joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411ff0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63239b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x6ce8d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
lea eax, [ebp - 0x90]
push 0xffffffffffffffff
push dword [0x6d4098]
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0x94]
xor eax, eax
mov word [ebp - 0x90], ax
call fcn.0040d840
mov dword [ebp - 4], 0
test esi, esi
je 0x412061
push esi
lea ecx, [ebp - 0x94]
call fcn.0040d710
push 0
push 0x80
push 3
push 0
push 1
push bind
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4120d7
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x4120d7
push eax
mov dword [ebp - 0x98], 0
call fcn.005bd22a
add esp, 4
mov esi, eax
lea eax, [ebp - 0x98]
push 0
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebx]
je 0x4120d9
push esi
call fcn.005bd233
add esp, 4
xor esi, esi
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
cmp eax, ecx
je 0x4120f2
push eax
call fcn.005e0980
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret

Function at 0x412260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x6dc408]
test eax, eax
push edi
cmove eax, dword [0x6dc40c]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x412284
pop edi
pop ebp
ret
mov eax, dword [0x6dc408]
test eax, eax
push ebx
cmove eax, dword [0x6dc40c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push edi
test ebx, ebx
jne 0x4122ae
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
xor eax, eax
pop edi
pop ebp
ret
mov eax, dword [0x6dc408]
test eax, eax
cmove eax, dword [0x6dc40c]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x4122a8
push esi
push eax
call fcn.005bd22a
add esp, 4
mov esi, eax
mov eax, dword [ebp + 8]
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call fcn.005d78a0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x412300
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push bind
push ecx
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x412330
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x412328
push esi
push eax
mov dword [ebp - 4], 0
call fcn.005bd22a
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp eax, dword [ebx]
je 0x41237b
push esi
call fcn.005bd233
add esp, 4
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413990
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov edx, ecx
mov byte [edx + 0x195], al
test al, al
jne 0x4139be
mov ecx, dword [edx + 0x40]
test ecx, ecx
je 0x4139be
cmp dword [ecx + 0x148], edx
jne 0x4139be
mov dword [ebp + 8], 0
pop ebp
jmp fcn.0040b960
pop ebp
ret 4
Function at 0x41c850
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x109c], 0
je 0x41c8bc
cmp dword [ebp + 8], 0x100
jne 0x41c8ac
cmp word [ebp + 0xc], 0xd
jne 0x41c8ac
cmp byte [esi + 0x10a2], 0
je 0x41c88e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x41c8ac
cmp byte [esi + 0x10a3], 0
jne 0x41c8ac
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x41c8a5
push ecx
push 0
push 0
push str.return
push esi
call fcn.0040c3b0
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x109c]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x4295b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 8]
mov ebx, ecx
and ebx, 7
je 0x4295fb
cmp ecx, ebx
jge 0x4295f3
mov edx, dword [esi]
mov edi, dword [esi + 0xc]
nop dword [eax]
cmp edx, dword [esi + 4]
jb 0x4295d9
xor al, al
jmp 0x4295de
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
shl eax, cl
add ecx, 8
or edi, eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
cmp ecx, 0x18
jle 0x4295d0
mov ecx, ebx
shr dword [esi + 0xc], cl
sub dword [esi + 8], ebx
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x42962d
mov edi, dword [esi + 0xc]
nop word [eax + eax]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx - 4], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x429610
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x429649
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x42963a
xor dl, dl
jmp 0x42963f
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x429632
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx ebx, ah
movzx eax, al
shl ebx, 8
add ebx, eax
shl ecx, 8
movzx eax, byte [ebp - 2]
add ecx, eax
mov eax, ebx
xor eax, 0xffff
cmp ecx, eax
je 0x429678
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
add eax, ebx
cmp eax, dword [esi + 4]
ja 0x42966f
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x18]
lea eax, [ecx + ebx]
cmp eax, edi
jbe 0x4296c9
cmp dword [esi + 0x1c], 0
je 0x42966f
mov edx, dword [esi + 0x14]
sub ecx, edx
sub edi, edx
mov dword [ebp - 4], ecx
lea eax, [ecx + ebx]
cmp eax, edi
jle 0x4296ab
add edi, edi
cmp eax, edi
jg 0x4296a5
push edi
push edx
call fcn.005e63b8
add esp, 8
test eax, eax
je 0x42966f
mov ecx, dword [ebp - 4]
add ecx, eax
mov dword [esi + 0x14], eax
add eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], eax
push ebx
push dword [esi]
push dword [esi + 0x10]
call fcn.005d78a0
add dword [esi], ebx
add esp, 0xc
add dword [esi + 0x10], ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x431bfb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x431cb7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6b35e8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6b35e8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6b35e8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6b35e8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6b35e8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6b35e8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6b35e8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6b35e8]
sub edi, 1
jne 0x431c10
pop edi
test esi, esi
je 0x431cda
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6b35e8]
sub esi, 1
jne 0x431cc0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x4324a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x4324e3
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4324d5
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x4324f4
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.005d78a0
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x43255b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x432556
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x432588
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x43256c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.005d78a0
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x43259c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x432593
cmp byte [esi + 8], 0
je 0x432593
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4326f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x432724
cmp byte [edi + 1], 0
je 0x43271d
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x43272a
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
mov dword [edi + 0x18], eax
cmp byte [edi], 0
push ebx
je 0x43274d
cmp byte [edi + 1], 0
je 0x432746
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x432750
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x43275f
mov eax, dword [edi + 0x18]
mov ebx, 0xffff
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jae 0x432764
mov ebx, eax
mov dword [ebp - 0xc], eax
push esi
push 0x404
call fcn.005e63ad
mov esi, eax
add esp, 4
test esi, esi
jne 0x43277f
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x10], 0
cmp ebx, eax
jbe 0x43287a
mov edx, dword [ebp - 4]
add eax, 0x400
cmp eax, ebx
mov ecx, eax
mov eax, 0x404
cmova ecx, ebx
sub edx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x404
mov dword [ebp - 0x18], edx
mov ebx, ecx
cmova ebx, eax
cmp byte [edi], 0
je 0x4327de
cmp byte [edi + 1], 0
je 0x43287a
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4327e1
mov dword [edi + 0x18], edx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 8], ebx
je 0x432809
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x432804
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x432832
mov edx, dword [edi + 0x18]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x14]
jbe 0x43281c
mov ecx, dword [edi + 0x14]
sub ecx, edx
mov dword [ebp - 8], ecx
push ecx
mov ecx, dword [edi + 0x10]
add ecx, edx
push ecx
push esi
call fcn.005d78a0
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [edi + 0x18], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x43287a
lea eax, [ebx - 3]
test eax, eax
jle 0x43286c
dec eax
cmp byte [eax + esi], 0x50
jne 0x43285e
cmp byte [eax + esi + 1], 0x4b
jne 0x43285e
cmp byte [eax + esi + 2], 5
jne 0x43285e
cmp byte [eax + esi + 3], 6
je 0x432864
test eax, eax
jg 0x432842
jmp 0x43286c
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
jne 0x43287a
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
jb 0x432793
push esi
call fcn.005e0980
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x433840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x4338d8
cmp dword [esi + 4], 0xffffffff
jne 0x4338d8
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x433870
cmp dword [ebp + 0x10], 1
mov eax, dword [0x6b6884]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x4338a3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4338a3
mov eax, 0x2000000
pop edi
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov ecx, edi
call fcn.00432350
add esp, 8
test eax, eax
jne 0x4338c4
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, eax
call fcn.00432890
mov dword [esi], eax
mov eax, dword [0x6dc45c]
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x43bee0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6ce8d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x43bf4d
cmp dword [esi + 0x10], 0
je 0x43bf4d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.005be1b0
mov ebx, esp
test ebx, ebx
je 0x43bf4d
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1b8
call fcn.0040d920
mov ecx, dword [esi + 0x10]
push ecx
push 0
push 0
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0040c3b0
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44b730
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x6ce8d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esi + 0x10], eax
mov dword [eax + 0x14dc], 0
cmp dword [esi + 4], 0
jne 0x44b7d5
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x9c], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x98], ecx
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x94], eax
mov eax, dword [ecx]
call dword [eax + 0x1c]
movups xmm0, xmmword [ebp - 0xa0]
sub esp, 0x10
mov ecx, esp
push ecx
push 0
push 0x40000000
push ecx
push dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esi
call fcn.0040e650
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push dword [ecx + 0x106c]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0040cbd0
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x90]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
lea ecx, [ebp - 0x8c]
mov eax, dword [eax]
movzx ebx, word [eax]
mov eax, dword [ebp - 0x90]
cmp eax, ecx
je 0x44b802
push eax
call fcn.005e0980
add esp, 4
test bx, bx
jne 0x44b816
mov eax, dword [esi + 0x10]
add eax, 0x14cc
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esi + 0x10]
add eax, 0x14cc
push eax
push 0
push 0x1002
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
mov byte [esi + 0x18], 1
xor ecx, ebp
pop esi
pop ebx
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret 4
Function at 0x44b8b0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x6ce8d4]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp eax, 0x4e
jne 0x44b903
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push esi
push eax
push dword [edi + 4]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 8
jne 0x44b9fc
push 0
push str.SysMonthCal32
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44b98f
xorps xmm0, xmm0
lea eax, [esp + 0x14]
push eax
movaps xmmword [esp + 0x14], xmm0
movaps xmmword [esp + 0x24], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x20
push eax
push 0
push 0x100e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x1c]
cmp eax, 0x1010003
je 0x44b977
cmp eax, 0x2010003
jne 0x44b9e7
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x10]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x10]
jl 0x44b9c4
cmp eax, dword [esp + 0x18]
jg 0x44b9c4
cmp eax, dword [esp + 0x14]
jl 0x44b9c4
cmp eax, dword [esp + 0x1c]
jle 0x44b9e7
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push 8
call fcn.0044ba90
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0x101
jne 0x44b8df
cmp esi, 0x2e
je 0x44ba39
cmp esi, 8
je 0x44ba39
cmp esi, 0x1b
jne 0x44b8df
push dword [ebp + 0x10]
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x10]
mov esi, eax
mov dword [ecx + 0x14dc], 3
jmp 0x44ba62
push dword [ebp + 0x10]
push esi
push 0x101
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x10]
mov esi, eax
mov dword [ecx + 0x14dc], 2
mov ecx, dword [edi + 0x10]
call fcn.0044bba0
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x450560
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.005d7e20
add esp, 0xc
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [ebp - 0x10], xmm0
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret
Function at 0x451920
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x6ce8d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x25c], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4519f5
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x258]
push eax
push 0x647aa0
push 1
push esi
push 0x647ad0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4519f5
mov ecx, dword [ebp - 0x258]
test ecx, ecx
je 0x4519b0
mov eax, dword [ecx]
lea edx, [ebp - 0x25c]
push edx
push 0x647ac0
push ecx
call dword [eax]
test eax, eax
js 0x4519f5
mov ecx, dword [ebp - 0x258]
mov edx, dword [ebp - 0x25c]
test edx, edx
je 0x4519cd
mov eax, dword [edx]
push 2
push edi
push edx
call dword [eax + 0x14]
test eax, eax
js 0x4519f5
mov ecx, dword [ebp - 0x258]
test ecx, ecx
je 0x4519eb
mov eax, dword [ecx]
lea edx, [ebp - 0x254]
push 4
push edx
push 0x104
push dword [ebp - 0x260]
push ecx
call dword [eax + 0xc]
test eax, eax
mov ecx, 1
cmovns esi, ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x25c]
test ecx, ecx
je 0x451a0d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0x258]
test edx, edx
je 0x451a1d
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret 8
Function at 0x451a40
Capabilities:
Check if file exists
Create shortcut via ishelllink
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x451ad6
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 8]
push eax
push 0x647aa0
push 1
push edi
push 0x647ad0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x451ad6
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push 0x647ac0
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x451ad6
mov eax, dword [ebp - 4]
push 2
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
js 0x451ad6
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x451ac1
push dword [ebp + 0xc]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x50]
test eax, eax
js 0x451ad6
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x451ad1
mov eax, dword [ecx]
push 1
push esi
push ecx
call dword [eax + 0x18]
mov edi, 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x451aeb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 8]
test edx, edx
je 0x451af8
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x458fe0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], 0x44
push 0
push eax
call fcn.005d7e20
add esp, 0xc
lea eax, [ebp - 0x44]
push dword [ebp + 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45a170
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x6ce8d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x63d280
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0
push eax
call fcn.005e4653
mov eax, dword [ebp - 0x408]
add esp, 0xc
test eax, eax
je 0x45a242
push eax
push 0x400
lea eax, [ebp - 0x404]
mov dword [esi + 4], 0
push 1
push eax
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
call fcn.005e497e
add esp, 0x10
test eax, eax
je 0x45a22e
nop dword [eax + eax]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call fcn.0045a0b0
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.005e497e
add esp, 0x1c
test eax, eax
jne 0x45a200
push esi
call fcn.00459fa0
push dword [ebp - 0x408]
call fcn.005e4732
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005bd4a0
mov esp, ebp
pop ebp
ret