joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432aa0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x10]
call fcn.0043ec3c
pop ecx
pop ecx
test eax, eax
jne 0x432c0f
push 0x200
call fcn.0043ba63
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x432ad5
push ebx
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
sub eax, ecx
inc eax
call fcn.00432c7f
mov ebx, eax
mov edi, ebx
mov dword [ebp - 0xc], ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x432af4
mov ecx, dword [ebp + 0x14]
push esi
mov esi, 0x4556b4
movsw word es:[edi], word [esi]
mov edx, ecx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432b09
sub ecx, edx
mov edi, ebx
mov esi, edx
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x432b19
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x17c]
mov ecx, edx
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x432bf7
mov dword [ebp - 4], 0x200
mov dword [ebp + 0x14], 0x80
lea eax, [ebp - 0x150]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432b60
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
sub eax, edx
inc eax
call fcn.00432c7f
mov ebx, eax
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x432b7a
mov esi, 0x4556b4
lea eax, [ebp - 0x150]
movsw word es:[edi], word [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x432b91
mov edi, ebx
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x432b9f
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0x14], 2
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
jae 0x432bdb
add dword [ebp - 4], 0x200
push dword [ebp - 4]
sub dword [ebp + 0x14], 0xffffff80
push dword [esi]
call fcn.0043c415
pop ecx
pop ecx
test eax, eax
je 0x432c15
mov dword [esi], eax
mov eax, dword [esi]
mov dword [eax], ebx
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x432b57
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
call fcn.00432db8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop edi
pop ebx
xor eax, eax
leave
ret 0x10
mov eax, dword [esi]
test eax, eax
je 0x432c22
push eax
call fcn.0043c387
pop ecx
and dword [esi], 0
jmp 0x432c0c
Function at 0x4330cd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
and dword [ebp - 0xc], 0
push ebx
push edi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
mov byte [ebp - 5], 1
call fcn.0043ec3c
pop ecx
pop ecx
test eax, eax
jne 0x43311e
push 0x4568bc
push dword [ebp + 8]
call fcn.0043cfad
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x433126
push dword [ebp + 8]
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.0043f07b
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
test eax, eax
je 0x43311e
and dword [eax], 0
xor al, al
pop edi
pop ebx
leave
ret 0xc
cmp byte [ebp + 0x10], 0
je 0x433146
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.0043ba63
pop ecx
mov dword [esi], eax
test eax, eax
je 0x43311e
mov ecx, dword [ebp - 0x30]
mov byte [eax + ecx], 0
jmp 0x433155
push dword [ebp - 0x30]
call fcn.0043ba63
pop ecx
mov dword [esi], eax
test eax, eax
je 0x43311e
mov ecx, dword [ebp + 0xc]
mov ebx, dword [esi]
mov eax, dword [ebp - 0x30]
test ecx, ecx
je 0x433163
mov dword [ecx], eax
test eax, eax
jbe 0x4331c5
sub eax, dword [ebp - 0xc]
mov edi, eax
mov eax, 0x8000
cmp edi, eax
jbe 0x433177
mov edi, eax
push dword [ebp - 0x10]
push edi
push 1
push ebx
call fcn.0043d264
add esp, 0x10
cmp eax, edi
jne 0x433199
add dword [ebp - 0xc], eax
add ebx, eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xc], eax
jb 0x433167
jmp 0x4331c5
push dword [ebp + 8]
push dword [ebp - 0xc]
push edi
push str.Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.0043f07b
push dword [esi]
call fcn.0043c387
mov eax, dword [ebp + 0xc]
and dword [esi], 0
add esp, 0x14
test eax, eax
je 0x4331c1
and dword [eax], 0
mov byte [ebp - 5], 0
push dword [ebp - 0x10]
call fcn.0043d72e
mov al, byte [ebp - 5]
pop ecx
jmp 0x433120
Function at 0x433b00
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, eax
push esi
push edi
cmp ebx, 0x40
jbe 0x433b16
push 0x40
pop ebx
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
cmp dword [ebp + 0x10], eax
je 0x433b6e
push dword [0x46d4ac]
call fcn.004337f6
pop ecx
push 1
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push dword [ebp + 0x10]
call fcn.00433c94
add esp, 0x14
push dword [0x46d4ac]
test al, al
je 0x433c14
call fcn.0043380a
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
jmp 0x433b8b
mov eax, dword [0x46d4ac]
mov esi, 0x46d94c
mov dword [esp + 0xc], eax
mov edi, 0x46d4b0
jmp 0x433b8c
push dword [ebp + 0x10]
call fcn.00433820
pop ecx
cmp dword [esi], ebx
jae 0x433b83
push dword [esp + 0xc]
call fcn.004337f6
pop ecx
xor ebx, ebx
push ebx
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push ebx
call fcn.0043c1d2
mov ecx, dword [esi]
mov dword [esp + 0x28], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
mov dword [edi + ecx*4], eax
mov eax, dword [esi]
cmp dword [edi + eax*4], 0xffffffff
jne 0x433bef
push 0x32
call ebx
xor eax, eax
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.0043c1d2
mov ecx, dword [esi]
add esp, 0x18
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
mov dword [edi + ecx*4], eax
jl 0x433bbe
mov eax, dword [esi]
cmp dword [edi + eax*4], 0xffffffff
jne 0x433bff
dec eax
mov dword [esi], eax
or eax, 0xffffffff
jmp 0x433c1c
push 0
call ebx
mov eax, dword [esi]
push dword [edi + eax*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [esi]
push dword [esp + 0xc]
call fcn.0043380a
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4344da
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4344ee
sub eax, edx
cmp eax, 0x104
jae 0x434671
lea eax, [ebp - 0x3c]
push eax
push esi
call fcn.0043ec3c
pop ecx
pop ecx
test eax, eax
jne 0x434522
test dword [ebp - 0x36], 0x4000
je 0x434522
mov al, 1
jmp 0x434673
lea edx, [ebp - 0x144]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43452c
push 0x5c
pop ebx
lea eax, [ebp - 0x144]
push ebx
push eax
call fcn.0043bbd0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x43463b
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434555
sub eax, edx
cmp eax, 3
jbe 0x434596
cmp byte [esi + 1], bl
jne 0x434596
push ebx
add esi, 2
push esi
call fcn.0043bbd0
pop ecx
pop ecx
test eax, eax
je 0x43463b
inc eax
push ebx
push eax
call fcn.0043bbd0
pop ecx
pop ecx
test eax, eax
je 0x43463b
push ebx
inc eax
push eax
jmp 0x43462e
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43459b
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x144]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4345af
sub eax, ecx
cmp edi, eax
je 0x434637
mov al, byte [esi - 1]
cmp al, 0x3a
je 0x43462b
cmp al, bl
jne 0x434637
jmp 0x43462b
lea eax, [ebp - 0x144]
mov byte [esi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4345d5
sub eax, edx
je 0x434629
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.0043ec3c
pop ecx
pop ecx
test eax, eax
jne 0x434618
test dword [ebp - 0x36], 0x4000
jne 0x434629
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
push str.Cant_create_dir__s:_non_dir__s_in_the_way
call fcn.0043f07b
add esp, 0xc
jmp 0x434671
lea eax, [ebp - 0x144]
push eax
call fcn.0043e849
pop ecx
test eax, eax
jne 0x434678
mov byte [esi], bl
push ebx
inc esi
push esi
call fcn.0043bbd0
pop ecx
mov esi, eax
pop ecx
test esi, esi
jne 0x4345c9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x434651
test al, 0x10
jne 0x43451b
push dword [ebp + 8]
call fcn.0043e849
pop ecx
test eax, eax
je 0x43451b
push dword [ebp + 8]
push str.Unable_to_create_dir__s
call fcn.0043f07b
pop ecx
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x144]
push eax
push str.Cant_create_dir__s:_mkdir_fails
jmp 0x43466a
Function at 0x43470c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x118
push ebx
push esi
push edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43471e
sub eax, ecx
cmp eax, 0x104
jbe 0x434735
xor al, al
jmp 0x4347cf
push dword [ebp + 8]
lea eax, [ebp - 0x118]
call fcn.004343ff
pop ecx
lea eax, [ebp - 0x118]
push eax
call fcn.004344da
pop ecx
test al, al
je 0x43472e
xor ebx, ebx
mov byte [ebp - 1], bl
mov edi, str.__s__n
push 0x45910c
push dword [ebp + 8]
call fcn.0043cfad
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4347d4
push dword [ebp + 8]
push str.Unable_to_open__s_for_writing__will_try_again_in_1_sec
call fcn.0043f07b
and dword [ebp - 8], 0
lea esi, [ebp - 8]
call fcn.00434686
push dword [ebp - 8]
push edi
call fcn.0043f07b
push dword [ebp - 8]
call fcn.0043c387
add esp, 0x14
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x19
jb 0x43475f
push dword [ebp + 8]
push str.ERROR:_Couldnt_open__s_for_writing_n
call fcn.0043cd34
add eax, 0x40
push eax
call fcn.0043d281
add esp, 0xc
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov byte [ebp - 1], 1
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], ebx
jbe 0x434855
mov esi, dword [ebp + 0x10]
sub esi, ebx
mov eax, 0x8000
cmp esi, eax
jbe 0x4347f5
mov esi, eax
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 8]
call fcn.0043ea8f
add esp, 0x10
cmp eax, esi
jne 0x434816
add dword [ebp - 8], esi
add ebx, esi
cmp ebx, dword [ebp + 0x10]
jb 0x4347e5
jmp 0x434855
push dword [ebp + 8]
push ebx
push esi
push str.ERROR:_Unable_to_write__li_bytes_at_offset__li_to__s_n
call fcn.0043cd34
add eax, 0x40
push eax
call fcn.0043d281
and dword [ebp - 8], 0
add esp, 0x14
lea esi, [ebp - 8]
call fcn.00434686
push dword [ebp - 8]
push edi
call fcn.0043f07b
push dword [ebp - 8]
call fcn.0043c387
add esp, 0xc
mov byte [ebp - 1], 0
push dword [ebp - 0xc]
call fcn.0043d72e
pop ecx
jmp 0x4347cc
Function at 0x434863
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 1
call fcn.0043ec3c
pop ecx
pop ecx
test eax, eax
jne 0x4348d5
push 0x4568bc
push dword [ebp + 8]
call fcn.0043cfad
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x4348db
push dword [ebp + 8]
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.0043f07b
lea esi, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.00434686
push dword [ebp - 8]
push str.__s__n
call fcn.0043f07b
push dword [ebp - 8]
call fcn.0043c387
mov eax, dword [ebp + 0xc]
add esp, 0x14
cmp eax, ebx
je 0x4348d5
mov dword [eax], ebx
xor al, al
pop esi
pop ebx
leave
ret
mov dword [edi], ebx
xor esi, esi
push dword [ebp - 0x2c]
call fcn.0043ba63
pop ecx
mov dword [edi], eax
cmp eax, ebx
jne 0x43491e
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x1e
jl 0x4348df
cmp dword [edi], ebx
jne 0x43491e
push dword [ebp + 8]
push str.Cabby:_Unable_to_allocate_memory_to_read__s_to_mem_n
call fcn.0043cd34
add eax, 0x40
push eax
call fcn.0043d281
add esp, 0xc
jmp 0x4348d5
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edi]
mov eax, dword [ebp - 0x2c]
test ecx, ecx
je 0x43492c
mov dword [ecx], eax
test eax, eax
jbe 0x4349c4
sub eax, dword [ebp - 8]
mov esi, eax
mov eax, 0x8000
cmp esi, eax
jbe 0x434944
mov esi, eax
push dword [ebp - 0xc]
push esi
push 1
push ebx
call fcn.0043d264
add esp, 0x10
cmp eax, esi
jne 0x434966
add dword [ebp - 8], eax
add ebx, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 8], eax
jb 0x434934
jmp 0x4349c4
push dword [ebp + 8]
push dword [ebp - 8]
push esi
push str.Cabby:_Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.0043cd34
add eax, 0x40
push eax
call fcn.0043d281
and dword [ebp - 8], 0
add esp, 0x14
lea esi, [ebp - 8]
call fcn.00434686
push dword [ebp - 8]
push str.__s__n
call fcn.0043cd34
add eax, 0x40
push eax
call fcn.0043d281
push dword [ebp - 8]
call fcn.0043c387
push edi
call fcn.0043c387
mov eax, dword [ebp + 0xc]
add esp, 0x14
test eax, eax
je 0x4349c0
and dword [eax], 0
mov byte [ebp - 1], 0
push dword [ebp - 0xc]
call fcn.0043d72e
mov al, byte [ebp - 1]
pop ecx
jmp 0x4348d7

Function at 0x43621c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x436263
cmp edx, 0x10
jl 0x43624f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x43623c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x436263
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x43625b
and edx, 3
cmp edx, 3
jne 0x436277
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x43627c
cmp edx, 2
jne 0x436288
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x43628d
cmp edx, 1
jne 0x436293
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x43fb5d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45e8f8]
jne 0x43fb67
repz ret
jmp fcn.0044968c

Function at 0x449792
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043fc47
and dword [ebp - 4], 0
cmp dword [0x46cd3c], 0
mov ebx, eax
jne 0x449843
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4498f4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4538c0
push edi
call esi
test eax, eax
je 0x4498f4
push eax
call fcn.0043fbd5
mov dword [esp], 0x4538b0
push edi
mov dword [0x46cd3c], eax
call esi
push eax
call fcn.0043fbd5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46cd40], eax
call esi
push eax
call fcn.0043fbd5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46cd44], eax
call esi
push eax
call fcn.0043fbd5
pop ecx
mov dword [0x46cd4c], eax
test eax, eax
je 0x449843
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043fbd5
pop ecx
mov dword [0x46cd48], eax
mov eax, dword [0x46cd48]
cmp eax, ebx
je 0x44989b
cmp dword [0x46cd4c], ebx
je 0x44989b
push eax
call fcn.0043fc50
push dword [0x46cd4c]
mov esi, eax
call fcn.0043fc50
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44989b
test edi, edi
je 0x44989b
call esi
test eax, eax
je 0x449892
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x449892
test byte [ebp - 0xc], 1
jne 0x44989b
or dword [ebp + 0x10], 0x200000
jmp 0x4498d4
mov eax, dword [0x46cd40]
cmp eax, ebx
je 0x4498d4
push eax
call fcn.0043fc50
pop ecx
test eax, eax
je 0x4498d4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4498d4
mov eax, dword [0x46cd44]
cmp eax, ebx
je 0x4498d4
push eax
call fcn.0043fc50
pop ecx
test eax, eax
je 0x4498d4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46cd3c]
call fcn.0043fc50
pop ecx
test eax, eax
je 0x4498f4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4498f6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4507d8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x450809
call fcn.0043e7e3
mov dword [eax], esi
call fcn.0043e7d0
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0043dda4
add esp, 0x14
or eax, 0xffffffff
jmp 0x450844
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x450826
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043e7f6
pop ecx
jmp 0x450804
test byte [ebp + 0xc], 0x80
je 0x450831
and eax, 0xfffffffe
jmp 0x450834
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x450817
xor eax, eax
pop esi
pop ebp
ret
Function at 0x408a54
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404814
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408a6d
test al, 0x10
jne 0x408a71
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409b70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409ba9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404454
jmp 0x409bb2
mov eax, ebx
mov edx, esi
call fcn.004043b8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409bbc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409bdd
mov al, byte [esp]
jmp 0x409bdf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ae70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40aed4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004045cc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408848
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aedb
lea eax, [ebp - 0xc]
call fcn.00404364
ret

Function at 0x41cc18
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x463a20
cmp dword [edi], 0
jne 0x41cc94
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x463a1c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4614bc
mov ecx, 2
call fcn.00402994
mov edx, 0x41cbf0
lea eax, [esi + 5]
call fcn.0041cc10
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041cc10
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41cc69
mov dword [0x463a1c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41e1a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e1a6
ret
Function at 0x443274
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x462154]
cmp byte [eax + 0xc], 0
je 0x4433e1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4433da
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x463be4], 0
jne 0x4432c8
push 0x4433e8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4433f0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463be4], eax
cmp dword [0x461a90], 0
jne 0x4433c3
push 0x443400
call sub.kernel32.dll_LoadLibraryA
mov dword [0x461a90], eax
cmp dword [0x461a90], 0
je 0x4433c3
push 0x44340c
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463be8], eax
push 0x44341c
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463bec], eax
push 0x443430
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463bf0], eax
push 0x443448
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463bf4], eax
push 0x443460
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463bf8], eax
push 0x443474
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463bfc], eax
push 0x44348c
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463c00], eax
push 0x4434a4
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463c04], eax
push 0x4434c0
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463c08], eax
push 0x4434cc
mov eax, dword [0x461a90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x463c0c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4433e1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4474c8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404364
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x447517
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004045cc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44f358
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44f3a8]
test si, 4
je 0x44f36c
or bl, 1
test si, 8
je 0x44f376
or bl, 4
test si, 1
je 0x44f380
or bl, 8
test si, 2
je 0x44f38a
or bl, 0x10
test si, 0x10
je 0x44f394
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44f3a3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret