joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4103d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 8], ecx
mov ebx, ecx
lea esi, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4103e3
sub edi, esi
xor esi, esi
test edi, edi
jle 0x4104a4
mov ah, byte [ebp - 1]
nop dword [eax]
mov al, byte [edx]
cmp al, 0x3d
je 0x4104a1
nop word [eax + eax]
test al, al
je 0x4104a1
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x410424
sub al, 0x41
jmp 0x410446
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x410430
sub al, 0x47
jmp 0x410446
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x41043c
add al, 4
jmp 0x410446
cmp al, 0x2b
je 0x410459
cmp al, 0x2f
je 0x410455
mov al, 0x40
inc edx
cmp al, 0x40
jne 0x41044f
mov al, byte [edx]
jmp 0x410410
cmp al, 0x41
je 0x4104a1
jmp 0x41045c
mov al, 0x3f
jmp 0x41045b
mov al, 0x3e
inc edx
mov ecx, esi
and ecx, 3
jmp dword [ecx*4 + 0x4104b0]
mov ah, al
shl ah, 2
jmp 0x410498
mov cl, al
shr cl, 4
or cl, ah
mov ah, al
mov byte [ebx], cl
inc ebx
shl ah, 4
jmp 0x410498
mov cl, al
shr cl, 2
or cl, ah
mov ah, al
mov byte [ebx], cl
inc ebx
shl ah, 6
jmp 0x410498
mov cl, ah
or cl, al
mov byte [ebx], cl
inc ebx
inc esi
cmp esi, edi
jl 0x410400
mov ecx, dword [ebp - 8]
pop edi
sub ebx, ecx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412bf0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37cc
call fcn.00458180
mov eax, dword [0x4f238c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
push esi
push edi
mov dword [ebp - 0x37cc], eax
xor edi, edi
nop word [eax + eax]
push edi
lea eax, [ebp - 0x108]
push str..PhysicalDrive_d
push eax
call fcn.004135a0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x412de3
push 0x2710
lea eax, [ebp - 0x37b8]
mov dword [ebp - 0x37c8], 0
push 0
push eax
mov dword [ebp - 0x37bc], 0
mov dword [ebp - 0x37c4], 0
mov dword [ebp - 0x37c0], 0
call fcn.0049e790
add esp, 0xc
lea eax, [ebp - 0x37c8]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0xc
lea eax, [ebp - 0x37c4]
push eax
push 0x2d1400
push esi
call ebx
test eax, eax
je 0x412dd6
mov edx, dword [ebp - 0x37ac]
lea eax, [ebp - 0xcc0]
push eax
push 0
lea ecx, [ebp - 0x37b8]
call fcn.00412a70
mov edx, dword [ebp - 0x37a8]
lea eax, [ebp - 0x8d8]
push eax
push 0
lea ecx, [ebp - 0x37b8]
call fcn.00412a70
mov edx, dword [ebp - 0x37a4]
lea eax, [ebp - 0x10a8]
push eax
push 0
lea ecx, [ebp - 0x37b8]
call fcn.00412a70
mov edx, dword [ebp - 0x37a0]
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x37b8]
call fcn.00412a70
add esp, 0x20
cmp byte [0x4f5790], 0
jne 0x412d9d
movsx eax, byte [ebp - 0x4f0]
push eax
call fcn.004a7322
add esp, 4
test eax, eax
jne 0x412d61
movsx eax, byte [ebp - 0x4dd]
push eax
call fcn.004a7322
add esp, 4
test eax, eax
je 0x412d9d
lea eax, [ebp - 0x4f0]
push eax
push 0x400
push 0x4f5790
call fcn.004a89b0
add esp, 0xc
lea eax, [ebp - 0x8d8]
push eax
push 0x400
push 0x4f5da0
call fcn.004a89b0
add esp, 0xc
mov dword [ebp - 0x37cc], 1
push 0x2710
lea eax, [ebp - 0x37b8]
push 0
push eax
call fcn.0049e790
add esp, 0xc
lea eax, [ebp - 0x37c8]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
jmp 0x412ddc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x10
jl 0x412c20
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x37cc]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00457808
mov esp, ebp
pop ebp
ret
Function at 0x416280
Capabilities:
Connect to http server
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2820
call fcn.00458180
mov eax, dword [0x4f238c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2820], eax
mov eax, dword [ebp + 0x10]
push str.RookIE_1.0
mov dword [ebp - 0x2814], eax
mov dword [ebp - 0x281c], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 3
push 0
push 0
push 0x50
mov edi, eax
push 0x4e7f03
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test edi, edi
je 0x416315
cmp dword [esi + 0x14], 0x10
jb 0x4162f2
mov esi, dword [esi]
push 0
push 0x80000800
push 0
push 0
push esi
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x2810], eax
test eax, eax
jne 0x41632a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457808
mov esp, ebp
pop ebp
ret 0xc
push 0
lea ecx, [ebp - 0x2818]
mov dword [ebp - 0x2818], 8
push ecx
lea ecx, [ebp - 0x281c]
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ebx, 0x2800
mov dword [ebp - 0x2808], 1
push ebx
xor edi, edi
call fcn.00457b5c
mov esi, eax
add esp, 4
test esi, esi
je 0x416315
push ebx
push edi
push esi
call fcn.0049e790
push ebx
lea eax, [ebp - 0x2804]
push edi
push eax
call fcn.0049e790
add esp, 0x18
cmp dword [ebp - 0x2808], edi
jbe 0x41643d
nop word [eax + eax]
lea eax, [ebp - 0x2808]
push eax
push 0x27ff
lea eax, [ebp - 0x2804]
push eax
push dword [ebp - 0x2810]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [ebp - 0x2808]
lea eax, [edi + ecx]
cmp eax, ebx
jbe 0x416411
add ebx, ebx
mov dword [ebp - 0x280c], esi
push ebx
call fcn.00457b5c
mov esi, eax
add esp, 4
test esi, esi
je 0x416315
push ebx
push 0
push esi
call fcn.0049e790
push edi
push dword [ebp - 0x280c]
push esi
call fcn.0049eca0
push dword [ebp - 0x280c]
call fcn.00434c8a
mov ecx, dword [ebp - 0x2808]
add esp, 0x1c
push ecx
lea eax, [ebp - 0x2804]
push eax
lea eax, [edi + esi]
push eax
call fcn.0049eca0
mov ecx, dword [ebp - 0x2814]
add esp, 0xc
mov eax, dword [ebp - 0x2808]
add edi, eax
mov dword [ecx], edi
test eax, eax
jne 0x4163a0
push dword [ebp - 0x2810]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x2820]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], esi
mov eax, dword [ebp - 0x2814]
mov dword [eax], edi
mov al, 1
pop edi
pop esi
pop ebx
call fcn.00457808
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418e33
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4f238c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
push esi
push str.MUTEX_CREATE_UITAB_CLIENT
call fcn.00404ba0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
xor esi, esi
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x418f41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x418f41
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call esi
push 1
mov edi, eax
call esi
cmp edi, 0x960
jl 0x418eaf
cmp eax, 0x5dc
jl 0x418eaf
mov dword [section..data], 3
jmp 0x418ec5
mov eax, dword [section..data]
cmp edi, 0x834
push 2
pop ecx
cmovge eax, ecx
mov dword [section..data], eax
call fcn.004053b0
push ebx
call fcn.0041e53b
pop ecx
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
pop edi
test eax, eax
js 0x418f41
push 0x400
call fcn.004578e1
pop ecx
test eax, eax
je 0x418ef9
mov ecx, eax
call fcn.00418f5b
mov esi, eax
jmp 0x418efb
mov esi, ebx
test esi, esi
je 0x418f41
push ebx
push 0x14c
push 0x23a
push ebx
push ebx
push ebx
push 0x10cf0000
push 0x4e7e9c
push ebx
mov ecx, esi
call fcn.0041ee74
mov ecx, esi
call fcn.0041ed1e
push 5
mov ecx, esi
call fcn.0041ed1a
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0041d8bb
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x1c]
call fcn.00405280
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00457808
leave
ret 0x10

Function at 0x41ae14
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
push str.label_anim
lea ecx, [edi + 0x2c]
call fcn.0041bb0c
push 0x23
push 1
push eax
lea ecx, [edi + 0x2c]
mov dword [edi + 0x36c], eax
call fcn.0041e80b
mov ecx, edi
pop edi
pop esi
jmp 0x41af51
xor eax, eax
push eax
push eax
push ecx
push 0x41af66
push eax
push eax
call fcn.004a42d1
add esp, 0x18
ret

Function at 0x41c3ef
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x41c412
or esi, 1
push 1
call edi
test ax, ax
jns 0x41c41e
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x41c42a
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x41c436
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x41d90e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x1c4]
call fcn.0041ed1a
mov edi, dword [ebp + 8]
test eax, eax
jle 0x41d964
push ebx
lea ecx, [esi + 0x1c4]
mov byte [ebp + 0xb], 0
call fcn.0041f78d
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x41d9c2
lea ecx, [esi + 0x1c4]
inc ebx
call fcn.0041ed1a
cmp ebx, eax
jl 0x41d92d
sub edi, 0x100
je 0x41da2f
sub edi, 4
je 0x41d9c6
dec edi
sub edi, 1
jne 0x41da26
push dword [ebp + 0xc]
and dword [ebp + 8], edi
call fcn.004a468e
pop ecx
mov ecx, dword [esi + 0x144]
lea edx, [ebp + 8]
push reloc.WS2_32.dll_ioctlsocket
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x41ec45
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x41da26
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x41da28
cmp dword [esi + 0x148], 0
je 0x41da26
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x158]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x15c]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.0041c3ef
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x148]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x41da26
mov ecx, dword [esi + 0x148]
test ecx, ecx
je 0x41da88
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x41da88
mov ecx, dword [esi + 0x148]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x41da88
mov ecx, dword [esi + 0x148]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0049fab3
pop ecx
pop ecx
test eax, eax
je 0x41da88
mov ecx, dword [esi + 0x148]
call fcn.00432f4e
test al, al
jne 0x41da26
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.0041e5bb
jmp 0x41d9c2
Function at 0x41e326
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [edi]
je 0x41e34d
cmp esi, dword [edi + 0x148]
je 0x41e34d
push dword [edi]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x148]
cmp esi, eax
je 0x41e433
test eax, eax
je 0x41e3b4
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x14
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x148]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0x148]
call fcn.0041e07a
and dword [edi + 0x148], 0
test esi, esi
je 0x41e433
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x41e433
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x41e433
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x41e433
xorps xmm0, xmm0
mov dword [edi + 0x148], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x148]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0x148]
call fcn.0041e07a
pop edi
pop esi
leave
ret 4
Function at 0x41f253
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x41f302
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x41f306
cmp dword [ebp - 0x1c], 0x10
jne 0x41f2d1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 4]
jne 0x41f2d1
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call fcn.0041ea53
pop ecx
test al, al
jne 0x41f2f3
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x41f306
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x41f29e
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x41f324
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x41f329
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41f35b
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x42a24d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4f238c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
push edi
and dword [ebx + 0x368], 0
mov edi, dword [ebp + 0x18]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x36c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x364], ecx
mov dword [ebx + 0x370], eax
mov dword [ebp - 0x18], ebx
mov byte [eax], 1
test ecx, ecx
jne 0x42a2c4
call fcn.00429fa5
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
test esi, esi
je 0x42a2c4
call fcn.00429fa5
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.00429fa5
mov edx, ebx
lea ecx, [ebx + 0x10]
neg edx
mov esi, dword [eax]
sbb edx, edx
and edx, ecx
mov ecx, eax
push edx
call dword [esi]
mov ecx, dword [ebx + 0x364]
test ecx, ecx
je 0x42a2ec
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov edi, eax
mov ecx, edi
call fcn.00418e1a
lea ecx, [ebp - 0x14]
mov ebx, eax
call fcn.0041f523
push 0
sub esp, 0x10
mov esi, eax
mov edi, esp
push 0x88
movsd dword es:[edi], dword [esi]
push connect
push 0
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.0041eee0
mov edi, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
jmp 0x42a331
push edi
call ebx
mov edi, eax
push edi
call ebx
test eax, eax
jne 0x42a32c
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457808
leave
ret 0x20

Function at 0x43490e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x109c], edi
je 0x434978
cmp dword [ebp + 8], 0x100
jne 0x434967
cmp word [ebp + 0xc], 0xd
jne 0x434967
cmp byte [esi + 0x10a2], 0
je 0x43494e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x434967
cmp byte [esi + 0x10a3], 0
jne 0x434967
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x434963
push edi
push edi
push edi
push str.return
push esi
call fcn.0041e07a
xor eax, eax
jmp 0x43497b
mov eax, dword [esi + 0x109c]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x434c8f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x434d00
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
test eax, eax
je 0x434d00
push eax
mov dword [ebp - 4], esi
call fcn.00457b5c
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp eax, dword [ebx]
je 0x434cfc
push esi
call fcn.00434c8a
pop ecx
xor esi, esi
mov eax, esi
jmp 0x434d02
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x434d07
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x8c
mov eax, 0x4c30ef
call fcn.00457873
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call fcn.0041c010
push eax
lea ecx, [ebp - 0x94]
call fcn.0041f533
xor edi, edi
lea ecx, [ebp - 0x94]
push esi
mov dword [ebp - 4], edi
call fcn.0041f7cd
push edi
push 0x80
push 3
push edi
push 1
push connect
lea ecx, [ebp - 0x94]
call fcn.00418e1a
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x434db1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x434db1
and dword [ebp - 0x98], 0
push eax
call fcn.00457b5c
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 0x98]
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebx]
je 0x434db3
push esi
call fcn.00434c8a
pop ecx
xor esi, esi
lea ecx, [ebp - 0x94]
call fcn.0041f68e
mov eax, esi
call fcn.0045782e
ret

Function at 0x434dc6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041c001
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x434dfd
push edi
call fcn.0041c001
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push edi
test ebx, ebx
jne 0x434e03
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop ebx
pop ebp
ret
call fcn.0041c001
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
je 0x434dfd
push esi
push eax
call fcn.00457b5c
mov esi, eax
mov eax, dword [ebp + 0x10]
pop ecx
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call fcn.0049eca0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop esi
jmp 0x434dff
Function at 0x443674
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x4436a2
cmp eax, edi
jge 0x443696
push esi
call fcn.0043fb6d
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x4436c5
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4436ab
mov dword [esi + 8], edx
jmp 0x4436da
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x4436d0
xor dl, dl
jmp 0x4436d5
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4436c5
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x443714
push str.zlib_corrupt
call fcn.0043fa98
add esp, 4
jmp 0x443754
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x443724
push str.read_past_buffer
jmp 0x44370a
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x44373e
push edi
push ecx
push esi
call fcn.00446190
add esp, 0xc
test eax, eax
je 0x443754
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0049eca0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x446421
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4f238c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4464db
movzx eax, word [esi]
test ax, ax
je 0x4464db
push edi
mov edi, esi
mov ecx, esi
mov edx, eax
cmp dx, 0x2f
je 0x446463
cmp dx, 0x5c
jne 0x446465
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x446457
cmp edi, esi
je 0x4464ae
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.004a8a0a
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4464e9
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00446421
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004a8ba1
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004a8b70
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00457808
leave
ret
call fcn.00457c86
int3
Function at 0x446aad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x446b29
cmp dword [edi + 4], 0xffffffff
jne 0x446b29
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4e7e98
push esi
call fcn.004a8b70
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x446afb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x446afb
mov eax, 0x2000000
jmp 0x446b2e
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00448fec
add esp, 0x10
test eax, eax
jne 0x446b19
mov eax, dword [ebp - 4]
jmp 0x446b2e
push eax
call fcn.0044970e
mov dword [edi], eax
mov eax, dword [0x4f4924]
pop ecx
jmp 0x446b2e
mov eax, 0x1000000
pop edi
leave
ret 0xc