joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x416263
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416255
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x416274
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.00496320
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4162a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x4162db
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4162d6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x416308
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x4162ec
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.00496320
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x41631c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x416313
cmp byte [esi + 8], 0
je 0x416313
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4173a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x41745f
cmp dword [edi + 4], 0xffffffff
jne 0x41745f
lea esi, [edi + 0x244]
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4173d0
sub esi, ecx
sar esi, 1
movzx eax, word [edi + esi*2 + 0x242]
cmp eax, 0x5c
je 0x4173fc
cmp eax, 0x2f
je 0x4173fc
mov dword [edi + esi*2 + 0x244], 0x2f
mov esi, dword [ebp + 0x10]
cmp esi, 1
jne 0x417422
push esi
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x417422
mov eax, 0x2000000
pop edi
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
mov ecx, dword [ebp + 8]
push eax
push esi
call fcn.004160f0
add esp, 8
test eax, eax
jne 0x417442
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, eax
call fcn.004165b0
xor ecx, ecx
mov dword [edi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x417ab0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4e5070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x417b51
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0049e1da
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417af0
sub ecx, edx
sar ecx, 1
je 0x417b30
movzx eax, word [ebp + ecx*2 - 0x20e]
cmp eax, 0x2f
je 0x417b13
cmp eax, 0x5c
jne 0x417b30
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x417c54
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x417b51
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [edi]
test ax, ax
je 0x417c44
push esi
mov esi, edi
mov ecx, edi
cmp ax, 0x2f
je 0x417b6e
cmp ax, 0x5c
jne 0x417b70
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x417b62
cmp esi, edi
je 0x417bb9
sub esi, edi
lea eax, [ebp - 0x20c]
and esi, 0xfffffffe
push esi
push edi
push eax
call fcn.00496320
add esp, 0xc
cmp esi, 0x208
jae 0x417c54
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, ebx
mov word [ebp + esi - 0x20c], ax
call fcn.00417ab0
xor eax, eax
mov word [ebp - 0x418], ax
pop esi
test ebx, ebx
je 0x417bdc
push 0x104
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.0049e1da
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x418]
mov word [ebp - 0x212], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417bf0
sub ecx, edx
mov eax, 0x104
sar ecx, 1
sub eax, ecx
push eax
lea eax, [ebp - 0x418]
lea eax, [eax + ecx*2]
push edi
push eax
call fcn.0049e1da
xor eax, eax
add esp, 0xc
mov word [ebp - 0x212], ax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x417c44
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00493122
mov esp, ebp
pop ebp
ret
call fcn.00493776
int3
Function at 0x4187e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x4188b8
mov eax, dword [esi + 0x3c]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x418814
cmp dword [esi + 0x40], ebx
jae 0x418814
push eax
call fcn.00493645
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x41882c
lea eax, [ebx + ebx]
push eax
call fcn.004933e1
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call fcn.00496320
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x4188b5
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
shr ecx, 8
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, dword [esi + 0x30]
or edi, 2
movzx eax, al
mov eax, dword [eax*4 + 0x4c7650]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x4c7650]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x418842
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4188f6
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x4188dd
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.00496320
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x418918
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4191f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4d5c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e5070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 0x14]
mov dword [ebp - 4], 0
push 0x1388
push eax
mov dword [esi], vtable.CNetResManager.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [ebp - 4], 2
mov edi, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test edi, edi
je 0x4192d2
push 0x70
call fcn.00493133
mov ebx, eax
mov dword [ebp - 0x14], ebx
sub esp, 0x14
mov byte [ebp - 4], 3
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x41929b
mov eax, dword [edx]
jmp 0x41929d
mov eax, edx
mov byte [eax], 0
cmp byte [edi], 0
jne 0x4192a9
xor ecx, ecx
jmp 0x4192bb
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4192b1
sub ecx, dword [ebp + 8]
push ecx
push edi
mov ecx, edx
call fcn.00403a90
mov ecx, ebx
call fcn.0042dbd0
mov byte [ebp - 4], 2
mov dword [esi + 0xc], eax
push 0x3c
call fcn.00493133
add esp, 4
mov dword [ebp + 8], eax
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0042bb20
mov dword [esi + 0x10], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x419690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov ebx, ecx
mov dword [ebp - 4], esi
cmp dword [edi + 0x118], esi
je 0x4196c6
mov ecx, dword [edi + 0xf0]
test ecx, ecx
je 0x4196eb
mov eax, dword [ecx]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x14]
mov esi, eax
mov dword [ebp - 4], esi
jmp 0x4196eb
push edi
call fcn.004198c0
test al, al
jne 0x4196eb
mov ecx, dword [edi + 0xf0]
test ecx, ecx
je 0x4196eb
mov eax, dword [ecx]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x14]
mov esi, eax
mov dword [ebp - 4], eax
cmp dword [ebx + 0xc], 0
je 0x419747
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x419747
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x419747
cmp eax, 0xffffffff
je 0x419747
mov esi, dword [ebp + 0xc]
xor edi, edi
nop dword [eax]
push 0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
mov eax, dword [ebp + 8]
push esi
add eax, edi
push eax
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp + 0xc]
cmp edi, esi
jae 0x419738
test eax, eax
jne 0x419710
add dword [ebx + 8], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x419a20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4e04
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4e5070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
lea esi, [edi + 0x14]
mov dword [edi + 0xc], eax
xor ecx, ecx
mov eax, 0x53
mov dword [edi], vtable.UiLib::CWindowWnd.0
mov edx, 4
mov dword [edi + 4], 0
mul edx
mov dword [edi + 8], 0
mov word [edi + 0x10], 0x100
seto cl
mov dword [esi], vtable.UiLib::CNotifyPump.0
neg ecx
mov dword [ebp - 0x14], esi
or ecx, eax
mov dword [esi + 0xc], 0
push ecx
mov dword [esi + 8], 0x53
call fcn.004933e1
push 0x14c
push 0
push eax
mov dword [esi + 4], eax
call fcn.00498020
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [edi + 0x4c]
mov dword [edi + 0x24], vtable.UiLib::INotifyUI.0
xor ecx, ecx
mov dword [edi + 0x28], vtable.UiLib::IMessageFilterUI.0
mov dword [edi + 0x2c], vtable.UiLib::IDialogBuilderCallback.0
mov dword [edi], vtable.IWindowBase.0
mov dword [esi], vtable.IWindowBase.4.0
mov dword [edi + 0x24], vtable.IWindowBase.3.0
mov dword [edi + 0x28], vtable.IWindowBase.2.0
mov dword [edi + 0x2c], vtable.IWindowBase.1.0
mov dword [edi + 0x44], vtable.UiLib::CDuiString.0
mov dword [edi + 0x48], eax
mov word [eax], cx
lea ecx, [edi + 0xcc]
mov byte [ebp - 4], 1
call fcn.0041d540
push 0xffffffffffffffff
push 0x4c5de8
lea ecx, [edi + 0x44]
mov dword [edi + 0x40], 0
mov dword [edi + 0x7a0], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x79c], 0
call fcn.00429c90
mov dword [edi + 0x7a8], 0
mov eax, edi
mov dword [edi + 0x7a4], 0
mov dword [edi + 0x7ac], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x419e50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x419e6e
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x419e6e
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x10
Function at 0x41ba80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0
jne 0x41bbfd
push 0x20
call fcn.00493133
add esp, 4
mov dword [ebp - 4], eax
mov ecx, eax
mov dword [eax], vtable.CWndShadow.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xd], 0x5000864
mov byte [eax + 0x11], 5
mov dword [eax + 0x14], 0
mov byte [eax + 0x18], 0
mov dword [eax + 0x1c], 0x505050
push dword [esi + 4]
mov dword [esi + 0x40], eax
call fcn.0042f3b0
mov eax, dword [esi + 0x40]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41baf3
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push edi
mov edi, dword [esi + 0x40]
mov eax, dword [edi + 4]
test eax, eax
je 0x41bb1a
test byte [edi + 0xc], 2
mov byte [edi + 0xf], 8
je 0x41bb1a
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x40]
mov eax, dword [edi + 4]
test eax, eax
je 0x41bb3b
test byte [edi + 0xc], 2
mov word [edi + 0x10], 0x202
je 0x41bb3b
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x40]
mov eax, dword [edi + 4]
test eax, eax
je 0x41bb5a
test byte [edi + 0xc], 2
mov byte [edi + 0xe], 0xd
je 0x41bb5a
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x40]
mov eax, dword [edi + 4]
test eax, eax
je 0x41bb79
test byte [edi + 0xc], 2
mov byte [edi + 0xd], 0x64
je 0x41bb79
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x40]
mov eax, dword [edi + 4]
test eax, eax
je 0x41bb9b
test byte [edi + 0xc], 2
mov dword [edi + 0x1c], 0x505050
je 0x41bb9b
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x40]
mov ecx, dword [esi + 4]
cmp dword [edi + 4], 0
je 0x41bbf0
and byte [edi + 0xc], 9
mov al, byte [edi + 0xc]
test al, 1
je 0x41bbda
test al, 8
jne 0x41bbda
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x41bbda
or byte [edi + 0xc], 4
mov cl, byte [edi + 0xc]
test eax, 0x21000000
jne 0x41bbda
or cl, 2
mov byte [edi + 0xc], cl
test byte [edi + 0xc], 2
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
je 0x41bbe9
push 8
jmp 0x41bbeb
push 0
push dword [edi + 4]
call eax
push dword [esi + 4]
mov ecx, dword [esi + 0x40]
call fcn.0042f790
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ee20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x540], edi
jle 0x41ee6b
nop dword [eax + eax]
mov eax, dword [esi + 0x53c]
lea edx, [ebp + 0xb]
mov byte [ebp + 0xb], 0
push edx
push dword [ebp + 0x10]
mov ecx, dword [eax + edi*4]
push dword [ebp + 0xc]
push ebx
mov eax, dword [ecx]
call dword [eax]
cmp byte [ebp + 0xb], 0
jne 0x41eed0
inc edi
cmp edi, dword [esi + 0x540]
jl 0x41ee40
sub ebx, 0x100
je 0x41ef42
sub ebx, 4
je 0x41eedb
sub ebx, 2
jne 0x41efe1
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.0049cf2d
mov ecx, dword [esi + 0x41c]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push SHCreateMemStream
push edx
push 0x423830
call dword [eax + 0x174]
mov esi, eax
test esi, esi
je 0x41efe1
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x134]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esi + 0x420], 0
je 0x41efe1
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movups xmmword [ebp - 0x10], xmm0
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x438]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x43c]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x10], eax
call fcn.00427d90
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x420]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x184]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x41efe1
mov ecx, dword [esi + 0x420]
test ecx, ecx
je 0x41efc8
mov eax, dword [ecx]
mov eax, dword [eax + 0x100]
cmp eax, method.UiLib::CCheckBoxUI.virtual_256
jne 0x41efec
cmp byte [ecx + 0x234], 0
je 0x41efc8
cmp byte [ecx + 0x235], 0
jne 0x41ef7d
jmp 0x41efc8
mov ecx, dword [esi + 0x420]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10c]
cmp eax, method.UiLib::CCheckBoxUI.virtual_268
jne 0x41eff4
mov al, byte [ecx + 0x236]
test al, al
je 0x41efc8
mov ecx, dword [esi + 0x420]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0049594d
add esp, 8
test eax, eax
je 0x41efc8
mov eax, dword [esi + 0x420]
cmp byte [eax + 0x245], 0
jne 0x41efe1
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.00422380
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call eax
test al, al
je 0x41efc8
jmp 0x41ef7d
call eax
jmp 0x41ef98
Function at 0x421be0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 4]
mov ebx, eax
mov esi, dword [ebp + 8]
cmp ebx, ecx
je 0x421c0f
cmp esi, dword [edi + 0x420]
je 0x421c0f
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x420]
cmp esi, eax
je 0x421d1e
cmp ebx, dword [edi + 4]
jne 0x421c2a
test esi, esi
je 0x421d1e
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x421c87
xorps xmm0, xmm0
mov dword [esp + 0xc], 0x15
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x14], esi
movups xmmword [esp + 0x20], xmm0
call ebx
mov ecx, dword [edi + 0x420]
lea edx, [esp + 0xc]
mov dword [esp + 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x184]
push ecx
push 0
push 0
push str.killfocus
push dword [edi + 0x420]
mov ecx, edi
call fcn.004229a0
mov dword [edi + 0x420], 0
test esi, esi
je 0x421d1e
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
cmp eax, method.UiLib::CCheckBoxUI.virtual_28
jne 0x421d27
mov eax, dword [esi + 0x40]
cmp eax, edi
jne 0x421d1e
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x100]
call eax
test al, al
je 0x421d1e
mov eax, dword [esi]
mov eax, dword [eax + 0x10c]
cmp eax, method.UiLib::CCheckBoxUI.virtual_268
jne 0x421d30
mov al, byte [esi + 0x236]
test al, al
je 0x421d1e
xorps xmm0, xmm0
mov dword [edi + 0x420], esi
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x16
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x14], esi
call ebx
mov ecx, dword [edi + 0x420]
lea edx, [esp + 0xc]
mov dword [esp + 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x184]
push ecx
push 0
push 0
push str.setfocus
push dword [edi + 0x420]
mov ecx, edi
call fcn.004229a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call eax
jmp 0x421ca2
mov ecx, esi
call eax
jmp 0x421ccb

Function at 0x427d10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, esi
push edi
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427d20
sub eax, edx
xor ecx, ecx
sar eax, 1
mov edx, 0x811c9dc5
lea edi, [eax + eax]
test edi, edi
je 0x427d51
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x427d40
pop edi
mov eax, edx
pop esi
ret

Function at 0x427d90
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x427db5
or esi, 1
push 1
call edi
test ax, ax
jns 0x427dc1
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x427dcd
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x427dd9
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x42bb20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b5d66
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x4e5070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 0x14]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0
push 0
push 1
mov byte [ebp - 4], 1
push 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0x14
push 0x14
push 0
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0x138
mov dword [edi + 0x10], eax
call fcn.00493133
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.0042c7f0
mov dword [edi + 0x38], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42c140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x42c165
push 0
push 0
push esi
push 0x42c260
push 0
push 0
call fcn.00498fd8
add esp, 0x18
mov dword [esi + 8], eax
mov ecx, dword [esi + 0x38]
call fcn.0042cc50
test eax, eax
je 0x42c17b
push dword [ebp + 8]
mov ecx, eax
call fcn.0042d000
mov eax, dword [esi + 4]
pop esi
test eax, eax
je 0x42c18a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop ebp
ret 4