joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482e9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x482fee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x482fee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.00482ff8
test eax, eax
je 0x482fee
add ebx, 0x28
dec ecx
jne 0x482fc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x48309e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x4830c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x48312e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x4830e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x48312e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x483105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x48312e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x483123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x48312e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x48316b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x483172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4831a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4831a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x483dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00483f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00483f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.00483eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00483f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00483ecb
push ecx
push dword [ebp + 8]
call fcn.00483f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00483f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00483ecb
push ecx
push dword [ebp + 8]
call fcn.00483f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00483f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00483ecb
push ecx
push dword [ebp + 8]
call fcn.00483f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00483f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00483ecb
cmp ecx, 0x2b
jne 0x483e0f
leave
ret 0xc

Function at 0x4854b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x485544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x75eb0
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4855d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x75eb0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x75eb0
call fcn.004853fa
push 0x75eb0
push dword [ebp + 0xc]
call fcn.004831a8
test eax, eax
jne 0x4855b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x75eb0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004855dd
test eax, eax
je 0x4855d6
jmp 0x485574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4855d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x48560b
Capabilities:
Terminate process

Disassembly:
call fcn.00485618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40a5f0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x40a615
or esi, 1
push 1
call edi
test ax, ax
jns 0x40a621
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x40a62d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x40a639
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x40b660
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x1c8], edi
jle 0x40b6af
nop dword [eax + eax]
mov eax, dword [esi + 0x1c4]
lea edx, [ebp + 0xb]
mov byte [ebp + 0xb], 0
push edx
push dword [ebp + 0x10]
mov ecx, dword [eax + edi*4]
push dword [ebp + 0xc]
push ebx
mov eax, dword [ecx]
call dword [eax]
cmp byte [ebp + 0xb], 0
jne 0x40b847
inc edi
cmp edi, dword [esi + 0x1c8]
jl 0x40b680
sub ebx, 0x100
je 0x40b7d0
sub ebx, 4
je 0x40b71f
sub ebx, 2
jne 0x40b7c5
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.0074f74c
mov ecx, dword [esi + 0x144]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push reloc.OLEAUT32.dll_VariantCopyInd
push edx
push 0x40f140
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x40b7c5
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esi + 0x148], 0
je 0x40b7c5
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
xor edi, edi
movq qword [ebp - 0xc], xmm0
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x158]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x15c]
push 0x11
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call ebx
test ax, ax
mov ecx, 8
push 2
cmovs edi, ecx
call ebx
test ax, ax
jns 0x40b782
or edi, 1
push 1
call ebx
test ax, ax
jns 0x40b78e
or edi, 2
push 0x10
call ebx
test ax, ax
jns 0x40b79a
or edi, 4
push 0x12
call ebx
test ax, ax
jns 0x40b7a6
or edi, 0x20
mov word [ebp - 0xa], di
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x148]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x40b7c5
mov ecx, dword [esi + 0x148]
test ecx, ecx
je 0x40b82e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc8]
call eax
test al, al
je 0x40b82e
mov ecx, dword [esi + 0x148]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd4]
call eax
test al, al
je 0x40b82e
mov ecx, dword [esi + 0x148]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.007358ca
add esp, 8
test eax, eax
je 0x40b82e
mov eax, dword [esi + 0x148]
cmp byte [eax + 0x10a1], 0
jne 0x40b7c5
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.0040de80
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d940
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x40d96b
cmp esi, dword [edi + 0x148]
je 0x40d96b
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x148]
cmp esi, eax
je 0x40da6c
test eax, eax
je 0x40d9dd
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], 0x14
movq qword [esp + 0x1c], xmm0
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x148]
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push ecx
push 0
push 0
push str.killfocus
push dword [edi + 0x148]
mov ecx, edi
call fcn.0040e390
mov dword [edi + 0x148], 0
test esi, esi
je 0x40da6c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x40da6c
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xc8]
call eax
test al, al
je 0x40da6c
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xd4]
call eax
test al, al
je 0x40da6c
xorps xmm0, xmm0
mov dword [edi + 0x148], esi
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x24], 0
movq qword [esp + 0x1c], xmm0
mov dword [esp + 8], 0x15
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x148]
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push ecx
push 0
push 0
push str.setfocus
push dword [edi + 0x148]
mov ecx, edi
call fcn.0040e390
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40f8c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40f905
cmp byte [ebp + 8], 0
je 0x40f8f9
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x410570
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7ab106
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x8aa514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x20]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
sub eax, edx
mov ecx, dword [ebp - 0x20]
push 0x20
push eax
mov eax, dword [ebp - 0x18]
sub eax, ecx
push eax
push edx
push ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esi + 4]
lea edi, [esi + 0x2c]
mov ecx, edi
call fcn.0040ade0
mov ecx, esi
lea eax, [esi + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, edi
call fcn.0040e030
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1ec]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x24]
mov ecx, esi
mov byte [ebp - 4], 1
mov edx, dword [eax]
neg ecx
push 0
sbb ecx, ecx
lea eax, [esi + 0x28]
and ecx, eax
push edi
push ecx
push 0
push ecx
mov eax, esp
lea ecx, [ebp - 0x168]
mov dword [eax], edx
call fcn.0041f2d0
mov ebx, eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1e8]
cmp eax, ecx
je 0x41069a
push eax
call fcn.0073bf11
add esp, 4
test ebx, ebx
jne 0x4106b9
push 0x10
push str.Duilib
push 0x86fdec
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
mov ecx, edi
call fcn.0040d500
mov edx, esi
lea eax, [esi + 0x20]
neg edx
mov ecx, edi
sbb edx, edx
and edx, eax
push edx
call fcn.0040df40
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x4106ee
push eax
call fcn.0073bf11
add esp, 4
mov eax, dword [ebp - 0x164]
test eax, eax
je 0x410701
push eax
call fcn.0073bf11
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b937d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4186e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov edx, ecx
mov byte [edx + 0x195], al
test al, al
jne 0x41870e
mov ecx, dword [edx + 0x40]
test ecx, ecx
je 0x41870e
cmp dword [ecx + 0x148], edx
jne 0x41870e
mov dword [ebp + 8], 0
pop ebp
jmp fcn.0040d940
pop ebp
ret 4
Function at 0x4258b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7ab5fb
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x8aa514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
lea eax, [ebp - 0x90]
push 0xffffffffffffffff
push dword [0x8b4628]
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0x94]
xor eax, eax
mov word [ebp - 0x90], ax
call fcn.00409a40
mov dword [ebp - 4], 0
test esi, esi
je 0x425921
push esi
lea ecx, [ebp - 0x94]
call fcn.00409910
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x425997
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x425997
push eax
mov dword [ebp - 0x98], 0
call fcn.004885e5
add esp, 4
mov esi, eax
lea eax, [ebp - 0x98]
push 0
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebx]
je 0x425999
push esi
call fcn.004885e0
add esp, 4
xor esi, esi
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
cmp eax, ecx
je 0x4259b2
push eax
call fcn.0073bf11
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b937d
mov esp, ebp
pop ebp
ret

Function at 0x425b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8c9200]
test eax, eax
push edi
cmove eax, dword [0x8c9204]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x425b44
pop edi
pop ebp
ret
mov eax, dword [0x8c9200]
test eax, eax
push ebx
cmove eax, dword [0x8c9204]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push edi
test ebx, ebx
jne 0x425b6e
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
xor eax, eax
pop edi
pop ebp
ret
mov eax, dword [0x8c9200]
test eax, eax
cmove eax, dword [0x8c9204]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x425b68
push esi
push eax
call fcn.004885e5
add esp, 4
mov esi, eax
mov eax, dword [ebp + 8]
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call fcn.00734c50
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x425bc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x425bf0
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x425be8
push esi
push eax
mov dword [ebp - 4], 0
call fcn.004885e5
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp eax, dword [ebx]
je 0x425c3b
push esi
call fcn.004885e0
add esp, 4
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c4b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x109c], 0
je 0x42c51c
cmp dword [ebp + 8], 0x100
jne 0x42c50c
cmp word [ebp + 0xc], 0xd
jne 0x42c50c
cmp byte [esi + 0x10a2], 0
je 0x42c4ee
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x42c50c
cmp byte [esi + 0x10a3], 0
jne 0x42c50c
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x42c505
push ecx
push 0
push 0
push str.return
push esi
call fcn.0040e390
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x109c]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x434410
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x8aa514]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x43447d
cmp dword [esi + 0x10], 0
je 0x43447d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.005b9600
mov ebx, esp
test ebx, ebx
je 0x43447d
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1b8
call fcn.00409b20
mov ecx, dword [esi + 0x10]
push ecx
push 0
push 0
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0040e390
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b937d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43dd70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x8aa514]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esi + 0x10], eax
mov dword [eax + 0x14dc], 0
cmp dword [esi + 4], 0
jne 0x43de15
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x9c], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x98], ecx
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x94], eax
mov eax, dword [ecx]
call dword [eax + 0x1c]
movups xmm0, xmmword [ebp - 0xa0]
sub esp, 0x10
mov ecx, esp
push ecx
push 0
push 0x40000000
push ecx
push dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esi
call fcn.0040f780
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push dword [ecx + 0x106c]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0040ebb0
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x90]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
lea ecx, [ebp - 0x8c]
mov eax, dword [eax]
movzx ebx, word [eax]
mov eax, dword [ebp - 0x90]
cmp eax, ecx
je 0x43de42
push eax
call fcn.0073bf11
add esp, 4
test bx, bx
jne 0x43de56
mov eax, dword [esi + 0x10]
add eax, 0x14cc
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esi + 0x10]
add eax, 0x14cc
push eax
push 0
push 0x1002
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
mov byte [esi + 0x18], 1
xor ecx, ebp
pop esi
pop ebx
call fcn.005b937d
mov esp, ebp
pop ebp
ret 4