joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ded57
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x74
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0xbb0], eax
mov eax, dword [ebx + 0x28]
movzx eax, word [eax + 0x154]
push esi
push edi
cvtsi2ss xmm0, eax
mulss xmm0, dword [0x57f940]
push ecx
lea eax, [esp + 0x44]
movss dword [esp], xmm0
push eax
call fcn.004030d7
mov eax, dword [ebx + 0x28]
and dword [esp + 0x14], 0
add eax, 0x148
cmp dword [ebx + 0xbb0], 0
movss xmm0, dword [eax]
movss dword [esp + 0x78], xmm0
movss xmm0, dword [eax + 4]
movss dword [esp + 0x7c], xmm0
movss xmm0, dword [eax + 8]
pop ecx
movss dword [esp + 0x7c], xmm0
movss xmm0, dword [0x55b520]
pop ecx
movss dword [esp + 0x7c], xmm0
jle 0x4def21
mov edi, dword [ebp + 0xc]
add edi, 0x24
lea esi, [ebx + 0x874]
mov eax, dword [edi - 0x20]
sub eax, 0
je 0x4dee54
dec eax
jne 0x4def04
lea eax, [esp + 0x40]
push eax
mov dword [esi + 0x20], 1
movss xmm0, dword [edi]
lea eax, [esp + 0x14]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [edi + 4]
push eax
lea eax, [esp + 0x24]
movss dword [esp + 0x1c], xmm0
movss xmm0, dword [edi + 8]
push eax
movss dword [esp + 0x24], xmm0
call sub.d3dx9_33.dll_D3DXVec3TransformNormal
movss xmm0, dword [esp + 0x1c]
movss dword [esi - 4], xmm0
movss xmm0, dword [esp + 0x20]
movss dword [esi], xmm0
movss xmm0, dword [esp + 0x24]
movss dword [esi + 4], xmm0
jmp 0x4deeba
and dword [esi + 0x20], 0
movss xmm0, dword [edi]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x2c]
movss dword [esp + 0x2c], xmm0
movss xmm0, dword [edi + 4]
push eax
lea eax, [esp + 0x3c]
movss dword [esp + 0x34], xmm0
movss xmm0, dword [edi + 8]
push eax
movss dword [esp + 0x3c], xmm0
call sub.d3dx9_33.dll_D3DXVec3TransformCoord
movss xmm0, dword [esp + 0x34]
movss dword [esi + 0xc], xmm0
movss xmm0, dword [esp + 0x38]
movss dword [esi + 0x10], xmm0
movss xmm0, dword [esp + 0x3c]
movss dword [esi + 0x14], xmm0
movss xmm0, dword [0x55b520]
movss dword [esi + 0x18], xmm0
fld dword [edi - 0x18]
xor eax, eax
fstp dword [esi + 0x34]
movss xmm0, dword [edi - 0xc]
movss xmm1, dword [edi - 0x10]
fld dword [edi - 0x14]
movss dword [esi + 0x2c], xmm0
fstp dword [esi + 0x24]
movss xmm0, dword [0x55b520]
movss dword [esi + 0x30], xmm0
xorps xmm0, xmm0
movss dword [esi + 0x28], xmm1
cmp byte [edi - 4], al
movss dword [esi + 0x40], xmm0
setne al
and dword [esi + 0x58], 0
mov dword [esi + 0x5c], eax
fld dword [edi - 0x1c]
fstp dword [esi + 0x44]
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
add edi, 0x30
add esi, 0x90
cmp eax, dword [ebx + 0xbb0]
jl 0x4dede8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x527be0
Capabilities:
Create directory

Disassembly:
sub esp, 0x2a8
push ebx
mov ebx, dword [esp + 0x2b0]
push ebp
push esi
push edi
push 0
push 0
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebx
call fcn.00529700
push eax
call dword [sym.imp.MSVCR80.dll__wsplitpath]
add esp, 0x14
lea ecx, [esp + 0x18]
call fcn.00526f20
push 0x104
lea ecx, [esp + 0x1c]
call fcn.005274f0
cmp word [esp + 0xba], 0
mov edi, dword [sym.imp.MSVCR80.dll__wmkdir]
mov ebp, dword [sym.imp.MSVCR80.dll__errno]
lea esi, [esp + 0xba]
je 0x527cc1
jmp 0x527c50
movzx eax, word [esi]
cmp ax, 0x5c
je 0x527c5f
cmp ax, 0x2f
jne 0x527cb8
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x6c]
mov word [esi], 0
call fcn.00527310
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x1c]
call fcn.00527470
lea ecx, [esp + 0x68]
call fcn.00527430
lea ecx, [esp + 0xb8]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00527990
add esp, 8
lea ecx, [esp + 0x18]
call fcn.00529700
push eax
call edi
add esp, 4
test eax, eax
je 0x527cb3
call ebp
mov word [esi], 0x5c
add esi, 2
cmp word [esi], 0
jne 0x527c50
mov ecx, ebx
call fcn.00529700
push eax
call edi
add esp, 4
test eax, eax
je 0x527cd4
call ebp
lea ecx, [esp + 0x18]
call fcn.00527430
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a8
ret

Function at 0x527cf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x258
push 0x208
lea eax, [esp + 0x54]
push 0
push eax
call sub.MSVCR80.dll_memset
mov edx, dword [esp + 0x268]
add esp, 0xc
lea ecx, [esp + 0x50]
push ecx
push 0
push 0
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 4]
call fcn.00527310
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0x264]
call fcn.00527470
lea ecx, [esp]
call fcn.00527430
add esp, 0x258
ret

Function at 0x527fa0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2028
call fcn.0052fda0
mov ecx, dword [esp + 0x202c]
push esi
push 0x57f1b0
call fcn.00529700
push eax
call dword [sym.imp.MSVCR80.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x527fd6
xor al, al
pop esi
add esp, 0x2028
ret
push edi
push 0x2028
lea eax, [esp + 0xc]
push 0
push eax
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.MSVCR80.dll_fread]
push esi
push 1
lea ecx, [esp + 0x1c]
push 0x2028
push ecx
call edi
mov edx, dword [esp + 0x38]
push 1
push edx
push esi
call dword [sym.imp.MSVCR80.dll_fseek]
mov eax, dword [esp + 0x2064]
mov ecx, dword [esp + 0x2060]
push esi
push 1
push eax
push ecx
call edi
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0x3c
pop edi
mov al, 1
pop esi
add esp, 0x2028
ret
Function at 0x528040
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x202c
call fcn.0052fda0
push ebx
mov ebx, dword [esp + 0x2038]
mov eax, dword [ebx + 0x140]
push esi
push 0
push eax
push 3
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0
call sub.d3dx9_33.dll_D3DXSaveTextureToFileInMemory
mov esi, dword [esp + 8]
test esi, esi
jne 0x528083
pop esi
xor al, al
pop ebx
add esp, 0x202c
ret
push ebp
push edi
push 0x2028
lea edx, [esp + 0x18]
push 0
push edx
call sub.MSVCR80.dll_memset
mov dword [esp + 0x20], 0x484d4752
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x2028
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
add esp, 0xc
push esi
call ecx
mov ebp, dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov esi, ebx
mov dword [esp + 0x28], eax
lea edi, [esp + 0x3c]
mov ebx, 4
mov edi, edi
mov ecx, esi
call fcn.00529700
push eax
push 0x400
push edi
call ebp
add esp, 0xc
add esi, 0x50
add edi, 0x800
sub ebx, 1
jne 0x5280d0
mov ecx, dword [esp + 0x2040]
push 0x55866c
call fcn.00529700
push eax
call dword [sym.imp.MSVCR80.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x52812b
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop ebp
pop esi
xor al, al
pop ebx
add esp, 0x202c
ret
mov edi, dword [sym.imp.MSVCR80.dll_fwrite]
push esi
push 1
lea ecx, [esp + 0x1c]
push 0x2028
push ecx
call edi
mov eax, dword [esp + 0x20]
mov edx, dword [eax]
add esp, 0x10
push esi
push 1
push eax
mov eax, dword [edx + 0x10]
call eax
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
push eax
call edi
mov eax, dword [esp + 0x2054]
mov ecx, dword [eax + 0x148]
mov edx, dword [eax + 0x144]
push esi
push 1
push ecx
push edx
call edi
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add esp, 0x24
push eax
call edx
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
add esp, 0x202c
ret

Function at 0x528370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x18]
push edx
push 0
mov dword [esp + 0x14], 4
call fcn.00529700
push eax
mov eax, dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop esi
jne 0x5283c6
cmp dword [esp], 4
jne 0x5283c6
cmp dword [esp + 0xc], 4
jne 0x5283c6
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
mov dword [ecx], edx
mov al, 1
add esp, 8
ret 8
xor al, al
add esp, 8
ret 8
Function at 0x528480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x54
push ebx
push ebp
push edi
mov edi, ecx
mov ecx, dword [esp + 0x64]
call fcn.00529700
mov edx, dword [edi]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea eax, [esp + 0x64]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push ebx
push edx
call ebp
test eax, eax
jne 0x528511
cmp dword [esp + 0xc], 1
jne 0x528511
mov eax, dword [esp + 0x64]
lea ecx, [eax + eax]
push esi
push ecx
call fcn.00526ee0
add esp, 4
lea edx, [esp + 0x68]
push edx
mov esi, eax
mov eax, dword [edi]
push esi
push 0
push 0
push ebx
push eax
call ebp
push esi
lea ecx, [esp + 0x18]
call fcn.00527310
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x70]
call fcn.00527470
lea ecx, [esp + 0x14]
call fcn.00527430
push esi
call fcn.00526f00
add esp, 4
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x54
ret 8
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x54
ret 8
Function at 0x529fe0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x206c
call fcn.0052fda0
push ebx
push esi
push edi
push 0x14
call fcn.00525dd0
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x52a010
mov dword [eax], vtable.BXPackImpl.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov esi, eax
jmp 0x52a012
xor esi, esi
mov eax, dword [esp + 0x207c]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push 4
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x10]
push edx
push eax
call edi
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jbe 0x52a15d
push ebp
lea ebp, [esi + 4]
push ebx
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x30]
mov dword [esp + 0x1c], ebx
mov eax, dword [esi + 0x10]
push edx
push eax
mov dword [esp + 0x38], ebx
call edi
push 0x2000
lea ecx, [esp + 0x80]
push ebx
push ecx
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x30]
add esp, 0xc
push ebx
lea edx, [esp + 0x14]
push edx
lea ecx, [eax + eax]
push ecx
lea edx, [esp + 0x88]
mov dword [esp + 0x1c], ebx
mov eax, dword [esi + 0x10]
push edx
push eax
call edi
push ebx
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x28]
mov dword [esp + 0x1c], ebx
mov eax, dword [esi + 0x10]
push edx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call edi
push ebx
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x2c]
mov dword [esp + 0x1c], ebx
mov eax, dword [esi + 0x10]
push edx
push eax
call edi
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x30]
call fcn.00527310
lea ecx, [esp + 0x2c]
call fcn.00526f70
lea edx, [esp + 0x2c]
push edx
mov ecx, ebp
call fcn.00529cd0
cmp eax, 0xffffffff
jne 0x52a13e
mov ecx, ebp
call fcn.00529f00
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
mov dword [esp + 0x2c], eax
call fcn.00527470
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov dword [eax + 0x50], edx
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x54], ecx
lea ecx, [esp + 0x2c]
call fcn.00527430
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
jb 0x52a066
pop ebp
mov edx, dword [esi + 0x10]
push ebx
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x206c
ret
Function at 0x52a4f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
push edi
push 2
push 0
push esi
call dword [sym.imp.MSVCR80.dll_fseek]
push esi
call dword [sym.imp.MSVCR80.dll_ftell]
push esi
mov edi, eax
call dword [sym.imp.MSVCR80.dll_rewind]
push esi
push edi
push 1
push 0x595a08
call dword [sym.imp.MSVCR80.dll_fread]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x2c], vtable.BXInputDeviceMapReader.0
mov dword [esp + 0x30], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
call fcn.005202ab
add esp, 0x2c
mov dword [esi + 4], 0
push 0x595a08
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0
call fcn.0052be50
pop edi
mov al, 1
pop esi
add esp, 0xc
ret
Function at 0x52d3a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
lea eax, [esp + 8]
push eax
mov esi, ecx
mov edx, dword [esi]
push 2
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop esi
pop ecx
ret 4

Function at 0x52d3d0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov eax, edx
push edi
mov esi, ecx
mov dword [esp + 8], 0
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x52d3e6
sub eax, edi
push 0
sar eax, 1
lea ecx, [esp + 0xc]
push ecx
add eax, eax
push eax
push edx
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov eax, esi
pop esi
pop ecx
ret 4
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4d137b]
shl eax, 2
mov dword [0x4d137f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004c47a0
pop edx
call fcn.004c3b3c
call fcn.004c47a4
push 0
call fcn.004c5758
pop ecx
push 0x4d1324
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4d1383], eax
push 0
jmp fcn.004cd8b0

Function at 0x40cbd8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
mov cl, al
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
movzx ecx, ax
sar ecx, 8
and ecx, 0xff
mov dword [ebp - 0x14], ecx
movzx ecx, dx
shr eax, 0x10
and eax, 0xff
mov dword [ebp - 0x18], eax
xor eax, eax
mov al, dl
mov dword [ebp - 0x1c], eax
xor eax, eax
sar ecx, 8
shr edx, 0x10
mov al, cl
mov dword [ebp - 0x20], eax
and edx, 0xff
mov dword [ebp - 0x24], edx
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
push esi
push ebx
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
cmp esi, ebx
jl 0x40cc68
mov esi, ebx
sar esi, 1
jns 0x40cc6f
adc esi, 0
mov dword [ebp - 0x38], esi
fild dword [ebp - 0x38]
add esp, 0xfffffff8
fstp qword [esp]
call fcn.004c919c
add esp, 8
call fcn.004c9430
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jle 0x40cd29
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x10]
imul ebx
cdq
idiv esi
mov ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x14]
add cl, byte [ebp - 0x10]
imul ebx
cdq
idiv esi
add al, byte [ebp - 0x14]
and ecx, 0xff
and eax, 0xff
movzx edx, ax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x18]
shl edx, 8
or ecx, edx
imul ebx
cdq
idiv esi
add al, byte [ebp - 0x18]
and eax, 0xff
shl eax, 0x10
or ecx, eax
push ecx
call sub.GDI32.DLL_CreateSolidBrush
mov edi, eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
push edi
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.USER32.DLL_FillRect
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
push edx
call sub.GDI32.DLL_SelectObject
push edi
call sub.GDI32.DLL_DeleteObject
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
push ecx
call sub.USER32.DLL_InflateRect
inc ebx
cmp esi, ebx
jg 0x40cc94
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreatePatternBrush
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov edx, dword [ebp - 8]
push edx
call sub.GDI32.DLL_DeleteObject
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414518
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
push 0
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov ebx, eax
test ebx, ebx
je 0x414576
test esi, esi
je 0x41453e
push esi
call fcn.004145f0
pop ecx
inc eax
add ebx, eax
push ebx
call fcn.0046ae84
pop ecx
mov edi, eax
push ebx
push edi
call sub.KERNEL32.DLL_GetSystemDirectoryA
test esi, esi
je 0x414570
mov eax, ebx
dec eax
push eax
push 0x5a48d9
push edi
call fcn.004145b4
add esp, 0xc
dec ebx
push ebx
push esi
push edi
call fcn.004145b4
add esp, 0xc
mov eax, edi
jmp 0x41457d
push esi
call fcn.00414584
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41465c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, eax
and eax, 0xff
and edi, 0xff00
mov dword [ebp - 8], eax
shr edi, 8
mov byte [ebx], 0
mov eax, edi
mov esi, edi
mov edx, edi
and esi, 4
and edx, 1
and eax, 2
test eax, eax
mov dword [ebp - 4], edx
je 0x41469e
mov eax, str.Ctrl_
jmp 0x4146a3
mov eax, 0x5a48e3
push eax
push ebx
call fcn.004c4900
add esp, 8
cmp dword [ebp - 4], 0
je 0x4146ba
mov edx, str.Shift_
jmp 0x4146bf
mov edx, 0x5a48e3
push edx
push ebx
call fcn.004c4900
add esp, 8
test esi, esi
je 0x4146d4
mov eax, str.Alt_
jmp 0x4146d9
mov eax, 0x5a48e3
push eax
push ebx
call fcn.004c4900
add esp, 8
push 0
mov edx, dword [ebp - 8]
push edx
call sub.USER32.DLL_MapVirtualKeyA
test edi, 8
mov esi, eax
je 0x414703
shl esi, 0x10
or esi, 0x3000000
jmp 0x41470c
shl esi, 0x10
or esi, 0x2000000
push 0x64
push ebx
call fcn.004c4990
pop ecx
add ebx, eax
push ebx
push esi
call sub.USER32.DLL_GetKeyNameTextA
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x414b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test eax, eax
je 0x414b48
test ebx, ebx
jne 0x414b4c
xor eax, eax
jmp 0x414bb5
push eax
call fcn.004b63c8
pop ecx
mov edi, eax
push ebx
call fcn.004b63c8
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
push edi
call fcn.0046af54
pop ecx
mov eax, dword [ebp - 4]
push eax
call fcn.0046af54
pop ecx
test ebx, ebx
jne 0x414b85
xor eax, eax
jmp 0x414bb5
push ebx
push esi
call sub.KERNEL32.DLL_SizeofResource
mov edi, eax
push ebx
push esi
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x414b9d
xor eax, eax
jmp 0x414bb5
push eax
call sub.KERNEL32.DLL_LockResource
test eax, eax
jne 0x414bab
xor eax, eax
jmp 0x414bb5
push edi
push eax
call fcn.00414bbc
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41a330
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
jne 0x41a34b
xor eax, eax
jmp 0x41a3a7
cmp dword [esp + 4], 5
jb 0x41a3a5
cmp dword [esp + 4], 5
jne 0x41a364
cmp dword [esp + 8], 0
jne 0x41a364
xor eax, eax
jmp 0x41a3a7
cmp dword [esp + 4], 5
jne 0x41a39e
cmp dword [esp + 8], 1
jne 0x41a39e
push str.Service_Pack
lea edx, [esp + 0x18]
push edx
call fcn.004c4b50
add esp, 8
push str.Service_Pack_1
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jl 0x41a39a
mov eax, 1
jmp 0x41a3a7
xor eax, eax
jmp 0x41a3a7
mov eax, 1
jmp 0x41a3a7
xor eax, eax
add esp, 0x94
ret

Function at 0x425870
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, 0x5a5b00
mov edi, str.Gdiplus.dll
mov ebx, edi
push esi
push edi
mov esi, 0x5a5b08
lea edi, [esp + 8]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp dword [esi], 0
jne 0x4258a3
push ebx
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [esi], eax
mov ebx, dword [esi]
test ebx, ebx
jne 0x4258b3
mov eax, 0x12
jmp 0x425993
lea edx, [edi + 0xc]
push edx
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5a5ae4], eax
test eax, eax
jne 0x4258d0
mov eax, 6
jmp 0x425993
lea edx, [edi + 0x1b]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5a5ae8], eax
test eax, eax
jne 0x4258ef
mov eax, 6
jmp 0x425993
lea edx, [edi + 0x2b]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5a5aec], eax
test eax, eax
jne 0x42590e
mov eax, 6
jmp 0x425993
lea edx, [edi + 0x44]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5a5af0], eax
test eax, eax
jne 0x42592a
mov eax, 6
jmp 0x425993
lea edx, [edi + 0x61]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5a5af4], eax
test eax, eax
jne 0x425946
mov eax, 6
jmp 0x425993
lea edx, [edi + 0x7c]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5a5af8], eax
test eax, eax
jne 0x425962
mov eax, 6
jmp 0x425993
lea edx, [edi + 0x98]
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5a5afc], eax
test eax, eax
jne 0x425981
mov eax, 6
jmp 0x425993
push 0
lea edx, [esp + 4]
push edx
push 0x5a5b04
call dword [0x5a5ae4]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x425df0
Capabilities:
Generate random numbers via winapi

Disassembly:
add esp, 0xffffffe0
cmp dword [0x5a5c30], 0
jne 0x425e26
push 0xf0000040
push 1
push 0
push 0
push 0x5d0bd8
call sub.ADVAPI32.DLL_CryptAcquireContextW
test eax, eax
jne 0x425e26
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x80090016
je 0x425e26
or eax, 0xffffffff
jmp 0x425e6a
mov dword [0x5a5c30], 1
push esp
push 0x20
mov edx, dword [0x5d0bd8]
push edx
call sub.ADVAPI32.DLL_CryptGenRandom
test eax, eax
jne 0x425e48
or eax, 0xffffffff
jmp 0x425e6a
push 0x20
lea edx, [esp + 4]
push edx
call fcn.00425d94
add esp, 8
push 0x20
push 0
lea ecx, [esp + 8]
push ecx
call fcn.004c485c
add esp, 0xc
xor eax, eax
add esp, 0x20
ret
Function at 0x425e05
Capabilities:
Generate random numbers via winapi

Disassembly:
add esp, 0xffffffe0
cmp dword [0x5a5c30], 0
jne 0x425e26
push 0xf0000040
push 1
push 0
push 0
push 0x5d0bd8
call sub.ADVAPI32.DLL_CryptAcquireContextW
test eax, eax
jne 0x425e26
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x80090016
je 0x425e26
or eax, 0xffffffff
jmp 0x425e6a
mov dword [0x5a5c30], 1
push esp
push 0x20
mov edx, dword [0x5d0bd8]
push edx
call sub.ADVAPI32.DLL_CryptGenRandom
test eax, eax
jne 0x425e48
or eax, 0xffffffff
jmp 0x425e6a
push 0x20
lea edx, [esp + 4]
push edx
call fcn.00425d94
add esp, 8
push 0x20
push 0
lea ecx, [esp + 8]
push ecx
call fcn.004c485c
add esp, 0xc
xor eax, eax
add esp, 0x20
ret
Function at 0x431eb8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf0
mov ebx, esp
xor esi, esi
mov ebp, 0x108
push ebx
push ebp
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov edi, eax
cmp ebp, edi
jae 0x431ef0
mov ebp, edi
mov eax, ebp
add eax, eax
push eax
call fcn.0046ae84
pop ecx
mov ebx, eax
push ebx
push ebp
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov edi, eax
push 0
test edi, edi
setne al
and eax, 1
push eax
call fcn.00434534
add esp, 8
cmp edi, 2
jb 0x431f3e
cmp ebp, edi
jbe 0x431f3e
cmp word [ebx + 2], 0x3a
jne 0x431f3e
mov ax, word [ebx]
cmp ax, 0x61
jb 0x431f2a
cmp ax, 0x7a
ja 0x431f2a
movzx esi, word [ebx]
add esi, 0xffffffe0
jmp 0x431f2d
movzx esi, word [ebx]
cmp esi, 0x41
jl 0x431f3c
cmp esi, 0x5a
jg 0x431f3c
sub esi, 0x41
jmp 0x431f3e
xor esi, esi
mov eax, esp
cmp ebx, eax
je 0x431f4b
push ebx
call fcn.0046af54
pop ecx
mov eax, esi
add esp, 0x210
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431f58
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov eax, dword [ebp + 8]
test eax, eax
jl 0x431fab
cmp eax, 0x19
jg 0x431fab
add ax, 0x41
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
push esi
setne bl
and ebx, 1
call sub.KERNEL32.DLL_SetErrorMode
push 0
push ebx
call fcn.00434534
add esp, 8
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret