joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b3ea3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x100f1d4c], 0
jne 0x100b3edb
mov edx, ecx
push esi
lea ecx, [ebp - 0xc]
call fcn.100037bf
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.10003e82
pop ecx
test esi, esi
pop esi
je 0x100b3ee8
mov al, 1
leave
ret
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x100b3ed5
xor al, al
leave
ret

Function at 0x100b40cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.100b49c1
cmp eax, 0xffffffff
je 0x100b40f7
test al, 0x10
jne 0x100b40f7
test al, 1
je 0x100b40f7
and eax, 0xfffffffe
mov edx, eax
mov ecx, esi
call fcn.100b4222
test al, al
je 0x100b4130
cmp byte [0x100f1d4c], 0
jne 0x100b4125
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.100037bf
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.10003e82
pop ecx
test esi, esi
je 0x100b4130
mov al, 1
jmp 0x100b4132
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x100b411f
xor al, al
pop esi
leave
ret

Function at 0x100b4222
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x100f1d4c], 0
push esi
mov esi, edx
jne 0x100b425a
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.100037bf
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.10003e82
pop ecx
test esi, esi
je 0x100b4266
mov al, 1
jmp 0x100b4268
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x100b4254
xor al, al
pop esi
leave
ret
Function at 0x100b49c1
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x100f1d4c], 0
jne 0x100b49f3
mov edx, ecx
push esi
lea ecx, [ebp - 0xc]
call fcn.100037bf
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.10003e82
pop ecx
mov eax, esi
pop esi
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret
Function at 0x100bd627
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100f0e3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.100bb424
mov dword [ebp - 0x14], eax
cmp dword [0x100f6d70], edi
jne 0x100bd718
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x100bd6a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100bd7f8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100bd7f8
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100bd7f8
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x100f6d70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x100f6d74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x100f6d78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100f6d80], eax
test eax, eax
je 0x100bd715
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100f6d7c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100bd73d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100bd730
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x100bd752
push 4
pop eax
jmp 0x100bd7fa
cmp dword [ebp - 0x14], edi
je 0x100bd752
push dword [0x100f6d70]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100bd737
mov eax, dword [0x100f6d7c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x100bd7b0
cmp dword [0x100f6d80], esi
je 0x100bd7b0
push eax
call ebx
push dword [0x100f6d80]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100bd7b0
test eax, eax
je 0x100bd7b0
call ecx
test eax, eax
je 0x100bd7a5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100bd7a5
test byte [ebp - 8], 1
jne 0x100bd7b0
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x100bd7e0
mov eax, dword [0x100f6d74]
cmp eax, esi
je 0x100bd7dd
push eax
call ebx
test eax, eax
je 0x100bd7dd
call eax
mov edi, eax
test edi, edi
je 0x100bd7dd
mov eax, dword [0x100f6d78]
cmp eax, esi
je 0x100bd7dd
push eax
call ebx
test eax, eax
je 0x100bd7dd
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x100f6d70]
call ebx
test eax, eax
je 0x100bd7f8
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x100bd7fa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b7060
leave
ret
Function at 0x41f660
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x413015
lea edi, [esi - 0x12015]
push edi
or ebp, 0xffffffff
jmp 0x41f682
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f689
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f678
mov eax, 1
add ebx, ebx
jne 0x41f69b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f690
jne 0x41f6ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f690
xor ecx, ecx
sub eax, 3
jb 0x41f6c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f732
mov ebp, eax
add ebx, ebx
jne 0x41f6cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f6d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f6fc
inc ecx
add ebx, ebx
jne 0x41f6e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f6dd
jne 0x41f6f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f6dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f71c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f70d
jmp 0x41f67e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f71c
add edi, ecx
jmp 0x41f67e
pop esi
mov edi, esi
mov ecx, 0x3d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f73a
cmp byte [edi], 7
jne 0x41f73a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41f73f
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f7ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f3a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f3f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f76c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f3f4]
or eax, eax
je 0x41f7a8
mov dword [ebx], eax
add ebx, 4
jmp 0x41f789
call dword [esi + 0x1f3f8]
popal
jmp section.UPX0

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x45d32c99
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x4c154819
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
mov ecx, 0x2ebc2d00
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x55975954
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x62786c
Capabilities:
Encode data using xor

