joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d39b6
Capabilities:
Get common file path

Disassembly:
push 0x254
mov eax, 0x5249b9
call fcn.004db767
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x250], eax
add eax, eax
cmp eax, 0x208
jae 0x4d3b68
sub esp, 0x18
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
mov ecx, esp
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x260], esp
push eax
call fcn.00404285
xor esi, esi
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.0046aae0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x234]
push str.msi.dll
call fcn.00404285
mov byte [ebp - 4], 2
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00430487
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.0040569b
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x254], esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24c]
mov eax, dword [ebp - 0x258]
sub eax, dword [ebp - 0x25c]
sar eax, 1
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x234]
push eax
call fcn.0046d480
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x4d3aa3
mov eax, dword [eax]
mov edi, dword [sym.imp.msi.dll_MsiMessageBoxW]
lea ecx, [ebp - 0x250]
push esi
push esi
push ecx
push esi
push eax
call edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
call fcn.0040569b
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x25c]
inc eax
push ecx
push eax
call fcn.0046e2f0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24c]
call fcn.0046d480
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x4d3af7
mov eax, dword [eax]
push esi
push esi
lea ecx, [ebp - 0x250]
push ecx
push dword [ebp - 0x25c]
push eax
call edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
call fcn.0040569b
mov edi, dword [ebp - 0x25c]
mov edx, esi
cmp edx, dword [ebp - 0x250]
jae 0x4d3b3f
movzx eax, word [edi + edx*2]
cmp eax, 0x2e
je 0x4d3b39
imul esi, esi, 0xa
add esi, 0xffffffd0
add esi, eax
inc edx
cmp edx, 3
jb 0x4d3b20
imul esi, esi, 0xa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x25c]
call fcn.0046df90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.0040569b
mov eax, esi
call fcn.004db711
ret
call fcn.004db3ad
int3
Function at 0x4d4d4b
Capabilities:
Delete directory

Disassembly:
push 0xc
mov eax, 0x524e6c
call fcn.004db733
mov esi, edx
mov ebx, ecx
call fcn.0040d33d
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d16b
mov dword [ebp - 4], 1
mov eax, dword [esi]
push 0x5c
pop edi
mov eax, dword [eax - 0xc]
test eax, eax
je 0x4d4dee
dec eax
mov ecx, esi
push eax
call fcn.00473c50
cmp ax, di
jne 0x4d4dee
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00406d83
mov byte [ebp - 4], 2
mov edx, dword [eax]
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x4d4ddd
cmp dword [edi + 0xc], 0
jl 0x4d4dd1
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4d4dd1
call fcn.004070e1
mov ecx, edi
mov esi, eax
call fcn.0040d645
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x4d4ddd
push dword [edx - 0xc]
lea ecx, [ebp - 0x10]
push edx
call fcn.0040d8ae
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040d645
jmp 0x4d4e2b
mov edx, dword [esi]
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x4d4e2b
cmp dword [edi + 0xc], 0
jl 0x4d4e1f
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4d4e1f
call fcn.004070e1
mov ecx, edi
mov esi, eax
call fcn.0040d645
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x4d4e2b
push dword [edx - 0xc]
lea ecx, [ebp - 0x10]
push edx
call fcn.0040d8ae
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx]
mov eax, dword [eax - 0xc]
cmp eax, dword [ecx - 0xc]
jge 0x4d4e8a
push 0x5c
push ecx
call fcn.004dee27
pop ecx
pop ecx
test eax, eax
jne 0x4d4e4b
or eax, 0xffffffff
jmp 0x4d4e4f
sub eax, dword [ebx]
sar eax, 1
push eax
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00406d83
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x4d4e7b
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.004d4d4b
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040d645
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0040d645
call fcn.004db6fc
ret
Function at 0x4d4e9f
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x524eaf
call fcn.004db733
mov ebx, edx
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x4d4f6f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0040d33d
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d16b
mov dword [ebp - 4], 1
push 0x5c
push dword [esi]
call fcn.004dee27
pop ecx
pop ecx
test eax, eax
je 0x4d4f50
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x4d4f50
push eax
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00406d83
mov byte [ebp - 4], 2
mov edx, dword [eax]
mov esi, dword [ebp - 0x10]
lea ecx, [edx - 0x10]
lea edi, [esi - 0x10]
cmp ecx, edi
je 0x4d4f3f
cmp dword [edi + 0xc], 0
jl 0x4d4f30
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4d4f30
call fcn.004070e1
mov ecx, edi
mov esi, eax
call fcn.0040d645
add esi, 0x10
mov dword [ebp - 0x10], esi
jmp 0x4d4f3f
push dword [edx - 0xc]
lea ecx, [ebp - 0x10]
push edx
call fcn.0040d8ae
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040d645
jmp 0x4d4f53
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x4d4f63
mov edx, ebx
lea ecx, [ebp - 0x10]
call fcn.004d4d4b
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.0040d645
call fcn.004db6fc
ret
Function at 0x4d55a9
Capabilities:
Check if file exists

Disassembly:
push 0x7c
mov eax, 0x525049
call fcn.004db767
mov dword [ebp - 0x78], edx
mov edx, ecx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x74], edx
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
and dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], ecx
mov ecx, edx
push eax
mov dword [ebp - 0x88], edx
call fcn.00404b28
push dword [ebp + 0x1c]
and dword [ebp - 4], 0
xor eax, eax
mov ecx, dword [ebp - 0x78]
inc eax
push esi
push edi
push ebx
push dword [ebp - 0x80]
mov ebx, dword [ebp - 0x84]
mov edx, ebx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x7c], eax
call fcn.004d5269
add esp, 0x14
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x4d561e
mov eax, dword [ebx]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
jne 0x4d573f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x78], esp
push ebx
call fcn.00404b28
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.0046aae0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x58]
call fcn.0046ddc0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x58]
call fcn.0046d410
mov edi, eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x40]
call fcn.0046d410
mov byte [ebp - 4], 5
mov edx, edi
cmp dword [edi + 0x14], 8
jb 0x4d5693
mov edx, dword [edi]
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x4d569d
mov ecx, dword [eax]
mov eax, dword [eax + 0x10]
cmp eax, dword [edi + 0x10]
jne 0x4d56b4
push eax
push edx
push ecx
call fcn.0040530d
add esp, 0xc
test eax, eax
je 0x4d56b8
mov byte [ebp - 0x74], 0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 4
call fcn.004056f2
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004056f2
cmp byte [ebp - 0x74], 0
je 0x4d5727
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.0046d480
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x4d56ee
mov eax, dword [eax]
push eax
call esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.004056f2
test esi, esi
je 0x4d5727
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.0046d480
push eax
mov ecx, ebx
mov byte [ebp - 4], 7
call fcn.00404232
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004056f2
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040dcb3
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.0040dcb3
mov eax, ebx
call fcn.004db711
ret
Function at 0x4d5de3
Capabilities:
Check os version

Disassembly:
push pe_nt_image_headers32
mov eax, 0x525148
call fcn.004db767
mov esi, ecx
mov dword [ebp - 0x128], esi
call fcn.0042e488
and dword [ebp - 4], 0
lea edi, [esi + 0x20]
push 0x58
push 0
push edi
call fcn.004de980
xor eax, eax
mov dword [esi + 0x78], 1
xor ecx, ecx
mov dword [edi], 0x58
lea ebx, [esi + 0x27c]
mov word [esi + 0x7c], cx
push 0x110
mov word [ebx], ax
lea eax, [ebp - 0x120]
push ecx
push eax
mov dword [ebp - 0x124], 0x114
call fcn.004de980
add esp, 0x18
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4d5e79
cmp dword [ebp - 0x120], 5
jae 0x4d5e7f
cmp dword [ebp - 0x120], 4
jne 0x4d5e79
cmp dword [ebp - 0x11c], 0x5a
jae 0x4d5e7f
mov dword [edi], 0x4c
and dword [esi + 0x5c], 0
lea eax, [esi + 0x7c]
mov dword [esi + 0x44], eax
mov eax, esi
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0x104
mov dword [esi + 0x48], 0x100
mov dword [esi + 0x54], 0x880024
mov dword [esi + 0x2c], 0x54a378
mov ecx, dword [0x57e2d8]
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x64], 0x42dd69
mov dword [esi + 0x24], ecx
call fcn.004db711
ret 0x18

Function at 0x4d6200
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4d951b
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x52520c
call fcn.004db767
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x4d9650
cmp byte [edi + 0x3e], bl
je 0x4d9650
mov eax, dword [edi]
mov ecx, 0xffff
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x52729c]
mov ecx, edi
call esi
mov ecx, 0xffff
cmp cx, ax
jne 0x4d9568
xor al, al
jmp 0x4d9652
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0045380e
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x4d959d
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d95a7
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call dword [0x52729c]
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x4d95d7
sub eax, 1
jne 0x4d9635
mov edi, dword [ebp - 0x30]
jmp 0x4d95dd
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3e], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d95ed
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x4d9617
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d95fe
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.004ecbdc
add esp, 0x10
cmp esi, eax
jne 0x4d9640
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3e], 0
je 0x4d963e
test esi, esi
jne 0x4d958f
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.0045371f
jmp 0x4d9589
dec eax
sub eax, 1
jne 0x4d9644
inc eax
jmp 0x4d9642
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00405ade
mov al, bl
jmp 0x4d9652
mov al, 1
call fcn.004db711
ret
Function at 0x4d9b2c
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x525261
call fcn.004db767
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x4d9b51
xor eax, eax
jmp 0x4d9cd8
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4d9b7d
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4d9b7d
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x4d9cd8
cmp dword [esi + 0x4c], 0
je 0x4d9cd5
mov ecx, esi
call fcn.004d9752
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4d9bb1
push dword [esi + 0x4c]
push edi
call fcn.004ec0d7
pop ecx
pop ecx
cmp ax, bx
je 0x4d9cd5
movzx ebx, di
jmp 0x4d9cd5
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.0045380e
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x34], edi
cmp ecx, 0x10
jb 0x4d9beb
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d9bf5
mov edx, eax
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x34]
mov esi, dword [edi]
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x38]
call dword [0x52729c]
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x4d9ccd
cmp eax, 1
jg 0x4d9ca7
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d9c40
mov edx, eax
mov edi, dword [ebp - 0x3c]
sub edi, edx
je 0x4d9c6f
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x4d9c51
mov edx, eax
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push edx
call fcn.004ecbdc
add esp, 0x10
cmp edi, eax
jne 0x4d9ca2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
jmp 0x4d9c72
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x40], edx
jne 0x4d9c9c
test edi, edi
jne 0x4d9bdd
cmp dword [ebp - 0x18], 0x20
jae 0x4d9cc7
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.0045371f
jmp 0x4d9bd7
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x4d9cc7
cmp eax, 3
jne 0x4d9ccd
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.004ec0d7
pop ecx
pop ecx
cmp ax, bx
je 0x4d9cc7
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
lea ecx, [ebp - 0x28]
call fcn.00405ade
mov ax, bx
call fcn.004db711
ret 4

Function at 0x4f669b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f635e

Function at 0x4f66a6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f64df
Function at 0x4ff17a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
mov eax, dword [0x57c080]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esp + 0x3c]
mov edi, dword [esi + 0x30]
movsx ebx, ax
shr eax, 0x10
movsx ebp, ax
jmp 0x4ff1e9
mov esi, dword [edi]
lea ecx, [esp + 0x1c]
xorps xmm0, xmm0
movups xmmword [esp + 0x1c], xmm0
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
push ebp
push ebx
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4ff1e6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
test al, al
je 0x4ff1e6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
test al, al
jne 0x4ff1ef
mov edi, dword [edi + 8]
test edi, edi
jne 0x4ff1a6
jmp 0x4ff215
xor eax, eax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x38], 0x205
lea ecx, [esp + 0x10]
push ecx
sete al
mov dword [esp + 0x18], ebp
inc eax
mov ecx, esi
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
call dword [eax + 0x4c]
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004dab24
add esp, 0x24
ret 8
Function at 0x4ff389
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x3c
mov eax, dword [0x57c080]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
push ebx
push ebp
movsx ebp, ax
mov ebx, ecx
shr eax, 0x10
and dword [edx], 0
push esi
cwde
push edi
mov edi, dword [ebx + 0x30]
mov dword [esp + 0x14], eax
jmp 0x4ff3fe
mov esi, dword [edi]
lea ecx, [esp + 0x34]
xorps xmm0, xmm0
movups xmmword [esp + 0x34], xmm0
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
push dword [esp + 0x14]
lea eax, [esp + 0x38]
push ebp
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4ff3fb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
test al, al
je 0x4ff3fb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
test al, al
jne 0x4ff428
mov edi, dword [edi + 8]
test edi, edi
jne 0x4ff3b8
mov ecx, dword [ebx + 0x34]
test ecx, ecx
je 0x4ff411
mov eax, dword [ecx]
call dword [eax + 0x54]
and dword [ebx + 0x34], edi
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004dab24
add esp, 0x3c
ret 0x10
mov ecx, dword [ebx + 0x34]
cmp esi, ecx
je 0x4ff43b
test ecx, ecx
je 0x4ff438
mov eax, dword [ecx]
call dword [eax + 0x54]
mov dword [ebx + 0x34], esi
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
mov dword [esp + 0x18], ebp
and ax, cx
lea edx, [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
xor cx, cx
cmp cx, ax
mov ecx, dword [ebx + 0x34]
push edx
sbb eax, eax
neg eax
mov dword [esp + 0x24], eax
mov eax, dword [ecx]
call dword [eax + 0x50]
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x2c], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
jmp 0x4ff411
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x2e964744
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4ba42fa2
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401c7f
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00404070
mov dword [esp], eax
mov eax, dword [0x40b2c8]
push eax
push eax
call fcn.00406192
lea ecx, [esp + 8]
pop edx
call fcn.00403100
push dword [esp]
push 0
push 0x40a00d
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
mov eax, dword [0x40b2c8]
push eax
push eax
push dword [esp + 8]
call fcn.00404090
lea ecx, [0x40b03c]
pop edx
call fcn.00403100
push dword [esp]
call fcn.004040e0
push dword [0x40b03c]
call fcn.00406100
push dword [0x40b03c]
call fcn.004061f3
mov eax, dword [0x40b2c8]
push eax
push eax
call fcn.00406035
lea ecx, [0x40b038]
pop edx
call fcn.00403100
mov eax, dword [esp + 0x14]
call fcn.00404100
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401d48
mov edx, dword [0x40b03c]
push dword [0x40b2c8]
call fcn.00407750
lea ecx, [0x40b038]
pop edx
call fcn.00403100
mov dword [esp + 0xc], 2
jmp 0x401d5a
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401d5a
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.00404100
mov dword [0x40b030], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
mov eax, ebx
call fcn.00404100
mov dword [0x40b034], eax
mov eax, 1
jmp 0x401d8d
push dword [esp + 4]
call fcn.004077b0
add esp, 0xc
pop ebx
ret 4
Function at 0x4020f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.004030f0
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x402149
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_LoadResource
mov dword [0x40b080], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x40b07c], eax
mov eax, dword [esp + 4]
jmp 0x402151
push dword [esp]
call fcn.004077b0
add esp, 8
ret 8
Function at 0x402830
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x15
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402837
mov edx, dword [esp + 0x60]
lea ecx, [esp]
call fcn.004030f0
mov edx, dword [esp + 0x64]
lea ecx, [esp + 4]
call fcn.004030f0
mov edx, dword [esp + 0x68]
lea ecx, [esp + 8]
call fcn.004030f0
mov edx, dword [esp]
push dword [0x40b2c8]
call fcn.00407750
mov edx, 0x40a00e
call fcn.00407750
mov edx, dword [esp + 0xc]
call fcn.00407750
lea ecx, [esp + 0x10]
pop edx
call fcn.00403100
lea eax, [esp + 0x10]
lea ebp, [esp + 0x10]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, str.open
mov dword [ebp + 0xc], eax
mov eax, str.wscript
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
mov dword [ebp + 0x18], eax
lea eax, [esp + 0x10]
push eax
call sub.SHELL32.dll_ShellExecuteExA
mov dword [esp + 0x4c], eax
push 0x19
call sub.KERNEL32.dll_Sleep
lea eax, [esp + 0x50]
push eax
lea ebp, [esp + 0x14]
push dword [ebp + 0x38]
call sub.KERNEL32.dll_GetExitCodeProcess
and eax, eax
je 0x40290b
mov ebx, dword [esp + 0x50]
cmp ebx, 0x103
je 0x40290b
jmp 0x40290d
jmp 0x4028de
mov eax, 1
jmp 0x402916
push dword [esp]
call fcn.004077b0
push dword [esp + 4]
call fcn.004077b0
push dword [esp + 8]
call fcn.004077b0
push dword [esp + 0xc]
call fcn.004077b0
add esp, 0x54
pop ebx
pop ebp
ret 0xc

Function at 0x403afa
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403b12
push dword [esp + 4]
push 0x403a93
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403b4f
push esi
mov esi, dword [0x40b0dc]
test esi, esi
je 0x403b4e
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403b46
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40b0dc
call fcn.00406a7d
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403b1f
pop edi
pop ebx
pop esi
ret 4

Function at 0x403f37
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
push 0x64
pop edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call esi
test eax, eax
je 0x403fdb
mov eax, dword [ebp - 0xc]
dec eax
je 0x403fbe
dec eax
jne 0x403fdb
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x403fba
dec eax
je 0x403fb6
dec eax
je 0x403f9c
dec eax
jne 0x403fdb
push 0x46
pop edi
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x9c
call esi
test eax, eax
je 0x403fdb
cmp byte [ebp - 0x1e], 1
je 0x403fdb
push 0x4b
jmp 0x403fda
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x403fb2
dec eax
je 0x403fae
dec eax
jne 0x403fdb
push 0x41
jmp 0x403fda
push 0x3c
jmp 0x403fda
push 0x32
jmp 0x403fda
push 0x14
jmp 0x403fda
push 5
jmp 0x403fda
cmp dword [ebp - 0x14], 0
je 0x403fd8
cmp dword [ebp - 0x14], 0xa
je 0x403fd4
cmp dword [ebp - 0x14], 0x5a
jne 0x403fdb
push 0x28
jmp 0x403fda
push 0x1e
jmp 0x403fda
push 0xa
pop edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret