joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e4d0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 8], 0
lea eax, [esi + 8]
push edi
mov edi, ecx
mov dword [ebp - 8], edi
jne 0x42e4f3
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x6c], 0x10
lea eax, [edi + 0x58]
jb 0x42e509
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x42e5f1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 2
push 0
push 0
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
lea eax, [esi + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e5ea
mov eax, dword [esi + 0x38]
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e5ea
cmp dword [esi + 0x3c], 0x10
lea eax, [esi + 0x28]
jb 0x42e590
mov eax, dword [eax]
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e5ea
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e5ea
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [esi + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e5ea
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [esi + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42e603
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 8]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
push dword [ebp + 8]
lea ecx, [ecx + 0x34]
call fcn.0042e770
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 8]
push 0
push 0
push 0
inc dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
jne 0x42e665
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call eax
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call eax
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42e680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 8], 0
lea eax, [ebx + 8]
push esi
mov esi, ecx
jne 0x42e69e
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 4]
add ecx, 8
push edi
add eax, ecx
lea edi, [esi + 0x1c]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x6c], 0x10
lea eax, [esi + 0x58]
jb 0x42e6c2
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42e72c
push 0
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 4
lea eax, [ebx + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e725
push 0
lea eax, [ebp + 8]
push eax
push 8
lea eax, [ebx + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42e73e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [ebp + 8]
push eax
push 8
lea eax, [ebx + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
je 0x42e726
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x430340
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x4303a8
and byte [esi + 0xc], 9
mov al, byte [esi + 0xc]
test al, 1
je 0x430387
test al, 8
jne 0x430387
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
jne 0x430373
cmp byte [ebp + 0xc], 0
je 0x430387
or byte [esi + 0xc], 4
mov cl, byte [esi + 0xc]
test eax, 0x21000000
jne 0x430387
or cl, 2
mov byte [esi + 0xc], cl
test byte [esi + 0xc], 2
je 0x43039d
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x431170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
shr edx, 0x10
mov esi, ecx
push edi
test edx, edx
je 0x4311c1
cmp word [eax], 0x3c
jne 0x4311a7
push eax
call fcn.0048a270
test al, al
jne 0x43125a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push ecx
push eax
call fcn.0048a3e0
test al, al
jne 0x43125a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [0x4e90c0]
test ecx, ecx
mov ebx, dword [ebp + 0xc]
cmove ecx, dword [0x4e90bc]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x43119c
mov eax, dword [0x4e90c0]
test eax, eax
push edi
cmove eax, dword [0x4e90bc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x431212
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x140], eax
mov eax, dword [0x4e90c0]
test eax, eax
push ecx
cmove eax, dword [0x4e90bc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, esi
call fcn.0048a320
test al, al
je 0x43119c
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [esi + 0x144], ebx
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00431280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x434780
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x10
mov edi, ecx
call fcn.00493133
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test edi, edi
je 0x4347c9
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4347c9
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [esi + 4], 0
jne 0x4347e9
push edi
mov dword [esi + 8], fcn.004199b0
mov dword [esi + 0xc], 0x419a00
call fcn.004199b0
add esp, 4
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43493d
xor al, al
pop ebx
pop ebp
ret 0xc
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x434954
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
push esi
push edi
mov eax, dword [eax + 0xe8]
mov dword [ebp + 0xc], eax
call fcn.004933e1
mov ecx, dword [ebp + 0xc]
add esp, 4
xor esi, esi
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edi
nop word [eax + eax]
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
mov eax, dword [ecx + 8]
push edi
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add esi, ecx
cmp esi, edi
jae 0x4349af
test eax, eax
je 0x4349af
test ecx, ecx
mov ecx, dword [ebp + 0xc]
jne 0x434980
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov al, 1
pop ebx
pop ebp
ret 0xc
Function at 0x43ccf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x43ccfb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x43cdb7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
sub edi, 1
jne 0x43cd10
pop edi
test esi, esi
je 0x43cdda
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
sub esi, 1
jne 0x43cdc0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x43d2f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x43d333
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43d325
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x43d344
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.00496320
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d370
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x43d3ab
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43d3a6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x43d3d8
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x43d3bc
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.00496320
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x43d3ec
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x43d3e3
cmp byte [esi + 8], 0
je 0x43d3e3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43e5b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x43e648
cmp dword [esi + 4], 0xffffffff
jne 0x43e648
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x43e5e0
cmp dword [ebp + 0x10], 1
mov eax, dword [0x4c9500]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x43e613
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x43e613
mov eax, 0x2000000
pop edi
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov ecx, edi
call fcn.0043d1a0
add esp, 8
test eax, eax
jne 0x43e634
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, eax
call fcn.0043d6c0
mov dword [esi], eax
mov eax, dword [0x4e9104]
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc

Function at 0x440ec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov edx, ecx
mov byte [edx + 0x235], al
test al, al
jne 0x440eee
mov ecx, dword [edx + 0x40]
test ecx, ecx
je 0x440eee
cmp dword [ecx + 0x420], edx
jne 0x440eee
mov dword [ebp + 8], 0
pop ebp
jmp fcn.00421be0
pop ebp
ret 4
Function at 0x445660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
cmp dword [ebx + 0x14], 0x10
mov eax, dword [ebx + 0x10]
mov dword [ebp - 4], eax
jb 0x44567e
mov esi, dword [ebx]
jmp 0x445680
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test eax, eax
je 0x4456a4
mov ebx, eax
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x445690
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 0x18]
and ecx, edx
mov edx, dword [edi + 0xc]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0xc], esi
mov esi, dword [edi + 4]
mov dword [ebp - 8], esi
lea ecx, [edx + ecx*4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0xc], esi
jne 0x4456cd
mov ecx, esi
jmp 0x4456d1
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x44580d
cmp dword [ebx + 0x14], 0x10
lea edx, [eax + 8]
jb 0x4456e6
mov edi, dword [ebx]
jmp 0x4456e8
mov edi, ebx
cmp dword [edx + 0x14], 0x10
lea ecx, [edx + 0x10]
jb 0x4456f3
mov edx, dword [edx]
mov ecx, dword [ecx]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp - 4]
mov esi, ecx
cmp dword [ebp + 0xc], ecx
cmovb esi, dword [ebp + 0xc]
test esi, esi
je 0x445763
sub esi, 4
jb 0x445721
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x445726
add edx, 4
add edi, 4
sub esi, 4
jae 0x445710
cmp esi, 0xfffffffc
je 0x44575a
mov cl, byte [edx]
cmp cl, byte [edi]
jne 0x445753
cmp esi, 0xfffffffd
je 0x44575a
mov cl, byte [edx + 1]
cmp cl, byte [edi + 1]
jne 0x445753
cmp esi, 0xfffffffe
je 0x44575a
mov cl, byte [edx + 2]
cmp cl, byte [edi + 2]
jne 0x445753
cmp esi, 0xffffffff
je 0x44575a
mov cl, byte [edx + 3]
cmp cl, byte [edi + 3]
je 0x44575a
sbb ecx, ecx
or ecx, 1
jmp 0x44575c
xor ecx, ecx
test ecx, ecx
jne 0x44576c
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, ecx
jb 0x44576c
jbe 0x445779
mov eax, dword [eax]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
jmp 0x4456c4
cmp dword [eax + 0x1c], 0x10
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x445787
mov edx, dword [edx]
cmp dword [ebx + 0x14], 0x10
jb 0x44578f
mov ebx, dword [ebx]
mov edi, dword [edi]
cmp ecx, edi
mov esi, edi
cmovb esi, ecx
test esi, esi
je 0x4457f4
sub esi, 4
jb 0x4457b2
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x4457b7
add ebx, 4
add edx, 4
sub esi, 4
jae 0x4457a1
cmp esi, 0xfffffffc
je 0x4457eb
mov cl, byte [ebx]
cmp cl, byte [edx]
jne 0x4457e4
cmp esi, 0xfffffffd
je 0x4457eb
mov cl, byte [ebx + 1]
cmp cl, byte [edx + 1]
jne 0x4457e4
cmp esi, 0xfffffffe
je 0x4457eb
mov cl, byte [ebx + 2]
cmp cl, byte [edx + 2]
jne 0x4457e4
cmp esi, 0xffffffff
je 0x4457eb
mov cl, byte [ebx + 3]
cmp cl, byte [edx + 3]
je 0x4457eb
sbb ecx, ecx
or ecx, 1
jmp 0x4457ed
xor ecx, ecx
test ecx, ecx
jne 0x4457fa
mov ecx, dword [ebp - 4]
cmp ecx, edi
jb 0x4457fa
jbe 0x4457fd
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x445b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x445bab
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x445bc7
movzx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x445bb6
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x18]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, esi
cmp dword [ecx + 4], eax
jne 0x445bfd
cmp dword [ecx], eax
jne 0x445bf5
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + esi + 4], eax
jmp 0x445c05
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
jmp 0x445c05
cmp dword [ecx], eax
jne 0x445c08
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [edx + 4]
push eax
push esi
call fcn.00445c20
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45b4c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc80], 0
je 0x45b54b
cmp dword [ebp + 8], 0x100
jne 0x45b52a
cmp word [ebp + 0xc], 0xd
jne 0x45b52a
cmp byte [esi + 0xd12], 0
jne 0x45b502
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x45b52a
cmp byte [esi + 0xd13], 0
je 0x45b52a
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x45b521
call fcn.004243f0
push ecx
mov ecx, dword [esi + 0x40]
push 0
push 0
push str.editreturn
push esi
call fcn.004229a0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 0xc80]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45d800
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00462400

Function at 0x45e760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b727e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e5070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov word [edi + 0x10], 0x100
mov dword [edi + 0x14], vtable.ReceiverImpl_int__struct_UiLib::ContextMenuParam_.0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x3c]
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [edi + 0x24], vtable.UiLib::INotifyUI.0
mov dword [edi + 0x30], eax
lea eax, [ecx + 8]
mov dword [edi], vtable.UiLib::CMenuWnd.2.0
mov dword [edi + 0x14], vtable.UiLib::CMenuWnd.1.0
mov dword [edi + 0x24], vtable.UiLib::CMenuWnd.0
push 0xffffffffffffffff
mov dword [ecx], vtable.UiLib::CDuiString.0
mov dword [ecx + 4], eax
push 0x4c5de8
mov word [eax], dx
call fcn.00429c90
lea eax, [edi + 0xcc]
mov dword [edi + 0xc4], vtable.UiLib::CDuiString.0
xor ecx, ecx
mov dword [edi + 0xc8], eax
mov word [eax], cx
lea eax, [edi + 0x154]
mov dword [edi + fcn.00429d50], vtable.UiLib::CDuiString.0
mov dword [edi + 0x150], eax
mov word [eax], cx
lea ecx, [edi + 0x1d4]
mov byte [ebp - 4], 3
call fcn.0041d540
mov dword [edi + 0x8a4], 0
mov dword [edi + 0x8a8], 0
mov dword [edi + 0x8b4], 0
mov dword [edi + 0x8b8], 0
mov dword [edi + 0x8bc], 0
push 0xffffffffffffffff
push 0x4c5de8
lea ecx, [edi + 0x14c]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x8b0], 0
call fcn.00429c90
push dword [ebp + 8]
mov edx, dword [edi + 0x8b8]
push ecx
mov ecx, dword [edi + 0x8b4]
call fcn.0041bf10
mov eax, dword [edi + 0x8b4]
add esp, 8
mov dword [edi + 0x8b8], eax
mov eax, edi
mov dword [edi + 0x8ac], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45eb50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, ecx
push esi
push edi
push 0xffffffffffffffff
mov dword [ebx + 0x34], eax
lea ecx, [ebx + 0x3c]
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp + 8]
push 0x4c5de8
mov dword [ebx + 0x8a4], eax
mov dword [ebx + 0x8a8], 0
call fcn.00429c90
push 0xffffffffffffffff
lea ecx, [ebx + 0xc4]
push 0x4c5de8
call fcn.00429c90
lea eax, [ebx + 0x14]
mov dword [ebp + 8], eax
test eax, eax
je 0x45ebd5
lea eax, [ebp + 8]
mov ecx, 0x4e61e4
push eax
call fcn.00409e50
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov eax, dword [eax]
cmp eax, method.ReceiverImpl_int__struct_UiLib::ContextMenuParam_.virtual_0
jne 0x45ec4e
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x4e61e0
push eax
add ecx, 4
call fcn.00409e50
mov ecx, dword [ebx + 0x8a4]
test ecx, ecx
jne 0x45ebe4
mov eax, dword [ebx + 0x30]
jmp 0x45ebf3
mov eax, dword [ecx]
cmp eax, vtable.UiLib::CMenuElementUI.2.0
jne 0x45ec5a
mov eax, dword [ecx + 0x40]
mov eax, dword [eax + 4]
push ecx
push 0
push 0
push 0
push 0
push 0x88
push SysReAllocString
push 0
push eax
mov ecx, ebx
call fcn.00428ab0
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push esi
call edi
test eax, eax
je 0x45ec2c
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x45ec20
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
push 0x4e61e0
call eax
jmp 0x45ebd5
call dword [eax + 0x1c]
jmp 0x45ebf0

Function at 0x45fa50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
push edi
mov edi, ecx
mov dword [eax], 0
mov eax, dword [edi + 0x8b0]
test eax, eax
je 0x45fa7e
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x45fa7e
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x8a4]
test ecx, ecx
je 0x45fb15
mov eax, dword [ecx]
cmp eax, vtable.UiLib::CMenuElementUI.2.0
jne 0x45fb1d
mov esi, dword [ecx + 0x48]
mov ecx, dword [edi + 0x8a4]
mov edx, dword [ecx]
cmp edx, vtable.UiLib::CMenuElementUI.2.0
jne 0x45fb27
mov eax, dword [ecx + 0x40]
mov ecx, dword [edi + 0x8a4]
push 0
push esi
push eax
mov edx, dword [ecx]
call dword [edx + 0x20]
mov ecx, dword [edi + 0x8a4]
mov eax, dword [ecx]
cmp eax, vtable.UiLib::CMenuElementUI.2.0
jne 0x45fb2c
lea eax, [ecx + 0x1ec]
mov ecx, dword [edi + 0x8a4]
sub esp, 0x10
movups xmm0, xmmword [eax]
mov edx, esp
mov esi, dword [ecx]
movups xmmword [edx], xmm0
call dword [esi + 0x48]
mov ecx, dword [edi + 0x8a4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x134]
cmp eax, vtable.UiLib::CMenuElementUI.2.0
jne 0x45fb31
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x45fb15
push ecx
mov ecx, eax
call fcn.00421be0
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
call dword [eax + 0x24]
mov esi, eax
jmp 0x45fa9c
call dword [edx + 0x1c]
jmp 0x45faaf
call dword [eax + 0x44]
jmp 0x45fad3
call edx
jmp 0x45fb15