joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479110
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x568e30]
xor eax, ebp
mov dword [ebp - 0x40], eax
push 0x7d0
lea eax, [ebp - 0xfe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
lea ecx, [ebp - 0xfd4]
push ecx
call fcn.004b9368
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xfe0]
push eax
call fcn.004b933a
add esp, 8
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004b8df0
add esp, 0xc
mov dword [ebp - 0x30], 0x51fcd8
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x51fce4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4791b2
lea ecx, [ebp - 0xfe0]
push ecx
call fcn.00479260
add esp, 4
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.004b8dd5
mov esp, ebp
pop ebp
ret

Function at 0x479260
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x568e30]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.004b8df0
add esp, 0xc
mov dword [ebp - 0x830], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.004b8df0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x51fd08
lea eax, [ebp - 0x7d8]
push eax
call fcn.004ba115
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x830]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4792ea
jmp 0x479304
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b8dd5
mov esp, ebp
pop ebp
ret
Function at 0x4795a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
mov eax, dword [0x568e30]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x4795c0
xor eax, eax
jmp 0x479717
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004b8df0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x420], dx
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.004b8df0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.004b9368
add esp, 8
lea eax, [ebp - 0x210]
push eax
call fcn.004beb54
add esp, 4
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x658], 0
push 0x228
push 0
lea ecx, [ebp - 0x654]
push ecx
call fcn.004b8df0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x479676
xor eax, eax
jmp 0x479717
mov dword [ebp - 0x658], 0x22c
lea edx, [ebp - 0x658]
push edx
mov eax, dword [ebp - 0x214]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x479708
lea ecx, [ebp - 0x634]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.004b9368
add esp, 8
lea eax, [ebp - 0x420]
push eax
call fcn.004beb54
add esp, 4
mov dword [ebp - 0x65c], eax
mov ecx, dword [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x65c]
push edx
call fcn.004b9ae4
add esp, 8
test eax, eax
jne 0x4796f1
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x650]
jmp 0x479717
lea ecx, [ebp - 0x658]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x479697
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004b8dd5
mov esp, ebp
pop ebp
ret
Function at 0x47a1b0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x568e30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0x51fd94
mov eax, dword [ebp + 8]
push eax
call fcn.00451d20
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x47a1f0
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x47a2e3
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov edx, 1
test edx, edx
je 0x47a2d5
mov dword [ebp - 0x10], 1
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.004b8df0
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x47a251
mov edx, dword [ebp + 8]
push edx
push str._s.del
lea eax, [ebp - 0x220]
push eax
call fcn.004ba115
add esp, 0xc
jmp 0x47a26d
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s.del_d
lea eax, [ebp - 0x220]
push eax
call fcn.004ba115
add esp, 0x10
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a28e
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47a2aa
cmp dword [ebp - 0xc], 0xa
jl 0x47a29c
jmp 0x47a2e3
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x47a1fe
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004badb9
add esp, 8
push 5
push 0
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x47a2e3
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b8dd5
mov esp, ebp
pop ebp
ret
Function at 0x47a300
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x568e30]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47a326
jmp 0x47a4b8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47a33e
jmp 0x47a4b8
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004b8df0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x420], cx
push 0x206
push 0
lea edx, [ebp - 0x41e]
push edx
call fcn.004b8df0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00479a20
add esp, 8
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x424], 0
mov eax, 1
test eax, eax
je 0x47a4b8
mov dword [ebp - 0x428], 1
xor ecx, ecx
mov word [ebp - 0x630], cx
push 0x206
push 0
lea edx, [ebp - 0x62e]
push edx
call fcn.004b8df0
add esp, 0xc
cmp dword [ebp - 0x424], 0
jne 0x47a418
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x420]
push ecx
push str._s_s.del
lea edx, [ebp - 0x630]
push edx
call fcn.004ba115
add esp, 0x10
jmp 0x47a441
mov eax, dword [ebp - 0x424]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x420]
push edx
push str._s_s.del_d
lea eax, [ebp - 0x630]
push eax
call fcn.004ba115
add esp, 0x14
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a465
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x47a48d
cmp dword [ebp - 0x424], 0xa
jl 0x47a479
jmp 0x47a4b8
mov eax, dword [ebp - 0x424]
add eax, 1
mov dword [ebp - 0x424], eax
jmp 0x47a3b5
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004badb9
add esp, 8
push 5
push 0
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x47a4b8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004b8dd5
mov esp, ebp
pop ebp
ret

Function at 0x47bce0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x47d180
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
setne dl
mov eax, dword [ebp - 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x47fbb0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
push 3
push 0
push 0
push connect
mov ecx, dword [ebp + 8]
call fcn.00429450
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x480771
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x56d904], 0
push esi
jne 0x4806e4
call fcn.0048060a
test eax, eax
je 0x480727
mov eax, dword [0x56d904]
cmp eax, 1
jne 0x480705
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x480727
pop esi
ret
push eax
call dword [0x56d90c]
test eax, eax
jne 0x48076f
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x48072b
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x56d904]
call dword [0x56d90c]
mov edi, eax
test edi, edi
je 0x480750
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x48076c
mov edi, esi
add esi, 0xff0
push edi
push dword [0x56d904]
call dword [0x56d908]
add edi, 0x10
cmp edi, esi
jb 0x480758
mov eax, edi
pop edi
pop esi
ret
jmp 0x4806d1
Function at 0x48cb20
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x48cb36
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x48cb42
or edi, 1
push 1
call esi
test ax, ax
jge 0x48cb4e
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x48cb5a
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x48cb66
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x48ccb3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x568e30]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004b8df0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call sym.Install.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b8dd5
leave
ret

Function at 0x48f259
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x48f27e
cmp ebx, dword [esi + 0x54]
je 0x48f27e
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x54]
cmp ebx, eax
je 0x48f340
push edi
test eax, eax
je 0x48f2d1
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x54]
mov ecx, esi
call sym.Install.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
mov dword [esi + 0x54], edi
test ebx, ebx
je 0x48f33f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x48f33f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test al, al
je 0x48f33f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xd4]
test al, al
je 0x48f33f
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x54], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x54]
mov ecx, esi
call sym.Install.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x48f53d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xd0]
mov ecx, edi
xor ebx, ebx
call sym.Install.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
test eax, eax
jle 0x48f58c
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call sym.Install.exe_public:_void____thiscall_DuiLib::CStdPtrArray::operator___int_const
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x48f5ed
mov ecx, edi
inc ebx
call sym.Install.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
cmp ebx, eax
jl 0x48f55b
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x48f646
sub eax, 4
je 0x48f5f1
dec eax
dec eax
jne 0x48f63d
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.004c15e2
pop ecx
mov ecx, dword [esi + 0x50]
push reloc.WS2_32.dll_ioctlsocket
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push sym.Install.exe_private:_static_class_DuiLib::CControlUI____stdcall_DuiLib::CPaintManagerUI::__FindControlFromShortcut_class_DuiLib::CControlUI___void__
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x48f63d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x48f63f
cmp dword [esi + 0x54], 0
je 0x48f63d
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.0048cb20
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x48f63d
cmp dword [esi + 0x54], 0
je 0x48f695
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x48f695
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x48f695
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.004b9552
pop ecx
pop ecx
test eax, eax
je 0x48f695
mov ecx, dword [esi + 0x54]
call sym.Install.exe_public:_bool___thiscall_DuiLib::CRichEditUI::IsWantTab_void_
test al, al
jne 0x48f63d
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx eax, al
push eax
mov ecx, esi
call sym.Install.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::SetNextTabControl_bool_
jmp 0x48f5ed
Function at 0x4a133a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x568e30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x4a13ab
cmp dword [esi + 0x10], ebx
je 0x4a13ab
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.004c14a0
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x4a13ab
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x1b8
call fcn.0048c097
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call sym.Install.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b8dd5
leave
ret 0x10

Function at 0x4a59c2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4d4], ebx
je 0x4a5a2a
cmp dword [ebp + 8], 0x100
jne 0x4a5a19
cmp word [ebp + 0xc], 0xd
jne 0x4a5a19
cmp byte [esi + 0x4da], bl
je 0x4a5a00
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4a5a19
cmp byte [esi + 0x4db], bl
jne 0x4a5a19
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x4a5a15
push ebx
push ebx
push ebx
push str.return
push esi
call sym.Install.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x4a5a2d
mov eax, dword [esi + 0x4d4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4ae53e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x4ae549
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x4ae604
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x527db8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x527db8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x527db8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x527db8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x527db8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x527db8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x527db8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x527db8]
inc edx
sub edi, 8
dec esi
jne 0x4ae569
pop ebx
test edi, edi
je 0x4ae61d
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x527db8]
inc edx
dec edi
jne 0x4ae608
pop edi
not eax
pop esi
ret

Function at 0x4aeab4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4aeae8
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4aeae3
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4aeb10
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4aeaf9
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.004b8a70
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4af8ad
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x568e30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4af957
movzx ecx, word [esi]
test cx, cx
je 0x4af957
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x4af8eb
cmp cx, 0x5c
jne 0x4af8ed
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x4af8df
cmp eax, esi
je 0x4af92b
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004ba3fb
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004af8ad
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004b9368
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004b933a
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b8dd5
leave
ret
Function at 0x4b0e88
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4b0f03
cmp dword [esi + 4], 0xffffffff
jne 0x4b0f03
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x53bb80
push edi
call fcn.004b933a
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x4b0ed5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4b0ed5
mov eax, 0x2000000
jmp 0x4b0f08
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ae8ca
add esp, 0x10
test eax, eax
jne 0x4b0ef3
mov eax, dword [ebp + 0x10]
jmp 0x4b0f08
push eax
call fcn.004b0a84
mov dword [esi], eax
mov eax, dword [0x56e008]
pop ecx
jmp 0x4b0f08
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc