joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40633e
Capabilities:
Hash data with crc32

Disassembly:
cmp esi, dword [ecx + ecx - 0x40]
je 0x406350
push dword [ebp - 0x66]
adc eax, 0x4e8380b4
or byte [eax + 0x53], al
cmp al, 0xb8
inc eax
add byte [edi + edx*2], cl
mov eax, 0x570c0040
cmp byte [esi], 0x5c
jne 0x40636f
cmp byte [esi + 1], 0x5c
jne 0x40636f
cmp byte [esi + 2], 0x3f
jne 0x40636f
cmp byte [esi + 3], 0x5c
jne 0x40636f
add esi, 4
cmp byte [esi], 0
je 0x406380
push esi
call 0x50415ae9
push 0xffffffffffffffc0
je 0x406380
inc esi
inc esi
mov al, byte [esi]
mov ebx, esi
test al, al
mov edi, esi
je 0x4063c3
push ebp
mov ebp, dword [0x80400675]
cmp al, 0x1f
jbe 0x4063b7
push eax
push 0x1815a3e8
call 0xfd7e5aa7
add byte [eax], bh
push eax
jne 0x4063b7
push esi
call ebp
sub eax, esi
push eax
push esi
push edi
call 0x80f55c38
inc eax
call ebp
mov edi, eax
push esi
call ebp
je 0x4063cd
call 0x7600e82d
iretd
and byte [edi], 0x8d

Function at 0x4063fe
Capabilities:
Hash data with crc32

Disassembly:
daa
lea edx, [edi + 0x53]
push edi
push ebx
push ss
push 0xffffffffffffffe8
jne 0x4063f8
push 0xffffffffffffff8b
clc
mov al, byte [edi]
cmp al, 0x20
je 0x4063da
cmp al, 0x5c
jne 0x4063e1
and byte [edi], 0xff
cmp ebx, edi
jb 0x4063c6
mov esi, edx
imul esi, esi, 0xbe560418
and byte [0xc2560042], 4
add byte [eax*2 + 0x1fc], cl
add cl, ch
das
add dl, byte [edx + eax*2]
jmp 0x4294662c
dec ebp
jne 0x4063c4
je 0x406415
lea ecx, [ebx + 0x3302ebc6]
rcr byte [esi], 0x53
push esi
mov esi, dword [ebp + 8]
push edi
push 0
cmp dword [esp + 0x56], ebx
pop esp
and al, 0x56
mov esi, 0x400104
lea eax, [ebp + 0x5607e0e0]
push esi
push eax
inc ebp
adc eax, 0x50ffffe4
cmp eax, esi
pop esi
jbe 0x406432
xor eax, eax
call 0x804e84b9
mov esp, 0x7e0df05
push esi
pop esp
and al, 4
or cl, cl
jmp 0x406447
je 0x406455
dec dword [ebp + 0x70fff889]
or byte [ebp - 0x1f1ffa7c], cl
pop es
push esi
push ecx
push 0xe856a3f4
jo 0x406483
add byte [eax], al
jmp 0x406486
push edi
shl esi, 3
mov edi, dword [esi + 0x40a258]
push 0x1554bc00
and al, 0x81
add ecx, dword [ebx + 0x40a258be]
add byte [eax], ch
mov esp, 0x81241554
inc eax
add bl, ch
or dl, byte [edi - 0x18]
jo 0x40649c
add byte [eax + 0x6a], dl
sal byte [edi + ecx - 1], 0xb6
pop esp
invalid
invalid
inc esp

Function at 0x40646c
Capabilities:
Hash data with crc32

Disassembly:
push esi
mov eax, eax
sysenter
add byte [eax], al
mov byte [eax + eax], al
mov eax, dword [edx]
shl eax, 0xa
sub ecx, eax
push ecx
push esi
mov esi, eax
Function at 0x402e9f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x4200c8]
test eax, eax
jne 0x402ed7
push 0x4179a8
push 0x6f
push eax
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x402ed0
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x402ed0
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
jmp 0x402ed2
xor eax, eax
mov dword [0x4200c8], eax
test eax, eax
push esi
mov esi, eax
je 0x402f1f
push ebx
mov bl, byte [eax]
jmp 0x402f02
push 2
lea eax, [esi + 1]
push eax
push dword [esp + 0x14]
call sub.msvcrt.dll__memicmp
add esp, 0xc
test eax, eax
movzx eax, bl
je 0x402f09
lea esi, [esi + eax + 3]
mov bl, byte [esi]
sub bl, 0x41
jne 0x402ee3
jmp 0x402f1e
push eax
add esi, 3
push esi
push edi
call sub.msvcrt.dll_memcpy
movzx eax, bl
add esp, 0xc
mov byte [eax + edi], 0
pop ebx
cmp byte [edi], 0
pop esi
jne 0x402f31
push dword [esp + 4]
push edi
call sub.msvcrt.dll_strcpy
pop ecx
pop ecx
xor eax, eax
inc eax
ret 4

Function at 0x402f37
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4200cc]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov dword [ebp - 4], ebx
jne 0x402f79
push 0x4179a8
push 0x70
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
cmp eax, ebx
je 0x402f72
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, ebx
je 0x402f72
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
jmp 0x402f74
xor eax, eax
mov dword [0x4200cc], eax
cmp eax, ebx
mov esi, eax
je 0x402fc4
mov bl, byte [eax]
jmp 0x402fa1
push 2
lea eax, [esi + 1]
push eax
push dword [ebp + 8]
call sub.msvcrt.dll__memicmp
add esp, 0xc
test eax, eax
movzx eax, bl
je 0x402fa8
lea esi, [esi + eax + 3]
mov bl, byte [esi]
sub bl, 0x41
jne 0x402f83
jmp 0x402fc4
push eax
add esi, 3
push esi
push edi
call sub.msvcrt.dll_memcpy
movzx eax, bl
add esp, 0xc
mov byte [eax + edi], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4

Function at 0x4030f9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00404aa6
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 8], eax
je 0x403164
push ebx
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea edi, [ebx + 0xa]
mov eax, esi
call fcn.00405f47
push ebx
push dword [esi]
push dword [ebp + 8]
call fcn.00405387
mov eax, dword [esi]
mov byte [ebx + eax], 0
mov eax, dword [esi]
add esp, 0xc
push dword [ebp + 8]
mov byte [eax + ebx + 1], 0
mov eax, dword [esi]
mov byte [eax + ebx + 2], 0
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi + 0xc], 0
lea ecx, [esi + 0x10]
mov eax, esi
call fcn.004031b2
xor eax, eax
pop edi
inc eax
pop ebx
jmp 0x403166
xor eax, eax
pop ebp
ret 4
Function at 0x4032e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x1000
mov eax, 0x8000
lea edx, [esp + 0x38]
mov dword [edi + 0x88], 0x1388
mov dword [edi + 0x38], ecx
mov dword [edi + 0x34], eax
mov dword [edi + 0x78], ecx
mov dword [edi + 0x74], eax
call fcn.004030ba
push dword [ebp + 0xc]
mov esi, edx
call fcn.004030f9
test eax, eax
je 0x40349f
push 0x4179b4
mov eax, esi
call fcn.00403226
mov dword [esp + 0x10], eax
push str.country_name
mov eax, esi
call fcn.00403226
mov dword [esp + 0x14], eax
push str.city_name
mov eax, esi
call fcn.00403226
mov dword [esp + 0x18], eax
push str.country_iso_code
mov eax, esi
call fcn.00403226
mov dword [esp + 0x20], eax
push str.subdivision_1_name
mov eax, esi
call fcn.00403226
mov dword [esp + 0x1c], eax
xor ecx, ecx
mov eax, esi
call fcn.004031b2
test eax, eax
je 0x40349f
lea ebx, [edi + 0x80]
mov ecx, dword [esp + 0x10]
or dword [esp + 0x28], 0xffffffff
or dword [esp + 0x2c], 0xffffffff
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0x68]
mov byte [esp + 0x34], 0
mov byte [esp + 0x35], 0
call fcn.00405a67
push eax
call sub.msvcrt.dll__wtoi
pop ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x68]
call fcn.00405a67
xor esi, esi
cmp word [eax], si
je 0x4033e2
push eax
mov eax, edi
call fcn.004059f1
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x68]
call fcn.00405a67
cmp word [eax], si
je 0x403404
push eax
add edi, 0x20
call fcn.0040591d
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x68]
call fcn.00405a67
cmp word [eax], si
je 0x403426
push eax
add edi, 0x60
call fcn.0040591d
mov edi, dword [ebp + 8]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x68]
call fcn.00405a67
cmp word [eax], si
je 0x403445
mov cl, byte [eax]
mov al, byte [eax + 2]
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], al
mov esi, dword [ebx + 0xc]
test esi, esi
jl 0x40348c
cmp esi, 0xffffffff
mov eax, dword [ebx + 8]
jne 0x40345d
push dword [ebx]
call sub.msvcrt.dll_free
jmp 0x40346d
push eax
push 0x14
lea eax, [ebx + 4]
mov edx, esi
mov edi, ebx
call fcn.00404d33
pop ecx
lea eax, [esi + 1]
cmp dword [ebx + 0xc], eax
pop ecx
jge 0x403479
mov dword [ebx + 0xc], eax
mov edi, esi
imul edi, edi, 0x14
add edi, dword [ebx]
push 5
pop ecx
lea esi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
xor ecx, ecx
lea eax, [esp + 0x38]
call fcn.004031b2
test eax, eax
jne 0x403391
lea edi, [esp + 0x38]
call fcn.004030df
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404ad8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret
Function at 0x404c5f
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.00404aa6
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x404cf1
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x404cda
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x404cda
shr esi, 1
and word [edi + esi*2], 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x404ce3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x404cfa
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x404dbb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x404f10
Capabilities:
Get common file path

Disassembly:
cmp word [0x4200d0], 0
push esi
mov esi, 0x4200d0
jne 0x404f31
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [0x4202dc], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x4202dc]
pop ecx
pop ecx
pop esi
ret

Function at 0x405215
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x41752c
push eax
push eax
push dword [esp + 0x14]
push 0x417d7c
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x4053a6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x418488
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret

Function at 0x40582b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
and word [ebp - 0x800], 0
push esi
push 0x7fe
lea eax, [ebp - 0x7fe]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp word [0x4202e0], 0
mov esi, 0x4202e0
jne 0x405873
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov dword [0x4204ec], eax
lea eax, [ebp - 0x800]
push esi
push eax
call sub.msvcrt.dll_wcscpy
lea esi, [ebp - 0x800]
call fcn.00404afc
push dword [ebp + 8]
mov eax, esi
push eax
call sub.msvcrt.dll_wcscat
mov eax, esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
add esp, 0x10
push eax
call esi
test eax, eax
jne 0x4058ad
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x405d9d
Capabilities:
Enumerate files on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x405dc9
lea eax, [esi + 0x28c]
push eax
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov dword [esp + 4], ecx
jmp 0x405de4
lea ecx, [esi + 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov dword [esp + 4], eax
jne 0x405deb
call fcn.00405e36
cmp dword [esp + 4], 0
je 0x405e2f
push ebx
push ebp
push edi
lea edi, [esi + 0x4dc]
lea ebx, [esi + 0x2b8]
add esi, 0x764
push esi
call sub.msvcrt.dll_wcslen
push ebx
mov ebp, eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + ebp + 1]
cmp eax, 0x143
pop ecx
pop ecx
jae 0x405e28
push ebx
push esi
mov eax, edi
call fcn.00404eec
pop ecx
pop ecx
jmp 0x405e2c
and word [edi], 0
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 4]
pop esi
pop ecx
ret

Function at 0x406307
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00404aa6
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 8], eax
je 0x406368
push ebx
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea edi, [ebx + 0xa]
mov eax, esi
call fcn.00405f47
push ebx
push dword [esi]
push dword [ebp + 8]
call fcn.00405387
mov eax, dword [esi]
mov byte [ebx + eax], 0
mov eax, dword [esi]
add esp, 0xc
push dword [ebp + 8]
mov byte [eax + ebx + 1], 0
mov eax, dword [esi]
mov byte [eax + ebx + 2], 0
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi + 0xc], 0
xor eax, eax
pop edi
inc eax
pop ebx
jmp 0x40636a
xor eax, eax
pop ebp
ret 4

Function at 0x407452
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
mov esi, eax
xor ebx, ebx
call fcn.00404aa6
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 8], eax
je 0x4074c1
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
cmp edi, ebx
jbe 0x4074b7
call fcn.00407100
lea eax, [edi + 1]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
push edi
push eax
push dword [ebp + 8]
mov dword [esi], eax
call fcn.00405387
mov eax, dword [esi]
mov byte [edi + eax], bl
add esp, 0x10
mov dword [esi + 0xc], ebx
call fcn.00407129
mov eax, dword [esi]
cmp eax, ebx
je 0x4074b4
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [esi], ebx
xor ebx, ebx
inc ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x407bad
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x41f788
push dword [esp + 0xc]
push esi
push 0x41752c
push dword [esp + 0x14]
push 0x41f998
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov eax, esi
ret
Function at 0x407bd2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00415e80
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x41f788
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x41752c
push dword [ebp + 8]
push 0x41f998
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x407c41
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x407c45
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00415e80
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x41f788
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x41752c
push dword [ebp + 8]
mov esi, 0x41f998
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x407cac
cmp dword [ebp + 0x10], 0
jne 0x407cac
xor eax, eax
jmp 0x407cba
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret

Function at 0x408031
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00404dbb
test eax, eax
pop ecx
je 0x4080b8
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x41f788
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x41f998
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x417fc0
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x41fa20
mov dword [0x41fa1c], eax
call fcn.00407bad
push 0x3f
push str.TranslatorName
mov esi, 0x41faa0
call fcn.00407bad
push 0xff
push str.TranslatorURL
mov esi, 0x41fb20
call fcn.00407bad
add esp, 0x18
pop edi
pop esi
ret

Function at 0x408ef2
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
and dword [ebp - 0x2b4], 0
push esi
push 0x2b0
mov esi, eax
lea eax, [ebp - 0x2b0]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
neg esi
sbb esi, esi
and esi, 0x10
or esi, 0x111
push esi
push 0x2b4
lea eax, [ebp - 0x2b4]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp dword [ebp - 0x2b4], 0
pop esi
je 0x408f56
push dword [ebp - 0x2b4]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x2b0]
leave
ret 4
Function at 0x40941b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00415e80
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x40a511
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4cc
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x2bc], ebx
push edi
je 0x40a5e0
cmp dword [esi + 0x2c4], ebx
je 0x40a5a2
push 0x2b0
lea eax, [esp + 0x230]
push ebx
push eax
mov dword [esp + 0x234], ebx
call sub.msvcrt.dll_memset
push 0x208
lea eax, [esp + 0x2e]
push ebx
push eax
mov word [esp + 0x34], bx
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x230]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [esi + 0x2b0], eax
push eax
jmp 0x40a5d1
call fcn.004058b0
push 0x60
pop ecx
shl eax, 4
xor edx, edx
div ecx
push 1
push 1
push 0x19
push eax
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push ebx
lea edi, [esi + 0x2b0]
push eax
mov dword [edi], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [edi]
push 1
push 0x1003
push dword [esi + 0x2a8]
call ebp
cmp dword [esi + 0x2c0], ebx
je 0x40a625
call fcn.004058b0
push 0x60
pop ecx
shl eax, 5
xor edx, edx
div ecx
push 1
push 1
push 0x19
push eax
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push ebx
lea edi, [esi + 0x2b4]
push eax
mov dword [edi], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [edi]
push ebx
push 0x1003
push dword [esi + 0x2a8]
call ebp
call fcn.004058b0
push 0x60
pop ecx
shl eax, 4
xor edx, edx
div ecx
push 1
push 1
push 0x19
mov edi, eax
push edi
push edi
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push ebx
mov dword [esi + 0x2ac], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push 0x1000
push edi
push edi
push ebx
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push 0x1000
push edi
push edi
push ebx
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
push dword [esi + 0x2ac]
mov dword [esp + 0x1c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
push dword [esi + 0x2ac]
call edi
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x2ac]
call edi
push dword [esp + 0x10]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
push dword [esp + 0x14]
call edi
mov eax, dword [esi + 0x2ac]
mov esi, dword [esi + 0x2a8]
push eax
push ebx
push 0x1208
push esi
call fcn.00403eb8
pop ecx
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4cc
ret
Function at 0x40aba7
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
movzx eax, word [esi + 0x2c]
cmp word [esp + 0x10], ax
push edi
jb 0x40abf4
movzx edi, word [esp + 0x14]
movzx eax, ax
add eax, dword [esi + 0x31c]
cmp edi, eax
jge 0x40abf4
push 0x10
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x40abda
inc ebx
movzx ecx, word [esi + 0x2c]
push ebx
mov eax, edi
push 0
sub eax, ecx
call fcn.00408b0a
call fcn.0040abfd
xor eax, eax
inc eax
jmp 0x40abf6
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x40b195
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
xor eax, eax
push edi
inc eax
call fcn.0040c18d
and word [ebp - 0x250], 0
push 0x208
lea eax, [ebp - 0x24e]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x250]
add esp, 0xc
push eax
call fcn.00404dea
pop ecx
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x250]
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x30], str.RunAs
mov dword [ebp - 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40b21e
push dword [edi + 0x208]
call dword [sym.imp.USER32.dll_DestroyWindow]
leave
ret

Function at 0x40bd88
Capabilities:
Delete file
Get common file path
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push edi
lea eax, [ebp - 0x410]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x40bdb7
push edi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
and word [ebp - 0x208], 0
lea eax, [ebp - 0x208]
push eax
push 0
push 0x418634
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov eax, dword [esi + 0x69c]
push 1
push 1
push 2
lea ecx, [ebp - 0x208]
push ecx
push esi
call fcn.0040bc6d
test eax, eax
pop edi
je 0x40be3c
push dword [esi + 0x208]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40be17
lea eax, [ebp - 0x208]
push eax
call fcn.00404c5f
pop ecx
jmp 0x40be1d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40be2f
push dword [esi + 0x208]
mov ecx, eax
call fcn.00404b1f
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
leave
ret