joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008069
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x1028b078], 0x12db
mov dword [ebp - 0x10], eax
call fcn.10007f2c
xor ecx, ecx
mov edx, eax
mov dword [0x1028b07c], 0x983
mov esi, dword [eax + 0x3c]
mov dword [0x1028b078], 0x297
mov esi, dword [eax + esi + 0x78]
mov dword [0x1028b07c], 0x1bf3
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x1028b078], 0xfffffbb5
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x100081e5
jmp 0x1000813e
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [0x1028b078], 0xd83
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x24], edi
jmp 0x100081e5
mov eax, dword [ebp - 0x2c]
add eax, 1
mov cl, byte [ebp - 0x2d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x2e]
and ch, dl
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], ch
mov eax, dword [ebp - 0x34]
cmp eax, 0x20
setb cl
mov dl, byte [ebp - 0x35]
and dl, cl
test dl, 1
mov dword [ebp - 0x3c], eax
jne 0x1000816a
jmp 0x10008197
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], bh
mov byte [ebp - 0x2e], cl
jne 0x10008108
mov al, byte [ebp - 0x2e]
test al, 1
jne 0x100080e0
jmp 0x100081a4
mov eax, dword [ebp - 0x28]
add eax, 2
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov edx, dword [ebp - 0x18]
cmp ecx, edx
setb bl
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x55], bl
xor eax, eax
mov cl, byte [ebp - 0x55]
test cl, 1
mov edx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x24], eax
jne 0x10008150
jmp 0x100081e5
mov eax, dword [ebp - 0x24]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100085d6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1028b07c], 0x1a92
mov dword [0x1028b078], 0x2534
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x1027778c]
mov dl, byte [eax + 0x1027775d]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
je 0x10008632
jmp 0x10008602
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [0x1028b078], 0x18b3
mov dword [ebp - 0x34], eax
call fcn.1000831d
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10008429
mov ecx, dword [0x1028b07c]
add ecx, 0x65b
mov dword [0x1028b07c], ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, 0
je 0x1000862a
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1028b078], 0x1b3e
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.100078ef
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x1028b078], 0x105c
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x44], ecx
mov dword [0x1028b07c], 0x1a71
add ecx, 0x23a7
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x10008714
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x10008742
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1028b07c], 0xa16
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x100087f0
lea eax, [ebp - 0x12c]
mov dword [0x1028b07c], 0xde3
mov dword [0x1028b078], 0x18b3
mov dword [ebp - 0x13c], eax
call fcn.1000831d
mov dword [esp], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp + 4], eax
call fcn.10008429
mov ecx, eax
mov dword [0x1028b090], eax
mov eax, esp
mov edx, dword [ebp - 0x140]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], ecx
jmp 0x10008890
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0x5c
mov edi, edx
add edi, esi
add edi, 0x38
mov esi, dword [edi]
imul edi, eax, 0x5c
add edx, edi
add edx, 4
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x34f
mov ecx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x100087f0
xor eax, eax
mov dword [0x1028b078], 0xccc
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov cl, byte [eax + 0x1027778c]
mov dl, byte [eax + 0x1027775d]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x150], eax
je 0x10008773
jmp 0x1000885b
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x148]
lea edx, section..data
imul esi, eax, 0x5c
mov edi, edx
add edi, esi
add edi, 0x38
mov esi, dword [edi]
imul edi, eax, 0x5c
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x5c
add edx, ebx
add edx, 4
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.10007b31
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x34f
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
jne 0x10008890
lea eax, [0x1027776b]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x1028b078], 0x10db
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.10007c0f
mov dword [0x1028b078], 0x2503
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x140]
mov dword [esp + 0xc], edx
call fcn.10007d9d
xor eax, eax
mov ecx, dword [ebp - 0x144]
add ecx, 0x111a12
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x134a00
mov ecx, dword [ebp - 0x144]
add ecx, 0x102fe9
mov dword [edx + 8], ecx
mov dword [0x1028b078], 0x14b
mov dword [edx + 0xc], 0x2010
mov dword [0x1028b07c], 0x112e
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x10013502
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022df0]
jne 0x1001350c
repz ret
jmp fcn.10013cd3

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x796c24aa
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x532319a6
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x40152a
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x124]
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x124], 0x14
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movzx eax, word [ebp - 0x120]
sub esp, 0x14
leave
sub eax, 0x41
ret

Function at 0x401586
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.0040152a
test eax, eax
jne 0x401620
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4020b6
sub eax, 0x401654
mov dword [esp], 0x401654
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401620
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401420
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004014a3
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], 0x40300c
call fcn.00401db9
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40ec20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5d4470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x5d446c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5d4470], edx
cmp eax, 0x26f
jl 0x40ec28
mov dword [0x564fa0], 0x270
ret

Function at 0x40ec60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x5d4474]
mov ebx, dword [eax*4 + 0x5d4470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d4aa4]
mov dword [eax*4 + 0x5d4470], edx
cmp eax, 0xe2
jl 0x40ec68
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5d4474]
mov ebx, dword [eax*4 + 0x5d4470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d40e4]
mov dword [eax*4 + 0x5d4470], edx
cmp eax, 0x26e
jl 0x40ecb8
mov edx, dword [0x5d4470]
mov ecx, dword [0x5d4e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5d4aa0]
mov dword [0x5d4e2c], eax
mov dword [0x564fa0], 0
pop ebx
ret

Function at 0x40ed40
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x564fa0]
add dword [0x564fa0], 1
mov eax, dword [0x5d3020]
cmp eax, dword [0x5646f0]
jne 0x40ed63
cmp ebx, 0x271
jb 0x40ed84
mov eax, dword [0x5d3020]
call fcn.0040ec20
not dword [0x5d3020]
mov eax, dword [0x5d3020]
mov dword [0x5646f0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40eda0
call fcn.0040ec60
xor ebx, ebx
mov dword [0x564fa0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5d4470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x4108f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x564440]
cmp ax, 0xcb
je 0x4109fc
cmp ax, 0xcc
je 0x4109fc
lea esi, [esi]
mov edx, dword [0x5d5070]
test edx, edx
je 0x410925
mov eax, dword [0x5d4f20]
call edx
mov ebx, eax
jmp 0x41092a
mov ebx, 0x5d4f24
cmp word [0x5d4f10], 0
jle 0x410950
mov eax, 0x5d4ef0
call fcn.00410b60
mov eax, ebx
call fcn.004104b0
mov eax, ebx
call fcn.00410520
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410972
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x41096d
mov edx, edi
mov eax, ebx
call fcn.0040f920
jmp 0x410970
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410958
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5d4f10], 0
jle 0x4109fc
mov edx, 0x5d4e30
mov eax, ebx
call fcn.0040fa60
mov edi, eax
test edi, edi
je 0x4109cc
mov eax, dword [0x5d4ec4]
mov dword [edi + 0xc], eax
cmp dword [0x5d4ec4], 0
je 0x4109c0
mov eax, dword [0x5d4ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5d4ec4], eax
nop
sub word [0x5d4f10], 1
cmp word [0x5d4f10], 0
sete bl
mov eax, 0x5d4ef0
call fcn.00410b80
test bl, bl
je 0x4109fc
mov eax, 0x5d4ef0
call fcn.00410b50
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x412a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00412a50
push ebp
push 0x413e90
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x412b9a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b4f0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x412aff
mov edx, 0x5d42f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x412b51
call sub.kernel32.dll_GetLastError
call fcn.00403ff0
lea eax, [ebp - 0x10]
call fcn.0040a0d0
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a570
mov edx, dword [ebp - 0x14]
mov ecx, 0x580334
lea eax, [ebp - 0x10]
call fcn.0040a400
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040adc0
jmp 0x412be8
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x412b6a
cmp eax, ecx
je 0x412b74
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b4f0
cmp byte [0x5646c0], 0
jne 0x412be8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040ba90
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040ae50
lea esi, [esi]
jmp 0x412be8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b4f0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x412bbe
mov eax, 0x5d42f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x5646c0], 0
jne 0x412be8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040ba90
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040ae50
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00412a50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413020
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5d4260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413200
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5d4260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403560
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5644c0], eax
mov ebx, eax
jmp 0x4131c3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x4130a8
cmp byte [ebx], 0
je 0x4131cc
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413123
mov al, byte [ebx]
cmp al, 1
jb 0x413118
sub al, 0x20
jbe 0x4130e8
sub al, 2
je 0x4130fc
jmp 0x413118
mov al, byte [ebp - 0x114]
test al, al
je 0x413128
add dword [ebp - 0x110], 1
jmp 0x413120
cmp byte [ebx + 1], 0x22
je 0x413113
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413120
add ebx, 1
jmp 0x413120
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x4130d8
test dword [ebp - 0x10c], 0xffffffff
je 0x4131bc
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413200
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5d4260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x4131b3
mov al, byte [ebx]
cmp al, 1
jb 0x4131a8
sub al, 0x20
jbe 0x413178
sub al, 2
je 0x41318c
jmp 0x4131a8
mov al, byte [ebp - 0x114]
test al, al
je 0x4131b8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x4131b0
cmp byte [ebx + 1], 0x22
je 0x4131a3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4131b0
add ebx, 1
jmp 0x4131b0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413168
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x4130ab
mov ebx, dword [ebp - 0x10c]
mov dword [0x5d4250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5d4260
call fcn.00410730
mov eax, dword [0x5d4260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426a10
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, edx
call fcn.004088d0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
xor eax, eax
push fcn.004269f0
push ebp
push 0x413e90
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.00403a40
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4a0]
lea edx, [ebp - 0x18]
call fcn.0048e980
mov edx, dword [ebp - 0x18]
mov ecx, str.___PuTTY
lea eax, [ebp - 0x14]
call fcn.00408a00
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x426a7d
mov eax, 0x5d42f0
push eax
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x426a92
mov ebx, dword [ebx - 4]
cmp ebx, 1
jl 0x426ae0
mov dword [ebp - 0x10], 0
mov esi, esi
add dword [ebp - 0x10], 1
push 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
movzx eax, byte [edx + eax - 1]
push eax
call sub.user32.dll_MapVirtualKeyA
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp - 0x1c]
shl eax, 0x10
push eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
movzx eax, byte [edx + eax - 1]
push eax
push 0x102
push dword [ebp - 0xc]
call sub.user32.dll_PostMessageA
cmp ebx, dword [ebp - 0x10]
jg 0x426aa0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004269f0
pop ebx
mov esp, ebp
pop ebp
ret