joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
lea eax, [esp + 8]
push eax
push 0x101
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41442f
mov edx, dword [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 8]
push ecx
push ebx
push ebx
push ebx
push str.DigitalProductId
push edx
call edi
test eax, eax
jne 0x414423
mov eax, dword [esp + 8]
cmp eax, 0x43
jbe 0x414423
add eax, 4
push esi
push eax
call fcn.0041884e
mov esi, eax
mov eax, dword [esp + 0x10]
add eax, 4
push eax
push ebx
push esi
call fcn.00422f70
mov edx, dword [esp + 0x20]
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
push esi
push ebx
push ebx
push str.DigitalProductId
push edx
call edi
test eax, eax
jne 0x414419
mov eax, dword [esp + 0xc]
push eax
mov eax, esi
call fcn.00414260
mov ebx, eax
push esi
call fcn.0041960a
add esp, 4
pop esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x414440
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x17c
mov eax, dword [0x630160]
xor eax, esp
mov dword [esp + 0x178], eax
test byte [0x657cc8], 1
jne 0x414480
or dword [0x657cc8], 1
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x657cc4], eax
push ebx
push pe_nt_image_headers32
lea eax, [esp + 0x30]
push 0
push eax
mov dword [esp + 0x34], 0
call fcn.00422f70
xor eax, eax
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x152]
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x154], cx
call fcn.00422f70
add esp, 0x18
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 4]
cmp ax, 9
je 0x414501
mov ebx, 0x20
cmp ax, 6
jne 0x414506
mov ebx, 0x40
mov eax, dword [0x657cc4]
test eax, eax
je 0x414665
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x114
call eax
test eax, eax
jne 0x414665
mov eax, dword [esp + 0x2c]
push edi
cmp eax, 5
jne 0x414574
cmp dword [esp + 0x34], 1
jne 0x41463f
lea eax, [esp + 0x140]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x414550
mov edx, dword [0x626ddc]
mov cx, word [0x626de0]
mov dword [eax], edx
mov word [eax + 4], cx
jmp 0x41463f
cmp eax, 6
jne 0x414603
mov eax, dword [esp + 0x34]
cmp eax, 1
jne 0x4145a9
lea edi, [esp + 0x140]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x414590
mov edx, dword [0x626de4]
mov dword [edi], edx
jmp 0x41463f
cmp eax, 2
jne 0x4145d5
lea edi, [esp + 0x140]
add edi, 0xfffffffe
jmp 0x4145c0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4145c0
mov eax, dword [0x626de8]
mov dword [edi], eax
jmp 0x41463f
cmp eax, 3
jne 0x41463f
lea eax, [esp + 0x140]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4145e4
mov ecx, dword [0x626dec]
mov edx, dword [0x626df0]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x41463f
cmp eax, 0xa
jne 0x41463f
cmp dword [esp + 0x34], 0
jne 0x41463f
lea eax, [esp + 0x140]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x414620
mov ecx, dword [0x626df4]
mov dx, word [0x626df8]
mov dword [eax], ecx
mov word [eax + 4], dx
mov eax, dword [esp + 0x38]
push ebx
push eax
lea ecx, [esp + 0x148]
push ecx
push str.Microsoft_Windows__s__d__d
push 0x657668
mov edx, 0x208
call fcn.00401fc0
add esp, 0x14
pop edi
mov ecx, dword [esp + 0x17c]
pop ebx
xor ecx, esp
mov eax, 0x657668
call fcn.00418878
add esp, 0x17c
ret
Function at 0x414920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x101
push 4
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
xor esi, esi
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41497b
mov eax, dword [esp + 8]
test eax, eax
je 0x41498a
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x651370
push esi
push str.InstallDate
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 8]
test eax, eax
je 0x41498a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4149da
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], esi
call fcn.00419bad
mov edi, eax
add esp, 4
test edi, edi
je 0x4149da
push 0x104
call fcn.0041884e
push 0x104
mov esi, eax
push 0
push esi
call fcn.00422f70
push edi
push str._Y__m__d__H:_M:_S
push 0x104
push esi
call fcn.0041b8a6
add esp, 0x20
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x418878
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x630160]
jne 0x418882
repz ret
jmp fcn.0041d32f

Function at 0x42eab6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041df3a
and dword [ebp - 4], 0
cmp dword [0x651fac], 0
mov ebx, eax
jne 0x42eb67
push 0x5c7d14
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42ec18
