joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006d49
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10006deb
movzx eax, word [ecx]
mov dword [ebp - 0x10], eax
add eax, 0xffffffd5
xor edx, edx
test eax, 0xfffd
sete dl
movzx eax, word [ecx + edx*2]
lea esi, [eax - 1]
xor edi, edi
cmp si, 0x7e
ja 0x10006ddd
lea ebx, [ecx + edx*2]
add ebx, 2
xor edi, edi
movzx eax, ax
push eax
call fcn.1024d21e
add esp, 4
test eax, eax
je 0x10006ddd
movzx esi, word [ebx - 2]
xor ecx, ecx
cmp esi, 0x7f
ja 0x10006db3
push esi
call fcn.1024d21e
add esp, 4
add esi, 0xffffffd0
test eax, eax
cmove esi, eax
mov ecx, esi
mov eax, ecx
xor eax, 0x7fffffff
mov edx, 0xcccccccd
mul edx
shr edx, 3
cmp edi, edx
jg 0x10006def
lea eax, [edi + edi*4]
lea edi, [ecx + eax*2]
movzx eax, word [ebx]
mov ecx, eax
dec ecx
add ebx, 2
cmp cx, 0x7f
jb 0x10006d85
mov eax, edi
neg eax
cmp word [ebp - 0x10], 0x2d
cmovne eax, edi
jmp 0x10006dfe
xor eax, eax
jmp 0x10006dfe
xor eax, eax
cmp word [ebp - 0x10], 0x2d
sete al
add eax, 0x7fffffff
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000fbd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x10443bf0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x1000fc0c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
lea edi, [ebp - 0x10]
mov dword [edi], esi
push esi
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
je 0x1000fc0e
mov esi, dword [ebp - 0x10]
jmp 0x1000fc0e
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1023b4d8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret 8

Function at 0x1000fc30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x10443bf0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x1000fc6c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
lea edi, [ebp - 0x10]
mov dword [edi], esi
push esi
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
je 0x1000fc6e
mov esi, dword [ebp - 0x10]
jmp 0x1000fc6e
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1023b4d8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret 8
Function at 0x430007
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
mov ebx, 0x408ed0
nop
mov ecx, 0x60e4082d
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x46266bf0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401e8a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x55ff5e
call fcn.0051f140
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebx + 0x24]
mov dword [ebp - 0x10], ebx
call fcn.00402891
xor esi, esi
lea ecx, [ebx + 0x30]
mov dword [ebp - 4], esi
call fcn.00402891
mov dword [ebx + 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
lea edi, [ebx + 0xc]
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
and byte [ebx + 9], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push edi
mov byte [ebp - 4], 1
mov byte [ebx + 8], 1
mov dword [ebx + 0x20], eax
mov byte [ebx + 0xa], 1
mov dword [ebx], esi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [ebx + 0x24]
call fcn.00402557
call fcn.004c226c
push esi
push edi
mov ecx, eax
call fcn.004c2367
mov esi, eax
push esi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, esi
push eax
push esi
lea ecx, [ebx + 0x30]
call fcn.00402557
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x40de32
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x561d7c
call fcn.0051f140
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x2f68]
mov dword [ebp - 4], 0x26
call fcn.0049c71a
lea ecx, [esi + 0x2e08]
mov byte [ebp - 4], 0x25
call fcn.0049c71a
lea ecx, [esi + 0x2ca8]
mov byte [ebp - 4], 0x24
call fcn.0049c71a
lea ecx, [esi + 0x2b48]
mov byte [ebp - 4], 0x23
call fcn.0049c71a
lea ecx, [esi + 0x29e8]
mov byte [ebp - 4], 0x22
call fcn.0049c71a
lea ecx, [esi + 0x2888]
mov byte [ebp - 4], 0x21
call fcn.0049c71a
lea ecx, [esi + 0x2728]
mov byte [ebp - 4], 0x20
call fcn.0049c71a
lea ecx, [esi + 0x25c8]
mov byte [ebp - 4], 0x1f
call fcn.0049c71a
lea ecx, [esi + 0x2468]
mov byte [ebp - 4], 0x1e
call fcn.0049c71a
lea ecx, [esi + 0x2308]
mov byte [ebp - 4], 0x1d
call fcn.0049c71a
lea ecx, [esi + 0x21a8]
mov byte [ebp - 4], 0x1c
call fcn.0049c71a
lea ecx, [esi + 0x2048]
mov byte [ebp - 4], 0x1b
call fcn.0049c71a
lea ecx, [esi + 0x1ee8]
mov byte [ebp - 4], 0x1a
call fcn.0049c71a
lea ecx, [esi + 0x1d88]
mov byte [ebp - 4], 0x19
call fcn.0049c71a
lea ecx, [esi + 0x1c28]
mov byte [ebp - 4], 0x18
call fcn.0049c71a
lea ecx, [esi + 0x1ac8]
mov byte [ebp - 4], 0x17
call fcn.0049c71a
lea ecx, [esi + 0x1968]
mov byte [ebp - 4], 0x16
call fcn.0049c71a
lea ecx, [esi + 0x1808]
mov byte [ebp - 4], 0x15
call fcn.0049c71a
lea ecx, [esi + 0x16e4]
mov byte [ebp - 4], 0x14
call fcn.0047c914
lea ecx, [esi + 0x15c0]
mov byte [ebp - 4], 0x13
call fcn.0047c914
lea ecx, [esi + 0x149c]
mov byte [ebp - 4], 0x12
call fcn.0047c914
lea ecx, [esi + 0x1378]
mov byte [ebp - 4], 0x11
call fcn.0047c914
lea ecx, [esi + 0x1254]
mov byte [ebp - 4], 0x10
call fcn.0047c914
lea ecx, [esi + 0x1130]
mov byte [ebp - 4], 0xf
call fcn.0047c914
lea ecx, [esi + 0x100c]
mov byte [ebp - 4], 0xe
call fcn.0047c914
lea ecx, [esi + 0xee8]
mov byte [ebp - 4], 0xd
call fcn.0047c914
lea ecx, [esi + 0xdc4]
mov byte [ebp - 4], 0xc
call fcn.0047c914
lea ecx, [esi + 0xc64]
mov byte [ebp - 4], 0xb
call fcn.0049c71a
lea ecx, [esi + 0xb40]
mov byte [ebp - 4], 0xa
call fcn.0047f619
lea ecx, [esi + 0xa1c]
mov byte [ebp - 4], 9
call fcn.0047f619
lea ecx, [esi + 0x8f8]
mov byte [ebp - 4], 8
call fcn.0047f619
lea ecx, [esi + 0x7d4]
mov byte [ebp - 4], 7
call fcn.0047f619
lea ecx, [esi + 0x6b0]
mov byte [ebp - 4], 6
call fcn.0047f619
lea ecx, [esi + 0x58c]
mov byte [ebp - 4], 5
call fcn.0047f619
lea ecx, [esi + 0x468]
mov byte [ebp - 4], 4
call fcn.0047f619
lea ecx, [esi + 0x344]
mov byte [ebp - 4], 3
call fcn.0047f619
lea ecx, [esi + 0x220]
mov byte [ebp - 4], 2
call fcn.0047f619
lea ecx, [esi + 0x150]
mov byte [ebp - 4], 1
call fcn.0047847d
and byte [ebp - 4], 0
lea ecx, [esi + 0x80]
call fcn.0047847d
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0051ee98
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42eb3b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x5658b1
call fcn.0051f140
sub esp, 0x134
push ebx
push esi
lea eax, [ebp - 0x1c]
push edi
mov esi, ecx
push eax
call sub.MFC42.DLL_AfxVariantInit
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
je 0x42ec79
mov ecx, dword [esi + 0x60]
cmp ecx, ebx
je 0x42eb81
mov eax, dword [ecx]
call dword [eax + 0x60]
mov ecx, dword [esi + 0x60]
cmp ecx, ebx
je 0x42eb81
mov eax, dword [ecx]
push 1
call dword [eax + 4]
push 0x40
call sub.MFC42.DLL_operatornew
mov edi, eax
pop ecx
mov dword [ebp - 0x40], edi
cmp edi, ebx
mov byte [ebp - 4], 1
je 0x42eba7
mov ecx, edi
call fcn.0051edea
mov dword [edi], 0x57ec08
mov eax, edi
jmp 0x42eba9
xor eax, eax
mov dword [esi + 0x60], eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], bl
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x24]
push 0xa
sub ecx, dword [ebp - 0x2c]
pop eax
push ebx
push ebx
sub ecx, 0xf
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
push ebx
push 0x64
push esi
sub ecx, eax
lea eax, [ebp - 0x3c]
push eax
push 0x50000000
mov dword [ebp - 0x30], ecx
mov ecx, dword [esi + 0x60]
push ebx
push 0x57ebf8
mov dword [ebp - 0x38], 0x50
call sub.MFC42.DLL_CWnd::CreateControl
test eax, eax
je 0x42ec79
mov al, byte [0x5d8050]
push 0x3f
mov byte [ebp - 0x140], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x13f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x140]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x140]
push str.Help_
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 8]
lea eax, [ebp - 0x140]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x1c]
mov ecx, dword [esi + 0x60]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.0049dba8
push 5
mov ecx, esi
call sub.MFC42.DLL_CWnd::ShowWindow
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x433d55
Capabilities:
Get common file path

Disassembly:
mov eax, 0x566179
call fcn.0051f140
push ecx
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push 0x131
call sub.MFC42.DLL_CDialog::CDialog
lea edi, [esi + 0x60]
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0051edea
mov dword [edi], 0x57ffc8
lea eax, [esi + 0xb8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea eax, [esi + 0xc4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x414]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x418]
mov byte [ebp - 4], 4
call fcn.0049d76b
push 0x2132b
mov byte [ebp - 4], 5
mov dword [esi], 0x57fef0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
or dword [esi + 0x1f4], 0xffffffff
or dword [esi + 0x1f8], 0xffffffff
mov dword [esi + 0xa4], eax
xor eax, eax
xor ecx, ecx
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], ecx
mov dword [esi + 0x410], ebx
mov dword [esi + 0x40c], ebx
mov dword [esi + 0x408], ebx
mov dword [esi + 0x404], ebx
mov dword [esi + 0x400], ebx
mov dword [esi + 0xb4], ebx
call dword [sym.imp.GraphicData.dll_GameDataSetQuery]
mov edx, dword [eax]
push str.French
mov ecx, eax
call dword [edx + 0x34]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x433e83
push 0x448
call sub.MFC42.DLL_operatornew
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
cmp ecx, ebx
mov byte [ebp - 4], 6
je 0x433e5f
call fcn.0047db25
jmp 0x433e61
xor eax, eax
cmp eax, ebx
mov byte [ebp - 4], 5
mov dword [esi + 0xb4], eax
jne 0x433e83
push str.E:CQ2ClientRelease_17.1.9MyShellDlgLoginFlash.cpp
push 0x5a
push 0x5c6a8c
call fcn.005185c3
add esp, 0xc
mov edi, 0x81
lea eax, [esi + 0x27d]
push edi
push ebx
push eax
mov byte [esi + 0xa0], bl
mov dword [esi + 0x428], ebx
mov byte [esi + 0xb0], 1
mov byte [esi + 0x3fe], bl
call sub.MSVCRT.dll_memset
push edi
lea eax, [esi + 0x1fc]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x21
lea eax, [esi + 0x1d0]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x100
lea eax, [esi + 0xd0]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x30
lea edi, [esi + 0x2fe]
push edi
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
call sub.MSVCRT.dll_strlen
cmp byte [eax + esi + 0x2fd], 0x5c
pop ecx
jne 0x433f12
push edi
call sub.MSVCRT.dll_strlen
pop ecx
mov byte [eax + esi + 0x2fd], bl
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4367ca
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
push 0x40
xor bl, bl
pop ecx
xor eax, eax
lea edi, [ebp - 0x21b]
mov byte [ebp - 0x21c], bl
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str._s.
lea eax, [ebp - 0x21c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCRT.dll__findfirst]
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
jne 0x43682a
mov al, 1
jmp 0x436889
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x436869
lea eax, [ebp - 0x104]
push 0x5c6eac
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x436869
lea eax, [ebp - 0x104]
push 0x5c6ea8
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x43687f
lea eax, [ebp - 0x118]
push eax
push esi
call dword [sym.imp.MSVCRT.dll__findnext]
pop ecx
test eax, eax
pop ecx
je 0x43682a
mov bl, 1
push esi
call dword [sym.imp.MSVCRT.dll__findclose]
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43fe88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x569ab2
call fcn.0051f140
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xe9
call sub.MFC42.DLL_CDialog::CDialog
xor edi, edi
lea ecx, [esi + 0x94]
mov dword [ebp - 4], edi
call fcn.0049c608
lea ecx, [esi + 0x1f4]
mov byte [ebp - 4], 1
call fcn.0049c608
lea ecx, [esi + 0x354]
mov byte [ebp - 4], 2
call fcn.0049c608
lea ecx, [esi + 0x4b4]
mov byte [ebp - 4], 3
call fcn.0049c608
lea ecx, [esi + 0x614]
mov byte [ebp - 4], 4
call fcn.0049c608
lea ecx, [esi + 0x774]
mov byte [ebp - 4], 5
call fcn.0049c608
lea ecx, [esi + 0x8d4]
mov byte [ebp - 4], 6
call fcn.0049c608
lea ecx, [esi + 0xa34]
mov byte [ebp - 4], 7
call fcn.0049c608
lea ecx, [esi + 0xb94]
mov byte [ebp - 4], 8
call fcn.0049c608
lea ecx, [esi + 0xcf4]
mov byte [ebp - 4], 9
call fcn.0049c608
lea ecx, [esi + 0xe54]
mov byte [ebp - 4], 0xa
call fcn.0049c608
lea ecx, [esi + 0xfb4]
mov byte [ebp - 4], 0xb
call fcn.0049c608
lea ecx, [esi + 0x1114]
mov byte [ebp - 4], 0xc
call fcn.0047f586
lea ecx, [esi + 0x1238]
mov byte [ebp - 4], 0xd
call fcn.0047f586
lea ecx, [esi + 0x135c]
mov byte [ebp - 4], 0xe
call fcn.0047f586
lea ecx, [esi + 0x1480]
mov byte [ebp - 4], 0xf
call fcn.0047f586
lea ecx, [esi + 0x15a4]
mov byte [ebp - 4], 0x10
call fcn.0047f586
lea ecx, [esi + 0x16c8]
mov byte [ebp - 4], 0x11
call fcn.0047f586
lea ecx, [esi + 0x17ec]
mov byte [ebp - 4], 0x12
call fcn.004783e6
lea ecx, [esi + 0x18bc]
mov byte [ebp - 4], 0x13
call fcn.004783e6
lea ecx, [esi + 0x198c]
mov byte [ebp - 4], 0x14
call fcn.004783e6
lea ecx, [esi + 0x1a5c]
mov byte [ebp - 4], 0x15
call fcn.004783e6
lea ecx, [esi + 0x1b2c]
mov byte [ebp - 4], 0x16
call fcn.004783e6
lea ecx, [esi + 0x1bfc]
mov byte [ebp - 4], 0x17
call fcn.004783e6
lea ecx, [esi + 0x1ccc]
mov byte [ebp - 4], 0x18
call fcn.004783e6
lea ecx, [esi + 0x1d9c]
mov byte [ebp - 4], 0x19
call fcn.004783e6
lea ecx, [esi + 0x1e6c]
mov byte [ebp - 4], 0x1a
call fcn.004783e6
lea ecx, [esi + 0x1f3c]
mov byte [ebp - 4], 0x1b
call fcn.004783e6
lea ecx, [esi + 0x200c]
mov byte [ebp - 4], 0x1c
call fcn.004783e6
lea ecx, [esi + 0x20dc]
mov byte [ebp - 4], 0x1d
call fcn.004783e6
lea ecx, [esi + 0x21ac]
mov byte [ebp - 4], 0x1e
call fcn.004783e6
lea ecx, [esi + 0x227c]
mov byte [ebp - 4], 0x1f
call fcn.004783e6
lea ecx, [esi + 0x234c]
mov byte [ebp - 4], 0x20
call fcn.004783e6
lea ecx, [esi + 0x241c]
mov byte [ebp - 4], 0x21
call fcn.004783e6
lea ecx, [esi + 0x24ec]
mov byte [ebp - 4], 0x22
call fcn.004783e6
lea ecx, [esi + 0x25bc]
mov byte [ebp - 4], 0x23
call fcn.004783e6
push 0x2132b
mov dword [esi], 0x580ae8
mov dword [esi + 0x60], edi
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
fldz
mov dword [esi + 0x6c], eax
mov dword [esi + 0x90], edi
fstp dword [esi + 0x8c]
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x45dac4
Capabilities:
Get common file path

Disassembly:
mov eax, 0x56bdfe
call fcn.0051f140
push ecx
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push 0x15e
call sub.MFC42.DLL_CDialog::CDialog
xor ebx, ebx
lea ecx, [esi + 0x190]
mov dword [ebp - 4], ebx
call fcn.00402891
lea ecx, [esi + 0x19c]
mov byte [ebp - 4], 1
call fcn.00402891
lea ecx, [esi + 0x1b0]
mov byte [ebp - 4], 2
call fcn.004783e6
lea ecx, [esi + 0x280]
mov byte [ebp - 4], 3
call fcn.004783e6
lea ecx, [esi + 0x350]
mov byte [ebp - 4], 4
call fcn.0049c608
lea ecx, [esi + 0x4b0]
mov byte [ebp - 4], 5
call fcn.0049c608
lea ecx, [esi + 0x610]
mov byte [ebp - 4], 6
call fcn.0049c608
lea ecx, [esi + 0x770]
mov byte [ebp - 4], 7
call fcn.0049c608
lea ecx, [esi + 0x8d0]
mov byte [ebp - 4], 8
call fcn.0049c608
lea ecx, [esi + 0xa30]
mov byte [ebp - 4], 9
call fcn.0049c608
lea ecx, [esi + 0xb90]
mov byte [ebp - 4], 0xa
call fcn.0049c608
lea ecx, [esi + 0xcf0]
mov byte [ebp - 4], 0xb
call fcn.0049c608
lea ecx, [esi + 0xe50]
mov byte [ebp - 4], 0xc
call fcn.0049c608
lea edi, [esi + 0xfb0]
mov byte [ebp - 4], 0xd
mov ecx, edi
call fcn.0051edea
mov dword [edi], 0x57ffc8
push ebx
mov dword [esi], 0x584260
mov dword [esi + 0x1ac], ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x188], eax
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], ecx
mov byte [esi + 0x1a8], bl
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x60], ebx
lea edi, [esi + 0x80]
mov dword [esi + 0x64], ebx
fldz
push edi
push 0xff
fstp dword [esi + 0x70]
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
call sub.MSVCRT.dll_strlen
cmp byte [eax + esi + 0x7f], 0x5c
pop ecx
jne 0x45dc39
push edi
call sub.MSVCRT.dll_strlen
pop ecx
mov byte [eax + esi + 0x7f], bl
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x47b28f
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address
Get number of processors

Disassembly:
mov ecx, 0x5d8348
jmp 0x47b283
mov eax, 0x56e605
call fcn.0051f140
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x50]
call fcn.0047c5a1
xor ebx, ebx
lea ecx, [esi + 0x70]
mov dword [ebp - 4], ebx
call fcn.00402891
lea eax, [esi + 0x7c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
push 6
mov edi, 0x5d8050
pop eax
mov byte [ebp - 4], 2
push 0xb
mov dword [esi + 4], eax
fldz
pop ecx
mov dword [esi + 0xc], eax
fstp dword [esi + 0x44]
push 8
mov dword [esi], 0x587c0c
pop eax
mov dword [esi + 8], ecx
fldz
push edi
mov dword [esi + 0x10], 0xc
fstp dword [esi + 0x48]
mov dword [esi + 0x14], 7
mov dword [esi + 0x18], 0xd
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0x10
mov dword [esi + 0x2c], 0xa
mov dword [esi + 0x30], 0x13
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], 0x15
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x68], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], ebx
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x70]
call fcn.00402557
lea eax, [esi + 0x5c]
push ebx
push eax
push str.State
mov edi, str.GuiSetup.ini
push str.AutoWrite
push edi
call fcn.00518321
lea eax, [esi + 0x64]
push ebx
push eax
push str.Status
push str.ExtraWrite
push edi
call fcn.00518321
add esp, 0x28
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x47da3a
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
push 0x2a
xor edi, edi
call fcn.0047dadc
test eax, eax
jne 0x47da58
push 0x36
mov ecx, esi
call fcn.0047dadc
test eax, eax
je 0x47da5b
push 1
pop edi
mov al, byte [esp + 0xc]
cmp al, 0x10
jb 0x47da67
cmp al, 0x19
jbe 0x47da77
cmp al, 0x1e
jb 0x47da6f
cmp al, 0x26
jbe 0x47da77
cmp al, 0x2c
jb 0x47da9f
cmp al, 0x32
ja 0x47da9f
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0xff
test ax, ax
je 0x47da92
test edi, edi
je 0x47da96
test ax, ax
jne 0x47da9b
test edi, edi
je 0x47da9b
push 1
pop eax
jmp 0x47daa1
xor eax, eax
jmp 0x47daa1
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x47e283
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_CWnd::GetDlgCtrlID
push eax
push esi
mov ecx, 0x5d8348
call fcn.0047b8cc
lea edi, [esi + 0x40]
push 0x1f98
push 0
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 0x18]
sub eax, dword [ebp + 8]
mov byte [esi + 0x74], cl
mov bl, byte [ebp + 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
mov byte [esi + 0x51], bl
mov dword [esi + 0x44], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [esi + 0x15b0], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov dword [esi + 0x15b4], eax
mov al, byte [ebp + 0x10]
movzx ecx, al
mov byte [esi + 0x50], al
mov eax, dword [ebp - 4]
sub eax, ecx
sub eax, dword [ebp - 0xc]
inc eax
cdq
idiv ecx
movzx ecx, bl
mov byte [esi + 0x52], al
mov eax, dword [ebp - 8]
sub eax, ecx
sub eax, dword [ebp - 0x10]
inc eax
cdq
idiv ecx
xor edx, edx
xor ecx, ecx
mov byte [esi + 0x53], al
lea eax, [esi + 0x1180]
mov dword [eax - 0x500], edx
and byte [esi + ecx + 0x1080], 0
mov dword [eax], edx
mov dword [eax - 0xd00], edx
mov dword [eax - 0x1100], 3
inc ecx
add eax, 4
cmp ecx, 0x100
jl 0x47e328
cmp dword [ebp + 0x1c], edx
je 0x47e36d
push 0x20
lea eax, [esi + 0x1fb8]
push dword [ebp + 0x1c]
push eax
call fcn.00519068
add esp, 0xc
push 1
pop eax
pop edi
mov dword [esi + 0x15a0], eax
mov dword [esi + 0x15a4], eax
pop esi
pop ebx
leave
ret 0x18

Function at 0x482219
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push esi
je 0x4822b7
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push 0x10
push 1
push dword [eax + 0x6c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4822b7
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
push dword [eax + 0x6c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
push dword [eax + 0x6c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4822b7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4822b7
add eax, 0x30
push 8
push eax
lea eax, [ebp - 8]
push eax
call sub.MSVCRT.dll_memcpy
movzx eax, word [ebp - 4]
add esp, 0xc
push eax
movzx eax, word [ebp - 2]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 6]
push eax
mov eax, dword [ebp + 0xc]
dec eax
push str._d._d._d._d
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x1c
mov al, 1
jmp 0x4822b9
xor al, al
pop esi
leave
ret