joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b30c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0042b2b5
test eax, eax
je 0x42b465
lea ecx, [esp + 0x18]
call fcn.0042b2b5
lea ecx, [esp + 0x18]
test eax, eax
je 0x42b3d4
call fcn.0042b2b5
test eax, eax
je 0x42b396
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0042b2b5
lea edi, [eax + edi*2]
dec ebx
jne 0x42b36c
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x42b38d
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x42b390
mov byte [edx], 0
inc edx
jmp 0x42b477
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x42b3cc
test ecx, ecx
je 0x42b460
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42b3be
jmp 0x42b45c
xor ebp, ebp
inc ebp
jmp 0x42b460
call fcn.0042b2eb
test edi, edi
jne 0x42b409
cmp eax, 2
jne 0x42b404
lea ecx, [esp + 0x18]
call fcn.0042b2eb
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x42b460
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x42b3f9
jmp 0x42b45c
sub eax, 3
jmp 0x42b40c
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0042b2eb
mov ecx, eax
cmp esi, 0x7d00
jb 0x42b433
inc ecx
cmp esi, 0x500
jb 0x42b43c
inc ecx
cmp esi, 0x80
jae 0x42b447
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x42b460
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42b453
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x42b47d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x42b33c
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b602
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x42b634
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x42b615
jmp 0x42b638
mov eax, dword [esp + 0x10]
test edi, edi
je 0x42b642
xor byte [esi], al
inc esi
dec edi
jne 0x42b63c
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x40abfb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41d410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040720a
and dword [ebp - 0x14], 0
cmp dword [0x43d980], 0
mov dword [ebp - 0x18], eax
jne 0x40acae
push 0x40248c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ad56
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402480
push ebx
call edi
test eax, eax
je 0x40ad56
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402470
push ebx
mov dword [0x43d980], eax
call edi
push eax
call esi
push 0x40245c
push ebx
mov dword [0x43d984], eax
call edi
push eax
call esi
push 0x402440
push ebx
mov dword [0x43d988], eax
call edi
push eax
call esi
mov dword [0x43d990], eax
test eax, eax
je 0x40acae
push 0x402428
push ebx
call edi
push eax
call esi
mov dword [0x43d98c], eax
mov eax, dword [0x43d98c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ad07
cmp dword [0x43d990], ecx
je 0x40ad07
push eax
call esi
push dword [0x43d990]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ad07
test ebx, ebx
je 0x40ad07
call edi
test eax, eax
je 0x40acfe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40acfe
test byte [ebp - 8], 1
jne 0x40ad07
or dword [ebp + 0x10], 0x200000
jmp 0x40ad3a
mov eax, dword [0x43d984]
cmp eax, dword [ebp - 0x18]
je 0x40ad3a
push eax
call esi
test eax, eax
je 0x40ad3a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ad3a
mov eax, dword [0x43d988]
cmp eax, dword [ebp - 0x18]
je 0x40ad3a
push eax
call esi
test eax, eax
je 0x40ad3a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43d980]
call esi
test eax, eax
je 0x40ad56
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ad58
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040af75
leave
ret

Function at 0x40af75
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41d410]
jne 0x40af7f
repz ret
jmp fcn.00413ece
Function at 0x41b200
Capabilities:
Delete file
Get uefi variable

Disassembly:
sub esp, 0xc2c
cmp dword [0x2b674e4], 0x37
jne 0x41b26d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
lea edx, [esp]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea ecx, [esp + 0x42c]
push ecx
push 0x4035f0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov edx, dword [0x2b678f8]
mov ecx, dword [0x2b66fc8]
mov al, byte [edx + esi + 0x38d6]
mov byte [ecx + esi], al
add esp, 0xc2c
ret
Function at 0x4015f1
Capabilities:
Log keystrokes via polling
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
push ecx
fxsave [0x44ce50]
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
mov eax, edi
shr ecx, 1
jae 0x401612
xor eax, eax
shr ecx, 1
push ecx
push edi
push edi
push eax
movlps qword [edi], xmm0
jb 0x40162a
push esi
call sub.kernel32.dll_GetSystemTime
push edi
push esi
call sub.kernel32.dll_SystemTimeToFileTime
push dword [ebp + 8]
call sub.kernel32.dll_SetFileTime
pop ecx
fxrstor [0x44ce50]
jecxz 0x401644
test eax, eax
je 0x4028a0
pop ecx
pop edi
pop esi
leave
ret 8
mov esi, 0x44ee76
mov ecx, dword [0x45e3bc]
jecxz 0x4028bf
push 0xfffffffffffffffe
push ecx
push esi
call fcn.00406cc0
mov dword [eax], 0xa0d3a
lea esi, [eax + 3]
push 0xfffffffffffffffe
push str.GetLastError__line___:_r_n
push esi
call fcn.00406cc0
xchg esi, eax
call sub.kernel32.dll_GetLastError
push 0
push 0x400
push esi
push 0
push eax
push 0
push 0x1000
call sub.kernel32.dll_FormatMessageA
push 0
jmp 0x402871
Function at 0x401ebb
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov eax, dword [eax*4 + 0x44eacc]
push edx
mov edx, esp
fxsave [0x44ce50]
push 0
push edx
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call sub.kernel32.dll_ReadFile
call fcn.004027b0
fxrstor [0x44ce50]
pop eax
mov edx, dword [esp + 0xc]
pop ecx
ret 0xc

Function at 0x40260a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ecx
push esi
fxsave [0x44ce50]
lea esi, [ebp - 0x24]
mov edx, dword [ebp + 8]
cmp edx, 0xa
ja 0x402636
push esi
push dword [edx*4 + 0x44eacc]
call sub.kernel32.dll_GetFileSizeEx
mov edx, dword [esi + 4]
jmp 0x402645
push esi
push 0
push edx
call sub.kernel32.dll_GetFileAttributesExA
add esi, 0x20
mov edx, dword [esi - 4]
dec eax
js 0x402649
lodsd eax, dword [esi]
fxrstor [0x44ce50]
pop esi
pop ecx
leave
ret 4

Function at 0x4027b0
Capabilities:
Log keystrokes via polling

Disassembly:
test eax, eax
jne 0x40285e
cmp dword [0x409bb0], eax
jne 0x40285e
pushal
mov edi, 0x409bb0
stosd dword es:[edi], eax
xchg ebx, eax
mov esi, 0x409bb4
call sub.kernel32.dll_GetLastError
push ebx
push 0x130
push esi
push ebx
push eax
push ebx
push 0x1000
call sub.kernel32.dll_FormatMessageA
add eax, esi
mov dword [eax], 0x20706965
lea ecx, [eax + 4]
mov edx, dword [esp + 0x20]
sub edx, 5
push 4
push edx
call fcn.004040e5
push eax
push ecx
call sub.kernel32.dll_lstrcpyA
call sub.kernel32.dll_GetConsoleWindow
test eax, eax
je 0x40283a
push str._API_error:
call fcn.00406fa0
push 0x409334
call fcn.00406fa0
push esi
call fcn.00406fa0
push 0x409338
call fcn.00406fa0
jmp 0x402851
push 0x10001
push 0x409327
push esi
push ebx
call sub.user32.dll_MessageBoxA
dec eax
mov dword [edi - 4], eax
je 0x40285d
push 0x11
call sub.user32.dll_GetKeyState
test ah, ah
jns 0x40285d
int3
popal
ret

Function at 0x402a38
Capabilities:
Log keystrokes via polling

Disassembly:
inc eax
push ecx
push edx
fxsave [0x44ce50]
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [0x45e8c4]
call sub.kernel32.dll_HeapAlloc
fxrstor [0x44ce50]
inc dword [0x45e3b0]
test eax, eax
je 0x4028f2
pop edx
pop ecx
ret 8

Function at 0x402a6e
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push edx
test eax, eax
je 0x402aa3
cmp eax, 0x45e3c8
je 0x402aa3
push eax
fxsave [0x44ce50]
push eax
push 0
push dword [0x45e8c4]
call sub.kernel32.dll_HeapFree
fxrstor [0x44ce50]
inc dword [0x45e3b4]
pop edx
test eax, eax
je 0x402aa6
pop edx
pop ecx
ret
pushal
push 4
push edx
call fcn.004040e5
mov edi, 0x409ce4
mov dword [edi], 0x3d727470
movlps xmm0, qword [eax]
movlps qword [edi + 4], xmm0
call sub.kernel32.dll_GetLastError
push 4
push eax
call fcn.004040e5
movlps xmm0, qword [eax]
movlps qword [edi + 0x10], xmm0
mov dword [edi + 0xc], 0x3d65202c
push 3
push 0x4092ff
push edi
push 0
call sub.user32.dll_MessageBoxA
popal
mov ecx, dword [0x409bac]
cmp eax, 7
je 0x402aa3
sub eax, 2
je 0x4028f1
int3
Function at 0x403132
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push ecx
push edx
lodsd eax, dword [esi]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
mov dword [ebp - 0xc], eax
add edx, 0x7c
je 0x40316f
dec edx
je 0x40329f
dec edx
je 0x4031ad
dec edx
jle 0x4031c1
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
push esi
rep movsb byte es:[edi], byte [esi]
call sub.kernel32.dll_GlobalFree
and dword [0x409a3c], 0
jmp 0x4031a8
mov edx, eax
lodsd eax, dword [esi]
sub dword [esi - 4], edx
mov ebx, esi
xchg esi, eax
mov ecx, dword [ebx]
sub ecx, dword [ebx - 4]
sub ecx, dword [ebp - 0xc]
jle 0x40318e
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add ebx, 4
cmp dword [ebx], 0
je 0x4031a8
mov edx, dword [ebp - 8]
mov al, byte [edx]
test al, al
je 0x4031a3
inc edx
stosb byte es:[edi], al
jmp 0x403199
add esi, dword [ebp - 0xc]
jmp 0x403178
pop edx
pop ecx
pop ebx
leave
ret
xor eax, eax
mov ecx, dword [ebp - 8]
dec ecx
push ecx
shr ecx, 2
rep stosd dword es:[edi], eax
pop ecx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4031a8
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
test eax, eax
jne 0x4031ee
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call fcn.00406cc0
pop eax
push dword [ebp - 0xc]
push edi
test al, 1
jne 0x4031e4
call sub.user32.dll_CharLowerBuffA
jmp 0x4031e9
call sub.user32.dll_CharUpperBuffA
add edi, dword [ebp - 0xc]
jmp 0x4031a8
push eax
mov ecx, dword [ebp - 0xc]
push 0
push 0
push ecx
push edi
push 0xffffffffffffffff
push eax
push 0
push dword [0x44d860]
call sub.kernel32.dll_WideCharToMultiByte
test eax, eax
je 0x403211
cmp eax, dword [ebp - 0xc]
jbe 0x40328b
pushal
test eax, eax
je 0x403251
pushal
pushfd
call sub.kernel32.dll_GetLastError
mov edi, eax
push 0
push 0x400
push 0x409f84
push 0
push edi
push 0
push 0x1000
call sub.kernel32.dll_FormatMessageA
popfd
popal
push 0
push str.mbrcUL8_eax:
push 0x409f84
push 0
call sub.user32.dll_MessageBoxA
jmp 0x40328a
pushal
pushfd
call sub.kernel32.dll_GetLastError
mov edi, eax
push 0
push 0x400
push 0x409f84
push 0
push edi
push 0
push 0x1000
call sub.kernel32.dll_FormatMessageA
popfd
popal
push 0
push str.mbrcUL8_eax0:
push 0x409f84
push 0
call sub.user32.dll_MessageBoxA
popal
push 0
push dword [0x45e8c4]
call sub.kernel32.dll_HeapFree
pop eax
dec edi
jmp 0x4031e9
mov eax, dword [ebp - 8]
cmp eax, 0x7f
ja 0x4032c5
push 0xa
push eax
push 0
call sub.kernel32.dll_FindResourceA
push eax
push 0
call sub.kernel32.dll_LoadResource
push dword [ebp - 0xc]
push eax
push edi
call fcn.00406cc0
jmp 0x4032ef
push 0
push eax
push 0x4a
call fcn.0040147a
cmp eax, 0xffffffff
jne 0x4032dc
mov dword [ebp - 0xc], eax
mov al, 0x3f
stosb byte es:[edi], al
jmp 0x4032ef
push dword [ebp - 0xc]
push edi
push 0xa
call fcn.00401ebb
push 0xa
pop eax
call fcn.004013b4
mov edx, dword [edi]
mov dword [0x409a4c], edx
add edi, dword [ebp - 0xc]
jmp 0x4031a8
Function at 0x40331a
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
fxsave [0x44ce50]
push esi
push ebx
push ecx
mov esi, dword [esp + 0x14]
call fcn.004032ff
push esi
mov edx, 0x409f7c
pop ebx
cmp ebx, 0xffffff91
jne 0x40333d
mov esi, dword [edx]
jmp 0x403341
and dword [edx + 4], 0
mov dword [edx], esi
push esi
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x4033b2
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4033b2
push esi
call sub.user32.dll_GetClipboardData
test eax, eax
je 0x4033ad
push eax
push eax
call sub.kernel32.dll_GlobalLock
mov edx, 0x409f80
cmp ebx, 0xffffff91
jne 0x40337a
xchg esi, eax
mov ecx, dword [edx]
rep movsb byte es:[edi], byte [esi]
jmp 0x4033a8
push edi
push edx
push dword [eax]
push eax
cmp esi, 0xd
jne 0x40338d
call fcn.00401f87
add eax, eax
jmp 0x403392
call fcn.00401fd0
pop ebx
pop edi
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jbe 0x40339d
xchg ecx, eax
stosd dword es:[edi], eax
add ebx, eax
push ebx
sub ebx, dword [edi - 0xc]
pop dword [edi - 0xc]
pop edi
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
xchg esi, eax
test ebx, ebx
pop ecx
pop ebx
pop esi
fxrstor [0x44ce50]
ret 8

Function at 0x40347a
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
call fcn.00405134
mov ecx, dword [esp + 8]
xor edx, edx
cmp ecx, 0x45ee08
jb 0x403496
cmp ecx, 0x4fb208
jb 0x403497
inc edx
push edx
push eax
mov dword [eax], ecx
jecxz 0x4034c0
push eax
push 0x13880
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar
pop edx
dec eax
js 0x4028a0
shl eax, 1
add dword [esp], eax
call fcn.00405146
pop ecx
ret 4

Function at 0x4036c3
Capabilities:
Log keystrokes via polling

Disassembly:
ja 0x40286f
mov edx, dword [esp + 4]
pushal
mov ebx, dword [edx*4 + 0x45e590]
sub ebx, 0x10
inc dword [ebx + 8]
cmp eax, dword [ebx]
jb 0x40375e
mov edi, dword [ebx + 0xc]
add eax, 0x7f
mul edi
xchg esi, eax
xor eax, eax
mov ah, 0x10
cmp esi, eax
jb 0x403700
mov ah, 0x80
cmp esi, 0x10000
jbe 0x403700
imul eax, esi, 5
shr eax, 3
add esi, eax
and esi, 0xfffff000
fxsave [0x44ce50]
push esi
push ebx
push 8
push dword [0x45e8c4]
call sub.kernel32.dll_HeapReAlloc
fxrstor [0x44ce50]
test eax, eax
je 0x4028f2
mov edx, 0x45e72c
push 0x64
pop ecx
add edx, 4
dec ecx
js 0x40286f
cmp ebx, dword [edx]
jne 0x403735
mov dword [edx], eax
push eax
add eax, 0x10
mov ecx, dword [esp + 0x28]
mov dword [ecx*4 + 0x45e590], eax
xchg esi, eax
sub eax, 0x10
cdq
div edi
pop edx
mov dword [edx], eax
popal
mov edx, dword [edx*4 + 0x45e590]
ret 4
Function at 0x403e38
Capabilities:
Log keystrokes via polling

Disassembly:
push 8
jmp fcn.0040289d
push edx
push ecx
push eax
sub esp, 0x20
movups xmmword [esp], xmm0
movups xmmword [esp + 0x10], xmm1
mov edx, 0x45e730
and dword [edx + 0x190], 0
xorps xmm0, xmm0
movaps xmm1, xmm0
pcmpeqd xmm1, xmmword [edx + 0x10]
pcmpeqd xmm0, xmmword [edx]
lea edx, [edx + 0x20]
por xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
je 0x403e59
shl eax, 0x10
pmovmskb ecx, xmm0
or eax, ecx
bsf eax, eax
lea edx, [edx + eax - 0x20]
mov ecx, dword [0x45e720]
sub ecx, edx
je 0x402867
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
add esp, 0x20
pop eax
mov dword [edx], eax
pop ecx
pop edx
ret

Function at 0x404ba2
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebx
sub esp, 0xfc0
lea ebx, [esp + 0x14]
push edi
call fcn.00401f87
cmp eax, 0xd50
jae 0x404d2a
lea eax, [edi + eax*2]
dec eax
dec eax
cmp eax, edi
jbe 0x404bcd
cmp word [eax], 0x5c
jne 0x404bc1
cmp eax, edi
jbe 0x404bd3
inc eax
inc eax
mov edx, eax
sub edx, edi
push edx
mov dword [ebx - 0xc], eax
push eax
pop dword [ebx - 8]
push 0x2a
pop dword [eax]
push edi
lea edx, [ebx + 0x250]
push edx
call fcn.00406cc0
mov dword [ebx - 0x10], eax
push esi
push 0x10
pop dword [ebx - 4]
lea edx, [0x44a668]
push dword [edx + 4]
push 0
push 0
push ebx
push dword [edx]
push edi
call sub.kernel32.dll_FindFirstFileExW
mov dword [ebx - 0x14], eax
cmp eax, 0xffffffff
je 0x404ce7
movups xmmword [ebp - 0x38], xmm0
mov ecx, dword [ebx]
and ecx, 0x10
xor ecx, dword [ebx - 4]
jne 0x404cca
lea edx, [ebx + 0x2c]
mov eax, dword [edx]
cmp al, 0x2e
jne 0x404c4e
shr eax, 0x10
test al, al
jne 0x404c41
xor eax, eax
jmp 0x404c4e
cmp al, 0x2e
jne 0x404c4e
shr eax, 0x10
test al, al
jne 0x404c4e
xor eax, eax
test eax, eax
je 0x404cca
mov ecx, dword [0x44a670]
jecxz 0x404c86
push edx
push esi
mov esi, edx
push esi
call fcn.00401f87
add eax, eax
push eax
push esi
push dword [ebx - 0xc]
call fcn.00406cc0
and dword [eax], 0
xchg ecx, eax
mov ecx, dword [ebp - 0x14]
push ebx
mov edx, ebx
mov ebx, 0x4fb6a0
call eax
pop ebx
pop esi
pop edx
je 0x404cca
cmp dword [ebx - 4], 0
je 0x404cc0
cmp dword [ebp - 0x10], 0
je 0x404c99
push edx
call fcn.00404d32
pop edx
cmp dword [ebp - 0xc], 0
je 0x404cbe
push edx
push edx
call fcn.00401f87
add eax, eax
pop edx
push eax
push edx
push dword [ebx - 0xc]
call fcn.00406cc0
mov dword [eax], 0x5c
call fcn.00404ba2
jmp 0x404cca
cmp ecx, 0xffffff91
je 0x404cca
call fcn.00404d32
push ebx
push dword [ebx - 0x14]
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x404c1f
push dword [ebx - 0x14]
call sub.kernel32.dll_FindClose
movups xmm0, xmmword [ebp - 0x38]
mov edx, esi
lodsw ax, word [esi]
test al, al
je 0x404d21
lodsw ax, word [esi]
cmp al, 0x7c
je 0x404cf9
test al, al
jne 0x404cef
xchg esi, ecx
push ecx
sub ecx, edx
test al, al
je 0x404d04
dec ecx
dec ecx
push ecx
push edx
push dword [ebx - 0xc]
call fcn.00406cc0
xor edx, edx
mov word [eax], dx
pop esi
mov dword [ebx - 4], edx
cmp dword [ebp - 0x10], 0
je 0x404bf9
mov ecx, dword [ebx - 0xc]
mov eax, dword [ebx - 8]
mov dword [ecx], eax
pop esi
add esp, 0xfc0
pop ebx
ret
Function at 0x405080
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push esi
push ebx
push ecx
mov edi, 0x4563aa
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test ebx, ebx
jns 0x405097
xor ebx, ebx
test bh, bh
js 0x402863
push 1
call fcn.0040517e
mov dword [edx], edi
push edi
test ebx, ebx
je 0x4050f6
xor eax, eax
cmp byte [esi + 1], al
jne 0x4050c0
mov dword [edx + 4], ebx
mov ecx, ebx
lodsb al, byte [esi]
rep stosb byte es:[edi], al
mov byte [edi], cl
jmp 0x4050ee
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
sub edi, esi
lea eax, [edi - 1]
imul eax, ebx
test ah, ah
js 0x402863
mov eax, dword [esp]
dec edi
push edi
push esi
push eax
call fcn.00406cc0
dec ebx
jg 0x4050db
mov byte [eax], bl
sub eax, dword [esp]
mov dword [edx + 4], eax
pop eax
pop ecx
pop ebx
pop esi
pop edi
ret 8
push edi
call fcn.00401fd0
mov dword [edx + 4], eax
jmp 0x4050ee

Function at 0x4051bc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
pushal
push 1
pop eax
cpuid
bt edx, 0x1a
jb 0x4051df
push 0
push 0
push 0x4093ac
push 0
call sub.user32.dll_MessageBoxA
push 0xffffffffffffff9d
call sub.kernel32.dll_ExitProcess
mov dword [0x45e720], 0x45e8c0
call sub.kernel32.dll_GetProcessHeap
mov dword [0x45e8c4], eax
mov edi, 0x45ea8c
mov eax, 0x40960c
stosd dword es:[edi], eax
xchg edx, eax
xor eax, eax
stosd dword es:[edi], eax
lea eax, [edx + 1]
stosd dword es:[edi], eax
push 2
pop eax
stosd dword es:[edi], eax
lea eax, [edx + 6]
stosd dword es:[edi], eax
push 1
pop eax
stosd dword es:[edi], eax
lea eax, [edx + 0xb]
stosd dword es:[edi], eax
push 1
pop eax
stosd dword es:[edi], eax
lea eax, [edx + 0xa]
stosd dword es:[edi], eax
push 2
pop eax
stosd dword es:[edi], eax
lea eax, [edx + 8]
stosd dword es:[edi], eax
push 4
pop eax
stosd dword es:[edi], eax
push edx
mov eax, dword [0x409590]
stosd dword es:[edi], eax
xchg esi, eax
push 0x104
push esi
push 0
call sub.kernel32.dll_GetModuleFileNameA
dec eax
js 0x405249
cmp byte [esi + eax - 1], 0x5c
jne 0x40523f
mov byte [esi + eax], ah
stosd dword es:[edi], eax
pop edx
lea eax, [edx + 0xd]
stosd dword es:[edi], eax
push 1
pop eax
stosd dword es:[edi], eax
cpuid
bt ecx, 0x14
mov eax, fcn.004067b0
jae 0x405268
mov eax, 0x406993
mov edi, 0x44a7a8
stosd dword es:[edi], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
movzx eax, byte [eax + 2]
test eax, eax
je 0x405287
mov dword [edi - 4], fcn.004067b0
stosd dword es:[edi], eax
xor ebx, ebx
mov edx, ebx
xor eax, eax
push 0x20
pop ecx
shr edx, 1
adc al, 0
loop 0x405291
stosb byte es:[edi], al
inc bl
jne 0x40528a
popal
ret
Function at 0x406528
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
movzx eax, byte [0x409540]
test edi, edi
je 0x406536
or al, 2
cmp byte [ebp + 9], ah
jns 0x40653d
or al, 0x40
and al, 0x43
mov dword [ebp - 0xc], eax
test al, 1
je 0x40656d
mov esi, 0x44cc20
xor ecx, ecx
xor ebx, ebx
test al, 2
jne 0x406556
add ebx, 9
cmp ecx, dword [esi]
jne 0x40656a
inc bh
push ebx
push esi
mov byte [esi + ecx], cl
inc cl
jne 0x40655e
call sub.user32.dll_CharLowerBuffA
mov byte [esi + 9], bl
mov eax, dword [ebp - 0x14]
shl eax, 3
push eax
push 0
push dword [ebp - 8]
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x4028f2
mov dword [ebp - 4], eax
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
dec ecx
call fcn.004065a3
push dword [ebp - 4]
push 0
push dword [ebp - 8]
call sub.kernel32.dll_HeapFree
pop esi
ret

Function at 0x406d9d
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
call fcn.00405134
mov ecx, dword [esp + 8]
cmp word [ecx], 0xfeff
jne 0x406db0
inc ecx
inc ecx
xor edx, edx
push edx
push eax
push edx
push edx
push 0x13880
push eax
push 0xffffffffffffffff
push ecx
push edx
push 0xfde9
call sub.kernel32.dll_WideCharToMultiByte
dec eax
js 0x4028a0
add dword [esp], eax
call fcn.00405146
pop ecx
ret 4

Function at 0x406fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.00407010
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4