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5c7d08
push edi
call esi
test eax, eax
je 0x42ec18
push eax
call fcn.0041dec8
mov dword [esp], 0x5c7cf8
push edi
mov dword [0x651fac], eax
call esi
push eax
call fcn.0041dec8
mov dword [esp], 0x5c7ce4
push edi
mov dword [0x651fb0], eax
call esi
push eax
call fcn.0041dec8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x651fb4], eax
call esi
push eax
call fcn.0041dec8
pop ecx
mov dword [0x651fbc], eax
test eax, eax
je 0x42eb67
push 0x5c7cb0
push edi
call esi
push eax
call fcn.0041dec8
pop ecx
mov dword [0x651fb8], eax
mov eax, dword [0x651fb8]
cmp eax, ebx
je 0x42ebbf
cmp dword [0x651fbc], ebx
je 0x42ebbf
push eax
call fcn.0041df43
push dword [0x651fbc]
mov esi, eax
call fcn.0041df43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42ebbf
test edi, edi
je 0x42ebbf
call esi
test eax, eax
je 0x42ebb6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42ebb6
test byte [ebp - 0xc], 1
jne 0x42ebbf
or dword [ebp + 0x10], 0x200000
jmp 0x42ebf8
mov eax, dword [0x651fb0]
cmp eax, ebx
je 0x42ebf8
push eax
call fcn.0041df43
pop ecx
test eax, eax
je 0x42ebf8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42ebf8
mov eax, dword [0x651fb4]
cmp eax, ebx
je 0x42ebf8
push eax
call fcn.0041df43
pop ecx
test eax, eax
je 0x42ebf8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x651fac]
call fcn.0041df43
pop ecx
test eax, eax
je 0x42ec18
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42ec1a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x438df3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.0045fcd5
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x438e3f
push ebx
call fcn.0045f133
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x438e56
mov eax, 0x631745
push eax
push 1
mov ebx, 0x130
call fcn.0045fd75
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x438e91
push 6
call fcn.0045f145
add esp, 4
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x438eb1
mov eax, 0x631745
push eax
push 2
mov ebx, 0x134
call fcn.0045fd15
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x438edb
push ebx
call fcn.0045f133
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x438efb
push eax
mov ebx, eax
call fcn.0043573c
inc eax
push eax
call fcn.0045f139
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x438f00
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x438f11
push ebx
call fcn.0045f133
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x460105
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x460123
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x460118
pop esi
ret
Function at 0x46bc12
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x46bc28
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x46bc34
or edi, 2
push 1
call esi
test ax, ax
jge 0x46bc40
or edi, 1
push 0x10
call esi
test ax, ax
jge 0x46bc4c
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x46bc58
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x46f153
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov ebx, dword [ebp + 8]
je 0x46f18e
mov ecx, dword [esi + 0x84]
cmp eax, ecx
je 0x46f18e
cmp ebx, dword [esi + 0xec]
je 0x46f18e
cmp byte [esi + 0xe4], 0
jne 0x46f18e
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0xec]
cmp ebx, eax
je 0x46f269
push edi
test eax, eax
je 0x46f1ef
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xec]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x11c]
push 1
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0xec]
mov ecx, esi
call fcn.0046f0e7
mov dword [esi + 0xec], edi
test ebx, ebx
je 0x46f268
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
cmp eax, esi
jne 0x46f268
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xdc]
test al, al
je 0x46f268
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xe8]
test al, al
je 0x46f268
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0xec], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xec]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x11c]
push 1
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0xec]
mov ecx, esi
call fcn.0046f0e7
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x473e12
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x630160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x473ea0
cmp dword [esi + 0x10], ebx
je 0x473ea0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.00424150
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x473ea0
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x1e4
call fcn.0047339e
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 1
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.0046f0e7
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0046c0c2
test al, al
je 0x473ea0
mov ecx, dword [esi + 0x10]
call fcn.0048aac1
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418878
leave
ret 0x10

Function at 0x47414f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
movsd dword es:[edi], dword [esi]
call fcn.0048a2a2
mov ecx, dword [ebx + 0x6d8]
test ecx, ecx
je 0x4741c9
lea eax, [ebp - 0x10]
push eax
call fcn.00473c76
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x6d8]
test eax, eax
je 0x4741a5
push 0
call fcn.0048c460
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4741c9
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 0x54
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
call fcn.0048c460
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x4741d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048a632
mov ecx, dword [esi + 0x6d8]
test ecx, ecx
je 0x474242
lea eax, [ebp - 0x10]
push eax
call fcn.00473c76
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x6d8]
test eax, eax
je 0x47421e
push 0
call fcn.0048c460
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x474242
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 0x54
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
call fcn.0048c460
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
leave
ret 0xc
Function at 0x479d4e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x28], ecx
mov ecx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebx + 0x2c], ecx
mov ecx, dword [ebp + 0x24]
mov dword [ebx + 0x574], eax
mov dword [ebx + 0x578], edi
mov dword [ebx + 0x57c], ecx
cmp eax, edi
jne 0x479db2
call fcn.00479c21
push dword [ebp + 0x1c]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
cmp dword [ebp + 0x20], edi
je 0x479db2
call fcn.00479c21
push dword [ebp + 0x20]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
lea esi, [ebx + 0x10]
call fcn.00479c21
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx]
mov ecx, dword [ebx + 0x574]
cmp ecx, edi
jne 0x479dd0
mov ecx, dword [ebp + 0x1c]
jmp 0x479dd7
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0046bf74
lea ecx, [ebp - 0x10]
mov dword [ebp + 0x20], eax
call fcn.00472e66
push edi
sub esp, 0x10
mov edi, esp
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x88
push accept
movsd dword es:[edi], dword [esi]
push 0
push dword [ebp + 0x20]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
call fcn.00472de9
mov edi, dword [ebx + 4]
mov esi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x479e19
push edi
call esi
mov edi, eax
push edi
call esi
test eax, eax
jne 0x479e14
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x4872ce
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x4872d9
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x487394
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5cde60]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5cde60]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5cde60]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5cde60]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5cde60]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5cde60]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5cde60]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x5cde60]
inc edx
sub edi, 8
dec esi
jne 0x4872f9
pop ebx
test edi, edi
je 0x4873ad
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x5cde60]
inc edx
dec edi
jne 0x487398
pop edi
not eax
pop esi
ret

Function at 0x487844
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x487878
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x487873
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4878a0
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x487889
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00422ff0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x48863d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x630160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4886e7
movzx ecx, word [esi]
test cx, cx
je 0x4886e7
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x48867b
cmp cx, 0x5c
jne 0x48867d
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x48866f
cmp eax, esi
je 0x4886bb
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004f22cb
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0048863d
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004f2500
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004f24d2
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00418878
leave
ret
Function at 0x489c18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x489c93
cmp dword [esi + 4], 0xffffffff
jne 0x489c93
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x6248cc
push edi
call fcn.004f24d2
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x489c65
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x489c65
mov eax, 0x2000000
jmp 0x489c98
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048765a
add esp, 0x10
test eax, eax
jne 0x489c83
mov eax, dword [ebp + 0x10]
jmp 0x489c98
push eax
call fcn.00489814
mov dword [esi], eax
mov eax, dword [0x652600]
pop ecx
jmp 0x489c98
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x48d21f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x694], ebx
je 0x48d289
cmp dword [ebp + 8], 0x100
jne 0x48d278
cmp word [ebp + 0xc], 0xd
jne 0x48d278
cmp byte [esi + 0x69a], bl
je 0x48d25d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x48d278
cmp byte [esi + 0x69b], bl
jne 0x48d278
mov ecx, dword [esi + 0x5c]
cmp ecx, ebx
je 0x48d274
push 1
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.0046f0e7
xor eax, eax
jmp 0x48d28c
mov eax, dword [esi + 0x694]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x48f944
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
sub esp, 0x2b4
lea ebp, [esp - 4]
mov eax, dword [0x630160]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push 0xc
mov eax, 0x5c42ca
call fcn.0041d26d
mov edi, dword [ebp + 0x2c0]
mov ebx, ecx
call fcn.0048ef2d
call fcn.0046bdb6
push eax
lea ecx, [ebp + 0x230]
call fcn.00473641
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0046bdbc
mov ecx, eax
call fcn.0047334a
test al, al
je 0x48faa6
push edi
lea ecx, [ebp + 0x230]
call fcn.004733da
push esi
push 0x80
push 3
push esi
push 1
push accept
lea ecx, [ebp + 0x230]
call fcn.004730dd
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
push esi
cmp eax, 0xffffffff
jne 0x48fa1a
push str.Error_opening_file
mov ecx, ebx
call fcn.0048f103
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x230]
call fcn.00473225
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.00418878
add ebp, 0x2b8
leave
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
jne 0x48fa2f
push esi
push str.File_is_empty
jmp 0x48f9db
cmp edi, 0x400000
jbe 0x48fa3f
push esi
push 0x5ceeac
jmp 0x48f9db
push edi
mov dword [ebp - 0x14], esi
call fcn.0041884e
pop ecx
push esi
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], edi
je 0x48fa85
push dword [ebp - 0x10]
call fcn.0041960a
pop ecx
mov ecx, ebx
call fcn.0048ef2d
push esi
push str.Could_not_read_file
jmp 0x48f9db
push dword [ebp + 0x2c4]
mov ecx, ebx
push edi
push dword [ebp - 0x10]
call fcn.0048f7f3
push dword [ebp - 0x10]
mov bl, al
call fcn.0041960a
pop ecx
jmp 0x48f9e4
call fcn.0046bdbc
push eax
lea ecx, [ebp + 0x230]
call fcn.004733c0
call fcn.0046bdc2
test al, al
je 0x48fac7
call fcn.0046bdc8
jmp 0x48fade
push 2
push esi
lea ecx, [ebp + 0x230]
call fcn.004730dd
push eax
call fcn.00489ff7
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, esi
jne 0x48faf0
push esi
push str.Error_opening_zip_file
jmp 0x48f9db
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push edi
push dword [ebp - 0x10]
call fcn.004886f5
add esp, 0x14
test eax, eax
je 0x48fb15
push esi
push str.Could_not_find_ziped_file
jmp 0x48f9db
mov eax, dword [ebp + 0x22c]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x48fa27
cmp eax, 0x400000
ja 0x48fa37
push eax
call fcn.0041884e
push 3
push dword [ebp - 0x14]
mov edi, eax
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.0048a054
add esp, 0x18
cmp eax, esi
je 0x48fb7c
cmp eax, 0x600
je 0x48fb7c
push edi
call fcn.0041960a
pop ecx
call fcn.0046bdc2
test al, al
jne 0x48fb71
push dword [ebp - 0x10]
call fcn.0048a08e
pop ecx
push esi
push str.Could_not_unzip_file
jmp 0x48f9db
call fcn.0046bdc2
test al, al
jne 0x48fb8e
push dword [ebp - 0x10]
call fcn.0048a08e
pop ecx
push dword [ebp + 0x2c4]
mov ecx, ebx
push dword [ebp - 0x14]
push edi
call fcn.0048f7f3
push edi
jmp 0x48fa99