joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bc10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 2
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41bc59
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478c25
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea ecx, [ebp - 0x438]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x41bcf7
mov ebx, dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov edx, dword [ebp - 0x430]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41bce5
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0047b9a0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
push esi
call ebx
test eax, eax
je 0x41bcde
mov ecx, dword [ebp - 0x43c]
lea eax, [ebp - 0x20c]
push eax
push ecx
call fcn.0047a17e
add esp, 8
test eax, eax
je 0x41bd11
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x438]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41bc77
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478c25
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x430]
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.00478c25
mov esp, ebp
pop ebp
ret
Function at 0x41bdc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0047dba0
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100c]
push eax
push 0x20019
push 0
push str.SOFTWAREWOW6432Nodei4Tool
mov dword [ebp - 0x1008], 0
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x1008], 1
mov dword [ebp - 0x1010], 0x800
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41be82
push esi
lea ecx, [ebp - 0x1010]
push ecx
mov ecx, dword [ebp - 0x100c]
lea edx, [ebp - 0x1004]
push edx
lea eax, [ebp - 0x1008]
push eax
push 0
push str.GUID
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41be59
push edi
mov ecx, 0x200
mov esi, 0x61a510
lea edi, [ebp - 0x804]
rep movsd dword es:[edi], dword [esi]
pop edi
mov esi, dword [ebp - 0x1010]
xor eax, eax
test esi, esi
je 0x41be81
lea ecx, [ebp - 0x804]
jmp 0x41be70
mov dl, byte [ebp + eax - 0x1004]
mov byte [ecx], dl
add eax, 2
inc ecx
cmp eax, esi
jb 0x41be70
pop esi
mov eax, dword [ebp - 0x100c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x804]
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41beb0
sub eax, edx
push eax
lea ecx, [ebp - 0x804]
push ecx
mov ecx, ebx
call fcn.00402c50
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, ebx
call fcn.00478c25
mov esp, ebp
pop ebp
ret
Function at 0x41c100
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aecec
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x434], 0xf
push 0x400
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 0x438], ebx
mov byte [ebp - 0x448], bl
mov dword [ebp - 0x484], ebx
call fcn.0047b9a0
lea ecx, [ebp - 0x480]
call fcn.00408d40
push eax
mov eax, str._source.dat
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 1
call fcn.0041dd30
add esp, 0x10
mov edi, 8
mov byte [ebp - 4], 3
cmp dword [ebp - 0x46c], edi
jb 0x41c1a9
mov ecx, dword [ebp - 0x480]
push ecx
call fcn.00478c1a
add esp, 4
mov eax, dword [ebp - 0x42c]
xor edx, edx
mov dword [ebp - 0x46c], 7
mov dword [ebp - 0x470], ebx
mov word [ebp - 0x480], dx
cmp dword [ebp - 0x418], edi
jae 0x41c1d6
lea eax, [ebp - 0x42c]
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41c258
lea eax, [ebp - 0x448]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.004032f0
cmp dword [ebp - 0x418], 8
jb 0x41c226
mov ecx, dword [ebp - 0x42c]
push ecx
call fcn.00478c1a
add esp, 4
xor edx, edx
cmp dword [ebp - 0x434], 0x10
mov dword [ebp - 0x418], 7
mov dword [ebp - 0x41c], ebx
mov word [ebp - 0x42c], dx
jb 0x41c35a
mov eax, dword [ebp - 0x448]
push eax
jmp 0x41c352
push ebx
lea ecx, [ebp - 0x484]
push ecx
push 0x400
lea edx, [ebp - 0x410]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41c283
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41c1f4
lea eax, [ebp - 0x410]
mov dword [ebp - 0x450], 0xf
mov dword [ebp - 0x454], ebx
mov byte [ebp - 0x464], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41c2a2
sub eax, edx
push eax
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x464]
call fcn.00402c50
lea edx, [ebp - 0x464]
push edx
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 4
call fcn.004032f0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x450], 0x10
jb 0x41c2f0
mov eax, dword [ebp - 0x464]
push eax
call fcn.00478c1a
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x448]
push ecx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov ecx, esi
mov byte [esi], bl
call fcn.004032f0
cmp dword [ebp - 0x418], 8
jb 0x41c329
mov edx, dword [ebp - 0x42c]
push edx
call fcn.00478c1a
add esp, 4
xor eax, eax
cmp dword [ebp - 0x434], 0x10
mov dword [ebp - 0x418], 7
mov dword [ebp - 0x41c], ebx
mov word [ebp - 0x42c], ax
jb 0x41c35a
mov ecx, dword [ebp - 0x448]
push ecx
call fcn.00478c1a
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478c25
mov esp, ebp
pop ebp
ret
Function at 0x4242d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
cmp ebx, eax
jne 0x4242f3
mov dword [edi + 8], eax
mov dword [edi + 4], eax
mov dword [edi], 1
mov eax, edi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 4]
push eax
mov esi, ebx
call fcn.00424260
mov esi, eax
add esp, 4
test esi, esi
je 0x424326
push ebx
call fcn.00479f11
add esp, 4
xor eax, eax
mov dword [edi], esi
pop esi
mov dword [edi + 8], eax
mov dword [edi + 4], eax
mov eax, edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov dword [ebp - 8], eax
call dword [0x62bb90]
mov esi, eax
add esp, 4
test esi, esi
jne 0x424361
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00479f11
add esp, 4
xor eax, eax
pop esi
mov dword [edi + 8], eax
mov dword [edi + 4], eax
mov dword [edi], 3
mov eax, edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push edx
push ebx
push 1
push esi
call fcn.0047afa8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00479f11
add esp, 0x14
cmp dword [ebp - 4], ebx
je 0x4243a2
push esi
call dword [0x62bb94]
add esp, 4
xor eax, eax
pop esi
mov dword [edi + 8], eax
mov dword [edi + 4], eax
mov dword [edi], 2
mov eax, edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push ebx
mov ecx, esi
call fcn.00420e50
add esp, 4
cmp eax, 1
jne 0x4243bc
mov byte [esi + ebx], 0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push ecx
push ebx
push esi
mov ebx, edi
call fcn.00427d90
pop esi
mov eax, edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4245a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push 1
push edx
call fcn.00479b48
add esp, 0x10
pop ebp
ret 8

Function at 0x42e2a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [esi]
xor eax, eax
mov edx, esi
test cl, cl
je 0x42e2c9
lea ecx, [ecx]
movsx ecx, cl
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x42e2b0
lea eax, [eax + eax*8]
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, dword [ebp + 8]
and edx, 0x3f
mov eax, dword [eax + edx*4]
push ebx
test eax, eax
je 0x42e338
mov ecx, dword [eax]
dec ecx
cmp ecx, 3
ja case.default.0x42e2e9
jmp dword [ecx*4 + 0x42e340]
lea ecx, [eax + 0x1c]
jmp 0x42e306
lea ecx, [eax + 0x10]
jmp 0x42e306
lea ecx, [eax + 0xc]
jmp 0x42e306
lea ecx, [eax + 9]
jmp 0x42e306
xor ecx, ecx
mov edx, esi
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x42e328
test bl, bl
je 0x42e324
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x42e328
add ecx, 2
add edx, 2
test bl, bl
jne 0x42e308
xor ecx, ecx
jmp 0x42e32d
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x42e33a
mov eax, dword [eax + 4]
test eax, eax
jne 0x42e2e1
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x42e350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov cl, byte [ebx]
push esi
xor eax, eax
push edi
mov edx, ebx
test cl, cl
je 0x42e37b
movsx ecx, cl
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x42e362
mov edx, dword [ebp + 8]
lea eax, [eax + eax*8]
mov edi, eax
shr edi, 0xb
xor edi, eax
and edi, 0x3f
mov esi, dword [edx + edi*4]
test esi, esi
je 0x42e3f0
mov eax, dword [esi]
dec eax
cmp eax, 3
ja case.default.0x42e39a
jmp dword [eax*4 + 0x42e458]
lea eax, [esi + 0x1c]
jmp 0x42e3b7
lea eax, [esi + 0x10]
jmp 0x42e3b7
lea eax, [esi + 0xc]
jmp 0x42e3b7
lea eax, [esi + 9]
jmp 0x42e3b7
xor eax, eax
mov ecx, ebx
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42e3e0
test dl, dl
je 0x42e3dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42e3e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x42e3c0
xor eax, eax
jmp 0x42e3e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42e402
mov esi, dword [esi + 4]
test esi, esi
jne 0x42e392
mov esi, dword [ebp + 0xc]
lea eax, [esi - 1]
cmp eax, 3
ja case.default.0x42e3fb
jmp dword [eax*4 + 0x42e468]
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [esi], ecx
pop edi
setne al
dec eax
and eax, esi
pop esi
pop ebx
pop ebp
ret 8
push ebx
call fcn.00431880
add esp, 4
test eax, eax
je 0x42e431
mov ecx, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ecx + edi*4]
mov dword [eax + 4], edx
mov dword [ecx + edi*4], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
call fcn.00431900
jmp 0x42e41f
push ebx
call fcn.00431960
jmp 0x42e41c
push ebx
call fcn.004319d0
jmp 0x42e41c
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x438333
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jns 0x438349
push 8
pop edi
push 2
call esi
test ax, ax
jns 0x438355
or edi, 1
push 1
call esi
test ax, ax
jns 0x438361
or edi, 2
push 0x10
call esi
test ax, ax
jns 0x43836d
or edi, 4
push 0x12
call esi
test ax, ax
jns 0x438379
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret
Function at 0x43b1a3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x120]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x43b1cf
cmp ebx, dword [esi + 0x170]
je 0x43b1cf
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x170]
cmp ebx, eax
je 0x43b2a6
push edi
test eax, eax
je 0x43b22e
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x170]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x170]
mov ecx, esi
call fcn.0043a7aa
mov dword [esi + 0x170], edi
test ebx, ebx
je 0x43b2a5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x43b2a5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test al, al
je 0x43b2a5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xd4]
test al, al
je 0x43b2a5
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x170], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x170]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x170]
mov ecx, esi
call fcn.0043a7aa
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x43b4c3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x1e4]
xor ebx, ebx
call fcn.00477e44
test eax, eax
jle 0x43b518
push ebx
lea ecx, [esi + 0x1e4]
mov byte [ebp - 1], 0
call fcn.0043d44b
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x43b57c
lea ecx, [esi + 0x1e4]
inc ebx
call fcn.00477e44
cmp ebx, eax
jl 0x43b4df
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x43b5e1
sub eax, 4
je 0x43b580
dec eax
dec eax
jne 0x43b5d8
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.0047bc70
pop ecx
mov ecx, dword [esi + 0x16c]
push reloc.WS2_32.dll_ioctlsocket
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x439c98
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x43b5d8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + pe_nt_image_headers32]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x43b5da
cmp dword [esi + 0x170], 0
je 0x43b5d8
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x180]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x184]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.00438333
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x170]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x43b5d8
cmp dword [esi + 0x170], 0
je 0x43b63f
mov ecx, dword [esi + 0x170]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x43b63f
mov ecx, dword [esi + 0x170]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x43b63f
mov ecx, dword [esi + 0x170]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.0047baed
pop ecx
pop ecx
test eax, eax
je 0x43b63f
mov ecx, dword [esi + 0x170]
call fcn.0044e22a
test al, al
jne 0x43b5d8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns al
movzx eax, al
push eax
mov ecx, esi
call fcn.0043b36d
jmp 0x43b57c
Function at 0x449d17
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x449d25
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x449de0
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5b41f8]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5b41f8]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5b41f8]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5b41f8]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5b41f8]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5b41f8]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5b41f8]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5b41f8]
add edx, 8
sub edi, 8
dec esi
jne 0x449d43
pop ebx
test edi, edi
je 0x449df9
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x5b41f8]
inc edx
dec edi
jne 0x449de4
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x44a2c1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x44a2f5
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44a2f0
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x44a31d
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x44a306
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0047c750
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x44b29b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x44b343
movzx ecx, word [esi]
test cx, cx
je 0x44b343
mov eax, esi
mov edx, esi
cmp cx, 0x2f
je 0x44b2d6
cmp cx, 0x5c
jne 0x44b2d8
mov eax, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x44b2ca
cmp eax, esi
je 0x44b317
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0047a54b
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0044b29b
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0047cbff
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0047cbce
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00478c25
leave
ret
Function at 0x44b855
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x6198a0
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0047978e
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x44b8c5
push ebx
push 2
push edi
push esi
call fcn.0047aa0e
push esi
call fcn.0047ac1e
push edi
push edi
push esi
mov ebx, eax
call fcn.0047aa0e
push ebx
call fcn.00479495
mov edi, eax
add esp, 0x20
test edi, edi
je 0x44b8bd
push esi
push ebx
push 1
push edi
call fcn.0047afa8
push ebx
push edi
push 0
call fcn.00449d17
push edi
mov dword [ebp - 4], eax
call fcn.00479529
add esp, 0x20
push esi
call fcn.00479f11
pop ecx
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x44cd7b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x44cde7
cmp dword [esi + 4], 0xffffffff
jne 0x44cde7
lea eax, [esi + 0x138]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp dword [ebp + 0x10], 1
jne 0x44cdb9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x44cdb9
mov eax, 0x2000000
jmp 0x44cdec
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044a0ce
add esp, 0x10
test eax, eax
jne 0x44cdd7
mov eax, dword [ebp + 0x10]
jmp 0x44cdec
push eax
call fcn.0044c96a
mov dword [esi], eax
mov eax, dword [0x62c3bc]
pop ecx
jmp 0x44cdec
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x44d215
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 2
or edi, 0xffffffff
push esi
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x440], edi
call fcn.0047cbb3
pop ecx
push eax
push esi
call fcn.0044d135
mov esi, eax
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 0x448], 1
cmp esi, ebx
je 0x44d39b
cmp edi, dword [ebp - 0x448]
jge 0x44d394
push 0x22c
lea eax, [ebp - 0x438]
push ebx
push eax
mov dword [ebp - 0x43c], ebx
call fcn.0047b9a0
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x43c]
push eax
push edi
push esi
mov dword [ebp - 0x444], ebx
call fcn.0044b63a
add esp, 0x1c
mov dword [ebp - 0x440], eax
cmp eax, ebx
jne 0x44d394
cmp edi, ebx
jge 0x44d2ce
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x448], eax
jmp 0x44d38c
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0047b9a0
push dword [ebp - 0x44c]
lea eax, [ebp - 0x20c]
push eax
call fcn.0047cbce
lea eax, [ebp - 0x20c]
push 0x619200
push eax
call fcn.0047cbce
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0047cbce
add esp, 0x24
cmp dword [ebp + 0x10], ebx
jne 0x44d361
mov ebx, dword [ebp - 0x230]
lea eax, [ebp - 0x20c]
push eax
shr ebx, 4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
and bl, 1
jne 0x44d361
test al, al
je 0x44d361
lea eax, [ebp - 0x20c]
push eax
call fcn.0044b855
pop ecx
cmp dword [ebp - 0x444], eax
je 0x44d38c
lea eax, [ebp - 0x20c]
push 2
push eax
call fcn.0047cbb3
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
call fcn.0044d193
add esp, 0x14
mov dword [ebp - 0x440], eax
test eax, eax
jne 0x44d394
inc edi
xor ebx, ebx
jmp 0x44d269
push esi
call fcn.0044d1cb
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x440]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00478c25
leave
ret

Function at 0x44ee46
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4d4], ebx
je 0x44eeae
cmp dword [ebp + 8], 0x100
jne 0x44ee9d
cmp word [ebp + 0xc], 0xd
jne 0x44ee9d
cmp byte [esi + 0x4da], bl
je 0x44ee84
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x44ee9d
cmp byte [esi + 0x4db], bl
jne 0x44ee9d
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x44ee99
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.0043a7aa
xor eax, eax
jmp 0x44eeb1
mov eax, dword [esi + 0x4d4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10