joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402cb0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
cmp dword [0x405740], 0
push ebx
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push ebp
jne 0x402cfc
call esi
mov edi, eax
test edi, edi
je 0x402cda
mov dword [0x405740], 1
jmp 0x402d00
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x402cf2
mov dword [0x405740], 2
jmp 0x402d04
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
cmp dword [0x405740], 1
jne 0x402db3
test edi, edi
jne 0x402d27
call esi
mov edi, eax
test edi, edi
jne 0x402d27
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x402d41
add esi, 2
cmp word [esi], 0
jne 0x402d2f
add esi, 2
cmp word [esi], 0
jne 0x402d2f
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x402da2
push ebp
call fcn.004034d0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x402da2
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x402d91
push ebx
call fcn.00403360
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x405740], 2
jne 0x402e37
test ebx, ebx
jne 0x402dd6
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x402dd6
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x402deb
inc ebp
cmp byte [ebp], 0
jne 0x402ddd
inc ebp
cmp byte [ebp], 0
jne 0x402ddd
sub ebp, ebx
inc ebp
push ebp
call fcn.004034d0
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x402e10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x403170
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x405758
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x403197
add eax, 8
inc ecx
cmp eax, 0x4057e0
jb 0x403188
cmp dword [ecx*8 + 0x405758], edx
lea ebx, [ecx*8]
jne 0x403352
cmp dword [0x4052bc], 1
je 0x403317
cmp dword [0x4052bc], 0
jne 0x4031ce
cmp dword [0x4052c0], 1
je 0x403317
cmp edx, 0xfc
je 0x403352
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x40320b
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x40324f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4042c0
push ebp
call fcn.004023e0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4042a0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x40575c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.004036a0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x405e70]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x40332e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x40575c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x4010d5
Capabilities:
Extract resource via kernel32 functions
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push 0xa
push 1
push dword [0x413378]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x401228
push eax
push dword [0x413378]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401228
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x424
push eax
push 0x412e50
call fcn.00405a00
add esp, 0xc
mov edi, 0x104
lea eax, [ebp - 0x104]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
and byte [ebp - 0x103], 0
lea eax, [ebp - 0x104]
push str.:Temp
push eax
call fcn.004058a0
mov esi, 0x412fd4
push esi
call fcn.00405980
add esp, 0xc
test eax, eax
jne 0x40116e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x401175
push esi
call fcn.00401e2f
pop ecx
mov eax, dword [0x4131ec]
sub eax, 0
je 0x40120f
dec eax
je 0x401201
dec eax
jne 0x4011d4
mov esi, 0x412ed0
push esi
call fcn.00405980
test eax, eax
pop ecx
jne 0x4011e6
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.00405890
push esi
call fcn.00401e2f
add esp, 0xc
test eax, eax
jne 0x4011ca
push 0x4131f0
call fcn.00405980
test eax, eax
pop ecx
jne 0x40121d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [0x410030], 1
push 0x413230
call fcn.00401f7b
pop ecx
push 1
pop eax
pop edi
pop esi
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4011ca
push esi
call fcn.00401e2f
and dword [0x410030], 0
pop ecx
jmp 0x4011d4
push 0x412ed0
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x4011ca
lea eax, [ebp - 0x104]
mov esi, 0x412ed0
push eax
jmp 0x4011a0
push str.Cannot_create_temporary_folder__please_repackage_with_a_specific_folder._n
call fcn.004056ca
pop ecx
xor eax, eax
jmp 0x4011e2
Function at 0x40122c
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push esi
push edi
push 0xa
push 2
push dword [0x413378]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x401260
push edi
push dword [0x413378]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x401267
xor eax, eax
jmp 0x401330
movsx eax, byte [0x412fd4]
push eax
call fcn.00405dd0
sub eax, 0x40
push eax
call fcn.00405d79
pop ecx
pop ecx
push 0x412fd4
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov esi, eax
push dword [0x413378]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push str.hsdiafwiuera
push edi
push esi
call fcn.00401fba
push 3
push edi
push esi
call fcn.004055b8
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push 0xffffffffffffffff
push esi
call fcn.00405616
mov eax, dword [ebp - 0x130]
add esp, 0x24
xor edi, edi
mov dword [ebp - 4], eax
test eax, eax
jle 0x401326
lea eax, [ebp - 0x130]
push eax
push edi
push esi
call fcn.00405616
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.00405d35
add esp, 0x14
test eax, eax
je 0x401320
push 2
lea eax, [ebp - 0x12c]
push 0
push eax
push edi
push esi
call fcn.00405649
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.00401d4e
add esp, 0x1c
inc edi
cmp edi, dword [ebp - 4]
jl 0x4012da
push esi
call fcn.00405683
pop ecx
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x401334
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push esi
push edi
push 0xa
push 3
push dword [0x413378]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x401368
push edi
push dword [0x413378]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x40136f
xor eax, eax
jmp 0x401463
movsx eax, byte [0x412ed0]
push eax
call fcn.00405dd0
sub eax, 0x40
push eax
call fcn.00405d79
pop ecx
pop ecx
push 0x412ed0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov esi, eax
push dword [0x413378]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push str.hsdiafwiuera
push edi
push esi
call fcn.00401fba
push 3
push edi
push esi
call fcn.004055b8
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push 0xffffffffffffffff
push esi
call fcn.00405616
mov eax, dword [ebp - 0x130]
add esp, 0x24
test eax, eax
mov dword [ebp - 4], eax
je 0x4013f2
shl eax, 6
push eax
call fcn.00405e9c
mov dword [0x41337c], eax
and byte [eax], 0
pop ecx
xor edi, edi
cmp dword [ebp - 4], edi
jle 0x401459
lea eax, [ebp - 0x130]
push eax
push edi
push esi
call fcn.00405616
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.00405d35
add esp, 0x14
test eax, eax
je 0x401453
push 2
lea eax, [ebp - 0x12c]
push 0
push eax
push edi
push esi
call fcn.00405649
lea eax, [ebp - 0x12c]
push eax
push dword [0x41337c]
call fcn.004058a0
push 0x4100c0
push dword [0x41337c]
call fcn.004058a0
add esp, 0x24
inc edi
cmp edi, dword [ebp - 4]
jl 0x4013f9
push esi
call fcn.00405683
pop ecx
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x401d4e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 8]
push str..wsc
push esi
call fcn.00405740
pop ecx
test eax, eax
pop ecx
jne 0x401dd6
push str..WSC
push esi
call fcn.00405740
pop ecx
test eax, eax
pop ecx
jne 0x401dd6
cmp byte [ebp + 0xc], al
push edi
mov edi, str.DllUnregisterServer
jne 0x401d8d
mov edi, str.DllRegisterServer
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401dc2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401daa
call eax
jmp 0x401db7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401e1c
pop ecx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x401dd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401e1c
pop ecx
mov edi, eax
mov eax, edi
pop edi
jmp 0x401e19
lea eax, [ebp - 0x104]
push str.regsvr32_scrobj.dll__n__i:_file:__
push eax
call fcn.00405890
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.004058a0
lea eax, [ebp - 0x104]
push 0x410058
push eax
call fcn.004058a0
add esp, 0x18
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
pop esi
leave
ret

Function at 0x401ef7
Capabilities:
Delete directory
Set current directory

Disassembly:
cmp dword [0x41337c], 0
push edi
mov edi, 0x412ed0
je 0x401f66
cmp dword [0x4131dc], 0
jne 0x401f5a
movsx eax, byte [0x412ed0]
push esi
push eax
call fcn.00405dd0
sub eax, 0x40
push eax
call fcn.00405d79
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, 0x4100c0
push esi
push dword [0x41337c]
call fcn.004062c6
pop ecx
pop ecx
test eax, eax
je 0x401f59
push eax
call fcn.00402031
push esi
push 0
call fcn.004062c6
add esp, 0xc
jmp 0x401f42
pop esi
push dword [0x41337c]
call fcn.004062bb
pop ecx
cmp dword [0x410030], 0
jne 0x401f76
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 1
pop eax
pop edi
ret

Function at 0x402031
Capabilities:
Delete file

Disassembly:
push esi
push 0x4102d0
push dword [esp + 0xc]
call fcn.004064e2
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x40207a
push esi
call fcn.0040c064
push eax
call fcn.0040bfec
pop ecx
test eax, eax
pop ecx
jle 0x402073
push edi
mov edi, eax
push esi
push 1
push 1
push 0x4102cc
call fcn.004063b8
add esp, 0x10
dec edi
jne 0x40205d
pop edi
push esi
call fcn.00406362
pop ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret
Function at 0x4038cd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4038db
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x4039bc
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x40e524]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40e524]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40e524]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40e524]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40e524]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40e524]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40e524]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x40e524]
xor eax, esi
inc edx
dec edi
jne 0x4038f8
pop ebx
cmp dword [ebp + 0x10], 0
je 0x4039dd
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40e524]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x4039c2
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x4041bf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4041f3
lea eax, [ebp + 8]
push 0
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4041ee
mov byte [esi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x40421b
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x404204
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00405a00
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
pop edi
div dword [ebp + 0xc]
pop esi
pop ebp
ret
Function at 0x404e66
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x404edf
cmp dword [esi + 4], 0xffffffff
jne 0x404edf
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x410154
push edi
call fcn.004058a0
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x404eb4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x404eb4
mov eax, 0x2000000
jmp 0x404ee4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403fcb
add esp, 0x10
test eax, eax
jne 0x404ed2
mov eax, dword [ebp - 4]
jmp 0x404ee4
push eax
call fcn.00404412
mov dword [esi], eax
pop ecx
xor eax, eax
jmp 0x404ee4
mov eax, 0x1000000
pop esi
leave
ret 0xc

Function at 0x405226
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4052bd
mov cl, byte [eax]
test cl, cl
je 0x4052bd
push esi
push edi
mov edi, eax
mov edx, eax
cmp cl, 0x2f
je 0x405250
cmp cl, 0x5c
jne 0x405252
mov edi, edx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x405246
cmp edi, eax
mov esi, edi
je 0x40528d
sub esi, eax
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.004067ba
and byte [ebp + esi - 0x104], 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00405226
add esp, 0x14
lea esi, [edi + 1]
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.00405890
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.004058a0
add esp, 0x10
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
leave
ret
Function at 0x405d35
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405d55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00406d7e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x405d76
test byte [esp + 8], 2
je 0x405d76
mov dword [0x41338c], 0xd
mov dword [0x413390], 5
jmp 0x405d51
xor eax, eax
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x50a333]
shl eax, 2
mov dword [0x50a337], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004fe644
pop edx
call fcn.004fd9e0
call fcn.004fe648
push 0
call fcn.004ff3f0
pop ecx
push 0x50a2dc
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x50a33b], eax
push 0
jmp fcn.0050640c

Function at 0x408bbc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
mov cl, al
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
movzx ecx, ax
sar ecx, 8
and ecx, 0xff
mov dword [ebp - 0x14], ecx
movzx ecx, dx
shr eax, 0x10
and eax, 0xff
mov dword [ebp - 0x18], eax
xor eax, eax
mov al, dl
mov dword [ebp - 0x1c], eax
xor eax, eax
sar ecx, 8
shr edx, 0x10
mov al, cl
mov dword [ebp - 0x20], eax
and edx, 0xff
mov dword [ebp - 0x24], edx
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
push esi
push ebx
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
cmp esi, ebx
jl 0x408c4c
mov esi, ebx
sar esi, 1
jns 0x408c53
adc esi, 0
mov dword [ebp - 0x38], esi
fild dword [ebp - 0x38]
add esp, 0xfffffff8
fstp qword [esp]
call fcn.00502bb0
add esp, 8
call fcn.00502fb4
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jle 0x408d0d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x10]
imul ebx
cdq
idiv esi
mov ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x14]
add cl, byte [ebp - 0x10]
imul ebx
cdq
idiv esi
add al, byte [ebp - 0x14]
and ecx, 0xff
and eax, 0xff
movzx edx, ax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x18]
shl edx, 8
or ecx, edx
imul ebx
cdq
idiv esi
add al, byte [ebp - 0x18]
and eax, 0xff
shl eax, 0x10
or ecx, eax
push ecx
call sub.GDI32.DLL_CreateSolidBrush
mov edi, eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
push edi
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.USER32.DLL_FillRect
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
push edx
call sub.GDI32.DLL_SelectObject
push edi
call sub.GDI32.DLL_DeleteObject
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
push ecx
call sub.USER32.DLL_InflateRect
inc ebx
cmp esi, ebx
jg 0x408c78
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_CreatePatternBrush
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov edx, dword [ebp - 8]
push edx
call sub.GDI32.DLL_DeleteObject
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4104b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
push 0
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov ebx, eax
test ebx, ebx
je 0x410516
test esi, esi
je 0x4104de
push esi
call fcn.00410590
pop ecx
inc eax
add ebx, eax
push ebx
call fcn.004aa5dc
pop ecx
mov edi, eax
push ebx
push edi
call sub.KERNEL32.DLL_GetSystemDirectoryA
test esi, esi
je 0x410510
mov eax, ebx
dec eax
push eax
push 0x59672d
push edi
call fcn.00410554
add esp, 0xc
dec ebx
push ebx
push esi
push edi
call fcn.00410554
add esp, 0xc
mov eax, edi
jmp 0x41051d
push esi
call fcn.00410524
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4105fc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, eax
and eax, 0xff
and edi, 0xff00
mov dword [ebp - 8], eax
shr edi, 8
mov byte [ebx], 0
mov eax, edi
mov esi, edi
mov edx, edi
and esi, 4
and edx, 1
and eax, 2
test eax, eax
mov dword [ebp - 4], edx
je 0x41063e
mov eax, str.Ctrl_
jmp 0x410643
mov eax, 0x596737
push eax
push ebx
call fcn.004fe780
add esp, 8
cmp dword [ebp - 4], 0
je 0x41065a
mov edx, str.Shift_
jmp 0x41065f
mov edx, 0x596737
push edx
push ebx
call fcn.004fe780
add esp, 8
test esi, esi
je 0x410674
mov eax, str.Alt_
jmp 0x410679
mov eax, 0x596737
push eax
push ebx
call fcn.004fe780
add esp, 8
push 0
mov edx, dword [ebp - 8]
push edx
call sub.USER32.DLL_MapVirtualKeyA
test edi, 8
mov esi, eax
je 0x4106a3
shl esi, 0x10
or esi, 0x3000000
jmp 0x4106ac
shl esi, 0x10
or esi, 0x2000000
push 0x64
push ebx
call fcn.004fe810
pop ecx
add ebx, eax
push ebx
push esi
call sub.USER32.DLL_GetKeyNameTextA
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x410ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test eax, eax
je 0x410ae8
test ebx, ebx
jne 0x410aec
xor eax, eax
jmp 0x410b55
push eax
call fcn.004f607c
pop ecx
mov edi, eax
push ebx
call fcn.004f607c
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
push edi
call fcn.004aa6ac
pop ecx
mov eax, dword [ebp - 4]
push eax
call fcn.004aa6ac
pop ecx
test ebx, ebx
jne 0x410b25
xor eax, eax
jmp 0x410b55
push ebx
push esi
call sub.KERNEL32.DLL_SizeofResource
mov edi, eax
push ebx
push esi
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x410b3d
xor eax, eax
jmp 0x410b55
push eax
call sub.KERNEL32.DLL_LockResource
test eax, eax
jne 0x410b4b
xor eax, eax
jmp 0x410b55
push edi
push eax
call fcn.00410b5c
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret