joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da60f
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x6a1360
call fcn.004cfddc
xor esi, esi
cmp dword [0x6fadac], esi
jne 0x4da653
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4da63e
mov dword [0x6fadac], edi
jmp 0x4da653
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4da653
mov dword [0x6fadac], 2
mov eax, dword [0x6fadac]
cmp eax, 2
je 0x4da734
cmp eax, esi
je 0x4da734
cmp eax, 1
jne 0x4da698
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x4da681
mov eax, dword [0x6faafc]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x4da69f
xor eax, eax
jmp 0x4da746
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.004ccea0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x4da6d5
cmp edi, esi
jne 0x4da6f0
lea eax, [ebx + ebx]
push eax
call fcn.004cb917
pop ecx
mov edi, eax
cmp edi, esi
je 0x4da698
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4da723
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x4da70d
push esi
push esi
jmp 0x4da713
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x4da72f
push edi
call fcn.004cb3f4
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x4da746
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.004cfe17
ret
Function at 0x4db89b
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x4db8b4
or eax, 0xffffffff
jmp 0x4db915
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x4db911
push 0x3d
push esi
call fcn.004dbbdd
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4db911
cmp esi, eax
je 0x4db911
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x6fa904]
sete cl
cmp eax, dword [0x6fa908]
mov dword [ebp - 4], ecx
jne 0x4db8f7
mov edi, eax
call fcn.004db83a
mov dword [0x6fa904], eax
cmp eax, ebx
jne 0x4db950
cmp dword [ebp + 0xc], ebx
je 0x4db919
cmp dword [0x6fa90c], ebx
je 0x4db919
call fcn.004da7ff
test eax, eax
je 0x4db950
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
je 0x4db922
xor eax, eax
jmp 0x4db914
push 4
call fcn.004cb917
cmp eax, ebx
pop ecx
mov dword [0x6fa904], eax
je 0x4db911
mov dword [eax], ebx
cmp dword [0x6fa90c], ebx
jne 0x4db950
push 4
call fcn.004cb917
cmp eax, ebx
pop ecx
mov dword [0x6fa90c], eax
je 0x4db911
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
mov ebx, dword [0x6fa904]
sub edi, esi
push esi
call fcn.004db7ed
mov edi, eax
test edi, edi
pop ecx
jl 0x4db9b7
cmp dword [ebx], 0
je 0x4db9b7
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.004cb3f4
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x4db997
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4db9f8
mov ecx, dword [esi + 4]
inc edi
mov dword [esi], ecx
lea esi, [ebx + edi*4]
cmp dword [esi], eax
jne 0x4db98e
mov eax, edi
shl eax, 2
push eax
push dword [0x6fa904]
call fcn.004d4c74
test eax, eax
mov esi, dword [ebp - 8]
pop ecx
pop ecx
je 0x4db9f8
jmp 0x4db9f3
cmp dword [ebp - 4], 0
jne 0x4dba5f
test edi, edi
jge 0x4db9c7
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x6fa904]
call fcn.004d4c74
test eax, eax
pop ecx
pop ecx
je 0x4db911
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
and dword [ecx], 0
mov dword [0x6fa904], eax
cmp dword [ebp + 0xc], 0
je 0x4dba4a
push esi
call fcn.004ccb20
inc eax
inc eax
push eax
call fcn.004cb917
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4dba4a
push esi
push edi
call fcn.004cbdc0
mov eax, edi
sub eax, esi
add eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov byte [eax], 0
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4dba43
or dword [ebp - 0x10], 0xffffffff
push edi
call fcn.004cb3f4
pop ecx
cmp dword [ebp - 4], 0
je 0x4dba57
push esi
call fcn.004cb3f4
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x4db914
push esi
call fcn.004cb3f4
mov eax, dword [ebp + 8]
and dword [eax], 0
pop ecx
jmp 0x4db91e
Function at 0x4dc900
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [0x708fd4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4dc922
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x4dc926
call dword [sym.imp.USER32.dll_CloseClipboard]
or eax, 0xffffffff
ret
push esi
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, dword [esp + 0xc]
test edi, edi
mov esi, eax
push esi
jne 0x4dc951
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, eax
add esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
xor eax, eax
pop esi
ret

Function at 0x4dc980
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [0x708fd4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4dc9db
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
xor eax, eax
pop esi
ret
Function at 0x4de7a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
jne 0x4de7ad
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
cmp ecx, eax
jne 0x4de7c8
mov dword [esi + 0x10], 1
pop esi
xor eax, eax
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x18]
mov edx, ebp
imul edx, ebx
add edx, ecx
cmp edx, eax
jbe 0x4de7e0
sub eax, ecx
xor edx, edx
div ebp
mov ebx, eax
test ebx, ebx
jne 0x4de7f1
mov dword [esi + 0x10], 1
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esi + 4], 1
push edi
jne 0x4de858
mov eax, dword [esi + 0x2c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x2c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov edi, ebp
imul edi, ebx
push eax
mov dword [esi + 0x30], 2
mov dword [esi + 0x140], ecx
mov dword [esi + 0x144], edx
mov dword [esi + 0x148], edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [esi + 0xc], 0
jne 0x4de84f
mov edx, dword [esi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, edi
mov eax, 1
jmp 0x4de877
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
mov edi, ebp
imul edi, ebx
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x18]
add dword [esi + 0x14], edi
test eax, eax
pop edi
je 0x4de7eb
pop ebx
mov eax, ecx
xor edx, edx
pop esi
div ebp
pop ebp
ret
Function at 0x4df010
Capabilities:
Delete file

Disassembly:
sub esp, 0x98
cmp dword [0x70a2b0], 1
je 0x4df1b8
cmp dword [0x70a3b8], 1
push esi
jne 0x4df15e
lea eax, [esp + 4]
push eax
call fcn.004dd0c0
add esp, 4
push 0x6a15cc
push 0x70a3bc
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push 0xa
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.004dc2e0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x70a3bc
call esi
push 0x69f2e0
push 0x70a3bc
call esi
mov edx, dword [esp + 8]
push 0xa
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.004dc2e0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x70a3bc
call esi
push 0x69f2e0
push 0x70a3bc
call esi
mov edx, dword [esp + 0xc]
push 0xa
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.004dc2e0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x70a3bc
call esi
push 0x69f2e0
push 0x70a3bc
call esi
mov edx, dword [esp + 0x10]
push 0xa
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.004dc2e0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x70a3bc
call esi
push 0x69f2e0
push 0x70a3bc
call esi
mov edx, dword [esp + 0x14]
push 0xa
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.004dc2e0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x70a3bc
call esi
push 0x69f2e0
push 0x70a3bc
call esi
push 0xa
lea ecx, [esp + 0x20]
push ecx
mov edx, dword [esp + 0x20]
push edx
call fcn.004dc2e0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x70a3bc
call esi
push str..txt
push 0x70a3bc
call esi
jmp 0x4df16e
push str.Log.txt
push 0x70a3bc
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x70a3bc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
push 0x70a3bc
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, esi
je 0x4df1a0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x709b30], esi
mov dword [0x709b34], esi
call dword [0x7090b0]
mov dword [0x7144bc], eax
pop esi
xor eax, eax
add esp, 0x98
ret

Function at 0x4e03a0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4e03c2
xor eax, eax
add esp, 0x208
ret
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax - 1], 0x5c
je 0x4e03dc
mov byte [esp + eax], 0x5c
mov byte [esp + eax + 1], 0
lea edx, [esp + 0x104]
push edx
push 0
push 0x6a161c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4e03b9
push esi
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x110]
push edx
call fcn.004dedc0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x4e0448
pop esi
add esp, 0x208
ret
mov eax, dword [esp + 0x210]
test eax, eax
je 0x4e045f
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop esi
add esp, 0x208
ret
Function at 0x4e5100
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.004e16a0
push 0x69deb4
call fcn.004e16a0
add esp, 8
call fcn.004e4e20
cmp dword [0x71d690], 1
jne 0x4e5167
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x71d690], 0
mov esi, 0x715694
lea esp, [esp]
mov eax, dword [esi]
test eax, eax
je 0x4e5149
push eax
call edi
mov dword [esi], 0
add esi, 8
cmp esi, 0x71d694
jl 0x4e5140
push 0x71d698
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4eb0f0
Capabilities:
Enumerate pe sections

Disassembly:
cmp dword [0x71dfb8], 1
push ebx
push ebp
push esi
push edi
jne 0x4eb117
xor eax, eax
cmp dword [0x71df6c], 0x10
sete al
add eax, 0x16
push eax
call fcn.004e8f70
add esp, 4
jmp 0x4eb130
xor ecx, ecx
cmp dword [0x71df6c], 0x10
push 0
setne cl
push 0
push ecx
call fcn.0052af70
add esp, 0xc
mov ebp, dword [esp + 0x14]
mov esi, eax
movzx ecx, byte [esi + 5]
mov eax, dword [esi + 0xc]
and eax, ebp
mov edi, 1
shl edi, cl
movzx ecx, byte [esi + 6]
mov ebx, 1
shl ebx, cl
movzx ecx, byte [esi + 8]
shr eax, cl
mov ecx, 1
mov edx, ecx
movzx ecx, byte [esi + 4]
imul eax, eax, 0xff
shl edx, cl
sub edi, 1
sub ebx, 1
sub edx, 1
mov ecx, edx
xor edx, edx
div ecx
mov edx, dword [esp + 0x18]
mov dword [edx], eax
movzx ecx, byte [esi + 9]
mov eax, dword [esi + 0x10]
and eax, ebp
shr eax, cl
xor edx, edx
mov ecx, dword [esp + 0x1c]
imul eax, eax, 0xff
div edi
xor edx, edx
pop edi
mov dword [ecx], eax
mov eax, dword [esi + 0x14]
movzx ecx, byte [esi + 0xa]
and eax, ebp
shr eax, cl
pop esi
pop ebp
imul eax, eax, 0xff
div ebx
mov edx, dword [esp + 0x14]
pop ebx
mov dword [edx], eax
xor eax, eax
ret
Function at 0x510db0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
push ebp
mov ebx, 1
xor ebp, ebp
cmp byte [0x8f1d00], bl
jne 0x510dd2
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret
cmp dword [0x8ed230], ebx
push esi
push edi
mov byte [0x8f1d00], bl
je 0x510ee3
cmp dword [0x8f1ce8], ebx
je 0x510ee3
cmp dword [0x8ed248], ebp
je 0x510ee3
cmp dword [0x8ed238], ebp
jne 0x510e16
cmp dword [0x714498], 0x108
jge 0x510ee3
call dword [0x7090b0]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
cmp dword [0x8ed250], esi
jne 0x510e3e
mov eax, dword [0x8ed24c]
push 0
push eax
call edi
test eax, eax
jne 0x510f99
call fcn.004e41d0
test eax, eax
jne 0x510f99
cmp dword [0x8ed240], ebp
je 0x510f99
mov eax, dword [0x8ed248]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push 0x8ed254
push 0x100
push eax
call edx
test eax, eax
je 0x510ea6
mov eax, dword [0x8ed248]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push eax
call edx
test eax, eax
jne 0x510f99
mov eax, dword [0x8ed248]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push 0x8ed254
push 0x100
push eax
call edx
test eax, eax
jne 0x510f99
mov eax, dword [0x8ed24c]
push 0
push eax
mov dword [0x8ed250], esi
call edi
test eax, eax
jne 0x510ec7
mov ecx, dword [0x8ed24c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov al, byte [esp + 0xb1]
mov byte [0x8ed28a], al
jmp 0x510f97
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x71568c]
jne 0x510f99
call dword [0x7090b0]
cmp dword [0x8ed250], eax
je 0x510f99
mov dword [0x8ed250], eax
call fcn.004e41d0
test eax, eax
jne 0x510f99
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0x100
push 0
push 0x8ed254
call fcn.004dc0b0
add esp, 0xc
xor eax, eax
mov edx, 0x41
xor ecx, ecx
movzx ecx, word [ecx + 0x6a905a]
movzx edx, dx
mov dl, byte [esp + edx + 0x10]
mov byte [ecx + 0x8ed254], dl
add eax, ebx
lea ecx, [eax + eax*2]
movzx edx, word [ecx + ecx + 0x6a9058]
add ecx, ecx
cmp dx, 0xffff
jne 0x510f41
mov al, byte [esp + 0x11]
mov cl, byte [esp + 0x12]
mov dl, byte [esp + 0x14]
shr al, 7
shr cl, 7
shr dl, 7
mov byte [0x8ef360], al
mov byte [0x8ef361], cl
mov byte [0x8ef362], dl
mov dword [0x8ef35c], ebx
mov ebp, ebx
pop edi
pop esi
mov eax, ebp
pop ebp
mov byte [0x8f1d00], 0
pop ebx
add esp, 0x100
ret
Function at 0x5115b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x114
cmp dword [0x8ed230], 1
je 0x511681
mov eax, dword [0x8ed244]
test eax, eax
je 0x511681
cmp dword [0x8ed238], 0
jne 0x5115e9
cmp dword [0x714498], 0x108
jge 0x511681
mov ecx, dword [eax]
lea edx, [esp]
push edx
push 0x14
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
je 0x51162c
mov eax, dword [0x8ed244]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push eax
call edx
test eax, eax
jne 0x511623
mov eax, dword [0x8ed244]
mov ecx, dword [eax]
lea edx, [esp]
push edx
push 0x14
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
je 0x51162c
xor eax, eax
add esp, 0x114
ret
mov ecx, 0x80
xor eax, eax
test byte [esp + 0xc], cl
je 0x51163c
lea eax, [ecx - 0x7f]
test byte [esp + 0xd], cl
je 0x511645
or eax, 2
test byte [esp + 0xe], cl
je 0x51164e
or eax, 4
test byte [esp + 0xf], cl
je 0x511657
or eax, 8
test byte [esp + 0x10], cl
je 0x511660
or eax, 0x10
test byte [esp + 0x11], cl
je 0x511669
or eax, 0x20
test byte [esp + 0x12], cl
je 0x511672
or eax, 0x40
test byte [esp + 0x13], cl
je 0x5116e0
or eax, ecx
add esp, 0x114
ret
call fcn.00510db0
cmp dword [0x8ef35c], 1
jne 0x5116b3
xor eax, eax
cmp byte [0x8ef360], al
je 0x51169e
mov eax, 1
cmp byte [0x8ef361], 0
je 0x5116aa
or eax, 2
cmp byte [0x8ef362], 0
jmp 0x5116db
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, 0x80
xor eax, eax
test byte [esp + 0x15], cl
je 0x5116ce
lea eax, [ecx - 0x7f]
test byte [esp + 0x16], cl
je 0x5116d7
or eax, 2
test byte [esp + 0x18], cl
je 0x5116e0
or eax, 4
add esp, 0x114
ret

Function at 0x512da0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x34
cmp dword [0x91a304], 0
jne 0x512db3
or eax, 0xffffffff
add esp, 0x34
ret
push 4
lea eax, [esp + 8]
push 0x6a9900
push eax
mov word [esp + 0x24], 1
mov word [esp + 0x26], 2
mov dword [esp + 0x28], 0xac44
mov word [esp + 0x32], 0x10
mov word [esp + 0x30], 4
mov dword [esp + 0x2c], 0x2b110
mov word [esp + 0x34], 0
call fcn.004dc130
movzx ecx, word [esp + 0x30]
imul ecx, dword [0x91a308]
push 4
lea edx, [esp + 0x1c]
add ecx, 0x26
push 0x6a98f8
push edx
mov dword [esp + 0x20], ecx
call fcn.004dc130
push 4
lea eax, [esp + 0x2c]
push 0x6a98f0
push eax
call fcn.004dc130
push 4
lea ecx, [esp + 0x52]
push 0x6a98e8
push ecx
mov dword [esp + 0x44], 0x12
call fcn.004dc130
movzx edx, word [esp + 0x54]
imul edx, dword [0x91a308]
mov eax, dword [0x91a30c]
add esp, 0x30
push 0
push 0
push 0
push eax
mov dword [esp + 0x3e], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x91a30c]
push 0
lea ecx, [esp + 4]
push ecx
push 0x2e
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x91a30c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x91a30c], 0
mov dword [0x91a304], 0
xor eax, eax
add esp, 0x34
ret
Function at 0x515930
Capabilities:
Delete file

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x8f2264], ebx
jne 0x515940
or eax, 0xffffffff
pop ebx
ret
mov ecx, dword [esp + 8]
test ecx, ecx
push esi
js 0x5159f3
mov eax, ecx
and eax, 0x78000000
cmp eax, 0x40000000
jne 0x5159f3
mov eax, ecx
and eax, 0xffff
cmp eax, 0x100
jge 0x5159f3
mov esi, dword [eax*4 + 0x8f1d08]
cmp esi, ebx
je 0x5159f3
mov edx, dword [esi]
shl edx, 0x10
and ecx, 0x7ff0000
cmp edx, ecx
jne 0x5159f3
mov eax, dword [0x8f22dc]
sub eax, ebx
mov dword [0x8f2224], ebx
je 0x5159b8
sub eax, 1
jne 0x5159ce
mov eax, dword [0x8f225c]
mov edx, dword [esi + 0x14]
mov ecx, dword [eax]
push ebx
push ebx
push ebx
push edx
push eax
mov eax, dword [ecx + 0xb8]
call eax
jmp 0x5159ce
push edi
call fcn.00513480
mov edi, 5
call fcn.004e41d0
sub edi, 1
jne 0x5159c3
pop edi
cmp dword [0x8f2230], 1
jne 0x5159e8
push 0x8f211c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x8f2230], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
pop esi
xor eax, eax
pop ebx
ret
pop esi
or eax, 0xffffffff
pop ebx
ret
Function at 0x518500
Capabilities:
Delete file

Disassembly:
push esi
xor esi, esi
cmp dword [0x8f2264], esi
jne 0x518510
or eax, 0xffffffff
pop esi
ret
cmp dword [0x91a320], esi
je 0x518549
mov dword [0x91a328], 1
call fcn.004e41d0
test eax, eax
jne 0x518549
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x91a328], 1
jne 0x518548
push 2
call edi
call fcn.004e41d0
test eax, eax
je 0x518532
pop edi
call fcn.00512da0
push esi
call fcn.00517970
add esp, 4
call fcn.00515850
call fcn.005158a0
call fcn.00516150
push 0x8f211c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x8f2240
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x8f22dc]
sub eax, esi
je 0x5185f2
sub eax, 1
jne 0x5185fc
mov eax, dword [0x8f225c]
cmp eax, esi
je 0x5185c2
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push esi
push esi
push esi
push esi
push eax
call edx
mov eax, dword [0x8f225c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push eax
call edx
mov eax, dword [0x8f225c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x8f225c], esi
mov eax, dword [0x8f2258]
cmp eax, esi
je 0x5185d9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x8f2258], esi
mov eax, dword [0x8f2260]
cmp eax, esi
je 0x5185fc
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x8f2260], esi
jmp 0x5185fc
mov dword [0x8f22d4], 0xffffffff
mov eax, dword [0x8f2268]
cmp eax, esi
je 0x518620
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push eax
call edx
mov eax, dword [0x8f2268]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x8f2268], esi
mov eax, dword [0x8f22d8]
cmp eax, esi
je 0x518644
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push eax
call edx
mov eax, dword [0x8f22d8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x8f22d8], esi
mov eax, dword [0x8f226c]
cmp eax, esi
je 0x51865b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x8f226c], esi
mov eax, dword [0x8f2264]
cmp eax, 1
jbe 0x51866d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [0x8f2270]
cmp eax, esi
mov dword [0x8f2264], esi
je 0x5186b9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x8f2270], esi
mov dword [0x8f2278], esi
mov dword [0x8f2274], esi
mov dword [0x8f227c], esi
mov dword [0x8f2280], esi
mov dword [0x8f2284], esi
mov dword [0x8f2288], esi
mov dword [0x8f228c], esi
mov dword [0x8f2290], esi
push 0x6a9e30
call fcn.004e16a0
add esp, 4
xor eax, eax
pop esi
ret
Function at 0x519480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, 0xd5555555
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
lea eax, [eax + eax*2]
push esi
lea ecx, [ecx + eax*4]
push edi
mov dword [ebp + 8], ecx
mov edi, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
cmp eax, 0xc
jb 0x519505
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x5194de
mov edx, dword [ebp - 4]
mov bl, byte [esi + eax]
xor byte [edi], bl
inc eax
inc edi
dec edx
cmp eax, 0xc
jb 0x5194c4
xor ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 4], edx
cmp edx, 0xc
jb 0x519505
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 0xc
div ecx
mov dword [ebp - 4], edx
mov ecx, eax
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov edx, dword [esi + 8]
xor dword [edi], eax
xor dword [edi + 4], ebx
xor dword [edi + 8], edx
add edi, 0xc
dec ecx
jne 0x5194f7
mov edx, dword [ebp - 4]
cmp edx, 0
je 0x519521
mov eax, dword [ebp + 8]
mov bl, byte [esi + eax]
xor byte [edi], bl
inc eax
cmp eax, 0xc
jne 0x51951d
xor eax, eax
inc edi
dec edx
jne 0x519510
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret