joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cd0
Capabilities:
Clear file content
Extract resource via kernel32 functions
Query or enumerate registry value
Resume thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_LockResource
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f00
push 0x80000001
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405d53
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f00
push 0x80000002
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405d53
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f1c
push 0x80000001
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x405ddc
xor eax, eax
push ebp
push 0x405dd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405b18
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x405dba
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405f3c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x405dba
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ddc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_ResetEvent
push eax
call sub.KERNEL32.DLL_LoadResource
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405ef6
cmp byte [ebp - 0xd], 0
jne 0x405e23
cmp byte [ebp - 0x12], 0
je 0x405ef6
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetErrorMode
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405e3c
dec ebx
cmp byte [ebx], 0x2e
je 0x405e4b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405e3b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405ef6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405e88
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
jne 0x405ef6
cmp byte [ebp - 0xd], 0
je 0x405ef6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
jne 0x405ef6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406570
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x4065bd
cmp dword [ebx + 4], 0x10000
jge 0x4065b3
push 0x400
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx]
mov eax, dword [eax]
call fcn.00405adc
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404724
jmp 0x4065bd
mov eax, esi
mov edx, dword [ebx + 4]
call fcn.0040482c
add esp, 0x400
pop esi
pop ebx
ret

Function at 0x4065c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40662e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_LoadResource
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004048a4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403108
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406618
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406635
lea eax, [ebp - 0x10]
call fcn.00404634
ret

Function at 0x40924c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.KERNEL32.DLL_CreateThread
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x40ce60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cf36
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004046cc
lea eax, [ebp - 8]
call fcn.00404b44
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404af4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cf20
mov eax, ebx
call fcn.004027a4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cf19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404af4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cf03
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cf48
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cf03
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf20
mov eax, dword [ebp - 0x10]
call fcn.004027c4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf3d
lea eax, [ebp - 8]
call fcn.00404634
ret
Function at 0x421afc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x421b02
ret

Function at 0x42e800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42e9b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404ce4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x42e9c8
call fcn.00404940
mov eax, ebx
call fcn.0041f990
mov edi, eax
dec edi
test edi, edi
jl 0x42e8b8
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041f964
mov edx, dword [0x436fc0]
call fcn.004039ec
test al, al
je 0x42e8b4
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041f964
lea edx, [ebp - 0x14]
call fcn.00446210
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404ce4
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004049b4
inc esi
dec edi
jne 0x42e866
mov al, byte [0x42e9cc]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x42e9d8
mov eax, dword [ebp - 0xc]
call fcn.0040dad8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004046cc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00446210
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x42e9c8
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00446210
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x42e9c8
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x42e9c8
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x42e9e4
call fcn.00409bc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e9b8
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404658
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404658
lea eax, [ebp - 0x14]
call fcn.00404634
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404658
ret
Function at 0x47e304
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47e332
mov eax, ebx
call fcn.0047edb8
cmp dword [ebx + 0x40], 0
je 0x47e32b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47e3a3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47e395
cmp dword [ebx + 8], 0
je 0x47e354
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47e366
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47e395
cmp dword [ebx + 8], 0
je 0x47e347
cmp eax, 3
je 0x47e379
dec eax
jne 0x47e347
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47e347
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47e347
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47e3c1
cmp dword [ebx + 0x14], 0xcc
je 0x47e3c1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047e3cc
pop ebx
ret
Function at 0x48fce8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48fcf0
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48fee2
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x48fef8
mov eax, esi
call fcn.004761bc
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404688
lea ecx, [ebp - 0x10]
mov edx, 0x48ff0c
mov eax, esi
call fcn.004761bc
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404688
lea ecx, [ebp - 0x14]
mov edx, 0x48ff24
mov eax, esi
call fcn.004761bc
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404688
lea ecx, [ebp - 0x18]
mov edx, 0x48ff40
mov eax, esi
call fcn.004761bc
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404688
lea ecx, [ebp - 0x1c]
mov edx, 0x48ff5c
mov eax, esi
call fcn.004761bc
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404688
lea ecx, [ebp - 0x24]
mov edx, 0x48ff74
mov eax, esi
call fcn.004761bc
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408a1c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408f64
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x48ff8c
mov eax, esi
call fcn.004761bc
mov eax, dword [ebp - 0x28]
call fcn.0046f818
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x48ff9c
mov eax, esi
call fcn.004761bc
mov eax, dword [ebp - 0x2c]
call fcn.0046f818
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x48ffb4
mov eax, esi
call fcn.004761bc
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408f64
inc eax
je 0x48fe85
lea ecx, [ebp - 0x34]
mov edx, 0x48ffb4
mov eax, esi
call fcn.004761bc
mov eax, dword [ebp - 0x34]
call fcn.00408f28
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a494
fstp qword [ebp - 0x3c]
wait
call fcn.0040a7f8
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x48fea0
lea ecx, [ebp - 0x40]
mov edx, 0x48ffb4
mov eax, esi
call fcn.004761bc
mov eax, dword [ebp - 0x40]
call fcn.0046f818
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x48ffc4
mov eax, esi
call fcn.004761bc
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fee9
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404658
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404658
ret

Function at 0x49dca4
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 7
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x49dcc0
mov al, 1
pop edx
ret
xor eax, eax
pop edx
ret
Function at 0x4d1afc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4fa180
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4d1b1e
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d1b20
shr eax, 1
dec edx
jne 0x4d1b0c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4d1b05
mov byte [0x4fa580], 1
pop esi
pop ebx
ret

Function at 0x4d1b3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4fa580], 0
jne 0x4d1b53
call fcn.004d1afc
mov eax, edi
dec eax
test eax, eax
jl 0x4d1b7c
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4fa180]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4d1b5d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4d45dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4d460d
dec al
je 0x4d4649
dec al
je 0x4d468d
dec al
je 0x4d46f8
jmp 0x4d4782
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4d4782
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d461d
jmp 0x4d4782
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d4782
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d4659
jmp 0x4d4782
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d4782
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4d46bb
xor ebp, ebp
jmp 0x4d46cc
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4d46d5
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d469d
jmp 0x4d4782
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d4782
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4d4750
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004d1b84
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d470c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4010fc
Capabilities:
Read file on windows

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, 0x4065d0
cmp dword [ebx], 0
jne 0x401163
push 0x644
push 0
call sub.KERNEL32.DLL_ReadFile
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x401128
xor eax, eax
mov dword [esp], eax
jmp 0x401178
mov eax, dword [esp + 8]
mov edx, dword [0x4065cc]
mov dword [eax], edx
mov eax, dword [esp + 8]
mov dword [0x4065cc], eax
xor eax, eax
mov edx, eax
add edx, edx
mov ecx, dword [esp + 8]
lea edx, [ecx + edx*8 + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 4]
mov ecx, dword [ebx]
mov dword [edx], ecx
mov edx, dword [esp + 4]
mov dword [ebx], edx
inc eax
cmp eax, 0x64
jne 0x40113f
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [ebx], eax
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop ebx
ret

Function at 0x4019dc
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp byte [0x4065ac], 0
je 0x401ad7
xor eax, eax
push ebp
push 0x401ad0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x406035], 0
je 0x401a10
push 0x4065b4
call sub.KERNEL32.DLL_WritePrivateProfileStringA
mov byte [0x4065ac], 0
mov eax, dword [0x40660c]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
xor eax, eax
mov dword [0x40660c], eax
mov eax, dword [0x4065d4]
mov dword [ebp - 8], eax
jmp 0x401a4e
push 0x8000
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, 0x4065d4
cmp eax, dword [ebp - 8]
jne 0x401a33
mov eax, 0x4065d4
call fcn.00401180
mov eax, 0x4065e4
call fcn.00401180
mov eax, 0x406610
call fcn.00401180
mov eax, dword [0x4065cc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401aa5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x4065cc], eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, dword [0x4065cc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401ad7
cmp byte [0x406035], 0
je 0x401ac5
push 0x4065b4
call sub.KERNEL32.DLL_lstrcmpiA
push 0x4065b4
call sub.KERNEL32.DLL_lstrlenA
ret
pop ecx
pop ecx
pop ebp
ret

Function at 0x402c6c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402d04
push 0x80000002
call sub.user32.dll_GetAsyncKeyState
test eax, eax
jne 0x402ce4
xor eax, eax
push ebp
push 0x402cdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402d20
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ce4
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowA
ret
mov ax, word [0x40500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40500c], ax
mov esp, ebp
pop ebp
ret
Function at 0x40336c
Capabilities:
Get file size

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x4033cd
cmp word [0x406208], 0xd7b2
jne 0x403395
cmp dword [0x406210], 0
jbe 0x403395
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405054
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_FindFirstFileA
push eax
call sub.KERNEL32.DLL_GetFileSize
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4033f4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_FindFirstFileA
push eax
call sub.KERNEL32.DLL_GetFileSize
pop edx
ret
cmp byte [0x405018], 0
jne 0x4033e9
push 0
push 0x40504c
push 0x405054
push 0
call sub.user32.dll_SendDlgItemMessageA
pop edx
ret

Function at 0x403a2c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403a92
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403620
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b60
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403a7c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a99
lea eax, [ebp - 0x10]
call fcn.004034f0
ret

Function at 0x404364
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, edx
mov ebx, eax
xor edi, edi
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
mov eax, ebx
call fcn.00403838
push eax
call fcn.00403d60
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4043c0
push 0
lea eax, [esp + 4]
push eax
mov eax, esi
call fcn.00403638
push eax
mov eax, esi
call fcn.00403838
push eax
push ebx
call sub.KERNEL32.DLL_GetCommandLineA
push ebx
call sub.KERNEL32.DLL_RtlUnwind
push ebx
call fcn.00403d58
or edi, 0xffffffff
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x404718
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
call fcn.004046f4
test al, al
je 0x40477c
push 0x104
lea eax, [esp + 0x109]
push eax
mov eax, esi
call fcn.00403838
push eax
call fcn.00403db8
push 0x104
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.00403838
push eax
call fcn.00403db8
push 0x40479c
lea eax, [esp + 0x109]
push eax
lea eax, [esp + 8]
push eax
push 0x4047a8
call sub.KERNEL32.DLL_GetLocaleInfoA
jmp 0x404793
push 5
mov eax, ebx
call fcn.00403838
push eax
mov eax, esi
call fcn.00403838
push eax
call sub.KERNEL32.DLL_GetStdHandle
add esp, 0x20c
pop esi
pop ebx
ret