joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51eae3
Capabilities:
Create directory

Disassembly:
mov eax, 0x61f203
call fcn.005f77f4
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.005fcba4
test eax, eax
pop ecx
je 0x51eb46
movzx ecx, word [esi + eax*2 - 2]
cmp cx, 0x2f
je 0x51eb10
cmp cx, 0x5c
jne 0x51eb46
dec eax
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.004e8350
push dword [eax]
and dword [ebp - 4], 0
call fcn.0051eae3
cmp dword [ebp - 0x20], 0x6575cc
pop ecx
je 0x51eb39
push dword [ebp - 0x20]
call fcn.005f7371
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x51eb5d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
jmp 0x51eb8b
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.0051b523
mov eax, dword [eax]
add esp, 0xc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp - 0x20], 0x6575c8
mov esi, eax
je 0x51eb8b
push dword [ebp - 0x20]
call fcn.005f7371
pop ecx
test esi, esi
jne 0x51eb39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14]
push str.Cannot_create_directory:___s
push eax
call fcn.0051d61a
add esp, 0xc
push 0x697a88
lea eax, [ebp - 0x14]
push eax
call fcn.005f8355
int3

Function at 0x51f019
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x51f062
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 8]
push str.Cannot_locate_system_directory:___s
push eax
call fcn.0051d61a
add esp, 0xc
push 0x697a88
lea eax, [ebp - 8]
push eax
call fcn.005f8355
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.00410170
mov eax, dword [ebp + 8]
leave
ret
Function at 0x51f09c
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x620199
call fcn.005f77f4
sub esp, 0x268
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 4], bl
je 0x51f0be
xor al, al
jmp 0x51f212
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [esi]
jns 0x51f16c
cmp eax, ebx
je 0x51f0e9
lea ecx, [ebp - 0x274]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
neg eax
sbb al, al
inc al
jmp 0x51f122
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0051b61b
mov eax, dword [eax]
pop ecx
pop ecx
lea ecx, [ebp - 0x274]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp dword [ebp - 0x24], 0x6575c8
mov dword [esi], eax
je 0x51f11c
push dword [ebp - 0x24]
call fcn.005f7371
pop ecx
cmp dword [esi], 0xffffffff
sete al
cmp al, bl
mov byte [esi + 4], al
jne 0x51f19f
mov eax, dword [ebp - 0x274]
shr eax, 4
and al, 1
mov byte [esi + 0x38], al
push 0xffffffffffffffff
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0051b593
add esp, 0xc
push eax
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.00403c90
cmp dword [ebp - 0x18], 0x6575cc
je 0x51f1c0
push dword [ebp - 0x18]
call fcn.005f7371
pop ecx
jmp 0x51f1c0
cmp eax, ebx
lea ecx, [ebp - 0x274]
push ecx
je 0x51f186
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
neg eax
sbb al, al
inc al
jmp 0x51f198
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
sete al
cmp al, bl
mov byte [esi + 4], al
je 0x51f1a3
xor al, al
jmp 0x51f211
mov eax, dword [ebp - 0x274]
shr eax, 4
and al, 1
mov byte [esi + 0x38], al
lea eax, [ebp - 0x248]
push eax
lea ecx, [esi + 0x20]
call fcn.004039e0
push 1
push ebx
push ebx
push dword [ebp - 0x258]
call fcn.005f8550
mov ecx, dword [ebp - 0x254]
push 1
push ebx
xor edi, edi
add eax, ecx
push ebx
push dword [ebp - 0x25c]
adc edx, edi
mov dword [esi + 0x34], edx
mov dword [esi + 0x30], eax
call fcn.005f8550
mov ecx, dword [ebp - 0x260]
push dword [ebp - 0x274]
add eax, ecx
adc edx, edi
mov dword [esi + 0x44], edx
mov dword [esi + 0x40], eax
call fcn.0051e91b
mov dword [esi + 0x3c], eax
pop ecx
mov al, 1
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x51f719
Capabilities:
Get disk size

Disassembly:
mov eax, 0x61f369
call fcn.005f77f4
sub esp, 0x4c
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
cmp byte [0x6b7f24], bl
push edi
jne 0x51f76a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.GetDiskFreeSpaceExA
push edi
call esi
push str.GetDiskFreeSpaceExW
push edi
mov dword [0x6b7f20], eax
call esi
mov dword [0x6b7f1c], eax
mov byte [0x6b7f24], 1
cmp dword [0x6b7f20], ebx
push dword [ebp + 8]
je 0x51f832
lea ecx, [ebp - 0x4c]
call fcn.00410170
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov dword [ebp - 4], ebx
je 0x51f7ad
sub eax, ecx
sar eax, 1
dec eax
movzx eax, word [ecx + eax*2]
cmp ax, 0x2f
je 0x51f7ad
cmp ax, 0x5c
je 0x51f7ad
push 0x5c
lea ecx, [ebp - 0x4c]
call fcn.00455530
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jge 0x51f7f5
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0051b61b
pop ecx
pop ecx
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov byte [ebp - 4], 1
call dword [0x6b7f20]
cmp dword [ebp - 0x40], 0x6575c8
mov esi, eax
je 0x51f80c
push dword [ebp - 0x40]
call fcn.005f7371
pop ecx
jmp 0x51f80c
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x4c]
call dword [0x6b7f1c]
mov esi, eax
cmp esi, ebx
je 0x51f818
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
jmp 0x51f81d
or edi, 0xffffffff
mov esi, edi
cmp dword [ebp - 0x4c], 0x6575cc
je 0x51f8fa
push dword [ebp - 0x4c]
jmp 0x51f8f4
lea eax, [ebp - 0x40]
push eax
call fcn.0051f2c2
pop ecx
pop ecx
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [ebp - 0x40]
jge 0x51f8a5
cmp eax, dword [ebp - 0x3c]
jne 0x51f85a
xor eax, eax
jmp 0x51f872
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0051b61b
mov eax, dword [eax]
pop ecx
pop ecx
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test byte [ebp - 0x10], 1
mov esi, eax
je 0x51f8c8
cmp dword [ebp - 0x58], 0x6575c8
je 0x51f8c8
push dword [ebp - 0x58]
call fcn.005f7371
pop ecx
jmp 0x51f8c8
sub eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
neg eax
lea ecx, [ebp - 0x1c]
push ecx
sbb eax, eax
and eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov esi, eax
cmp esi, ebx
je 0x51f8e3
mov eax, dword [ebp - 0x18]
mul dword [ebp - 0x1c]
push ebx
push dword [ebp - 0x20]
push edx
push eax
call fcn.005f8550
mov esi, eax
mov edi, edx
jmp 0x51f8e8
or edi, 0xffffffff
mov esi, edi
cmp dword [ebp - 0x40], 0x6575cc
je 0x51f8fa
push dword [ebp - 0x40]
call fcn.005f7371
pop ecx
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x51ff02
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0051f2c2
pop ecx
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x51ff32
test eax, eax
je 0x51ff32
cmp eax, 2
je 0x51ff32
xor bl, bl
jmp 0x51ff34
mov bl, 1
cmp dword [ebp - 0xc], 0x6575cc
je 0x51ff46
push dword [ebp - 0xc]
call fcn.005f7371
pop ecx
mov al, bl
pop ebx
leave
ret

Function at 0x5201be
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x520207
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 8]
push str.Cannot_read_from_file___ls_:___s
push eax
call fcn.0051d61a
add esp, 0x10
push 0x697a88
lea eax, [ebp - 8]
push eax
call fcn.005f8355
mov eax, dword [ebp + 0xc]
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
pop esi
leave
ret 8

Function at 0x52025c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x520290
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jne 0x520290
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
pop esi
leave
ret 8
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 8]
push str.Cannot_write_to_file___ls_:___s
push eax
call fcn.0051d61a
add esp, 0x10
push 0x697a88
lea eax, [ebp - 8]
push eax
call fcn.005f8355
int3

Function at 0x520415
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x520465
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x520464
push dword [edi + 4]
call esi
push eax
lea eax, [ebp - 0x10]
push str.Cannot_retrieve_size_of_file___ls_:___s
push eax
call fcn.0051d61a
add esp, 0x10
push 0x697a88
lea eax, [ebp - 0x10]
push eax
call fcn.005f8355
pop esi
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
leave
ret
Function at 0x521136
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov edx, eax
mov ecx, eax
and edx, 3
shr eax, 2
je 0x521176
push ebx
push esi
mov esi, eax
mov eax, dword [esp + 0xc]
push edi
movzx edi, word [eax]
add ecx, edi
movzx edi, word [eax + 2]
mov ebx, ecx
shl ebx, 5
xor edi, ebx
shl edi, 0xb
xor ecx, edi
mov edi, ecx
shr edi, 0xb
add eax, 4
add ecx, edi
dec esi
jne 0x52114f
pop edi
pop esi
pop ebx
jmp 0x52117a
mov eax, dword [esp + 4]
dec edx
je 0x5211b0
dec edx
je 0x52119d
dec edx
jne 0x5211c2
movzx edx, word [eax]
movzx eax, byte [eax + 2]
shl eax, 2
add ecx, edx
xor eax, ecx
shl eax, 0x10
xor ecx, eax
mov eax, ecx
shr eax, 0xb
jmp 0x5211c0
movzx eax, word [eax]
add ecx, eax
mov eax, ecx
shl eax, 0xb
xor ecx, eax
mov eax, ecx
shr eax, 0x11
jmp 0x5211c0
movzx eax, byte [eax]
add ecx, eax
mov eax, ecx
shl eax, 0xa
xor ecx, eax
mov eax, ecx
shr eax, 1
add ecx, eax
mov eax, ecx
shl eax, 3
xor ecx, eax
mov eax, ecx
shr eax, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor ecx, eax
mov eax, ecx
shr eax, 0x11
add ecx, eax
mov eax, ecx
shl eax, 0x19
xor ecx, eax
mov eax, ecx
shr eax, 6
add eax, ecx
ret

Function at 0x521200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push edi
mov edi, 0x811c9dc5
jbe 0x52122b
push esi
mov esi, dword [esp + 0x10]
movzx eax, byte [esi]
push eax
call fcn.005f92c8
imul edi, edi, 0x1000193
xor edi, eax
inc esi
dec ebx
pop ecx
jne 0x521214
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x521230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push edi
mov edi, 0x811c9dc5
jbe 0x52125f
push esi
mov esi, dword [esp + 0x10]
movzx eax, word [esi]
push eax
call fcn.005f8e6d
imul edi, edi, 0x1000193
movzx eax, ax
xor edi, eax
inc esi
inc esi
dec ebx
pop ecx
jne 0x521244
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x523a04
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x61f63d
call fcn.005f77f4
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov byte [esi + 4], bl
mov dword [esi + 8], ebx
call fcn.00522978
mov dword [ebp - 4], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00522978
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x523adb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x61f668
call fcn.005f77f4
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, ecx
mov dword [esi], eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
call fcn.00523237
and dword [ebp - 4], 0
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x20]
call fcn.00522aff
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00523987
add edi, 0x44
push edi
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 2
call fcn.00522aff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x5249f2
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x61f783
call fcn.005f77f4
sub esp, 0x280
push ebx
push esi
push edi
mov edi, 0x62d888
push edi
lea ecx, [ebp - 0x18]
call fcn.00410170
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], esi
call fcn.00412f50
mov eax, dword [ebp - 0x14]
cmp word [eax - 2], 0x5c
jne 0x524a37
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.005249cb
push edi
lea ecx, [ebp - 0x18]
call fcn.00412f50
call fcn.00412df0
push 0x40
test al, al
push esi
lea eax, [ebp - 0x70]
mov dword [ebp - 0x74], 0x44
push eax
je 0x524ab1
call fcn.005f7e70
add esp, 0xc
xor ebx, ebx
push 0x104
lea eax, [ebp - 0x28c]
inc ebx
push eax
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x44], bx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, esi
je 0x524b4b
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x28c]
push eax
push esi
push 0x4000200
push esi
push esi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
jmp 0x524b47
call fcn.005f7e70
push 0xffffffffffffffff
push dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x30]
inc ebx
push eax
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x44], bx
call fcn.0051b523
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], bl
call fcn.0051b61b
add esp, 0x20
push 0x104
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, eax
cmp ebx, esi
je 0x524b22
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x188]
push eax
push esi
push 0x4000200
push esi
push esi
push esi
push dword [ebp - 0x24]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
mov edi, 0x6575c8
cmp dword [ebp - 0x24], edi
je 0x524b35
push dword [ebp - 0x24]
call fcn.005f7371
pop ecx
cmp dword [ebp - 0x30], edi
mov byte [ebp - 4], 0
je 0x524b47
push dword [ebp - 0x30]
call fcn.005f7371
pop ecx
cmp ebx, esi
jne 0x524b71
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20]
push str.Unable_to_launch_process:___s
push eax
call fcn.0051d61a
add esp, 0xc
push 0x697a88
lea eax, [ebp - 0x20]
push eax
call fcn.005f8355
cmp dword [ebp - 0x18], 0x6575cc
pop edi
pop esi
pop ebx
je 0x524b86
push dword [ebp - 0x18]
call fcn.005f7371
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x526aba
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 0x61f956
call fcn.005f77f4
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
add edi, 0xf
and edi, 0xfffffff0
cmp esi, eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], esi
jne 0x526af2
mov esi, dword [eax]
mov dword [ebp - 0x14], esi
jmp 0x526b06
cmp dword [esi + 0x10], edi
jae 0x526b92
lea ecx, [ebp - 0x14]
call fcn.005263d1
mov esi, dword [ebp - 0x14]
cmp esi, dword [ebp + 8]
jne 0x526af2
mov ecx, dword [ebx + 0x14]
cmp dword [ebp + 8], ecx
jne 0x526bf3
mov eax, dword [ebx + 0x24]
lea esi, [eax + edi - 1]
dec eax
push 0x40
not eax
push 0x1000
and esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [ebp + 8], eax
je 0x526b7e
and dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebx + 0x18]
mov dword [ebp - 0x14], esi
call fcn.00526751
cmp edi, esi
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
jae 0x526b7e
mov eax, dword [ebp + 8]
add eax, edi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
sub esi, edi
push eax
lea ecx, [ebx + 8]
mov dword [ebp - 0x20], esi
call fcn.00526751
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
sub dword [esi + 0x10], edi
mov edi, dword [esi + 0xc]
add edi, dword [esi + 0x10]
cmp dword [esi + 0x10], 0
jne 0x526bba
lea ecx, [ebx + 0x14]
cmp dword [ecx], esi
jne 0x526bad
call fcn.005263d1
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 8]
call fcn.005267e2
mov eax, edi
jmp 0x526b81
mov eax, dword [ebx + 0xc]
mov dword [ebp + 8], ecx
jmp 0x526aeb

Function at 0x526e9e
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x61f990
call fcn.005f77f4
sub esp, 0x28
push esi
mov esi, ecx
mov dword [esi], 0x658184
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
and dword [ebp - 4], 0
lea ecx, [esi + 8]
mov dword [esi], 0x658190
call fcn.005265cc
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
mov dword [esi + 0x14], eax
call fcn.005265cc
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x24], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x538e88
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ff38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov dword [eax], 0x63ead0
mov eax, dword [ebp - 0x44]
mov dword [eax], 0x6290e0
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x44]
mov dword [eax], fcn.00539100
mov eax, dword [ebp - 0x44]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x44]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x44]
and dword [eax + 0xc], 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
add ecx, 0x10
call fcn.00434cf0
mov eax, dword [ebp - 0x44]
add eax, 0x20
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and dword [eax], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x44]
add eax, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and dword [eax], 0
mov eax, dword [ebp - 0x14]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x44]
add eax, 0x30
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
and dword [eax], 0
mov eax, dword [ebp - 0x18]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x18]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x18]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x44]
add eax, 0x40
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
and dword [eax], 0
mov eax, dword [ebp - 0x1c]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x1c]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x1c]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x44]
mov dword [eax + 0x58], 1
mov eax, dword [ebp - 0x44]
mov dword [eax + 0x5c], 1
mov eax, dword [ebp - 0x44]
fld1
fstp dword [eax + 0x60]
mov eax, dword [ebp - 0x44]
mov byte [eax + 0x64], 1
mov eax, dword [ebp - 0x44]
mov byte [eax + 0x65], 1
mov eax, dword [ebp - 0x44]
add eax, 0x68
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 0x6575cc
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], 0x6575cc
mov eax, dword [ebp - 0x20]
mov dword [eax + 8], 0x6575cc
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
add ecx, 0x74
call fcn.0053a256
mov eax, dword [ebp - 0x44]
add eax, 0x80
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], 0
mov eax, dword [ebp - 0x44]
and dword [eax + 0x50], 0
mov eax, dword [ebp - 0x44]
and dword [eax + 0x54], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x542557
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62012f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x848
push 0
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x542590
jmp 0x5426d7
mov eax, dword [ebp - 0x10]
shl eax, 0x10
or eax, 0x2000000
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 8
je 0x5425b4
mov eax, dword [ebp - 0x14]
or eax, 0x1000000
mov dword [ebp - 0x14], eax
call fcn.00412df0
movzx eax, al
test eax, eax
je 0x54264f
push 0x400
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
je 0x54264a
lea eax, [ebp - 0x814]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x844]
add eax, 2
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x844]
mov ax, word [eax]
mov word [ebp - 0x84a], ax
add dword [ebp - 0x844], 2
cmp word [ebp - 0x84a], 0
jne 0x5425f8
mov eax, dword [ebp - 0x844]
sub eax, dword [ebp - 0x848]
sar eax, 1
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
lea eax, [ebp + eax*2 - 0x814]
push eax
lea eax, [ebp - 0x814]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040fcf0
jmp 0x5426d7
push 0x400
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
je 0x5426d7
push 0xffffffffffffffff
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.0051b593
add esp, 0xc
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x83c], eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x83c]
push dword [eax + 4]
mov eax, dword [ebp - 0x83c]
push dword [eax]
mov ecx, dword [ebp + 0xc]
call fcn.0040fcf0
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x820], 0x6575cc
je 0x5426d7
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x840], eax
push dword [ebp - 0x840]
call fcn.005f7371
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret