joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f37
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x42a280
mov eax, 0x2134
call fcn.004c11d0
mov eax, dword [0x53bbf0]
xor eax, esp
mov dword [esp + 0x2130], eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push str.kernel32.dll
mov dword [esp + 0x14], ebx
lea esi, [esp + 0x144]
mov byte [esp + 0x144], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x42a472
nop
mov ebp, 0x57c665
push str.CreateToolhelp32Snapshot
push edi
call ebp
push str.Process32First
push edi
mov ebx, eax
call ebp
push str.Process32Next
push edi
mov dword [esp + 0x1c], eax
call ebp
test ebx, ebx
mov ebp, eax
je 0x42a451
push 0
push 2
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x42a378
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], 0x128
call dword [esp + 0x1c]
test eax, eax
je 0x42a371
lea ecx, [esp + 0x3c]
push 0x5c
push ecx
call fcn.004c0af0
add esp, 8
test eax, eax
jne 0x42a330
lea eax, [esp + 0x3c]
jmp 0x42a333
add eax, 1
lea edx, [esp + 0x140]
cmp esi, edx
je 0x42a344
mov byte [esi], 0x2c
add esi, 1
push eax
push str._P:_s_
push esi
call fcn.004c1313
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42a358
sub eax, edx
add esi, eax
lea eax, [esp + 0x18]
push eax
push edi
call ebp
test eax, eax
jne 0x42a317
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x10]
xor ebp, ebp
push ebp
push 0x4016ae
mov dword [ebx + 0x35b4], ebp
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebx + 0x35b4], ebp
jle 0x42a403
lea edi, [ebx + 0x35b8]
mov edi, edi
cmp dword [esp + 0x2148], 0
jge 0x42a3c0
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42a3b0
sub eax, edx
cmp eax, 0x50
jae 0x42a3f2
lea edx, [esp + 0x140]
cmp esi, edx
je 0x42a3d1
mov byte [esi], 0x2c
add esi, 1
push edi
push str._W:_s_
push esi
call fcn.004c1313
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42a3e5
sub eax, edx
add esi, eax
add ebp, 1
add edi, 0x96
cmp ebp, dword [ebx + 0x35b4]
jl 0x42a3a0
push 0x2ee0
push 0
add ebx, 0x35b8
push ebx
call fcn.004c14b0
mov edx, dword [esp + 0x2154]
mov ecx, dword [0x56391c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x74]
add esp, 0xc
push edx
lea edx, [esp + 0x144]
push edx
call eax
mov ecx, dword [esp + 0x2140]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c118f
add esp, 0x2134
ret 4
mov cx, word [0x512348]
mov dl, byte [0x51234a]
mov word [esp + 0x140], cx
mov byte [esp + 0x142], dl
jmp 0x42a378
mov ax, word [0x512348]
mov cl, byte [0x51234a]
mov word [esp + 0x140], ax
mov byte [esp + 0x142], cl
jmp 0x42a37c
Function at 0x4020f9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
jmp 0x45d4b0
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
lea esi, [edi + 0x1b0]
or eax, 0xffffffff
cmp edi, esi
mov ebp, ecx
mov edx, edi
jae 0x45d4f1
lea ebx, [ebx]
movzx ecx, byte [edx]
xor ecx, eax
sar eax, 8
and ecx, 0xff
and eax, 0xffffff
xor eax, dword [ecx*4 + 0x53a208]
add edx, 1
cmp edx, esi
jb 0x45d4d0
not eax
mov dword [ebp + 0x88], eax
mov dword [ebp + 0x66], eax
lea esi, [ebp + 0x98]
mov dword [esp + 0x10], 0x12
mov edx, 2
nop
mov ebp, 0xc
movzx eax, word [edi]
mov cl, ah
and cl, 0xf8
mov byte [esp + 0x1a], cl
mov ecx, eax
shr ecx, 5
add al, al
add cl, cl
add al, al
add cl, cl
add al, al
mov byte [esp + 0x19], cl
mov byte [esp + 0x18], al
mov ecx, dword [esp + 0x18]
mov ebx, ecx
shr ebx, 0x10
movzx bx, bl
shr ecx, 8
and bx, 0xfff8
movzx cx, cl
shl bx, 5
shr al, 3
or bx, cx
cmp dword [0x576828], edx
movzx ax, al
jne 0x45d56e
and bx, 0xfff8
jmp 0x45d576
and bx, 0xfffc
add bx, bx
add bx, bx
add bx, bx
or bx, ax
movzx eax, bx
mov word [esi], ax
add edi, edx
add esi, edx
sub ebp, 1
jne 0x45d515
sub dword [esp + 0x10], 1
jne 0x45d510
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x402207
Capabilities:
Encode data using xor

Disassembly:
jmp 0x459a80
mov eax, dword [0x563908]
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov cl, 0xff
cmp byte [eax + 0x7790], cl
push edi
jne 0x459aa7
cmp byte [eax + 0x7791], cl
jne 0x459aa7
cmp byte [eax + 0x7792], cl
je 0x459acf
mov eax, dword [eax + 0x7790]
mov ecx, dword [0x576828]
mov edi, dword [esi + 0x4c]
mov ebx, dword [edi]
push 0
push eax
push ecx
call fcn.0040223e
movzx edx, ax
mov eax, dword [ebx + 0x28]
add esp, 8
push edx
mov ecx, edi
call eax
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x459be1
mov edx, dword [esi + 0x4c]
push ebp
push 0
push 0
push 0
push 3
push 0
push 0
push edx
push 0
call fcn.004a4dc0
mov ecx, dword [esi + 0xc]
mov ebp, dword [ecx + 0x168]
movsx eax, word [ebp + 6]
cdq
mov edi, eax
movsx eax, word [ebp + 0x1e]
xor edi, edx
sub edi, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esi + 0x4c]
mov ebx, dword [edx + 8]
sub ebx, eax
movsx eax, word [ebp + 0x12]
cdq
xor eax, edx
sub eax, edx
test eax, eax
pop ebp
jle 0x459b5e
cmp edi, ebx
jge 0x459b5e
lea esp, [esp]
mov eax, dword [esi + 0x4c]
push 0
push 0
push 0
push 3
push edi
push 0
push eax
push 1
call fcn.004a4dc0
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + 0x168]
movsx eax, word [edx + 0x12]
cdq
xor eax, edx
sub eax, edx
add edi, eax
cmp edi, ebx
jl 0x459b30
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x168]
movsx eax, word [eax + 0x1e]
mov edi, dword [esi + 0x4c]
push 0
push 0
cdq
xor eax, edx
push 0
sub eax, edx
mov edx, dword [edi + 8]
push 3
sub edx, eax
push edx
push 0
push edi
push 2
call fcn.004a4dc0
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x168]
movsx eax, word [eax + 4]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esi + 0x4c]
cmp eax, dword [edx + 4]
jge 0x459be1
mov eax, dword [ecx + 0x168]
movsx eax, word [eax + 4]
mov esi, dword [esi + 0x4c]
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
mov edx, dword [esi + 8]
mov dword [esp + 0x18], edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0xc]
push ecx
push 0
mov ecx, esi
call edx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x402243
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
jmp 0x4426d0
sub esp, 8
push edi
push 0
mov edi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x442816
push ebp
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0xc], ebp
je 0x44280b
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
lea ecx, [edi + 0x9420]
mov eax, ecx
mov dword [esp + 0x10], ebx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x442717
mov cl, byte [ecx]
sub eax, esi
cmp cl, 0x3f
je 0x442733
cmp cl, 0x2a
mov ecx, 0x400
jne 0x442738
mov ecx, 0xc8
sub ecx, eax
sub ecx, 1
test ecx, ecx
jle 0x442802
mov eax, ebx
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x442750
sub eax, esi
cmp ecx, eax
jge 0x442763
mov ebx, ecx
jmp 0x442771
lea ecx, [ebx + 1]
mov al, byte [ebx]
add ebx, 1
test al, al
jne 0x442766
sub ebx, ecx
mov esi, dword [edi + 0x9820]
lea ebp, [esi + edi + 0x9420]
mov eax, ebp
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x442783
sub eax, ecx
add eax, 1
push eax
add esi, ebx
lea eax, [esi + edi + 0x9420]
push ebp
push eax
call fcn.004c3dd0
mov ecx, dword [edi + 0x9820]
mov edx, dword [esp + 0x1c]
push ebx
lea esi, [ecx + edi + 0x9420]
push edx
push esi
call fcn.004c1720
mov eax, dword [edi + 0x14]
mov ecx, dword [eax + 0x804]
movsx ecx, word [ecx + 0xa8]
add ecx, dword [eax + 0x80c]
add esp, 0x18
test ebx, ebx
jle 0x4427f8
mov edx, ebx
lea ebx, [ebx]
mov al, byte [esi]
cmp al, 0x20
jl 0x4427ed
movsx eax, al
cmp eax, ecx
jl 0x4427f0
mov byte [esi], 0x20
add esi, 1
sub edx, 1
jne 0x4427e0
add dword [edi + 0x9820], ebx
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop esi
pop ebx
pop ebp
pop edi
add esp, 8
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
add esp, 8
ret
Function at 0x402338
Capabilities:
Enumerate files on windows
Read file on windows

Disassembly:
jmp 0x40c600
sub esp, 0x188
mov eax, dword [0x53bbf0]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push ebp
lea eax, [esp + 0x4c]
push eax
mov ebp, ecx
push 0x511348
mov dword [ebp + 0x3fc], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
je 0x40c7cb
push esi
push edi
lea ecx, [esp + 0x80]
push 0x510e68
push ecx
call fcn.004c20fd
mov edi, eax
add esp, 8
test edi, edi
je 0x40c7a2
push edi
push 0xe
lea edx, [esp + 0x24]
push 1
push edx
call fcn.004c1e2a
push edi
push 0x28
lea eax, [esp + 0x44]
push 1
push eax
call fcn.004c1e2a
add esp, 0x20
cmp word [esp + 0x1c], 0x4d42
jne 0x40c799
cmp word [esp + 0x3a], 0x18
jne 0x40c799
cmp dword [esp + 0x3c], 0
jne 0x40c799
mov ecx, dword [ebp + 0x3fc]
imul ecx, ecx, 0x1f0
push 0x40
lea edx, [esp + 0x84]
lea esi, [ecx + ebp + 0x5b0]
push edx
push esi
call fcn.004c0c10
add esp, 0xc
mov byte [esi + 0x3f], 0
cmp dword [esp + 0x30], 0x12
jne 0x40c799
cmp dword [esp + 0x34], 0xc
jne 0x40c799
mov dword [esp + 0x10], 0xb
nop
xor esi, esi
push edi
call fcn.004c2e5b
push edi
mov bl, al
call fcn.004c2e5b
push edi
mov byte [esp + 0x21], al
call fcn.004c2e5b
movzx cx, byte [esp + 0x21]
movzx ax, al
and ax, 0xfff8
shl ax, 5
shr bl, 3
add esp, 0xc
or ax, cx
cmp dword [0x576828], 2
movzx dx, bl
jne 0x40c738
and ax, 0xfff8
jmp 0x40c73f
and ax, 0xfffc
add ax, ax
mov ecx, dword [ebp + 0x3fc]
imul ecx, ecx, 0xf8
add ax, ax
add ax, ax
or ax, dx
add ecx, esi
add ecx, dword [esp + 0x10]
movzx eax, ax
add esi, 0xc
cmp esi, 0xd8
mov word [ebp + ecx*2 + 0x400], ax
jl 0x40c6f2
mov esi, 2
push edi
call fcn.004c2e5b
add esp, 4
sub esi, 1
jne 0x40c775
sub dword [esp + 0x10], 1
jns 0x40c6f0
add dword [ebp + 0x3fc], 1
mov ebx, dword [esp + 0x18]
push edi
call fcn.004c1af7
add esp, 4
cmp dword [ebp + 0x3fc], 0x1f4
jge 0x40c7c2
lea edx, [esp + 0x54]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c643
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov ecx, dword [esp + 0x18c]
pop ebp
pop ebx
xor ecx, esp
call fcn.004c118f
add esp, 0x188
ret
Function at 0x402716
Capabilities:
Write file on windows

Disassembly:
jmp 0x409ce0
push ebx
push esi
mov esi, ecx
lea eax, [esi + 4]
push 0x5111c8
push eax
call fcn.004c20fd
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x409d5a
push ebp
xor ebp, ebp
cmp dword [esi + 0x208], ebp
jle 0x409d50
push edi
xor edi, edi
lea esp, [esp]
mov ecx, dword [esi + 0x204]
push ebx
push 4
add ecx, edi
push 1
push ecx
call fcn.004c2a02
mov edx, dword [esi + 0x204]
push ebx
push 0x1b0
lea eax, [edx + edi + 8]
push 1
push eax
call fcn.004c2a02
add ebp, 1
add esp, 0x20
add edi, 0x1b8
cmp ebp, dword [esi + 0x208]
jl 0x409d10
pop edi
push ebx
call fcn.004c1af7
add esp, 4
pop ebp
mov eax, dword [esi + 0x204]
test eax, eax
je 0x409d77
push eax
call fcn.004c21b6
add esp, 4
mov dword [esi + 0x204], 0
pop esi
pop ebx
ret

Function at 0x402725
Capabilities:
Terminate process
Write file on windows

Disassembly:
jmp 0x42e380
sub esp, 0x208
mov eax, dword [0x53bbf0]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x22c]
push 0x562f88
lea eax, [esp + 0x118]
push str._s.exe
push eax
mov ebp, ecx
call fcn.004c1313
lea ecx, [esp + 0x120]
push ecx
push esi
call fcn.004c16c5
add esp, 0x14
test eax, eax
jne 0x42e412
mov esi, str.infup.exe
lea esp, [esp]
mov cl, byte [eax + str.infup.exe]
mov byte [eax + 0x563088], cl
add eax, 1
test cl, cl
jne 0x42e3e0
cmp dword [esp + 0x220], 0
je 0x42e412
lea edx, [esp + 0x114]
push edx
push str.infup.exe
call fcn.0048d3e0
add esp, 8
mov eax, dword [esp + 0x228]
mov edx, dword [esp + 0x230]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
push edi
call fcn.004b75c0
add esp, 0x10
cmp dword [esp + 0x220], 0
mov ebx, eax
je 0x42e47f
mov eax, dword [esp + 0x10]
push eax
push ebx
push esi
call fcn.004b6860
add esp, 0xc
test al, al
jne 0x42e4aa
push esi
lea ecx, [esp + 0x18]
push str.Could_not_upgrade_file:__s
push ecx
call fcn.004c1313
mov eax, dword [ebp + 0xc]
add esp, 0xc
push 0x10
push 0x510f80
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.004c277d
push 0x5111c8
push esi
call fcn.004c20fd
mov edi, eax
add esp, 8
test edi, edi
je 0x42e4ce
mov ecx, dword [esp + 0x10]
push edi
push ecx
push 1
push ebx
call fcn.004c2a02
push edi
call fcn.004c1af7
add esp, 0x14
push ebx
call fcn.004c21b6
mov ecx, dword [esp + 0x218]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c118f
add esp, 0x208
ret 0x18
push esi
lea edx, [esp + 0x18]
push str.Could_not_open_file_for_upgrading:__s
push edx
call fcn.004c1313
mov ecx, dword [ebp + 0xc]
add esp, 0xc
push 0x10
push 0x510f80
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.004c277d
int3
Function at 0x404e90
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x404e90
mov eax, 0x14408
call fcn.004c11d0
mov eax, dword [0x53bbf0]
xor eax, esp
mov dword [esp + 0x14404], eax
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 8], 0x14400
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x404ee6
lea ecx, [esp + 4]
mov eax, 6
jmp 0x404ed0
cmp dword [ecx + 0x190], eax
jne 0x404ee0
cmp dword [ecx + 0x1a0], eax
je 0x404eff
mov ecx, dword [ecx]
test ecx, ecx
jne 0x404ed0
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x14404]
xor ecx, esp
call fcn.004c118f
add esp, 0x14408
ret
movzx eax, byte [ecx + 0x194]
cdq
shld edx, eax, 8
push esi
shl eax, 8
mov esi, eax
movzx eax, byte [ecx + 0x195]
push edi
mov edi, edx
cdq
or esi, eax
movzx eax, byte [ecx + 0x196]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x197]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x198]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x199]
mov ecx, dword [esp + 0x1440c]
or edi, edx
shld edi, esi, 8
cdq
shl esi, 8
or edi, edx
or esi, eax
mov edx, edi
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.004c118f
add esp, 0x14408
ret
Function at 0x40c190
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push edi
lea ebx, [esi + 0x28]
push ebx
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0xc]
lea edi, [esi + 0x24]
push edi
push eax
mov eax, dword [ebp + 8]
push eax
call edx
cmp dword [esp + 0x3c], eax
mov dword [esi + 0x20], eax
je 0x40c1f9
cmp eax, 7
je 0x40c1e1
cmp eax, 6
je 0x40c1e1
cmp eax, 5
je 0x40c1e1
cmp eax, 9
je 0x40c1e1
cmp eax, 0xa
jne 0x40c1f9
mov eax, dword [0x563908]
mov ecx, dword [eax + 0x5a8]
push 0
push 0
push 0
push 0
call fcn.004a7120
mov eax, 4
cmp dword [esi + 0x20], eax
jne 0x40c295
test byte [ebp + 0x10], al
jne 0x40c295
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x40c233
fld qword [esi + 0x4c]
sub esp, 0x18
fstp qword [esp + 0x10]
fld qword [esi + 0x44]
fstp qword [esp + 8]
fld qword [esi + 0x3c]
jmp 0x40c254
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x40c295
fld qword [esi + 0x64]
sub esp, 0x18
fstp qword [esp + 0x10]
fld qword [esi + 0x5c]
fstp qword [esp + 8]
fld qword [esi + 0x54]
mov ecx, dword [esi + 0x34]
fstp qword [esp]
mov eax, 0x38e38e39
imul ecx
mov eax, dword [edi]
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebx]
cdq
idiv ecx
mov ebx, eax
call fcn.0048db20
lea ecx, [edi + edi*2]
lea edx, [ebx + ecx*4]
mov dword [esi + edx*4 + 0x94], eax
mov dword [esi + 0x38], 1
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c600
Capabilities:
Enumerate files on windows
Read file on windows

Disassembly:
jmp 0x40c600
sub esp, 0x188
mov eax, dword [0x53bbf0]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push ebp
lea eax, [esp + 0x4c]
push eax
mov ebp, ecx
push 0x511348
mov dword [ebp + 0x3fc], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
je 0x40c7cb
push esi
push edi
lea ecx, [esp + 0x80]
push 0x510e68
push ecx
call fcn.004c20fd
mov edi, eax
add esp, 8
test edi, edi
je 0x40c7a2
push edi
push 0xe
lea edx, [esp + 0x24]
push 1
push edx
call fcn.004c1e2a
push edi
push 0x28
lea eax, [esp + 0x44]
push 1
push eax
call fcn.004c1e2a
add esp, 0x20
cmp word [esp + 0x1c], 0x4d42
jne 0x40c799
cmp word [esp + 0x3a], 0x18
jne 0x40c799
cmp dword [esp + 0x3c], 0
jne 0x40c799
mov ecx, dword [ebp + 0x3fc]
imul ecx, ecx, 0x1f0
push 0x40
lea edx, [esp + 0x84]
lea esi, [ecx + ebp + 0x5b0]
push edx
push esi
call fcn.004c0c10
add esp, 0xc
mov byte [esi + 0x3f], 0
cmp dword [esp + 0x30], 0x12
jne 0x40c799
cmp dword [esp + 0x34], 0xc
jne 0x40c799
mov dword [esp + 0x10], 0xb
nop
xor esi, esi
push edi
call fcn.004c2e5b
push edi
mov bl, al
call fcn.004c2e5b
push edi
mov byte [esp + 0x21], al
call fcn.004c2e5b
movzx cx, byte [esp + 0x21]
movzx ax, al
and ax, 0xfff8
shl ax, 5
shr bl, 3
add esp, 0xc
or ax, cx
cmp dword [0x576828], 2
movzx dx, bl
jne 0x40c738
and ax, 0xfff8
jmp 0x40c73f
and ax, 0xfffc
add ax, ax
mov ecx, dword [ebp + 0x3fc]
imul ecx, ecx, 0xf8
add ax, ax
add ax, ax
or ax, dx
add ecx, esi
add ecx, dword [esp + 0x10]
movzx eax, ax
add esi, 0xc
cmp esi, 0xd8
mov word [ebp + ecx*2 + 0x400], ax
jl 0x40c6f2
mov esi, 2
push edi
call fcn.004c2e5b
add esp, 4
sub esi, 1
jne 0x40c775
sub dword [esp + 0x10], 1
jns 0x40c6f0
add dword [ebp + 0x3fc], 1
mov ebx, dword [esp + 0x18]
push edi
call fcn.004c1af7
add esp, 4
cmp dword [ebp + 0x3fc], 0x1f4
jge 0x40c7c2
lea edx, [esp + 0x54]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c643
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov ecx, dword [esp + 0x18c]
pop ebp
pop ebx
xor ecx, esp
call fcn.004c118f
add esp, 0x188
ret
Function at 0x411e70
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x411e70
push 0xffffffffffffffff
push 0x50931b
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x53bbf0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53bbf0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
xor eax, eax
xor ebp, ebp
mov ebx, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebp
xor edi, edi
cmp eax, edi
jne 0x412062
push 0x6c
call fcn.004c1ea3
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, edi
mov dword [esp + 0x58], edi
je 0x411ef4
push 0x400
push 0x14
push 0x2000
push 0x1000
push edi
push 4
push 0x4027ca
push edi
push edi
mov ecx, eax
call fcn.004a7c00
mov edi, eax
mov eax, dword [ebx + ebp*4 + 0x2144]
push 1
mov ecx, ebp
shl ecx, 8
lea edx, [ecx + ebx + 0x1f44]
push eax
push edx
mov ecx, edi
mov dword [esp + 0x64], 0xffffffff
call fcn.004a88e0
mov esi, eax
test esi, esi
je 0x41203a
call fcn.00401d39
mov ebp, eax
jmp 0x411f30
mov eax, dword [0x56c728]
or eax, dword [0x56c72c]
jne 0x411f53
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
mov eax, edx
shr eax, 3
jmp 0x411f8b
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
push 0x64
push eax
push ecx
call fcn.004c0bd0
mov ecx, dword [0x56c72c]
push ecx
mov ecx, dword [0x56c728]
push ecx
push edx
push eax
call fcn.004c0b20
and eax, 0x7fffffff
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x2bc
jge 0x411fb8
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x411fb8
cmp dword [esi + 0xc], 2
je 0x411fbe
mov ecx, edi
call fcn.004a96a0
jmp 0x411f30
cmp dword [esi + 0xc], 2
jne 0x41202f
lea eax, [ebx + 0x224c]
lea edx, [esp + 0x29]
mov dword [esp + 0x14], 1
mov byte [esp + 0x28], 1
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x411fd7
push 0x21
lea edx, [esp + 0x2c]
push edx
push 0
mov ecx, esi
call fcn.004a9380
call fcn.00401d39
test ebx, ebx
mov dword [0x53e6ac], ebx
je 0x41202f
cmp dword [esi + 0xc], 2
jne 0x41202f
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x412027
mov ecx, edi
call fcn.004a96a0
cmp dword [0x53e6ac], 0
jne 0x412002
jmp 0x41202f
mov dword [esp + 0x18], 2
mov ecx, esi
call fcn.004a8450
mov ebp, dword [esp + 0x18]
test edi, edi
je 0x41204e
mov ecx, edi
call fcn.004a8870
push edi
call fcn.004c130e
add esp, 4
mov eax, dword [esp + 0x14]
add ebp, 1
cmp ebp, 2
mov dword [esp + 0x18], ebp
jl 0x411eb0
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004c118f
add esp, 0x48
ret
Function at 0x4163d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x4163d0
push 0xffffffffffffffff
push 0x509658
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53bbf0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 4], eax
mov dword [esi], vtable.FloatReassignKey.0
mov dword [esi + 8], ecx
xor eax, eax
mov dword [esi + 0x81c], eax
mov dword [esi + 0x820], eax
mov dword [esi + 0x824], eax
xor edi, edi
mov dword [esi + 0x818], edi
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x828], edi
mov ecx, dword [0x56390c]
mov dword [esp + 0x20], edi
call fcn.004a9f90
mov ecx, dword [0x56390c]
call fcn.004a9fa0
mov ebp, eax
cmp ebp, edi
jle 0x416479
lea ebx, [esi + 0x18]
mov ecx, dword [0x56390c]
push edi
call fcn.004a9e50
mov dword [ebx], eax
add edi, 1
add ebx, 4
cmp edi, ebp
jl 0x416461
mov ecx, dword [0x563908]
push esi
call fcn.004024d2
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4201e7
Capabilities:
Write file on windows

Disassembly:
jmp 0x4201e0
mov eax, dword [esp + 4]
cmp eax, 4
push esi
mov esi, ecx
ja case.default.0x4201f1
push edi
jmp dword [eax*4 + 0x420350]
cmp dword [esp + 0x14], 0
jne 0x42034b
mov ecx, dword [esi + 0x17f8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
cmp eax, 7
jne 0x42034b
mov ecx, dword [esi + 0x17f8]
lea eax, [esi + 0x30b4]
push eax
call fcn.00401d0c
pop edi
pop esi
ret 0xc
cmp dword [esp + 0x14], 0
jne 0x42034b
mov ecx, dword [0x56391c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x90]
lea eax, [esi + 0x6ac]
push eax
lea eax, [esi + 0x5ac]
push eax
add esi, 0x62c
push esi
call edx
pop edi
pop esi
ret 0xc
cmp dword [esp + 0x14], 0
jne 0x4202a5
lea eax, [esi + 0x6ec]
push 0x5111c8
push eax
call fcn.004c20fd
mov edi, eax
add esp, 8
test edi, edi
je 0x4202a5
mov ecx, dword [esi + 0x770]
mov edx, dword [esi + 0x76c]
push edi
push 1
push ecx
push edx
call fcn.004c2a02
push edi
call fcn.004c1af7
add esp, 0x14
mov eax, dword [esi + 0x76c]
test eax, eax
je 0x42034b
push eax
call fcn.004c21b6
add esp, 4
pop edi
mov dword [esi + 0x76c], 0
pop esi
ret 0xc
mov eax, dword [esp + 0x10]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x13ec
jg 0x42034b
mov ecx, dword [esi + 0x1788]
mov edi, dword [ecx + eax*4 + 0x1f48]
test edi, edi
je 0x42034b
movzx edx, word [edi + 0x80]
mov ax, word [esi + 0xf4]
mov cx, word [esi + 0xf8]
mov word [esi + 0x6c34], dx
movzx edx, word [esi + 0x100]
mov word [esi + 0x6c36], ax
mov eax, dword [esp + 0x14]
mov word [esi + 0x6c38], cx
mov word [esi + 0x6c3a], dx
mov dword [esi + 0x6c2c], eax
mov dword [esi + 0x6c30], 0
add esi, 0xfffffffc
push edi
mov ecx, esi
call fcn.004026d0
push edi
mov ecx, esi
call fcn.004019e7
pop edi
pop esi
ret 0xc