joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408776
Capabilities:
Hide graphical window

Disassembly:
push ebx
push 0
push dword [0x420b08]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push dword [0x420b0c]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push dword [0x420b10]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push dword [0x420b14]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push dword [0x420b18]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push dword [0x420b1c]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push dword [0x420b20]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push dword [0x420b24]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push dword [0x420b28]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push 0
push 0x130b
push dword [0x420b00]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov ebx, eax
cmp eax, 4
ja 0x408862
lea ecx, [eax*4 + 0x420b08]
mov ecx, dword [ecx]
push ecx
push 1
push ecx
call dword [sym.imp.USER32.DLL_ShowWindow]
call dword [sym.imp.USER32.DLL_BringWindowToTop]
cmp ebx, 3
jne 0x408862
push 0
push 0
push 0x130b
push dword [0x420b04]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp eax, 3
ja 0x408862
lea ecx, [eax*4 + 0x420b1c]
mov ecx, dword [ecx]
push ecx
push 1
push ecx
call dword [sym.imp.USER32.DLL_ShowWindow]
call dword [sym.imp.USER32.DLL_BringWindowToTop]
pop ebx
ret

Function at 0x408864
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [0x420b44]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push dword [0x420b48]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push 0
push 0x130b
push dword [0x420b40]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp eax, 1
ja 0x4088b3
lea ecx, [eax*4 + 0x420b44]
mov ecx, dword [ecx]
push ecx
push 1
push ecx
call dword [sym.imp.USER32.DLL_ShowWindow]
call dword [sym.imp.USER32.DLL_BringWindowToTop]
ret
Function at 0x40ab8f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
pushal
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x40aba6
cmp byte [ebx], 1
je 0x40ac34
mov byte [ebx], 1
push 0x5000
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test eax, eax
je 0x40ac34
mov edx, dword [ebp + 0x14]
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x40ac04
add eax, 0x10
push 0
push 0xff0
push eax
push 0
push esi
push 0
push 0x1200
call dword [sym.imp.KERNEL32.DLL_FormatMessageW]
mov eax, edi
add eax, 0x1000
mov edx, edi
add edx, 0x10
push edx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0x14
jmp 0x40ac19
add eax, 0x1000
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0xc
push 0
push 0
push edi
push 0x40ab0c
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
popal
leave
ret 0x14

Function at 0x40b15f
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push esi
push edi
push ebx
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push 0x42556c
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
jne 0x40b1c4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x40b1a9
push 0
push 0x1010
push 0x42556c
push dword [0x4315e0]
push eax
call fcn.0040ab8f
jmp 0x40b22e
push 0
push 0x1010
push 0x42556c
push dword [0x4315d8]
push 0
call fcn.0040ab8f
jmp 0x40b22e
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x42556c
push 0
push 0x40b210
push 0x425774
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
cmp eax, 5
jne 0x40b1f5
call fcn.0040d41e
call fcn.0040b32c
pop ebx
pop edi
pop esi
ret
push 0
push 0x1040
push 0x42556c
push dword [0x4315e8]
push 0
call fcn.0040ab8f
jmp 0x40b22e
cld
mov esi, 0x41f068
mov ecx, dword [0x41f064]
mov edi, 0x425ca0
rep movsw word es:[edi], word [esi]
mov esi, str.UPS_LM_events.log
mov ecx, 0x12
rep movsw word es:[edi], word [esi]
mov byte [0x425ea8], 1
mov esi, 0x41f068
mov ecx, dword [0x41f064]
mov edi, 0x425eb0
rep movsw word es:[edi], word [esi]
mov esi, str.UPS_LM_voltage.log
mov ecx, 0x13
rep movsw word es:[edi], word [esi]
mov esi, 0x41f068
mov ecx, dword [0x41f064]
mov edi, 0x4260bc
rep movsw word es:[edi], word [esi]
mov esi, str.UPS_LM_polling.log
mov ecx, 0x13
rep movsw word es:[edi], word [esi]
mov esi, 0x41f068
mov ecx, dword [0x41f064]
mov edi, 0x426794
rep movsw word es:[edi], word [esi]
mov esi, str.UPS_LM_email.log
mov ecx, 0x11
rep movsw word es:[edi], word [esi]
mov esi, 0x41f068
mov ecx, dword [0x41f064]
mov edi, 0x427170
rep movsw word es:[edi], word [esi]
mov esi, str.UPS_LM_vk.log
mov ecx, 0xe
rep movsw word es:[edi], word [esi]
mov esi, 0x41f068
mov ecx, dword [0x41f064]
mov edi, 0x427b4c
rep movsw word es:[edi], word [esi]
mov esi, str.UPS_LM_tg.log
mov ecx, 0xe
rep movsw word es:[edi], word [esi]
mov dword [0x427d57], 5
mov dword [0x4285bc], 3
mov dword [0x428e08], 5
cmp dword [0x429230], 0x1e
call fcn.0040b32c
mov byte [0x4262c7], 1
jmp 0x40b1f1
Function at 0x40b4e2
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push edi
push esi
push ebx
lea edi, [0x426692]
cmp word [edi], 0
jne 0x40b53f
mov eax, edi
call fcn.00408be9
mov esi, dword [0x4314d0]
cld
mov ecx, 0x1e
lodsw ax, word [esi]
stosw word es:[edi], ax
dec ecx
je 0x40b516
test ax, ax
jne 0x40b50a
mov ax, 0x20
stosw word es:[edi], ax
sub edi, 2
mov eax, edi
sub eax, dword [0x4314d0]
mov ecx, 0x74
sub ecx, eax
shr ecx, 1
lea ebx, [ebp - 4]
mov dword [ebx], ecx
push ebx
push edi
push 5
call dword [sym.imp.KERNEL32.DLL_GetComputerNameExW]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x40d2ab
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9fc
push esi
push edi
push ebx
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push 0x42556c
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
je 0x40d3ba
mov ebx, eax
lea edi, [ebp - 0x9fc]
mov dword [edi], 0
lea edx, [ebp - 0x9dc]
push 0
push edx
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp word [edi], 0xfeff
jne 0x40d30b
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40d333
lea edx, [ebp - 0x9dc]
push 0
push edx
push 2
push 0x40d416
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x40d3ba
lea edi, [ebp - 0x9fc]
lea esi, [0x40b63f]
cld
mov ebx, dword [esi]
test ebx, ebx
je 0x40d3b3
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
cmp ecx, 1
je 0x40d37c
cmp ecx, 2
je 0x40d381
cmp ecx, 4
je 0x40d378
push 0x42556c
push ebx
push dword [esi + 8]
push 0x425774
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
test eax, eax
je 0x40d3ba
add esi, 0xc
jmp 0x40d340
mov eax, dword [ebx]
jmp 0x40d384
movzx eax, byte [ebx]
jmp 0x40d384
movzx eax, word [ebx]
push eax
push 0x40d418
push 0x10
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfW]
add esp, 0x10
push 0x42556c
push edi
push dword [esi + 8]
push 0x425774
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
test eax, eax
je 0x40d3ba
add esi, 0xc
jmp 0x40d340
pop ebx
pop edi
pop esi
leave
ret 4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
lea edi, [ebp - 0x9d8]
mov dword [edi], 0
lea ebx, [ebp - 0x5f0]
push 0
push 0x1f4
push edi
push 0
push esi
push 0
push 0x1200
call dword [sym.imp.KERNEL32.DLL_FormatMessageW]
push edi
push esi
push 0x42556c
push dword [0x4315d0]
push ebx
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0x14
push 0x10
push str.UPS_Lite_Manager
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_MessageBoxW]
jmp 0x40d3b3
Function at 0x40d41e
Capabilities:
Read .ini file

Disassembly:
pushal
lea esi, [0x40b63f]
cld
mov ebx, dword [esi]
test ebx, ebx
je 0x40d4ab
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
cmp ecx, 1
je 0x40d45f
cmp ecx, 2
je 0x40d478
cmp ecx, 4
je 0x40d492
push 0x42556c
push dword [esi + 4]
push ebx
push 0
push dword [esi + 8]
push 0x425774
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
add esi, 0xc
jmp 0x40d426
push 0x42556c
push 0
push dword [esi + 8]
push 0x425774
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov byte [ebx], al
jmp 0x40d45a
push 0x42556c
push 0
push dword [esi + 8]
push 0x425774
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov word [ebx], ax
jmp 0x40d45a
push 0x42556c
push 0
push dword [esi + 8]
push 0x425774
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov dword [ebx], eax
jmp 0x40d45a
popal
ret

Function at 0x40d584
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push ebx
cld
mov edi, dword [ebp + 0x18]
xor eax, eax
mov ecx, 0x82
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
cmp eax, 0
jne 0x40d5e3
mov dword [ebp - 4], 0x208
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x18]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
cmp eax, 0
jne 0x40d5e3
push dword [ebp + 0x18]
call fcn.0040d5f4
test eax, eax
je 0x40d5e3
inc ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, ebx
pop ebx
pop edi
leave
ret 0x14

Function at 0x40d62a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, 2
mov dword [0x41f270], 0xffffffff
push 0x41f270
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyW]
test eax, eax
jne 0x40d6b9
mov dword [0x41f274], 0x208
push 0x41f274
push 0x41f278
push 0
push 0
push 0x41fb54
push dword [0x41f270]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
xor edi, edi
cmp eax, 2
je 0x40d6ad
mov edi, 2
test eax, eax
jne 0x40d6ad
mov esi, 0x41f068
mov edx, 0x41f278
cld
lodsw ax, word [esi]
cmp ax, word [edx]
jne 0x40d6ad
inc edx
inc edx
test ax, ax
jne 0x40d69a
mov edi, 1
push dword [0x41f270]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, edi
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x40d6c2
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp eax, edx
je 0x40d776
mov edi, eax
cmp al, 2
je 0x40d776
mov dword [0x41f270], 0xffffffff
push 0x41f270
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyW]
test eax, eax
jne 0x40d776
test edi, edi
je 0x40d73c
push 0x41fb54
push dword [0x41f270]
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueW]
mov eax, dword [0x41f060]
shl eax, 1
push eax
push 0x41f068
push 1
push 0
push 0x41fb54
push dword [0x41f270]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExW]
mov edi, eax
jmp 0x40d74f
push 0x41fb54
push dword [0x41f270]
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueW]
mov edi, eax
push dword [0x41f270]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp edi, 5
jne 0x40d776
push 0
push str.UPS_Lite_Manager
push dword [0x431460]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.DLL_MessageBoxW]
pop ebx
pop esi
pop edi
leave
ret 0x10
Function at 0x40e21b
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push edi
lea edi, [ebp - 0x12c]
cmp byte [0x425eac], 0
je 0x40e297
mov eax, dword [0x420ac4]
not eax
or eax, dword [0x420acc]
or eax, dword [0x420ad0]
or eax, dword [0x420ac8]
je 0x40e297
push dword [0x420ac8]
push 0x40e438
push dword [0x420ad0]
push 0x40e42f
push dword [0x420acc]
push 0x40e426
push dword [0x420ac4]
push 0x40e41b
push 0x40e444
push 0x12c
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x2c
push 0
push edi
call fcn.00414acf
mov byte [0x420ad4], 0
cmp dword [0x420ac8], 0
je 0x40e2e2
push 0
push dword [0x420ac8]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
test eax, eax
jne 0x40e2e2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push dword [0x420ac8]
push 0x40e495
push 0x12c
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x14
push 0
push edi
call fcn.00414acf
push dword [0x420ac8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x420ac8], 0
cmp dword [0x420ac4], 0xffffffff
je 0x40e33f
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
jne 0x40e33f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push dword [0x420ac4]
push 0x40e41b
push 0x40e475
push 0x12c
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x18
push 0
push edi
call fcn.00414acf
mov dword [0x420ac4], 0xffffffff
cmp dword [0x420acc], 0xffffffff
je 0x40e399
cmp dword [0x420acc], 0
je 0x40e399
push dword [0x420acc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
jne 0x40e399
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push dword [0x420acc]
push 0x40e426
push 0x40e475
push 0x12c
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x18
push 0
push edi
call fcn.00414acf
mov dword [0x420acc], 0
cmp dword [0x420ad0], 0xffffffff
je 0x40e3f3
cmp dword [0x420ad0], 0
je 0x40e3f3
push dword [0x420ad0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
jne 0x40e3f3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push dword [0x420ad0]
push 0x40e42f
push 0x40e475
push 0x12c
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x18
push 0
push edi
call fcn.00414acf
mov dword [0x420ad0], 0
mov dword [0x42089c], 0
mov dword [0x4208a0], 0
mov byte [0x42084c], 0
pop edi
leave
ret
Function at 0x4122fb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push esi
push edi
push ebx
cmp dword [0x42089c], 2
jb 0x4123db
cmp dword [0x42089c], 0x100
ja 0x4123db
mov esi, dword [ebp + 8]
mov byte [esi], 0
mov dword [ebp - 0x284], esi
mov eax, dword [ebp + 0xc]
add eax, esi
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x288], 0
lea edi, [ebp - 0x27c]
mov ecx, 5
cld
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28c], 0
mov eax, dword [0x420ad0]
mov dword [ebp - 0x26c], eax
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
lea ecx, [ebp - 0x27c]
lea edx, [ebp - 0x28c]
lea eax, [ebp - 0x100]
push ecx
push edx
push dword [0x42089c]
push eax
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4123f1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x4123f1
call fcn.00412f26
lea ebx, [ebp - 0x268]
push eax
push 0x412538
push 0x168
push ebx
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
push 0
push ebx
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x412531
push 0
push 0x4125f6
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x412531
mov eax, dword [0x4262e4]
cmp dword [ebp - 0x288], 0
je 0x412404
mov eax, dword [0x4262e8]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0
je 0x41248d
cmp eax, 0x102
je 0x412455
call dword [sym.imp.KERNEL32.DLL_GetLastError]
call fcn.00412f26
lea ebx, [ebp - 0x268]
push eax
push 0x41255c
push 0x168
push ebx
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
push 0
push ebx
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x412531
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_CancelIo]
cmp dword [ebp - 0x288], 0
jne 0x41252b
cmp byte [0x425ea9], 1
je 0x412483
push 0
push 0x412585
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x412531
lea edx, [ebp - 0x28c]
lea ecx, [ebp - 0x27c]
push 1
push edx
push ecx
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
test eax, eax
jne 0x4124e2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
call fcn.00412f26
lea ebx, [ebp - 0x268]
push eax
push 0x4125a8
push 0x168
push ebx
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
push 0
push ebx
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x412531
lea esi, [ebp - 0xff]
mov ecx, dword [ebp - 0x28c]
dec ecx
je 0x41252b
js 0x41252b
cld
mov edi, dword [ebp - 0x284]
cmp edi, dword [ebp - 0x280]
jae 0x412518
lodsb al, byte [esi]
stosb byte es:[edi], al
inc dword [ebp - 0x288]
dec ecx
jne 0x4124fa
mov dword [ebp - 0x284], edi
jmp 0x412345
push 0
push 0x4125d0
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x412531
mov eax, dword [ebp - 0x288]
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x41262e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
push edi
push ebx
cmp dword [0x42089c], 2
jb 0x4126ed
cmp dword [0x42089c], 0x100
ja 0x4126ed
lea edi, [ebp - 0x27c]
mov ecx, 5
cld
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x280], 0
mov eax, dword [0x420ad0]
mov dword [ebp - 0x26c], eax
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
lea ecx, [ebp - 0x27c]
lea edx, [ebp - 0x280]
lea eax, [ebp - 0x100]
push ecx
push edx
push dword [0x42089c]
push eax
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x412703
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x412703
call fcn.00412f26
lea ebx, [ebp - 0x268]
push eax
push 0x4127c7
push 0x168
push ebx
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
push 0
push ebx
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x4127c2
push 0
push 0x412848
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x4127c2
push dword [0x4262e0]
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0
je 0x412769
cmp eax, 0x102
je 0x412756
call dword [sym.imp.KERNEL32.DLL_GetLastError]
call fcn.00412f26
lea ebx, [ebp - 0x268]
push eax
push 0x4127ef
push 0x168
push ebx
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
push 0
push ebx
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x4127c2
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_CancelIo]
mov eax, 0xffffffff
jmp 0x4127c2
lea edx, [ebp - 0x280]
lea ecx, [ebp - 0x27c]
push 1
push edx
push ecx
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
test eax, eax
jne 0x412657
call dword [sym.imp.KERNEL32.DLL_GetLastError]
call fcn.00412f26
lea ebx, [ebp - 0x268]
push eax
push 0x41281c
push 0x168
push ebx
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
push 0
push ebx
call fcn.00414acf
mov eax, 0xffffffff
jmp 0x4127c2
pop ebx
pop edi
pop esi
leave
ret
Function at 0x412884
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push esi
push edi
push ebx
mov ecx, dword [0x4208a0]
cmp ecx, 2
jb 0x4129c7
cmp ecx, 0x104
ja 0x4129c7
cmp byte [0x42084c], 0
je 0x4128be
push 0x14
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4128ab
mov byte [0x42084c], 1
cld
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4129b0
mov dword [ebp - 0x288], eax
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x104]
mov ecx, dword [0x4208a0]
xor al, al
stosb byte es:[edi], al
dec ecx
movsb byte es:[edi], byte [esi]
dec dword [ebp - 0x288]
je 0x412951
loop 0x4128ea
lea edi, [ebp - 0x280]
mov ecx, 5
cld
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [0x420acc]
mov dword [ebp - 0x270], eax
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
lea edi, [ebp - 0x104]
lea edx, [ebp - 0x284]
lea ecx, [ebp - 0x280]
push ecx
push edx
push dword [0x4208a0]
push edi
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
call fcn.004129d5
test eax, eax
je 0x4129c3
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4128da
cld
xor al, al
rep stosb byte es:[edi], al
lea edi, [ebp - 0x280]
mov ecx, 5
cld
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [0x420acc]
mov dword [ebp - 0x270], eax
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
lea edi, [ebp - 0x104]
lea edx, [ebp - 0x284]
lea ecx, [ebp - 0x280]
push ecx
push edx
push dword [0x4208a0]
push edi
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
call fcn.004129d5
test eax, eax
je 0x4129c3
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, 1
mov byte [0x42084c], 0
pop ebx
pop edi
pop esi
leave
ret 8
xor eax, eax
jmp 0x4129b5
push 0
push 0x412b6a
call fcn.00414acf
jmp 0x4129c3
Function at 0x412ba7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
push esi
push edi
push ebx
mov ecx, dword [0x4208a0]
cmp ecx, 2
jb 0x412d4a
cmp ecx, 0x104
ja 0x412d4a
cmp byte [0x42084c], 0
je 0x412be1
push 0x14
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x412bce
mov byte [0x42084c], 1
cld
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x104]
mov ecx, dword [0x4208a0]
xor al, al
stosb byte es:[edi], al
dec ecx
lodsb al, byte [esi]
cmp al, 0x20
jb 0x412c64
stosb byte es:[edi], al
loop 0x412bfc
lea edi, [ebp - 0x280]
mov ecx, 5
cld
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [0x420acc]
mov dword [ebp - 0x270], eax
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
lea edi, [ebp - 0x104]
lea edx, [ebp - 0x284]
lea ecx, [ebp - 0x280]
push ecx
push edx
push dword [0x4208a0]
push edi
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
call fcn.00412d58
test eax, eax
je 0x412d46
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x412bec
mov al, 0xd
stosb byte es:[edi], al
dec ecx
jne 0x412cd4
lea edi, [ebp - 0x280]
mov ecx, 5
cld
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [0x420acc]
mov dword [ebp - 0x270], eax
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
lea edi, [ebp - 0x104]
lea edx, [ebp - 0x284]
lea ecx, [ebp - 0x280]
push ecx
push edx
push dword [0x4208a0]
push edi
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
call fcn.00412d58
test eax, eax
je 0x412d46
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edi, [ebp - 0x104]
mov ecx, dword [0x4208a0]
cld
xor al, al
rep stosb byte es:[edi], al
lea edi, [ebp - 0x280]
mov ecx, 5
cld
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [0x420acc]
mov dword [ebp - 0x270], eax
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
lea edi, [ebp - 0x104]
lea edx, [ebp - 0x284]
lea ecx, [ebp - 0x280]
push ecx
push edx
push dword [0x4208a0]
push edi
push dword [0x420ac4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
call fcn.00412d58
test eax, eax
je 0x412d46
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, 1
mov byte [0x42084c], 0
pop ebx
pop edi
pop esi
leave
ret 4
xor eax, eax
jmp 0x412d38
push 0
push 0x412eed
call fcn.00414acf
jmp 0x412d46
Function at 0x41489d
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push edi
lea edi, [ebp - 0x214]
push 0x10
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
shr eax, 0xf
and eax, 1
jne 0x4148ea
push 0x11
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
shr eax, 0xf
and eax, 1
je 0x414906
cmp byte [0x4260b8], 0
je 0x4149a5
movzx eax, byte [0x41f4e5]
lea ebx, [0x425eb0]
jmp 0x414920
cmp byte [0x4262c4], 0
je 0x4149a5
movzx eax, byte [0x41f4e6]
lea ebx, [0x4260bc]
jmp 0x414920
cmp byte [0x425ea8], 0
je 0x4149a5
movzx eax, byte [0x41f4e4]
lea ebx, [0x425ca0]
test eax, eax
je 0x414941
lea eax, [ebp - 0x41c]
push 0x420850
push 0x104
push eax
push ebx
call fcn.00415459
lea ebx, [ebp - 0x41c]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4149a5
push 0x104
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpynW]
push edi
call dword [sym.imp.SHLWAPI.DLL_PathQuoteSpacesW]
push 5
push 0
push edi
push 0x425a98
push str.open
push 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteW]
cmp eax, 0x20
ja 0x4149a1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x4149a1
push 0x425a98
push 0x4149d8
push 0x4149c0
push dword [0x420af8]
call fcn.00407edb
pop edi
pop ebx
leave
ret
push 0
push str.UPS_Lite_Manager
push dword [0x4315c8]
push dword [0x420af8]
call dword [sym.imp.USER32.DLL_MessageBoxW]
jmp 0x4149a1