 0x84]
push 0x41da0c
push 0x400
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x424420]
test ecx, ecx
je 0x40755b
cmp dword [ecx], 0
mov esi, ecx
je 0x407552
push 1
push str._Normal_Termination
call fcn.00407ef0
push esi
call fcn.0040b631
add esp, 4
mov dword [0x424420], 0
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
lea edx, [esp + 0x10]
push edx
push 0
push edi
push 0x4073e0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [edi + 0x80], eax
nop
push 0x64
call esi
mov eax, dword [0x424420]
cmp dword [eax + 0x31c], 0
je 0x4075a0
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
jmp 0x407490
Function at 0x409970
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push edi
push 0x1000
lea ecx, [esi + 0x2110]
push 0
push ecx
mov dword [esi], vtable.CTRL_BOX.0
mov dword [esi + 0x2004], 0
mov dword [esi + 0x2008], 0
mov dword [esi + 0x200c], 0xffffff9c
mov dword [esi + 0x512c], eax
call fcn.0040a8b0
add esp, 0xc
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
call edi
push 0x80ffff
mov dword [esi + 0x4124], eax
call edi
push 0x41d3d4
push 0
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x258
push 0
push 0
push 0
push 0x10
mov dword [esi + 0x5128], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
idiv dword [esp + 0x40]
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [esi + 0x3120], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x409930
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
pop edi
mov eax, esi
pop esi
ret 8

Function at 0x409974
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push edi
push 0x1000
lea ecx, [esi + 0x2110]
push 0
push ecx
mov dword [esi], vtable.CTRL_BOX.0
mov dword [esi + 0x2004], 0
mov dword [esi + 0x2008], 0
mov dword [esi + 0x200c], 0xffffff9c
mov dword [esi + 0x512c], eax
call fcn.0040a8b0
add esp, 0xc
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
call edi
push 0x80ffff
mov dword [esi + 0x4124], eax
call edi
push 0x41d3d4
push 0
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x258
push 0
push 0
push 0
push 0x10
mov dword [esi + 0x5128], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
idiv dword [esp + 0x40]
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [esi + 0x3120], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x409930
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
pop edi
mov eax, esi
pop esi
ret 8
Function at 0x40a090
Capabilities:
Get common file path

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
push 0x443b18
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0x443b18
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40a0b1
sub eax, edx
cmp eax, 3
jne 0x40a0d0
cmp byte [0x443b1a], 0x5c
jne 0x40a0d0
mov byte [0x443b1a], bl
mov eax, dword [esp + 0x74]
cmp eax, ebx
je 0x40a0ec
mov edx, 0x443b18
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x40a0e0
mov eax, dword [esp + 0x70]
mov esi, eax
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40a0f2
mov edi, 0x443b18
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x40a105
mov ebp, dword [esp + 0x60]
mov edx, dword [esp + 0x68]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x64]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov edi, 0x41d890
mov esi, ebp
mov ecx, 5
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov dword [esp + 0x10], 0x4c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x443b18
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], 0x200
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 0x88002c
mov word [esp + 0x48], bx
mov word [esp + 0x4a], bx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], 0x409f50
mov dword [esp + 0x58], ebx
jne 0x40a1ba
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.comdlg32.dll_GetOpenFileNameA]
jmp 0x40a1be
mov eax, dword [esp + 0x74]
mov edi, 0x41d8cc
mov esi, ebp
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a1db
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.comdlg32.dll_GetSaveFileNameA]
cmp eax, ebx
jne 0x40a1e9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
mov edi, 0x41d8cc
mov esi, ebp
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40a25b
cmp word [esp + 0x4a], bx
mov edi, dword [esp + 0x1c]
jne 0x40a25b
mov esi, dword [esp + 0x28]
lea esi, [esi + esi - 1]
xor eax, eax
cmp esi, ebx
jbe 0x40a227
mov cl, byte [edi]
add edi, 1
test cl, cl
jne 0x40a214
add eax, 1
movzx edx, ax
cmp edx, esi
jb 0x40a214
lea eax, [edi + 1]
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40a230
mov edi, 0x443b18
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x40a243
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov eax, 0x443b18
pop ebx
add esp, 0x4c
ret

Function at 0x40a675
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422f80]
jne 0x40a67f
repz ret
jmp fcn.0040cb1d
Function at 0x410029
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x410056
call fcn.0040caec
mov dword [eax], esi
call fcn.0040cad9
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040ca7a
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x410032
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x410085
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040caff
pop ecx
call fcn.0040cad9
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4100ac
test al, 1
je 0x4100ac
test byte [esp + 0xc], 2
je 0x4100ac
call fcn.0040caec
mov dword [eax], 5
call fcn.0040cad9
mov dword [eax], 0xd
jmp 0x41007c
xor eax, eax
pop esi
ret