joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011320
Capabilities:
Enumerate gui resources
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x1001408c], 8
jne 0x10011350
mov edx, dword [0x10030348]
test edx, edx
je 0x10011340
mov eax, dword [ebp + 8]
test eax, eax
je 0x10011380
leave
xor eax, eax
ret 4
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.__d__n
mov dword [esp + 8], str.EnableTheming
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x1001408c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_7
jmp 0x1001132f
lea eax, [ebp - 4]
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov dword [0x10030348], 0
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x100113d0
mov dword [esp + 4], 0x31a
mov dword [esp], sym._UXTHEME_broadcast_msg_8
call dword [sym.imp.user32.dll_EnumWindows]
xor eax, eax
sub esp, 8
leave
ret 4
mov eax, dword [ebp - 4]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x1002ab0a
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ThemeActive
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x100113ad

Function at 0x10011cf0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
test byte [0x1001408c], 8
jne 0x10011d30
mov dword [esp], ebx
call sym._UXTHEME_SetActiveTheme
mov dword [esp + 4], 0x31a
mov ebx, eax
mov dword [esp], sym._UXTHEME_broadcast_msg_8
call dword [sym.imp.user32.dll_EnumWindows]
mov eax, ebx
mov ebx, dword [ebp - 4]
sub esp, 8
leave
ret 0xc
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__s__p__n
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], str.ApplyTheme
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x1001408c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_7
jmp 0x10011d03
Function at 0x10012730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
mov dword [esp + 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.SystemUsesLightTheme
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegGetValueW]
mov edx, dword [ebp - 8]
xor eax, eax
sub esp, 0x1c
leave
test edx, edx
sete al
ret

Function at 0x10012790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
mov dword [esp + 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.AppsUseLightTheme
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegGetValueW]
mov edx, dword [ebp - 8]
xor eax, eax
sub esp, 0x1c
leave
test edx, edx
sete al
ret

Function at 0x10012d60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [ebp + 8]
test byte [0x1001409c], 8
jne 0x10012de8
mov dword [esp + 8], str.TEXTFILE
mov eax, dword [ebp + 0xc]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x10012e20
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x10012e28
mov dword [esp], esi
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
sub esp, 8
mov esi, eax
mov dword [esp], 0xc
and esi, 0xfffffffe
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [eax], ebx
mov dword [eax + 4], ebx
add ebx, esi
mov dword [eax + 8], ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0xc], str.Loading_resource_INI__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x1002b4cc
mov dword [esp + 4], 0x1001409c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_8
jmp 0x10012d75
xor ebx, ebx
jmp 0x10012db0
test byte [0x1001409c], 8
jne 0x10012e38
xor eax, eax
jmp 0x10012ddc
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0xc], str._s_resource_not_found_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x1002b4cc
mov dword [esp + 4], 0x1001409c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_8
xor eax, eax
jmp 0x10012ddc
Function at 0x10013350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x100133a8
cmp byte [esi + ebx - 1], 0xa
je 0x1001337c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100303e4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10013950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x100303f4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x10013b10
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x100303f4]
movzx eax, al
bt eax, esi
jae 0x10013b70
mov ecx, dword [0x100303e4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x10013a15
test byte [0x100140d8], 8
jne 0x10013ab0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x100140e8], 8
jne 0x10013a60
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100139e4
cmp esi, 3
jbe 0x10013a20
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1002b598]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x100139e4
mov ecx, dword [0x100303f4]
test ecx, ecx
je 0x10013b50
mov dword [esp], 0x100140e8
call dword [0x100303f4]
test al, 8
je 0x100139bb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100139bb
mov ebx, dword [0x100303f4]
test ebx, ebx
je 0x10013b30
mov dword [esp], 0x100140d8
call dword [0x100303f4]
test al, 8
je 0x100139a6
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x100139ae
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x100303f4
call sym._load_func.part.0
jmp 0x1001396d
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x100303f4
call sym._load_func.part.0
jmp 0x10013aba
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x100303f4
call sym._load_func.part.0
jmp 0x10013a6e
mov eax, 0xffffffff
jmp 0x10013a15
Function at 0x1a8580
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e000]
push edi
or ebp, 0xffffffff
jmp 0x1a85a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1a85a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a8598
mov eax, 1
add ebx, ebx
jne 0x1a85bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1a85b0
jne 0x1a85cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1a85b0
xor ecx, ecx
sub eax, 3
jb 0x1a85e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1a8652
mov ebp, eax
add ebx, ebx
jne 0x1a85eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1a85f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1a861c
inc ecx
add ebx, ebx
jne 0x1a8608
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1a85fd
jne 0x1a8619
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1a85fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1a863c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1a862d
jmp 0x1a859e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1a863c
add edi, ecx
jmp 0x1a859e
pop esi
mov edi, esi
mov ecx, 0x467
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1a865a
cmp byte [edi], 0xa
jne 0x1a865a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1a865f
lea edi, [esi + 0x26000]
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1a86ba
cmp al, 0xef
ja 0x1a86ad
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1a868f
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1a869c
mov ebp, dword [esi + 0x35d80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1a86ee
sub esp, 0xffffff80
jmp 0x1872fd
Function at 0x409b0a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x409b11
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
and eax, eax
je 0x409bb9
lea eax, [esp + 8]
lea eax, [esp + 8]
push eax
push str.SeDebugPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
and eax, eax
je 0x409bb0
lea eax, [esp + 0x10]
lea ebp, [esp + 0x10]
mov dword [ebp], 1
lea ebp, [esp + 8]
push dword [ebp]
lea ebp, [esp + 0x14]
pop eax
mov dword [ebp + 4], eax
lea ebp, [esp + 8]
push dword [ebp + 4]
lea ebp, [esp + 0x14]
pop eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], 2
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
mov byte [esp], al
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
movsx eax, byte [esp]
movsx eax, al
jmp 0x409bc4
add esp, 0x34
pop ebx
pop ebp
ret

Function at 0x40a2ba
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push dword [esp + 0xc]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x40a2dc
mov dword [esp], 1
jmp 0x40a2ec
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40a425
mov ebx, dword [esp + 0x10]
cmp ebx, 1
je 0x40a324
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x40a314
mov dword [esp], 1
jmp 0x40a324
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40a425
mov ebx, dword [esp + 0x14]
cmp ebx, 1
je 0x40a35c
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x40a34c
mov dword [esp], 1
jmp 0x40a35c
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40a425
mov ebx, dword [esp + 0x18]
cmp ebx, 1
je 0x40a394
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x40a384
mov dword [esp], 1
jmp 0x40a394
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40a425
mov ebx, dword [esp + 0x10]
cmp ebx, 1
jne 0x40a3c0
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x40a3c0
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40a425
mov ebx, dword [esp + 0x14]
cmp ebx, 1
jne 0x40a3ec
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x40a3ec
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40a425
mov ebx, dword [esp + 0x18]
cmp ebx, 1
jne 0x40a418
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x40a418
mov dword [esp], 0
xor edx, edx
xor eax, eax
jmp 0x40a425
xor edx, edx
mov eax, 1
jmp 0x40a425
add esp, 4
pop ebx
ret 0x10
Function at 0x40dc5c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40dd40
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test byte [ebp + 0x10], 1
mov ebx, eax
je 0x40dcf6
push edi
push edi
push edi
push dword [ebp + 0xc]
call fcn.0040e7f0
mov ebx, eax
cmp ebx, edi
je 0x40dd35
push dword [ebp + 8]
push dword [0x4a5608]
call fcn.00415777
mov esi, eax
mov eax, 0x10000
push eax
push ebx
mov dword [esi + 0x18], eax
call fcn.0040e793
push eax
push ebx
call fcn.0040e779
push eax
call fcn.0040e385
mov dword [esi], eax
cmp eax, edi
je 0x40dcee
mov dword [esi + 0x14], ebx
mov dword [ebp - 4], esi
jmp 0x40dd35
push ebx
call fcn.0040e7a0
jmp 0x40dd35
push ebx
push edi
push dword [0x4a4e34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
je 0x40dd35
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push esi
push dword [ebp + 8]
call fcn.0040e36f
push esi
push edi
push dword [0x4a4e34]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc
Function at 0x40de85
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
push dword [0x4a5608]
xor ebx, ebx
call fcn.00415814
mov esi, eax
test esi, esi
je 0x40e00b
mov eax, dword [esi]
mov dword [ebp - 4], eax
cmp dword [esi + 0x14], ebx
je 0x40df37
push dword [ebp + 8]
call fcn.0040e4b7
jmp 0x40dec8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1d], bl
jne 0x40dec0
push dword [esi + 0x14]
call fcn.0040e7c9
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
xor ebx, ebx
push ebx
mov eax, esi
mov byte [esi + 0x1c], 1
call fcn.0040dd5a
pop ecx
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push 0x40ddcd
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x40df0c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40df1d
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040e587
mov eax, dword [esi]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x34]
mov esi, dword [esi]
mov eax, dword [esi]
push 1
push ebx
push ebx
push esi
call dword [eax + 0x30]
jmp 0x40e00b
test byte [ebp + 0xc], 1
je 0x40df40
xor ebx, ebx
inc ebx
test byte [ebp + 0xc], 2
je 0x40dfcd
push esi
call fcn.0040e024
lea eax, [esi + 4]
push 0x10
push eax
call fcn.00416040
pop ecx
pop ecx
lea edx, [ebp - 4]
push edx
push dword [ebp - 4]
mov edi, eax
mov eax, dword [0x4a561c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jne 0x40e00b
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov byte [edi + 5], bl
mov byte [edi + 4], 1
mov eax, dword [ebp - 4]
push dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
push dword [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x40]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40dfb1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040e4e7
jmp 0x40dfbd
mov eax, dword [ebp - 4]
push dword [esi + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push 0
push 0
push eax
call dword [ecx + 0x30]
jmp 0x40e00b
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x34]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40dfef
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040e587
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push 0
push 0
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x40e00b
xor edi, edi
inc edi
mov byte [esi + 0x1c], 1
mov byte [esi + 0x1e], bl
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40e9a9
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x40e9f8
push dword [esp + 0x10]
push 0x40e927
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4a564c]
cmp esi, ebx
je 0x40ea4c
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40e9f0
cmp byte [esi + 0x10], bl
je 0x40e9f0
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x40e9cd
jmp 0x40ea4c
mov esi, dword [0x4a564c]
cmp esi, ebx
je 0x40ea4c
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40ea45
cmp byte [esi + 0x11], bl
je 0x40ea22
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x40ea38
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x4a564c
call fcn.0041606d
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x40ea03
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x40f0ff
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4a565c], 0
jne 0x40f111
call fcn.0040f050
push esi
push edi
push dword [0x4a5658]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
mov esi, eax
test esi, esi
jne 0x40f136
call fcn.0040f050
push dword [0x4a5658]
call edi
mov esi, eax
mov eax, dword [ebp + 8]
push 0x11
lea ecx, [esi + 8]
pop edx
mov edi, eax
imul edi, edi, 0x53a9b4fb
xor eax, eax
inc eax
sub eax, edi
mov dword [ecx + 0x44], eax
imul eax, eax, 0x53a9b4fb
xor edi, edi
inc edi
sub edi, eax
mov eax, edi
mov dword [ecx], eax
add ecx, 4
dec edx
jne 0x40f13f
and dword [esi], edx
push 0x1f
mov dword [esi + 4], 0xa
pop edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.0040f009
dec edi
pop ecx
pop ecx
jne 0x40f170
pop edi
pop esi
leave
ret 4

Function at 0x411fa5
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
mov bl, pe_nt_image_headers32
test edi, edi
je 0x412021
push 9
call esi
test bl, al
je 0x412021
push 0x11
call esi
test bl, al
jne 0x412021
push 0x10
call esi
test bl, al
jne 0x412021
push 0x12
call esi
test bl, al
jne 0x412021
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x412021
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x412021
xor eax, eax
jmp 0x4120a3
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x41204a
push 0x11
call esi
test bl, al
jne 0x412042
push 0x10
call esi
test bl, al
jne 0x412042
push 0x12
call esi
test bl, al
je 0x41204a
push 1
push ebp
call fcn.00411f5e
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test edi, edi
je 0x412060
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x4120a0
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x4120a0
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x4120a0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x4120a0
dec esi
push esi
push dword [0x4a5c64]
call fcn.00415814
test eax, eax
je 0x4120a0
mov eax, dword [eax + 8]
jmp 0x4120a2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x412c0b
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x412d43
cmp byte [eax], 0
je 0x412d43
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea ecx, [ebp + eax - 0x109]
cmp eax, 2
je 0x412c65
cmp eax, 3
jne 0x412ca5
cmp byte [ebp - 0x107], 0x3a
jne 0x412ca5
cmp eax, 2
jne 0x412c86
lea eax, [ebp - 0x108]
push 0x44b2bc
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x412d43
jmp 0x412d40
mov byte [ecx], 0
dec ecx
cmp byte [ecx], 0x5c
je 0x412ca1
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x412cef
test byte [ebp - 0x248], 0x10
je 0x412cd4
push 0xfffffffffffffffe
pop edi
or esi, 0xffffffff
jmp 0x412ce6
mov esi, dword [ebp - 0x22c]
xor edi, edi
or edi, dword [ebp - 0x228]
xor edx, edx
or esi, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x412d43
cmp byte [ebp - 0x108], 0x5c
jne 0x412d01
cmp byte [ebp - 0x107], 0x5c
je 0x412d13
cmp byte [ebp - 0x108], 0x2e
jne 0x412d43
cmp byte [ebp - 0x107], 0x2e
jne 0x412d43
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x412d2b
test al, 0x10
je 0x412d43
jmp 0x412d3d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x412d43
or esi, 0xffffffff
push 0xfffffffffffffffe
pop edi
mov eax, edi
pop edi
mov edx, esi
pop esi
leave
ret 4

Function at 0x412d50
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x412d85
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x4131e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x413239
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x413238
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4a5c88]
push eax
push ecx
call fcn.00415814
test eax, eax
je 0x413234
cmp dword [eax + 4], 0
je 0x413222
push esi
push edi
push eax
call fcn.004135a0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc