joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e41a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4e4242.0
jmp dword [ecx*4 + 0x4e41db]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e420d
sub dl, 8
je 0x4e421c
jmp case.0x4e4242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e3e50
jmp case.0x4e4242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e3ea8
jmp case.0x4e4242.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4e4242.0
movzx ecx, byte [ecx + 0x4e4249]
jmp dword [ecx*4 + 0x4e425a]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e3f54
jmp case.0x4e4242.0
cmp dl, 3
jne 0x4e4287
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e3fac
jmp case.0x4e4242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e3f68
jmp case.0x4e4242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e3ff0
jmp case.0x4e4242.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e42b2
sub dl, 8
je 0x4e42be
jmp case.0x4e4242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e401c
jmp case.0x4e4242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e4088
jmp case.0x4e4242.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e42dd
sub dl, 8
je 0x4e42e9
jmp case.0x4e4242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e4144
jmp case.0x4e4242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e416c
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x4e438b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004e3354
test eax, eax
je 0x4e438b
mov eax, ebx
call fcn.004e4394
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x4e4324
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e4394
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4e43c5
dec al
je 0x4e4400
dec al
je 0x4e4445
dec al
je 0x4e44ae
jmp 0x4e4538
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4e4538
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4e43d5
jmp 0x4e4538
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e4538
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4e4410
jmp 0x4e4538
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e4538
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4e4474
xor ebp, ebp
jmp 0x4e4484
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4e448d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4e4455
jmp 0x4e4538
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e4538
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4e4507
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004e1408
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4e44c2
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ef278
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
dec ecx
js 0x4ef2c9
lea eax, [ebp - 0x30]
cmp word [eax + 0x20], 3
je 0x4ef2b0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4ef2a0
jmp 0x4ef2c9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4ef2b1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405abe
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405d89
test bl, 8
mov dword [ebp - 8], eax
je 0x405afd
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x42a2e8], eax
jmp 0x405c7a
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405b17
test eax, eax
je 0x405c28
test bl, 2
je 0x405c28
mov esi, 0x425730
push edi
push esi
call fcn.004063b0
cmp dword [ebp + 8], 0
je 0x405b36
push 0x40a57c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405b3c
push edi
call fcn.00405ccd
cmp word [edi], 0
jne 0x405b4c
cmp word [0x425730], 0x5c
jne 0x405b57
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405c1d
cmp word [ebp - 0x22c], 0x2e
jne 0x405ba1
cmp word [ebp - 0x22a], 0
je 0x405c00
cmp word [ebp - 0x22a], 0x2e
jne 0x405ba1
cmp word [ebp - 0x228], 0
je 0x405c00
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.004063b0
test byte [ebp - 0x258], 0x10
je 0x405bcc
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405c00
push dword [ebp + 0xc]
push edi
call fcn.00405abe
jmp 0x405c00
push dword [ebp - 4]
push edi
call fcn.00405a76
test eax, eax
jne 0x405bf8
cmp dword [ebp - 4], eax
je 0x405bf0
push edi
push 0xfffffffffffffff1
call fcn.00405414
push 0
push edi
call fcn.00406176
jmp 0x405c00
inc dword [0x42a2e8]
jmp 0x405c00
push edi
push 0xfffffffffffffff2
call fcn.00405414
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405b79
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405c28
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405c7a
cmp dword [ebp - 8], esi
jne 0x405c3c
inc dword [0x42a2e8]
jmp 0x405c7a
push edi
call fcn.004066f3
test eax, eax
je 0x405c7a
push edi
call fcn.00405c81
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405a76
test eax, eax
jne 0x405c72
cmp dword [ebp - 4], esi
je 0x405c34
push edi
push 0xfffffffffffffff1
call fcn.00405414
push esi
push edi
call fcn.00406176
jmp 0x405c7a
push edi
push 0xffffffffffffffe5
call fcn.00405414
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x55bf52a9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1d00727b
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4015e4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 2
jne 0x40172c
mov dword [ebp - 8], esp
push 0x467247
push dword [ebp + 8]
call dword [0x46d569]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401625
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40167b
mov dword [ebp - 8], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401659
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40167b
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 8], esp
push str.Comet_Image
push dword [ebp + 8]
call dword [0x46d569]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4016a2
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4016d1
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4016d1
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 8], esp
push str.Comet_Stream
push dword [ebp + 8]
call dword [0x46d569]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4016f8
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401727
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401727
push 6
call fcn.004595a5
add esp, 4
jmp 0x4017f3
cmp dword [ebp + 0xc], 0x201
jne 0x4017f3
mov dword [ebp - 8], esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x46d56d]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401764
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push str.CometHitMove
push dword [ebp + 8]
call dword [0x46d569]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40178e
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x4017eb
mov dword [ebp - 8], esp
call dword [0x46d571]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4017ba
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 8], esp
push 0
push 2
push 0xa1
push dword [ebp + 8]
call dword [0x46d575]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4017eb
push 6
call fcn.004595a5
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x401823
mov dword [ebp - 8], esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x46d56d]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40181e
push 6
call fcn.004595a5
add esp, 4
jmp 0x401823
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405d09
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x405d24
call fcn.00405d94
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x405d50
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405d7a
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x405d8e
mov esp, ebp
pop ebp
ret 8

Function at 0x405dc5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405e08
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405e32
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405e66
push 6
call fcn.004595a5
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x405e6e
mov esp, ebp
pop ebp
ret 4
Function at 0x40706d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0045b6e0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4070b2
push ebx
call fcn.0045959f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4070e0
push 6
call fcn.004595a5
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4070fc
push eax
mov ebx, eax
call fcn.004018a9
inc eax
push eax
call fcn.00459599
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x407101
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407112
push ebx
call fcn.0045959f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x407119
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 1
jne 0x407138
mov dword [ebp + 0x14], 0
jmp 0x407155
cmp dword [ebp + 0x14], 2
jne 0x40714e
mov dword [ebp + 0x14], 7
jmp 0x407155
mov dword [ebp + 0x14], 1
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0x46754b
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x407190
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x4071ac
mov eax, 0
jmp 0x4071b6
mov eax, 1
jmp 0x4071b6
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40e72b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0x46754b
push 0x46754b
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40e771
push 6
call fcn.004595a5
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x425604
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.0045b6e0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x425649
push ebx
call fcn.0045959f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x425674
push 6
call fcn.004595a5
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x425690
push eax
mov ebx, eax
call fcn.004018a9
inc eax
push eax
call fcn.00459599
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x425695
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4256a6
push ebx
call fcn.0045959f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x426a0d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0045b6e0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x426a52
push ebx
call fcn.0045959f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x426a7d
push 6
call fcn.004595a5
add esp, 4
push 0x4676ba
push dword [ebp - 4]
mov ecx, 2
call fcn.00401914
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x426a9d
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x426aae
push ebx
call fcn.0045959f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x43be67
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x43bea2
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0045f190
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43bf05
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0045b330
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x43bf29
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0045f190
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43bf8c
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0045b330
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x43bfb0
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0045f190
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43c013
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0045b330
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x43c01b
mov esp, ebp
pop ebp
ret
Function at 0x440308
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x44034e
push 6
call fcn.004595a5
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x467867]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.00401497
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0045b6e0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4403a1
push ebx
call fcn.0045959f
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4403da
push 6
call fcn.004595a5
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4403f6
push eax
mov ebx, eax
call fcn.004018a9
inc eax
push eax
call fcn.00459599
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4403fb
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x44040c
push ebx
call fcn.0045959f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x45c590
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x45c5f9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0045b0e0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret