joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ffa3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00406a94
xor eax, eax
push ebp
push 0x4ffab2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004ff96c
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004ff904
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004ff8ac
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4ffa7c
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ffab9
lea eax, [ebp - 4]
call fcn.00406658
ret
Function at 0x500b58
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x500d49
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x500d05
mov eax, dword [ebp - 4]
call fcn.00502f74
cmp ebx, eax
jge 0x500d05
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
mov edx, ebx
call fcn.004e7ba8
mov edx, dword [0x4eb320]
call fcn.0040559c
mov esi, eax
mov eax, esi
call fcn.004eea54
test al, al
je 0x500cfb
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x500bda
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x500cee
xor eax, eax
push ebp
push 0x500ce7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00501b90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
call fcn.0043c4f0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, esi
call fcn.00406b88
mov eax, dword [ebp - 8]
call fcn.00406b1c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x160]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00501164
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x160]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500d33
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
test al, al
jne 0x500ce6
mov eax, dword [ebp - 4]
call fcn.00501c14
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.004066ac
jmp 0x500d33
mov eax, dword [ebp - 8]
call fcn.00406658
jmp 0x500d33
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00414134
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x42d414]
call fcn.004195fc
call fcn.00405e34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500d50
lea eax, [ebp - 0x54]
call fcn.004070b4
ret
Function at 0x505bec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x505c19
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x505c98
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004fb1fc
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x505c66
mov cx, word [esp]
sub cx, si
jmp 0x505c68
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x505c4f
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x505c8e
mov cx, word [esp]
sub cx, si
jmp 0x505c90
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x505c77
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x505cf5
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.005058c0
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x505ce0
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x505cf5
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x505bf6
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x50a97c
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
call fcn.0050a818
test al, al
je 0x50a9a9
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.0050a91c
test al, al
jne 0x50a99f
call fcn.0041bd20
mov eax, dword [esp + 0x14]
imul dword [esp + 0x18]
jmp 0x50a9da
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, ebx
call fcn.00407150
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
test eax, eax
jne 0x50a9d3
call fcn.0041bd20
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x3c
pop ebx
ret

Function at 0x512cb0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffda4
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x5d0], 0
je 0x512cd4
mov eax, dword [esi + 0x5d0]
call fcn.004e82e0
test al, al
jne 0x512cef
push esp
push 0x12d
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x12d
call fcn.004072ac
jmp 0x512cfc
mov eax, ebx
mov edx, dword [esi + 0x5d0]
call fcn.004070c4
mov eax, dword [ebx]
call fcn.0040741c
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x512d19
mov eax, ebx
mov edx, 0x512d30
call fcn.004074c0
add esp, 0x25c
pop esi
pop ebx
ret
Function at 0x513c3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004070ac
mov eax, dword [ebp - 8]
call fcn.004070ac
xor eax, eax
push ebp
push 0x513d30
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404bc4
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, dword [0x52d058]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00407150
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 8]
call fcn.00407150
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004149d0
mov eax, dword [ebp - 0x48]
call fcn.00407150
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x513d0d
jmp 0x513cfb
mov eax, dword [0x52d058]
mov eax, dword [eax]
call fcn.004d1484
mov eax, dword [0x52d058]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x513d0d
push 0x64
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x513cdf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513d37
lea eax, [ebp - 0x48]
call fcn.004070b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004070bc
ret
Function at 0x515d68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x515e55
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20e]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.004072ac
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x515dcb
mov eax, ebx
sub eax, 0xa
cmp word [eax], 2
je 0x515dcb
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406844
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x515de8
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x515de8
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406844
test eax, eax
je 0x515df1
sub eax, 4
mov eax, dword [eax]
cmp word [ebx + eax*2 - 2], 0x5c
jne 0x515e35
mov eax, dword [ebp - 4]
test eax, eax
je 0x515e16
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x515e16
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406844
mov ebx, eax
test ebx, ebx
je 0x515e21
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004077ec
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004070c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515e5c
lea eax, [ebp - 4]
call fcn.004070b4
ret
Function at 0x5294c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
jmp 0x529522
jle 0x5294e1
mov dword [esp + 4], ebx
jmp 0x5294e5

Function at 0x529505
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 1]
lea esp, [esp]
jmp 0x529540
Function at 0x60aeb5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0xabceb28b
lea edi, [esp + ebx]
bt eax, ecx
xchg ch, bl
setnp dh
neg bx
jmp 0x60aebd
pop ebp
xchg di, ax
rdtsc
jmp 0x60ae99
mov ecx, dword [esp]
neg ecx
btr ebx, eax
bsr esi, esp
pushfd
mov al, dh
jmp 0x60aed1
lea edx, [eax + ebp]
bsr edi, ebx
mov edi, dword [esp + 1]
shl ch, 1
add esp, 3
jmp 0x60af09
mov esi, ecx
clc
clc
setbe bl
rol cl, 7
mov di, bx
jmp 0x60aef3

Function at 0x60b561
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 8
clc
rdtsc
mov cx, 0xad81
jmp 0x60b584

Function at 0x60ba52
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0x58
neg eax
jmp 0x60ba5c
lea ebx, [eax + eax]
sub esp, 3
mov di, 0xed4b
pushal
clc
push word [esp + 0x1e]
jmp 0x60ba85

Function at 0x60bca8
Capabilities:
Access peb ldr_data

Disassembly:
pushfd
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x60bc92
Function at 0x401bdd
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00403dc0
mov dword [esp], eax
mov eax, dword [0x40b3b0]
push eax
push eax
call fcn.00405eb2
lea ecx, [esp + 8]
pop edx
call fcn.004030f0
push dword [esp]
push 0
push 0x40a00d
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
mov eax, dword [0x40b3b0]
push eax
push eax
push dword [esp + 8]
call fcn.00403e50
lea ecx, [0x40b12c]
pop edx
call fcn.004030f0
push dword [esp]
call fcn.00403e30
push dword [0x40b12c]
call fcn.00405ea0
push dword [0x40b12c]
call fcn.00405f13
mov eax, dword [0x40b3b0]
push eax
push eax
call fcn.00405dd5
lea ecx, [0x40b124]
pop edx
call fcn.004030f0
mov eax, dword [esp + 0x14]
call fcn.00403ea0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401cea
mov ebx, dword [esp + 0x18]
inc ebx
mov eax, ebx
call fcn.00403ea0
mov ebx, eax
cmp ebx, 1
jne 0x401cc3
push dword [0x40b3b0]
mov edx, 0x40a00e
call fcn.004074f0
mov edx, dword [0x40b124]
call fcn.004074f0
mov edx, 0x40a011
call fcn.004074f0
lea ecx, [0x40b128]
pop edx
call fcn.004030f0
mov edx, dword [0x40b12c]
push dword [0x40b3b0]
call fcn.004074f0
lea ecx, [0x40b124]
pop edx
call fcn.004030f0
mov dword [esp + 0xc], 2
jmp 0x401cfc
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401cfc
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.00403ea0
mov dword [0x40b11c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
mov eax, ebx
call fcn.00403ea0
mov dword [0x40b120], eax
mov eax, 1
jmp 0x401d2f
push dword [esp + 4]
call fcn.00407550
add esp, 0xc
pop ebx
ret 4
Function at 0x4020b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.00403100
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x402102
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_LoadResource
mov dword [0x40b130], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x40b16c], eax
mov eax, dword [esp + 4]
jmp 0x40210a
push dword [esp]
call fcn.00407550
add esp, 8
ret 8

