joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f915
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x57a734]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x560c1c
mov dword [ebp - 0x244], ecx
lea edi, [ebp - 0x20c]
xor ebx, ebx
push 0x1fa
lea eax, [ebp - 0x1fe]
movsd dword es:[edi], dword [esi]
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004fce20
xor eax, eax
mov dword [ebp - 0x248], ebx
lea edi, [ebp - 0x218]
add esp, 0xc
stosd dword es:[edi], eax
push 0xa
stosd dword es:[edi], eax
pop ecx
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x244]
cmp cx, 0x41
jb 0x42f988
cmp cx, 0x5a
jbe 0x42f991
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x42fa02
push ebx
push 0x80
push 3
push ebx
push 3
push closesocket
lea eax, [ebp - 0x20c]
mov word [ebp - 0x204], cx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42f9fe
push ebx
lea eax, [ebp - 0x248]
mov dword [ebp - 0x214], ebx
push eax
push 0x28
lea eax, [ebp - 0x240]
mov dword [ebp - 0x218], ebx
push eax
push 0xc
lea eax, [ebp - 0x218]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
cmovne ebx, dword [ebp - 0x224]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
jmp 0x42fa04
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e36f8
mov esp, ebp
pop ebp
ret

Function at 0x42fa15
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x57a734]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.004fce20
push esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.004fce20
push esi
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.004fce20
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004fce20
add esp, 0x30
lea eax, [ebp - 0x414]
push 0x100
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push edi
push edi
push edi
push edi
mov ecx, 0x104
lea eax, [ebp - 0x61c]
push ecx
push eax
push ecx
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0050eeb7
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push str._s_sts_downloader.cfg
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42faf9
lea eax, [ebp - 0x20c]
push eax
push edi
push str.AutoRun
push str.Settings
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x42fafb
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e36f8
mov esp, ebp
pop ebp
ret
Function at 0x4305b3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [eax + 0x108]
cmp eax, dword [esi + 0x360]
jne 0x430614
mov eax, dword [esi + 0x370]
cmp eax, 8
je 0x4306f6
cmp eax, 9
je 0x4306f6
cmp eax, 0xa
je 0x4306f6
cmp eax, 7
je 0x4305fa
cmp eax, 6
jne 0x4306f6
push 0
push 0
push 0xb7f
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4306f6
cmp eax, dword [esi + 0x35c]
jne 0x430632
push 0
push 0xf020
push 0x112
call fcn.0044e801
jmp 0x4306ff
cmp eax, dword [esi + 0x364]
jne 0x43069b
mov eax, dword [esi + 0x370]
xor edi, edi
inc edi
cmp eax, 2
je 0x430683
cmp eax, edi
je 0x430683
cmp eax, 8
je 0x430665
cmp eax, 9
je 0x430665
cmp eax, 0xa
je 0x430665
cmp eax, 7
je 0x43066b
cmp eax, 6
je 0x43066b
push edi
jmp 0x4306fa
push 0
push 0
push 0xb7f
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
jmp 0x4306f8
push edi
push 0
call fcn.0044e981
push 0
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x430680
cmp eax, dword [esi + 0x368]
jne 0x4306ff
mov eax, dword [esi + 0x370]
cmp eax, 8
je 0x4306db
cmp eax, 9
je 0x4306db
cmp eax, 0xa
je 0x4306db
cmp eax, 7
je 0x4306c2
cmp eax, 6
jne 0x4306f6
push 0
push 0
push 0xb7f
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_PostMessageW]
push 1
jmp 0x4306ef
push 0
push 0
push 0x10
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_PostMessageW]
push 2
mov ecx, esi
call fcn.0044e425
push 2
mov ecx, esi
call fcn.0044e425
pop edi
pop esi
pop ebp
ret 4
Function at 0x434323
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x4376ab
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.004375fa
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00505b49
push edi
call fcn.00503941
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4376fa
push edi
call fcn.0050ef97
pop ecx
test eax, eax
je 0x4376fa
lea ecx, [esi + 0x40]
mov dword [esi + 0x38], 5
call fcn.00435ef0
lea ecx, [esi + 0x4c]
call fcn.00435ef0
mov dword [esi + 0x58], ebx
jmp 0x437777
push 2
push ebx
push edi
call fcn.00505b49
push edi
call fcn.0050ec73
push 0
push 0
push edi
mov ebx, eax
call fcn.00505b49
add esp, 0x1c
cmp ebx, 0xffffffff
jne 0x43773a
mov dword [esi + 0x38], 5
lea ecx, [esi + 0x40]
call fcn.00435ef0
lea ecx, [esi + 0x4c]
call fcn.00435ef0
and dword [esi + 0x58], 0
jmp 0x437777
cmp ebx, 0xffffffff
jae 0x43771d
test ebx, ebx
jne 0x43774c
mov dword [esi + 0x38], 0xf
jmp 0x437724
lea eax, [ebx + 1]
push eax
call fcn.004e3d16
push edi
push ebx
push 1
push eax
mov dword [esi + 0x5c], eax
call fcn.0050f18e
add esp, 0x14
cmp eax, ebx
jne 0x43771d
mov eax, dword [esi + 0x5c]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.004378ec
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x43f900
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d78b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x57a734]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0
mov dword [ebx], 0x562894
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push 0
push 0
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004033e8
push 8
call fcn.004e3709
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 2
call fcn.004448d4
mov dword [esi + 4], eax
add esp, 4
lea eax, [ebx + 0x10]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov ecx, edi
lea eax, [ebp - 0x20]
mov dword [edi + 0x3c], 0
push eax
call fcn.004034a5
push eax
mov dword [ebp - 4], 3
call fcn.0040e1de
add esp, 4
mov esi, eax
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x43fa39
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x43fa39
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov byte [ebp - 4], 1
mov ecx, esi
mov eax, dword [esi]
push 0x20
mov eax, dword [eax + 0x20]
call eax
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x43fa61
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.004033e8
mov dword [ebp - 4], 5
mov eax, dword [ebx]
push ecx
push dword [ebp + 8]
lea ecx, [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x60]
mov dword [edx + ebx - 4], eax
call fcn.0043ff30
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43ff30
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d7fe
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x57a734]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004e3709
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004448d4
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 1
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x43fff2
mov eax, dword [eax]
push 2
push ecx
push eax
mov ecx, edi
call fcn.0040d8a2
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x448245
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x448268
or esi, 1
push 1
call edi
test ax, ax
jns 0x448274
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x448280
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x44828c
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4496e5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x1bc]
call fcn.0044dc2e
mov edi, dword [ebp + 8]
test eax, eax
jle 0x44973b
push ebx
lea ecx, [esi + 0x1bc]
mov byte [ebp + 0xb], 0
call fcn.0044d7b1
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x449799
lea ecx, [esi + 0x1bc]
inc ebx
call fcn.0044dc2e
cmp ebx, eax
jl 0x449704
sub edi, 0x100
je 0x449806
sub edi, 4
je 0x44979d
dec edi
sub edi, 1
jne 0x4497fd
push dword [ebp + 0xc]
and dword [ebp + 8], edi
call fcn.0050b0de
pop ecx
mov ecx, dword [esi + 0x13c]
lea edx, [ebp + 8]
push reloc.WS2_32.dll_ioctlsocket
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x44aa08
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x4497fd
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x4497ff
cmp dword [esi + 0x140], 0
je 0x4497fd
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x150]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x154]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.00448245
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4497fd
mov ecx, dword [esi + 0x140]
test ecx, ecx
je 0x44985f
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x44985f
mov ecx, dword [esi + 0x140]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x44985f
mov ecx, dword [esi + 0x140]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.004fe6fa
pop ecx
pop ecx
test eax, eax
je 0x44985f
mov ecx, dword [esi + 0x140]
call fcn.0045c532
test al, al
jne 0x4497fd
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.0044a350
jmp 0x449799
Function at 0x44a0f5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [edi]
je 0x44a11c
cmp esi, dword [edi + 0x140]
je 0x44a11c
push dword [edi]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x140]
cmp esi, eax
je 0x44a202
test eax, eax
je 0x44a183
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x14
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [edi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0x140]
call fcn.00449e51
and dword [edi + 0x140], 0
test esi, esi
je 0x44a202
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x44a202
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x44a202
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x44a202
xorps xmm0, xmm0
mov dword [edi + 0x140], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [edi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0x140]
call fcn.00449e51
pop edi
pop esi
leave
ret 4
Function at 0x44e8ab
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x44e95a
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x44e95e
cmp dword [ebp - 0x1c], 0x10
jne 0x44e929
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 4]
jne 0x44e929
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call fcn.0044a7b1
pop ecx
test al, al
jne 0x44e94b
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x44e95e
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x44e8f6
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x44e97c
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x44e981
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44e9b3
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x4533f5
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x52e659
call fcn.004e41bf
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.00453782
call fcn.0044805e
push eax
lea ecx, [ebp - 0x94]
call fcn.0044d58b
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00448064
mov ecx, eax
call fcn.0044dd77
test al, al
je 0x45350b
push ebx
lea ecx, [ebp - 0x94]
call fcn.0044d801
push edi
push 0x80
push 3
push edi
push 1
push closesocket
lea ecx, [ebp - 0x94]
call fcn.0044803f
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x45347c
push str.Error_opening_file
jmp 0x4535ec
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
test edi, edi
je 0x453585
cmp edi, 0x400000
ja 0x453596
and dword [ebp - 0x2c8], 0
push edi
call fcn.004e3d16
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x4534f4
push ebx
call fcn.004e3ad9
pop ecx
mov ecx, esi
call fcn.00453782
push 0
push str.Could_not_read_file
jmp 0x4535ec
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.00453637
push dword [ebp - 0x2cc]
jmp 0x45361a
call fcn.00448064
push eax
lea ecx, [ebp - 0x94]
call fcn.0044d7e4
call fcn.00448130
test al, al
je 0x45352c
call fcn.0044806a
jmp 0x453543
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0044803f
push eax
call fcn.0045eb39
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x453554
push eax
push str.Error_opening_zip_file
jmp 0x4535ec
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.0045e579
add esp, 0x14
test eax, eax
je 0x45357b
push 0
push str.Could_not_find_ziped_file
jmp 0x4535ec
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x45358e
push 0
push str.File_is_empty
jmp 0x4535ec
cmp ebx, 0x400000
jbe 0x45359f
push 0
push 0x53725c
jmp 0x4535ec
push ebx
call fcn.004e3d16
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.0045ef10
add esp, 0x18
test eax, eax
je 0x4535f7
cmp eax, 0x600
je 0x4535f7
push dword [ebp - 0x2c8]
call fcn.004e3ad9
pop ecx
call fcn.00448130
test al, al
jne 0x4535e5
push edi
call fcn.0045e3d5
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.004537aa
mov bl, al
jmp 0x453622
call fcn.00448130
test al, al
jne 0x453607
push edi
call fcn.0045e3d5
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.00453637
push edi
mov bl, al
call fcn.004e3ad9
pop ecx
lea ecx, [ebp - 0x94]
call fcn.0044d6c6
mov al, bl
call fcn.004e4169
ret 8
Function at 0x45e035
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x4d8], edi
je 0x45e09f
cmp dword [ebp + 8], 0x100
jne 0x45e08e
cmp word [ebp + 0xc], 0xd
jne 0x45e08e
cmp byte [esi + 0x4de], 0
je 0x45e075
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x45e08e
cmp byte [esi + 0x4df], 0
jne 0x45e08e
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x45e08a
push edi
push edi
push edi
push str.return
push esi
call fcn.00449e51
xor eax, eax
jmp 0x45e0a2
mov eax, dword [esi + 0x4d8]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x45e427
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x57a734]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x45e4e1
movzx eax, word [esi]
test ax, ax
je 0x45e4e1
push edi
mov edi, esi
mov ecx, esi
mov edx, eax
cmp dx, 0x2f
je 0x45e469
cmp dx, 0x5c
jne 0x45e46b
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x45e45d
cmp edi, esi
je 0x45e4b4
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.0051168a
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x45e4ef
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0045e427
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.005116fe
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005116cd
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004e36f8
leave
ret
call fcn.004e3e42
int3

Function at 0x45eab3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x45eb2f
cmp dword [edi + 4], 0xffffffff
jne 0x45eb2f
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0x539784
push esi
call fcn.005116cd
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x45eb01
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x45eb01
mov eax, 0x2000000
jmp 0x45eb34
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00460ff2
add esp, 0x10
test eax, eax
jne 0x45eb1f
mov eax, dword [ebp - 4]
jmp 0x45eb34
push eax
call fcn.00461714
mov dword [edi], eax
mov eax, dword [0x57fa90]
pop ecx
jmp 0x45eb34
mov eax, 0x1000000
pop edi
leave
ret 0xc
Function at 0x4610ff
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x461132
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x46112d
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x46115c
mov edx, dword [edi + 0x18]
push esi
mov esi, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x14]
cmovbe esi, ecx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004fc8a0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x4612ea
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4612f8
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4613b7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x539050]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x539050]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x539050]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x539050]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x539050]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x539050]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x539050]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x539050]
sub edi, 1
jne 0x461310
pop edi
test esi, esi
je 0x4613d3
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x539050]
inc edx
sub esi, 1
jne 0x4613bb
not ecx
mov eax, ecx
pop esi
pop ebp
ret