joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40599c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x616038], 0
je 0x4059c2
mov edx, esi
mov eax, ebx
call dword [0x616038]
jmp 0x4059d1
mov eax, 8
call fcn.004030ac
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x630055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405964
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4093bc
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x40d21c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x40d2bc
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call fcn.00406378
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call fcn.00406250
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x40d246
cmp byte [esp], 0
je 0x40d28b
mov eax, edi
call fcn.00406250
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x40d2c8
mov eax, edi
call fcn.00406250
push eax
mov eax, edi
call fcn.00406250
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.00403294
mov edx, ebx
mov eax, edi
xor ecx, ecx
call fcn.00406378
jmp 0x40d2c8
mov eax, edi
mov edx, 0x40d2dc
call fcn.00405a6c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40d2e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x40d383
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.00406d2c
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov ecx, 0xa
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.00407480
add bp, 0x30
mov word [eax + esi*2 - 2], bp
dec esi
test ebx, ebx
jne 0x40d308
cmp byte [esp], 0
je 0x40d351
mov eax, edi
call fcn.00407480
mov word [eax + esi*2 - 2], 0x2d
dec esi
test esi, esi
jle 0x40d38f
mov eax, edi
call fcn.00407480
push eax
mov eax, edi
call fcn.00407480
lea eax, [eax + esi*2]
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
add ecx, ecx
pop edx
call fcn.00403294
mov edx, ebx
mov eax, edi
call fcn.00406d2c
jmp 0x40d38f
mov eax, edi
mov edx, 0x40d3a4
call fcn.004069b0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40e4fc
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp word [0x616aa4], 0
jne 0x40e534
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e52b
movzx eax, word [esp]
mov word [0x616aa4], ax
jmp 0x40e534
mov word [0x616aa4], 0x2c
movzx eax, word [0x616aa4]
pop edx
ret
Function at 0x40eb08
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40eb10
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ed22
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x40eb53
lea edx, [ebp - 0xc]
mov eax, ebx
call dword [0x616830]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00406bcc
jmp 0x40ecef
test ebx, 0xc0000000
je 0x40eb9b
lea edx, [ebp - 0x10]
mov eax, dword [0x616abc]
call fcn.0040ed40
mov eax, dword [ebp - 0x10]
call fcn.004061d8
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x6168a0]
call fcn.0040ed40
mov eax, dword [ebp - 0x14]
call fcn.004061d8
push eax
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x40eb9b
push ebx
call eax
mov ebx, eax
mov edi, 0x1300
cmp ebx, 0x834
jb 0x40ebe0
cmp ebx, 0xbb7
ja 0x40ebe0
push 2
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x616ab8]
call fcn.0040ed40
mov eax, dword [ebp - 0x18]
call fcn.004061d8
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40ebe5
or edi, 0x800
jmp 0x40ebe5
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40ece8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_FormatMessageW
test eax, eax
je 0x40ec88
xor eax, eax
push ebp
push 0x40ec81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406b5c
mov eax, dword [esi]
call fcn.00406d20
mov ebx, eax
test ebx, ebx
jbe 0x40ec6a
mov eax, dword [esi]
movzx edi, word [eax + ebx*2 - 2]
cmp di, 0xd
jne 0x40ec51
mov eax, esi
call fcn.00407480
mov word [eax + ebx*2 - 2], 0x20
jmp 0x40ec65
cmp di, 0xa
jne 0x40ec65
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.0040722c
dec ebx
test ebx, ebx
ja 0x40ec34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eccb
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LocalFree
ret
lea edx, [ebp - 0x20]
mov eax, dword [0x616ac0]
call fcn.0040ed40
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00406bcc
push dword [ebp - 0x1c]
push 0x40ed3c
lea eax, [ebp - 0x24]
push eax
mov cx, 0x30
mov edx, 1
mov eax, ebx
call fcn.0040dd08
push dword [ebp - 0x24]
mov eax, esi
mov edx, 3
call fcn.00406f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ecef
cmp dword [ebp - 8], 0
je 0x40ece7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ed29
lea eax, [ebp - 0x24]
call fcn.004069a0
lea eax, [ebp - 0x20]
call fcn.00405a18
lea eax, [ebp - 0x1c]
call fcn.004069a0
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405a3c
ret
Function at 0x40ed40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.00405a6c
mov eax, ebx
call fcn.00406248
mov eax, dword [ebx]
call fcn.00405ddc
test eax, eax
jle 0x40ed71
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x40ed66
pop esi
pop ebx
ret

Function at 0x40fa2c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40fb2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x30]
call fcn.00408278
mov esi, eax
lea eax, [esi + 1]
push eax
lea eax, [ebx + 0x30]
mov ecx, 1
mov edx, dword [0x40f724]
call fcn.00408440
add esp, 4
lea eax, [esi + esi*2]
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x38]
mov dword [edx + eax*8], ecx
mov ecx, dword [ebx + 0x3c]
mov dword [edx + eax*8 + 4], ecx
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebp + 8]
mov dword [edx + eax*8 + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edx + eax*8 + 0xc], ecx
test edi, edi
jne 0x40faae
test esi, esi
jle 0x40faae
lea edi, [esi + esi*2]
mov eax, dword [ebx + 0x30]
lea eax, [eax + edi*8 + 0x10]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + edi*8 - 8]
call fcn.004069b0
jmp 0x40fabf
lea eax, [esi + esi*2]
mov edx, dword [ebx + 0x30]
lea eax, [edx + eax*8 + 0x10]
mov edx, edi
call fcn.004069b0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add dword [ebx + 0x38], eax
adc dword [ebx + 0x3c], edx
test esi, esi
jne 0x40fb17
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x40faf2
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x10]
call fcn.00406a3c
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.user32.dll_SetWindowTextW
jmp 0x40fb17
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x10]
mov ecx, 0
call fcn.00406bf4
mov eax, dword [ebp - 4]
call fcn.004061d8
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.user32.dll_SetWindowTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fb34
lea eax, [ebp - 4]
call fcn.00405a18
ret
Function at 0x410994
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x410ade
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x4109bc
cmp dword [ebx + 4], 0
jne 0x410ade
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x4109e2
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x4109e2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x20], edx
push 0
push 0x100000
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
sub eax, dword [ebx + 8]
sbb edx, dword [ebx + 0xc]
push edx
push eax
call fcn.004108e8
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x410ade
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
jne 0x410a91
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x410a37
push 4
push 0x1000
push 0x100000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
push dword [ebx + 0xc]
push dword [ebx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor ecx, ecx
xor edx, edx
call fcn.00410928
test al, al
je 0x410a87
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x410a87
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 4]
jne 0x410a87
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], eax
jmp 0x410aaf
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x20], edx
jmp 0x410aaf
push dword [ebx + 0xc]
push dword [ebx + 8]
mov ecx, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, 4
call fcn.0041097c
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [ebx], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x410ade
mov ecx, dword [ebx + 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
call fcn.00414c28
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov dword [edx], eax
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x410ea8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 8], eax
mov esi, dword [ebx + 0x24]
sub esi, dword [ebx + 0x5c]
sub esi, dword [ebx + 0x54]
test esi, esi
jne 0x410ed9
cmp dword [ebx + 0x54], 0
jne 0x410ed9
cmp dword [ebx + 0x5c], 0
jne 0x410ed9
mov esi, dword [ebp - 8]
jmp 0x410f84
cmp esi, 0xffffffff
jne 0x410ee4
dec esi
jmp 0x410f84
mov eax, dword [ebx + 0x54]
mov edx, dword [ebp - 8]
sub edx, 0x106
add edx, dword [ebp - 8]
cmp eax, edx
jb 0x410f84
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 8]
lea edx, [eax + edx]
mov ecx, dword [ebp - 8]
xchg edx, eax
call fcn.00403294
mov eax, dword [ebp - 8]
sub dword [ebx + 0x58], eax
mov eax, dword [ebp - 8]
sub dword [ebx + 0x54], eax
mov eax, dword [ebp - 8]
sub dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x34]
mov edx, dword [ebx + 0x2c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jb 0x410f46
movzx ecx, word [ebp - 4]
sub cx, word [ebp - 8]
mov word [edx], cx
jmp 0x410f4b
mov word [edx], 0
dec eax
test eax, eax
jne 0x410f28
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x28]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jb 0x410f77
movzx ecx, word [ebp - 4]
sub cx, word [ebp - 8]
mov word [edx], cx
jmp 0x410f7c
mov word [edx], 0
dec eax
test eax, eax
jne 0x410f59
add esi, dword [ebp - 8]
mov ecx, dword [ebx]
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
push edx
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
cmp edx, dword [esp + 4]
jne 0x410fa0
cmp eax, dword [esp]
pop edx
pop eax
je 0x41100e
push ebp
mov eax, dword [ebx + 0x54]
add eax, dword [ebx + 0x5c]
mov edx, dword [ebx + 0x20]
add edx, eax
mov eax, ecx
mov ecx, esi
call fcn.00410e34
pop ecx
add dword [ebx + 0x5c], eax
cmp dword [ebx + 0x5c], 3
jb 0x410fe8
mov eax, dword [ebx + 0x54]
mov edx, dword [ebx + 0x20]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x30], eax
mov ecx, dword [ebx + 0x40]
shl eax, cl
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x20]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x3c]
mov dword [ebx + 0x30], eax
cmp dword [ebx + 0x5c], 0x106
jae 0x41100e
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx + 0x18]
jne 0x410eb8
cmp eax, dword [ecx + 0x14]
jne 0x410eb8
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x412568
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x4126b5
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x412590
cmp dword [ebx + 4], 0
jne 0x4126b5
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x4125b6
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x4125b6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x20], edx
push 0
push 0x100000
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
sub eax, dword [ebx + 8]
sbb edx, dword [ebx + 0xc]
push edx
push eax
call fcn.004108e8
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x4126b5
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
jne 0x412665
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x41260b
push 4
push 0x1000
push 0x100000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
push dword [ebx + 0xc]
push dword [ebx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor ecx, ecx
xor edx, edx
call fcn.00410928
test al, al
je 0x41265b
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x41265b
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 4]
jne 0x41265b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], eax
jmp 0x412683
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x20], edx
jmp 0x412683
push dword [ebx + 0xc]
push dword [ebx + 8]
mov ecx, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, 4
call fcn.0041097c
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [ebx], eax
cmp dword [ebx + 0xc], 0
jne 0x4126b5
cmp dword [ebx + 8], 0
jne 0x4126b5
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
cdq
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
add dword [ebx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
sub dword [ebx + 4], eax
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x414c28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
dec ecx
test ecx, ecx
jl 0x414c4c
inc ecx
mov eax, edx
mov edx, esi
xor dl, byte [eax]
movzx edx, dl
mov edx, dword [edx*4 + 0x617788]
shr esi, 8
xor edx, esi
mov esi, edx
inc eax
dec ecx
jne 0x414c33
mov eax, esi
pop esi
ret
Function at 0x416a98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
movzx eax, cl
mov edx, dword [ebp - 4]
cmp word [edx + eax*2], 0xffff
jne 0x416aea
mov dword [ebp - 0xc], 0x7fffffff
xor esi, esi
mov ebx, dword [ebp - 8]
movzx eax, cl
movzx edx, byte [ebx]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [ebp - 0xc]
jge 0x416ae1
movzx edx, cl
mov edi, dword [ebp - 4]
lea edi, [edi + edx*2]
mov word [edi], si
mov dword [ebp - 0xc], eax
inc esi
add ebx, 3
cmp esi, 0x10
jne 0x416ac0
movzx eax, cl
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4179d4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, eax
lea eax, [ebp - 0x14]
mov edx, 0x14
call fcn.0040abf0
mov dword [ebp - 0x14], 0x14
push 0x417adc
push 0x417af8
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409db4
mov ebx, eax
test ebx, ebx
je 0x417a17
lea eax, [ebp - 0x14]
push eax
call ebx
test eax, eax
jne 0x417a6d
lea eax, [ebp - 8]
push eax
call sub.user32.dll_GetCursorPos
test eax, eax
je 0x417a6d
push dword [ebp - 4]
push dword [ebp - 8]
call sub.user32.dll_WindowFromPoint
test eax, eax
je 0x417a3f
push 0
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov ebx, eax
jmp 0x417a41
xor ebx, ebx
test ebx, ebx
je 0x417a53
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetCursor
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x417a6d
push 0
push ebx
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_AttachThreadInput
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x417ad6
test byte [ebp - 0x10], 1
je 0x417ad6
lea eax, [ebp - 0x28]
push eax
push ebx
call sub.user32.dll_GetIconInfo
test eax, eax
je 0x417aae
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x417a95
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x417aa2
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 4], eax
push 3
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub edx, dword [eax - 8]
push edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
sub edx, dword [eax - 4]
push edx
push esi
call sub.user32.dll_DrawIconEx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4198e4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4198ec
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x419ae1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.004069b0
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x419948
lea eax, [ebp - 0x20]
mov edx, ebx
mov ecx, 0
call fcn.00406bf4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call dword [0x617bec]
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00406bcc
jmp 0x419aa9
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.00406a3c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x419aa9
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00406d2c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x419aa9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x419af0
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4199e7
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
jne 0x4199b9
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x4199e7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, esi
call fcn.004195c8
jmp 0x419aa9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x419af4
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x419aa9
cmp dword [ebp - 0x14], 0
je 0x419aa9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x419b34
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0040abec
mov edx, dword [ebp - 0x14]
movzx edx, word [edx]
call fcn.0040abe0
mov cx, 0x30
mov edx, 8
call fcn.0040dbc4
mov eax, dword [ebp - 0x30]
mov ecx, 0x7fffffff
mov edx, 2
call fcn.0040715c
push dword [ebp - 0x2c]
push 0x419b64
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00406f68
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00406c2c
mov eax, dword [ebp - 0x24]
call fcn.00406710
push eax
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x419aa9
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x18]
call fcn.00406b5c
mov eax, dword [ebp - 0x34]
mov ebx, dword [0x62f55c]
mov ebx, dword [ebx]
mov edx, esi
call ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419ae8
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004069a8
lea eax, [ebp - 0x24]
call fcn.00406544
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405a3c
lea eax, [ebp - 4]
call fcn.004069a0
ret
Function at 0x419b80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
push 0x40
push 0x1000
push 0x11
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [ebp - 4], ebx
mov eax, ebx
mov byte [eax], 0x58
mov byte [eax + 1], 0x68
mov dword [eax + 2], esi
mov byte [eax + 6], 0x50
mov byte [eax + 7], 0xff
mov byte [eax + 8], 0x25
lea edx, [eax + 0xd]
mov dword [eax + 9], edx
mov dword [eax + 0xd], edi
lea eax, [ebp - 8]
push eax
push 0x20
push 0x11
push 0
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x41a670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x41a6bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 2
mov edi, esi
mov eax, edi
call fcn.0041b6a4
test al, al
jne 0x41a6b2
cmp word [edi], 0x5a4d
jne 0x41a6b2
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x41a6b2
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41a6c8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41a860
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [0x617c08], 0
jne 0x41a941
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x41a8b3
push 0x10000
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW_1
mov esi, eax
jmp 0x41a8e4
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree
cmp esi, 0xffffffff
je 0x41a941
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x41a90f
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x41a921
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x41a93b
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
pop edi
pop esi
pop ebx
ret