joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4636e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov edi, edx
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4637e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404068
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov eax, ebx
call fcn.004636b4
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4637cc
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404528
mov edi, eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4637ae
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jae 0x4637ae
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004046b4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0xc]
call fcn.00404528
call fcn.0040864c
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004046b4
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.004040bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jb 0x4637d3
mov edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.0046363c
jmp 0x4637d3
mov eax, ebx
call fcn.004635d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4637f0
lea eax, [ebp - 0xc]
call fcn.00404068
ret
Function at 0x463880
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor ecx, ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404518
mov eax, dword [ebp - 8]
call fcn.00404518
xor eax, eax
push ebp
push 0x463ae5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
call fcn.00408624
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 0x110]
mov ecx, 0xff
call fcn.00404304
mov eax, dword [ebp - 4]
call fcn.00402878
call fcn.0040283c
lea eax, [ebp - 0x250]
push eax
push 0x463af4
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x463a72
mov eax, dword [ebp - 8]
call fcn.00408334
test al, al
jne 0x463938
mov eax, dword [ebp - 8]
call fcn.00408358
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.004042d8
mov eax, dword [ebp - 0x10]
mov edx, 0x463b00
call fcn.00404474
je 0x463a4f
mov eax, dword [ebp - 0x10]
mov edx, 0x463b0c
call fcn.00404474
je 0x463a4f
cmp dword [ebp - 0x250], 0x10
jne 0x463a1e
push dword [ebp - 8]
push 0x463b18
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043e8
mov eax, dword [ebp - 0xc]
call fcn.00408334
test al, al
jne 0x4639aa
mov eax, dword [ebp - 0xc]
call fcn.00408358
mov eax, dword [ebp - 4]
call fcn.00404328
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4639e7
push dword [ebp - 4]
push 0x463b18
push dword [ebp - 0x10]
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.004043e8
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0xc]
call fcn.00463880
jmp 0x463a4f
lea eax, [ebp - 0x25c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00404374
mov eax, dword [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404374
mov eax, dword [ebp - 0x260]
pop edx
call fcn.00463880
jmp 0x463a4f
push dword [ebp - 8]
push 0x463b18
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043e8
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404528
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404528
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x250]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x463938
push ebx
call sub.kernel32.dll_FindClose_1
jmp 0x463a97
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x110]
call fcn.004042cc
mov eax, dword [ebp - 0x264]
call fcn.00402878
call fcn.0040283c
xor ebx, ebx
jmp 0x463aba
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x110]
call fcn.004042cc
mov eax, dword [ebp - 0x268]
call fcn.00402878
call fcn.0040283c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463aec
lea eax, [ebp - 0x268]
mov edx, 6
call fcn.0040408c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040408c
ret
Function at 0x41cf44
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x520
mov eax, dword [0x48f820]
xor eax, esp
mov dword [esp + 0x51c], eax
push ebx
push esi
xor ebx, ebx
push 0xc7
lea eax, [esp + 0x1d]
push ebx
push eax
mov byte [esp + 0x24], bl
call fcn.00431520
add esp, 0xc
lea eax, [esp + 0xe0]
push 0x12c
push ebx
push eax
call fcn.00431520
add esp, 0xc
xor eax, eax
push 0x206
mov word [esp + 0x31c], ax
lea eax, [esp + 0x31e]
push ebx
push eax
call fcn.00431520
add esp, 0xc
lea eax, [esp + 0x211]
push 0x103
push ebx
push eax
mov byte [esp + 0x21c], bl
call fcn.00431520
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
call fcn.0041f12b
pop ecx
lea ecx, [esp + 0x318]
call fcn.00402702
push ecx
lea edx, [esp + 0x214]
lea ecx, [esp + 0x31c]
call fcn.004200b5
lea eax, [esp + 0x148]
mov dword [esp + 0x10], eax
pop ecx
lea eax, [esp + 0x210]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x14]
push eax
push 0x42a290
push ebx
push ebx
mov dword [esp + 0x2c], ebx
call fcn.0042e9d0
mov esi, eax
add esp, 0x18
test esi, esi
je 0x41d044
push 0xffffffffffffffff
push esi
call dword [0x47a080]
push esi
call dword [0x47a060]
mov ecx, dword [esp + 0x524]
pop esi
pop ebx
xor ecx, esp
call fcn.0042aea6
mov esp, ebp
pop ebp
ret
Function at 0x41e12e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x478b0e
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x48f820]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x48f820]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x41e27b
cmp byte [esi + 0x45], bl
je 0x41e27b
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x41e192
xor al, al
jmp 0x41e27d
push ebx
push 8
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.0041ea66
lea eax, [esi + 0x48]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
mov ecx, dword [ecx + 0x40]
push eax
mov eax, dword [esp + 0x34]
lea edi, [esp + 0x24]
cmovae edi, edx
lea esi, [esp + 0x24]
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
push dword [esp + 0x24]
call dword [edx + 0x20]
sub eax, ebx
je 0x41e1fc
dec eax
jne 0x41e261
mov esi, dword [esp + 0x14]
jmp 0x41e203
mov esi, dword [esp + 0x14]
mov byte [esi + 0x45], bl
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp ecx, 0x10
lea eax, [esp + 0x20]
cmovae eax, edx
sub edi, eax
je 0x41e242
push dword [esi + 0x50]
cmp ecx, 0x10
push edi
lea eax, [esp + 0x28]
cmovae eax, edx
push 1
push eax
call fcn.0042b9db
add esp, 0x10
cmp edi, eax
jne 0x41e26a
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
cmp byte [esi + 0x45], 0
je 0x41e268
test edi, edi
jne 0x41e1c1
push ebx
push 8
lea ecx, [esp + 0x28]
call fcn.00401bd8
jmp 0x41e1b9
dec eax
dec eax
jne 0x41e26e
inc eax
jmp 0x41e26c
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x20]
call fcn.00401ab7
mov al, bl
jmp 0x41e27d
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042aea6
mov esp, ebp
pop ebp
ret

Function at 0x41f410
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edi
mov ebx, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x41f41c
sub esi, ecx
xor edx, edx
test esi, esi
jle 0x41f43d
sub edi, ebx
lea ecx, [edx + ebx]
lea eax, [edx + 1]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
cmp edx, esi
jl 0x41f42d
pushal
xor eax, eax
je 0x41fe47
mov edi, 0xc6844200
pop es
dec ecx
mov ecx, ebp
invalid
popal
pop edi
pop esi
pop ebx
ret
Function at 0x427ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x427eca
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x427f82
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x488af8]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x488af8]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x488af8]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x488af8]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x488af8]
movzx eax, byte [edx + 5]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x488af8]
movzx eax, byte [edx + 6]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x488af8]
movzx eax, byte [edx + 7]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x488af8]
add edx, 8
sub esi, 8
dec edi
jne 0x427ee5
pop edi
test esi, esi
je 0x427f9b
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x488af8]
inc edx
dec esi
jne 0x427f86
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x427fa3
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov edx, 0xff
and eax, edx
shr esi, 8
mov eax, dword [eax*4 + 0x488af8]
xor eax, esi
movzx ecx, al
add ecx, dword [edi + 4]
mov dword [edi], eax
mov eax, dword [edi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
and ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x488af8]
mov dword [edi + 8], eax
pop edi
pop esi
ret
Function at 0x4538a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x4538c9
push dword [esi + 0x134]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4538ff
push dword [esi + 0x130]
lea eax, [eax + eax*2]
push 1
add eax, 0x4814d8
push 2
push eax
call fcn.0042b9db
push dword [esi + 0x130]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0042b9db
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x45e770
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x45e781
jmp dword [eax*4 + 0x45e7f4]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret

Function at 0x45f5a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.0042e9d0
add esp, 0x18
test eax, eax
je 0x45f5c2
cmp eax, 0xffffffff
jne 0x45f5c4
xor eax, eax
pop ebp
ret

Function at 0x4686f0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
push esi
mov eax, edx
shr eax, 0x1f
push edi
mov edi, dword [ebp + 8]
add eax, edx
mov ebx, dword [edi]
xor esi, esi
cmp eax, 2
je 0x46872c
push str.Couldnt_set_desired_mode
push ebx
call fcn.00453330
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x468743
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.004533d0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x46875b
push edi
call fcn.004684a0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x468770
push edi
call fcn.004675e0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x468785
push edi
call fcn.00468480
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x468795
push edi
call fcn.004685e0
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x4731e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x47320c
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4731fd
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x473240
cmp dword [esi + 8], 0
jne 0x473230
push 0x48ae30
push dword [eax + 8]
call fcn.0042b82a
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x473230
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0042e4c9
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x473262
mov eax, dword [esi + 8]
test eax, eax
je 0x47325c
push eax
call fcn.0042bcb1
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x475d10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x4906b0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x475d3d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x475d84
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x475d8a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x475dea
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
push 1
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
push 1
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
lea ebx, [ebx + 1]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0x475db0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x475e17
nop
mov eax, dword [esi + 4]
push 1
push 0x487b42
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x487b43
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x475df0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402987
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4029b8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4029b4
cmp esi, eax
jae 0x4029b8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4029a4
cmp esi, eax
jb 0x4029be
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x408320
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x510531
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x53a1a4]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53a1a4]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
xor esi, esi
mov dword [esp + 0x4c], esi
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
call fcn.00402da0
mov dword [esp + 0x4c], esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push esi
push esi
mov dword [esp + 0x24], 1
call edi
mov esi, eax
xor ecx, ecx
lea eax, [esi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e8dab
add esp, 4
mov ebx, eax
push ebx
push esi
mov dword [esp + 0x28], ebx
call edi
mov ebp, eax
xor esi, esi
test ebp, ebp
jbe 0x40846c
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
mov dword [esp + 0x4c], 1
cmp esi, ebp
jae 0x40846c
movzx eax, word [ebx + esi*2]
test ax, ax
je 0x4083fd
movzx eax, ax
push eax
mov eax, 1
lea edi, [esp + 0x28]
call fcn.00408ab0
inc esi
cmp esi, ebp
jb 0x4083db
jmp 0x4083fe
inc esi
cmp dword [esp + 0x38], 0
je 0x408458
mov eax, dword [esp + 0x28]
mov edi, 8
cmp dword [esp + 0x3c], edi
jae 0x408418
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x408436
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
call fcn.0040ed70
mov ebx, dword [esp + 0x20]
mov byte [esp + 0x4c], 0
cmp dword [esp + 0x3c], edi
jb 0x40844e
mov edx, dword [esp + 0x28]
push edx
call fcn.004ea0ff
add esp, 4
cmp esi, ebp
jb 0x4083b4
jmp 0x40846c
cmp dword [esp + 0x3c], 8
jb 0x40846c
mov eax, dword [esp + 0x28]
push eax
call fcn.004ea0ff
add esp, 4
push ebx
call fcn.004ea5cf
mov eax, dword [esp + 0x1c]
add esp, 4
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004ea10a
add esp, 0x3c
ret
Function at 0x408820
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [esp + 8]
add edi, 0xfffff6a0
jns 0x40885c
mov ecx, dword [esi + 0x470]
sub ecx, dword [esi + 0x46c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jae 0x4088c4
mov ecx, dword [esi + 0x470]
sub ecx, dword [esi + 0x46c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408884
call fcn.004ea2c7
mov edx, dword [esi + 0x46c]
lea ecx, [edi*8]
sub ecx, edi
cmp dword [edx + ecx*4 + 0x18], 8
lea eax, [edx + ecx*4]
jb 0x4088a2
mov eax, dword [eax + 4]
jmp 0x4088a5
add eax, 4
movzx edi, word [eax]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0
movzx ecx, di
push ecx
push 0x464
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
ret 4

Function at 0x40c3b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
cmp dword [esi + 0x3dc], ebp
je 0x40c3d4
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [esi + 0x3dc], ebp
mov edi, dword [esi + 0x3d0]
cmp edi, ebp
je 0x40c4e3
call fcn.00402870
mov ebx, eax
mov edi, 1
cmp ebx, ebp
je 0x40c48f
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
push 2
push ebp
mov ecx, ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x30]
mov ecx, ebx
call edx
test eax, eax
je 0x40c416
mov eax, esi
call fcn.0040c2d0
mov eax, dword [esi + 0x3d0]
cmp eax, dword [esi + 0x3cc]
je 0x40c42c
cmp dword [ebx + 0xac], ebp
je 0x40c48f
mov edx, dword [ebx]
mov edx, dword [edx + 0x48]
mov dword [ebx + 0xfc], ebp
movzx ecx, word [esp + 0x3c]
lea eax, [esp + 0x14]
push eax
movzx eax, word [esp + 0x3c]
shl ecx, 0x10
or ecx, eax
push ecx
mov ecx, dword [esp + 0x3c]
push ecx
push 0x202
push ebp
mov ecx, ebx
mov dword [esp + 0x28], ebp
call edx
mov eax, dword [ebx + 0xa0]
cmp eax, ebp
je 0x40c480
cmp word [eax], bp
je 0x40c480
push edi
push ebp
push ebp
push eax
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40c48f
mov eax, dword [ebx + 0x14]
cmp eax, ebp
je 0x40c48f
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esi + 0x3d0], ebp
cmp dword [esp + 0xc], ebp
je 0x40c4e3
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edx, dword [ebx]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov ecx, dword [esi + 4]
push ecx
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push ecx
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x40c4f0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
xor edi, edi
call esi
test al, al
js 0x40c50d
push 0xa1
call esi
test al, al
jns 0x40c512
mov edi, 4
push 0x11
call esi
test al, al
js 0x40c522
push 0x11
call esi
test al, al
jns 0x40c525
or edi, 8
push 1
call esi
test al, al
js 0x40c535
push 1
call esi
test al, al
jns 0x40c538
or edi, 1
push 2
call esi
test al, al
js 0x40c548
push 2
call esi
test al, al
jns 0x40c54b
or edi, 2
push 4
call esi
test al, al
js 0x40c55b
push 0x10
call esi
test al, al
jns 0x40c55e
or edi, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
push eax
push ecx
push edi
call fcn.0040c3b0
pop edi
mov eax, 1
pop esi
ret 0xc

Function at 0x40f000
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esi + 4]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x40f054
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x40f04a
cmp ebx, 0x1b
jne 0x40f036
mov ecx, dword [esi + 4]
push 0
push 2
push 0x111
push ecx
jmp 0x40f048
cmp ebx, 0xd
jne 0x40f04a
mov edx, dword [esi + 4]
push 0
push 1
push 0x111
push edx
call edi
mov dword [esi + 0x454], 0
cmp dword [esi + 4], 0
je 0x40f076
movzx eax, word [esp + 0xc]
movzx ecx, word [esp + 8]
mov edx, dword [esi + 0x30]
shl eax, 0x10
or eax, ecx
push eax
push ebx
push 0x100
push edx
call edi
pop edi
ret 8