joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413630
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45c107
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x474cb0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov dword [esi], vtable.CBuffer.0
mov byte [esi + 4], al
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
mov edi, 1
push eax
mov dword [esp + 0x20], edi
call fcn.004013e0
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], edi
mov ebx, dword [esp + 0x30]
push ecx
call fcn.004134a0
lea edi, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.004058c0
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x2c], 1
call fcn.004014e0
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0040eac0
add esp, 8
mov byte [esp + 0x28], 3
mov edi, dword [eax]
mov ebp, dword [edi - 0xc]
test edi, edi
je 0x413705
test ebp, ebp
jle 0x413705
mov ebx, dword [esi + 0xc]
push 1
lea edx, [ebx + ebp*2]
push edx
call fcn.00412c60
test al, al
je 0x413705
mov eax, dword [esi + 8]
push ebp
add eax, ebx
push edi
push eax
call fcn.004479a0
add esp, 0xc
add ebx, ebp
mov dword [esi + 0xc], ebx
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x2c], 1
call fcn.004014e0
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x2c], 0
call fcn.004014e0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8

Function at 0x413a20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x474cb0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x21c]
push esi
push edi
mov esi, edx
test ecx, ecx
jne 0x413a49
xor eax, eax
jmp 0x413a5f
mov eax, ecx
lea edi, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x413a50
sub eax, edi
sar eax, 1
mov ebx, eax
push ecx
lea eax, [ebp + 0xa8]
call fcn.004059b0
test esi, esi
je 0x413a86
cmp word [esi], 0
je 0x413a86
lea edi, [ebp + 0xa4]
mov edx, esi
call fcn.00405530
jmp 0x413ac0
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edi, [ebp + 0xa4]
call fcn.0044b4ff
cdq
xor eax, edx
sub eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0x18]
push ecx
push str._smgy__u_u.tmp
call fcn.004017f0
add esp, 0x10
mov eax, dword [edi]
xor esi, esi
push esi
push 0x80
push 4
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0xa0], eax
cmp eax, 0xffffffff
je 0x413af4
cmp eax, esi
je 0x413af4
mov dword [ebp + 0xac], esi
lea eax, [esi + 1]
jmp 0x413b18
mov dword [ebp + 0xa0], esi
lea esi, [ebp + 0xa8]
call fcn.004015c0
mov esi, edi
call fcn.004015c0
mov dword [ebp + 0xac], 0
xor eax, eax
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004462cb
add esp, 0x210
ret 4
Function at 0x413d40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b2b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x474cb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
lea ebx, [edi + 0xd4]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xbc]
xor esi, esi
cmp eax, esi
je 0x413d92
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [edi + 0xbc], esi
mov eax, dword [edi + 0xc0]
cmp eax, esi
je 0x413da9
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [edi + 0xc0], esi
mov eax, dword [edi + 0xc4]
cmp eax, esi
je 0x413dc0
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [edi + 0xc4], esi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0xb0], esi
jne 0x413e15
mov dword [ebp - 4], esi
mov eax, dword [edi]
push 4
mov ecx, edi
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 4], 0xffffffff
jmp 0x413df8
xor esi, esi
mov dword [edi + 4], esi
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xa0]
cmp eax, esi
je 0x413e82
mov dword [edi + 0xb0], esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xa0], esi
lea esi, [edi + 0xa4]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x413e60
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004015c0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x413df6
mov edx, dword [ecx]
push 4
push edi
mov eax, dword [edx + 0xc]
call eax
jmp 0x413df6
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x413df8
Function at 0x413fe0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x45c0a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x474cb0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov eax, dword [esi + 0x38]
cmp eax, 0xc8
je 0x414023
cmp eax, 0xce
jne 0x4140cf
lea edi, [esi + 0xd4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0xa0]
cmp eax, ebx
je 0x4140ed
mov edx, dword [esp + 0x34]
push ebx
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push ecx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4140a7
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x34]
jne 0x4140a7
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x18], ebx
je 0x414149
sub esp, 0x10
mov eax, esp
lea edi, [esp + 0x38]
mov dword [esp + 0x24], esp
mov dword [eax], vtable.CBuffer.0
mov byte [eax + 4], bl
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call fcn.00412d90
mov ecx, dword [esi + 0x18]
mov eax, dword [ecx]
mov edx, dword [eax]
push esi
call edx
jmp 0x414149
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push eax
mov ecx, str.failed_to_fwrite
call fcn.00405480
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
push esi
call fcn.00413d40
lea ecx, [esp + 0x28]
call fcn.00412c10
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov ecx, dword [esi + 0x8c]
cmp ecx, ebx
jne 0x4140fd
lea ecx, [esi + 0x90]
lea eax, [esp + 0x28]
call fcn.00412d40
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x18], ebx
je 0x414149
mov edi, dword [esi + 0x8c]
cmp edi, ebx
jne 0x414122
lea edi, [esi + 0x90]
sub esp, 0x10
mov eax, esp
mov dword [esp + 0x24], esp
mov dword [eax], vtable.CBuffer.0
mov byte [eax + 4], bl
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call fcn.00412d90
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
mov eax, dword [edx]
push esi
call eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x28], vtable.CBuffer.0
cmp eax, ebx
je 0x414167
cmp dword [eax - 4], ebx
jle 0x414167
dec dword [eax - 4]
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
cmp eax, ebx
je 0x41417b
add eax, 0xfffffff8
push eax
call fcn.004470dc
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
Function at 0x41b0b5
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x41b0cb
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x41b0d7
or edi, 1
push 1
call esi
test ax, ax
jge 0x41b0e3
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x41b0ef
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x41b0fb
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x41cc3f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x41cc64
cmp ebx, dword [esi + 0x54]
je 0x41cc64
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x54]
cmp ebx, eax
je 0x41cd26
push edi
test eax, eax
je 0x41ccb7
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x54]
mov ecx, esi
call fcn.0041c752
mov dword [esi + 0x54], edi
test ebx, ebx
je 0x41cd25
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x41cd25
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc0]
test al, al
je 0x41cd25
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xcc]
test al, al
je 0x41cd25
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x54], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x54]
mov ecx, esi
call fcn.0041c752
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41cf23
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xd0]
mov ecx, edi
xor ebx, ebx
call fcn.004292a5
test eax, eax
jle 0x41cf72
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call fcn.0041a7e1
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x41cfd3
mov ecx, edi
inc ebx
call fcn.004292a5
cmp ebx, eax
jl 0x41cf41
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x41d02c
sub eax, 4
je 0x41cfd7
dec eax
dec eax
jne 0x41d023
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.004486a6
pop ecx
mov ecx, dword [esi + 0x50]
push inet_addr
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x41c17b
call dword [eax + 0xf4]
mov esi, eax
test esi, esi
je 0x41d023
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xe8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x41d025
cmp dword [esi + 0x54], 0
je 0x41d023
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.0041b0b5
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x41d023
cmp dword [esi + 0x54], 0
je 0x41d07b
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc0]
test al, al
je 0x41d07b
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xcc]
test al, al
je 0x41d07b
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.0044732b
pop ecx
pop ecx
test eax, eax
je 0x41d07b
mov ecx, dword [esi + 0x54]
call fcn.0042e74f
test al, al
jne 0x41d023
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx eax, al
push eax
mov ecx, esi
call fcn.0041cdd7
jmp 0x41cfd3
Function at 0x420b33
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
sub esp, 0x2b4
lea ebp, [esp - 4]
mov eax, dword [0x474cb0]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push 0xc
mov eax, 0x459e07
call fcn.004484ce
mov edi, dword [ebp + 0x2c0]
mov ebx, ecx
call fcn.0042011c
call fcn.0041b251
push eax
lea ecx, [ebp + 0x230]
call fcn.0041ab36
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0041b257
mov ecx, eax
call fcn.0041a937
test al, al
je 0x420c95
push edi
lea ecx, [ebp + 0x230]
call fcn.0041a9bc
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea ecx, [ebp + 0x230]
call fcn.0041a962
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
push esi
cmp eax, 0xffffffff
jne 0x420c09
push str.Error_opening_file
mov ecx, ebx
call fcn.004202f2
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x230]
call fcn.0041a812
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.004462cb
add ebp, 0x2b8
leave
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
jne 0x420c1e
push esi
push str.File_is_empty
jmp 0x420bca
cmp edi, 0x400000
jbe 0x420c2e
push esi
push str.File_too_large
jmp 0x420bca
push edi
mov dword [ebp - 0x14], esi
call fcn.00446245
pop ecx
push esi
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], edi
je 0x420c74
push dword [ebp - 0x10]
call fcn.004470dc
pop ecx
mov ecx, ebx
call fcn.0042011c
push esi
push str.Could_not_read_file
jmp 0x420bca
push dword [ebp + 0x2c4]
mov ecx, ebx
push edi
push dword [ebp - 0x10]
call fcn.004209e2
push dword [ebp - 0x10]
mov bl, al
call fcn.004470dc
pop ecx
jmp 0x420bd3
call fcn.0041b257
push eax
lea ecx, [ebp + 0x230]
call fcn.0041a9a2
call fcn.0041b25d
test al, al
je 0x420cb6
call fcn.0041b263
jmp 0x420ccd
push 2
push esi
lea ecx, [ebp + 0x230]
call fcn.0041a962
push eax
call fcn.00429169
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, esi
jne 0x420cdf
push esi
push str.Error_opening_zip_file
jmp 0x420bca
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push edi
push dword [ebp - 0x10]
call fcn.00427867
add esp, 0x14
test eax, eax
je 0x420d04
push esi
push str.Could_not_find_ziped_file
jmp 0x420bca
mov eax, dword [ebp + 0x22c]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x420c16
cmp eax, 0x400000
ja 0x420c26
push eax
call fcn.00446245
push 3
push dword [ebp - 0x14]
mov edi, eax
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.004291c6
add esp, 0x18
cmp eax, esi
je 0x420d6b
cmp eax, 0x600
je 0x420d6b
push edi
call fcn.004470dc
pop ecx
call fcn.0041b25d
test al, al
jne 0x420d60
push dword [ebp - 0x10]
call fcn.00429200
pop ecx
push esi
push str.Could_not_unzip_file
jmp 0x420bca
call fcn.0041b25d
test al, al
jne 0x420d7d
push dword [ebp - 0x10]
call fcn.00429200
pop ecx
push dword [ebp + 0x2c4]
mov ecx, ebx
push dword [ebp - 0x14]
push edi
call fcn.004209e2
push edi
jmp 0x420c88
Function at 0x426440
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x42644b
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x426506
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x462180]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x462180]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x462180]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x462180]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x462180]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x462180]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x462180]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x462180]
inc edx
sub edi, 8
dec esi
jne 0x42646b
pop ebx
test edi, edi
je 0x42651f
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x462180]
inc edx
dec edi
jne 0x42650a
pop edi
not eax
pop esi
ret

Function at 0x4269b6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4269ea
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4269e5
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x426a12
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4269fb
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.004479a0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4277af
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x474cb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x427859
movzx ecx, word [esi]
test cx, cx
je 0x427859
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x4277ed
cmp cx, 0x5c
jne 0x4277ef
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x4277e1
cmp eax, esi
je 0x42782d
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00447d6c
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004277af
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00447d4d
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00447d1f
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004462cb
leave
ret
Function at 0x428d8a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x428e05
cmp dword [esi + 4], 0xffffffff
jne 0x428e05
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x469fb4
push edi
call fcn.00447d1f
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x428dd7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x428dd7
mov eax, 0x2000000
jmp 0x428e0a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004267cc
add esp, 0x10
test eax, eax
jne 0x428df5
mov eax, dword [ebp + 0x10]
jmp 0x428e0a
push eax
call fcn.00428986
mov dword [esi], eax
mov eax, dword [0x47663c]
pop ecx
jmp 0x428e0a
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x42e90d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x438], ebx
je 0x42e975
cmp dword [ebp + 8], 0x100
jne 0x42e964
cmp word [ebp + 0xc], 0xd
jne 0x42e964
cmp byte [esi + 0x43e], bl
je 0x42e94b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x42e964
cmp byte [esi + 0x43f], bl
jne 0x42e964
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x42e960
push ebx
push ebx
push ebx
push 0x462b80
push esi
call fcn.0041c752
xor eax, eax
jmp 0x42e978
mov eax, dword [esi + 0x438]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x436bcf
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x474cb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x436c40
cmp dword [esi + 0x10], ebx
je 0x436c40
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.00447e50
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x436c40
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x134
call fcn.0041a98e
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0041c752
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004462cb
leave
ret 0x10
Function at 0x441fa9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x441fce
cmp eax, edi
jge 0x441fc6
mov eax, esi
call fcn.0044195d
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x441ff0
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x441fd5
cmp ecx, 4
jge 0x44200f
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x441ffd
xor eax, eax
jmp 0x442005
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x441ff3
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x442041
mov eax, str.zlib_corrupt
call fcn.0043f57a
jmp 0x44207c
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x442051
mov eax, str.read_past_buffer
jmp 0x44203a
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x442066
mov ecx, edi
call fcn.00441988
test eax, eax
je 0x44207c
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004479a0
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x4462cb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474cb0]
jne 0x4462d5
repz ret
jmp fcn.0044bad2