joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418852
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x418861
pop dword [ebp - 0x14]
mov eax, 0x61c5460
add eax, 0xfa253401
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3b494
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3d9a
mov edx, eax
mov edi, 0x90ea4d93
add edi, 0x6f59066d
add edi, dword [ebp - 0x14]
mov esi, 0x61df7e37
xor dword [ebp - 4], ecx
mov ebx, dword [edi]
sub dword [ebp - 0x10], ebx
add ebx, esi
sub dword [ebp - 0x10], ecx
mov dword [edx], ebx
sub dword [ebp - 0xc], ecx
add edx, 0x5dbf23f6
sub edx, 0x5dbf23f2
add edi, 4
loop 0x4188af
add eax, 0xe93b
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401087
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push edi
lea eax, [ebp - 0x21c]
push eax
mov edi, 0x104
push edi
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp + 8]
call fcn.004013f9
call fcn.00443802
test eax, eax
je 0x4010d6
push 0x10
push 0x469f96
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4012b0
cmp dword [0x489880], 0
push ebx
push esi
mov ebx, 0x489894
jne 0x401106
push 0xffffffffffffffff
push dword [0x489888]
mov esi, 0x48b930
push 1
call fcn.00405f68
mov al, byte [0x47765c]
mov byte [0x48b932], al
jmp 0x401154
lea eax, [ebp - 2]
push eax
push 0x489880
mov esi, ebx
mov eax, 0x48b930
call fcn.004065c2
test al, al
jne 0x40112e
mov dword [0x477674], 1
jmp 0x4012a1
mov al, byte [0x48b930]
mov byte [0x489884], al
mov al, byte [0x48b931]
push 0x48987c
mov byte [ebp - 1], al
lea eax, [ebp - 0x428]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [0x489880]
push ebx
call fcn.00418bae
test eax, eax
je 0x40118a
mov edi, 0x48b930
call fcn.00406134
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x477674], 1
jmp 0x4012ae
cmp byte [ebp - 1], 1
jne 0x40123c
cmp byte [0x489855], 1
jne 0x40123c
call fcn.0040d365
test al, al
jne 0x40123c
push edi
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [ebp - 2], 0
je 0x401215
mov edi, 0x46a000
push edi
lea esi, [ebp - 0x10]
call fcn.0040dcac
push ebx
mov eax, esi
call fcn.0040dea7
push edi
mov eax, esi
call fcn.0040dea7
push 1
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x428]
push eax
push 0x46a004
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x10]
call fcn.0044d460
pop ecx
jmp 0x401297
push 1
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x428]
push eax
push 0x46a004
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401297
call fcn.004012b5
call fcn.00401388
cmp byte [0x489884], 0
jne 0x401259
mov edi, 0x48a2d8
call fcn.0040990c
push 1
mov eax, 0x489aa0
call fcn.00418d10
cmp byte [0x489884], 0
jne 0x401297
mov edi, 0x48b0fc
mov esi, dword [edi]
test esi, esi
je 0x40128c
push dword [esi + 8]
call fcn.0044d460
push esi
call fcn.0044d460
and dword [edi], 0
pop ecx
pop ecx
add edi, 4
cmp edi, 0x48b918
jl 0x401273
mov edi, 0x48b930
call fcn.00406134
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x401e83
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esi]
push ebp
xor ebp, ebp
cmp eax, ebp
jne 0x401e93
xor al, al
jmp 0x401f1d
push ebx
push edi
push 1
push eax
call fcn.004031a8
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ebp
push 0x25
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x10], ebp
push eax
jge 0x401edf
push 0x25
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x401f01
push 0x27
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push dword [esi]
call fcn.004031a8
pop edi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x4023b2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
jne 0x4023c5
xor al, al
jmp 0x4023fd
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0xb0
push eax
call esi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x4023e8
xor al, al
jmp 0x4023fc
push edi
push 0
push 0
push 0xe
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jne 0x402402
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 0x101]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044d3f6
pop ecx
push eax
mov dword [ebp - 4], eax
lea eax, [edi + 1]
push eax
push 0xd
push dword [ebx]
call esi
test eax, eax
je 0x40245f
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x40243e
mov ecx, dword [ebp - 4]
and word [ecx + eax*2], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2]
push eax
mov eax, dword [ebp + 8]
call fcn.0040de0f
mov bl, 1
push dword [ebp - 4]
call fcn.0044d460
pop ecx
mov al, bl
jmp 0x4023fb
xor bl, bl
jmp 0x402452
Function at 0x402e9b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp byte [esi + 8], 0
push edi
je 0x402ed3
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [esi + 0x30], eax
jne 0x402ecc
mov dword [esi + 0x3c], edi
xor eax, eax
jmp 0x402fe4
mov dword [ebp - 4], 1
cmp byte [esi + 4], 0
mov edi, dword [sym.imp.USER32.dll_GetClassNameW]
push ebx
mov ebx, 0x100
je 0x402f12
push ebx
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call edi
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x80c]
push ecx
push eax
call fcn.0044d935
test eax, eax
pop ecx
pop ecx
jne 0x402f0f
mov dword [ebp - 8], 1
inc dword [ebp - 4]
cmp byte [esi + 7], 0
je 0x402f7d
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x80c]
push eax
push ebx
call edi
mov edi, dword [esi + 0x18]
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d9c3
push eax
lea eax, [ebp - 0x80c]
push eax
push edi
call fcn.0044d98e
add esp, 0x10
test eax, eax
jne 0x402f78
inc dword [esi + 0x40]
push dword [esi + 0x40]
lea eax, [ebp - 0x80c]
push eax
push str._s_u
push eax
call fcn.0044d9d9
push dword [esi + 0x18]
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d935
add esp, 0x18
test eax, eax
je 0x402fd9
inc dword [ebp - 4]
jmp 0x402f80
mov ebx, dword [ebp + 8]
cmp byte [esi + 6], 0
je 0x402fb2
push 0x400
lea eax, [ebp - 0x80c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0x80c]
push ecx
push eax
call fcn.0044d935
test eax, eax
pop ecx
pop ecx
je 0x402fd9
inc dword [ebp - 4]
cmp byte [esi + 5], 0
je 0x402fd1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x402fce
inc dword [esi + 0x40]
mov eax, dword [esi + 0x40]
cmp eax, dword [esi + 0x34]
jne 0x402fce
inc dword [ebp - 8]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jne 0x402fe0
mov dword [esi + 0x3c], ebx
xor eax, eax
jmp 0x402fe3
xor eax, eax
inc eax
pop ebx
pop edi
leave
ret 4

Function at 0x4031a8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x4031d3
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x4031ee
push 1
jmp 0x4031d5
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret 8
Function at 0x405a7e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20630
call fcn.004528c0
push ebx
xor ebx, ebx
push esi
push edi
push 0x400
mov byte [0x48b930], bl
mov byte [0x48b931], bl
mov byte [0x48b932], bl
mov dword [0x48b934], ebx
mov dword [0x48b938], ebx
mov dword [0x48b93c], ebx
mov dword [0x48b940], ebx
mov dword [0x48b944], 0x46a390
mov dword [0x48b948], ebx
mov dword [0x48b94c], ebx
mov dword [0x48b950], ebx
mov dword [0x48b954], 0x46a390
mov dword [0x48b958], ebx
mov dword [0x48b95c], ebx
mov dword [0x48b960], ebx
mov dword [0x48b968], ebx
mov dword [0x48b970], ebx
call fcn.0044d3f6
pop ecx
mov dword [0x48b964], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0044fee5
push esi
lea eax, [ebp - 0x424]
push str.Include
push eax
call fcn.0044ff2f
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0044ff6c
mov edi, 0x20a
push edi
call fcn.0044d3f6
mov ecx, dword [0x48b964]
mov edx, dword [0x48b968]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x48b968]
mov eax, dword [0x48b964]
mov eax, dword [eax + ecx*4]
inc dword [0x48b968]
lea ecx, [ebp - 0x21c]
push ecx
push eax
call fcn.0044d37c
add esp, 0x40
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405ce5
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20630]
push eax
push ebx
push ebx
push str.Include
push dword [ebp - 0xc]
mov dword [ebp - 4], 0x1fffe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405cdc
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
add eax, eax
mov word [ebp + eax - 0x20630], bx
mov word [ebp + eax - 0x2062e], bx
lea eax, [ebp - 0x20630]
mov word [ebp - 0x21c], bx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp ax, bx
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], bx
je 0x405c4e
cmp ax, 0x3b
je 0x405c4e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0044d352
pop ecx
pop ecx
jmp 0x405cd3
lea eax, [ebp - 0x21c]
push eax
call fcn.0044d9c3
test eax, eax
pop ecx
je 0x405c8a
lea eax, [ebp - 0x21c]
push eax
call fcn.0044d9c3
cmp word [ebp + eax*2 - 0x21e], 0x5c
pop ecx
je 0x405c8a
lea eax, [ebp - 0x21c]
push 0x46a584
push eax
call fcn.0044d352
pop ecx
pop ecx
push edi
call fcn.0044d3f6
mov ecx, dword [0x48b964]
mov edx, dword [0x48b968]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x48b968]
mov eax, dword [0x48b964]
mov eax, dword [eax + ecx*4]
inc dword [0x48b968]
push esi
lea ecx, [ebp - 0x21c]
push ecx
push eax
call fcn.0044ff8a
mov eax, dword [ebp - 8]
add esp, 0x10
cmp word [eax], bx
mov word [ebp - 0x21c], bx
je 0x405cdc
add dword [ebp - 8], 2
jmp 0x405c1e
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x48b930
pop ebx
leave
ret
Function at 0x407c0d
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp ebx, edi
jne 0x407c27
mov eax, dword [ebp + 8]
cmp byte [eax + 9], 0
je 0x407cfd
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], eax
je 0x407cc8
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp - 4]
mov dword [0x48bde8], eax
call esi
test ebx, ebx
mov dword [ebp + 0xc], eax
je 0x407c9a
lea eax, [ebp - 0xc]
push eax
push ebx
call edi
mov ecx, dword [0x48bde8]
cmp ecx, eax
mov dword [0x48bde4], eax
je 0x407c8f
push 1
push eax
push ecx
call esi
mov dword [ebp - 8], eax
mov eax, dword [0x48bde4]
push 1
push eax
push dword [ebp - 4]
call esi
mov dword [ebp - 0xc], eax
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jne 0x407cfc
cmp dword [ebp - 8], ecx
jne 0x407cfc
cmp dword [ebp - 0xc], ecx
jne 0x407cfc
mov eax, dword [0x48bde8]
cmp dword [ebp - 4], eax
jne 0x407cfc
cmp eax, dword [0x48bde4]
jne 0x407cfc
mov eax, dword [ebp + 8]
mov dword [eax + 0x248], ecx
jmp 0x407cfc
cmp ebx, edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x407cf0
push edi
push dword [0x48bde4]
push eax
call esi
mov ecx, dword [0x48bde8]
mov eax, dword [0x48bde4]
cmp ecx, eax
je 0x407cf0
push edi
push eax
push ecx
call esi
push edi
push dword [0x48bde8]
push dword [ebp - 4]
call esi
pop esi
pop edi
leave
ret 8

Function at 0x407d73
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
cmp byte [ebp + 0xc], al
mov byte [ebp - 1], al
je 0x407dd1
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov eax, esi
call fcn.00407d02
mov edi, dword [esi + 4]
push esi
call fcn.00408ee9
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push dword [ebp + 8]
mov eax, esi
push 2
pop ebx
call fcn.00407d02
mov edi, dword [esi]
push esi
call fcn.00408ee9
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret 8
Function at 0x408ee9
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
test edi, edi
push esi
jl 0x408f7d
jne 0x408f01
push 0
jmp 0x408f77
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x219]
neg al
sbb eax, eax
and eax, 0x28
add eax, 0xf
cmp edi, eax
jae 0x408f76
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call esi
test eax, eax
je 0x408f76
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 8]
push eax
call esi
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sbb ecx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
fild qword [esp + 0x18]
fild qword [esp + 0x20]
fdivp st(1)
fmul qword [0x470338]
call fcn.00464806
cmp eax, edi
jb 0x408f34
jmp 0x408f7d
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x408f84
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
cmp word [eax], bx
push esi
mov esi, ecx
mov byte [ebp - 1], 1
mov dword [ebp - 0xc], ebx
jne 0x408fa3
xor al, al
jmp 0x4090c0
push eax
or eax, 0xffffffff
call fcn.0040d90e
mov ecx, dword [ebp + 0x10]
mov byte [ecx], bl
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x10], eax
mov byte [edi], bl
mov byte [esi], bl
mov byte [ecx], bl
call fcn.0044f530
inc eax
push eax
call fcn.0044d3f6
add esp, 0xc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov al, byte [ecx + ebx]
cmp al, 0x2b
je 0x408fea
cmp al, 0x5e
je 0x408fe6
cmp al, 0x21
je 0x408fe6
cmp al, 0x23
jne 0x40900e
cmp al, 0x2b
jne 0x408fef
mov eax, dword [ebp + 0xc]
jmp 0x408fff
cmp al, 0x5e
jne 0x408ff8
mov byte [esi], 1
jmp 0x40900b
cmp al, 0x21
jne 0x409004
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x40900b
cmp al, 0x23
jne 0x40900b
mov byte [edi], 1
inc ebx
jmp 0x408fd0
mov al, byte [ecx + ebx]
inc ebx
cmp al, 0x7b
mov byte [ebp - 0x18], al
mov dword [ebp - 0x14], ebx
jne 0x409070
mov ebx, dword [ebp - 8]
lea edx, [ebp - 0x14]
mov esi, ecx
add al, 2
call fcn.00408eac
test eax, eax
jne 0x40905c
mov esi, dword [ebp - 0xc]
push ebx
push dword [esi*4 + 0x476438]
call fcn.00462515
test eax, eax
pop ecx
pop ecx
je 0x40904e
inc esi
cmp esi, 0x62
mov dword [ebp - 0xc], esi
jl 0x40902f
cmp esi, 0x62
je 0x40905c
cmp byte [esi + 0x4765c0], 0
je 0x409062
mov byte [ebp - 1], 0
jmp 0x4090a2
mov eax, dword [esi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x4090a2
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov ecx, dword [ebp + 8]
movsx eax, ax
test ax, 0x200
mov dword [ecx], eax
je 0x40908a
mov byte [esi], 1
test ax, 0x400
je 0x409096
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 1
test ax, 0x100
je 0x4090a2
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp + 8]
push dword [ebp - 0x10]
and dword [eax], 0xff
call fcn.0044d460
push dword [ebp - 8]
call fcn.0044d460
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop esi
pop ebx
leave
ret 0xc
Function at 0x40915f
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, eax
xor ebp, ebp
cmp esi, ebp
push edi
jne 0x40917b
push ebp
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov edi, dword [esp + 0x20]
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x409193
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp eax, ebp
jne 0x409265
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebp
push dword [esp + 0x28]
mov ebx, eax
mov dword [esp + 0x24], ebx
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push ebx
mov dword [esp + 0x1c], eax
call esi
push 1
push edi
push ebx
call esi
push 1
push dword [esp + 0x14]
push edi
call esi
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp eax, ebp
mov dword [esp + 0x14], eax
jne 0x40924b
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ebp
push ebp
push ebp
push 0x12
call edi
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call ebx
push ebp
push 2
push ebp
push 0x12
call edi
push eax
push 0x12
call ebx
push ebp
push ebp
push ebp
push 0x12
call edi
push eax
push 0x12
call ebx
push ebp
push 2
push ebp
push 0x12
call edi
push eax
push 0x12
call ebx
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
push ebp
push dword [esp + 0x14]
push ebx
call esi
push ebp
push edi
push ebx
call esi
push ebp
push dword [esp + 0x14]
push edi
call esi
mov eax, dword [esp + 0x14]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
Function at 0x409339
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
push edi
xor ebx, ebx
xor edi, edi
lea eax, [esi + 0x20]
cmp dword [eax], ebx
je 0x409356
inc edi
add eax, 8
cmp edi, 0x10
jl 0x409349
cmp edi, 0x10
jne 0x409362
xor eax, eax
jmp 0x409402
cmp byte [esi + 0x18], 1
jne 0x4093d9
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 4]
lea eax, [esi + edi*8 + 0x1c]
push ebx
push 0x438
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [esi + 8], ebx
jne 0x4093b5
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi], eax
je 0x4093b5
push str.VirtualAllocEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, ebx
jne 0x4093c1
mov eax, 0x427b3d
mov ecx, dword [ebp + 0xc]
push 4
push 0x1000
push dword [ebp + 8]
lea esi, [esi + edi*8 + 0x20]
push ebx
push dword [ecx]
call eax
jmp 0x409400
push ebx
push dword [ebp + 8]
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebx
push ebx
push ebx
push 0xf001f
mov dword [esi + edi*8 + 0x1c], eax
push eax
lea esi, [esi + edi*8 + 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi], eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40ae87
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi]
test al, 3
je 0x40af07
push ebx
xor ebx, ebx
inc ebx
test bl, al
je 0x40aeb0
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call fcn.0045041b
mov eax, dword [ebp - 8]
or eax, dword [ebp - 4]
pop ecx
pop ecx
jne 0x40af06
mov eax, dword [esi]
test al, 0x20
je 0x40aecb
push dword [esi + 4]
push 2
push ebx
push 0x46ae30
call fcn.004505e5
mov dword [esi + 0xc], ebx
jmp 0x40af03
test al, 0x40
je 0x40aee8
push dword [esi + 4]
push 2
push ebx
push 0x46ae34
call fcn.004505e5
mov dword [esi + 0xc], 2
jmp 0x40af03
test al, al
jns 0x40af06
push dword [esi + 4]
push 3
push ebx
push str.rb
call fcn.004505e5
mov dword [esi + 0xc], 4
add esp, 0x10
pop ebx
leave
ret

Function at 0x40af3b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and dword [esi + 0xc], 0
push edi
push 0x46ae3c
push dword [ebp + 8]
mov byte [esi + 8], 0
call fcn.004502fc
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x40afc6
push ebx
push edi
push 3
lea eax, [ebp + 8]
push 1
push eax
call fcn.004509f1
push edi
mov ebx, eax
call fcn.004506d9
add esp, 0x14
push 2
pop eax
cmp ebx, eax
jb 0x40afa3
cmp byte [ebp + 8], 0xff
jne 0x40af92
cmp byte [ebp + 9], 0xfe
jne 0x40afa3
mov dword [esi + 0xc], 1
jmp 0x40afc1
cmp byte [ebp + 8], 0xfe
jne 0x40afa3
cmp byte [ebp + 9], 0xff
jne 0x40afa3
mov dword [esi + 0xc], eax
jmp 0x40afc1
cmp ebx, 3
jb 0x40afc5
cmp byte [ebp + 8], 0xef
jne 0x40afc5
cmp byte [ebp + 9], 0xbb
jne 0x40afc5
cmp byte [ebp + 0xa], 0xbf
jne 0x40afc5
mov dword [esi + 0xc], 4
mov byte [esi + 8], 1
pop ebx
pop edi
pop ebp
ret 4