joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ffe9c50
Capabilities:
Encode data using xor

Disassembly:
or dl, 0x13
mov ecx, 0x6366c16
or al, 0x96
dec esp
cmp ebp, esi
and dword [eax + 0x313a805c], esi
sbb al, 0
lcall 0x7435, 0x2d34b7b3
mov ebp, 0x20170886
pop ecx
lea esi, [eax + 0x182bbfb7]
or dword [eax], esp
sbb al, 0x25
adc byte [edi], bl
nop
cmpsb byte [esi], byte es:[edi]
mov cl, 0xbc
sbb bh, byte [ebx]
xor dword [eax - 0x7f038383], esp
movsd dword es:[edi], dword [esi]
xor bh, byte [edi + ecx*4]
cli
or bl, al
adc esp, dword [esp + edi - 0x78]
movsb byte es:[edi], byte [esi]
scasb al, byte es:[edi]
and byte [ebp - 0x6c6e72a], bl
test al, 0x87
adc eax, 0x7e2fe33c
wait
and edi, dword [ecx]
stosd dword es:[edi], eax
fdivr qword [edx]
test byte [eax - 0x6d18900], bl
or esi, ecx
das
mov al, 0xaa
push es
inc ebx
sub eax, 0xbcb81c16
xor dword [edi], ebp
sub eax, 0x45f03a2f
jp sym.odsfkvozg.dll_ServiceMain
and eax, 0x8dd9144
outsb dx, byte [esi]
xchg byte [edx], al
nop
add dword [ebp + 4], edi
ja 0x7ffe9cde
into
and eax, 0x390680a9
cmp eax, 0xc5850af0
adc byte [esi - 0x2b], dh
das
scasb al, byte es:[edi]
xchg edi, eax
and ebx, dword [edx + 0x3d]
push es
xchg edx, eax
pushfd
inc edx
mov dl, 0x5c
xor al, byte [ebp + edx*4 + 0x1c05e2c]
cmpsb byte [esi], byte es:[edi]
jae 0x7ffe9d30
cmc
sub byte [ebx + 0x45b38072], al
call 0xc0cf3511
push ebx
out 0xd, al
mov ecx, 0x29090340
clc
sub al, 0x65
std
lahf
cmp esp, dword [0x17e53a35]
cmp dl, al
inc byte [ebx + 0x2131051a]
invalid
sub eax, 0x29cc2e09
xor esp, ebp
sub bl, byte [edi + edx - 0x3ceafdca]
setp byte [ebp + 0x1b]
lodsd eax, dword [esi]
and dword [edi], ebx
fbld tbyte ss:[ecx]
mov dh, 0xfb
pushfd
adc al, byte [0x7a8993b]
invalid
Function at 0x40100a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
jmp 0x401210
push ecx
push ebx
push ebp
push esi
push edi
push 0x1f8
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [0x405974], eax
xor ebx, ebx
xor eax, eax
mov ecx, dword [0x405974]
mov byte [ecx + eax], al
inc eax
cmp eax, 0x1f8
jl 0x40122c
mov eax, dword [esp + 0x20]
mov byte [esp + 0x20], bl
xor esi, esi
mov byte [eax], bl
mov byte [eax + 1], bl
mov edi, dword [esp + 0x20]
mov ebp, dword [0x405974]
mov eax, dword [esp + 0x18]
and edi, 0xff
xor edx, edx
lea ecx, [ebx + ebp]
mov dl, byte [edi + eax]
xor eax, eax
mov al, byte [ecx]
add esi, edx
add eax, esi
mov esi, 0x1f8
cdq
idiv esi
mov byte [esp + 0x10], dl
mov esi, dword [esp + 0x10]
and esi, 0xff
lea edx, [esi + ebp]
push edx
push ecx
call fcn.00401560
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x1c]
inc ebx
cmp ebx, 0x1f8
mov byte [esp + 0x20], dl
jl 0x40124c
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x408cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408d29
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408d29
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x408d1a
cmp esi, edx
jae 0x408d29
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x408d08
cmp esi, edx
jae 0x408d29
cmp word [esi], 0
je 0x408d29
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40b580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1808
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5221ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0041d786
mov edi, eax
add esp, 4
test edi, edi
je 0x40b623
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004151bc
add esp, 4
mov dword [edi + 4], eax
jmp 0x40b625
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00403a60
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x40b685
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40b685
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x40b6a9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40b6cb
cmp byte [ebp + 0xc], 0
je 0x40b6b8
push esi
call fcn.00415768
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40b6d7
mov esi, str.ios_base::badbit_set
jmp 0x40b6e7
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040b710
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00404800
push 0x516564
lea eax, [ebp - 0x30]
push eax
call fcn.004b32bd
int3
Function at 0x40f3a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5221ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40f427
test ebx, ebx
je 0x40f427
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40f427
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40f427
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40f421
push esi
push ebx
push edi
call fcn.004b3330
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40f421
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d647
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d647
mov esp, ebp
pop ebp
ret

Function at 0x413880
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.0041d910
mov eax, dword [0x5221ec]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1048], 0x44
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1048]
push edi
mov edi, dword [ebp + 0xc]
push eax
movlpd qword [ebp - 0x1044], xmm0
movlpd qword [ebp - 0x103c], xmm0
movlpd qword [ebp - 0x1034], xmm0
movlpd qword [ebp - 0x102c], xmm0
movlpd qword [ebp - 0x1024], xmm0
movlpd qword [ebp - 0x101c], xmm0
movlpd qword [ebp - 0x1014], xmm0
movlpd qword [ebp - 0x100c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 5
mov dword [ebp - 0x101c], 1
push 0x1000
mov word [ebp - 0x1018], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x1004]
push 0
push eax
movups xmmword [ebp - 0x1058], xmm0
call fcn.004b30b0
add esp, 0xc
cmp dword [edi + 0x10], 0
je 0x41395f
cmp dword [edi + 0x14], 8
jb 0x41393d
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x413947
mov eax, dword [esi]
push edi
push eax
lea eax, [ebp - 0x1004]
push str.__s___s
push eax
call fcn.00412b80
add esp, 0x10
jmp 0x41397e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x413969
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x1004]
push str.__s_
push eax
call fcn.00412b80
add esp, 0xc
cmp byte [ebp + 0x10], 0
je 0x413999
cmp dword [esi + 0x14], 8
jb 0x41398c
mov esi, dword [esi]
push esi
call fcn.00419df0
add esp, 4
test eax, eax
je 0x4139ef
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1004]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x4139ef
push dword [ebp - 0x1054]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1058]
call esi
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d647
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0041d647
mov esp, ebp
pop ebp
ret
Function at 0x41c930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2d51
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5221ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.00406540
mov ecx, eax
test ecx, ecx
je 0x41cac4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ca85
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41ca77
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x41ca85
add eax, 0x10
push 0x5281e4
push eax
mov dword [ebp - 0x20], eax
call fcn.0041d848
mov esi, eax
add esp, 8
test esi, esi
je 0x41ca85
push dword [ebp - 0x20]
push 0
push esi
call fcn.004b30b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41ca3a
push esi
call fcn.0041d7cd
add esp, 4
jmp 0x41ca85
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ca40
sub ecx, edx
sar ecx, 1
je 0x41ca6e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ca56
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00408a80
push esi
call fcn.0041d7cd
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41ca85
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41caa4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d647
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00405ce0
int3
Function at 0x41cad0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5221ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41caf4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x41cb56
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x41cb56
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41cb71
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d647
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41f060
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2f2f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5221ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00406540
mov ecx, eax
test ecx, ecx
je 0x41f214
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00406540
mov ecx, eax
test ecx, ecx
je 0x41f21e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00406540
mov ecx, eax
test ecx, ecx
je 0x41f228
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov dword [esi + 0x10], eax
test edx, edx
jne 0x41f138
xor ecx, ecx
jmp 0x41f150
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f140
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00408a80
push edi
mov ecx, ebx
call fcn.0040e970
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x41f16c
xor ecx, ecx
jmp 0x41f184
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f174
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00408a80
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.004200c0
push eax
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.0040e970
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f1c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x41f1fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41f1fe
cmp dword [esi + 0x10], 0
je 0x41f1f5
push dword [edi]
call fcn.004c3492
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00405ce0
push 0x80004005
call fcn.00405ce0
push 0x80004005
call fcn.00405ce0
int3
Function at 0x41fee0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3048
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5221ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x420041
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.__set_log_lev0
push edi
call ebx
test eax, eax
je 0x41ff38
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 4]
jmp 0x420041
push str.__set_log_lev1
push edi
call ebx
test eax, eax
je 0x41ff52
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
jmp 0x420041
push str.__set_log_lev2
push edi
call ebx
test eax, eax
je 0x41ff6c
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 4]
jmp 0x420041
push str.__set_log_lev3
push edi
call ebx
test eax, eax
je 0x41ff86
mov eax, dword [esi]
mov ecx, esi
push 3
call dword [eax + 4]
jmp 0x420041
push str.__reload_log_switch
push edi
call ebx
test eax, eax
je 0x420041
push 3
mov ecx, esi
call fcn.0041fea0
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403fd0
push 0x4f0810
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004218a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41ffde
push 0
mov ecx, esi
call fcn.0041fea0
lea eax, [esi + 0x2c]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x41ffef
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x44], 0
mov byte [ebp - 4], 1
je 0x420031
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x420031
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 4]
call eax
test al, al
je 0x420031
push str._______log_reload_switch
lea ecx, [ebp - 0x44]
call fcn.0040ff10
mov ecx, dword [esi + 0x44]
lea edx, [ebp - 0x44]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x44]
call fcn.00404ca0
lea ecx, [ebp - 0x2c]
call fcn.0041f310
lea ecx, [ebp - 0x28]
call fcn.00404ca0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d647
mov esp, ebp
pop ebp
ret 4
Function at 0x421ea0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e338b
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x5221ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [edi]
mov eax, dword [ebp + 8]
push eax
call dword [edx]
cmp byte [edi + 0xc], 0
je 0x421fd6
mov ebx, dword [edi + 0x14]
lea esi, [edi + 0x20]
push 0x180
push 0x40
push 0x8109
push ebx
push esi
call fcn.004c3da0
add esp, 0x14
mov dword [ebp - 0xac], eax
test eax, eax
je 0x421fb6
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.004b30b0
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
push 2
call fcn.0041eee0
push 0x4f0584
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push str._error.__
push ebx
push str.open
push eax
call fcn.00403110
add esp, 8
push eax
call fcn.00403110
add esp, 8
push eax
call fcn.00403110
add esp, 8
mov ecx, eax
call fcn.0041f490
push eax
call fcn.00403110
add esp, 8
lea eax, [ebp - 0xd8]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00421de0
cmp dword [eax + 0x14], 8
jb 0x421f99
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xd8]
call fcn.00404ca0
lea ecx, [ebp - 0xa8]
call fcn.004055c0
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x421fcc
push 2
push 0
push eax
call fcn.004c41c9
add esp, 0xc
jmp 0x421fcf
or eax, 0xffffffff
mov dword [edi + 8], eax
mov byte [edi + 0xc], 0
mov eax, dword [edi + 4]
mov dword [ebp - 0xc0], eax
test eax, eax
je 0x4220f4
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor bl, bl
push 0
push eax
call esi
test eax, eax
movzx edx, bl
mov ecx, 1
cmove edx, ecx
mov dword [ebp - 0xac], edx
test dl, dl
jne 0x422029
cmp dword [ebp + 0xc], 0
je 0x422021
push 0xffffffffffffffff
push dword [edi + 4]
call esi
mov byte [ebp - 0xac], 1
jmp 0x422029
test dl, dl
je 0x4220f4
lea ecx, [edi + 0x24]
mov dword [ebp - 0xb8], 0
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
cmp eax, ecx
je 0x4220cd
mov esi, dword [ecx]
mov dword [ecx], 0
mov edx, dword [ecx + 4]
mov dword [ecx + 4], 0
mov eax, dword [ecx + 8]
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb0], eax
mov dword [ecx + 8], 0
cmp esi, edx
je 0x4220cd
nop dword [eax]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x42209a
mov ecx, dword [esi]
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x4220b9
push dword [esi + 0x10]
push ecx
push eax
call fcn.004c477f
mov edx, dword [ebp - 0xbc]
add esp, 0xc
mov ecx, eax
jmp 0x4220bc
or ecx, 0xffffffff
mov ebx, dword [edi + 8]
add esi, 0x18
add ebx, ecx
mov dword [edi + 8], ebx
cmp esi, edx
jne 0x422090
jmp 0x4220d0
mov ebx, dword [edi + 8]
lea ecx, [ebp - 0xb8]
call fcn.0041d2b0
cmp byte [ebp - 0xac], 0
je 0x4220f0
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
jmp 0x4220f7
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d647
mov esp, ebp
pop ebp
ret 8
Function at 0x4246f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3558
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5221ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0041d786
mov edi, eax
add esp, 4
test edi, edi
je 0x424794
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004151bc
add esp, 4
mov dword [edi + 4], eax
jmp 0x424796
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00412bc0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4247f7
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x4247f7
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x42481a
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x42483d
cmp byte [ebp + 0xc], 0
je 0x424829
push esi
call fcn.00415768
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x424849
mov esi, str.ios_base::badbit_set
jmp 0x424859
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040b710
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00404800
push 0x516564
lea eax, [ebp - 0x30]
push eax
call fcn.004b32bd
int3

Function at 0x4269c0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x4269e5
or esi, 1
push 1
call edi
test ax, ax
jns 0x4269f1
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x4269fd
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x426a09
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x43a310
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x594], 0
je 0x43a37d
cmp dword [ebp + 8], 0x100
jne 0x43a36d
cmp word [ebp + 0xc], 0xd
jne 0x43a36d
cmp byte [esi + 0x59a], 0
je 0x43a34e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x43a36d
cmp byte [esi + 0x59b], 0
jne 0x43a36d
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x43a366
push 0
push 0
push 0
push str.return
push esi
call fcn.00428d80
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x594]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10