joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042e60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x10042e8c
jl 0x10042e80
test esi, esi
jne 0x10042e8c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10042ea5
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov dword [ebp - 4], esi
mov edx, dword [eax]
test edx, edx
je 0x10042ee5
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10042ee5
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 8], esi
add esp, 0xc
mov dword [ebp - 4], edi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
je 0x10042f9c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10042f10
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [ebp - 8]
cmp eax, 0xfff
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [ebp - 4], edx
jbe 0x10042f5f
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 4], edi
add esp, 0x10
mov dword [ebp - 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10042f89
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10042f30
cmp dword [ebp - 4], 0
jbe 0x10042f9f
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
mov eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10043310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1006e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10043340
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10043370
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10043370
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10043445
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10043399
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100433a5
movsx eax, bl
jmp 0x100433dc
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10043445
cmp eax, 1
jle 0x10043406
cmp eax, 3
jne 0x10043445
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10043424
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10043445
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10043445
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret 4
Function at 0x10047580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1004763c
cmp byte [esi + 0x3d], 0
je 0x1004763c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1004762a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100475f1
sub eax, 1
je 0x100475f5
sub eax, 2
jne 0x1004762a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10047613
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1004762a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret
Function at 0x1004bf80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055a5d
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1006e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.1004be20
cmp byte [ebp - 0x84], 0
jne 0x1004c0d1
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x1004c015
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x1006e6e0
call fcn.1004be20
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.1004be20
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x1004c084
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.1004bed0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x1004c113
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1004c109
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1004c109
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1004ca36
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004c1e9
mov esp, ebp
pop ebp
ret
Function at 0x1004ec10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1004ed1c
test eax, eax
je 0x1004ed1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10069fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x1004ed03
lea edi, [eax + 4]
jmp 0x1004ec67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1004ec7c
mov dword [ebp - 4], 2
jmp 0x1004ec9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x1004ec93
mov dword [ebp - 4], 1
jmp 0x1004ec9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x1004ed13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x1004ecd6
mov byte [ecx], 0x3d
jmp 0x1004ece2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x1004eced
mov byte [ecx], 0x3d
jmp 0x1004ecf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x1004ec64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401bce
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push dword [esp + 8]
pop dword [0x407fa4]
xor eax, eax
push eax
push eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
je 0x401d0e
push dword [0x407fa4]
push 0xffff
push dword [esp + 8]
call fcn.00403810
lea ecx, [esp + 8]
pop edx
call fcn.00403000
push dword [0x407fa4]
push 1
push dword [esp + 0xc]
call fcn.00403420
inc dword [0x407fa4]
mov edx, 0x40705e
pop ecx
mov dword [0x407fa4], ecx
add ecx, dword [0x407150]
call 0x40a120
je 0x401cba
push dword [esp + 4]
call fcn.004034e0
mov ebx, eax
add ebx, 0xfffffffe
mov dword [esp], ebx
mov ebx, dword [esp]
cmp ebx, 0xffffffff
jne 0x401c80
push dword [0x407fa4]
mov ebx, dword [esp + 4]
inc ebx
push ebx
push 2
push dword [esp + 0x10]
call fcn.00403500
lea ecx, [esp + 8]
pop edx
call fcn.00403000
jmp 0x401ca2
push dword [0x407fa4]
push dword [esp + 4]
push 2
push dword [esp + 0x10]
call fcn.00403500
lea ecx, [esp + 8]
pop edx
call fcn.00403000
push 1
push 0x40705e
push dword [esp + 0xc]
call fcn.004035b0
mov dword [esp], eax
jmp 0x401cd0
push 1
push 0x407060
push dword [esp + 0xc]
call fcn.004035b0
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
je 0x401cf6
push dword [0x407fa4]
mov ebx, dword [esp + 4]
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00403420
lea ecx, [esp + 8]
pop edx
call fcn.00403000
mov edx, dword [esp + 4]
push dword [0x407fa4]
call fcn.00403140
pop eax
add eax, dword [0x407150]
jmp 0x401d1c
mov eax, dword [0x407fa4]
add eax, dword [0x407150]
mov byte [eax], 0
push dword [esp + 4]
call fcn.004031a0
add esp, 8
pop ebx
ret

Function at 0x4020a2
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0xc]
push eax
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegDeleteValueA
push dword [0x407fa4]
push 0x200
call fcn.004033d0
lea ecx, [esp + 0x10]
pop edx
call fcn.00403000
mov dword [esp + 4], 0x200
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x18]
push dword [esp + 0x34]
call sub.ADVAPI32.dll_RegEnumValueA
mov dword [esp + 8], eax
push dword [esp + 8]
mov ebx, 0x103
cmp ebx, dword [esp]
jne 0x402147
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegDeleteValueA
mov edx, 0x407010
lea ecx, [esp + 0x10]
call fcn.00403054
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegDeleteValueA
add esp, 4
jmp 0x40216d
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x402162
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegDeleteValueA
inc dword [esp + 4]
jmp 0x402167
add esp, 4
jmp 0x40216d
pop eax
jmp 0x4020b7
xor eax, eax
push dword [esp + 0xc]
call fcn.004031a0
add esp, 0x10
pop ebx
ret 4
Function at 0x40217f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov edx, dword [esp + 0x20]
lea ecx, [esp]
call fcn.0040305c
push dword [esp]
mov edx, 0x407010
pop ecx
call 0x40a120
jne 0x4022a4
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push dword [esp + 0xc]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegOpenKeyExA
mov ebx, eax
and ebx, ebx
jne 0x4022a4
push dword [0x407fa4]
push 0x200
call fcn.004033d0
lea ecx, [esp + 0x14]
pop edx
call fcn.00403000
mov dword [esp + 0xc], 0x200
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegEnumKeyExA
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x402273
mov edx, dword [esp + 4]
xor ecx, ecx
call 0x40a120
jne 0x40225b
mov edx, dword [esp + 4]
push dword [0x407fa4]
call fcn.00403140
mov edx, 0x40705c
call fcn.00403140
mov edx, dword [esp + 0x18]
call fcn.00403140
lea ecx, [esp + 0x18]
pop edx
call fcn.00403000
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call fcn.0040217f
inc dword [esp + 0xc]
jmp 0x402278
add esp, 4
jmp 0x40227e
pop eax
jmp 0x4021cd
mov ebx, dword [esp + 0x24]
and ebx, ebx
jne 0x40229e
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegDeleteKeyA
jmp 0x4022a4
mov eax, dword [esp + 4]
jmp 0x4022a6
xor eax, eax
push dword [esp]
call fcn.004031a0
push dword [esp + 0x10]
call fcn.004031a0
add esp, 0x14
pop ebx
ret 0xc

Function at 0x4026c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push dword [esp + 0x10]
pop dword [0x407fa4]
sub esp, 0x1c
mov eax, esp
mov edx, eax
add edx, 0x1c
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x4026d9
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.0040305c
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.0040305c
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push dword [esp + 0xc]
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
mov ebx, eax
and ebx, ebx
jne 0x402798
mov dword [esp + 0xc], 0x400
push dword [0x407fa4]
push dword [esp + 0x10]
call fcn.004033d0
lea ecx, [esp + 0x1c]
pop edx
call fcn.00403000
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x18]
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ebx, eax
and ebx, ebx
jne 0x40278f
mov ebx, dword [esp + 0xc]
and ebx, ebx
jle 0x40278f
push dword [0x407fa4]
mov ebx, dword [esp + 0x10]
dec ebx
push ebx
push dword [esp + 0x20]
call fcn.00403420
pop eax
add eax, dword [0x407150]
jmp 0x4027a6
push dword [esp + 8]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [0x407fa4]
add eax, dword [0x407150]
mov byte [eax], 0
push dword [esp + 4]
call fcn.004031a0
push dword [esp]
call fcn.004031a0
push dword [esp + 0x18]
call fcn.004031a0
add esp, 0x1c
pop ebx
ret 8
Function at 0x40531d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 9
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
je 0x40539a
push 0x11
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x40539a
push 0x10
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x40539a
push 0x12
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x40539a
call sub.USER32.dll_GetFocus
push 5
lea edi, [ebp - 0xd]
push edi
push eax
call sub.USER32.dll_GetClassNameA
push 4
push str.Rich
lea eax, [ebp - 0xd]
push eax
call sub.CRTDLL.dll_strncmp
add esp, 0xc
or eax, eax
jne 0x40539a
jmp 0x4053c5
push 0x407220
push dword [ebp + 8]
call sub.USER32.dll_GetPropA
mov dword [ebp - 4], eax
or eax, eax
je 0x4053c3
dec eax
push eax
push dword [0x407fd8]
call fcn.00405e63
mov dword [ebp - 8], eax
mov eax, dword [eax + 0xc]
jmp 0x4053c5
xor eax, eax
pop edi
leave
ret 4

Function at 0x405870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 0
jne 0x40589f
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
push eax
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 4

Function at 0x405ab0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov eax, dword [0x407270]
mov edx, dword [0x407274]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
push dword [ebp + 8]
push dword [0x407fe8]
call fcn.00405e63
mov dword [ebp - 0xc], eax
or eax, eax
je 0x405b2a
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push dword [eax]
call sub.KERNEL32.DLL_GetFileSize
push 0
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
pop eax
pop edx
pop ecx
or eax, ecx
pop ecx
or edx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
je 0x405b2a
cmp dword [ecx + 0x14], 0
jne 0x405b2a
mov edi, ecx
mov esi, dword [edi + 8]
sub esi, dword [edi + 0xc]
add eax, esi
adc edx, 0
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 4
Function at 0x405cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
cmp dword [edi + 0x14], 0
jne 0x405d15
push edi
call fcn.00405870
mov dword [edi + 0x14], 1
and dword [edi + 0xc], 0
cmp dword [edi + 0xc], esi
jl 0x405d6a
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ebx, eax
add ebx, dword [edi + 4]
mov eax, esi
cmp eax, 1
je 0x405d38
cmp eax, 2
je 0x405d41
cmp eax, 4
je 0x405d4c
jmp 0x405d55
mov eax, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [eax], dl
jmp 0x405d62
mov eax, dword [ebp + 0xc]
mov dx, word [ebx]
mov word [eax], dx
jmp 0x405d62
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx]
mov dword [eax], edx
jmp 0x405d62
push esi
push ebx
push dword [ebp + 0xc]
call sub.CRTDLL.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
jmp 0x405de9
mov ebx, dword [edi + 0xc]
push ebx
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
push eax
push dword [ebp + 0xc]
call sub.CRTDLL.dll_memcpy
add esp, 0xc
mov eax, ebx
add eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
sub esi, ebx
cmp esi, dword [edi + 8]
jl 0x405da9
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [edi]
call sub.KERNEL32.DLL_ReadFile
and dword [edi + 0xc], 0
jmp 0x405de9
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [ebp - 4]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x10], eax
cmp esi, dword [edi + 0xc]
jle 0x405dd0
mov esi, dword [edi + 0xc]
push esi
push dword [edi + 4]
push dword [ebp + 0xc]
call sub.CRTDLL.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov eax, ebx
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x6fd819c1
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x1a3f248b
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219