joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004cae
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100b2d0]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
cmp ebx, esi
mov dword [ebp - 0x208], 1
je 0x1004dd2
push edi
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x21c]
push eax
push ecx
push esi
push esi
push 0x20
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x1004d84
push 0xffffffffffffffff
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
cmp dword [0x100c888], esi
mov ecx, dword [ebp - 0x20c]
jne 0x1004d55
mov al, byte [0x100c48c]
test al, 1
je 0x1004d55
test al, 2
jne 0x1004d55
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x1004d55
mov dword [0x100c48c], ecx
push ecx
call fcn.01002d03
push dword [ebp - 0x218]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call edi
push dword [ebp - 0x21c]
call edi
test byte [0x100c495], 4
je 0x1004dcb
cmp dword [ebp - 0x20c], esi
jge 0x1004dcb
jmp 0x1004dc5
call fcn.01003aa1
push esi
mov dword [0x100ba5c], eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
push esi
push 0x10
lea eax, [ebp - 0x204]
push eax
push ebx
push 0x4c4
push esi
call fcn.01003ebe
mov dword [ebp - 0x208], esi
mov eax, dword [ebp - 0x208]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.010064de
leave
ret 8
Function at 0x1004e73
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x14], edi
je 0x1004f8f
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.SHBrowseForFolder
push edi
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1004f7c
push 0xc3
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x1004f7c
push str.SHGetPathFromIDList
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1004f7c
cmp byte [0x100ba80], bl
mov esi, 0x100ba80
jne 0x1004f19
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
add eax, esi
push eax
push esi
call edi
cmp byte [eax], 0x5c
mov dword [ebp - 4], eax
jne 0x1004f19
push eax
push esi
call edi
cmp byte [eax], 0x3a
je 0x1004f19
mov eax, dword [ebp - 4]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
mov byte [edi], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x1002d5a
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1004f6a
push esi
push eax
call dword [ebp - 0xc]
cmp byte [0x100ba80], bl
je 0x1004f64
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push dword [ebp + 8]
call dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor eax, eax
cmp byte [edi], bl
setne al
jmp 0x1004fa3
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push ebx
push 0x10
push ebx
push ebx
push 0x4c1
jmp 0x1004f99
push ebx
push 0x10
push ebx
push ebx
push 0x4c2
push dword [ebp + 8]
call fcn.01003ebe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1004faf
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
inc ebx
call fcn.0100672a
test eax, eax
je 0x100501d
cmp dword [0x100bc3c], 0
jne 0x1005011
test byte [0x100c898], bl
jne 0x1005011
push 6
push 0
push 0x1003e28
push dword [0x100ba4c]
mov dword [0x100be64], esi
push 0x7d3
push dword [0x100c4a4]
call fcn.01004819
sub eax, 6
je 0x1005011
dec eax
je 0x1005025
sub eax, 0x832
jne 0x1005011
mov dword [0x100bc3c], ebx
push 0x80
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x100501d
Function at 0x10052d4
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100b2d0]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
je 0x100537f
mov edi, 0x104
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.0100342e
test eax, eax
je 0x10053e4
lea eax, [ebp - 0x108]
push eax
mov esi, 0x100bc44
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
test byte [0x100c494], 0x20
je 0x1005371
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
movzx eax, word [ebp - 0x12c]
sub eax, ebx
je 0x1005365
dec eax
je 0x100535e
dec eax
je 0x1005357
dec eax
jne 0x1005371
push 0x1001420
jmp 0x100536a
push 0x1001418
jmp 0x100536a
push 0x1001410
jmp 0x100536a
push 0x1001408
push edi
push esi
call fcn.010066cf
push 0x1001271
push edi
push esi
call fcn.010066cf
jmp 0x100538c
push eax
mov esi, 0x100bc44
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push esi
call fcn.010044bd
xor edi, edi
inc edi
test eax, eax
jne 0x10053ab
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x10053c3
mov dword [0x100c880], edi
push ebx
push dword [ebp + 0x10]
push esi
call fcn.0100456a
test eax, eax
je 0x10053cf
mov dword [0x100ba5c], ebx
mov eax, edi
jmp 0x10053e6
call fcn.01003aa1
mov dword [0x100ba5c], eax
jmp 0x10053e4
cmp dword [0x100c880], ebx
je 0x10053e4
push esi
mov dword [0x100c880], ebx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010064de
leave
ret 0xc
Function at 0x10053fa
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100b2d0]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x110], eax
mov dword [0x100c4a4], eax
xor eax, eax
mov ecx, 0x23f
mov edi, 0x100bba0
rep stosd dword es:[edi], eax
push 0x41
mov ecx, 0xcb
mov edi, 0x100c880
rep stosd dword es:[edi], eax
pop ecx
mov edi, 0x100ba80
rep stosd dword es:[edi], eax
push 0x7f
mov esi, 0x100bbb4
xor edi, edi
push esi
xor ebx, ebx
inc edi
push 0x100144c
mov dword [ebp - 0x10c], ebx
mov dword [0x100be4c], edi
call fcn.01002e55
cmp eax, ebx
je 0x100564a
cmp eax, 0x80
ja 0x100564a
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
push eax
mov dword [0x100ba50], eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
push 4
push 0x100c494
push 0x1001440
call fcn.01002e55
test eax, eax
je 0x10054d3
test byte [0x100c494], 0xc0
je 0x1005563
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x1001430
call fcn.01002e55
test eax, eax
jne 0x10054f2
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003ebe
mov dword [0x100ba5c], 0x80070714
jmp 0x100565a
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
cmp eax, ebx
mov dword [0x100ba54], eax
je 0x1005563
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x1005563
test byte [0x100c494], 0x80
je 0x1005532
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003ebe
jmp 0x1005548
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003ebe
cmp eax, 6
je 0x1005563
push dword [0x100ba54]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x100ba5c], 0x800700b7
jmp 0x100565a
push dword [ebp - 0x114]
mov dword [0x100ba60], ebx
call fcn.0100359c
test eax, eax
jne 0x1005587
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1005654
cmp byte [0x100c89a], bl
je 0x100559e
push 0x100c89a
call fcn.01002a96
jmp 0x100565a
push 0xa
push 0x1001424
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, ebx
je 0x10055c8
push eax
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x10c], eax
cmp dword [0x100b2c4], ebx
je 0x10055d6
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100c884], ebx
jne 0x1005646
push dword [ebp - 0x10c]
call fcn.0100488c
test eax, eax
je 0x100565a
mov ax, word [0x100ba64]
cmp ax, di
je 0x1005604
cmp ax, 2
je 0x1005604
cmp ax, 3
jne 0x1005646
test byte [0x100c495], 1
je 0x1005646
test byte [0x100c898], 1
jne 0x1005646
call fcn.01001760
test eax, eax
jne 0x1005646
push 0x83e
push 0x547
push 0x100189d
push ebx
push 0x7d6
push dword [0x100c4a4]
call fcn.01004819
cmp eax, 0x83d
jne 0x100565a
mov eax, edi
jmp 0x100565c
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003ebe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010064de
leave
ret 0xc
Function at 0x1006205
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b2d0]
push edi
xor edi, edi
cmp word [0x100c898], di
mov dword [ebp - 4], eax
jne 0x1006247
cmp dword [0x100c884], edi
jne 0x100623e
call fcn.010043ec
test eax, eax
je 0x1006259
cmp word [0x100c898], di
jne 0x1006247
call fcn.01004bc8
test eax, eax
je 0x1006259
call fcn.0100435e
test eax, eax
je 0x1006259
call fcn.01005f21
test eax, eax
jne 0x1006260
xor eax, eax
jmp 0x100636a
push ebx
push esi
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x1001264
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.010066cf
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
cmp esi, edi
mov ebx, 0x100bc44
je 0x10062b3
push 0x10014a8
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, edi
je 0x10062b3
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [0x100c884], edi
jne 0x10062da
cmp dword [0x100c490], edi
jne 0x10062da
call fcn.010047b3
test eax, eax
jne 0x10062da
xor eax, eax
jmp 0x1006368
push ebx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
jne 0x1006301
push edi
push 0x10
push edi
push edi
push 0x4bc
push edi
call fcn.01003ebe
call fcn.01003aa1
mov dword [0x100ba5c], eax
jmp 0x10062d3
cmp dword [0x100c88c], edi
jne 0x1006312
call fcn.01005a36
test eax, eax
je 0x10062d3
test byte [0x100cba8], 0xc0
jne 0x1006330
xor eax, eax
mov ax, word [0x100ba64]
push eax
call fcn.01001f93
mov dword [0x100bb84], eax
jmp 0x1006336
mov dword [0x100bb84], edi
cmp dword [0x100c884], edi
jne 0x100634f
cmp dword [0x100c490], edi
jne 0x100634f
call fcn.01005abc
test eax, eax
je 0x10062d3
cmp word [0x100c898], di
jne 0x1006365
cmp dword [0x100c884], edi
jne 0x1006365
call fcn.01004de5
xor eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.010064de
leave
ret

Function at 0x100645c
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
call fcn.0100646b
jmp fcn.010063e0

Function at 0x100672a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006741
xor eax, eax
jmp 0x1006749
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4
Function at 0x10068b3
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x100b2d0]
and dword [ebp - 0xa8], 0
cmp dword [0x100b2dc], 0xfffffffe
mov dword [ebp - 4], eax
mov dword [ebp - 0xb0], 0xc
jne 0x10069d6
and dword [0x100b2dc], 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
je 0x10069d6
cmp dword [ebp - 0x94], 1
jne 0x10069d6
cmp dword [ebp - 0xa0], 4
jne 0x10069d6
cmp dword [ebp - 0x9c], 0xa
jae 0x10069d6
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10069d6
lea eax, [ebp - 0xac]
push eax
push 0x20019
push 0
push 0x10014b8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10069d6
push edi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x1001271
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xac]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x10069d6
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0100678f
test eax, eax
je 0x10069d6
and dword [ebp - 0xa8], 0x3ff
cmp dword [ebp - 0xa8], 1
je 0x10069cc
cmp dword [ebp - 0xa8], 0xd
jne 0x10069d6
mov dword [0x100b2dc], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x100b2dc]
call fcn.010064de
leave
ret

Function at 0x10069ea
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x1006a22
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
jne 0x1006a26
xor eax, eax
jmp 0x1006a3c
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_MulDiv]
leave
ret 4

Function at 0x1007d39
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [ebp + 0x10]
jle 0x1007d76
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007d53
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007d92
dec esi
je 0x1007d8b
dec esi
jne 0x1007d97
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x401b30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401be6
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x48f5cc
call sub.KERNEL32.DLL_WriteFile
cmp byte [0x48f04d], 0
je 0x401b5e
push 0x48f5cc
call sub.KERNEL32.DLL_WritePrivateProfileStringA
mov eax, 0x48f5ec
call fcn.004014f4
mov eax, 0x48f5fc
call fcn.004014f4
mov eax, 0x48f628
call fcn.004014f4
push 0xff8
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x48f624], eax
cmp dword [0x48f624], 0
je 0x401bc5
mov eax, 3
mov edx, dword [0x48f624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401b9b
mov eax, 0x48f60c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x48f618], eax
mov byte [0x48f5c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bed
cmp byte [0x48f04d], 0
je 0x401be5
push 0x48f5cc
call sub.KERNEL32.DLL_lstrcpyA
ret

Function at 0x403240
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x48a008], 0x8088405
inc edx
mov dword [ebx + 0x48a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4037f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48a024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40388c
push 0x80000002
call sub.user32.dll_UpdateWindow
test eax, eax
jne 0x40386c
xor eax, eax
push ebp
push 0x403865
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038a8
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_VkKeyScanA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40386c
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_UnregisterClassA
ret
mov ax, word [0x48a024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48a024], ax
mov esp, ebp
pop ebp
ret
Function at 0x405e80
Capabilities:
Extract resource via kernel32 functions
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_InitializeCriticalSection
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4060b0
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x405f03
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4060b0
push 0x80000002
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x405f03
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4060cc
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
jne 0x405f8c
xor eax, eax
push ebp
push 0x405f85
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405cc8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_VkKeyScanA
test eax, eax
je 0x405f6a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4060ec
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_VkKeyScanA
test eax, eax
je 0x405f6a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f8c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MulDiv
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_LocalFileTimeToFileTime
push eax
call sub.KERNEL32.DLL_GlobalUnlock
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4060a6
cmp byte [ebp - 0xd], 0
jne 0x405fd3
cmp byte [ebp - 0x12], 0
je 0x4060a6
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405fec
dec ebx
cmp byte [ebx], 0x2e
je 0x405ffb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405feb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4060a6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406038
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_MulDiv
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LockResource
mov esi, eax
test esi, esi
jne 0x4060a6
cmp byte [ebp - 0xd], 0
je 0x4060a6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_MulDiv
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LockResource
mov esi, eax
test esi, esi
jne 0x4060a6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_MulDiv
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LockResource
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cfbc
Capabilities:
Log keystrokes

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x40d023
mov eax, dword [esp + 0x10]
mov dword [0x48a0cc], eax
mov eax, dword [esp + 4]
mov dword [0x48a0d0], eax
mov eax, dword [esp + 8]
mov dword [0x48a0d4], eax
cmp dword [0x48a0cc], 1
jne 0x40d007
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov dword [0x48a0d8], eax
jmp 0x40d010
mov eax, dword [esp + 0xc]
mov dword [0x48a0d8], eax
mov eax, 0x48a0dc
lea edx, [esp + 0x14]
mov ecx, 0x80
call fcn.00404944
add esp, 0x94
ret

Function at 0x40d04c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d122
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040476c
lea eax, [ebp - 8]
call fcn.00404be4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b94
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d10c
mov eax, ebx
call fcn.004027f0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d105
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b94
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d0ef
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d134
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d0ef
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d10c
mov eax, dword [ebp - 0x10]
call fcn.00402810
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d129
lea eax, [ebp - 8]
call fcn.004046d4
ret

Function at 0x40d634
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d698
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.user32.dll_IsRectEmpty
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404944
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetWindowTextA
mov edx, eax
pop eax
call fcn.00408ed4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d69f
lea eax, [ebp - 0xc]
call fcn.004046d4
ret

Function at 0x4224a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4224a6
ret