joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455f79
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
push 0x38
pop eax
mov ecx, dword [esi + 8]
and ecx, 0x3f
mov byte [ecx + esi + 0x40], 0x80
inc ecx
cmp ecx, eax
jbe 0x455fc3
push 0x40
pop edx
cmp ecx, edx
je 0x455fae
sub edx, ecx
lea eax, [esi + 0x40]
push edx
add eax, ecx
push 0
push eax
call fcn.00433480
add esp, 0xc
lea ebp, [esi + 0x40]
lea edi, [esi + 0x20]
mov edx, ebp
push 1
mov ecx, edi
call dword [esi]
push 0x38
xor ecx, ecx
pop eax
jmp 0x455fc9
lea ebp, [esi + 0x40]
lea edi, [esi + 0x20]
sub eax, ecx
push eax
lea eax, [esi + 0x40]
add eax, ecx
push 0
push eax
call fcn.00433480
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, ebp
shld eax, ecx, 3
shl ecx, 3
bswap ecx
bswap eax
mov dword [esi + 0x7c], ecx
mov ecx, edi
push 1
mov dword [esi + 0x78], eax
call dword [esi]
push 4
pop edx
mov ecx, dword [edi + 4]
mov eax, dword [edi]
lea edi, [edi + 8]
bswap eax
mov dword [ebx], eax
lea ebx, [ebx + 8]
bswap ecx
mov dword [ebx - 4], ecx
sub edx, 1
jne 0x455ffe
pop edi
mov ecx, esi
pop esi
pop ebp
pop ebx
jmp fcn.0045639a

Function at 0x45638e
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x491ab8]
mov dword [ecx], eax
jmp fcn.0045639a

Function at 0x45639a
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 8], 0
and dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x456861
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
push edx
push edi
push edi
call fcn.00437f94
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x45688b
call fcn.00456804
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x4583cd
Capabilities:
Open clipboard

Disassembly:
push 0x1c
mov eax, 0x473539
call fcn.0044d957
mov esi, edx
and dword [ebp - 4], 0
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne byte [ebp - 0xd]
test eax, eax
je 0x458489
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x458489
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea eax, [eax*2 + 2]
push eax
push 0xd
pop ecx
call fcn.0045849b
push 0
mov edx, esi
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00457dc9
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc ecx
push ecx
mov ecx, eax
call fcn.0045849b
push 1
pop edi
test al, al
movzx ebx, bl
push edi
mov edx, esi
lea ecx, [ebp - 0x28]
cmovne ebx, edi
call fcn.00457dc9
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00457524
push dword [ebp - 0x28]
call fcn.0042f842
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc eax
pop ecx
push eax
push 7
pop ecx
call fcn.0045849b
push dword [ebp - 0x1c]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.0042f842
pop ecx
jmp 0x45848b
xor bl, bl
lea ecx, [ebp - 0xd]
call fcn.00458502
mov al, bl
call fcn.0044d931
ret

Function at 0x45849b
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
mov esi, edx
call fcn.0045ad11
test al, al
je 0x4584f1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4584f1
push dword [ebp + 8]
push esi
push eax
call fcn.004335e0
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4584f1
mov dword [ebp - 4], ebx
mov bl, 1
lea ecx, [ebp - 4]
call fcn.0045acf4
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4
Function at 0x458ff2
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x348]
sub esp, 0x348
push 0xffffffffffffffff
push 0x473661
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x49100c]
xor eax, ebp
mov dword [ebp + 0x344], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 4], ebx
mov edi, 0x114
mov word [eax], cx
cmp byte [0x4942c1], cl
jne 0x45909a
lea eax, [ebp + 0x22c]
mov byte [ebp + 0x22c], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x459093
cmp eax, edi
jae 0x459093
lea edx, [ebp + 0x22c]
mov byte [ebp + 0x340], bl
lea ecx, [ebp - 0x1c]
call fcn.00456ceb
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00457ac8
push dword [ebp - 0x1c]
call fcn.0042f842
mov al, 1
jmp 0x459134
xor al, al
jmp 0x459135
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
je 0x459093
cmp esi, edi
jae 0x4590ce
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ebp + 0x228], ax
lea eax, [ebp]
push eax
call fcn.00457a32
mov al, 1
jmp 0x459135
lea ecx, [ebp - 0x1c]
call fcn.00457a0e
mov dword [ebp - 4], 1
cmp esi, dword [ebp - 0x14]
jbe 0x4590eb
push esi
lea ecx, [ebp - 0x1c]
call fcn.00457458
mov edi, dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x45912c
xor eax, eax
mov word [edi + esi*2], ax
mov eax, ebx
cmp word [edi], bx
je 0x459110
inc eax
cmp word [edi + eax*2], bx
jne 0x459109
mov dword [ebp - 0x18], eax
cmp eax, ecx
jne 0x45912c
lea eax, [esi - 1]
cmp eax, ecx
jne 0x45912c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.00457ac8
mov bl, 1
push edi
call fcn.0042f842
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x344]
xor ecx, ebp
call fcn.0042f831
add ebp, 0x348
leave
ret

Function at 0x459163
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.0045a00f
cmp eax, 0xffffffff
je 0x459190
mov edx, eax
and dl, 0x11
cmp dl, 1
jne 0x459190
and eax, 0xfffffffe
mov ecx, esi
mov edx, eax
call fcn.004594bc
test al, al
je 0x4591c9
cmp byte [0x4942c1], 0
jne 0x4591ba
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.00456d11
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042f842
pop ecx
test esi, esi
jmp 0x4591c3
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4591c9
mov al, 1
jmp 0x4591cb
xor al, al
pop esi
leave
ret
Function at 0x459313
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x4736bc
call fcn.0044d957
mov edi, ecx
cmp byte [0x4942c1], 0
jne 0x459352
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.00456d11
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.0042f842
pop ecx
test esi, esi
je 0x459360
mov al, 1
jmp 0x4593a6
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x45934c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x459371
xor al, al
jmp 0x4593a6
lea ecx, [ebp - 0x50]
call fcn.00459bf4
lea ecx, [ebp - 0x28]
call fcn.00457a0e
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.00459c15
test al, al
je 0x45939b
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.0042f842
pop ecx
mov al, bl
call fcn.0044d931
ret

Function at 0x4593ac
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4942c1], 0
jne 0x4593e0
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.00456d11
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042f842
pop ecx
test esi, esi
pop esi
jmp 0x4593eb
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4593f1
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x45945e
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4942c1], 0
jne 0x459490
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.00456d11
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042f842
pop ecx
test esi, esi
pop esi
jmp 0x459499
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x45949f
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x4594bc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4942c1], 0
push esi
mov esi, edx
jne 0x4594f0
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.00456d11
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042f842
pop ecx
test esi, esi
jmp 0x4594fa
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x459500
mov al, 1
jmp 0x459502
xor al, al
pop esi
leave
ret
Function at 0x459563
Capabilities:
Get disk information

Disassembly:
push 0x30
mov eax, 0x473722
call fcn.0044d957
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.004014c9
cmp byte [0x4942c1], 0
jne 0x45964f
mov ecx, ebx
call fcn.004014c9
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x4595a7
xor al, al
jmp 0x459718
push edi
call fcn.0042f961
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x45970f
cmp edi, dword [ebp - 0x1c]
ja 0x45970f
lea ecx, [ebp - 0x30]
call fcn.00457919
mov byte [ebp - 4], 1
test edi, edi
je 0x459648
xor eax, eax
mov dword [ebp - 0x18], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x14], eax
cmp byte [esi + eax - 1], 0
jne 0x459639
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.00457b28
mov ebx, dword [ebp - 0x14]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x3c]
call fcn.00456cc5
mov edi, eax
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00401574
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401535
mov byte [ebp - 4], 1
push dword [ebp - 0x3c]
call fcn.0042f842
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jne 0x4595ef
mov edi, dword [ebp - 0x20]
cmp ebx, edi
jmp 0x459703
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x4595a0
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042f961
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x45970f
cmp edi, dword [ebp - 0x20]
ja 0x45970f
lea ecx, [ebp - 0x30]
call fcn.00457a0e
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x1c], edx
mov ecx, ebx
mov dword [ebp - 0x14], ecx
test edi, edi
je 0x459701
push 2
pop eax
mov dword [ebp - 0x18], eax
cmp word [esi + eax - 2], bx
jne 0x4596f0
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.00457a32
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x1c], eax
call fcn.00401574
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
call fcn.00401535
mov eax, dword [ebp - 0x18]
mov edx, eax
mov ecx, dword [ebp - 0x14]
inc ecx
add eax, 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
cmp ecx, edi
jb 0x4596ba
mov edx, dword [ebp - 0x1c]
cmp edx, edi
push dword [ebp - 0x30]
sete bl
call fcn.0042f842
pop ecx
push esi
call fcn.0042f842
mov al, bl
pop ecx
call fcn.0044d931
ret
Function at 0x45a00f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4942c1], 0
jne 0x45a041
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.00456d11
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042f842
pop ecx
mov eax, esi
pop esi
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret

Function at 0x45a482
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45a4ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45a4ac
xor al, al
jmp 0x45a4c0
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x45d88b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
cmp esi, 0xffffffff
je 0x45d96b
mov edx, dword [ecx + 0x78]
mov eax, dword [ecx + 0x7c]
lea ecx, [esp + 0x2c]
and dword [esp + 0x34], 0
add eax, dword [edx + esi*4]
mov dword [esp + 0x2c], eax
mov eax, dword [edx + esi*4 + 4]
sub eax, dword [edx + esi*4]
mov dword [esp + 0x30], eax
call fcn.0045fe68
mov ebx, eax
test ebx, ebx
jmp 0x45d961
lea ecx, [esp + 0x2c]
call fcn.0045fe50
mov esi, dword [esp + 0x34]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x2c]
movzx ebp, al
movlpd qword [esp + 0x20], xmm0
mov edi, dword [esp + 0x24]
mov byte [esp + 0x3c], al
lea ecx, [esi + ecx]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
and ebp, 0xf
jbe 0x45d936
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movzx eax, byte [esi + ebx]
shld edi, ecx, 8
cdq
shl ecx, 8
or edi, edx
or eax, ecx
inc esi
mov ecx, eax
cmp esi, ebp
jb 0x45d913
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x14]
mov al, byte [esp + 0x3c]
add esi, ebp
mov dword [esp + 0x34], esi
cmp ecx, 0x6f10701
jne 0x45d948
test edi, edi
je 0x45d977
test al, 0x20
je 0x45d95e
lea ecx, [esp + 0x2c]
call fcn.0045fe68
and dword [esp + 0x24], 0
add dword [esp + 0x34], eax
sub ebx, 1
mov dword [esp + 0x14], ebx
jne 0x45d8ce
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov al, 1
jmp 0x45d96d
Function at 0x461f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x461fa0
mov dword [esi], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x461fe6
push edi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], edi
test esi, esi
je 0x461fdb
add dword [esi], edx
test eax, eax
jne 0x461fe6
call fcn.004624ba
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x46bd2c
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
mov edx, ecx
cmp edx, 8
je 0x46bd6f
cmp edx, 0x52
je 0x46bd5e
cmp ecx, 0x76
jne 0x46bd6b
mov ecx, esi
call fcn.0046b28f
jmp 0x46bd76
test al, al
je 0x46bd6b
mov ecx, esi
call fcn.0046b497
jmp 0x46bd76
xor al, al
jmp 0x46bd78
mov ecx, esi
call fcn.0046b42c
mov al, 1
pop esi
ret 4
Function at 0x46d3c5
Capabilities:
Get file system object information

Disassembly:
push 0x1c8
mov eax, 0x475216
call fcn.0044d98b
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d4]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1b0], eax
call fcn.00457a0e
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x46d448
push dword [edi + 0xc]
lea ecx, [ebp - 0x1bc]
push dword [edi + 8]
call fcn.0046d345
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a8]
call fcn.0046d388
push eax
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 2
call fcn.00457ac8
push dword [ebp - 0x1a8]
call fcn.0042f842
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x1bc]
call fcn.0042f842
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1ac], eax
call fcn.00456f67
mov esi, eax
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.00457385
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c8]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.00457b7a
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.0046d61e
lea eax, [ebp - 0x1c8]
mov ecx, ebx
push eax
call fcn.0046d61e
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00457a9a
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.004570cd
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0045704e
lea ecx, [ebp - 0x19c]
call fcn.004570cd
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0045704e
lea ecx, [ebp - 0x19c]
call fcn.004570cd
cmp byte [edi + 1], 0
je 0x46d565
mov edx, 0x3f4
lea ecx, [ebp - 0x1a8]
call fcn.0045b201
push eax
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 6
call fcn.0045704e
mov byte [ebp - 4], 5
push dword [ebp - 0x1a8]
call fcn.0042f842
lea ecx, [ebp - 0x19c]
mov dword [esp], 0x483ca0
call fcn.00457002
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x10]
call fcn.0045af94
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00457002
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
mov edx, dword [ebp - 0x19c]
mov ecx, eax
call fcn.0045b99f
mov edx, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1a8]
push 0
call fcn.00457dc9
push 0x110
push 0x160
lea eax, [ebp - 0x190]
push eax
push 0x80
push dword [ebp - 0x1a8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1a8]
mov esi, eax
call fcn.0042f842
pop ecx
test esi, esi
je 0x46d5e6
push dword [ebp - 0x1b0]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.0042f842
pop ecx
push dword [ebp - 0x1c8]
call fcn.0042f842
pop ecx
push dword [ebp - 0x1bc]
call fcn.0042f842
pop ecx
push dword [ebp - 0x1d4]
call fcn.0042f842
pop ecx
call fcn.0044d946
ret 0xc
Function at 0x46dba6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x46dbd9
cmp dword [edx + 8], 0xffffff65
jne 0x46dbd9
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x46dc13
sub eax, 0x14
je 0x46dbe0
dec eax
sub eax, 1
je 0x46dc13
xor al, al
pop esi
leave
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x46dbd9
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
jmp 0x46dbdb
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x46dbd9
mov ecx, esi
call fcn.0046dab6
jmp 0x46dc0f
Function at 0x46fe60
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x49100c]
xor eax, esp
mov dword [esp + 0x164], eax
test cl, cl
mov edx, 0x4011
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x90
push 0x482f44
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.0042f831
mov esp, ebp
pop ebp
ret

Function at 0x46feb6
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d0
mov eax, dword [0x49100c]
xor eax, esp
mov dword [esp + 0x2cc], eax
push esi
mov esi, edx
or esi, 0x80
cmp byte [0x4942c1], 0
push edi
mov edi, dword [ebp + 8]
jne 0x46ff19
mov edx, ecx
lea ecx, [esp + 0xc]
call fcn.00456d11
push 0x4010
push 0x160
lea ecx, [esp + 0x20]
push ecx
push esi
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [esp + 0xc]
mov esi, eax
call fcn.0042f842
pop ecx
mov eax, esi
jmp 0x46ff27
push ecx
push ecx
lea eax, [esp + 0x20]
mov edx, esi
push eax
call fcn.0046fe42
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x2d4]
pop edi
pop esi
xor ecx, esp
call fcn.0042f831
mov esp, ebp
pop ebp
ret 4

Function at 0x470610
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47063c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x47063c
xor al, al
jmp 0x47064d
mov ecx, dword [ebp - 4]
xor eax, eax
add eax, edi
mov dword [esi], eax
mov al, 1
adc ecx, 0
mov dword [esi + 4], ecx
pop edi
pop esi
leave
ret
Function at 0x403c34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4ef020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403ccc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403cac
xor eax, eax
push ebp
push 0x403ca5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403ce8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403cac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4ef020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4ef020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404ab4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f204c], 0
je 0x404b15
cmp word [0x4f2220], 0xd7b2
jne 0x404add
cmp dword [0x4f2228], 0
jbe 0x404add
mov eax, 0x4f221c
call dword [0x4f2238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4ef078
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404b3c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4ef030], 0
jne 0x404b31
push 0
push 0x4ef070
push 0x4ef078
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40705c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4070c2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404eb8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403534
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4070ac
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4070c9
lea eax, [ebp - 0x10]
call fcn.00404c38
ret