Function at 0x402761
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402768
mov edx, dword [esp + 0x5c]
lea ecx, [esp]
call fcn.00403100
mov edx, dword [esp + 0x60]
lea ecx, [esp + 4]
call fcn.00403100
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
call fcn.00403100
lea eax, [esp + 0xc]
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, str.open
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
mov dword [ebp + 0x18], eax
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.dll_ShellExecuteExA
mov dword [esp + 0x48], eax
push 0x19
call sub.KERNEL32.dll_Sleep
lea eax, [esp + 0x4c]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 0x38]
call sub.KERNEL32.dll_GetExitCodeProcess
and eax, eax
je 0x40280f
mov ebx, dword [esp + 0x4c]
cmp ebx, 0x103
je 0x40280f
jmp 0x402811
jmp 0x4027e2
mov eax, 1
jmp 0x40281a
push dword [esp]
call fcn.00407550
push dword [esp + 4]
call fcn.00407550
push dword [esp + 8]
call fcn.00407550
add esp, 0x50
pop ebx
pop ebp
ret 0xc

Function at 0x4038b5
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x4038cd
push dword [esp + 4]
push 0x40384e
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x40390a
push esi
mov esi, dword [0x40b1c0]
test esi, esi
je 0x403909
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403901
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40b1c0
call fcn.0040681d
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x4038da
pop edi
pop ebx
pop esi
ret 4
Function at 0x403cd7
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
push 0x64
pop edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call esi
test eax, eax
je 0x403d7b
mov eax, dword [ebp - 0xc]
dec eax
je 0x403d5e
dec eax
jne 0x403d7b
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x403d5a
dec eax
je 0x403d56
dec eax
je 0x403d3c
dec eax
jne 0x403d7b
push 0x46
pop edi
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x9c
call esi
test eax, eax
je 0x403d7b
cmp byte [ebp - 0x1e], 1
je 0x403d7b
push 0x4b
jmp 0x403d7a
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x403d52
dec eax
je 0x403d4e
dec eax
jne 0x403d7b
push 0x41
jmp 0x403d7a
push 0x3c
jmp 0x403d7a
push 0x32
jmp 0x403d7a
push 0x14
jmp 0x403d7a
push 5
jmp 0x403d7a
cmp dword [ebp - 0x14], 0
je 0x403d78
cmp dword [ebp - 0x14], 0xa
je 0x403d74
cmp dword [ebp - 0x14], 0x5a
jne 0x403d7b
push 0x28
jmp 0x403d7a
push 0x1e
jmp 0x403d7a
push 0xa
pop edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x4045fc
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40b424]
call fcn.00406690
mov edi, eax
test edi, edi
je 0x40465e
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x404625
push dword [esp + 0xc]
push edi
call eax
jmp 0x40465e
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00407750
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.004077f0
pop esi
pop ebx
pop edi
ret 8
Function at 0x405d3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x405daa
push 0x11
call esi
test al, al
js 0x405daa
push 0x10
call esi
test al, al
js 0x405daa
push 0x12
call esi
test al, al
js 0x405daa
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x405daa
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x405dce
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x405dce
dec eax
push eax
push dword [0x40b42c]
call fcn.00406690
mov eax, dword [eax + 8]
jmp 0x405dd0
xor eax, eax
pop esi
leave
ret 4

Function at 0x405f13
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x405f86
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x405f68
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x405f66
cmp dl, 0x5c
je 0x405f66
cmp dl, 0x2f
jne 0x405f72
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x405f52
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x405f88
xor eax, eax
leave
ret 4

Function at 0x405f90
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x405fc5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x406250
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
mov dword [esp + 4], eax
je 0x406299
cmp byte [esi], al
je 0x406299
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40b43c]
push eax
push ecx
call fcn.00406690
test eax, eax
je 0x4062c7
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x4062a0
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406285
sub ecx, edi
push ecx
push esi
push eax
call fcn.00406330
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x4062a0
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x4062d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x406329
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x406328
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40b43c]
push eax
push ecx
call fcn.00406690
test eax, eax
je 0x406324
cmp dword [eax + 4], 0
je 0x406312
push esi
push edi
push eax
call fcn.00406330
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x406330
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x406365
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x4063de
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x4063cb
sub ecx, 1
je 0x4063b6
sub ecx, 2
je 0x4063a3
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00405f90
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40640b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc