joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1029fc6
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x1038f18], 1
push ebx
push esi
push edi
jne 0x1029ff5
or dword [0x1038f18], 1
call fcn.01029f65
mov dword [0x1038f14], eax
push 4
pop eax
call fcn.0100baed
mov esi, esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x102a017
xor eax, eax
jmp 0x102a0d4
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x4c]
lea edi, [eax - 1]
not edi
and edi, esi
sub edi, eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x1038f10]
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xffff1000
add esi, 0x11000
add esi, ebx
cmp edi, esi
jb 0x102a010
cmp eax, 1
je 0x102a0b5
mov dword [ebp - 8], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x102a010
mov eax, dword [ebp - 0x20]
add dword [ebp - 8], eax
test dword [ebp - 0x1c], ebx
je 0x102a05e
test dword [ebp - 0x18], 0x100
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
je 0x102a090
xor eax, eax
inc eax
jmp 0x102a0d4
cmp edi, eax
jb 0x102a010
cmp eax, esi
jae 0x102a09f
mov dword [ebp - 8], esi
push 4
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1038f10]
jmp 0x102a0b8
mov dword [ebp - 8], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0x10]
push ecx
inc eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100158a
leave
ret
Function at 0x102d5fd
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
push dword [eax + 0x38]
call fcn.01029c1a
mov dword [ebp + 8], eax
mov eax, dword [esi + 4]
push dword [eax + 0x3c]
call fcn.01029c88
push 2
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
mov esi, dword [ebp + 0xc]
pop ebx
test byte [eax + 0x30], bl
je 0x102d778
mov al, byte [ebp + 8]
xor edx, edx
lea ecx, [esi + 8]
test al, 8
je 0x102d68f
mov edi, ebx
test al, 1
je 0x102d679
test bl, al
je 0x102d663
mov ax, word [edx + 0x1038ef8]
mov word [ecx], ax
add edx, ebx
add ecx, 4
cmp edx, 4
jae 0x102d6da
jmp 0x102d64d
mov ax, word [edx + str.hQB0hQ]
mov word [ecx], ax
add edx, ebx
add ecx, 4
cmp edx, 4
jae 0x102d6da
jmp 0x102d663
mov ax, word [edx + 0x1038ef0]
mov word [ecx], ax
add edx, ebx
add ecx, 4
cmp edx, 4
jae 0x102d6da
jmp 0x102d679
push 3
pop edi
test al, 1
je 0x102d6c6
test bl, al
je 0x102d6b0
mov ax, word [edx + 0x1038ee8]
mov word [ecx], ax
add edx, ebx
add ecx, 4
cmp edx, 6
jae 0x102d6da
jmp 0x102d69a
mov ax, word [edx + 0x1038ee0]
mov word [ecx], ax
add edx, ebx
add ecx, 4
cmp edx, 6
jae 0x102d6da
jmp 0x102d6b0
mov ax, word [edx + 0x1038ed8]
mov word [ecx], ax
add edx, ebx
add ecx, 4
cmp edx, 6
jb 0x102d6c6
mov eax, dword [ebp - 4]
test eax, eax
jne 0x102d6e9
mov ax, word [0x1038eb0]
jmp 0x102d722
test al, 1
je 0x102d6f5
mov ax, word [0x1038eb2]
jmp 0x102d722
test bl, al
je 0x102d701
mov ax, word [0x1038eb4]
jmp 0x102d722
test al, 4
je 0x102d70d
mov ax, word [0x1038eb6]
jmp 0x102d722
test al, 8
je 0x102d719
mov ax, word [0x1038eb8]
jmp 0x102d722
push 0x20
pop eax
mov word [esi + edi*4 + 8], ax
inc edi
mov word [esi + edi*4 + 8], ax
push 0x15
inc edi
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x102d753
lea eax, [esi + edi*4 + 8]
xor ecx, ecx
add edi, 4
mov dx, word [ecx + 0x1038ed0]
mov word [eax], dx
add ecx, ebx
add eax, 4
cmp ecx, 8
jae 0x102d77a
jmp 0x102d73d
test byte [ebp + 8], 0x10
je 0x102d77a
lea eax, [esi + edi*4 + 8]
xor ecx, ecx
add edi, 4
mov dx, word [ecx + 0x1038ec8]
mov word [eax], dx
add ecx, ebx
add eax, 4
cmp ecx, 8
jae 0x102d77a
jmp 0x102d762
xor edi, edi
test edi, edi
jle 0x102d78f
lea eax, [esi + 0xa]
mov ecx, edi
push 7
pop edx
mov word [eax], dx
add eax, 4
dec ecx
jne 0x102d783
xor eax, eax
mov dword [esi], edi
inc eax
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
leave
ret 8
Function at 0x1032005
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.01008a96
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], eax
jbe 0x103206d
mov dword [ebp - 8], eax
mov eax, dword [0x1038080]
mov ecx, dword [ebp - 8]
add eax, ecx
test byte [eax + 0x14], 4
jne 0x1032052
mov al, byte [eax + 0x15]
cmp al, 0x80
je 0x1032077
cmp al, 0x81
je 0x1032077
cmp al, 0x88
je 0x1032077
xor ecx, ecx
cmp al, 0x86
sete cl
mov eax, ecx
test eax, eax
jne 0x1032077
mov eax, dword [0x10383d0]
inc dword [ebp - 0xc]
add dword [ebp - 8], 0x18
mov dword [eax + 4], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0x1032026
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.0101c0e4
push 1
push dword [ebp - 4]
call fcn.01026ccb
mov ecx, dword [0x1038030]
mov esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ebx, [esi + 0xc]
push ebx
add ecx, 0x300000
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x103213f
mov eax, dword [0x1038080]
mov ecx, dword [ebp - 8]
push dword [eax + ecx]
push dword [0x1038268]
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x1032169
xor esi, esi
push edi
xor eax, eax
push ebx
mov word [ebp - 0xe], ax
push 1
lea eax, [ebp - 0x10]
push eax
push dword [0x1038268]
mov word [ebp - 0x10], si
call sub.GDI32.dll_GetStringBitmapW
test eax, eax
je 0x1032169
mov ax, word [edi]
mov word [ebp - 4], ax
mov ax, word [edi + 4]
mov word [ebp - 2], ax
lea eax, [edi + 8]
push eax
push dword [ebp - 4]
push esi
call fcn.0102683d
test eax, eax
jl 0x1032169
inc esi
cmp si, 0x20
jb 0x10320dd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1032052
add esi, 0xc
push esi
mov esi, dword [sym.imp.ntdll.dll_DbgPrintEx]
push 0x1011c70
push 1
push 0x70
call esi
push 0x1009c78
push 1
push 0x70
call esi
add esp, 0x1c
xor eax, eax
jmp 0x1032070
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1032162
Function at 0x103267c
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x18]
mov edx, dword [ebp + 0xc]
mov ecx, dword [0x1038030]
mov eax, dword [eax + 0x30]
push esi
movsx esi, word [ebp + 0xc]
shr edx, 0x10
movsx edx, dx
imul edx, esi
push edi
shl edx, 3
push edx
add ecx, 0x300000
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x10326cc
mov eax, 0xc0000017
jmp 0x10327e7
mov eax, dword [0x1038258]
push ebx
push 4
pop ebx
test byte [eax], bl
je 0x1032701
test byte [0x10382f8], 1
jne 0x1032701
cmp byte [section..data], 0
mov eax, dword [0x1038044]
je 0x1032706
cmp dword [0x1038334], eax
je 0x1032706
mov dword [ebp - 8], 0x4e4
jmp 0x1032709
mov eax, dword [0x1038334]
mov dword [ebp - 8], eax
movsx eax, word [ebp + 0xe]
movsx ecx, word [ebp + 0xc]
mov esi, dword [ebp + 8]
imul eax, ecx
shl eax, 2
push eax
push esi
push edi
call dword [sym.imp.msvcrt.dll_memmove]
and dword [ebp - 0xc], 0
xor eax, eax
add esp, 0xc
cmp ax, word [ebp + 0xe]
jge 0x10327cd
movsx eax, word [ebp + 0xc]
and dword [ebp + 8], 0
test eax, eax
jle 0x10327bd
movzx ecx, word [edi + 2]
test ecx, 0x100
je 0x103278f
dec eax
cmp dword [ebp + 8], eax
jge 0x103277e
inc dword [ebp + 8]
push 2
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebp - 8]
call fcn.0101c39e
mov ax, word [ebp - 4]
mov byte [esi], al
mov cx, word [edi + 2]
mov word [esi + 2], cx
add esi, ebx
add edi, ebx
mov byte [esi], ah
jmp 0x10327a5
mov byte [esi], 0x20
mov ax, word [edi + 2]
mov ecx, 0xfcff
and ax, cx
jmp 0x10327a9
test ecx, 0x300
jne 0x10327b1
push 1
push esi
push 1
push edi
push dword [ebp - 8]
call fcn.0101c39e
mov ax, word [edi + 2]
mov word [esi + 2], ax
add esi, ebx
add edi, ebx
movsx eax, word [ebp + 0xc]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x1032742
movsx eax, word [ebp + 0xe]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jl 0x1032736
push dword [ebp - 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x1036b09
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x15
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp + 8]
test al, 1
je 0x1036b20
or edx, 3
xor eax, eax
test dl, 1
je 0x1036b36
mov eax, 0x20000
test dl, 2
jne 0x1036b36
mov eax, 0x40000
test dl, 8
je 0x1036b40
or eax, 0x10000
test dl, 0x10
je 0x1036b4a
or eax, 0x400000
mov ecx, 0x20000000
test ecx, edx
je 0x1036b58
or eax, 0x800000
test edx, 0x40000000
je 0x1036b62
or eax, ecx
pop ebp
ret 4
Function at 0x4040c9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x40411b
mov dword [ebp - 0xc], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x404113
push 0x4f
push 0x402ea9e
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x404154
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x404151
push 0x7d
push 0x402ea9e
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404168
mov eax, 0
jmp 0x4041d0
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x404199
push 0x10b
push 0x402ea9e
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4041c8
push 0x12f
push 0x402ea9e
push 6
call fcn.00442f61
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x4041d0
mov esp, ebp
pop ebp
ret 8
Function at 0x4052c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40530f
push 0x19
push 0x402f66d
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4053a6
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x45b498]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.004011c1
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.00444790
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x405367
push ebx
call fcn.00442f55
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00404641
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4053a6
push 0xda
push 0x402f66d
push 6
call fcn.00442f61
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x4053c0
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00442f5b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4053c5
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4053d6
push ebx
call fcn.00442f55
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40c8c4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push VariantClear
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40c905
mov eax, 0x45b586
push eax
push 1
mov ebx, 0x130
call fcn.004455b0
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 8], 2
fild dword [ebp - 4]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x45b438]
fstp qword [ebp - 0x24]
mov dword [ebp - 0x28], esp
fld qword [ebp - 0x24]
call fcn.004011c1
push eax
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop
nop
cmp dword [ebp - 0x28], esp
je 0x40c969
push 0x89
push 0x402efc6
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40c998
push 0xc7
push 0x402efc6
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40c9cf
push 0xe2
push 0x402efc6
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40c9fb
push 0x10a
push 0x402efc6
push 6
call fcn.00442f61
add esp, 0xc
call fcn.0040cab8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40ca2f
push 0x151
push 0x402efc6
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [sym.imp.USER32.dll_EmptyClipboard]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40ca58
push 0x16b
push 0x402efc6
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push 1
xor eax, eax
call dword [sym.imp.USER32.dll_SetClipboardData]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40ca89
push 0x17e
push 0x402efc6
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40cab2
push 0x1ac
push 0x402efc6
push 6
call fcn.00442f61
add esp, 0xc
mov esp, ebp
pop ebp
ret 4

Function at 0x40caf3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0x45b586
push 0x45b586
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 4], esp
je 0x40cb43
push 0
push 0x402ea94
push 6
call fcn.00442f61
add esp, 0xc
mov esp, ebp
pop ebp
ret 4
Function at 0x41a77f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push reloc.OLEAUT32.dll_SysStringLen
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.004451f0
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
call fcn.0040e739
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41a7f3
push 0x60
push 0x402eaef
push 6
call fcn.00442f61
add esp, 0xc
jmp 0x41a7f8
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41ea02
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 4], esp
je 0x41ea39
push 0x39
push 0x40140a3
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
push 0x424699
push 0xe
xor eax, eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41ea77
push 0x39
push 0x40140a3
push 6
call fcn.00442f61
add esp, 0xc
mov dword [0x47dc7f], eax
mov dword [ebp - 4], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 4], esp
je 0x41eaaa
push 0x99
push 0x40140a3
push 6
call fcn.00442f61
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
push 0x42c241
push 0xd
xor eax, eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41eae8
push 0x99
push 0x40140a3
push 6
call fcn.00442f61
add esp, 0xc
mov dword [0x47dc83], eax
mov esp, ebp
pop ebp
ret
Function at 0x448910
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x448979
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00444500
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x448980
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x4489c1.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x4489c1.2
jmp dword [eax*4 + 0x448a4c]
mov word [esp + 0x48], di
jmp 0x4489fa
mov word [esp + 0x48], 2
jmp 0x4489fa
mov word [esp + 0x48], 3
jmp 0x4489fa
mov word [esp + 0x48], 4
jmp 0x4489fa
mov word [esp + 0x48], 7
jmp 0x4489fa
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x448a44
cmp dword [esp + 0x70], edi
je 0x448a30
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x448c00
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x448c1e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x448c13
pop esi
ret

Function at 0x448c30
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x448d00
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x448d6a
push esi
lea edi, [eax + 0x400]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x448d3a
push esi
xor edi, edi
call dword [0x47e8ec]
add esp, 4
test eax, eax
je 0x448d86
push eax
push esi
call fcn.0044aa20
add esp, 8
mov edi, eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x44a430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x44a451
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x44a4ab
inc edi
cmp edi, esi
jl 0x44a445
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x44a4e0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x44a49a
cmp byte [eax], bl
je 0x44a4b5
cmp byte [eax + 1], bl
je 0x44a4be
cmp byte [eax + 2], bl
je 0x44a4c8
cmp byte [eax + 3], bl
je 0x44a4d4
add eax, 4
cmp eax, edi
jb 0x44a471
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x44c8d0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x455590]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x455590]
xor eax, edx
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x44c980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [ebx + 0x2d]
push edi
test al, al
je 0x44ca09
mov eax, dword [ebx + 0x3c]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x44c9b1
cmp dword [ebx + 0x40], edi
jae 0x44c9b1
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebx + 0x3c], 0
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x44c9ca
lea eax, [edi + edi]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], edi
mov ecx, edi
mov edi, dword [ebx + 0x3c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
jbe 0x44ca04
mov eax, dword [ebx + 0x3c]
mov cl, byte [esi + eax]
lea eax, [ebx + 0x30]
push ecx
push eax
call fcn.0044c930
mov edx, dword [ebx + 0x3c]
add esp, 8
mov byte [esi + edx], al
inc esi
cmp esi, edi
jb 0x44c9e6
mov esi, dword [ebx + 0x3c]
jmp 0x44ca0c
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx + 0x20]
test edx, edx
je 0x44ca53
mov eax, dword [ebx + 0x24]
lea ecx, [eax + edi]
cmp ecx, dword [ebx + 0x28]
jb 0x44ca2e
pop edi
mov dword [ebx + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
mov ecx, edi
lea edi, [eax + edx]
mov edx, ecx
mov eax, dword [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x24]
pop edi
add ecx, eax
pop esi
mov dword [ebx + 0x24], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebx + 4]
test eax, eax
je 0x44ca73
lea ecx, [ebp + 0xc]
push 0
push ecx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [ebx + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8