joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4431b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b33f3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0xec8960]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea edx, [esi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], ecx
mov byte [esi + 0x64], 0
mov dword [esi + 0x68], eax
test byte [edi + 8], 8
je 0x44329b
test cl, 0x10
jne 0x44329b
mov al, 1
jmp 0x44329d
xor al, al
mov byte [esi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov edi, dword [edi + 0x18]
sar ecx, 3
cmp edi, ecx
jae 0x4432c1
lea ecx, [edi*8]
mov dword [edx + 4], ecx
jmp 0x4432f8
jbe 0x4432f8
mov eax, dword [edx + 8]
sar eax, 3
cmp edi, eax
jbe 0x4432d8
push ecx
push edi
mov ecx, edx
call fcn.00444680
jmp 0x4432f8
sub edi, ecx
je 0x4432f5
lea eax, [edi*8]
push eax
push 0
push ebx
call fcn.0048b190
add esp, 0xc
lea ebx, [ebx + edi*8]
lea edx, [esi + 0x40]
mov dword [edx + 4], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x449290
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b36a9
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0xec8960]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], eax
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.nanogui::Widget.0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
xorps xmm0, xmm0
movups xmmword [edi + 0x10], xmm0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0xf
mov byte [edi + 0x10], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x50]
mov dword [edi + 0x4c], 0x101
push 0
movups xmmword [ecx], xmm0
push 0xe9af88
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0042fa00
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 4
mov dword [edi + 0x68], 0xffffffff
mov byte [edi + 0x6c], 0
mov dword [edi + 0x70], 0x3f800000
mov dword [edi + 0x74], 0
test eax, eax
je 0x4493b4
mov edx, dword [eax + 0x44]
mov ecx, eax
sub edx, dword [eax + 0x40]
mov esi, dword [eax]
push edi
sar edx, 2
push edx
call dword [esi + 8]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x45cf00
Capabilities:
Create directory

Disassembly:
push esi
push edi
mov edi, ecx
push 0
push edi
call fcn.0048a9bd
add esp, 8
lea esi, [eax - 2]
cmp esi, edi
jb 0x45cf60
movzx eax, word [esi]
push eax
push 0xea01d0
call fcn.0048a9bd
add esp, 8
test eax, eax
jne 0x45cf35
sub esi, 2
cmp esi, edi
jae 0x45cf16
pop edi
pop esi
ret
push ebx
movzx ebx, word [esi]
xor eax, eax
push eax
push edi
mov word [esi], ax
call fcn.00499581
add esp, 8
test eax, eax
je 0x45cf5c
mov ecx, edi
call fcn.0045cf00
push edi
call fcn.00499657
add esp, 4
mov word [esi], bx
pop ebx
pop edi
pop esi
ret
Function at 0x45efd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0xef1584], 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
jne 0x45f0b6
xor edi, edi
nop dword [eax]
mov edx, edi
mov eax, edi
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edi*4 + 0xeef588], eax
inc edi
cmp edi, 0x100
jb 0x45eff0
cmp edi, 0x800
jae 0x45f0b6
mov ecx, dword [edi*4 + 0xeef188]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0xeef588]
mov dword [edi*4 + 0xeef588], ecx
inc edi
cmp edi, 0x800
jb 0x45f092
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0xf06f98]
cmp eax, dword [ecx + 4]
jle 0x45f0ff
push 0xf06f98
call fcn.00489055
add esp, 4
cmp dword [0xf06f98], 0xffffffff
jne 0x45f0ff
xor edx, edx
mov ecx, str.CrcUpdate
call fcn.0045eb70
push 0xf06f98
mov dword [0xf06fa0], eax
call fcn.0048900b
add esp, 4
mov eax, dword [0xf06fa0]
test eax, eax
je 0x45f11c
push 0xeef588
push esi
push ebx
push dword [ebp + 8]
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
test esi, esi
je 0x45f140
test bl, 3
je 0x45f140
movzx ecx, byte [ebx]
inc ebx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0xeef588]
sub esi, 1
jne 0x45f123
cmp esi, 4
jb 0x45f193
mov edi, esi
shr edi, 2
nop word [eax + eax]
xor eax, dword [ebx]
sub esi, 4
mov ecx, eax
add ebx, 4
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0xeef988]
xor edx, dword [ecx*4 + 0xeefd88]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0xeef588]
xor edx, dword [eax*4 + 0xef0188]
mov eax, edx
sub edi, 1
jne 0x45f150
test esi, esi
je 0x45f1b1
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0xeef588]
sub esi, 1
jne 0x45f197
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4614c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push dword [ecx + 0xc]
call fcn.0049b786
add esp, 8
test eax, eax
setne al
pop ebp
ret 4

Function at 0x4614f0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
and eax, 0xfffffffa
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
pop esi
ret
Function at 0x463fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
lea esi, [eax*4 + 4]
mov ebx, edx
push 0
push esi
mov edi, ecx
call fcn.0045c6b0
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jne 0x464013
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
push eax
call fcn.0048b190
mov esi, dword [ebp + 8]
lea ecx, [edi + ebx]
mov eax, dword [edi]
add esp, 0xc
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ecx
mov dword [esi], eax
add esi, 4
movzx edx, byte [edi]
movzx eax, byte [edi + 1]
shl edx, 8
add edx, eax
movzx eax, byte [edi + 2]
shl edx, 8
add edx, eax
movzx eax, byte [edi + 3]
shl edx, 8
add edi, 4
add edx, eax
cmp edi, ecx
jae 0x464107
mov ebx, dword [ebp - 4]
nop
mov eax, edx
shr eax, 0xc
xor eax, edx
shr eax, 3
xor eax, edx
and eax, dword [ebp + 0x10]
mov ecx, dword [ebx + eax*4]
mov dword [ebx + eax*4], esi
mov al, byte [edi]
inc edi
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x4640f3
cmp al, 0xf2
jne 0x4640f3
xor ebx, ebx
mov cl, byte [edi]
inc edi
movzx eax, cl
xor eax, 0xc
add ebx, eax
cmp cl, 0xf3
je 0x464085
mov dword [ebp - 0xc], edi
test ebx, ebx
je 0x4640e2
mov ecx, dword [ebp + 0xc]
dec ecx
add ecx, ebx
je 0x4640be
mov edi, dword [ebp - 8]
sub edi, esi
nop dword [eax]
mov al, byte [edi + esi]
mov byte [esi], al
inc esi
sub ecx, 1
jne 0x4640b0
mov edi, dword [ebp - 0xc]
movzx edx, byte [esi - 4]
movzx eax, byte [esi - 3]
mov ebx, dword [ebp - 4]
shl edx, 8
add edx, eax
movzx eax, byte [esi - 2]
shl edx, 8
add edx, eax
movzx eax, byte [esi - 1]
shl edx, 8
add edx, eax
jmp 0x4640fe
mov ebx, dword [ebp - 4]
shl edx, 8
mov byte [esi], 0xf2
or edx, 0xf2
jmp 0x4640fd
mov byte [esi], al
movzx eax, al
shl edx, 8
or edx, eax
inc esi
cmp edi, dword [ebp - 0x10]
jb 0x464060
push 0x8000
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
sub esi, dword [ebp - 0x14]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x468c20
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
add edx, 0xfffffffc
push ebx
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 4], edx
lea esi, [edi + ecx]
mov dword [ebp - 0xc], esi
cmp esi, edx
jae 0x468c55
nop dword [eax + eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x468c4f
inc esi
cmp esi, edx
jb 0x468c40
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x468d6d
cmp ecx, 3
jbe 0x468c94
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x14], ebx
test cl, cl
je 0x468cd2
cmp cl, 0xff
je 0x468cd2
mov edx, dword [ebp - 4]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x468c31
dec ecx
shl eax, cl
and eax, 7
je 0x468c6c
cmp byte [eax + 0xe7fa58], 0
je 0x468cbf
movzx ecx, byte [eax + 0xe7fa60]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x468cbc
cmp cl, 0xff
jne 0x468c6c
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and eax, 3
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x468c31
movzx ebx, cl
movzx ecx, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
sub ebx, edi
sub ebx, dword [ebp + 8]
test eax, eax
je 0x468d38
mov esi, dword [ebp + 8]
movzx edx, byte [eax + 0xe7fa60]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0x10], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x468d1d
cmp dl, 0xff
jne 0x468d35
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0x10]
shl edx, cl
dec edx
xor ebx, edx
sub ebx, esi
sub ebx, edi
jmp 0x468cfc
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
neg cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x14]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x468c31
pop esi
pop ebx
cmp ecx, 3
jbe 0x468d82
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4736c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push esi
mov dword [ebp - 0x14], eax
mov esi, dword [eax + 4]
mov dword [ebp - 0xc], esi
cmp esi, dword [eax + 8]
jae 0x473884
push ebx
push edi
nop dword [eax]
mov ebx, dword [esi + 4]
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi]
sub eax, ebx
cdq
idiv ecx
mov esi, dword [esi + 8]
inc eax
mov dword [ebp - 0x10], ebx
cmp esi, eax
cmovge esi, eax
cmp dword [ebp + 8], 0
mov eax, ecx
jne 0x4737cf
sub eax, 2
je 0x4737a6
sub eax, 2
je 0x47377d
lea edi, [esi - 1]
imul edi, ecx
add edi, ebx
cmp edi, ebx
jbe 0x47386d
mov eax, edi
sub eax, ecx
mov dword [ebp - 8], eax
nop word [eax + eax]
xor esi, esi
mov dword [ebp - 4], 0
test ecx, ecx
jle 0x47376d
nop dword [eax]
mov dl, byte [eax + esi]
mov bl, byte [esi + edi]
mov al, bl
sub al, dl
movzx edx, dl
sub al, byte [ebp - 4]
add edx, dword [ebp - 4]
mov byte [esi + edi], al
movzx eax, bl
cmp eax, edx
sbb eax, eax
inc esi
neg eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp esi, ecx
jl 0x473740
mov ebx, dword [ebp - 0x10]
sub edi, ecx
sub eax, ecx
mov dword [ebp - 8], eax
cmp edi, ebx
ja 0x473730
jmp 0x47386d
mov edx, dword [ebx]
lea esi, [ebx + esi*4]
add ebx, 4
cmp ebx, esi
jae 0x47386d
nop dword [eax]
mov ecx, dword [ebx]
mov eax, ecx
sub eax, edx
mov edx, ecx
mov dword [ebx], eax
add ebx, 4
cmp ebx, esi
jb 0x473790
jmp 0x47386d
movzx edx, word [ebx]
lea esi, [ebx + esi*2]
add ebx, 2
cmp ebx, esi
jae 0x47386d
movzx ecx, word [ebx]
mov eax, ecx
sub eax, edx
mov edx, ecx
mov word [ebx], ax
add ebx, 2
cmp ebx, esi
jb 0x4737b7
jmp 0x47386d
imul esi, ecx
lea edx, [esi + ebx]
mov dword [ebp - 0x10], edx
sub eax, 2
je 0x47384d
sub eax, 2
je 0x473831
lea edi, [ecx + ebx]
cmp edi, edx
jae 0x47386d
nop dword [eax]
xor esi, esi
mov dword [ebp - 8], 0
test ecx, ecx
jle 0x473827
nop dword [eax]
movzx edx, byte [ebx + esi]
add edx, dword [ebp - 8]
movzx eax, byte [esi + edi]
add eax, edx
mov byte [esi + edi], al
inc esi
cdq
and edx, 0xff
add eax, edx
sar eax, 8
mov dword [ebp - 8], eax
cmp esi, ecx
jl 0x473800
mov edx, dword [ebp - 0x10]
add edi, ecx
add ebx, ecx
cmp edi, edx
jb 0x4737f0
jmp 0x47386d
mov ecx, dword [ebx]
lea eax, [ebx + 4]
cmp eax, edx
jae 0x47386d
nop word [eax + eax]
add dword [eax], ecx
mov ecx, dword [eax]
add eax, 4
cmp eax, edx
jb 0x473840
jmp 0x47386d
movzx eax, word [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebx + 2]
cmp eax, edx
jae 0x47386d
mov cx, word [ebp - 0x10]
nop
add word [eax], cx
mov cx, word [eax]
add eax, 2
cmp eax, edx
jb 0x473860
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
add esi, 0xc
mov dword [ebp - 0xc], esi
cmp esi, dword [eax + 8]
jb 0x4736e0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x477c40
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0xec8960]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x20
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
lea ecx, [ebp - 0x34]
call fcn.00477b40
mov edi, dword [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualFree]
cmp edi, 0xa00000
jb 0x477c9e
lea ecx, [ebp - 0x2c]
call fcn.00477b40
lea ecx, [ebp - 0x2c]
call fcn.00477bb0
push 0x8000
push 0
push dword [ebp - 0x2c]
lea esi, [edi + eax]
call ebx
jmp 0x477ca0
xor esi, esi
mov eax, dword [ebp - 0x10]
cmp esi, eax
jae 0x477cd4
cmp edi, 0xa00000
jb 0x477cd0
lea ecx, [ebp - 0x2c]
call fcn.00477b40
lea ecx, [ebp - 0x2c]
call fcn.00477bb0
push 0x8000
push 0
push dword [ebp - 0x2c]
lea esi, [edi + eax]
call ebx
jmp 0x477cd6
xor esi, esi
jmp 0x477cd6
mov esi, eax
push 0x8000
push 0
push dword [ebp - 0x34]
call ebx
mov ecx, dword [ebp - 4]
lea eax, [esi - 0x500000]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004888df
mov esp, ebp
pop ebp
ret

Function at 0x477ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
push dword [ebp + 8]
push dword [ecx + 8]
call fcn.004a2cc3
add esp, 0xc
test eax, eax
jns 0x477f17
cmp dword [0xecedb0], 0
je 0x477f33
jmp 0x477f74
cdq
cmp eax, ebx
jne 0x477f21
cmp edx, dword [ebp + 0x10]
je 0x477f2c
cmp dword [0xecedb0], 0
je 0x477f80
jmp 0x477f74
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, 0x40000
call fcn.00477d00
mov ecx, 0x40000
mov edi, eax
call fcn.00477d00
push str.ERROR:_file_read_operation_failed
push edi
mov esi, eax
call fcn.0042e890
mov edx, esi
mov ecx, edi
call fcn.0045cec0
push esi
push 0xea0114
call fcn.00437320
add esp, 0x10
push 2
call fcn.00497ee7
push 1
push 0xeced70
call fcn.0048a9ab
mov ecx, 0x40000
call fcn.00477d00
mov ecx, 0x40000
mov edi, eax
call fcn.00477d00
push ebx
push str.ERROR:_cant_read__lu_bytes
push edi
mov esi, eax
call fcn.0042e890
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.0045cec0
push esi
push 0xea0114
call fcn.00437320
add esp, 8
push 2
call fcn.00497ee7
int3
Function at 0x479db0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0xec8960]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov esi, dword [ebx]
cmp dword [esi + 0x40068], 0
jne 0x479de3
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004888df
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x70], 0
je 0x479ee8
mov edi, dword [ebx + 0x68]
mov edx, dword [ebx + 0x6c]
mov eax, dword [ebx + 0x400d8]
not eax
mov ecx, dword [edi + 0x64]
cmp eax, dword [ecx + edx*4]
je 0x479e15
cmp dword [0xecedb0], 0
je 0x479f18
jmp 0x479f0c
cmp byte [esi], 0x74
je 0x479e2b
mov eax, dword [edi + 0x58]
cmp dword [eax + edx*4], 0
jne 0x479e2b
lea ecx, [ebx + 0x78]
call fcn.0045c630
mov eax, dword [ebx + 0x68]
mov esi, dword [ebx + 0x84]
mov ecx, dword [eax + 0x4c]
mov eax, dword [ebx + 0x6c]
mov edx, dword [ecx + eax*8]
mov eax, dword [ecx + eax*8 + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
test eax, eax
jg 0x479e5f
jl 0x479e51
test edx, edx
jae 0x479e5f
mov dword [ebp - 0x10], 0x7fffffff
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
call fcn.00499ea0
mov edx, eax
mov ecx, 0x76c
add esp, 4
add cx, word [edx + 0x14]
mov word [ebp - 0x20], cx
movzx ecx, word [edx + 0x10]
inc cx
mov word [ebp - 0x1e], cx
movzx ecx, word [edx + 0xc]
mov word [ebp - 0x1a], cx
movzx ecx, word [edx + 8]
mov word [ebp - 0x18], cx
movzx eax, word [edx + 4]
mov word [ebp - 0x16], ax
movzx eax, word [edx]
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
push 0
push 0x2000000
push 3
push 0
push 3
push 0x100
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebx]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x70], 0
pop edi
cmp dword [eax + 0x40068], 0
pop esi
setne al
xor ecx, ebp
pop ebx
call fcn.004888df
mov esp, ebp
pop ebp
ret
push 1
push 0xeced70
call fcn.0048a9ab
mov ecx, 0x40000
call fcn.00477d00
mov ecx, 0x40000
mov edi, eax
call fcn.00477d00
push dword [ebx + 0x88]
mov esi, eax
push str.ERROR:_file__s_failed_CRC_check
push edi
call fcn.0042e890
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.0045cec0
push esi
push 0xea0114
call fcn.00437320
add esp, 8
push 2
call fcn.00497ee7
int3
Function at 0x47e650
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0xecb880], 0
jne 0x47e669
push 0
push 0x10001
call fcn.0047d8a0
add esp, 8
ret
jmp fcn.0047f030

Function at 0x47f1c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x47f22e
push esi
lea ecx, [edi + edi]
push ecx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x47f209
push str.Win32:_Failed_to_allocate_global_handle_for_clipboard
push 0x10008
call fcn.00482810
add esp, 8
pop esi
pop edi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
jne 0x47f231
push str.Win32:_Failed_to_lock_global_handle
push 0x10008
call fcn.00482810
add esp, 8
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop esi
pop edi
pop ebp
ret
push edi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push dword [0xecc388]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x47f263
push str.Win32:_Failed_to_open_clipboard
jmp 0x47f219
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop edi
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]

Function at 0x47fd50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
xor edi, edi
mov ebx, 0x7fffffff
cmp dword [ebp + 8], edi
jle 0x47fd9a
mov ecx, dword [ebp + 0x10]
imul ecx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp + 0x10], ecx
nop
mov eax, dword [esi + 4]
imul eax, dword [esi]
sub eax, ecx
mov ecx, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
cmovge ecx, edi
add esi, 0xc
cmp eax, ebx
mov edi, ecx
mov ecx, dword [ebp + 0x10]
cmovge eax, ebx
sub dword [ebp + 8], 1
mov ebx, eax
jne 0x47fd70
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x480370
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0xec8960]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov dword [0xecd138], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x4803ca
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [ebp - 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0xecd128], xmm0
movd xmm0, dword [ebp - 8]
cvtdq2pd xmm0, xmm0
movsd qword [0xecd130], xmm0
cmp dword [edi + 0x64], 0x34001
jne 0x4803ef
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4803df
push dword [eax + 4]
jmp 0x4803f1
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
jmp 0x4803f1
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push edi
call fcn.0047bf10
add esp, 4
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
cmp dword [edi + 0x1e0], 0
je 0x48047e
mov eax, dword [edi + 0x2a4]
push 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 1
push eax
mov dword [ebp - 0x10], 0x20001
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x48047e
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.00482810
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004888df
mov esp, ebp
pop ebp
ret

Function at 0x480490
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x1e0], 0
je 0x4804dc
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x4804dc
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.00482810
add esp, 8
push 0
mov dword [0xecd138], 0
call dword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si eax, qword [0xecd130]
cvttsd2si ecx, qword [0xecd128]
mov dword [ebp - 4], eax
mov dword [esi + 0x2cc], eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x2a4]
mov dword [ebp - 8], ecx
mov dword [esi + 0x2c8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [esi + 0x64], 0x34001
jne 0x480563
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x48054a
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret