joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
je 0x41395f
mov dword [edi], 0
jmp 0x413920
mov eax, 0x400000
cmp esi, 0x400000
ja 0x41392f
mov eax, esi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x413967
test ecx, ecx
je 0x41395f
test esi, esi
jne 0x413920
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
je 0x4139df
mov dword [edi], 0
jmp 0x4139a0
mov eax, 0x400000
cmp esi, 0x400000
ja 0x4139af
mov eax, esi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x4139e7
test ecx, ecx
je 0x4139df
test esi, esi
jne 0x4139a0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4163a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edx, edx
jmp 0x4163b0
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x489360], ecx
inc edx
cmp edx, 0x100
jb 0x4163b0
cmp edx, 0x800
jae 0x416489
lea ebx, [ebx]
mov eax, dword [edx*4 + 0x488f60]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x489360]
inc edx
mov dword [edx*4 + 0x48935c], eax
cmp edx, 0x800
jb 0x416460
lea esi, [ebp - 0x24]
mov dword [0x48812c], 0x416fb0
call fcn.00417070
test eax, eax
je 0x416546
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov esi, eax
shr eax, 4
shr esi, 8
and eax, 0xf00f
and esi, 0xff00f
xor edi, edi
mov dword [ebp - 4], eax
mov ecx, 0x486574
xor edx, edx
mov eax, dword [ecx - 8]
cmp eax, dword [ebp - 0x20]
jne 0x4164dc
mov eax, dword [ebp - 0x1c]
cmp dword [ecx - 4], eax
jne 0x4164dc
cmp dword [ecx], ebx
je 0x416514
add edx, 0xc
inc edi
add ecx, 0xc
cmp edx, 0x24
jb 0x4164c8
or ecx, 0xffffffff
sub ecx, 0
je 0x41652c
dec ecx
je 0x416518
dec ecx
jne 0x416546
cmp esi, 6
jb 0x416546
jne 0x41653c
cmp dword [ebp - 4], 0xf
jb 0x416546
mov dword [0x48812c], 0x417060
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
jmp 0x4164eb
cmp esi, 5
jb 0x416546
jne 0x41653c
mov eax, dword [ebp - 4]
cmp eax, 6
jb 0x416546
cmp eax, 0xa
jmp 0x41653a
cmp esi, 6
jb 0x416546
jne 0x41653c
cmp dword [ebp - 4], 0x100c
je 0x416546
mov dword [0x48812c], 0x417060
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx]
and esi, 7
mov dword [ebp - 4], 0
cmp eax, 5
jae 0x417532
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
lea edx, [edx + eax - 4]
push ebx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], edx
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
add edi, eax
cmp edi, edx
jae 0x417560
mov cl, byte [edi]
and cl, 0xfe
cmp cl, 0xe8
je 0x417560
inc edi
cmp edi, edx
jb 0x417551
mov ebx, edi
sub ebx, eax
mov eax, ebx
sub eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
cmp edi, edx
jae 0x417667
cmp eax, 3
jbe 0x417597
xor esi, esi
mov al, byte [edi + 4]
mov dword [ebp - 8], ebx
test al, al
je 0x4175d4
cmp al, 0xff
je 0x4175d4
and esi, 3
add esi, esi
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x417545
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x41757b
movzx eax, byte [esi + 0x4799f8]
mov ecx, edi
sub ecx, eax
cmp byte [esi + 0x4799f0], 0
mov al, byte [ecx + 4]
je 0x4175c0
test al, al
je 0x4175c0
cmp al, 0xff
jne 0x41757b
and esi, 3
add esi, esi
mov dword [ebp - 8], ebx
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x417545
movzx ecx, byte [edi + 2]
movzx edx, al
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
sub edx, ebx
lea eax, [edx - 5]
test esi, esi
je 0x417637
movzx edx, byte [esi + 0x4799f8]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
mov cl, bl
test cl, cl
je 0x41761e
cmp cl, 0xff
jne 0x417634
mov ebx, dword [ebp - 4]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x4175f2
mov ebx, dword [ebp - 4]
mov ecx, eax
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
add ebx, 5
mov byte [edi + 3], dl
mov edx, dword [ebp - 0xc]
mov byte [edi + 2], cl
mov byte [edi + 1], al
mov dword [ebp - 4], ebx
jmp 0x417545
cmp eax, 3
jbe 0x41767c
mov edx, dword [ebp + 0xc]
pop edi
xor esi, esi
mov eax, ebx
pop ebx
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea ecx, [eax - 1]
shl esi, cl
pop edi
mov eax, ebx
pop ebx
and esi, 7
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41bef5
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jns 0x41bf0b
push 8
pop edi
push 2
call esi
test ax, ax
jns 0x41bf17
or edi, 1
push 1
call esi
test ax, ax
jns 0x41bf23
or edi, 2
push 0x10
call esi
test ax, ax
jns 0x41bf2f
or edi, 4
push 0x12
call esi
test ax, ax
jns 0x41bf3b
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x41de6b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x41de93
cmp ebx, dword [esi + 0x140]
je 0x41de93
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x140]
cmp ebx, eax
je 0x41df6a
push edi
test eax, eax
je 0x41def2
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x140]
mov ecx, esi
call fcn.0041d96a
mov dword [esi + 0x140], edi
test ebx, ebx
je 0x41df69
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x41df69
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc0]
test al, al
je 0x41df69
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xcc]
test al, al
je 0x41df69
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x140], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x140]
mov ecx, esi
call fcn.0041d96a
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41e18b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x1bc]
xor ebx, ebx
call fcn.0043aacb
test eax, eax
jle 0x41e1e0
push ebx
lea ecx, [esi + 0x1bc]
mov byte [ebp - 1], 0
call fcn.0041fcdf
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x41e244
lea ecx, [esi + 0x1bc]
inc ebx
call fcn.0043aacb
cmp ebx, eax
jl 0x41e1a7
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x41e2a9
sub eax, 4
je 0x41e248
dec eax
dec eax
jne 0x41e2a0
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.00452b7e
pop ecx
mov ecx, dword [esi + 0x13c]
push 0x8000000a
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x41d141
call dword [eax + 0xf4]
mov esi, eax
test esi, esi
je 0x41e2a0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xe8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x41e2a2
cmp dword [esi + 0x140], 0
je 0x41e2a0
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x150]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x154]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.0041bef5
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x140]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x41e2a0
cmp dword [esi + 0x140], 0
je 0x41e307
mov ecx, dword [esi + 0x140]
mov eax, dword [ecx]
call dword [eax + 0xc0]
test al, al
je 0x41e307
mov ecx, dword [esi + 0x140]
mov eax, dword [ecx]
call dword [eax + 0xcc]
test al, al
je 0x41e307
mov ecx, dword [esi + 0x140]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.00452f2e
pop ecx
pop ecx
test eax, eax
je 0x41e307
mov ecx, dword [esi + 0x140]
call fcn.0043513b
test al, al
jne 0x41e2a0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns al
movzx eax, al
push eax
mov ecx, esi
call fcn.0041e030
jmp 0x41e244
Function at 0x4268eb
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x46b086
call fcn.00453fde
mov edi, dword [ebp + 8]
mov ebx, ecx
call fcn.00425edb
call fcn.0041c072
push eax
lea ecx, [ebp - 0x94]
call fcn.004200ed
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0041c078
mov ecx, eax
call fcn.0041fe41
test al, al
je 0x426a33
push edi
lea ecx, [ebp - 0x94]
call fcn.0041fedd
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.0041fe6a
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push esi
cmp eax, 0xffffffff
jne 0x42698f
push str.Error_opening_file
mov ecx, ebx
call fcn.004260b1
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0041fd16
mov al, bl
call fcn.00454028
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
jne 0x4269a4
push esi
push str.File_is_empty
jmp 0x42696d
cmp edi, 0x400000
jbe 0x4269b4
push esi
push 0x46fbec
jmp 0x42696d
push edi
mov dword [ebp - 0x2cc], esi
call fcn.00419ceb
pop ecx
push esi
lea ecx, [ebp - 0x2cc]
push ecx
push edi
push eax
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2c8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2cc], edi
je 0x426a0f
push dword [ebp - 0x2c8]
call fcn.004514d7
pop ecx
mov ecx, ebx
call fcn.00425edb
push esi
push str.Could_not_read_file
jmp 0x42696d
push dword [ebp + 0xc]
mov ecx, ebx
push edi
push dword [ebp - 0x2c8]
call fcn.00426798
push dword [ebp - 0x2c8]
mov bl, al
call fcn.004514d7
pop ecx
jmp 0x426976
call fcn.0041c078
push eax
lea ecx, [ebp - 0x94]
call fcn.0041fec0
call fcn.0041c07e
test al, al
je 0x426a54
call fcn.0041c084
jmp 0x426a6b
push 2
push esi
lea ecx, [ebp - 0x94]
call fcn.0041fe6a
push eax
call fcn.0043448c
add esp, 0xc
mov dword [ebp - 0x2c8], eax
cmp eax, esi
jne 0x426a80
push esi
push str.Error_opening_zip_file
jmp 0x42696d
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d0]
push eax
push 1
push edi
push dword [ebp - 0x2c8]
call fcn.00432ba4
add esp, 0x14
test eax, eax
je 0x426aae
push esi
push str.Could_not_find_ziped_file
jmp 0x42696d
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2cc], eax
cmp eax, esi
je 0x42699c
cmp eax, 0x400000
ja 0x4269ac
push eax
call fcn.00419ceb
push 3
push dword [ebp - 0x2cc]
mov edi, eax
push edi
push dword [ebp - 0x2d0]
push dword [ebp - 0x2c8]
call fcn.004344ea
add esp, 0x18
cmp eax, esi
je 0x426b24
cmp eax, 0x600
je 0x426b24
push edi
call fcn.004514d7
pop ecx
call fcn.0041c07e
test al, al
jne 0x426b19
push dword [ebp - 0x2c8]
call fcn.00434522
pop ecx
push esi
push str.Could_not_unzip_file
jmp 0x42696d
call fcn.0041c07e
test al, al
jne 0x426b39
push dword [ebp - 0x2c8]
call fcn.00434522
pop ecx
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp - 0x2cc]
push edi
call fcn.00426798
push edi
jmp 0x426a26
Function at 0x427166
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2d0
mov eax, 0x46b0ea
call fcn.00453fde
mov dword [ebp - 0x2dc], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2d8], esi
call fcn.0041c072
push eax
lea ecx, [ebp - 0x94]
call fcn.004200ed
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0041c078
mov ecx, eax
call fcn.0041fe41
test al, al
je 0x42724f
push esi
lea ecx, [ebp - 0x94]
call fcn.0041fedd
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.0041fe6a
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c8], eax
cmp eax, 0xffffffff
jne 0x4271fb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0041fd16
jmp 0x427341
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
je 0x4271e7
push esi
mov dword [ebp - 0x2d0], edi
call fcn.00419ceb
pop ecx
push edi
mov ebx, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push ebx
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x42732e
push ebx
call fcn.004514d7
pop ecx
jmp 0x4271e7
call fcn.0041c078
push eax
lea ecx, [ebp - 0x94]
call fcn.0041fec0
call fcn.0041c07e
test al, al
je 0x427270
call fcn.0041c084
jmp 0x427287
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0041fe6a
push eax
call fcn.0043448c
add esp, 0xc
mov dword [ebp - 0x2c8], eax
cmp eax, edi
je 0x4271e7
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push esi
push dword [ebp - 0x2c8]
call fcn.00432ba4
add esp, 0x14
test eax, eax
jne 0x4271e7
mov esi, dword [ebp - 0x98]
cmp esi, edi
je 0x4271e7
push esi
call fcn.00419ceb
push 3
push esi
mov ebx, eax
push ebx
push dword [ebp - 0x2d4]
push dword [ebp - 0x2c8]
call fcn.004344ea
add esp, 0x18
cmp eax, edi
je 0x427319
cmp eax, 0x600
je 0x427319
push ebx
call fcn.004514d7
pop ecx
call fcn.0041c07e
test al, al
jne 0x4271e7
push dword [ebp - 0x2c8]
call fcn.00434522
jmp 0x42724c
call fcn.0041c07e
test al, al
jne 0x42732e
push dword [ebp - 0x2c8]
call fcn.00434522
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0041fd16
cmp ebx, edi
jne 0x4273c0
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x2d8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c8], eax
cmp eax, 0xffffffff
je 0x4273bc
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
je 0x4273bc
push esi
mov dword [ebp - 0x2cc], edi
call fcn.00419ceb
pop ecx
push edi
mov ebx, eax
lea eax, [ebp - 0x2cc]
push eax
push esi
push ebx
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2cc], esi
je 0x4273b8
push ebx
call fcn.004514d7
pop ecx
xor ebx, ebx
cmp ebx, edi
jne 0x4273c0
xor eax, eax
jmp 0x4273d8
mov ecx, dword [ebp - 0x2dc]
push esi
push ebx
call fcn.00426f2c
push ebx
mov esi, eax
call fcn.004501b9
pop ecx
mov eax, esi
call fcn.00454028
ret 4
Function at 0x4316e1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4316ef
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x4317aa
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x471cd0]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x471cd0]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x471cd0]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x471cd0]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x471cd0]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x471cd0]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x471cd0]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x471cd0]
add edx, 8
sub edi, 8
dec esi
jne 0x43170d
pop ebx
test edi, edi
je 0x4317c3
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x471cd0]
inc edx
dec edi
jne 0x4317ae
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x431c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x431ca4
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x431c9f
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x431ccc
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x431cb5
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00453830
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x432aee
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x485370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x432b96
movzx ecx, word [esi]
test cx, cx
je 0x432b96
mov eax, esi
mov edx, esi
cmp cx, 0x2f
je 0x432b29
cmp cx, 0x5c
jne 0x432b2b
mov eax, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x432b1d
cmp eax, esi
je 0x432b6a
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00456d58
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00432aee
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00456df0
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00456dbf
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004501c4
leave
ret
Function at 0x4340c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x43413e
cmp dword [esi + 4], 0xffffffff
jne 0x43413e
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x47a348
push edi
call fcn.00456dbf
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x434110
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x434110
mov eax, 0x2000000
jmp 0x434143
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00431a7d
add esp, 0x10
test eax, eax
jne 0x43412e
mov eax, dword [ebp + 0x10]
jmp 0x434143
push eax
call fcn.00433cb2
mov dword [esi], eax
mov eax, dword [0x487128]
pop ecx
jmp 0x434143
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x435377
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4ec], ebx
je 0x4353df
cmp dword [ebp + 8], 0x100
jne 0x4353ce
cmp word [ebp + 0xc], 0xd
jne 0x4353ce
cmp byte [esi + 0x4f2], bl
je 0x4353b5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4353ce
cmp byte [esi + 0x4f3], bl
jne 0x4353ce
mov ecx, dword [esi + 0x44]
cmp ecx, ebx
je 0x4353ca
push ebx
push ebx
push ebx
push 0x4725b0
push esi
call fcn.0041d96a
xor eax, eax
jmp 0x4353e2
mov eax, dword [esi + 0x4ec]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4423e1
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x485370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x28], ebx
cmp edi, 0x4e
jne 0x44240c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp edi, 8
jne 0x4424d9
push ebx
push 0x475310
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x442493
push 0x20
pop esi
push esi
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.00453660
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x100e
push edi
mov dword [ebp - 0x24], esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x18], 0x1010003
jne 0x442476
xor eax, eax
inc eax
jmp 0x442482
cmp dword [ebp - 0x18], 0x2010003
je 0x442471
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004501c4
leave
ret 0xc
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x14]
jl 0x4424c1
cmp eax, dword [ebp - 0xc]
jg 0x4424c1
cmp eax, dword [ebp - 0x10]
jl 0x4424c1
cmp eax, dword [ebp - 8]
jle 0x44247f
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push 8
call fcn.00442129
mov dword [ebp - 0x28], eax
jmp 0x44247f
mov ecx, dword [ebp + 0xc]
mov eax, 0x101
cmp edi, eax
jne 0x44254a
cmp ecx, 0x2e
je 0x4424ef
cmp ecx, 8
jne 0x442526
push dword [ebp + 0x10]
push ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov edi, eax
mov eax, dword [esi + 0x10]
mov dword [eax + 0x5a8], 2
mov ecx, dword [esi + 0x10]
call fcn.00441f82
push ebx
push ebx
push 0x10
mov ecx, esi
call fcn.0041bce2
mov eax, edi
jmp 0x442482
cmp ecx, 0x1b
jne 0x44254a
push dword [ebp + 0x10]
push ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esi + 0x10]
mov dword [ecx + 0x5a8], 3
mov edi, eax
jmp 0x442514
push dword [ebp + 0x10]
push ecx
push edi
mov ecx, esi
call fcn.0041bcfb
jmp 0x442482