Disassembly:
pop eax
dec ecx
mov word [edx + 0x64], fs
dec ebp
fist word [esi - 0x2cb67dbc]
arpl word [esi - 0x295aab6], sp
xchg byte [ebp - 0x40], dl
pop ebp
outsd dx, dword [esi]
wait
insd dword es:[edi], dx
wait
test dword [ebx + eax*2 + 0x5030aa94], edx
jg 0x627888
stc
mov al, 0x68
xor eax, 0xaa754cfd
popal
mov ecx, 0x7282ec9f
invalid
dec esi
pop edx
jbe 0x62781b
push cs
jp 0x6278c2
les esp, [ebp - 0x1d]
in eax, 0x89
fld dword fs:[edx + ebx*2]
sti
cmp al, 0xd1
adc ebp, dword [eax + 0x3e]
outsb dx, byte [esi]
cld
popfd
sar byte [edx - 0x22b795a5], cl
loopne fcn.0062786c
push 0x48
fucom st(0)
fild qword [ebx + 0x5e]
xor al, 0x65
imul ebx, dword [esi + 0x34], 0x65
sbb byte [esi], ah
lodsb al, byte [esi]
pop edx
mov ds, edi
xchg edx, esi
adc ah, byte [ebx - 0x34]
or ch, cl
outsb dx, byte [esi]
cvtps2pd xmm5, qword [ebx - 6]
xor al, 0x56
inc ebp
mov ebx, 0x4e489155
mov eax, dword [eax - 0x7e]
mov ah, 0x4b
stosd dword es:[edi], eax
add dword [edx + 0x5a3bce69], eax
dec edx
cmp bh, byte [esi + 0x3b]
cwde
wait
sub cl, byte [edx - 0x57d6c79]
pop ecx
mov al, byte [edi + 0x59fa8293]
cmp dl, 0x59
cmpsb byte [esi], byte es:[edi]
stc
inc edx
sbb ah, byte [edx]
dec edx
scasd eax, dword es:[edi]
cmp dword [esi - 0x74c0af2d], ecx
xor ah, cl
dec eax
mov ebp, 0x35c7c407
imul edx, dword [ecx + 4], 0x5d
loopne 0x6278bf
jnp 0x627885
dec eax
aad 0xa9
in al, 0x42
mov bh, 0x48
sbb dh, byte [edx - 0x5c]
or dword [esi + 4], 0x8a2c33ee
push ebp
outsb dx, byte [esi]
invalid

Function at 0x62ace9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323d0
cmp edx, dword [eax]
je 0x62ad0b
add eax, 8
inc ecx
cmp eax, 0x632460
jl 0x62acfc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323d0]
jne 0x62ae39
mov eax, dword [0x63af64]
cmp eax, 1
je 0x62ae13
test eax, eax
jne 0x62ad3c
cmp dword [0x6322f8], 1
je 0x62ae13
cmp edx, 0xfc
je 0x62ae39
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62ad73
lea eax, [ebp - 0x1a4]
push 0x62f9d0
push eax
call fcn.0062b6d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062bb60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62adb6
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062bb60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62f9cc
push edi
call fcn.0062da30
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x62f9b0
push eax
call fcn.0062b6d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062b6e0
lea eax, [ebp - 0xa0]
push 0x62f9ac
push eax
call fcn.0062b6e0
push dword [esi + 0x6323d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062b6e0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x62f984
push eax
call fcn.0062d9a4
add esp, 0x2c
pop edi
jmp 0x62ae39
lea eax, [ebp + 8]
lea esi, [esi + 0x6323d4]
push 0
push eax
push dword [esi]
call fcn.0062bb60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x423aa4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419328
and dword [ebp - 4], 0
cmp dword [0x43879c], 0
mov ebx, eax
jne 0x423b55
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x423c06
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x423c06
push eax
call fcn.004192b6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43879c], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4387a0], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4387a4], eax
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387ac], eax
test eax, eax
je 0x423b55
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387a8], eax
mov eax, dword [0x4387a8]
cmp eax, ebx
je 0x423bad
cmp dword [0x4387ac], ebx
je 0x423bad
push eax
call fcn.00419331
push dword [0x4387ac]
mov esi, eax
call fcn.00419331
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423bad
test edi, edi
je 0x423bad
call esi
test eax, eax
je 0x423ba4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423ba4
test byte [ebp - 0xc], 1
jne 0x423bad
or dword [ebp + 0x10], 0x200000
jmp 0x423be6
mov eax, dword [0x4387a0]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x423be6
mov eax, dword [0x4387a4]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43879c]
call fcn.00419331
pop ecx
test eax, eax
je 0x423c06
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423c08
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x3d4c1398
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
mov ecx, 0x40d03c29
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x403d33
Capabilities:
Create directory

Disassembly:
push ecx
push 0x43
push 0x401920
push dword [esp - 0x80]
push dword [esp - 0x82]
call fcn.00403d5b
mov ecx, dword [esp]
mov eax, dword [ecx + 4]
mov ecx, dword [0x41b285]
cmp eax, ecx
je 0x403d71
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
mov ebp, eax
lea esp, [esp + 8]
add dword [esp + 4], ecx
push dword [esp - 0x1f]
push 0x405f58
call 0x403d9d
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
lea esp, [esp + 0xc]
pop ecx
ret 8

Function at 0x403d5b
Capabilities:
Create directory

Disassembly:
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push 0xffffffffffffffc0
call 0x403d7b
jne 0x403ddb
lea eax, [esi - 1]
push ebp
push eax

Function at 0x403f7e
Capabilities:
Get common file path
Get disk information

Disassembly:
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi], eax
mov eax, esi
push eax
push ebx
push 0xfffffffffffffffa
push dword [esp + 4]
push 0x40a408
call fcn.00403650
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [esp + 0x14]
push ecx
push ebx
push 0x41a22c
push 0x41afe2
push 0x41a92d

Function at 0x403fba
Capabilities:
Get common file path

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x41a384
push esi
push dword [esp - 0x1f]
push 0x404c88
call 0x403fed
mov ecx, dword [0x41a418]
mov edx, dword [ecx]
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp - 0x2a]
push ebp
push dword [esp - 0x4b]
push dword [esp - 0xee]
push dword [esp + 3]
call 0x404024
lea ecx, [esi + ebp]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x40400e
inc edi
add ebp, 0x14
mov ebp, dword [esp + 0x18]
lea esp, [esp + 0x18]
add dword [esp + 4], esi
push dword [esp + 0x71]
push dword [esp - 0xb3]
push dword [esp - 0x50]
push 0xffffffffffffffa1
push ecx
call fcn.00404069
jmp dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]

Function at 0x403fed
Capabilities:
Get common file path

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x41a384
push esi
push dword [esp - 0x1f]
push 0x404c88
call 0x403fed
mov ecx, dword [0x41a418]
mov edx, dword [ecx]
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp - 0x2a]
push ebp
push dword [esp - 0x4b]
push dword [esp - 0xee]
push dword [esp + 3]
call 0x404024
lea ecx, [esi + ebp]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x40400e
inc edi
add ebp, 0x14
mov ebp, dword [esp + 0x18]
lea esp, [esp + 0x18]
add dword [esp + 4], esi
push dword [esp + 0x71]
push dword [esp - 0xb3]
push dword [esp - 0x50]
push 0xffffffffffffffa1
push ecx
call fcn.00404069
jmp dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
Function at 0x404024
Capabilities:
Get common file path

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x41a384
push esi
push dword [esp - 0x1f]
push 0x404c88
call 0x403fed
mov ecx, dword [0x41a418]
mov edx, dword [ecx]
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp - 0x2a]
push ebp
push dword [esp - 0x4b]
push dword [esp - 0xee]
push dword [esp + 3]
call 0x404024
lea ecx, [esi + ebp]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x40400e
inc edi
add ebp, 0x14
mov ebp, dword [esp + 0x18]
lea esp, [esp + 0x18]
add dword [esp + 4], esi
push dword [esp + 0x71]
push dword [esp - 0xb3]
push dword [esp - 0x50]
push 0xffffffffffffffa1
push ecx
call fcn.00404069
jmp dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]

Function at 0x4040ac
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], esp
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 4], 0xffffffff
add dword [esp], eax
call dword [ebp - 0x48]
test eax, eax
je 0x407ed6
push 0x400d23
push 0x20
push ebx
push 0x40f663
call fcn.004031d1
mov eax, dword [esp]
test eax, eax
jne 0x4040ea
movzx edx, word [esp + 0x16]
push edx
mov eax, 0x41b0eb
mul dword [esp + 0x10]
shr edx, 6
push edx
xor eax, eax
or edx, 0xffffffff
push ebx
push 0x69
push 0x400fee
push 0x40df6f
call fcn.00403650
push edx
push eax
push eax
xor dword [esp + 4], ecx
pop ecx
push 0x400a3f
push 0xc
push 0x400055
push 0x3fda3f
call fcn.00403a9a
push 0xffffffffffffffff
push 0x41a70a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [esp + 0x14], 0
call fcn.00409f24
test eax, eax
add esp, 4
leave
ret 8
cmp dword [ebp - 0x24], 0
jne 0x4058b3
add eax, ebx
push dword [esp + 4]
push 0x36
push dword [esp + 8]
push 0x40b90d
call fcn.0040335f
push 0x41b326
push eax
call esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [esi + 0x54]
test eax, eax
jne 0x407e8e
inc eax
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x3fddc0
call fcn.00403930
mov eax, dword [esi + 0x14]
test eax, eax
mov dword [esp + 4], 0
je 0x407f00
mov ecx, dword [eax]
lea edx, [esp + 4]
mov ecx, esi
mov dword [esi + 0x2014], ebx
mov dword [esi + 0x2018], ebx
call fcn.00404f1e
mov ecx, esi
call fcn.0040b0f6
inc ebp
cmp ebp, 0x41a259
call dword [edx]
push 0x400509
push 0x40030e
push 0x40012f
push 0x3fcb4e
call fcn.004034ec
sub esp, 0xc
mov edx, dword [esp + 0x14]
push esi
Function at 0x4040f7
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
xor edi, edi
xor dword [esp], eax
xor dword [esp], ebx
call fcn.00405b0c
cmp eax, 0
jne 0x40bbed
sub eax, esi
push esi
push eax
push 0x7f
push 0x40f235
call fcn.00403091
cmp bl, byte [esi + 1]
jne 0x4040af
add eax, 2
add esi, 2
test cl, cl
jne 0x4040b3
mov dword [ebp - 0x44], esp
push 0x1e
push 0x400bff
push dword [esp + 0xc]
push 0x405605
call fcn.00403930
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x40bc15
xor eax, eax
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 4]
mov eax, dword [eax + 0x10]

Function at 0x40412d
Capabilities:
Log keystrokes via polling

Disassembly:
add byte [eax], al
add byte [eax + 0x1000935c], bh
push esi
push 0
mov esi, ecx
call fcn.0040aeeb
mov dword [esi], 0x10009380
and ecx, dword [esp]
add esp, 4
pop eax
leave
push dword [esp + 0xc]
push 0x400daa
push 0x400d9b
push 0x408a9b
call fcn.0040335f
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]

Function at 0x404724
Capabilities:
Move file

Disassembly:
mov eax, dword [0x41a703]
call fcn.00409c4b
cmp eax, 0xffffffff
je 0x404760
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push eax
push dword [esp - 0x24]
call 0x404763
xor eax, eax
push eax
push 0x41aeb6
call fcn.00406cec
mov eax, dword [esi + 0x14]
lea esp, [esp + 8]
mov eax, dword [esp + 8]
push dword [esp - 0xa7]
push dword [esp - 0x7c]
call 0x404794
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
lea esp, [esp + 0xc]
add dword [esp + 4], eax
push 0x4047b8
push 0x3f
push dword [esp - 0x12]
push esi
call 0x4047bb
sub esp, 8
push esi
push 0x41a66c
mov esi, ecx
lea esp, [esp + 0x14]
pop eax
ret 0xc

Function at 0x404a44
Capabilities:
Get file size

Disassembly:
test eax, eax
setge cl
mov eax, ecx
sub esp, 0xc
push ebx
push ecx
push dword [esp + 0x7d]
push dword [esp - 0xd]
push 0x403ba8
call fcn.00404a44
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
lea esp, [esp + 0x10]
mov ecx, dword [esp + 8]
push 0x35
call 0x404a66
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, dword [esp + 8]
mov dword [0x41b128], eax
mov eax, esi
pop esi
push ebp
lea esp, [esp + 8]
add dword [esp + 4], ecx
push dword [esp - 0x70]
push esi
push dword [esp + 8]
push dword [esp - 0x3b]
call 0x404aa0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x404a11
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x41b1c6
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esp, [esp + 0x14]
pop ecx
ret 0xc

Function at 0x404ec2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41afd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp