joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4382f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a63a2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ccecc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x4b75bc
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.00439f00
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.0043af00
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x4d3410]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.0043a320
test eax, eax
jne 0x4383f1
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x4383e0
or eax, 4
and eax, 0x17
mov dword [ecx + 8], eax
test dword [ecx + 0xc], eax
je 0x4383f1
push ebx
call fcn.00417030
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x43af00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a35ab
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ccecc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00468be3
push 4
mov dword [esp + 0x20], 0
call fcn.0044293d
mov edi, eax
add esp, 4
test edi, edi
je 0x43af7e
call fcn.00468a54
mov dword [edi], eax
call fcn.00468882
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00468ba4
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x43af73
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00468bcc
jmp 0x43af80
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x43bdf0
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x578
jmp fcn.004700a4

Function at 0x43de80
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
push ebp
lea ebp, [esi + 0x318]
push edi
mov dword [esi + 0x33c], eax
mov dword [esi + 0x340], ecx
mov dword [esi + 0x344], edx
mov dword [esi + 0x348], 0
mov dword [esp + 0x10], ebp
test ebp, ebp
je 0x43ded4
lea ebx, [esp + 0x10]
mov edi, 0x4cec10
call fcn.0043d4c0
mov eax, dword [ebp]
mov edx, dword [eax]
push 0x4cec0c
mov ecx, ebp
call edx
mov ecx, dword [esi + 0x344]
test ecx, ecx
jne 0x43dee6
mov eax, dword [esi + 0x338]
jmp 0x43def4
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
mov ecx, eax
call fcn.0046ecbc
xor ebp, ebp
push ebp
sub esp, 0x10
mov ecx, esp
push 0x80
mov dword [ecx], ebp
push 0x90000000
xor ebx, ebx
mov dword [ecx + 4], ebx
xor edx, edx
xor edi, edi
mov dword [ecx + 8], edi
push ebp
mov dword [ecx + 0xc], edx
push eax
mov ecx, esi
call fcn.00469f98
mov edi, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push edi
call ebx
test eax, eax
je 0x43df3c
push edi
call ebx
mov edi, eax
push edi
call ebx
test eax, eax
jne 0x43df30
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x43f190
Capabilities:
Create process on windows

Disassembly:
test byte [0x4d3670], 1
jne 0x43f1b2
or dword [0x4d3670], 1
call fcn.0041b6c0
push 0x4a88c0
call fcn.0044f061
add esp, 4
mov eax, dword [0x4d3354]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 4]
mov dword [ecx], 1
mov eax, 1
ret 4

Function at 0x43f1e0
Capabilities:
Create process on windows

Disassembly:
test byte [0x4d3670], 1
jne 0x43f202
or dword [0x4d3670], 1
call fcn.0041b6c0
push 0x4a88c0
call fcn.0044f061
add esp, 4
mov eax, dword [0x4d3344]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
ret
Function at 0x4411b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x578
jmp method.DuiLib::CMenuUI.virtual_276
Function at 0x44e200
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ccecc]
jne 0x44e20a
repz ret
jmp fcn.00455dd0

Function at 0x46387e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00457cf7
and dword [ebp - 4], 0
cmp dword [0x4d2494], 0
mov ebx, eax
jne 0x46392f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4639e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4639e0
push eax
call fcn.00457c85
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4d2494], eax
call esi
push eax
call fcn.00457c85
mov dword [esp], 0x4ad404
push edi
mov dword [0x4d2498], eax
call esi
push eax
call fcn.00457c85
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d249c], eax
call esi
push eax
call fcn.00457c85
pop ecx
mov dword [0x4d24a4], eax
test eax, eax
je 0x46392f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00457c85
pop ecx
mov dword [0x4d24a0], eax
mov eax, dword [0x4d24a0]
cmp eax, ebx
je 0x463987
cmp dword [0x4d24a4], ebx
je 0x463987
push eax
call fcn.00457d00
push dword [0x4d24a4]
mov esi, eax
call fcn.00457d00
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x463987
test edi, edi
je 0x463987
call esi
test eax, eax
je 0x46397e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46397e
test byte [ebp - 0xc], 1
jne 0x463987
or dword [ebp + 0x10], 0x200000
jmp 0x4639c0
mov eax, dword [0x4d2498]
cmp eax, ebx
je 0x4639c0
push eax
call fcn.00457d00
pop ecx
test eax, eax
je 0x4639c0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4639c0
mov eax, dword [0x4d249c]
cmp eax, ebx
je 0x4639c0
push eax
call fcn.00457d00
pop ecx
test eax, eax
je 0x4639c0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d2494]
call fcn.00457d00
pop ecx
test eax, eax
je 0x4639e0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4639e2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x469fc7
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x469fdd
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x469fe9
or edi, 1
push 1
call esi
test ax, ax
jge 0x469ff5
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x46a001
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x46a00d
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret
Function at 0x46beee
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x46bf13
cmp ebx, dword [esi + 0x58]
je 0x46bf13
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x58]
cmp ebx, eax
je 0x46bfd5
push edi
test eax, eax
je 0x46bf66
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x58]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x110]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x58]
mov ecx, esi
call fcn.0046b8e6
mov dword [esi + 0x58], edi
test ebx, ebx
je 0x46bfd4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x46bfd4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test al, al
je 0x46bfd4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xd4]
test al, al
je 0x46bfd4
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x58], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x58]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x110]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x58]
mov ecx, esi
call fcn.0046b8e6
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46c1d2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xd4]
mov ecx, edi
xor ebx, ebx
call fcn.004699d5
test eax, eax
jle 0x46c221
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call fcn.0046ebbd
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x46c282
mov ecx, edi
inc ebx
call fcn.004699d5
cmp ebx, eax
jl 0x46c1f0
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x46c2db
sub eax, 4
je 0x46c286
dec eax
dec eax
jne 0x46c2d2
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.0049e055
pop ecx
mov ecx, dword [esi + 0x54]
push reloc.OLEAUT32.dll_VariantCopyInd
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x46b183
call dword [eax + 0x104]
mov esi, eax
test esi, esi
je 0x46c2d2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x46c2d4
cmp dword [esi + 0x58], 0
je 0x46c2d2
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.00469fc7
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x58]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x110]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x46c2d2
cmp dword [esi + 0x58], 0
je 0x46c32a
mov ecx, dword [esi + 0x58]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x46c32a
mov ecx, dword [esi + 0x58]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x46c32a
mov ecx, dword [esi + 0x58]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.0044ea67
pop ecx
pop ecx
test eax, eax
je 0x46c32a
mov ecx, dword [esi + 0x58]
call fcn.004855a8
test al, al
jne 0x46c2d2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx eax, al
push eax
mov ecx, esi
call fcn.0046c086
jmp 0x46c282
Function at 0x481e25
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x481e30
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x481eeb
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4b1dd8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4b1dd8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4b1dd8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4b1dd8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4b1dd8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4b1dd8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4b1dd8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4b1dd8]
inc edx
sub edi, 8
dec esi
jne 0x481e50
pop ebx
test edi, edi
je 0x481f04
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x4b1dd8]
inc edx
dec edi
jne 0x481eef
pop edi
not eax
pop esi
ret

Function at 0x48239b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4823cf
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4823ca
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4823f7
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4823e0
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.004582d0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x483194
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4ccecc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x48323e
movzx ecx, word [esi]
test cx, cx
je 0x48323e
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x4831d2
cmp cx, 0x5c
jne 0x4831d4
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x4831c6
cmp eax, esi
je 0x483212
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00450ffb
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00483194
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0049df20
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0049def2
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e200
leave
ret
Function at 0x48476f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4847ea
cmp dword [esi + 4], 0xffffffff
jne 0x4847ea
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4b60e8
push edi
call fcn.0049def2
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x4847bc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4847bc
mov eax, 0x2000000
jmp 0x4847ef
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004821b1
add esp, 0x10
test eax, eax
jne 0x4847da
mov eax, dword [ebp + 0x10]
jmp 0x4847ef
push eax
call fcn.0048436b
mov dword [esi], eax
mov eax, dword [0x4d2c74]
pop ecx
jmp 0x4847ef
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x48575f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x558], ebx
je 0x4857c7
cmp dword [ebp + 8], 0x100
jne 0x4857b6
cmp word [ebp + 0xc], 0xd
jne 0x4857b6
cmp byte [esi + 0x55e], bl
je 0x48579d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4857b6
cmp byte [esi + 0x55f], bl
jne 0x4857b6
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x4857b2
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.0046b8e6
xor eax, eax
jmp 0x4857ca
mov eax, dword [esi + 0x558]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x488b0f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
sub esp, 0x2b4
lea ebp, [esp - 4]
mov eax, dword [0x4ccecc]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push 0xc
mov eax, 0x4a21d9
call fcn.004536e4
mov edi, dword [ebp + 0x2c0]
mov ebx, ecx
call fcn.0048803a
call fcn.0046a18f
push eax
lea ecx, [ebp + 0x230]
call fcn.0046f06d
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0046a195
mov ecx, eax
call fcn.0046edca
test al, al
je 0x488c71
push edi
lea ecx, [ebp + 0x230]
call fcn.0046ee5a
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
lea ecx, [ebp + 0x230]
call fcn.0046ecbc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
push esi
cmp eax, 0xffffffff
jne 0x488be5
push str.Error_opening_file
mov ecx, ebx
call fcn.00488210
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x230]
call fcn.0046eca2
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.0044e200
add ebp, 0x2b8
leave
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
jne 0x488bfa
push esi
push str.File_is_empty
jmp 0x488ba6
cmp edi, 0x400000
jbe 0x488c0a
push esi
push str.File_too_large
jmp 0x488ba6
push edi
mov dword [ebp - 0x14], esi
call fcn.0044296c
pop ecx
push esi
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], edi
je 0x488c50
push dword [ebp - 0x10]
call fcn.00442977
pop ecx
mov ecx, ebx
call fcn.0048803a
push esi
push str.Could_not_read_file
jmp 0x488ba6
push dword [ebp + 0x2c4]
mov ecx, ebx
push edi
push dword [ebp - 0x10]
call fcn.004889be
push dword [ebp - 0x10]
mov bl, al
call fcn.00442977
pop ecx
jmp 0x488baf
call fcn.0046a195
push eax
lea ecx, [ebp + 0x230]
call fcn.0046ee40
call fcn.0046a19b
test al, al
je 0x488c92
call fcn.0046a1a1
jmp 0x488ca9
push 2
push esi
lea ecx, [ebp + 0x230]
call fcn.0046ecbc
push eax
call fcn.00484b4e
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, esi
jne 0x488cbb
push esi
push str.Error_opening_zip_file
jmp 0x488ba6
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push edi
push dword [ebp - 0x10]
call fcn.0048324c
add esp, 0x14
test eax, eax
je 0x488ce0
push esi
push str.Could_not_find_ziped_file
jmp 0x488ba6
mov eax, dword [ebp + 0x22c]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x488bf2
cmp eax, 0x400000
ja 0x488c02
push eax
call fcn.0044296c
push 3
push dword [ebp - 0x14]
mov edi, eax
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.00484bab
add esp, 0x18
cmp eax, esi
je 0x488d47
cmp eax, 0x600
je 0x488d47
push edi
call fcn.00442977
pop ecx
call fcn.0046a19b
test al, al
jne 0x488d3c
push dword [ebp - 0x10]
call fcn.00484be5
pop ecx
push esi
push str.Could_not_unzip_file
jmp 0x488ba6
call fcn.0046a19b
test al, al
jne 0x488d59
push dword [ebp - 0x10]
call fcn.00484be5
pop ecx
push dword [ebp + 0x2c4]
mov ecx, ebx
push dword [ebp - 0x14]
push edi
call fcn.004889be
push edi
jmp 0x488c64
Function at 0x48f901
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x48f926
cmp eax, edi
jge 0x48f91e
mov eax, esi
call fcn.0048f2b5
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x48f948
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x48f92d
cmp ecx, 4
jge 0x48f967
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x48f955
xor eax, eax
jmp 0x48f95d
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x48f94b
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x48f999
mov eax, str.zlib_corrupt
call fcn.0048ced2
jmp 0x48f9d4
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x48f9a9
mov eax, str.read_past_buffer
jmp 0x48f992
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x48f9be
mov ecx, edi
call fcn.0048f2e0
test eax, eax
je 0x48f9d4
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004582d0
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x4952b6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4ccecc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x495327
cmp dword [esi + 0x10], ebx
je 0x495327
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.00455420
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x495327
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x23c
call fcn.0046ee1e
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0046b8e6
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e200
leave
ret 0x10