joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4177b0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x50ef4b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x234], eax
push ebp
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
mov eax, dword [0x544fac]
mov edx, dword [eax + 0xc]
xor ebp, ebp
mov ecx, 0x544fac
mov dword [esp + 0x14], ebp
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x10], edi
push ebp
push 2
mov dword [esp + 0x258], ebp
mov dword [esp + 0x1c], ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x41785c
lea esi, [edi - 0x10]
mov eax, esi
call fcn.00404eb0
add eax, 0x10
mov dword [ebx], eax
mov dword [esp + 0x250], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41796b
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
jmp 0x41796b
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebp
jne 0x4178a3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi - 0x10]
mov eax, esi
call fcn.00404eb0
add eax, 0x10
mov dword [ebx], eax
mov dword [esp + 0x250], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jmp 0x417847
mov ecx, dword [esp + 0x258]
cmp dword [esp + 0x20], ecx
je 0x4178c1
lea edx, [esp + 0x18]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4178a3
jmp 0x4178c9
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x417917
lea esi, [edi - 0x10]
mov eax, esi
call fcn.00404eb0
add eax, 0x10
mov dword [ebx], eax
mov dword [esp + 0x250], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41796b
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
jmp 0x41796b
lea eax, [esp + 0x18]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x417952
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x20], ecx
je 0x417941
lea edx, [esp + 0x18]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x417926
jmp 0x417952
lea edx, [esp + 0x3c]
lea edi, [esp + 0x10]
call fcn.00407720
mov edi, dword [esp + 0x10]
push esi
call ebp
lea eax, [edi - 0x10]
call fcn.00404eb0
add eax, 0x10
lea ecx, [esp + 0x10]
mov dword [ebx], eax
call fcn.00406cf0
mov eax, ebx
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.004ea10a
add esp, 0x244
ret
Function at 0x418c70
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x50ee8b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.004f0190
add esp, 0xc
push 0x104
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
call fcn.00406c40
push edi
push 0x80
push 3
push edi
push 1
mov dword [esp + 0x234], edi
mov ecx, dword [esp + 0x1c]
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
jne 0x418d2d
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadImageToMem_CreateFile_error:_d__path:_ws
mov ecx, 0x546980
call fcn.004df340
add esp, 0xc
jmp 0x418d73
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
cmp eax, 0x100000
jae 0x418d53
push str.the_packet_is_too_small
mov ecx, 0x546980
call fcn.004df340
add esp, 4
jmp 0x418d73
cmp eax, 0x6400000
jbe 0x418d6e
push str.the_packet_is_too_large
mov ecx, 0x546980
call fcn.004df340
add esp, 4
jmp 0x418d73
mov edi, 1
mov dword [esp + 0x220], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418d9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004ea10a
add esp, 0x21c
ret

Function at 0x418ee0
Capabilities:
Create thread

Disassembly:
push edi
push 0x40
xor edi, edi
call fcn.004ea4e3
add esp, 4
test eax, eax
je 0x418ef9
push eax
call fcn.004d62c0
jmp 0x418efb
xor eax, eax
mov dword [esi + 0x1c], eax
test eax, eax
je 0x418f49
cmp dword [0x5467cc], edi
je 0x418f15
push esi
call fcn.00419420
mov dword [esi + 0x28], eax
pop edi
ret
push 0
push 0
push esi
push 0x419400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
push str.LoadProductPacket_CreateThread_return:_d
mov ecx, 0x546980
mov dword [esi + 0x14], eax
call fcn.004df340
add esp, 8
mov eax, 1
cmp dword [esi + 0x14], edi
jne 0x418f4b
mov eax, edi
pop edi
ret
Function at 0x418fe0
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x50dc88
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x544fac]
mov edx, dword [eax + 0xc]
xor ebp, ebp
mov ecx, 0x544fac
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], ebp
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
push esi
push str.GetPacketData__d
mov ecx, 0x546980
mov dword [esp + 0x30], ebp
call fcn.004df340
mov edi, dword [esp + 0x38]
add esp, 8
lea eax, [esp + 0x14]
push eax
mov eax, esi
call fcn.00419170
mov ebx, dword [esp + 0x14]
push ebx
push str.GetPacketData_return:_d
mov ecx, 0x546980
mov edi, eax
call fcn.004df340
add esp, 8
test edi, edi
je 0x419107
push 0x40
call fcn.004ea4e3
add esp, 4
test eax, eax
je 0x419089
push eax
call fcn.004d62c0
mov esi, eax
jmp 0x41908b
xor esi, esi
mov ebp, esi
test esi, esi
je 0x419107
push str.Extract...
mov ecx, 0x546980
call fcn.004df340
mov edx, dword [esp + 0x38]
mov ecx, dword [esi]
mov eax, dword [ecx]
add esp, 4
push 1
push edx
push ebx
push edi
push esi
call eax
xor ecx, ecx
mov esi, eax
test esi, esi
sete cl
push ecx
push str.Extract_return:_d
mov ecx, 0x546980
call fcn.004df340
add esp, 8
test esi, esi
je 0x4190ff
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4190fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x41914d
mov dword [esp + 0x1c], 1
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
je 0x419118
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebp, ebp
je 0x419125
mov ecx, dword [ebp]
mov edx, dword [ecx + 0xc]
push ebp
call edx
lea eax, [esi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419149
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8

Function at 0x419210
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push edi
xor edi, edi
mov dword [esp + 0xc], edi
lea eax, [ebx - 0x100000]
cmp edi, eax
jb 0x419230
mov esi, ebx
sub esi, edi
jmp 0x419235
mov esi, 0x100000
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
push esi
lea edx, [edi + ecx]
push edx
push eax
call ebp
test eax, eax
je 0x41926a
mov eax, dword [esp + 0xc]
cmp eax, esi
jne 0x41926a
add edi, eax
cmp edi, ebx
jb 0x419220
mov eax, 1
pop edi
pop esi
pop ebp
pop ecx
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReadMem_new_error:_d
mov ecx, 0x546980
call fcn.004df340
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret 8
Function at 0x419290
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
xor ebp, ebp
cmp dword [esi + 0x20], 0xffffffff
push edi
mov dword [esp + 0x10], ebp
jne 0x4192b9
push str.LoadImageToMem_m_hFile_is_NUll
mov ecx, 0x546980
call fcn.004df340
add esp, 4
jmp 0x41935b
mov eax, dword [esi + 8]
push 0x54512d
push eax
call fcn.004ec128
add esp, 8
mov dword [esi + 4], eax
cmp eax, ebp
jne 0x4192ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.m_pFileBuffer_new_error:_d
mov ecx, 0x546980
call fcn.004df340
add esp, 8
jmp 0x41935b
mov edx, dword [esi + 8]
push ebp
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x419356
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.ReadFile_new_error:_d
mov ecx, 0x546980
call fcn.004df340
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 4]
mov ebx, dword [esi + 8]
push ecx
push edx
call fcn.00419210
test eax, eax
jne 0x419356
call edi
push eax
push str.ReadMem_error:_d
mov ecx, 0x546980
call fcn.004df340
add esp, 8
jmp 0x41935b
mov ebp, 1
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x419371
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0xffffffff
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x41a3b0
Capabilities:
Create thread
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x511698
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x5b4]
test eax, eax
jne 0x41a498
push 2
call fcn.0041bff0
push 0
push 0x516283
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
call fcn.00401800
push 0
push 0
push 0xa
push 0x5467c0
lea ecx, [esp + 0x34]
mov dword [esp + 0x58], 0
call fcn.00430ad0
cmp dword [esp + 0x3c], 0x10
jb 0x41a441
mov eax, dword [esp + 0x28]
push eax
call fcn.004ea0ff
add esp, 4
mov eax, dword [0x546880]
test eax, eax
je 0x41a4ef
lea edx, [esp + 0x18]
push edx
push 0
push 0x4a
lea ecx, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x64
mov dword [esp + 0x24], 0xa
mov dword [esp + 0x28], 0x2711
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], 8
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x40
ret
cmp eax, 2
jne 0x41a4ef
push eax
call fcn.0041bff0
add esi, 0x50
mov edi, 0x519
mov eax, esi
mov dword [0x542940], 1
call fcn.0041d4b0
mov dword [0x54635c], eax
mov edi, 0x51a
mov eax, esi
call fcn.0041d4b0
push 0
push 0
push 0x5467c0
push 0x434490
push 0
push 0
mov dword [0x546360], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x546848], eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x40
ret

Function at 0x41a570
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x51166b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
push esi
mov ecx, edi
call fcn.0041bff0
cmp esi, 1
jne 0x41a605
push 4
call fcn.004ea4e3
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
test esi, esi
je 0x41a5d4
mov eax, dword [edi + 0x5bc]
sub eax, 0x10
call fcn.00404eb0
add eax, 0x10
mov dword [esi], eax
jmp 0x41a5d6
xor esi, esi
push 0
push 0
push esi
push 0x41c690
push 0
push 0
mov dword [0x542940], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
mov dword [0x542940], 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x41b3f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x510456
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x42]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x20], ebx
mov word [esp + 0x48], ax
call fcn.004f0190
mov eax, dword [esi + 0x5bc]
add esp, 0xc
lea edi, [esi + 0x5bc]
push 0x103
push eax
lea edx, [esp + 0x44]
push edx
call fcn.004ec133
mov ecx, dword [esi + 4]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x11
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x3c]
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x51e59c
mov dword [esp + 0x30], 0x8041
mov dword [esp + 0x34], 0x41b3c0
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
cmp eax, ebx
je 0x41b582
lea ecx, [esp + 0x244]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x41b582
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x248]
call fcn.00406c40
lea eax, [esp + 0x10]
mov dword [esp + 0x458], ebx
call fcn.004151d0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, str.Shuame_
call fcn.00417ae0
add esp, 8
mov byte [esp + 0x458], 1
call fcn.00404f20
mov byte [esp + 0x458], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b547
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [edi]
push edi
lea eax, [esi + 0x50]
mov ecx, 0x4b7
call fcn.0041d430
mov dword [esp + 0x458], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b582
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.004ea10a
add esp, 0x450
ret

Function at 0x41be30
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov ecx, 1
call fcn.0041a570
lea esi, [edi + 0x50]
mov edi, 0x519
mov eax, esi
call fcn.0041d4b0
mov dword [0x54635c], eax
mov edi, 0x51a
mov eax, esi
call fcn.0041d4b0
push 0
push 0
push 0x5467c0
push 0x434490
push 0
push 0
mov dword [0x546360], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [0x546848], eax
pop esi
pop ecx
ret
Function at 0x41de80
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esi + 4]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41ded4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x41deca
cmp ebx, 0x1b
jne 0x41deb6
mov ecx, dword [esi + 4]
push 0
push 2
push 0x111
push ecx
jmp 0x41dec8
cmp ebx, 0xd
jne 0x41deca
mov edx, dword [esi + 4]
push 0
push 1
push 0x111
push edx
call edi
mov dword [esi + 0x584], 0
cmp dword [esi + 4], 0
je 0x41def6
movzx eax, word [esp + 0xc]
movzx ecx, word [esp + 8]
mov edx, dword [esi + 0x30]
shl eax, 0x10
or eax, ecx
push eax
push ebx
push 0x100
push edx
call edi
pop edi
ret 8

Function at 0x420120
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x24
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
cmp dword [ebx + 0x4d0], ebp
je 0x420144
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebx + 0x4d0], ebp
mov edi, dword [ebx + 0x4c0]
cmp edi, ebp
je 0x420255
call fcn.00402870
mov esi, eax
mov edi, 1
cmp esi, ebp
je 0x420201
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
push 2
push ebp
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
mov ecx, esi
call edx
test eax, eax
je 0x420188
push edi
push ebx
mov eax, esi
call fcn.00402130
mov eax, dword [ebx + 0x4c0]
cmp eax, dword [ebx + 0x4bc]
je 0x42019e
cmp dword [esi + 0xac], ebp
je 0x420201
mov edx, dword [esi]
mov edx, dword [edx + 0x48]
mov dword [esi + 0xfc], ebp
movzx ecx, word [esp + 0x3c]
lea eax, [esp + 0x14]
push eax
movzx eax, word [esp + 0x3c]
shl ecx, 0x10
or ecx, eax
push ecx
mov ecx, dword [esp + 0x3c]
push ecx
push 0x202
push ebp
mov ecx, esi
mov dword [esp + 0x28], ebp
call edx
mov eax, dword [esi + 0xa0]
cmp eax, ebp
je 0x4201f2
cmp word [eax], bp
je 0x4201f2
push edi
push ebp
push ebp
push eax
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x420201
mov eax, dword [esi + 0x14]
cmp eax, ebp
je 0x420201
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [ebx + 0x4c0], ebp
cmp dword [esp + 0xc], ebp
je 0x420255
mov eax, dword [ebx + 4]
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edx, dword [esi]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov ecx, dword [ebx + 4]
push ecx
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push ecx
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebx + 4]
push edx
call dword [sym.imp.USER32.dll_GetParent]
movzx ecx, word [esp + 0x3c]
movzx edx, word [esp + 0x38]
shl ecx, 0x10
or ecx, edx
push ecx
mov ecx, dword [esp + 0x38]
push ecx
push 0x202
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
add esp, 0x24
ret 0xc
Function at 0x420290
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
xor edi, edi
call esi
test al, al
js 0x4202ae
push 0xa1
call esi
test al, al
jns 0x4202b3
mov edi, 4
push 0x11
call esi
test al, al
js 0x4202c3
push 0x11
call esi
test al, al
jns 0x4202c6
or edi, 8
push 1
call esi
test al, al
js 0x4202d6
push 1
call esi
test al, al
jns 0x4202d9
or edi, 1
push 2
call esi
test al, al
js 0x4202e9
push 2
call esi
test al, al
jns 0x4202ec
or edi, 2
push 4
call esi
test al, al
js 0x4202fc
push 0x10
call esi
test al, al
jns 0x4202ff
or edi, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push edi
call fcn.00420120
pop edi
mov eax, 1
pop esi
pop ecx
ret 8

Function at 0x420e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebx
push 0x400000
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x420e5f
pop edi
pop esi
xor eax, eax
pop ebx
ret
push ebx
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x420e59
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x420e84
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi]
sub eax, 0x10
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
lea ecx, [edi + 1]
sub eax, ecx
or edx, eax
jge 0x420ea4
mov eax, esi
call fcn.004023e0
mov ecx, dword [esi]
push edi
push ebp
push ecx
call fcn.004f1f90
add esp, 0xc
mov eax, edi
call fcn.00418950
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x420ed0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x50d428
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00420d90
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x421036
mov edx, dword [0x544fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x544fac
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0
call fcn.00420d90
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [eax]
push ecx
push edx
push eax
push str._s_d._s
lea edi, [esp + 0x20]
call fcn.00418bf0
mov ecx, dword [esp + 0x20]
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x42100e
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x421007
mov eax, dword [esi]
sub eax, 0x10
mov dword [esp + 0x14], 0
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
lea ecx, [edi + 0xa]
sub eax, ecx
or eax, edx
jge 0x420faf
mov eax, esi
call fcn.004023e0
mov eax, dword [esi]
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420ff3
cmp dword [esp + 0x14], edi
jne 0x420ff3
mov eax, edi
call fcn.00418950
lea ecx, [esp + 0x10]
call fcn.00406cf0
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
mov eax, dword [esi]
cmp dword [eax - 8], 0
jl 0x421063
mov dword [eax - 0xc], 0
mov eax, dword [esi]
mov byte [eax], 0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421036
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2c]
movzx edx, word [esp + 0x28]
push ecx
push edx
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x42106d
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
push 0x80070057
call fcn.004029f0
mov ecx, esi
call fcn.00420e40
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret