joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4fd43c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x505b60], ecx
inc eax
cmp eax, 0x100
jb 0x44f295
cmp eax, 0x800
jae 0x44f363
nop dword [eax]
mov edx, dword [eax*4 + 0x505760]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x505b60]
mov dword [eax*4 + 0x505b60], edx
inc eax
cmp eax, 0x800
jb 0x44f340
lea ecx, [ebp - 0x24]
mov dword [0x505b54], 0x451040
call fcn.00451220
test eax, eax
je 0x44f43f
mov ecx, dword [ebp - 0x14]
mov edx, ecx
shr edx, 8
mov eax, ecx
mov edi, edx
and eax, 0xf00
and edi, 0xff000
and edx, 0xf00
and ecx, 0xf0
or edi, eax
or edx, ecx
shr edi, 8
shr edx, 4
xor ecx, ecx
mov eax, 0x4eccbc
xor esi, esi
mov ebx, dword [ebp - 0x20]
cmp dword [eax - 8], ebx
jne 0x44f3ca
mov ebx, dword [ebp - 0x1c]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp - 0x18]
jne 0x44f3ca
cmp dword [eax], ebx
je 0x44f3e7
add esi, 0xc
inc ecx
add eax, 0xc
cmp esi, 0x24
jb 0x44f3b3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a186f
mov esp, ebp
pop ebp
ret
sub ecx, 0
je 0x44f415
sub ecx, 1
je 0x44f404
sub ecx, 1
jne 0x44f43f
cmp edi, 6
jb 0x44f43f
jne 0x44f435
cmp edx, 0xf
jb 0x44f43f
jmp 0x44f435
cmp edi, 5
jb 0x44f43f
jne 0x44f435
cmp edx, 6
jb 0x44f43f
cmp edx, 0xa
jmp 0x44f433
cmp edi, 6
jb 0x44f43f
jne 0x44f435
cmp edx, 0x1c
je 0x44f43f
cmp edx, 0x26
je 0x44f43f
cmp edx, 0x27
je 0x44f43f
cmp edx, 0x35
je 0x44f43f
cmp edx, 0x36
je 0x44f43f
mov dword [0x505b54], 0x4510e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a186f
mov esp, ebp
pop ebp
ret
Function at 0x454140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x454162
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
push ebx
lea ebx, [edx - 4]
add ebx, ecx
mov dword [ebp - 8], ebx
nop
lea eax, [edi + ecx]
cmp eax, ebx
jae 0x454189
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x454186
inc eax
cmp eax, ebx
jb 0x454177
mov ecx, dword [ebp - 4]
mov edx, eax
sub edx, edi
mov edi, eax
sub edx, ecx
sub edi, ecx
cmp eax, ebx
jae 0x45427f
cmp edx, 2
jbe 0x454231
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x454268
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, edi
sub ebx, ecx
test esi, esi
je 0x454201
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x4541ff
mov edx, 0x100
shl edx, cl
mov ecx, dword [ebp + 8]
dec edx
xor ebx, edx
add ecx, edi
sub ebx, ecx
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov ecx, dword [ebp - 4]
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp - 8]
add edi, eax
jmp 0x454170
mov ecx, edx
shr esi, cl
test esi, esi
je 0x4541a6
cmp esi, 4
ja 0x45425a
cmp esi, 3
je 0x45425a
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x4541a6
mov ecx, dword [ebp - 4]
or esi, 8
shr esi, 1
inc edi
jmp 0x454170
mov ebx, dword [ebp - 8]
or esi, 8
mov ecx, dword [ebp - 4]
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x454170
mov eax, dword [ebp + 0xc]
mov ecx, edx
shr esi, cl
xor ecx, ecx
cmp edx, 2
pop ebx
cmovbe ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x456920
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9b2d
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x4fd43c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a0], ebx
call fcn.00456b70
mov esi, eax
cmp word [edi], bx
je 0x456979
cmp word [edi + 2], 0x3a
jne 0x456979
mov eax, edi
jmp 0x4569b0
mov ecx, esi
call fcn.0045d5c0
test al, al
jne 0x456a87
push edi
lea eax, [ebp - 0x19c]
mov ecx, esi
push eax
call fcn.0045ce10
mov ebx, 1
mov dword [ebp - 4], 0
mov ecx, eax
mov dword [ebp - 0x1a0], ebx
call fcn.0040bfc0
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x118]
call fcn.0045cbd0
mov dword [ebp - 4], 2
test bl, 1
je 0x4569d5
lea ecx, [ebp - 0x19c]
call fcn.0045ccc0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x118]
call fcn.0040bfc0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x456a75
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x456a75
push esi
mov dword [ebp - 0x1a4], 0
call fcn.004a1c49
add esp, 4
mov dword [ebp - 0x1a0], eax
lea ecx, [ebp - 0x1a4]
push 0
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1a4], esi
jne 0x456a67
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x118]
mov dword [eax], esi
call fcn.0045ccc0
mov eax, dword [ebp - 0x1a0]
jmp 0x456b3a
push dword [ebp - 0x1a0]
call fcn.004a1c44
add esp, 4
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
call fcn.0045ccc0
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x94]
call fcn.0045cbd0
push 0x4ce920
push 0x4e8020
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 3
call fcn.0045d7f0
lea eax, [ebp - 0x94]
mov ecx, 0x502d1c
push eax
lea eax, [ebp - 0x1b4]
push eax
call fcn.00454840
mov esi, dword [ebp - 0x1ac]
cmp byte [esi + 0xd], 0
jne 0x456b21
lea ecx, [esi + 0x10]
call fcn.0040bfc0
push eax
lea ecx, [ebp - 0x94]
call fcn.0045cea0
test al, al
jne 0x456b21
cmp esi, dword [0x502d1c]
je 0x456b21
mov edi, dword [esi + 0xa4]
push edi
call fcn.004a1c49
add esi, 0x94
add esp, 4
mov ebx, eax
cmp dword [esi + 0x14], 0x10
jb 0x456b14
mov esi, dword [esi]
push edi
push esi
push ebx
call fcn.004a3690
add esp, 0xc
jmp 0x456b25
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x94]
mov dword [eax], edi
call fcn.0045ccc0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a186f
mov esp, ebp
pop ebp
ret
Function at 0x456d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4ce910
push dword [ebp + 8]
call fcn.00456b60
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x456dca
push edi
push esi
call fcn.00456b60
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x456dc9
push esi
call fcn.00456b60
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x456dc9
push 0x45c430
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.0044bd60
add esp, 0xc
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [ebp + 0xc]
call fcn.00456de0
add esp, 4
pop esi
pop ebp
ret

Function at 0x4574c0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x4574e5
or esi, 2
push 1
call edi
test ax, ax
jns 0x4574f1
or esi, 1
push 0x10
call edi
test ax, ax
jns 0x4574fd
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x457509
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x459b50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [edi + 0x354]
call fcn.0045d3f0
mov ebx, dword [ebp + 8]
test eax, eax
jle 0x459bab
nop
push esi
lea ecx, [edi + 0x354]
mov byte [ebp + 0xb], 0
call fcn.0045cdf0
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push ebx
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x459cfc
lea ecx, [edi + 0x354]
inc esi
call fcn.0045d3f0
cmp esi, eax
jl 0x459b70
sub ebx, 0x100
je 0x459c85
sub ebx, 4
je 0x459c21
sub ebx, 2
jne 0x459c7a
cmp dword [edi + 0xe0], ebx
je 0x459c7a
push dword [ebp + 0xc]
mov dword [ebp + 8], ebx
call fcn.004ab8ea
mov ecx, dword [edi + 0xe0]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x80000012
push edx
push 0x45c100
call dword [eax + 0x114]
mov esi, eax
test esi, esi
je 0x459c7a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x108]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [edi + 0xe4]
test eax, eax
je 0x459c7a
mov ecx, dword [edi + 0xf8]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [edi + 0xf4]
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
call fcn.004574c0
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x459c7a
mov ecx, dword [edi + 0xe4]
test ecx, ecx
je 0x459ce3
mov eax, dword [ecx]
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x459ce3
mov ecx, dword [edi + 0xe4]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x459ce3
mov ecx, dword [edi + 0xe4]
push str.RichEdit
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.004a33b5
add esp, 8
test eax, eax
je 0x459ce3
mov ecx, dword [edi + 0xe4]
call fcn.00473120
test al, al
jne 0x459c7a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, edi
setns al
movzx eax, al
push eax
call fcn.0045b490
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45aef0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x45af2b
mov ecx, dword [edi + 0x84]
cmp eax, ecx
je 0x45af2b
cmp esi, dword [edi + 0xe4]
je 0x45af2b
cmp byte [edi + 0xdc], 0
jne 0x45af2b
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xe4]
cmp esi, eax
je 0x45b026
test eax, eax
je 0x45af9a
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.0045aa70
mov dword [edi + 0xe4], 0
test esi, esi
je 0x45b026
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, edi
jne 0x45b026
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x45b026
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x45b026
xorps xmm0, xmm0
mov dword [edi + 0xe4], esi
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.0045aa70
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x45be30
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xfffffffffffffff0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x45bee1
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
mov ecx, 0x502b5c
mov dword [ebp - 4], ebx
call fcn.0045d3f0
sub eax, 1
mov dword [ebp + 8], eax
js 0x45bed8
push eax
mov ecx, 0x502b5c
call fcn.0045cdf0
cmp dword [ebp - 4], 0
mov edi, eax
je 0x45beca
mov ecx, edi
call fcn.00456900
cmp dword [esi], eax
je 0x45be99
mov ecx, edi
call fcn.00456900
cmp ebx, eax
jne 0x45bebd
push esi
mov ecx, edi
call fcn.0045bdd0
test al, al
jne 0x45bf65
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.00459b50
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
test ebx, ebx
jne 0x45be83
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
sub eax, 1
mov dword [ebp + 8], eax
jns 0x45be70
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x502b5c
xor edi, edi
call fcn.0045d3f0
test eax, eax
jle 0x45bed8
mov ecx, 0x502b5c
call fcn.0045d3f0
push edi
mov ecx, 0x502b5c
call fcn.0045cdf0
mov ebx, eax
mov ecx, ebx
call fcn.00456900
cmp dword [esi], eax
je 0x45bf2b
mov ecx, 0x502b5c
inc edi
call fcn.0045d3f0
cmp edi, eax
jl 0x45bef1
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ecx, ebx
call fcn.0045bdd0
test al, al
jne 0x45bf65
mov eax, dword [esi + 8]
cmp eax, 0xe5
jne 0x45bf4b
push dword [esi]
call sub.IMM32.dll_ImmGetVirtualKey
mov dword [esi + 8], eax
lea ecx, [ebp - 8]
push ecx
push dword [esi + 0xc]
mov ecx, ebx
push eax
push dword [esi + 4]
call fcn.00459b50
test al, al
je 0x45bed8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45c440
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x502d14]
mov ecx, 0x502d14
push dword [esi + 4]
push 0x502d14
call fcn.00454790
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov dword [0x502d18], 0
pop esi
pop ebp
jmp fcn.00456df0

Function at 0x45e490
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45e4d5
cmp byte [ebp + 8], 0
je 0x45e4c9
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x45eb50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9f86
mov eax, dword fs:[0]
push eax
mov eax, 0x1178
call fcn.004a22e0
mov eax, dword [0x4fd43c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xfffffffffffffff0
call fcn.0045d3f0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, edi
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.0045d3f0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x1020]
mov ecx, edi
push eax
call fcn.0045d3f0
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x1014]
mov edx, dword [ebp - 0x101c]
sub eax, edx
mov ecx, dword [ebp - 0x1020]
push 0x20
push eax
mov eax, dword [ebp - 0x1018]
sub eax, ecx
push eax
push edx
push ecx
push 0
mov ecx, edi
call fcn.0045d3f0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push dword [edi + 4]
lea ebx, [edi + 0x2c]
mov ecx, ebx
call fcn.00456c90
mov ecx, edi
lea eax, [edi + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, ebx
call fcn.00455a90
lea ecx, [ebp - 0x1180]
call fcn.00484590
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
mov dword [ebp - 4], 0
call dword [eax + 0x24]
xor edx, edx
mov byte [ebp - 4], 1
push 0
push ebx
test edi, edi
lea ecx, [edi + 0x28]
cmove ecx, edx
push ecx
push edx
push ecx
mov ecx, eax
mov esi, esp
call fcn.0040bfc0
push eax
mov ecx, esi
call fcn.0045cca0
lea ecx, [ebp - 0x1180]
call fcn.00484c40
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.0045ccc0
test esi, esi
jne 0x45ed41
push 0x800
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.004a3c10
add esp, 0xc
lea eax, [ebp - 0x810]
lea ecx, [ebp - 0x1180]
push 0x400
push eax
call fcn.00484d10
push 0x800
lea eax, [ebp - 0x1010]
push esi
push eax
call fcn.004a3c10
add esp, 0xc
lea eax, [ebp - 0x1010]
lea ecx, [ebp - 0x1180]
push 0x400
push eax
call fcn.00484d20
push str.load_resource_errr._location:
lea ecx, [ebp - 0x1038]
call fcn.00403d70
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x1038]
call fcn.00403bd0
push str._msg:
lea ecx, [ebp - 0x1038]
call fcn.00403bd0
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1038]
call fcn.00403bd0
push 0x10
push str.Duilib
lea ecx, [ebp - 0x1038]
call fcn.00403ee0
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov ecx, ebx
call fcn.00455f90
mov edx, edi
lea eax, [edi + 0x20]
neg edx
mov ecx, ebx
sbb edx, edx
and edx, eax
push edx
call fcn.00455940
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x18]
lea ecx, [ebp - 0x1180]
call fcn.004834a0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a186f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45feb0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.00456920
mov edi, eax
add esp, 8
test edi, edi
jne 0x45ff54
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45ff49
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
test eax, eax
je 0x45ff49
push eax
mov dword [ebp + 8], edi
call fcn.004a1c49
add esp, 4
mov edi, eax
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp dword [ebp + 8], eax
je 0x45ff45
push edi
call fcn.004a1c44
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
jne 0x45ff57
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push edi
mov ecx, ebx
call fcn.0045ff80
push edi
mov esi, eax
call fcn.004a1c44
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x474fc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x79c], 0
je 0x47502f
cmp dword [ebp + 8], 0x100
jne 0x47501f
cmp word [ebp + 0xc], 0xd
jne 0x47501f
cmp byte [esi + 0x7a2], 0
je 0x474ffe
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x47501f
cmp byte [esi + 0x7a3], 0
jne 0x47501f
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x475018
push 1
push 0
push 0
push 0
push str.return
push esi
call fcn.0045aa70
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x79c]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x47cd30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x47cd60
cmp eax, edi
jge 0x47cd54
push esi
call fcn.00478a70
mov eax, dword [esi + 8]
add esp, 4
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x47cd8d
mov edi, dword [esi + 0xc]
nop dword [eax]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x47cd70
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x47cda9
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x47cd9a
xor dl, dl
jmp 0x47cd9f
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x47cd90
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x47cdde
pop edi
pop esi
mov dword [ebp + 8], str.zlib_corrupt
pop ebp
jmp fcn.00478990
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x47cdf6
pop edi
pop esi
mov dword [ebp + 8], str.read_past_buffer
pop ebp
jmp fcn.00478990
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x47ce14
push edi
push ecx
push esi
call fcn.004800f0
add esp, 0xc
test eax, eax
jne 0x47ce14
pop edi
pop esi
pop ebp
ret
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004a3690
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
pop ebp
ret
Function at 0x4990b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4fd43c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x49913b
cmp dword [esi + 0x10], 0
je 0x49913b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004a22b0
mov ebx, esp
test ebx, ebx
je 0x49913b
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1e4
call fcn.0045cd80
mov ecx, dword [esi + 0x10]
push 1
push 0
push 0
mov eax, dword [ecx]
push 0
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.0045aa70
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00457040
test al, al
je 0x49913b
mov ecx, dword [esi + 0x10]
call fcn.00463550
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a186f
mov esp, ebp
pop ebp
ret 0x10

Function at 0x499cd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4fd43c]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.00465d70
mov ecx, dword [esi + 0x7e8]
test ecx, ecx
je 0x499d65
lea eax, [ebp - 0x14]
push eax
call fcn.00498420
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov esi, dword [esi + 0x7e8]
test eax, eax
je 0x499d3f
push 0
mov ecx, esi
call fcn.0045d3f0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a186f
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push 0
mov ecx, esi
call fcn.0045d3f0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004a186f
mov esp, ebp
pop ebp
ret 0x14