joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4adb2e
Capabilities:
Reference sql statements

Disassembly:
push 0x68
mov eax, 0x50e0c9
call fcn.004cc2a7
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, str.prereq
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push ebx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
call fcn.004d163d
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00407b30
xor ebx, ebx
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0045106f
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push ebx
push 1
call fcn.0040487e
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov ebx, str.SELECT__Data__FROM__Binary__WHERE__Name___Prereq.dll
push ebx
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.004d163d
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x44]
call fcn.00407b30
mov byte [ebp - 4], 3
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.0049f1fb
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
push 0
push 1
call fcn.0040487e
cmp dword [ebp - 0x48], 8
lea ecx, [ebp - 0x5c]
cmovae ecx, dword [ebp - 0x5c]
call fcn.004150b6
mov dword [ebp - 0x60], eax
lea edx, [ebp - 0x68]
push dword [ebp - 0x60]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x74]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x64], eax
call fcn.004b1b83
pop ecx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x60], 0
je 0x4adc35
push str.InstallPrereq
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4adc35
push esi
call eax
mov dword [edi], eax
mov bl, 1
jmp 0x4adc37
xor bl, bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.004b16e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
push 0
push 1
call fcn.0040487e
mov al, bl
call fcn.004cc251
ret 4
Function at 0x4b0985
Capabilities:
Get common file path

Disassembly:
push 0x230
mov eax, 0x50e95f
call fcn.004cc2a7
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
mov esi, dword [ebp + 8]
and dword [ebp - 0x234], 0
push 0x104
push eax
mov dword [ebp - 0x238], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add eax, eax
cmp eax, 0x208
jae 0x4b0a71
sub esp, 0x18
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
mov ecx, esp
lea eax, [ebp - 0x218]
mov dword [ebp - 0x23c], esp
push eax
call fcn.00407bc3
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.004656c0
xor eax, eax
mov dword [ebp - 4], eax
mov edi, str.msiexec.exe
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
push edi
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.004d163d
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.00407b30
mov dword [ebp - 4], 2
lea eax, [ebp - 0x230]
push eax
mov ecx, esi
call fcn.00425c19
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
push 0
push ebx
call fcn.0040487e
mov eax, esi
call fcn.004cc251
ret 4
call fcn.004cbef6
int3
Function at 0x4b22e8
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0x80
mov eax, 0x50ef2f
call fcn.004cc2a7
mov esi, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, esp
mov dword [ebp - 0x74], esp
mov dword [ebp - 0x8c], eax
push esi
call fcn.00407bc3
xor edi, edi
mov dword [ebp - 4], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.004656c0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x70]
call fcn.00465ae0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x4b2341
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
mov dword [ebp - 0x74], ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.0040487e
mov eax, dword [ebp + 0xc]
cmp ebx, 3
jne 0x4b236b
test eax, 0x20000
jne 0x4b23af
cmp ebx, 2
jne 0x4b2377
test eax, 0x10000
jne 0x4b23af
cmp ebx, 4
jne 0x4b2383
test eax, 0x40000
jne 0x4b23af
cmp ebx, 5
jne 0x4b238f
test eax, 0x80000
jne 0x4b23af
cmp ebx, 6
jne 0x4b239b
test eax, 0x100000
jne 0x4b23af
cmp ebx, 2
jne 0x4b2477
test eax, 0x200000
je 0x4b2477
lea eax, [ebp - 0x28]
mov dword [ebp - 0x84], edi
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
call fcn.00465ae0
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x4b23d6
mov eax, dword [eax]
push edi
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.0040487e
push esi
lea ecx, [ebp - 0x28]
call fcn.00407bc3
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
mov eax, dword [ebp - 0x78]
mov ebx, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x84]
mov edi, dword [ebp - 0x80]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040a3c1
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 7
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.0040487e
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x58]
push eax
call fcn.004b3649
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push edi
push 1
call fcn.0040487e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
push edi
push 1
call fcn.0040487e
call fcn.004cc251
ret 0x18
Function at 0x4b8ffa
Capabilities:
Get common file path

Disassembly:
push 0x254
mov eax, 0x510301
call fcn.004cc2a7
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x250], eax
add eax, eax
cmp eax, 0x208
jae 0x4b91d4
sub esp, 0x18
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
mov ecx, esp
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x260], esp
push eax
call fcn.00407bc3
xor ebx, ebx
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.004656c0
mov dword [ebp - 4], 1
xor eax, eax
mov esi, str.msi.dll
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
push esi
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], ax
call fcn.004d163d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x234]
call fcn.00407b30
mov byte [ebp - 4], 2
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00425c19
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
push ebx
push 1
call fcn.0040487e
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x250], ebx
call fcn.00467040
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x4b910a
mov eax, dword [eax]
mov esi, dword [sym.imp.msi.dll_MsiMessageBoxW]
lea ecx, [ebp - 0x250]
push ebx
push ebx
push ecx
push ebx
push eax
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
push ebx
push 1
call fcn.0040487e
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x25c]
inc eax
push eax
call fcn.00467250
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00467040
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x4b9160
mov eax, dword [eax]
mov edi, dword [ebp - 0x25c]
lea ecx, [ebp - 0x250]
push ebx
push ebx
push ecx
push edi
push eax
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
push ebx
push 1
call fcn.0040487e
mov eax, ebx
mov edx, ebx
cmp edx, dword [ebp - 0x250]
jae 0x4b91a8
movzx esi, word [edi + edx*2]
cmp esi, 0x2e
je 0x4b91a2
imul ecx, eax, 0xa
lea eax, [esi - 0x30]
add eax, ecx
inc edx
cmp edx, 3
jb 0x4b9189
imul esi, eax, 0xa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x25c]
call fcn.004677d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
push ebx
push 1
call fcn.0040487e
mov eax, esi
call fcn.004cc251
ret
call fcn.004cbef6
int3
Function at 0x4c0ee5
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4c1051
mov ebp, 0x10000000
cmp eax, 0x7c
je 0x4c1051
cmp eax, 0x29
jne 0x4c0f1e
cmp dword [esi + 0x10], 0
jne 0x4c1051
test dword [esi + 0x50], ebp
je 0x4c105f
cmp eax, 0x2e
jne 0x4c0f39
push 5
lea ecx, [esi + 0x24]
call fcn.004c115c
mov ecx, esi
call fcn.004c0ec0
jmp 0x4c103c
cmp eax, 0x5c
jne 0x4c0f96
mov ecx, esi
call fcn.004c0ec0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4c0f6c
cmp word [esi + 0x48], 0x62
jne 0x4c0f6c
push 4
lea ecx, [esi + 0x24]
call fcn.004c115c
mov ecx, esi
call fcn.004c0ec0
jmp 0x4c1043
test eax, eax
je 0x4c0f8a
cmp word [esi + 0x48], 0x42
jne 0x4c0f8a
push 4
lea ecx, [esi + 0x24]
call fcn.004c115c
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4c0f60
mov ecx, esi
call fcn.004c1c33
jmp 0x4c103c
cmp eax, 0x5b
jne 0x4c0fba
mov ecx, esi
call fcn.004c0ec0
mov ecx, esi
call fcn.004c1be7
cmp dword [esi + 0x4c], 0x5d
je 0x4c0f2d
push 4
jmp 0x4c1061
cmp eax, 0x28
jne 0x4c0fe2
mov ecx, esi
call fcn.004c0ec0
mov ecx, esi
call fcn.004c1ce1
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4c105f
mov ecx, esi
call fcn.004c0ec0
jmp 0x4c1038
cmp eax, 0x5e
jne 0x4c0fee
push 2
jmp 0x4c0f58
cmp eax, 0x24
jne 0x4c0ffa
push 3
jmp 0x4c0f58
cmp eax, 0x2a
je 0x4c105b
cmp eax, 0x2b
je 0x4c105b
cmp eax, 0x3f
je 0x4c105b
cmp eax, 0x7b
je 0x4c105b
cmp eax, 0x7d
jne 0x4c1018
test dword [esi + 0x50], ebp
je 0x4c1057
cmp eax, 0x5d
jne 0x4c1022
test dword [esi + 0x50], ebp
je 0x4c0fb3
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004c1e80
mov ecx, esi
call fcn.004c0ec0
mov bl, 1
test bl, bl
je 0x4c1043
mov ecx, esi
call fcn.004c1dbd
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x4c0efd
pop esi
pop ebp
mov al, cl
pop ebx
ret
push 6
jmp 0x4c1061
push 0xa
jmp 0x4c1061
push 5
call fcn.004c91dc
int3
Function at 0x4c5ed4
Capabilities:
Delete directory

Disassembly:
push 0xc
mov eax, 0x513820
call fcn.004cc273
mov edi, edx
mov esi, ecx
call fcn.00406ab4
push eax
lea ecx, [ebp - 0x10]
call fcn.004068df
mov dword [ebp - 4], 1
mov eax, dword [edi]
push 0x5c
pop ebx
mov eax, dword [eax - 0xc]
test eax, eax
je 0x4c5f43
dec eax
mov ecx, edi
push eax
call fcn.0046a1e0
cmp ax, bx
jne 0x4c5f43
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00447ac6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push eax
call fcn.00446083
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406ba9
jmp 0x4c5f4c
push edi
lea ecx, [ebp - 0x10]
call fcn.00446083
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi]
mov eax, dword [eax - 0xc]
cmp eax, dword [ecx - 0xc]
jge 0x4c5faa
push ebx
push ecx
call fcn.004cf115
pop ecx
pop ecx
test eax, eax
jne 0x4c5f6b
or eax, 0xffffffff
jmp 0x4c5f6f
sub eax, dword [esi]
sar eax, 1
push eax
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00447ac6
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x4c5f9b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.004c5ed4
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406ba9
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406ba9
call fcn.004cc23c
ret

Function at 0x4c5fbf
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x513863
call fcn.004cc273
mov edi, edx
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x4c6052
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00406ab4
push eax
lea ecx, [ebp - 0x10]
call fcn.004068df
mov dword [ebp - 4], 1
push 0x5c
push dword [esi]
call fcn.004cf115
pop ecx
pop ecx
test eax, eax
je 0x4c6033
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x4c6033
push eax
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00447ac6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push eax
call fcn.00446083
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406ba9
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x4c6046
mov edx, edi
lea ecx, [ebp - 0x10]
call fcn.004c5ed4
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406ba9
call fcn.004cc23c
ret
Function at 0x4c65f2
Capabilities:
Check if file exists

Disassembly:
push 0x7c
mov eax, 0x513a1c
call fcn.004cc2a7
mov dword [ebp - 0x80], edx
mov edx, ecx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x84], edx
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
and dword [ebp - 0x74], 0
mov dword [ebp - 0x78], ecx
mov ecx, edx
push eax
mov dword [ebp - 0x88], edx
call fcn.0040a3c1
push dword [ebp + 0x1c]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x80]
push esi
push edi
mov edi, dword [ebp - 0x7c]
mov edx, edi
push ebx
push dword [ebp - 0x78]
mov dword [ebp - 0x74], 1
call fcn.004c62c5
add esp, 0x14
cmp dword [edi + 0x14], 8
jb 0x4c6662
mov eax, dword [edi]
jmp 0x4c6664
mov eax, edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x4c6764
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84], esp
push edi
call fcn.0040a3c1
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.004656c0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x58]
call fcn.00467480
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x58]
call fcn.00466fd0
mov esi, eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x40]
call fcn.00466fd0
push esi
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0040febb
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 4
mov esi, eax
call fcn.00404627
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00404627
test esi, esi
jne 0x4c674c
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00467040
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x4c6710
mov eax, dword [eax]
push eax
call ebx
test eax, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
setne bl
call fcn.00404627
test bl, bl
je 0x4c674c
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00467040
push eax
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.0040f13f
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00404627
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004078d9
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.004078d9
mov eax, edi
call fcn.004cc251
ret
Function at 0x4c6dfd
Capabilities:
Check os version

Disassembly:
push 0x120
mov eax, 0x513b21
call fcn.004cc2a7
mov esi, ecx
mov dword [ebp - 0x128], esi
call fcn.00423b32
and dword [ebp - 4], 0
lea edi, [esi + 0x20]
push 0x58
push 0
push edi
call fcn.004cd4d0
xor eax, eax
mov dword [esi + 0x78], 1
xor ecx, ecx
mov dword [edi], 0x58
lea ebx, [esi + 0x27c]
mov word [esi + 0x7c], cx
push 0x110
mov word [ebx], ax
lea eax, [ebp - 0x120]
push ecx
push eax
mov dword [ebp - 0x124], 0x114
call fcn.004cd4d0
add esp, 0x18
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4c6e93
cmp dword [ebp - 0x120], 5
jae 0x4c6e99
cmp dword [ebp - 0x120], 4
jne 0x4c6e93
cmp dword [ebp - 0x11c], 0x5a
jae 0x4c6e99
mov dword [edi], 0x4c
and dword [esi + 0x5c], 0
lea eax, [esi + 0x7c]
mov dword [esi + 0x44], eax
mov eax, esi
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0x104
mov dword [esi + 0x48], 0x100
mov dword [esi + 0x54], 0x880024
mov dword [esi + 0x2c], str.Folders_Only
mov ecx, dword [0x56e360]
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x64], 0x42333b
mov dword [esi + 0x24], ecx
call fcn.004cc251
ret 0x18

Function at 0x4c70f0
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4ca1e6
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x513bba
call fcn.004cc2a7
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4ca303
cmp byte [ebx + 0x3e], 0
je 0x4ca303
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.004cc202
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x4ca232
xor al, al
jmp 0x4ca305
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004513d9
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x4ca262
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.004cc202
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x4ca297
sub eax, 1
je 0x4ca29b
dec eax
sub eax, 1
je 0x4ca2f1
xor bl, bl
jmp 0x4ca2f3
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x4ca2ab
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x4ca2d3
cmp eax, 0x10
jae 0x4ca2ba
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004dcf39
add esp, 0x10
cmp esi, eax
jne 0x4ca293
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x4ca2f1
test esi, esi
jne 0x4ca256
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00404095
jmp 0x4ca250
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004044bd
mov al, bl
jmp 0x4ca305
mov al, 1
call fcn.004cc251
ret
Function at 0x4ca77c
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x513c0f
call fcn.004cc2a7
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x4ca7a1
xor eax, eax
jmp 0x4ca91a
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4ca7cd
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4ca7cd
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x4ca91a
cmp dword [esi + 0x4c], 0
je 0x4ca917
mov ecx, esi
call fcn.004ca3ef
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4ca800
push dword [esi + 0x4c]
push edi
call fcn.004c9fae
pop ecx
pop ecx
test al, al
je 0x4ca917
movzx ebx, di
jmp 0x4ca917
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004513d9
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x4ca838
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.004cc202
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x4ca90b
cmp eax, 1
jg 0x4ca8e6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x4ca881
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x4ca8ae
cmp eax, 0x10
jae 0x4ca890
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.004dcf39
add esp, 0x10
cmp edi, eax
jne 0x4ca8e1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x4ca8b1
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x4ca8db
test edi, edi
jne 0x4ca82c
cmp dword [ebp - 0x18], 0x20
jae 0x4ca905
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.00404095
jmp 0x4ca826
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x4ca905
cmp eax, 3
jne 0x4ca90b
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.004c9fae
pop ecx
pop ecx
test al, al
je 0x4ca905
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004044bd
mov ax, bx
call fcn.004cc251
ret 4

Function at 0x4e68cb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e658e

Function at 0x4e68d6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e670f
Function at 0x4eee7a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
mov eax, dword [0x569078]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esp + 0x3c]
mov edi, dword [esi + 0x30]
movsx ebx, ax
shr eax, 0x10
movsx ebp, ax
jmp 0x4eeee9
mov esi, dword [edi]
lea ecx, [esp + 0x1c]
xorps xmm0, xmm0
movups xmmword [esp + 0x1c], xmm0
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
push ebp
push ebx
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4eeee6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
test al, al
je 0x4eeee6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
test al, al
jne 0x4eeeef
mov edi, dword [edi + 8]
test edi, edi
jne 0x4eeea6
jmp 0x4eef15
xor eax, eax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x38], 0x205
lea ecx, [esp + 0x10]
push ecx
sete al
mov dword [esp + 0x18], ebp
inc eax
mov ecx, esi
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
call dword [eax + 0x4c]
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cb6da
add esp, 0x24
ret 8

Function at 0x4ef089
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x3c
mov eax, dword [0x569078]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
push ebx
push ebp
push esi
push edi
movsx ebp, ax
mov edi, ecx
shr eax, 0x10
and dword [edx], 0
cwde
mov ebx, dword [edi + 0x30]
mov dword [esp + 0x14], eax
jmp 0x4ef0fe
mov esi, dword [ebx]
lea ecx, [esp + 0x34]
xorps xmm0, xmm0
movups xmmword [esp + 0x34], xmm0
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
push dword [esp + 0x14]
lea eax, [esp + 0x38]
push ebp
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4ef0fb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
test al, al
je 0x4ef0fb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
test al, al
jne 0x4ef128
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4ef0b8
mov ecx, dword [edi + 0x34]
test ecx, ecx
je 0x4ef111
mov eax, dword [ecx]
call dword [eax + 0x54]
and dword [edi + 0x34], ebx
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cb6da
add esp, 0x3c
ret 0x10
mov ecx, dword [edi + 0x34]
cmp esi, ecx
je 0x4ef13b
test ecx, ecx
je 0x4ef138
mov eax, dword [ecx]
call dword [eax + 0x54]
mov dword [edi + 0x34], esi
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
mov dword [esp + 0x18], ebp
and ax, cx
lea edx, [esp + 0x18]
xor cx, cx
cmp cx, ax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 0x34]
sbb eax, eax
neg eax
mov dword [esp + 0x20], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x50]
mov eax, dword [edi + 4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x2c], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
jmp 0x4ef111
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219