joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47679c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.004377e4
call fcn.004cafe0
test eax, eax
je 0x476814
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004f315c
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00477fc0
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x47688e
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push 0
push edx
push ebx
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x47685b
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x47685b
push 0
push 0
call fcn.00477fc0
add esp, 8
xor ebx, ebx
jmp 0x47688e
xor eax, eax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00477fc0
add esp, 8
mov ebx, dword [ebp - 0xc]
call fcn.004377e0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476e38
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00475a40
pop ecx
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x476e6b
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x476e6b
xor esi, esi
jmp 0x476e70
mov esi, 1
push 0
push esi
call fcn.00477fc0
add esp, 8
test esi, esi
je 0x476e9a
mov eax, dword [ebp - 4]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, ebx
xor edx, edx
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
jmp 0x476e9e
xor eax, eax
xor edx, edx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x476ea4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004779ec
pop ecx
mov esi, eax
mov ebx, eax
call fcn.004377e4
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00477fc0
add esp, 8
call fcn.004377e0
test esi, esi
je 0x476ee7
push esi
call fcn.00455a78
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x476ef0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004779ec
pop ecx
mov esi, eax
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004779ec
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
call fcn.004377e4
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
setne cl
and ecx, 1
mov ebx, ecx
push 0
push ebx
call fcn.00477fc0
add esp, 8
call fcn.004377e0
test esi, esi
je 0x476f48
push esi
call fcn.00455a78
pop ecx
test edi, edi
je 0x476f53
push edi
call fcn.00455a78
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x476f5c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004779ec
pop ecx
mov esi, eax
mov ebx, eax
call fcn.004377e4
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00477fc0
add esp, 8
call fcn.004377e0
test esi, esi
je 0x476fa1
push esi
call fcn.00455a78
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x476fa8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004779ec
pop ecx
mov esi, eax
mov ebx, eax
call fcn.004377e4
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
push edi
setne al
and eax, 1
mov ebx, eax
call sub.KERNEL32.DLL_SetErrorMode
push 0
push ebx
call fcn.00477fc0
add esp, 8
call fcn.004377e0
test esi, esi
je 0x476ffb
push esi
call fcn.00455a78
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x477004
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004779ec
pop ecx
mov esi, eax
mov ebx, eax
call fcn.004377e4
push ebx
call sub.KERNEL32.DLL_RemoveDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00477fc0
add esp, 8
call fcn.004377e0
test esi, esi
je 0x477047
push esi
call fcn.00455a78
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x477074
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov byte [ebx], 0
cmp dword [ebp + 8], 0
jle 0x4770ab
call fcn.00477318
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 4]
je 0x4770ab
mov ecx, dword [ebp + 8]
dec ecx
push ecx
call fcn.004772c8
pop ecx
call fcn.004377e4
mov edi, dword [ebp + 0x10]
mov eax, edi
add eax, eax
push eax
call fcn.004559a4
pop ecx
mov esi, eax
mov word [esi], 0
push 0
push esi
push edi
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
push eax
call fcn.00477fc0
mov word [esi + edi*2 - 2], 0
add esp, 8
mov edx, dword [ebp + 0x10]
dec edx
push edx
push ebx
push esi
call fcn.00463410
add esp, 0xc
push esi
call fcn.00455a78
pop ecx
call fcn.004377e0
call fcn.00477f84
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
je 0x477122
mov edx, dword [ebp - 4]
dec edx
push edx
call fcn.004772c8
pop ecx
push edi
call fcn.00477fac
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [ebx + ecx - 1], 0
test edi, edi
jne 0x4771a7
cmp byte [ebx], 0
je 0x4771a7
push ebx
call fcn.004f3294
pop ecx
mov dword [ebp - 8], ebx
mov esi, eax
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x47714f
add dword [ebp - 8], 2
sub esi, 2
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx]
push ecx
push 0x5acc8f
call fcn.004f3240
add esp, 8
test eax, eax
je 0x47716c
inc dword [ebp - 8]
dec esi
test esi, esi
je 0x47718c
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + esi - 1]
push edx
push 0x5acc8f
call fcn.004f3240
add esp, 8
test eax, eax
je 0x47718c
dec esi
test esi, esi
je 0x4771a3
cmp ebx, dword [ebp - 8]
je 0x4771a3
push esi
mov ecx, dword [ebp - 8]
push ecx
push ebx
call fcn.004f3110
add esp, 0xc
mov byte [ebx + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4771b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov byte [esi], 0
call fcn.004377e4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, edx
push edx
call fcn.004559a4
pop ecx
mov ebx, eax
mov word [ebx], 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne dl
and edx, 1
mov edi, edx
push 0
push edi
call fcn.00477fc0
add esp, 8
mov eax, dword [ebp - 4]
mov word [ebx + eax*2 - 2], 0
mov edx, dword [ebp + 0xc]
dec edx
push edx
push esi
push ebx
call fcn.00463410
add esp, 0xc
push ebx
call fcn.00455a78
pop ecx
call fcn.004377e0
mov ecx, dword [ebp + 0xc]
mov byte [esi + ecx - 1], 0
test edi, edi
je 0x477262
cmp byte [esi], 0
je 0x477262
push esi
call fcn.004f3294
pop ecx
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, dword [ebp + 0xc]
jae 0x477262
xor edx, edx
mov dl, byte [esi + ebx - 1]
push edx
push 0x5acc8f
call fcn.004f3240
add esp, 8
test eax, eax
jne 0x477262
mov byte [esi + ebx], 0x5c
inc ebx
mov byte [esi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x47726c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004779ec
pop ecx
mov esi, eax
mov ebx, eax
call fcn.004377e4
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00477fc0
add esp, 8
push edi
call sub.KERNEL32.DLL_SetErrorMode
call fcn.004377e0
test esi, esi
je 0x4772bf
push esi
call fcn.00455a78
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4780bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x47819d
test edi, edi
je 0x47819d
call fcn.004377e4
cmp dword [0x5acc98], 0
jne 0x478109
push 0x5acca0
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x478109
push str.CreateSymbolicLinkW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5acc98], eax
cmp dword [0x5acc98], 0
je 0x47818c
push edi
call fcn.004779ec
pop ecx
mov esi, eax
mov dword [ebp - 4], eax
push ebx
call fcn.004779ec
pop ecx
mov edi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x478138
test al, 0x10
jne 0x47813c
xor edx, edx
jmp 0x478141
mov edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x478151
mov ecx, 1
jmp 0x478153
xor ecx, ecx
push ecx
push ebx
mov eax, dword [ebp - 4]
push eax
call dword [0x5acc98]
test eax, eax
setne dl
and edx, 1
mov ebx, edx
push 0
push ebx
call fcn.00477fc0
add esp, 8
test esi, esi
je 0x47817f
push esi
call fcn.00455a78
pop ecx
test edi, edi
je 0x478196
push edi
call fcn.00455a78
pop ecx
jmp 0x478196
push 1
call fcn.00477fac
pop ecx
xor ebx, ebx
call fcn.004377e0
jmp 0x4781a7
push 2
call fcn.00477fac
pop ecx
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4781b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
test ebx, ebx
je 0x4782cb
call fcn.004377e4
cmp dword [0x5acc9c], 0
jne 0x4781f7
push 0x5acca0
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x4781f7
push str.GetFinalPathNameByHandleW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5acc9c], eax
cmp dword [0x5acc9c], 0
je 0x4782bc
push ebx
call fcn.004779ec
pop ecx
mov esi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x47821e
test al, 0x10
jne 0x478222
xor edx, edx
jmp 0x478227
mov edx, 1
mov eax, edx
push 0
test eax, eax
je 0x478236
mov ecx, 0x2000010
jmp 0x47823b
mov ecx, 0x80
push ecx
push 3
push 0
push 1
push SysReAllocStringLen
push ebx
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
jne 0x478260
push 0
push 0
call fcn.00477fc0
add esp, 8
jmp 0x4782af
push 0
push 0x108
lea edx, [ebp - 0x210]
push edx
push eax
call dword [0x5acc9c]
cmp eax, 0x108
jae 0x4782a7
test eax, eax
jbe 0x478299
mov word [ebp + eax*2 - 0x210], 0
lea eax, [ebp - 0x210]
push eax
call fcn.004633a0
pop ecx
mov edi, eax
push 0
push 1
call fcn.00477fc0
add esp, 8
jmp 0x4782af
push 9
call fcn.00477fac
pop ecx
test esi, esi
je 0x4782c4
push esi
call fcn.00455a78
pop ecx
jmp 0x4782c4
push 1
call fcn.00477fac
pop ecx
call fcn.004377e0
jmp 0x4782d3
push 2
call fcn.00477fac
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4786b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov byte [eax], 0
call fcn.004377e4
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x4786e1
push ebx
call fcn.004779ec
pop ecx
mov esi, eax
jmp 0x4786e3
xor eax, eax
cmp dword [ebp + 0xc], 0
mov ebx, eax
je 0x478704
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
je 0x478704
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004779ec
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
jmp 0x47873b
lea edx, [ebp - 0x424]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
jne 0x478729
push 0
push 0
call fcn.00477fc0
add esp, 8
xor eax, eax
jmp 0x47879d
mov word [ebp - 0x216], 0
lea edx, [ebp - 0x424]
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x214]
push ecx
push 0
test ebx, ebx
jne 0x47874d
mov ebx, 0x5acd2c
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov ebx, eax
test ebx, ebx
je 0x478775
push 0x107
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x214]
push ecx
call fcn.00463410
add esp, 0xc
test esi, esi
je 0x478780
push esi
call fcn.00455a78
pop ecx
test edi, edi
je 0x47878b
push edi
call fcn.00455a78
pop ecx
push 0
push ebx
call fcn.00477fc0
add esp, 8
call fcn.004377e0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4787f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov byte [ebx], 0
lea eax, [ebp - 0x210]
push eax
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
je 0x478836
mov word [ebp - 2], 0
push 0x107
push ebx
lea eax, [ebp - 0x210]
xor esi, esi
push eax
call fcn.00463410
add esp, 0xc
test esi, esi
jne 0x47885f
cmp byte [ebx], 0
je 0x47885f
push ebx
call fcn.004f3294
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x47886a
cmp eax, 0x107
jge 0x47886a
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
jmp 0x47886a
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0x5c
mov byte [ebx + 2], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x479d68
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x479e59
call sub.USER32.DLL_EmptyClipboard
cmp dword [ebp + 8], 0xd
jne 0x479da1
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0045b4d4
add esp, 0x10
mov esi, eax
jmp 0x479db9
push 0
push 0
call fcn.00462f20
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0045b3fc
add esp, 0x10
mov esi, eax
test esi, esi
je 0x479e4f
cmp dword [ebp + 8], 0xd
lea eax, [esi + 1]
jne 0x479dd1
mov edx, 2
jmp 0x479dd6
mov edx, 1
imul edx
push eax
push 2
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x479e54
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x479e43
cmp dword [ebp + 8], 0xd
jne 0x479e11
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.0045b4d4
add esp, 0x10
jmp 0x479e29
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
call fcn.00462f20
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0045b3fc
add esp, 0x10
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_SetClipboardData
test eax, eax
setne al
and eax, 1
mov edi, eax
test edi, edi
jne 0x479e54
push ebx
call sub.KERNEL32.DLL_GlobalFree
jmp 0x479e54
mov edi, 1
call sub.USER32.DLL_CloseClipboard
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x479e64
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
call sub.USER32.DLL_IsClipboardFormatAvailable
test eax, eax
je 0x479f2d
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x479f2d
push edi
call sub.USER32.DLL_GetClipboardData
mov esi, eax
test esi, esi
je 0x479f28
push esi
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x479f28
push esi
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov eax, edi
dec eax
je 0x479eef
sub eax, 6
je 0x479eef
sub eax, 6
je 0x479ec5
jmp 0x479efe
shr ebx, 1
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.0045af10
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x479f22
push ebx
mov ecx, dword [ebp - 4]
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0045b600
add esp, 0x10
jmp 0x479f22
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004c95b8
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x479f22
push ebx
cmp edi, 1
mov ecx, dword [ebp - 4]
push ecx
jne 0x479f13
call fcn.00462f20
jmp 0x479f15
xor eax, eax
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0045b544
add esp, 0x10
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_CloseClipboard
test ebx, ebx
jne 0x479f3f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00457f10
add esp, 8
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x47a2d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
xor ebx, ebx
push esp
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x47a3c1
test byte [esp + 0x10], 0x80
je 0x47a2f5
or ebx, 1
test byte [esp + 0x11], 0x80
je 0x47a2ff
or ebx, 2
test byte [esp + 0x12], 0x80
je 0x47a309
or ebx, 4
test byte [esp + 0x5b], 0x80
je 0x47a316
or ebx, 0x4000
test byte [esp + 0x5c], 0x80
je 0x47a323
or ebx, 0x8000
test byte [esp + 0x5d], 0x80
je 0x47a330
or ebx, 0x10000
test byte [esp + 0x91], 1
je 0x47a33d
or ebx, 0x10
test byte [esp + 0x90], 1
je 0x47a34a
or ebx, 0x20
test byte [esp + 0x14], 1
je 0x47a354
or ebx, 0x40
test byte [esp + 0x2d], 1
je 0x47a361
or ebx, 0x80
test byte [esp + 0xa0], 0x80
je 0x47a371
or ebx, 0x100
test byte [esp + 0xa1], 0x80
je 0x47a381
or ebx, 0x200
test byte [esp + 0xa2], 0x80
je 0x47a391
or ebx, 0x400
test byte [esp + 0xa3], 0x80
je 0x47a3a1
or ebx, 0x800
test byte [esp + 0xa4], 0x80
je 0x47a3b1
or ebx, 0x1000
test byte [esp + 0xa5], 0x80
je 0x47a3c1
or ebx, 0x2000
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x47a3cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x47a4f4
test bl, 1
je 0x47a3f6
mov dl, 0x80
jmp 0x47a3f8
xor edx, edx
test bl, 2
mov byte [ebp - 0xf0], dl
je 0x47a407
mov al, 0x80
jmp 0x47a409
xor eax, eax
test bl, 4
mov byte [ebp - 0xef], al
je 0x47a418
mov dl, 0x80
jmp 0x47a41a
xor edx, edx
test bh, 0x40
mov byte [ebp - 0xee], dl
je 0x47a429
mov al, 0x80
jmp 0x47a42b
xor eax, eax
test bh, 0x80
mov byte [ebp - 0xa5], al
je 0x47a43a
mov dl, 0x80
jmp 0x47a43c
xor edx, edx
test ebx, 0x10000
mov byte [ebp - 0xa4], dl
je 0x47a44e
mov al, 0x80
jmp 0x47a450
xor eax, eax
test bl, 0x10
mov byte [ebp - 0xa3], al
je 0x47a45f
mov dl, 1
jmp 0x47a461
xor edx, edx
test bl, 0x20
mov byte [ebp - 0x6f], dl
je 0x47a46d
mov al, 1
jmp 0x47a46f
xor eax, eax
test bl, 0x40
mov byte [ebp - 0x70], al
je 0x47a47b
mov dl, 1
jmp 0x47a47d
xor edx, edx
test bl, 0x80
mov byte [ebp - 0xec], dl
je 0x47a48c
mov al, 1
jmp 0x47a48e
xor eax, eax
test bh, 1
mov byte [ebp - 0xd3], al
je 0x47a49d
mov dl, 0x80
jmp 0x47a49f
xor edx, edx
test bh, 2
mov byte [ebp - 0x60], dl
je 0x47a4ab
mov al, 0x80
jmp 0x47a4ad
xor eax, eax
test bh, 4
mov byte [ebp - 0x5f], al
je 0x47a4b9
mov dl, 0x80
jmp 0x47a4bb
xor edx, edx
test bh, 8
mov byte [ebp - 0x5e], dl
je 0x47a4c7
mov al, 0x80
jmp 0x47a4c9
xor eax, eax
test bh, 0x10
mov byte [ebp - 0x5d], al
je 0x47a4d5
mov dl, 0x80
jmp 0x47a4d7
xor edx, edx
test bh, 0x20
mov byte [ebp - 0x5c], dl
je 0x47a4e3
mov al, 0x80
jmp 0x47a4e5
xor eax, eax
mov byte [ebp - 0x5b], al
lea edx, [ebp - 0x100]
push edx
call sub.USER32.DLL_SetKeyboardState
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47adcc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, 0xffffffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x47ae02
test ecx, ecx
je 0x47ae02
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5acd54]
xor ebx, eax
inc edx
mov eax, ebx
dec ecx
jne 0x47ade4
xor eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x47ae08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ax, 0xffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x47ae47
test ecx, ecx
je 0x47ae47
movzx ebx, ax
movzx edi, byte [edx]
mov esi, ebx
xor esi, edi
and esi, 0xff
sar ebx, 8
mov si, word [esi*2 + 0x5ad154]
xor si, bx
inc edx
mov eax, esi
dec ecx
jne 0x47ae23
xor ax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48bf20
Capabilities:
Get hostname

Disassembly:
add esp, 0xffffffdc
mov dword [esp], 0x10
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
mov word [esp + 0x22], 0
cmp word [esp + 4], 0
je 0x48bf58
lea edx, [esp + 4]
push edx
call fcn.004633a0
pop ecx
jmp 0x48bf63
push str.HOSTNAME
call fcn.004c7620
pop ecx
add esp, 0x24
ret
Function at 0x48bf80
Capabilities:
Get session user name

Disassembly:
add esp, 0xfffffdfc
mov dword [esp], 0x100
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.ADVAPI32.DLL_GetUserNameW
mov word [esp + 0x202], 0
cmp word [esp + 4], 0
je 0x48bfbe
lea edx, [esp + 4]
push edx
call fcn.004633a0
pop ecx
jmp 0x48bfc9
push str.USER
call fcn.004c7620
pop ecx
add esp, 0x204
ret
Function at 0x4c7548
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4c757e
push esi
call fcn.004779ec
pop ecx
mov edi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
test edi, edi
mov ebx, eax
je 0x4c757e
push edi
call fcn.00455a78
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4c7588
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4c75c3
push esi
call fcn.004779ec
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4c75af
test al, 0x50
je 0x4c75b3
xor ebx, ebx
jmp 0x4c75b8
mov ebx, 1
test edi, edi
je 0x4c75c3
push edi
call fcn.00455a78
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4c75cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4c7607
push esi
call fcn.004779ec
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4c75f3
test al, 0x10
jne 0x4c75f7
xor ebx, ebx
jmp 0x4c75fc
mov ebx, 1
test edi, edi
je 0x4c7607
push edi
call fcn.00455a78
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4c7620
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
push eax
call fcn.0046324c
pop ecx
mov ebx, eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov esi, eax
test esi, esi
je 0x4c7674
mov eax, esi
add eax, eax
push eax
call fcn.004559a4
pop ecx
mov dword [ebp - 4], eax
push esi
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov ecx, dword [ebp - 4]
push ecx
call fcn.004633a0
pop ecx
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call fcn.00455a78
pop ecx
push ebx
call fcn.00455a78
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret