joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463b0c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.0040bfbf
mov eax, dword [esi]
mov ecx, eax
mov dword [ebp - 8], eax
call fcn.00463c4b
test al, al
je 0x463b36
xor al, al
jmp 0x463bc6
mov ecx, esi
call fcn.00463bcd
mov ebx, eax
test ebx, ebx
jne 0x463b48
mov ebx, 0x7fff
xor ecx, ecx
lea esi, [ebx + 1]
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fd8b
pop ecx
mov edi, eax
push edi
push esi
push 0xd
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x463bbd
push edi
call fcn.00428d10
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x463bb4
xor ecx, ecx
test esi, esi
je 0x463b96
mov al, byte [ecx + edi]
sub al, 0x20
cmp al, 0x5e
ja 0x463bb4
inc ecx
cmp ecx, esi
jb 0x463b88
push edi
lea ecx, [ebp - 0x18]
call fcn.00463930
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00408725
lea ecx, [ebp - 0x18]
call fcn.0040b1ff
jmp 0x463bbd
mov ecx, dword [ebp + 8]
push edi
call fcn.004084e7
push edi
call fcn.0041fd94
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46959c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fd8b
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00420db0
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x4695f7
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x4695ee
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x469b67
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [ecx + 0x20]
neg eax
sbb eax, eax
and eax, 2
cmp dword [ecx], eax
jl 0x469b77
mov eax, dword [ecx]
mov ecx, eax
jmp fcn.0046afc6

Function at 0x469b7e
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [ecx + 0x20]
neg eax
sbb eax, eax
and eax, 2
cmp dword [ecx + 4], eax
jl 0x469b90
mov eax, dword [ecx + 4]
mov ecx, eax
jmp fcn.0046afc6
Function at 0x469b97
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [esi], eax
mov word [esi + 4], ax
cmp dword [edi + 0x20], eax
je 0x469c3a
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x469d1f
mov eax, 0x80
cmp byte [ebp - 0x60], al
je 0x469bdf
cmp byte [ebp - 0xf0], al
jne 0x469be8
cmp byte [edi + 0x1a], 0
jne 0x469be8
mov byte [esi], 1
cmp byte [ebp - 0x5f], al
jne 0x469bf7
cmp byte [edi + 0x1b], 0
jne 0x469bf7
mov byte [esi + 1], 1
cmp byte [ebp - 0xef], al
jne 0x469c09
cmp byte [edi + 0x1c], 0
jne 0x469c09
mov byte [esi + 2], 1
cmp byte [ebp - 0xee], al
jne 0x469c1b
cmp byte [edi + 0x1d], 0
jne 0x469c1b
mov byte [esi + 3], 1
cmp byte [ebp - 0xa5], al
jne 0x469d1f
cmp byte [edi + 0x1e], 0
jne 0x469d1f
mov byte [esi + 4], 1
jmp 0x469d1f
push ebx
push 0xa0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x469c67
push 0xa0
call ebx
mov ecx, 0x8000
test cx, ax
je 0x469c70
cmp byte [edi + 0x1a], 0
jne 0x469c70
mov byte [esi], 1
push 0xa1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x469c96
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
je 0x469ca0
cmp byte [edi + 0x1b], 0
jne 0x469ca0
mov byte [esi + 1], 1
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x469cc0
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
je 0x469cca
cmp byte [edi + 0x1c], 0
jne 0x469cca
mov byte [esi + 2], 1
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x469cea
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
je 0x469cf4
cmp byte [edi + 0x1d], 0
jne 0x469cf4
mov byte [esi + 3], 1
push 0x5b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x469d14
push 0x5b
call ebx
mov ecx, 0x8000
test cx, ax
je 0x469d1e
cmp byte [edi + 0x1e], 0
jne 0x469d1e
mov byte [esi + 4], 1
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x469eaf
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
mov esi, ecx
je 0x469ecb
mov byte [esi + 0x14], 1
mov cl, 1
jmp 0x469ece
mov cl, byte [esi + 0x14]
cmp byte [eax + 2], 0
je 0x469ed8
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x469ee2
mov byte [esi + 0x17], 1
xor eax, eax
test cl, cl
je 0x469ef0
cmp byte [esi + 0x1a], al
je 0x469ef0
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x469efd
cmp byte [esi + 0x1b], al
je 0x469efd
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x469f0a
cmp byte [esi + 0x1c], al
je 0x469f0a
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x469f17
cmp byte [esi + 0x1d], al
je 0x469f17
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x469f24
cmp byte [esi + 0x1e], al
je 0x469f24
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x469fa6
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46a0de
mov cl, byte [esi + 0x1a]
mov dl, byte [esi + 0x1b]
test cl, cl
sete al
dec al
and byte [ebp - 0x6c], al
test dl, dl
sete al
dec al
and byte [ebp - 0x6b], al
test cl, cl
jne 0x469f69
test dl, dl
sete al
dec al
and byte [ebp - 0xfc], al
cmp byte [esi + 0x1c], 0
sete al
dec al
and byte [ebp - 0xfb], al
cmp byte [esi + 0x1d], 0
sete al
dec al
and byte [ebp - 0xfa], al
test cl, cl
sete al
dec al
and byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x46a0de
push ebx
push edi
lea ecx, [ebp - 0xc]
call fcn.00469b24
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x469fde
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x469ffc
cmp byte [esi + 0x1a], 0
jne 0x469ffc
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.0046b1fd
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046aaba
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x46a01e
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x46a03c
cmp byte [esi + 0x1b], 0
jne 0x46a03c
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.0046b1fd
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046aaba
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x46a058
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x46a073
cmp byte [esi + 0x1c], 0
jne 0x46a073
push 0x11
lea ecx, [ebp - 0xc]
call fcn.0046b1fd
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046aaba
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x46a08f
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x46a0aa
cmp byte [esi + 0x1d], 0
jne 0x46a0aa
push 0x12
lea ecx, [ebp - 0xc]
call fcn.0046b1fd
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046aaba
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x46a0c1
push 0x5b
call edi
test bx, ax
je 0x46a0dc
cmp byte [esi + 0x1e], 0
jne 0x46a0dc
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.0046b1fd
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046aaba
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x46a90b
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bx, 1
cmp byte [ebp + 0xc], bl
je 0x46a96d
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0046b144
mov ecx, dword [ebp - 4]
call fcn.00469b7e
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0046b144
mov ecx, dword [ebp - 4]
call fcn.00469b67
pop esi
pop edi
mov al, bl
pop ebx
leave
ret 8

Function at 0x46a975
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x46aa5c
cmp bl, 0x14
je 0x46aa5c
cmp bl, 0x90
je 0x46aa5c
cmp bl, 0x91
je 0x46aa5c
cmp bl, 0xff
je 0x46aa49
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46a9ec
movzx eax, bl
or byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, bh
mov ecx, edi
shl eax, 0x10
mov edx, eax
mov dword [ebp + 8], eax
or edx, 1
call fcn.00469dab
cmp al, 1
jne 0x46aa0e
mov edx, dword [ebp + 8]
or edx, 0x1000001
cmp byte [esi + 0x17], 0
jne 0x46aa1f
cmp byte [esi + 0x1d], 0
jne 0x46aa1f
cmp bl, 0x12
jne 0x46aa3d
cmp byte [esi + 0x16], 0
jne 0x46aa3d
cmp byte [esi + 0x1c], 0
jne 0x46aa3d
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x104
jmp 0x46aa51
push edx
movzx eax, bl
push eax
push 0x100
jmp 0x46aa51
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46aaac
cmp bl, 0xff
je 0x46aa82
mov ecx, edi
call fcn.00469dab
push ecx
mov ecx, esi
cmp al, 1
jne 0x46aa73
push 1
jmp 0x46aa75
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0046b144
jmp 0x46aaac
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00469b7e
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46aaba
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x46ab9a
cmp bl, 0x14
je 0x46ab9a
cmp bl, 0x90
je 0x46ab9a
cmp bl, 0x91
je 0x46ab9a
cmp bl, 0xff
je 0x46abea
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46ab31
movzx eax, bl
xor byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, bh
mov ecx, edi
shl eax, 0x10
mov edx, eax
mov dword [ebp + 8], eax
or edx, 0xc0000001
call fcn.00469dab
cmp al, 1
jne 0x46ab56
mov edx, dword [ebp + 8]
or edx, 0xc1000001
cmp byte [esi + 0x17], 0
jne 0x46ab67
cmp byte [esi + 0x1d], 0
jne 0x46ab67
cmp bl, 0x12
jne 0x46ab85
cmp byte [esi + 0x16], 0
jne 0x46ab85
cmp byte [esi + 0x1c], 0
jne 0x46ab85
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x105
jmp 0x46ab8f
push edx
movzx eax, bl
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46abea
cmp bl, 0xff
je 0x46abc0
mov ecx, edi
call fcn.00469dab
push ecx
mov ecx, esi
cmp al, 1
jne 0x46abb1
push 3
jmp 0x46abb3
push 2
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0046b144
jmp 0x46abea
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 6
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00469b67
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46abf8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x46ac29
cmp byte [esi + 1], 0
jne 0x46ac29
cmp byte [esi + 2], 0
jne 0x46ac29
cmp byte [esi + 3], 0
jne 0x46ac29
cmp byte [esi + 4], 0
je 0x46add2
cmp dword [edi + 0x20], 0
push ebx
je 0x46ad5a
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x46ad5a
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46acb3
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x46ac71
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x46ac82
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x46ac8e
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x46ac9a
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x46aca6
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x46acc4
cmp byte [esi + 1], 0
je 0x46acdb
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x46acf8
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 3], 0
je 0x46ad37
cmp byte [esi + 2], 0
jne 0x46ad20
cmp byte [edi + 0x1c], 0
jne 0x46ad20
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x46ad32
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x46adca
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x46adca
xor ebx, ebx
cmp byte [esi], bl
je 0x46ad73
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0046b144
cmp byte [esi + 1], bl
je 0x46ad8b
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0046b144
cmp byte [esi + 2], bl
je 0x46ada0
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0046b144
cmp byte [esi + 3], bl
je 0x46adb5
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0046b144
cmp byte [esi + 4], bl
je 0x46adca
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0046b144
mov ecx, edi
call fcn.00469b7e
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x46add8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x46ae09
cmp byte [esi + 1], 0
jne 0x46ae09
cmp byte [esi + 2], 0
jne 0x46ae09
cmp byte [esi + 3], 0
jne 0x46ae09
cmp byte [esi + 4], 0
je 0x46afc0
cmp dword [edi + 0x20], 0
push ebx
je 0x46af42
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x46af42
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46ae93
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x46ae51
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x46ae62
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x46ae6e
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x46ae7a
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x46ae86
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x46aea4
cmp byte [esi + 1], 0
je 0x46aebd
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x46aedc
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 3], 0
je 0x46af1d
cmp byte [esi + 2], 0
jne 0x46af04
cmp byte [edi + 0x1c], 0
jne 0x46af04
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x46af18
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x46afb8
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x46afb8
cmp byte [esi], 0
push 2
pop ebx
je 0x46af5d
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0046b144
cmp byte [esi + 1], 0
je 0x46af76
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0046b144
cmp byte [esi + 2], 0
je 0x46af8c
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0046b144
cmp byte [esi + 3], 0
je 0x46afa2
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0046b144
cmp byte [esi + 4], 0
je 0x46afb8
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0046b144
mov ecx, edi
call fcn.00469b67
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x46afc6
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
test esi, esi
js 0x46b04a
jne 0x46afd9
push 0
jmp 0x46b044
cmp esi, 0xf
jae 0x46b043
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x46b043
mov dword [ebp - 4], esi
fild dword [ebp - 4]
test esi, esi
jns 0x46affc
fadd qword [0x4c81d0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sbb eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
fild qword [ebp - 8]
fstp qword [ebp - 0x20]
call fcn.0041e364
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x46b005
jmp 0x46b04a
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret

Function at 0x46b198
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.00469e9c
mov eax, dword [ebp + 8]
mov word [esi + 8], ax
test ax, ax
je 0x46b1f6
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x46b1f6
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x46b1df
mov byte [esi + 1], 1
test bl, 2
je 0x46b1e8
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x46b1f2
mov byte [esi + 4], 1
mov al, 1
jmp 0x46b1f8
xor al, al
pop esi
pop ebp
ret 4

Function at 0x46cc1d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 8], edi
je 0x46cc37
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.0046cb55
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], edi
pop edi
pop esi
leave
ret 8
Function at 0x46ce1e
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20034
call fcn.00441ef0
push ebx
push esi
lea eax, [ebp - 0x20034]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.0046dcfe
lea eax, [ebp - 0x10034]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.0046dcfe
pop ecx
pop ecx
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x46cea8
cmp byte [ebp + 8], al
je 0x46cecc
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call fcn.004251c2
pop ecx
pop ecx
test eax, eax
je 0x46cf8d
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x46cf8d
lea ecx, [ebp - 0x20034]
call fcn.0046e0b7
test al, al
je 0x46cecc
lea ecx, [ebp - 0x10034]
call fcn.0046e0b7
test al, al
je 0x46ced2
cmp byte [ebp + 8], 0
jne 0x46cf0b
xor al, al
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x10034]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040b606
lea ecx, [ebp - 0x34]
call fcn.0046d1df
mov bl, al
lea ecx, [ebp - 0x34]
neg bl
sbb bl, bl
call fcn.0040b1ff
add bl, 1
jne 0x46cecc
lea ecx, [ebp - 0x10034]
call fcn.0046e0b7
test al, al
je 0x46cecc
lea eax, [ebp - 0x20034]
push 0x4c68dc
push eax
call fcn.00428fc8
lea eax, [ebp - 0x20034]
push eax
call fcn.004248f3
xor ecx, ecx
mov word [ebp + eax*2 - 0x20032], cx
lea eax, [ebp - 0x10034]
push eax
call fcn.004248f3
xor ecx, ecx
mov dword [ebp - 0x20], 2
add esp, 0x10
mov word [ebp + eax*2 - 0x10032], cx
lea eax, [ebp - 0x20034]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10034]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0x24], eax
mov eax, 0x614
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x46cecc
mov al, 1
jmp 0x46cece
Function at 0x46d1df
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
mov dword [esp], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
mov eax, dword [ecx + 8]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 4]
push esi
push 0x49d034
mov dword [esp + 0x18], eax
inc dword [eax]
call fcn.0040562b
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d2ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 2
jne 0x46d243
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46d248
jmp 0x46d2b0
cmp eax, 3
jne 0x46d2b4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
push 0x49d034
inc dword [eax]
call fcn.0040642a
cmp eax, 0xffffffff
je 0x46d2a1
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x20]
call fcn.0040ad22
lea ecx, [esp + 0x18]
call fcn.0046d1df
test al, al
je 0x46d29f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
mov bl, al
lea ecx, [esp + 0x18]
call fcn.0040b1ff
jmp 0x46d2b6
test al, 0x10
je 0x46d2b4
mov bl, 1
jmp 0x46d2b6
xor bl, bl
lea ecx, [esp + 8]
call fcn.0040b1ff
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret