joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
jne 0x10001246
push esi
lea eax, [ebp - 0x21c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x100020ec
lea ecx, [ebp - 0x21c]
call section..text
push str.SAFrameLimiterHotkey.ini
lea ecx, [ebp - 0x21c]
call section..text
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x100020f0
push str.options
call esi
mov dword [0x10003058], eax
test eax, eax
jne 0x1000118e
mov dword [0x10003058], 0x2e
lea eax, [ebp - 0x21c]
push eax
push 0
push str.hotkey2
push str.options
call esi
movq xmm0, qword [str.false]
mov dword [0x100033d8], eax
mov eax, dword [0x10002128]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x21c]
push eax
push 6
lea eax, [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
push eax
push str.false
push str.show_message
push str.options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x10]
push str.true
push eax
call esi
test eax, eax
je 0x10001207
push 0x10002154
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x10001207
xor eax, eax
jmp 0x1000120c
mov eax, 1
mov dword [0x100033d0], eax
lea eax, [ebp - 0x220]
push eax
push 0x40
push 5
push 0x53e981
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x53e982]
add eax, 0x53e986
mov dword [0x100033d4], eax
mov eax, 0x10001090
sub eax, 0x53e986
mov dword [0x53e982], eax
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.1000125b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4012fe
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
sub eax, edx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edx
sbb esi, esi
not esi
and esi, eax
je 0x40132d
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x401318
jmp 0x40132f
mov eax, dword [ecx]
pop edi
pop esi
ret 8

Function at 0x404651
Capabilities:
Accept command line arguments

Disassembly:
push 0x50
mov eax, 0x451844
call fcn.0044800e
mov esi, ecx
mov edi, dword [ebp + 8]
lea edx, [esi + 0xc8]
push str.Launcher_
lea ecx, [ebp - 0x40]
call fcn.0040c795
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [esp], str.Settings.json
call fcn.00409e5a
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x58]
call fcn.00407bb1
mov byte [ebp - 4], 2
cmp dword [esi + 0x19c], ebx
je 0x4046e9
lea eax, [esi + 0x18c]
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x4046db
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x4046cf
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00409e7f
push str.Using_custom_name_for_Settings.json.
push 3
mov ecx, esi
call fcn.0040bc3a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x4046f5
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x40]
push eax
call fcn.0040abb0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
jb 0x40470d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
mov ecx, esi
lea eax, [ebp - 0x5c]
push eax
push str.Settings_file_full_path:__s.
push 3
call fcn.0040c189
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.00406343
lea ecx, [ebp - 0x58]
mov bl, al
call fcn.004011f3
lea ecx, [ebp - 0x28]
call fcn.004011f3
lea ecx, [ebp - 0x40]
call fcn.004011f3
mov al, bl
call fcn.00447fb8
ret 4
Function at 0x404a6f
Capabilities:
Accept command line arguments

Disassembly:
push 0x12c
mov eax, 0x451926
call fcn.0044807c
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x114], esi
mov eax, ebx
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [esi + 0x128]
push eax
mov ecx, edi
call fcn.00409e5a
cmp dword [esi + 0x138], ebx
je 0x404bb2
push ecx
push str._______S___s
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.0040781b
push ecx
push str.___eac_launcher_settings__eac_launcher_settings___s__0_9a_zA_Z___.json__s_0_9a_zA_Z___.json__
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0040781b
lea eax, [ebp - 0x40]
mov esi, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x110], eax
cmp eax, ecx
je 0x404b9d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x128], ebx
or esi, 1
mov dword [ebp - 0x124], 7
push 0x462948
mov word [ebp - 0x138], ax
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.00409e5a
mov byte [ebp - 4], 4
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x404b3e
mov ecx, dword [edi]
mov eax, dword [edi + 0x10]
mov edx, edi
lea eax, [ecx + eax*2]
jb 0x404b4a
mov edx, dword [edi]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push dword [ebp - 0x110]
lea ecx, [ebp - 0x118]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0040f52c
add esp, 0x14
lea ecx, [ebp - 0x58]
call fcn.004011f3
lea eax, [ebp - 0x138]
mov ecx, edi
push eax
call fcn.00407b7b
lea ecx, [ebp - 0x138]
and esi, 0xfffffffe
call fcn.004011f3
mov eax, dword [ebp - 0x110]
add eax, 0x14
jmp 0x404ade
push 0x4077f3
push 2
push 0x14
lea eax, [ebp - 0x40]
mov byte [ebp - 4], bl
push eax
call fcn.00447cc0
call fcn.00447fc9
ret
Function at 0x406260
Capabilities:
Accept command line arguments

Disassembly:
push 0x74
mov eax, 0x451b1c
call fcn.0044800e
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407bb1
xor ebx, ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
jb 0x40628e
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x68]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x4062b2
push str.Failed_in_parsing_command_line_arguments__custom_paths_will_not_be_supported_.
push 2
mov ecx, esi
call fcn.0040bc3a
jmp 0x406335
push 0x3c
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00419c50
add esp, 4
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x64]
push edi
push dword [ebp - 0x68]
call fcn.0040b92c
mov byte [ebp - 4], 1
jmp 0x40631a
cmp dword [ebp - 0x30], 0
jne 0x40631a
mov eax, dword [ebp - 0x58]
sub eax, ebx
je 0x4062fb
sub eax, 1
jne 0x40631a
push dword [ebp - 0x40]
lea ecx, [ebp - 0x80]
call fcn.00407bb1
lea ecx, [esi + 0x174]
jmp 0x40630c
push dword [ebp - 0x40]
lea ecx, [ebp - 0x80]
call fcn.00407bb1
lea ecx, [esi + 0x18c]
push eax
call fcn.00407b7b
lea ecx, [ebp - 0x80]
call fcn.004011f3
lea ecx, [ebp - 0x64]
call fcn.0040b9ae
test al, al
jne 0x4062d6
cmp dword [ebp - 0x2c], 0
je 0x406335
push dword [ebp - 0x2c]
call fcn.00422570
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004011f3
call fcn.00447fb8
ret

Function at 0x4069f2
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
mov eax, dword [0x46c004]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
mov ebx, dword [esp + 0x20c]
push ebp
push esi
push edi
push dword [ecx + 0x490]
mov ebp, dword [ebx + 0x18]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebp
call edi
push 1
push ebp
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0xffffff
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
mov esi, 0xe0a924
push esi
push ebp
call dword [sym.imp.GDI32.dll_SetDCPenColor]
push esi
push ebp
call dword [sym.imp.GDI32.dll_SetDCBrushColor]
mov esi, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x12
call esi
push eax
push ebp
call edi
push 0x13
call esi
push eax
push ebp
call edi
push 8
push 8
push dword [ebx + 0x28]
lea esi, [ebx + 0x1c]
push dword [ebx + 0x24]
push dword [ebx + 0x20]
push dword [esi]
push ebp
call dword [sym.imp.GDI32.dll_RoundRect]
push pe_nt_image_headers32
lea eax, [esp + 0x14]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x406aa6
push 0x825
push esi
push eax
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00418deb
add esp, 0x204
ret 4
Function at 0x4081d7
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x46c004]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
push edi
mov edi, 0xffff
mov esi, ecx
cmp di, bx
jne 0x4081ff
xor eax, eax
jmp 0x4082d5
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x40822f
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp*2]
cmp ecx, eax
jae 0x40822f
lea ecx, [ebp - 1]
mov ax, bx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x4082d4
cmp dword [esi + 0x4c], 0
je 0x4082d1
mov ecx, esi
call fcn.0040a1ee
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40825c
push dword [esi + 0x4c]
push ebx
call fcn.0041f0dc
pop ecx
pop ecx
cmp ax, di
je 0x4082d1
movzx edi, bx
jmp 0x4082d1
movzx eax, bx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2a]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4082d1
cmp eax, 1
jle 0x4082a1
cmp eax, 3
jne 0x4082d1
push dword [esi + 0x4c]
push dword [esp + 0x1c]
jmp 0x40824b
mov ebp, dword [esp + 0x10]
lea eax, [esp + 0x1c]
sub ebp, eax
je 0x4082c0
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.0041fb03
add esp, 0x10
cmp ebp, eax
jne 0x4082d1
lea eax, [esp + 0x18]
mov byte [esi + 0x3e], 1
cmp dword [esp + 0x14], eax
mov ax, bx
jne 0x4082d4
mov ax, di
pop ebp
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00418deb
add esp, 0x30
ret 4
Function at 0x409314
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x46c004]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push ebp
or ebp, 0xffffffff
push esi
mov esi, ecx
cmp ebx, ebp
jne 0x409339
xor eax, eax
jmp 0x409404
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x409362
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x409362
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x4093ce
cmp dword [esi + 0x4c], 0
je 0x409401
mov ecx, esi
call fcn.0040a518
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40937f
movsx eax, bl
jmp 0x4093bd
lea eax, [esp + 0x10]
mov byte [esp + 0x1b], bl
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2f]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x409401
cmp eax, 1
jle 0x4093d2
cmp eax, 3
jne 0x409401
movsx eax, byte [esp + 0x1b]
push dword [esi + 0x4c]
push eax
call fcn.0041eba3
pop ecx
pop ecx
cmp eax, ebp
jne 0x4093ce
mov ebx, ebp
mov eax, ebx
jmp 0x409403
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
sub edi, eax
je 0x4093f1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0041fb03
add esp, 0x10
cmp edi, eax
jne 0x409401
lea eax, [esp + 0x1b]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x409403
mov eax, ebp
pop edi
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00418deb
add esp, 0x30
ret 4

Function at 0x40a275
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40a2fb
cmp byte [esi + 0x3e], 0
je 0x40a2fb
mov edi, 0xffff
push edi
call fcn.004081d7
cmp di, ax
je 0x40a2cd
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40a2d1
sub eax, 1
je 0x40a2d5
dec eax
sub eax, 1
je 0x40a2fb
xor al, al
jmp 0x40a2fd
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40a2f2
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0041fb03
add esp, 0x10
cmp edi, eax
jne 0x40a2cd
cmp byte [esi + 0x3e], 0
sete al
jmp 0x40a2fd
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00418deb
leave
ret
Function at 0x40a53b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40a5bd
cmp byte [esi + 0x3d], 0
je 0x40a5bd
push 0xffffffffffffffff
call fcn.00409314
cmp eax, 0xffffffff
je 0x40a58f
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40a593
sub eax, 1
je 0x40a597
dec eax
sub eax, 1
je 0x40a5bd
xor al, al
jmp 0x40a5bf
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40a5b4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0041fb03
add esp, 0x10
cmp edi, eax
jne 0x40a58f
cmp byte [esi + 0x3d], 0
sete al
jmp 0x40a5bf
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00418deb
leave
ret

Function at 0x40f70e
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x40f867
push 0x29
pop ebp
mov edx, 0x10000000
cmp eax, 0x7c
je 0x40f867
cmp eax, ebp
jne 0x40f74f
cmp dword [esi + 0x10], 0
mov eax, ebp
jne 0x40f867
cmp eax, ebp
jne 0x40f74f
test dword [esi + 0x50], edx
je 0x40f875
cmp eax, 0x2e
jne 0x40f76a
push 5
lea ecx, [esi + 0x24]
call fcn.0040f962
mov ecx, esi
call fcn.0040f6e5
jmp 0x40f852
cmp eax, 0x5c
jne 0x40f7bf
mov ecx, esi
call fcn.0040f6e5
test byte [esi + 0x50], 0x80
je 0x40f7b3
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x40f79b
push 4
lea ecx, [esi + 0x24]
call fcn.0040f962
mov ecx, esi
call fcn.0040f6e5
jmp 0x40f859
cmp eax, 0x42
jne 0x40f7b3
push 4
lea ecx, [esi + 0x24]
call fcn.0040f962
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x40f78f
mov ecx, esi
call fcn.0040ff4f
jmp 0x40f852
cmp eax, 0x5b
jne 0x40f7df
mov ecx, esi
call fcn.0040f6e5
mov ecx, esi
call fcn.0040ff03
cmp dword [esi + 0x4c], 0x5d
je 0x40f75e
push 4
jmp 0x40f877
cmp eax, 0x28
jne 0x40f7fb
mov ecx, esi
call fcn.0040f6e5
mov ecx, esi
call fcn.0041003d
mov bl, al
cmp dword [esi + 0x4c], ebp
jne 0x40f875
jmp 0x40f847
cmp eax, 0x5e
jne 0x40f804
push 2
jmp 0x40f787
cmp eax, 0x24
jne 0x40f810
push 3
jmp 0x40f787
cmp eax, 0x2a
je 0x40f871
cmp eax, 0x2b
je 0x40f871
cmp eax, 0x3f
je 0x40f871
cmp eax, 0x7b
je 0x40f871
cmp eax, 0x7d
jne 0x40f82e
test dword [esi + 0x50], edx
je 0x40f86d
cmp eax, 0x5d
jne 0x40f838
test dword [esi + 0x50], edx
je 0x40f7d8
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004101aa
mov bl, 1
mov ecx, esi
call fcn.0040f6e5
test bl, bl
je 0x40f859
mov ecx, esi
call fcn.004100d3
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x40f724
pop esi
pop ebp
mov al, cl
pop ebx
ret
push 6
jmp 0x40f877
push 0xa
jmp 0x40f877
push 5
call fcn.0040f06c
int3
Function at 0x416546
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x41654e
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416561
test al, 0x10
je 0x416561
mov al, 1
ret
xor al, al
ret

Function at 0x416564
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x46c004]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, edx
push edi
mov eax, dword [esi]
mov dword [esi + 4], eax
test ecx, ecx
je 0x416617
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x416617
push ebx
push ebp
xor ebp, ebp
mov dword [esi + 4], eax
push ebp
push 0x80
push 3
push ebp
push 5
push 0x120089
push ecx
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41660b
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x416604
cmp edi, dword [esp + 0x14]
jb 0x4165d2
mov edi, dword [esp + 0x14]
push esi
push edi
mov ecx, esi
call fcn.00416808
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
sub eax, dword [esi]
push ebp
push ecx
push eax
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4165ff
mov eax, dword [esi + 4]
sub eax, dword [esi]
cmp dword [esp + 0x10], eax
je 0x416604
mov eax, dword [esi]
mov dword [esi + 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
pop ebp
setne al
pop ebx
jmp 0x416619
xor al, al
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
call fcn.00418deb
add esp, 0x10
ret

Function at 0x41662a
Capabilities:
Enumerate files on windows

Disassembly:
push 0x26c
mov eax, 0x452a6e
call fcn.0044800e
mov edi, edx
cmp dword [ecx + 0x14], 8
jb 0x416643
mov ecx, dword [ecx]
lea eax, [ebp - 0x260]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41665f
xor al, al
jmp 0x4166f4
cmp word [ebp - 0x234], 0x2e
je 0x4166d5
test byte [ebp - 0x260], 0x10
jne 0x4166d5
and dword [ebp - 0x268], 0
lea ecx, [ebp - 0x278]
xor eax, eax
mov dword [ebp - 0x264], 7
mov word [ebp - 0x278], ax
lea eax, [ebp - 0x234]
push eax
call fcn.00409e5a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
mov eax, dword [edi + 4]
push ecx
cmp dword [edi + 8], eax
je 0x4166be
mov ecx, eax
call fcn.0040ac54
add dword [edi + 4], 0x18
jmp 0x4166c6
push eax
mov ecx, edi
call fcn.004166fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.004011f3
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41665f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
call fcn.00447fb8
ret
Function at 0x416cd7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
mov dword [esp + 4], ecx
push ebx
mov ebx, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 4], edx
push ebp
push esi
mov eax, dword [edx]
mov dword [edx + 4], eax
push edi
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x416d92
cmp dword [edi + 0x10], 0
je 0x416d92
cmp dword [ebx + 0x10], 0
je 0x416d92
mov esi, dword [0x46e4e0]
mov ebp, dword [0x46e4e4]
cmp esi, ebp
je 0x416d92
mov edx, edi
mov ecx, esi
call fcn.00412b0a
test al, al
jne 0x416d34
add esi, 0x18
cmp esi, ebp
jne 0x416d20
cmp esi, ebp
je 0x416d92
cmp dword [edi + 0x14], 8
jb 0x416d40
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x416d48
mov ebx, dword [ebx]
push edi
push ebx
mov ebx, dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x416d92
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x416d92
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x416d92
push dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [eax + edi]
push edx
push eax
call fcn.004170d9
mov al, 1
jmp 0x416d94
xor al, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x4256cd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042538d

Function at 0x42b31a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042afdd

Function at 0x42b325
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042b15e
Function at 0x29a091e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x29a091f4
pop dword [ebp - 0x14]
mov eax, 0x29a091f4
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x3b29c38f
add dword [ebp - 0x24], 0x132881bc
mov dword [ebp - 0x20], 0x7665caaa
add dword [ebp - 0x20], 0xbbcd819b
mov dword [ebp - 0x1c], 0x25e04b11
add dword [ebp - 0x1c], 0x266bf91d
mov dword [ebp - 0x18], 0xd5e4fe9b
add dword [ebp - 0x18], 0x2a1b0165
lea eax, [ebp - 0x24]
push eax
mov eax, 0x1977f124
add eax, 0x10294f68
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xaf09fb0
add dword [ebp - 0x24], 0x6981c9a6
mov dword [ebp - 0x20], 0x45ec0cc0
add dword [ebp - 0x20], 0xfb8054b5
mov dword [ebp - 0x1c], 0x73de6b51
add dword [ebp - 0x1c], 0xef91011b
mov dword [ebp - 0x18], 0x5cc52f22
sub dword [ebp - 0x18], 0x5cc52f22
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x38327
push 0
call eax
mov ecx, 0x3f77
mov esi, eax
mov edi, 0x29a22000
add edi, dword [ebp - 0x14]
mov edx, 0xbb81ba2c
sub dword [ebp - 0x10], eax
mov ebx, dword [edi]
xor dword [ebp - 8], edi
sub ebx, edx
xor dword [ebp - 4], edx
mov dword [esi], ebx
add dword [ebp - 0xc], 0x62efbd16
add esi, 0x5582dd64
sub esi, 0x5582dd60
add edi, 4
loop 0x29a092fa
add eax, 0x5172979a
add eax, 0xae8e5915
mov ebx, eax
add eax, 5
mov ecx, 0xc197f6fe
sub ecx, 0x97f7f6fe
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x445ec0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0
push 0x1012
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
movzx esi, ax
shr esi, 0xf
push 0x12
and esi, 1
call ebx
movzx edi, ax
shr edi, 0xf
push 0x11
and edi, 1
call ebx
shr eax, 0xf
and eax, 1
test byte [esp + 0x14], 1
jne 0x445f3d
test esi, esi
jne 0x445f3d
test edi, edi
jne 0x445f3d
test eax, eax
jne 0x445f3d
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
add esp, 0x14
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x4643c0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x8c04
call fcn.004b1040
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x8c00], eax
mov ecx, dword [esp + 0x8c0c]
lea eax, [esp + 0x8c10]
push eax
push ecx
lea edx, [esp + 8]
push 0x1400
push edx
call fcn.004b478b
xor eax, eax
mov word [esp + 0x280e], ax
mov eax, dword [esp + 0x8c18]
add esp, 0x10
sub eax, 0
je 0x464479
sub eax, 1
je 0x464457
sub eax, 1
jne 0x4644bd
push 0x1400
lea ecx, [esp + 0x2804]
push ecx
lea edx, [esp + 8]
push edx
call fcn.00456730
lea eax, [esp + 0x2800]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x464440
push esi
sub eax, edx
push eax
push 1
lea eax, [esp + 0x280c]
push eax
jmp 0x4644b5
lea eax, [esp]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x464460
sub eax, edx
push esi
sar eax, 1
push eax
push 2
lea ecx, [esp + 0xc]
jmp 0x4644b4
push 0x5000
lea edx, [esp + 0x3c04]
push edx
lea eax, [esp + 8]
push eax
call fcn.00478020
lea eax, [esp + 0x3c00]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4644a0
push esi
sub eax, edx
push eax
push 1
lea ecx, [esp + 0x3c0c]
push ecx
call fcn.004b39f8
add esp, 0x10
mov ecx, dword [esp + 0x8c00]
xor ecx, esp
call fcn.004b102c
add esp, 0x8c04
ret