joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4452f4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00445165

Function at 0x445aee
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00428570
mov eax, dword [0x4be034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0044262d
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x445b30
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x445c8c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00478f20
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4c5be8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00445683
mov ecx, dword [esi*4 + 0x4c5be8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x445c85
cmp eax, dword [edi + ecx + 0x24]
jne 0x445c85
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x445c85
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00445683
add esp, 0x14
test edx, edx
jl 0x445c85
jg 0x445bfb
test eax, eax
jb 0x445c85
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x445c85
jl 0x445c15
cmp dword [ebp - 0x1008], eax
ja 0x445c85
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x445c33
test ebx, ebx
je 0x445c6c
cmp ecx, edi
jae 0x445c6c
mov al, byte [ecx]
cmp al, 0xd
jne 0x445c4d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x445c59
cmp byte [ecx + 1], 0xa
jne 0x445c59
inc ecx
jmp 0x445c59
movzx eax, al
movsx eax, byte [eax + 0x4be2b8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x445c33
cmp edx, ebx
jne 0x445c33
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x445c8a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004272a5
leave
ret
Function at 0x44a783
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4be034]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x44a7ce
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0044a922
test al, al
jne 0x44a7c8
sub edx, 2
cmp edx, edi
jne 0x44a7ae
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x44a7f0
lea eax, [edi + 2]
cmp edx, eax
je 0x44a7f0
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0044a6cf
add esp, 0x10
jmp 0x44a8ea
push esi
lea ecx, [ebp - 0x255]
call fcn.0044a922
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44a833
push dword [ebp - 0x25c]
jmp 0x44a7e0
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x44a870
cmp word [ebp - 0x226], 0
je 0x44a891
cmp word [ebp - 0x226], ax
jne 0x44a870
cmp word [ebp - 0x224], 0
je 0x44a891
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0044a6cf
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x44a8dd
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x44a84a
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x44a8c5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x44a8ea
push 0x44a4ff
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00450bc0
add esp, 0x10
jmp 0x44a8ba
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004272a5
leave
ret

Function at 0x44b1f5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x44b206
pop esi
ret
push ebx
push edi
push esi
call fcn.0044b1be
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004417f8
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x44b22e
push ebx
push esi
push edi
call fcn.00428c80
add esp, 0xc
push 0
call fcn.00440dd6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x44b5f2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044b243
Function at 0x451665
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004515e1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4517dd
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4517dd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x45178c
jg 0x4516be
test eax, eax
je 0x451782
push 1
push 0x1000
call fcn.004433cc
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4516e4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x451779
push 0x8000
push ebx
call fcn.0043ebc1
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x451710
jg 0x45170b
cmp ecx, 0x1000
jb 0x451710
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00443d8b
add esp, 0x10
cmp eax, 0xffffffff
je 0x451755
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x45170b
jl 0x45173c
test ecx, ecx
jne 0x4516fd
push dword [ebp - 0xc]
push ebx
call fcn.0043ebc1
push esi
call fcn.00440dd6
add esp, 0xc
xor edi, edi
jmp 0x4517ee
cmp byte [edi + 0x24], 0
je 0x45176c
cmp dword [edi + 0x20], 5
jne 0x45176c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x451777
mov edi, dword [edi + 0x18]
jmp 0x451779
xor edi, edi
push esi
call fcn.00440dd6
pop ecx
jmp 0x4517ee
test ecx, ecx
jg 0x45174e
jl 0x45178c
test eax, eax
jae 0x45174e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004456a1
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4517af
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x45174e
jmp 0x4517e6
push ebx
call fcn.004460f5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x45174e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4517ee
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4517eb
mov edi, dword [edi + 0x18]
jmp 0x4517ee
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004456a1
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x453950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492ef8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4be034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push esi
call dword [eax + 0x28]
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x30]
call eax
mov edx, dword [esi]
mov ecx, esi
push 1
mov bl, al
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x470060
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
shr ecx, 2
push edi
test ecx, ecx
je 0x470125
mov edi, dword [esp + 0x20]
cmp ecx, 8
jb 0x470100
mov ebx, ecx
lea eax, [edi + 0x10]
mov esi, ebp
and ebx, 0xfffffff8
sub esi, edi
xorps xmm3, xmm3
mov dword [esp + 0x10], esi
movaps xmm2, xmm3
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edx*4]
add edx, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, ebx
jb 0x4700b0
mov edi, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edx, ecx
jae 0x470125
mov esi, ebp
lea edi, [edi + edx*4]
sub esi, dword [esp + 0x20]
sub ecx, edx
add edx, ecx
mov eax, dword [edi + esi]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
or ebx, eax
sub ecx, 1
jne 0x470111
mov esi, dword [esp + 0x24]
shl edx, 2
sub esi, edx
jne 0x47013b
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x20]
add ebp, edx
add ecx, edx
mov eax, ebx
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov dword [esp + 0x20], ecx
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x10], edx
test esi, esi
je 0x470215
cmp esi, 0x20
jb 0x4701f9
mov ebx, esi
mov edx, ebp
and ebx, 0xffffffe0
xorps xmm3, xmm3
sub edx, ecx
mov eax, ecx
mov dword [esp + 0x14], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ecx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x470190
por xmm2, xmm3
mov ecx, dword [esp + 0x20]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
cmp edi, esi
jae 0x470215
sub ebp, dword [esp + 0x20]
add ecx, edi
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x470205
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x470230
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, edx
shr edi, 2
test edi, edi
je 0x4702d7
cmp edi, 8
jb 0x4702b0
lea eax, [esi - 4]
lea eax, [eax + edi*4]
lea ecx, [ebp - 4]
lea ecx, [ecx + edi*4]
cmp ebp, eax
ja 0x470269
cmp ecx, esi
jae 0x4702b0
mov ecx, edi
lea eax, [ebp + 0x10]
mov edx, esi
and ecx, 0xfffffff8
sub edx, ebp
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + ebx*4]
add ebx, 8
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, ecx
jb 0x470281
mov ebp, dword [esp + 0x18]
cmp ebx, edi
jae 0x4702d7
lea ecx, [ebx*4]
mov edx, esi
sub edi, ebx
add ecx, ebp
sub edx, ebp
add ebx, edi
mov eax, dword [ecx + edx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edi, 1
jne 0x4702c5
mov edx, dword [esp + 0x20]
shl ebx, 2
sub edx, ebx
je 0x470354
add ebp, ebx
add esi, ebx
xor edi, edi
test edx, edx
je 0x470354
cmp edx, 0x20
jb 0x47033b
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, edx
add ecx, edx
cmp ebp, eax
ja 0x4702ff
cmp ecx, esi
jae 0x47033b
mov ecx, edx
mov ebx, esi
and ecx, 0xffffffe0
mov eax, ebp
sub ebx, ebp
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [esi + edi + 0x10]
add edi, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x470310
cmp edi, edx
jae 0x470354
sub esi, ebp
lea ecx, [edi + ebp]
sub edx, edi
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x470346
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x47bab8
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push 0x464
mov eax, 0x495f44
call fcn.00427df1
mov esi, ecx
mov ecx, dword [esi]
call fcn.0047f3c4
mov edx, dword [esi]
lea ecx, [ebp - 0x448]
mov edi, eax
call fcn.0047f3e2
lea eax, [ebp - 0x470]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x470], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x464], ebx
push 0x1c
lea eax, [ebp - 0x460]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x4c20fc
call fcn.00408313
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x47bb2b
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x430], eax
xor eax, eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], 7
mov word [ebp - 0x42c], ax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x414], eax
test ecx, ecx
je 0x47bb82
push ecx
lea ecx, [ebp - 0x42c]
call fcn.00402048
lea eax, [ebp - 0x430]
push eax
push 0x411a65
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x468]
lea ecx, [ebp - 0x42c]
sub esi, dword [ebp - 0x46c]
sar esi, 2
call fcn.0040172c
lea ecx, [ebp - 0x460]
call fcn.0040172c
cmp esi, 1
jle 0x47bc5d
push 0x400
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.00429200
mov esi, dword [ebp - 0x46c]
add esp, 0xc
cmp esi, dword [ebp - 0x468]
je 0x47bc74
push 0x200
lea eax, [ebp - 0x410]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp - 0x434], 8
lea eax, [ebp - 0x448]
lea ecx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x448]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x47bc3d
test dx, dx
je 0x47bc39
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x47bc3d
add ecx, 4
add eax, 4
test dx, dx
jne 0x47bc17
mov eax, ebx
jmp 0x47bc42
sbb eax, eax
or eax, 1
test eax, eax
je 0x47bc53
add esi, 4
cmp esi, dword [ebp - 0x468]
jne 0x47bbe9
jmp 0x47bc55
mov edi, dword [esi]
mov esi, dword [ebp - 0x46c]
jmp 0x47bc74
mov eax, dword [ebp - 0x468]
mov esi, dword [ebp - 0x46c]
sub eax, esi
sar eax, 2
test eax, eax
je 0x47bc74
mov edi, dword [esi]
test esi, esi
je 0x47bc9e
mov eax, dword [ebp - 0x464]
sub eax, esi
and eax, 0xfffffffc
push eax
push esi
call fcn.00401700
pop ecx
pop ecx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x464], ebx
lea ecx, [ebp - 0x448]
call fcn.0040172c
mov eax, edi
call fcn.00427da0
ret
Function at 0x47c3e6
Capabilities:
Create thread

Disassembly:
push 0x5c
mov eax, 0x4960aa
call fcn.00427e5d
cmp byte [0x4e8b9d], 0
jne 0x47c463
xor esi, esi
lea eax, [ebp - 0x48]
push eax
push esi
push 0x4e8790
push 0x402cf1
push esi
push esi
mov dword [0x4e8b08], esi
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], esi
call fcn.00483fe0
or dword [ebp - 4], 0xffffffff
mov dword [0x4e8b08], eax
jmp 0x47c43c
cmp dword [ebp - 0x48], 0
je 0x47c45a
push esi
push esi
push 0x502
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4e8b08], 0
je 0x47c469
call fcn.00427daf
ret
lea ecx, [ebp - 0x2c]
call fcn.004079c4
mov dword [ebp - 4], 2
call fcn.004076fa
test al, al
lea eax, [ebp - 0x44]
je 0x47c4a9
push 0x2b
push 0x13
push eax
call fcn.0047b83b
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406f3f
lea ecx, [ebp - 0x44]
call fcn.00405ca2
lea ecx, [ebp - 0x2c]
call fcn.00482962
jmp 0x47c4c4
push 0x29
push 0x11
push eax
call fcn.0047b83b
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406f3f
lea ecx, [ebp - 0x44]
call fcn.00405ca2
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00405c31
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x68]
call fcn.00405055
push 0x4b9e04
lea eax, [ebp - 0x68]
push eax
call fcn.0042a81e
int3

Function at 0x47c4ef
Capabilities:
Create thread

Disassembly:
push esi
call fcn.004337fb
cmp byte [0x4e8b9d], 0
mov esi, eax
jne 0x47c54c
cmp dword [0x4e8b04], 0
jne 0x47c54c
cmp word [0x4e8c1e], 3
push edi
mov edi, 0x4e8c18
jne 0x47c530
mov ecx, edi
call fcn.0040201c
test al, 1
je 0x47c530
mov eax, dword [0x4e88b8]
shr eax, 9
test al, 1
je 0x47c54b
push 0x4e8b0c
xor eax, eax
push eax
push edi
push 0x405f67
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e8b10], eax
pop edi
mov eax, esi
pop esi
ret
Function at 0x47c756
Capabilities:
Check mutex on windows

Disassembly:
push 0x6c
mov eax, 0x49614a
call fcn.00427df1
mov eax, dword [0x4e88b8]
shr eax, 0xe
test al, 1
je 0x47c8cc
xor ebx, ebx
lea ecx, [ebp - 0x58]
push 0x4e87a8
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call fcn.00405ca7
push 7
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
pop esi
xor eax, eax
mov dword [ebp - 0x40], ebx
push 0x4ac9e8
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00402048
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x28], ebx
push 0x4ac9b0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov word [ebp - 0x28], ax
call fcn.00402048
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.0040a6a0
mov eax, dword [ebp - 0x14]
mov edi, 0x1000
pop ecx
push 8
pop esi
cmp eax, esi
jb 0x47c821
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], ecx
cmp eax, edi
jb 0x47c818
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x74]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x78]
push eax
push ecx
call fcn.004272b3
pop ecx
pop ecx
xor eax, eax
mov byte [ebp - 4], bl
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
cmp eax, esi
jb 0x47c86d
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
cmp eax, edi
jb 0x47c864
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x78]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
push eax
push ecx
call fcn.004272b3
pop ecx
pop ecx
cmp dword [ebp - 0x44], esi
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4e8b14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x47c8d2
mov eax, dword [ebp - 0x44]
cmp eax, esi
jb 0x47c8cc
mov ecx, dword [ebp - 0x58]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
cmp eax, edi
jb 0x47c8c3
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x78]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
push eax
push ecx
call fcn.004272b3
pop ecx
pop ecx
call fcn.00427da0
ret
push 0x2e
push 0x29
lea eax, [ebp - 0x70]
push eax
call fcn.0047b83b
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.00482962
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x38]
call fcn.00405c31
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00405055
push 0x4b9e04
lea eax, [ebp - 0x20]
push eax
call fcn.0042a81e
int3
Function at 0x47cdac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4be034]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4e87d0], 0
push esi
mov esi, 0x4e87c0
jne 0x47cec7
push ebx
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x804]
mov ecx, esi
push eax
call fcn.00402048
cmp dword [0x4e87d4], 8
mov eax, esi
cmovae eax, dword [0x4e87c0]
xor ebx, ebx
push ebx
push eax
call fcn.00438a05
pop ecx
pop ecx
test eax, eax
je 0x47ce25
push 0x4aa4bc
mov ecx, esi
call fcn.00402048
mov ecx, esi
call fcn.00408e84
cmp dword [0x4e87d0], ebx
je 0x47ce4a
cmp dword [0x4e87d4], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4e87c0]
push eax
call fcn.00438a05
pop ecx
pop ecx
test eax, eax
je 0x47ce5d
push str.TEMP
call fcn.004397f5
pop ecx
push eax
mov ecx, esi
call fcn.00402048
cmp dword [0x4e87d0], ebx
je 0x47ce82
cmp dword [0x4e87d4], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4e87c0]
push eax
call fcn.00438a05
pop ecx
pop ecx
test eax, eax
je 0x47ce95
push 0x4ac9e0
call fcn.004397f5
pop ecx
push eax
mov ecx, esi
call fcn.00402048
cmp dword [0x4e87d0], ebx
je 0x47ceba
cmp dword [0x4e87d4], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4e87c0]
push eax
call fcn.00438a05
pop ecx
pop ecx
test eax, eax
je 0x47cec6
push 0x4e8790
mov ecx, esi
call fcn.00405d0f
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004272a5
leave
ret
Function at 0x481fe4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4be034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [esi + 0xc], 0x201
jne 0x4820d5
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00429200
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x218]
push eax
push edi
push 0x44b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x244], eax
xor eax, eax
push 7
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
lea edi, [ebp - 0x234]
pop ecx
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebx + 0xb8]
pop edi
cmp eax, dword [ebx + 0xbc]
je 0x4820d8
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4820d8
and dword [eax], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004272a5
leave
ret 0xc

Function at 0x482c40
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov dword [0x4e8d04], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xfffffffffffffffa
push dword [0x4e8d04]
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
push eax
push 0x482990
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
test eax, eax
mov dword [0x4e8d08], eax
pop esi
setne al
pop ebp
ret 4