joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408bea
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x413100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [section..data]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004047f2
mov dword [ebp - 0x14], eax
cmp dword [0x424f30], esi
jne 0x408cdd
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x408c6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x408dbd
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x408dbd
push 0x4101f8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x408dbd
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x424f30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x424f34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x424f38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x424f40], eax
test eax, eax
je 0x408cda
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x424f3c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x408d02
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x408cf5
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x408d17
push 4
pop eax
jmp 0x408dbf
cmp dword [ebp - 0x14], esi
je 0x408d17
push dword [0x424f30]
call dword [0x413004]
push 3
jmp 0x408cfc
mov eax, dword [0x424f3c]
mov ebx, dword [0x413004]
cmp eax, edi
je 0x408d75
cmp dword [0x424f40], edi
je 0x408d75
push eax
call ebx
push dword [0x424f40]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x408d75
test eax, eax
je 0x408d75
call ecx
test eax, eax
je 0x408d6a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x408d6a
test byte [ebp - 8], 1
jne 0x408d75
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x408da5
mov eax, dword [0x424f34]
cmp eax, edi
je 0x408da2
push eax
call ebx
test eax, eax
je 0x408da2
call eax
mov esi, eax
test esi, esi
je 0x408da2
mov eax, dword [0x424f38]
cmp eax, edi
je 0x408da2
push eax
call ebx
test eax, eax
je 0x408da2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x424f30]
call ebx
test eax, eax
je 0x408dbd
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x408dbf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040260e
mov esp, ebp
pop ebp
ret
Function at 0x45c960
Capabilities:
Get geographical location

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov dword [0x765a20], eax
mov dword [esp + 0x1c], 0
mov dword [0x76036c], 0xf00078
mov dword [0x76036c], 0xf0007b
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], 0x400
call sub.KERNEL32.dll_GetLocaleInfoW
sub esp, 0x10
mov ebx, eax
mov dword [0x76036c], 0xf0007c
call fcn.00572920
call fcn.00572920
call fcn.00572950
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0056f860
sub esp, 8
call fcn.00572950
mov dword [esp + 4], eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
call fcn.00572aa0
sub esp, 8
mov dword [0x76036c], 0xf0007d
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 4
mov dword [esp], 0x400
call sub.KERNEL32.dll_GetLocaleInfoW
sub esp, 0x10
test eax, eax
jne 0x45ca70
mov dword [0x76036c], 0xf0007f
mov dword [0x76036c], 0xf00080
call fcn.00572920
mov dword [esp], section..rdata
call fcn.00572a40
sub esp, 4
call fcn.005729f0
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00572ba0
sub esp, 4
mov eax, ebx
add esp, 0x28
pop ebx
ret 8
mov dword [0x76036c], 0xf0007e
call fcn.00572920
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00572a40
sub esp, 4
call fcn.005729f0
mov ebx, eax
jmp 0x45ca52
Function at 0x45caa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
sub esp, 0x48
mov dword [esp + 0x2c], 0x7603dc
mov dword [esp + 0x28], str.PureBasic.exe_shellopencommand
mov eax, dword [esp + 0x5c]
mov dword [0x765a20], eax
mov dword [esp + 4], str.PureBasic.exe_shellopencommand
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00572bd0
sub esp, 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.00572bd0
sub esp, 8
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [0x76036c], 0x800008
mov dword [0x76036c], 0x800009
mov dword [esp + 0x30], 0
mov dword [0x76036c], 0x800009
mov dword [esp + 0x34], 0
mov dword [0x76036c], 0x800009
mov dword [esp + 0x38], 0x400
mov dword [0x76036c], 0x800009
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00572080
sub esp, 4
mov dword [0x76036c], 0x80000a
test eax, eax
jne 0x45cbe0
mov dword [0x76036c], 0x800015
mov dword [0x76036c], 0x800016
call fcn.00572920
mov dword [esp], section..rdata
call fcn.00572a40
sub esp, 4
call fcn.005729f0
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00572ba0
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00572ba0
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00572ba0
sub esp, 4
mov eax, ebx
add esp, 0x48
pop ebx
ret 0x10
mov ebx, eax
mov dword [0x76036c], 0x80000b
lea eax, [esp + 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], SysStringLen
call sub.ADVAPI32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x45cc3b
mov dword [0x76036c], 0x80000c
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x45cc88
mov dword [0x76036c], 0x800011
mov dword [0x76036c], 0x800012
mov dword [0x76036c], 0x800013
mov dword [esp], ebx
call fcn.00571f60
sub esp, 4
mov dword [0x76036c], 0x800014
call fcn.00572920
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00572a40
sub esp, 4
call fcn.005729f0
mov ebx, eax
jmp 0x45cba1
mov dword [0x76036c], 0x80000d
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x38]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x34]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x45ccf8
mov dword [0x76036c], 0x80000f
mov dword [0x76036c], 0x800010
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.dll_RegCloseKey
sub esp, 4
jmp 0x45cc31
mov dword [0x76036c], 0x80000e
call fcn.00572920
call fcn.00572920
call fcn.00572950
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00571f80
sub esp, 8
call fcn.00572950
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.00572aa0
sub esp, 8
jmp 0x45ccc9
Function at 0x519239
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
push esi
mov esi, ebx
test eax, eax
je 0x5193df
cmp word [eax], bx
je 0x5193df
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x5193db
push ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test ebp, ebp
jle 0x5193d0
push edi
push dword [esp + 0x20]
call fcn.0051996f
mov edi, eax
test edi, edi
je 0x5193cf
cmp dword [esp + 0x20], 0xffffffff
mov ebx, dword [esp + 0x18]
jne 0x5192af
push 2
jmp 0x5192b3
push dword [esp + 0x20]
push ebx
call fcn.00519dfe
mov esi, eax
test esi, esi
je 0x5193c8
cmp ebx, 0xffffffff
jne 0x5192ca
mov ebx, esi
mov eax, dword [esi + 4]
mov dword [esi + 0x30], ebx
lea ebx, [ebp + 8]
mov dword [esi + 0x38], eax
xor eax, eax
push ebx
push eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x14], eax
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x28], eax
test eax, eax
je 0x51930b
mov dword [eax + 4], ebx
mov eax, dword [esi + 0x28]
and dword [eax], 0
mov eax, dword [esi + 0x28]
add eax, 8
mov dword [esi + 0x44], eax
cmp dword [esp + 0x20], 0xffffffff
je 0x519319
mov dword [esi + 0x34], 1
push esi
push edi
call fcn.00579770
pop ecx
pop ecx
xor ebx, ebx
mov ecx, 0x4000
mov dword [esp + 0x20], ecx
test ebp, ebp
jle 0x5193c4
lea eax, [ecx + ebx]
cmp eax, ebp
jle 0x519344
mov ecx, ebp
sub ecx, ebx
mov dword [esp + 0x20], ecx
push ecx
push edi
call fcn.00578f90
mov dword [esp + 0x20], eax
pop ecx
pop ecx
test eax, eax
je 0x5193b6
push 0
lea ecx, [esp + 0x20]
push ecx
push dword [esp + 0x28]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x1c]
add ebx, eax
cmp dword [esi + 0x14], 0
jne 0x519388
push eax
push dword [esp + 0x1c]
call fcn.00519a1a
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x1c]
cmp ebx, ebp
jl 0x519390
push 1
jmp 0x519392
push 0
push eax
push edi
call fcn.005793d0
add esp, 0xc
test eax, eax
je 0x5193aa
mov ecx, dword [esp + 0x20]
cmp ebx, ebp
jl 0x519335
jmp 0x5193c4
push edi
call fcn.00579240
pop ecx
mov dword [esi + 0x18], eax
jmp 0x5193bd
mov dword [esi + 0x18], 1
push edi
push esi
call fcn.00519ad4
and dword [esi + 0x2c], 0
push edi
call fcn.00579510
pop ecx
pop edi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov eax, esi
jmp 0x5193e1
xor eax, eax
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x51f2aa
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x51f2ff
push dword [esp + 0x10]
push 0x51f229
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x7607a4]
test esi, esi
je 0x51f358
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x51f2f7
cmp byte [esi + 0x10], 0
je 0x51f2f7
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x51f2d3
jmp 0x51f358
mov esi, dword [0x7607a4]
test esi, esi
je 0x51f358
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x51f351
cmp byte [esi + 0x11], 0
je 0x51f32d
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x51f344
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x7607a4
call fcn.00571ecd
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x51f30c
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x539ec2
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x765a90]
call fcn.00571742
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x539fc2
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x539f18
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x539f10
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x539f58
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x539f9a
push 0x22
pop edx
cmp cx, dx
je 0x539f4a
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x539f3a
xor ecx, ecx
cmp word [eax], cx
je 0x539f9a
mov ecx, eax
add eax, 2
jmp 0x539f9c
test dx, dx
je 0x539fa2
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x539f4a
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x539f90
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x539f9a
cmp cx, dx
je 0x539f8d
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x539f7d
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x539f62
jmp 0x539f4a
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x539fa4
xor edx, edx
cmp dword [ebp], ebx
jne 0x539fad
test edi, edi
jne 0x539fca
test edx, edx
je 0x539fb2
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x539f06
test edi, edi
jne 0x539fdb
mov eax, ebx
jmp 0x539fdf
test esi, esi
je 0x539fdb
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x539fdf
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x53a048
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x53a107
cmp dword [esp + 0x24], 2
je 0x53a107
push 0x2000
push ebp
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x53a0d6
cmp dword [esp + 0x18], 2
jne 0x53a0f2
cmp dword [esp + 0x28], 0xffffffff
je 0x53a09a
cmp ebp, dword [esp + 0x28]
jae 0x53a0f2
add ebp, 2
test ebx, ebx
jne 0x53a0bf
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x53a0f2
cmp ax, 0xd
je 0x53a0d6
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x53a086
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.0060bf70
jmp 0x53a199
push eax
push 0
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x53a125
cmp ebp, dword [esp + 0x28]
jae 0x53a17d
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53a17d
cmp dword [esp + 0x18], 1
jne 0x53a17d
inc ebp
test ebx, ebx
jne 0x53a16a
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x53a17d
cmp al, 0xd
je 0x53a118
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x53a118
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x53a194
call fcn.0060bde0
jmp 0x53a199
call fcn.0060bd80
push esi
push 0
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x53b5d2
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x53b634
cmp word [esi], di
je 0x53b634
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.005999f0
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.00599c00
add esp, 0x10
test eax, eax
jne 0x53b633
push 0x24
push 8
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [ecx + 0x20], eax
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x53c073
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x53bfc2
push 0x10
push 0x2c
call fcn.00571854
push 0
push 0
push 8
mov dword [0x7609d4], eax
call fcn.00571749
cmp word [0x7609cc], 0
mov dword [0x765b0c], eax
jne 0x53c158
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x53c0cb
mov word [0x7609cc], di
jmp 0x53c0d3
xor eax, eax
mov word [0x7609cc], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x7609e8], eax
test eax, eax
je 0x53c157
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x7609e8]
mov dword [0x7609d8], eax
call esi
push str.getnameinfo
push dword [0x7609e8]
mov dword [0x7609dc], eax
call esi
push str.WSAStringToAddressA
push dword [0x7609e8]
mov dword [0x7609e0], eax
call esi
cmp dword [0x7609d8], 0
mov dword [0x7609e4], eax
pop esi
je 0x53c157
cmp dword [0x7609dc], 0
je 0x53c157
cmp dword [0x7609e0], 0
je 0x53c157
test eax, eax
je 0x53c157
mov dword [0x7609d0], edi
pop edi
add esp, 0x190
ret

Function at 0x53e1d6
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push ebp
push edi
xor edi, edi
mov ebp, edi
test eax, eax
je 0x53e271
cmp word [eax], di
je 0x53e271
push esi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x53e26c
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push edi
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x53e264
push ebp
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], ebx
jne 0x53e255
push dword [esp + 0x1c]
push ebx
push edi
push dword [esp + 0x20]
call fcn.0053e9d0
mov ebp, eax
push edi
push 0
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, ebp
pop esi
jmp 0x53e273
xor eax, eax
pop edi
pop ebp
ret 0xc
Function at 0x53ff40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 1
call edi
mov ebx, 0x8000
test bx, ax
je 0x53ff5a
inc esi
push 2
call edi
test bx, ax
je 0x53ff66
or esi, 2
push 4
call edi
test bx, ax
je 0x53ff72
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5403b9
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.00557508
push eax
call fcn.0055acd6
push dword [0x760a2c]
mov dword [esp + 0x24], eax
call fcn.0057190c
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x54042d
inc ebx
push 0x12
call esi
test di, ax
je 0x540439
or ebx, 2
push 0x11
call esi
test di, ax
je 0x540445
or ebx, 4
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.0053ff40
push 0x54049a
push ebp
push dword [esp + 0x2c]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x34]
push dword [esp + 0x2c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x44]
movzx eax, ax
push 0x332c
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x18], eax
call fcn.0055c19c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x540ca0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x540cdc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x540d20
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x765b38]
call fcn.005717ab
test eax, eax
je case.0x540d4e.3
mov ecx, dword [esp + 8]
add ecx, 0xfffffffe
cmp ecx, 0x17
ja case.0x540d4e.3
movzx ecx, byte [ecx + 0x540e58]
jmp dword [ecx*4 + 0x540e40]
cmp dword [eax + 4], 0
je 0x540d6b
push 2
push 0x622a98
push eax
call fcn.00540ff0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x622a98
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x540d9a
push 3
push 0x6222b0
push eax
call fcn.00540ff0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 3
push 0x6222b0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x540dc9
push 2
push 0x622a9c
push eax
call fcn.00540ff0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x622a9c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x540df8
push 4
push 0x622aa0
push eax
call fcn.00540ff0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x622aa0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x540e27
push 4
push 0x622aa8
push eax
call fcn.00540ff0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x622aa8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x540e70
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x540ed5
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x540ecd
push dword [esp + 0x10]
push dword [0x765b38]
call fcn.005717ab
test eax, eax
je 0x540ec3
cmp dword [eax + 4], 0
je 0x540eb2
push edi
push esi
push eax
call fcn.00540ff0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc
Function at 0x540ee0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x540fe8
cmp word [edx], 0
je 0x540fe8
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x540f0e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x540f6d
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x540f40
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x540f20
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00540ff0
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x540f40
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00541100
mov edi, eax
test edi, edi
je 0x540f63
cmp dword [esi + 4], 0
je 0x540fbb
push dword [esp + 0x14]
push edi
push esi
call fcn.00540ff0
push edi
push 0
push dword [0x760378]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x760378]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc