joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019a16
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
call fcn.10019713
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10019a3a
push 2
pop eax
jmp 0x10019a9e
push ebx
push edi
call fcn.10019713
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x10019a53
push 0xd
pop esi
jmp 0x10019a94
push edi
call fcn.10019713
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
test ecx, ecx
je 0x10019a4e
mov eax, dword [ebp + 0x14]
push 8
pop edx
cmp ecx, dword [eax]
mov dword [eax], ecx
cmova esi, edx
test esi, esi
jne 0x10019a94
cmp dword [ebp + 0x10], esi
jne 0x10019a80
push 0x57
jmp 0x10019a50
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [ebp + 0x10]
call fcn.100626d0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x10019aa2
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x94
mov eax, 0x10088bd8
call fcn.10060a77
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x9c], eax
call fcn.10019722
push eax
lea ecx, [ebp - 0x94]
call fcn.10017327
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], edi
call fcn.100174c2
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.100174a2
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10019b16
push 2
pop esi
jmp 0x10019b79
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jne 0x10019b29
push 0xd
pop esi
jmp 0x10019b72
mov eax, dword [ebp - 0x9c]
xor esi, esi
push 8
pop ecx
cmp edi, dword [eax]
mov dword [eax], edi
cmova esi, ecx
test esi, esi
jne 0x10019b72
mov eax, dword [ebp - 0xa0]
test eax, eax
jne 0x10019b4d
push 0x57
jmp 0x10019b26
and dword [ebp - 0x98], 0
lea ecx, [ebp - 0x98]
push 0
push ecx
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x98], edi
push 0xc
pop eax
cmovne esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x94]
call fcn.1000c780
mov eax, esi
call fcn.10060a21
ret

Function at 0x10019c9e
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x10019cc1
or esi, 1
push 1
call edi
test ax, ax
jns 0x10019ccd
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x10019cd9
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x10019ce5
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x1001b3bd
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0xec]
call fcn.100178d3
mov edi, dword [ebp + 8]
test eax, eax
jle 0x1001b413
push ebx
lea ecx, [esi + 0xec]
mov byte [ebp + 0xb], 0
call fcn.10017483
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x1001b46e
lea ecx, [esi + 0xec]
inc ebx
call fcn.100178d3
cmp ebx, eax
jl 0x1001b3dc
sub edi, 0x100
je 0x1001b4d5
sub edi, 4
je 0x1001b472
dec edi
sub edi, 1
jne 0x1001b4cc
push dword [ebp + 0xc]
and dword [ebp + 8], edi
call fcn.10072bbc
pop ecx
mov ecx, dword [esi + 0x6c]
lea edx, [ebp + 8]
push reloc.OLEAUT32.dll_VariantCopyInd
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x1001c74b
call dword [eax + 0x100]
mov esi, eax
test esi, esi
je 0x1001b4cc
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf4]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x1001b4ce
cmp dword [esi + 0x70], 0
je 0x1001b4cc
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x80]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x84]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.10019c9e
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x70]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x10c]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x1001b4cc
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x1001b522
mov eax, dword [ecx]
call dword [eax + 0xcc]
test al, al
je 0x1001b522
mov ecx, dword [esi + 0x70]
mov eax, dword [ecx]
call dword [eax + 0xd8]
test al, al
je 0x1001b522
mov ecx, dword [esi + 0x70]
push str.RichEdit
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.10062449
pop ecx
pop ecx
test eax, eax
je 0x1001b522
mov ecx, dword [esi + 0x70]
call fcn.1002c5ce
test al, al
jne 0x1001b4cc
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.1001c30b
jmp 0x1001b4ce
Function at 0x1002d948
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x4ec], edi
je 0x1002d9b2
cmp dword [ebp + 8], 0x100
jne 0x1002d9a1
cmp word [ebp + 0xc], 0xd
jne 0x1002d9a1
cmp byte [esi + 0x4f2], 0
je 0x1002d988
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002d9a1
cmp byte [esi + 0x4f3], 0
jne 0x1002d9a1
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1002d99d
push edi
push edi
push edi
push str.return
push esi
call fcn.1001bcad
xor eax, eax
jmp 0x1002d9b5
mov eax, dword [esi + 0x4ec]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1002ddc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100af334]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1002de7a
movzx eax, word [esi]
test ax, ax
je 0x1002de7a
push edi
mov edi, esi
mov ecx, esi
mov edx, eax
cmp dx, 0x2f
je 0x1002de02
cmp dx, 0x5c
jne 0x1002de04
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x1002ddf6
cmp edi, esi
je 0x1002de4d
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.100663fd
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x1002de88
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.1002ddc0
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.10072681
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.10072610
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1005fd1a
leave
ret
call fcn.100605b9
int3

Function at 0x1002e480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x1002e4fc
cmp dword [edi + 4], 0xffffffff
jne 0x1002e4fc
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x100a0e08
push esi
call fcn.10072610
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x1002e4ce
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x1002e4ce
mov eax, 0x2000000
jmp 0x1002e501
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10030a1a
add esp, 0x10
test eax, eax
jne 0x1002e4ec
mov eax, dword [ebp - 4]
jmp 0x1002e501
push eax
call fcn.100311df
mov dword [edi], eax
mov eax, dword [0x100b1b98]
pop ecx
jmp 0x1002e501
mov eax, 0x1000000
pop edi
leave
ret 0xc
Function at 0x10030a1a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
cmp eax, 1
je 0x10030a3f
cmp eax, 2
je 0x10030a3f
cmp eax, 3
je 0x10030a3f
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x10000
xor eax, eax
leave
ret
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
mov byte [ebp - 8], dl
mov ecx, edx
mov dword [ebp - 4], ecx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [edi], edx
cmp eax, 1
jne 0x10030a9e
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 4]
push 2
push edx
push edx
push eax
call esi
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x10030a83
mov dword [edi], 0x100
jmp 0x10030b61
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb al, al
inc al
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
cmp eax, 2
jne 0x10030b4d
push edx
push 0x80
push 3
push edx
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x10030ad1
mov dword [edi], 0x200
jmp 0x10030b61
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
dec eax
neg eax
push 0
push dword [ebp - 4]
sbb al, al
inc al
mov byte [ebp - 8], al
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0xc], esi
test esi, esi
je 0x10030b3d
push esi
call fcn.1006997a
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10030b3d
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, 0x800
test eax, eax
jne 0x10030b25
mov dword [edi], ecx
mov eax, ecx
jmp 0x10030b27
mov eax, dword [edi]
cmp dword [ebp - 0x10], esi
je 0x10030b30
mov dword [edi], ecx
mov eax, ecx
test eax, eax
je 0x10030b3d
push ebx
call fcn.10069975
pop ecx
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x10030b53
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
jne 0x10030b65
test ebx, ebx
jne 0x10030b65
mov dword [edi], 0x300
xor eax, eax
jmp 0x10030bc5
push 0x24
call fcn.100600bf
mov esi, eax
xor edx, edx
mov eax, dword [ebp + 0x10]
pop ecx
mov dword [esi + 4], eax
cmp dword [ebp - 4], edx
je 0x10030ba9
mov ecx, dword [ebp - 8]
mov byte [esi], 1
mov byte [esi + 8], cl
mov eax, dword [ebp - 4]
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], dl
mov dword [esi + 0x14], edx
test cl, cl
je 0x10030bc1
push 1
push edx
push edx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x14], eax
xor edx, edx
jmp 0x10030bc1
mov eax, dword [ebp - 0xc]
mov byte [esi], dl
mov byte [esi + 8], 1
mov dword [esi + 0xc], edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edx
mov dword [esi + 0x14], edx
mov dword [edi], edx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10030bca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x10030bfd
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10030bf8
mov byte [edi + 0x10], 1
mov eax, dword [ebp + 0x10]
jmp 0x10030c27
mov edx, dword [edi + 0x20]
push esi
mov esi, dword [edi + 0x1c]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x1c]
cmovbe esi, ecx
mov ecx, dword [edi + 0x18]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.100626d0
add esp, 0xc
mov eax, esi
add dword [edi + 0x20], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x10030db5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10030dc3
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x10030e82
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008f7e8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008f7e8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008f7e8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008f7e8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008f7e8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008f7e8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008f7e8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008f7e8]
sub edi, 1
jne 0x10030ddb
pop edi
test esi, esi
je 0x10030e9e
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008f7e8]
inc edx
sub esi, 1
jne 0x10030e86
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x1004473e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100af334]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x100447ab
cmp dword [esi + 0x10], 0
je 0x100447ab
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.100609e0
mov ebx, esp
test ebx, ebx
je 0x100447ab
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1c4
call fcn.1001744a
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.1001bcad
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005fd1a
leave
ret 0x10

Function at 0x10044ead
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100af334]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
sub esp, 0x10
lea esi, [ebp + 8]
mov edi, esp
mov ebx, ecx
mov dword [ebp - 0x38], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1001e7ae
mov ecx, dword [ebx + 0x5a8]
test ecx, ecx
je 0x10044fa4
lea eax, [ebp - 0x14]
push eax
call fcn.10043ed4
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x10044f14
mov ecx, dword [ebx + 0x5a8]
push 0
call fcn.100178d3
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x10044fa4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10044f71
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
mov esi, eax
lea edi, [ebp - 0x24]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_UnionRect]
test eax, eax
je 0x10044f64
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x10044fb5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
mov ebx, eax
test ebx, ebx
jne 0x10044f23
mov ecx, dword [ebp - 0x38]
inc eax
shl eax, 6
or eax, 0x14
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x5a8]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.100178d3
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005fd1a
leave
ret 0x10
xor eax, eax
inc eax
jmp 0x10044f71
Function at 0x10046b28
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x1008a03f
call fcn.10060a77
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x5b8], ebx
cmp dword [edi + 4], ebx
jne 0x10046bba
lea eax, [ebp - 0xa8]
push eax
call fcn.10046802
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xa8]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.1000f1ad
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.10052ffc
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.1001ffb9
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.100193c2
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.10017a24
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.1000c780
mov esi, 0x5a8
test bl, bl
je 0x10046bf5
mov eax, dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.10060a21
ret 4
Function at 0x10050220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x1005024e
cmp eax, edi
jge 0x10050242
push esi
call fcn.1004c719
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x10050271
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x10050257
mov dword [esi + 8], edx
jmp 0x10050286
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x1005027c
xor dl, dl
jmp 0x10050281
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x10050271
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x100502c0
push str.zlib_corrupt
call fcn.1004c644
add esp, 4
jmp 0x10050300
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x100502d0
push str.read_past_buffer
jmp 0x100502b6
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x100502ea
push edi
push ecx
push esi
call fcn.10052d3c
add esp, 0xc
test eax, eax
je 0x10050300
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.100626d0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x1005318e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100531c0
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8

Function at 0x10058709
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xc
mov eax, 0x1008ae43
call fcn.10060a43
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.10007d29
push dword [ebp - 0x10]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1005879f
push eax
jmp 0x1005878e
call fcn.100077a1
push eax
lea ecx, [ebp - 0x14]
call fcn.100074f7
inc edi
mov byte [ebp - 4], 1
push edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.10009952
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.1000738a
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.10007d77
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10058781
push esi
call fcn.1006c182
pop ecx
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.10007d77
push edi
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.1000991e
mov edi, eax
cmp edi, 0xffffffff
jne 0x10058734
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.10007d77
call fcn.10060a0c
ret
Function at 0x1005890e
Capabilities:
Check if file exists
Delete file

Disassembly:
push 8
mov eax, 0x1008aeb9
call fcn.10060a43
mov edi, ecx
push dword [ebp + 0x10]
mov eax, dword [edi]
push dword [ebp + 8]
call dword [eax + 0x6c]
test eax, eax
je 0x10058a12
call fcn.100077a1
push eax
lea ecx, [ebp + 0x10]
call fcn.100074f7
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 0xc]
push ebx
mov byte [ebp - 4], 1
call fcn.10007950
pop ecx
push eax
push ebx
lea ecx, [ebp + 0x10]
call fcn.10007cb5
push 0x5c
push dword [ebp + 0x10]
call fcn.10061d5c
pop ecx
pop ecx
test eax, eax
jne 0x10058975
or eax, 0xffffffff
jmp 0x1005897a
sub eax, dword [ebp + 0x10]
sar eax, 1
inc eax
lea ecx, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10009952
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 2
call fcn.1000738a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.10007d77
mov esi, dword [ebp + 0x10]
push esi
call fcn.10058709
pop ecx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100589c0
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
lea ecx, [ebp - 0x14]
push eax
push eax
push 0x80
push 2
push eax
push 0xc0000000
push ebx
call fcn.10058653
test eax, eax
js 0x100589f7
push 0
push dword [edi + 0x3c]
lea ecx, [ebp - 0x14]
push dword [edi + 0x38]
call fcn.10059cb3
test eax, eax
js 0x100589f7
xor ebx, ebx
inc ebx
jmp 0x100589f9
xor ebx, ebx
cmp dword [ebp - 0x14], 0
je 0x10058a08
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.10007d77
mov eax, ebx
call fcn.10060a0c
ret 0xc

Function at 0x10058fd8
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x1008b06d
call fcn.10060a43
call fcn.100077a1
push eax
lea ecx, [ebp - 0x10]
call fcn.100074f7
xor esi, esi
lea ecx, [ebp - 0x10]
push esi
push 0x1a
push 0x200
mov dword [ebp - 4], esi
call fcn.10007b83
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1000735e
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
test eax, eax
jne 0x1005903d
mov ecx, dword [ebp + 8]
push 0x100a1484
call fcn.10007d29
lea ecx, [esi - 0x10]
call fcn.10007d77
mov eax, dword [ebp + 8]
jmp 0x10059096
dec eax
lea ecx, [ebp - 0x10]
push eax
call fcn.10009d39
cmp ax, 0x5c
je 0x1005905c
push 1
push 0x100a0e08
lea ecx, [ebp - 0x10]
call fcn.10009cad
push 0xd
push str.CloudNotePad_
lea ecx, [ebp - 0x10]
call fcn.10009cad
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp - 0x10]
je 0x1005907b
push esi
call fcn.10058709
pop ecx
lea edi, [esi - 0x10]
push edi
call fcn.10007444
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, edi
mov dword [esi], eax
call fcn.10007d77
mov eax, esi
call fcn.10060a0c
ret