joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4623b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4623f0
push esi
push edi
push eax
call fcn.0044fa00
add esp, 4
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4623dc
test al, 0x10
je 0x4623dc
mov esi, 1
jmp 0x4623de
xor esi, esi
test edi, edi
je 0x4623eb
push edi
call fcn.00434080
add esp, 4
pop edi
mov eax, esi
pop esi
ret
xor eax, eax
ret

Function at 0x4627f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x462830
push esi
push edi
push eax
call fcn.0044fa00
add esp, 4
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46281c
test al, 0x50
jne 0x46281c
mov esi, 1
jmp 0x46281e
xor esi, esi
test edi, edi
je 0x46282b
push edi
call fcn.00434080
add esp, 4
pop edi
mov eax, esi
pop esi
ret
xor eax, eax
ret

Function at 0x464ae0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push edi
push dword [esp + 0x10]
xor ebx, ebx
call fcn.0042a580
add esp, 4
mov edi, eax
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
test ebp, ebp
je 0x464b30
lea eax, [ebp*2]
push esi
push eax
call fcn.004340b0
add esp, 4
mov esi, eax
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
call fcn.0042a460
push esi
mov ebx, eax
call fcn.00434080
add esp, 8
pop esi
push edi
call fcn.00434080
add esp, 4
mov eax, ebx
pop edi
pop ebp
pop ebx
ret

Function at 0x464b40
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x18]
call fcn.0042a580
mov ebp, dword [esp + 0x20]
add esp, 4
mov edi, dword [esp + 0x20]
mov esi, eax
mov dword [esp + 0x10], esi
test ebp, ebp
jne 0x464b6b
test edi, edi
jg 0x464b6b
xor ebx, ebx
jmp 0x464b79
lea eax, [edi + edi]
push eax
call fcn.004340b0
add esp, 4
mov ebx, eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
test ebx, ebx
je 0x464bb0
test esi, esi
je 0x464ba7
xor eax, eax
mov word [ebx + edi*2 - 2], ax
lea eax, [edi - 1]
push eax
push ebp
push ebx
call fcn.0042a4f0
add esp, 0xc
push ebx
call fcn.00434080
add esp, 4
push dword [esp + 0x10]
call fcn.00434080
add esp, 4
test esi, esi
jne 0x464bd4
test ebp, ebp
je 0x464bd4
mov eax, esi
test edi, edi
je 0x464bd6
pop edi
pop esi
mov byte [ebp], 0
pop ebp
pop ebx
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x47fd20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0xffffffffffffffff
push dword [esp + 0x18]
push ebx
call fcn.00487e00
mov esi, eax
add esp, 0xc
mov ecx, dword [esi + 0x7c]
or byte [esi + 0x1b], 0x80
mov edi, dword [ecx + 0xc]
mov eax, dword [edi + 0x88]
test eax, eax
je 0x47fd81
test byte [eax + 0x24], 8
jne 0x47fd81
cmp dword [edi + 0x170], 0
jne 0x47fd81
cmp dword [edi + 0x168], 0
jne 0x47fd81
push eax
call fcn.00443a40
add esp, 4
mov dword [edi + 0x168], eax
test eax, eax
jne 0x47fd81
mov dword [edi + 0x170], 1
mov dword [esi + 0xc], 0
mov eax, 0x38e38e39
mov dword [esi + 0x10], 0
mov dword [esi + 0x38], 1
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x14], 0xa0043
mov byte [esi + 0x1a], 0x20
movzx ecx, word [ebx + 0x2e]
sub ecx, 0xc
mov dword [esi + 0x44], 1
imul ecx
push 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push esi
mov word [esi + 0x78], ax
call fcn.00486210
add esp, 8
mov dword [ebx + 0x14], esi
pop edi
pop esi
pop ebx
ret
Function at 0x47fe20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push 0xffffffffffffffff
push dword [esp + 0x1c]
push ebp
call fcn.00487e00
add esp, 0xc
mov esi, eax
cmp dword [esp + 0x10], 0
je 0x47fe43
or byte [esi + 0x1b], 0x80
mov bl, byte [esp + 0x24]
cmp bl, 0x43
jne 0x47fe93
mov eax, dword [esi + 0x7c]
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [edi + 0x88]
test eax, eax
je 0x47fe92
test byte [eax + 0x24], 8
jne 0x47fe92
cmp dword [edi + 0x170], 0
jne 0x47fe92
cmp dword [edi + 0x168], 0
jne 0x47fe92
push eax
call fcn.00443a40
add esp, 4
mov dword [edi + 0x168], eax
test eax, eax
jne 0x47fe92
mov dword [edi + 0x170], 1
pop edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47feb7
push eax
call fcn.0045fdd0
mov dword [esi + 4], eax
push eax
mov eax, dword [esi + 0x7c]
push dword [eax + 0xc]
call fcn.0046d850
add esp, 0xc
mov word [esi + 0x18], ax
mov eax, dword [esp + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x47fed2
push eax
call fcn.0045fdd0
add esp, 4
mov dword [esi + 8], eax
cmp dword [esp + 0x3c], 0
mov eax, dword [esp + 0x30]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x38], eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x20], eax
mov dword [esi + 0x3c], 0
je 0x47ff04
cmp bl, 0x43
jne 0x47ff04
mov eax, 1
jmp 0x47ff06
xor eax, eax
mov cx, word [esp + 0x28]
cmp bl, 0x43
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
movzx eax, bl
mov word [esi + 0x14], ax
setne al
dec al
mov word [esi + 0x16], cx
and al, 0x20
mov dword [esi + 0x34], 0
mov byte [esi + 0x1a], al
mov dword [esi + 0x30], 0
movzx eax, word [ebp + 0x2e]
sub eax, 0xc
movzx ecx, cx
add ecx, 8
cdq
idiv ecx
push dword [esp + 0x44]
mov word [esi + 0x78], ax
push esi
mov dword [esi + 0x44], 1
call fcn.00486210
add esp, 8
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x480240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x480269
push eax
call fcn.00487fa0
mov eax, dword [edi + 0x14]
add esp, 4
cmp dword [eax + 0x44], 0
je 0x480269
push eax
call fcn.00487190
add esp, 4
mov esi, dword [edi + 0x18]
test esi, esi
je 0x480292
push esi
call fcn.00487fa0
add esp, 4
cmp dword [esi + 0x44], 0
je 0x480288
push esi
call fcn.00487190
add esp, 4
mov esi, dword [esi + 0x80]
test esi, esi
jne 0x480270
cmp dword [edi + 0x20], 0
mov esi, dword [edi + 0x3c]
je 0x4802b1
push 0
push 0
push str.hb_cdxIndexFlushAvailPage_on_readonly_database.
push 0x238d
call fcn.0044b600
add esp, 0x10
cmp dword [edi + 0x1c], 0
je 0x4802d3
cmp dword [edi + 0x40], 0
jne 0x4802d3
push 0
push 0
push str.hb_cdxIndexFlushAvailPage_on_not_locked_index_file.
push 0x238e
call fcn.0044b600
add esp, 0x10
lea eax, [edi + 0x48]
push eax
push dword [edi + 8]
push dword [edi + 0xc]
call fcn.00479540
add esp, 0xc
test eax, eax
jne 0x4802fd
push eax
push eax
push str.hb_cdxIndexLockFlush:_flush_lock_failed.
push 0x2395
call fcn.0044b600
add esp, 0x10
mov ebp, dword [edi + 0x38]
test esi, esi
je 0x4803a3
cmp dword [esi + 4], 0
je 0x4803a3
movzx eax, word [edi + 0x2e]
push ebx
push eax
push 0
push eax
call fcn.004340b0
add esp, 4
push eax
call fcn.004a3fe0
add esp, 0xc
mov ebx, eax
nop
mov eax, dword [esi]
mov dword [ebx], eax
cmp dword [edi + 0x28], 0
je 0x480340
movzx ecx, word [edi + 0x30]
jmp 0x480342
xor ecx, ecx
mov eax, ebp
xor edx, edx
call fcn.004a25f0
push edx
push eax
movzx eax, word [edi + 0x2e]
push eax
push ebx
push dword [edi + 8]
call fcn.00441b00
movzx ecx, word [edi + 0x2e]
add esp, 0x14
cmp eax, ecx
je 0x48037c
push 0
push 0
push str.Write_in_index_page_failed.
push 0x3f3
call fcn.0044b600
add esp, 0x10
mov dword [edi + 0x78], 1
mov ebp, dword [esi]
mov dword [esi + 4], 0
mov esi, dword [esi + 8]
test esi, esi
je 0x480399
cmp dword [esi + 4], 0
jne 0x480330
push ebx
call fcn.00434080
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x480730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
cmp dword [esi + 0x20], 0
mov ebp, dword [esi + 8]
mov dword [esp + 0x10], ebp
je 0x48075e
push 0
push 0
push str.hb_cdxIndexGetAvailPage_on_readonly_database.
push 0x238d
call fcn.0044b600
add esp, 0x10
cmp dword [esi + 0x1c], 0
je 0x480780
cmp dword [esi + 0x40], 0
jne 0x480780
push 0
push 0
push str.hb_cdxIndexGetAvailPage_on_not_locked_index_file.
push 0x238e
call fcn.0044b600
add esp, 0x10
mov edi, dword [esi + 0x38]
test edi, edi
je 0x48081a
cmp edi, 0xffffffff
je 0x48081a
mov ebx, dword [esp + 0x20]
test ebx, ebx
jne 0x480822
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4807c5
mov ecx, dword [eax]
mov dword [esi + 0x38], ecx
mov ecx, dword [eax + 8]
push eax
mov dword [esi + 0x3c], ecx
call fcn.00434080
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [esi + 0x28], 0
je 0x4807d1
movzx ecx, word [esi + 0x30]
jmp 0x4807d3
xor ecx, ecx
mov eax, edi
xor edx, edx
call fcn.004a25f0
push edx
push eax
push 4
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.004419e0
add esp, 0x14
cmp eax, 4
je 0x480809
push 0
push 0
push str.hb_cdxIndexGetAvailPage:_Read_index_page_failed.
push 0x3f2
call fcn.0044b600
add esp, 0x10
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x38], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x480828
movzx eax, word [esi + 0x2c]
jmp 0x48082c
movzx eax, word [esi + 0x2e]
mov edi, dword [esi + 0x34]
xor ebp, ebp
movzx eax, ax
mov edx, edi
mov dword [esp + 0x14], eax
cmp edi, 0xffffffff
jne 0x480866
cmp dword [esi + 0x28], ebp
je 0x48084a
movzx edi, word [esi + 0x30]
jmp 0x48084c
xor edi, edi
push dword [esp + 0x10]
call fcn.00441ab0
add esp, 4
mov ecx, edi
call fcn.004a2610
mov edi, eax
mov edx, eax
mov dword [esi + 0x34], edi
movzx eax, word [esi + 0x2e]
mov dword [esp + 0x1c], eax
nop
cmp dword [esi + 0x28], 0
je 0x48087a
xor ecx, ecx
jmp 0x48087e
movzx ecx, word [esi + 0x30]
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0x14]
add edx, eax
mov eax, dword [esp + 0x1c]
add ebp, eax
cmp ebp, ecx
jb 0x480870
mov dword [esi + 0x34], edx
test ebx, ebx
je 0x48093c
cmp ecx, eax
cmovae eax, ecx
push eax
push 0
push eax
mov dword [esp + 0x28], eax
call fcn.004340b0
add esp, 4
push eax
call fcn.004a3fe0
lea ecx, [esi + 0x48]
mov ebp, eax
push ecx
push dword [esi + 8]
push dword [esi + 0xc]
call fcn.00479540
add esp, 0x18
test eax, eax
jne 0x4808e7
push eax
push eax
push str.hb_cdxIndexLockFlush:_flush_lock_failed.
push 0x2395
call fcn.0044b600
add esp, 0x10
cmp dword [esi + 0x28], 0
je 0x4808f3
movzx ecx, word [esi + 0x30]
jmp 0x4808f5
xor ecx, ecx
mov eax, edi
xor edx, edx
call fcn.004a25f0
mov ebx, dword [esp + 0x1c]
push edx
push eax
push ebx
push ebp
push dword [esp + 0x20]
call fcn.00441b00
add esp, 0x14
cmp eax, ebx
je 0x48092c
push 0
push 0
push str.Write_in_index_page_failed.
push 0x3f3
call fcn.0044b600
add esp, 0x10
push ebp
mov dword [esi + 0x78], 1
call fcn.00434080
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x480e30
Capabilities:
Terminate process

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x1c], 0
je 0x480e5d
cmp dword [edi + 0x44], 0
jne 0x480e5d
cmp dword [edi + 0x40], 0
jne 0x480e5d
push 0
push 0
push str.hb_cdxIndexPageRead_on_not_locked_index_file.
push 0x238f
call fcn.0044b600
add esp, 0x10
cmp dword [edi + 0x28], 0
je 0x480e69
movzx ecx, word [edi + 0x30]
jmp 0x480e6b
xor ecx, ecx
mov eax, dword [esp + 0xc]
xor edx, edx
call fcn.004a25f0
push edx
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [edi + 8]
call fcn.004419e0
add esp, 0x14
pop edi
cmp eax, dword [esp + 0x10]
je 0x480eb7
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.hb_cdxIndexPageRead:_Read_index_page_failed.
mov dword [esp + 4], 0x3f2
jmp fcn.0044b600
ret
Function at 0x4840b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
test byte [esi + 0x20], 2
mov eax, dword [esi + 0x40]
mov ebx, dword [esi + 0x10]
movzx eax, word [eax + 0x16]
mov dword [esp + 0x1c], eax
lea ebp, [eax + 8]
jne 0x4840e8
push 0
push 0
push str.hb_cdxPageLeafDelKey:_page_is_not_a_leaf.
push 0x23f1
call fcn.0044b600
add esp, 0x10
test ebx, ebx
js 0x4840f1
cmp ebx, dword [esi + 0xc]
jl 0x484107
push 0
push 0
push str.hb_cdxPageLeafDelKey:_wrong_iKey_index.
push 0x23f1
call fcn.0044b600
add esp, 0x10
mov edi, dword [esi + 0x34]
test edi, edi
jne 0x484129
mov eax, dword [esi + 0xc]
imul eax, ebp
push eax
call fcn.004340b0
mov edi, eax
push edi
push esi
call fcn.00483f10
add esp, 0xc
mov dword [esi + 0x34], edi
lea ecx, [ebx + 1]
imul ecx, ebp
mov dword [esp + 0x18], ecx
movzx eax, word [ecx + edi - 4]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x40]
movzx edx, word [eax + 0x16]
movzx eax, word [ecx + edi - 2]
movzx ecx, byte [esi + 0x1f]
sub ecx, eax
mov eax, dword [esi + 0xc]
sub ecx, dword [esp + 0x14]
dec eax
add ecx, edx
mov dword [esp + 0x10], ecx
cmp ebx, eax
jge 0x4841f6
lea eax, [ebx + 2]
xor ecx, ecx
imul eax, ebp
sub eax, 4
mov dword [esp + 0x28], eax
movzx eax, word [edi + eax]
sub dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
test ebx, ebx
jle 0x4841e3
mov esi, dword [esp + 0x18]
lea eax, [ebx - 1]
mov ecx, dword [esp + 0x14]
imul eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
add eax, edi
movzx eax, word [eax + esi + 6]
mov esi, dword [esp + 0x30]
sub edx, eax
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov dword [esp + 0x1c], edx
cmovb ecx, eax
cmp ecx, edx
jle 0x4841bb
mov ecx, edx
jmp 0x4841e3
jge 0x4841e3
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
lea edx, [edi + esi]
mov edi, dword [esp + 0x1c]
add edx, ecx
sub eax, esi
mov esi, eax
mov al, byte [edx]
cmp al, byte [esi + edx]
jne 0x4841df
inc ecx
inc edx
cmp ecx, edi
jl 0x4841d2
mov esi, dword [esp + 0x30]
mov eax, dword [esi + 0x34]
mov edx, dword [esp + 0x28]
add dword [esp + 0x10], ecx
mov word [edx + eax], cx
mov ecx, dword [esp + 0x10]
mov edi, dword [esi + 0xc]
add word [esi + 0x32], cx
dec edi
movzx eax, word [esi + 0x32]
mov dword [esi + 0xc], edi
cmp edi, ebx
jle 0x48422d
mov eax, dword [esp + 0x18]
sub edi, ebx
add eax, dword [esi + 0x34]
imul edi, ebp
imul ebp, ebx
push edi
add ebp, dword [esi + 0x34]
push eax
push ebp
call fcn.004a3a60
mov edi, dword [esi + 0xc]
add esp, 0xc
movzx eax, word [esi + 0x32]
xor edx, edx
movzx ebp, ax
cmp ebx, edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 1
setge dl
test edi, edi
jne 0x48424e
or edx, 4
jmp 0x484256
test bp, bp
jns 0x484256
or edx, 2
movzx ecx, byte [esi + 0x1f]
mov eax, edx
pop edi
or eax, 8
cmp bp, cx
pop esi
pop ebp
cmovl eax, edx
pop ebx
add esp, 0x1c
ret
Function at 0x49dc30
Capabilities:
Set console window title

Disassembly:
sub esp, 0x24c
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0x248], eax
cmp dword [0x4d5788], 0
jne 0x49dc8a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49dc79
push str.GetConsoleWindow
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d578c], eax
mov dword [0x4d5788], 1
jmp 0x49dc8f
mov eax, dword [0x4d578c]
mov dword [0x4d5788], 1
jmp 0x49dc8f
mov eax, dword [0x4d578c]
push ebx
push esi
push edi
test eax, eax
je 0x49dcb4
call eax
mov ebx, eax
mov ecx, dword [esp + 0x254]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a209e
add esp, 0x24c
ret
push 0x100
lea eax, [esp + 0x58]
xor ebx, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
test eax, eax
je 0x49dc9a
mov dword [esp + 0x14], 0x3e003e
lea esi, [ebx + 2]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
nop dword [eax]
mov eax, 0x4ec4ec4f
mul ecx
shr edx, 3
imul eax, edx, 0x1a
sub ecx, eax
add ecx, 0x41
mov word [esp + esi*2 + 0x14], cx
mov ecx, edx
inc esi
test ecx, ecx
jne 0x49dce0
mov eax, 0x3a
mov word [esp + esi*2 + 0x14], ax
inc esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, 0x4ec4ec4f
lea esi, [esi + 1]
mul edi
shr edx, 3
imul ecx, edx, 0x1a
sub edi, ecx
add edi, 0x41
mov word [esp + esi*2 + 0x12], di
mov edi, edx
test edi, edi
jne 0x49dd11
mov dword [esp + esi*2 + 0x14], 0x3c003c
lea esi, [esi*2 + 4]
cmp esi, 0x40
jae 0x49ddb9
xor eax, eax
mov word [esp + esi + 0x14], ax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
test eax, eax
je 0x49dc9a
push ebp
mov esi, 0xc8
push edi
push esi
call fcn.00463cf0
mov ebp, dword [sym.imp.USER32.dll_FindWindowW]
add esp, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
nop dword [eax]
lea eax, [esp + 0x18]
push eax
push 0
call ebp
mov ebx, eax
test ebx, ebx
jne 0x49dda8
lea eax, [esp + 0x10]
push eax
push edi
push esi
call fcn.00463d40
mov esi, eax
mov edi, edx
mov ecx, esi
add esp, 0xc
or ecx, edi
jne 0x49dd80
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
pop ebp
jmp 0x49dc9a
call fcn.004a1fc4
int3
Function at 0x49fe80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebx
movzx esi, ax
shr esi, 7
push 0x11
and esi, 1
call ebx
mov edi, esi
or edi, 2
and al, 0x80
push 0x12
cmove edi, esi
call ebx
mov esi, edi
or esi, 4
and al, 0x80
push 0x5b
cmove esi, edi
call ebx
mov edi, esi
or edi, 0x4000
and al, 0x80
push 0x5c
cmove edi, esi
call ebx
mov esi, edi
or esi, 0x8000
and al, 0x80
push 0x5d
cmove esi, edi
call ebx
mov edi, esi
or edi, 0x10000
and al, 0x80
push 0x91
cmove edi, esi
call ebx
mov esi, edi
or esi, 0x10
and al, 1
push 0x90
cmove esi, edi
call ebx
mov edi, esi
or edi, 0x20
and al, 1
push 0x14
cmove edi, esi
call ebx
mov esi, edi
or esi, 0x40
and al, 1
push 0x2d
cmove esi, edi
call ebx
mov edi, esi
or edi, 0x80
and al, 1
push 0xa0
cmove edi, esi
call ebx
mov esi, edi
or esi, 0x100
and al, 0x80
push 0xa1
cmove esi, edi
call ebx
mov edi, esi
or edi, 0x200
and al, 0x80
push 0xa2
cmove edi, esi
call ebx
mov esi, edi
or esi, 0x400
and al, 0x80
cmove esi, edi
push 0xa3
call ebx
mov edi, esi
or edi, 0x800
and al, 0x80
push 0xa4
cmove edi, esi
call ebx
mov esi, edi
or esi, 0x1000
and al, 0x80
push 0xa5
cmove esi, edi
call ebx
mov ecx, esi
or ecx, 0x2000
and al, 0x80
pop edi
cmove ecx, esi
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x4a0a70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x65c
push ebx
push ebp
push esi
push edi
mov word [esp + 0x10], 0
mov ebx, 1
mov byte [esp + 0x12], 0
call fcn.0042ef90
push 0x400
push ebx
mov ebp, eax
call fcn.0042a600
add esp, 8
test eax, eax
je 0x4a0c12
push ebx
call fcn.0042a670
push ebx
mov dword [esp + 0x1c], eax
call fcn.0042a6d0
mov edi, eax
add esp, 8
xor esi, esi
test edi, edi
jle 0x4a0ae7
mov ebx, dword [esp + 0x14]
movzx ecx, byte [esi + ebx]
push ecx
push ebp
call fcn.00443a60
mov word [esp + esi*2 + 0x274], ax
add esp, 8
inc esi
cmp esi, edi
jl 0x4a0ac7
mov ebx, 1
xor eax, eax
push 0x24c
push eax
mov dword [esp + esi*2 + 0x274], eax
lea eax, [esp + 0x28]
push eax
call fcn.004a3fe0
add esp, 0xc
mov dword [esp + 0x1c], 0xa0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov dword [esp + 0x14], eax
je 0x4a0b39
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4a0c12
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4d57b4]
test ebx, ebx
je 0x4a0ba2
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x284]
inc esi
push eax
call ebp
xor ebx, ebx
mov dword [0x4d57b4], eax
cmp eax, 0xffffffff
sete bl
jne 0x4a0b8d
cmp esi, 5
je 0x4a0c12
test ebx, ebx
je 0x4a0b9d
push 0x1f4
call edi
mov eax, dword [0x4d57b4]
cmp esi, 5
jl 0x4a0b54
push 0
lea ecx, [esp + 0x1c]
push ecx
push 3
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x10], 0xef
jne 0x4a0be6
cmp byte [esp + 0x11], 0xbb
jne 0x4a0be6
cmp byte [esp + 0x12], 0xbf
jne 0x4a0be6
pop edi
pop esi
pop ebp
mov dword [0x4d57b0], 1
mov eax, 1
pop ebx
add esp, 0x65c
ret
push 0
push 0
push 0
push dword [0x4d57b4]
mov dword [0x4d57b0], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x65c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x65c
ret
Function at 0x4a1980
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test ebx, ebx
je 0x4a19d9
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
and ecx, 0xfffbffff
or ecx, 0x80
push ecx
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x237
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
mov eax, ebx
pop ebx
ret
mov eax, dword [esp + 0x14]
push dword [eax]
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x237
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
je 0x4a1a54
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a1a54
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x4a1a4d
push 0
push 1
push 0
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 3
push 0
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
pop edi
mov eax, ebx
pop ebx
ret
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, ebx
pop ebx
ret

Function at 0x4b6e60
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0x100], eax
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4b6fb7
movzx ecx, byte [esp + 0x10]
shr ecx, 7
movzx eax, byte [esp + 0x11]
mov edx, ecx
or edx, 2
and al, 0x80
movzx eax, byte [esp + 0x12]
cmove edx, ecx
mov ecx, edx
or ecx, 4
and al, 0x80
movzx eax, byte [esp + 0x5b]
cmove ecx, edx
mov edx, ecx
or edx, 0x4000
and al, 0x80
movzx eax, byte [esp + 0x5c]
cmove edx, ecx
mov ecx, edx
or ecx, 0x8000
and al, 0x80
movzx eax, byte [esp + 0x5d]
cmove ecx, edx
mov edx, ecx
or edx, 0x10000
and al, 0x80
movzx eax, byte [esp + 0x91]
cmove edx, ecx
mov ecx, edx
or ecx, 0x10
and al, 1
movzx eax, byte [esp + 0x90]
cmove ecx, edx
mov edx, ecx
or edx, 0x20
and al, 1
movzx eax, byte [esp + 0x14]
cmove edx, ecx
mov ecx, edx
or ecx, 0x40
and al, 1
movzx eax, byte [esp + 0x2d]
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and al, 1
movzx eax, byte [esp + 0xa0]
cmove edx, ecx
mov ecx, edx
or ecx, 0x100
and al, 0x80
movzx eax, byte [esp + 0xa1]
cmove ecx, edx
mov edx, ecx
or edx, 0x200
and al, 0x80
movzx eax, byte [esp + 0xa2]
cmove edx, ecx
mov ecx, edx
or ecx, 0x400
and al, 0x80
movzx eax, byte [esp + 0xa3]
cmove ecx, edx
mov edx, ecx
or edx, 0x800
and al, 0x80
movzx eax, byte [esp + 0xa4]
cmove edx, ecx
mov ecx, edx
or ecx, 0x1000
and al, 0x80
cmove ecx, edx
test byte [esp + 0xa5], 0x80
je 0x4b6fa0
or ecx, 0x2000
mov eax, ecx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.004a209e
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
xor eax, eax
xor ecx, esp
call fcn.004a209e
add esp, 0x104
ret