joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f4c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x58f892
call fcn.0056a01f
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.00439ddd
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x49f522
call fcn.00439ddd
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x49f536
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x49f532
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x49f53e
or eax, 0xffffffff
jmp 0x49f690
mov ecx, edi
call fcn.0049fac7
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.00412e2d
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x49f5ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x49f5ca
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x49f5ca
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.00404300
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x49f5c7
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x5999dc]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x49f5c7
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0041afa4
test eax, eax
je 0x49f5c7
push 0
mov ecx, esi
call fcn.0041ad5a
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.00412ab0
push ebx
call fcn.0041425f
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0049f466
test eax, eax
jne 0x49f613
cmp dword [edi + 0x9c], eax
jne 0x49f613
call fcn.00439ddd
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0041425f
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0049f466
and dword [edi + 0x9c], 0
jmp 0x49f63e
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x49f652
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0041ad5a
test esi, esi
je 0x49f65f
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x49f675
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x49f675
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x5999dc]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0049fa7e
mov eax, dword [edi + 0x68]
call fcn.00569f84
ret
Function at 0x4a1c0f
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.005731a3
pop ecx
test eax, eax
jne 0x4a1c51
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x5a8dd0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0041219d
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a1c17
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x4a1de0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 1
mov eax, dword [esi]
push 1
mov edi, dword [eax + 0xe0]
mov ecx, edi
je 0x4a1e1b
push 0
call dword [0x5999dc]
mov ecx, esi
call edi
test eax, eax
je 0x4a1e17
xor eax, eax
inc eax
jmp 0x4a1e2e
xor eax, eax
jmp 0x4a1e2e
push dword [esi + 0x24]
call dword [0x5999dc]
mov ecx, esi
call edi
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
leave
ret
Function at 0x4c0bbd
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], ecx
inc eax
inc ebx
mov dword [ebp - 4], eax
cmp dword [edi + 8], ebx
jle 0x4c0c34
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4c0bfa
mov eax, dword [ecx + 0x10]
cmp dword [eax + ebx*8 + 4], edx
je 0x4c0bfa
mov eax, dword [edi + 0xc]
cmp dword [eax + ebx*4], 0
je 0x4c0c27
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4c0c2a
mov eax, dword [edi + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4c0c20
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x5999dc]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
and dword [eax + ebx*4], 0
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, dword [edi + 8]
jl 0x4c0bdd
test eax, eax
je 0x4c0c7b
lea esi, [ecx + 0x1c]
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
push edi
add ecx, 0x14
call fcn.004c0eac
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x5999dc]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4c0eff
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x590c71
call fcn.0056a01f
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x4c0ff6
cmp edi, dword [ebx + 0xc]
jge 0x4c0ff6
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x4c0f56
cmp edi, dword [esi + 8]
jl 0x4c0fe4
cmp dword [ebp + 0xc], 0
je 0x4c0fe4
xor edi, edi
jmp 0x4c0f88
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.004c09bc
mov esi, eax
test esi, esi
je 0x4c0f70
mov dword [esi], vtable.CThreadData.0
jmp 0x4c0f72
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.0041b471
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x4c0fa4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x4c0fb0
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x4c101d
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.0056bb70
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4c0ff6
cmp edi, dword [esi + 8]
jge 0x4c0ff6
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00569f84
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0044a0e8
int3

Function at 0x4c5c8c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x4c5ce2
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4c5cbb
call fcn.00448756
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4c5cd0
call fcn.00448756
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4c5ce2
call fcn.00448756
call fcn.00439ddd
cmp dword [eax + 0x3c], 0
je 0x4c5cf7
push esi
mov ecx, ebx
call fcn.004c53b2
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.004c5edd
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4c5d20
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4c5d2c
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4c759c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
push 1
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4c75c9
or dword [esi + 0x3c], 1
or dword [esi + 0x38], 2
jmp 0x4c75de
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4c75de
or dword [esi + 0x3c], 2
or dword [esi + 0x38], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 4], edx
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0041425f
jmp 0x4c76af
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0041425f
cmp eax, edi
jne 0x4c76b9
push 1
push 0x209
push 0x200
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x4c764b
push 1
push 0x109
push 0x100
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4c768f
mov eax, dword [ebp - 0x1c]
cmp eax, 0x202
je 0x4c76b9
cmp eax, 0x205
je 0x4c76b9
cmp eax, 0x201
je 0x4c76b9
cmp eax, 0x204
je 0x4c76b9
cmp eax, 0x100
jne 0x4c7677
cmp dword [ebp - 0x18], 0x1b
je 0x4c76b9
push dword [ebp - 8]
lea eax, [esi + 0x24]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, ebx
sbb edx, dword [ebp - 4]
test edx, edx
jb 0x4c76af
ja 0x4c76a8
cmp eax, dword [0x5fcbe4]
jbe 0x4c76af
mov dword [esi + 0x34], 1
cmp dword [esi + 0x34], 0
je 0x4c7600
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x34]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4c86b2
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [ecx + 0x14]
cmp dword [esi - 0xc], 0
je 0x4c86e8
push ebx
mov ebx, dword [ecx + 8]
push edi
mov edi, dword [ecx + 0xc]
call fcn.00404300
test eax, eax
je 0x4c86d0
mov eax, dword [eax + 0x20]
push 1
push edi
push ebx
push esi
push 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
pop edi
sbb eax, eax
pop ebx
inc eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4e081d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4e0847
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4e084d
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.004041a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0053b1f9
int3

Function at 0x4e08fa
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x4e0941
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4e0950
push str.MoveFileTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4e0950
push dword [esi]
mov ecx, edi
push 2
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x5999dc]
call edi
jmp 0x4e0952
cmp dword [esi + 4], ebx
je 0x4e0950
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4e0b87
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x4e0b98
xor eax, eax
jmp 0x4e0bb4
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e0bb9
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.004041a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0053b1f9
int3

Function at 0x4e0c94
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x5999dc]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4e0cc7
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.004041a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0053b1f9
int3

Function at 0x4e0da0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x4e0dcb
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4e0dd1
cmp dword [ebp - 4], esi
jne 0x4e0de8
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.004041a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0053b1f9
lea ecx, [edi + 0xc]
call fcn.004041a0
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0053ae4f
int3
Function at 0x4fd249
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x587e6a
call fcn.00569fb6
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040a2e0
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x4fd2a7
call fcn.00439e2b
cmp eax, 1
jne 0x4fd2a7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.00470426
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040a8fc
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00403db0
inc esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00403db0
mov eax, esi
call fcn.00569f84
ret 0x10

Function at 0x4fd2ce
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x587e6a
call fcn.00569fb6
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040a2e0
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x4fd32c
call fcn.00439e2b
cmp eax, 1
jne 0x4fd32c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.00470426
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040a8fc
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00403db0
inc esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00403db0
mov eax, esi
call fcn.00569f84
ret 0x14
Function at 0x53b841
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5f4ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x230
xor edi, edi
push edi
push esi
call fcn.0056bb70
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.00570e46
push eax
call fcn.00403800
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x5b2ad8]
je 0x53b99f
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x53b9b3
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x53b9b3
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
je 0x53b8fd
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x53b8f1
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.0053b48f
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
jmp 0x53b8f8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x53b8ff
mov eax, edi
mov ecx, esi
mov dword [ecx + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.0053bb4f
test eax, eax
je 0x53b926
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.0053b217
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x53b92a
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.0053bb4f
test eax, eax
je 0x53b951
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.0053b217
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x53b955
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.0053bb4f
test eax, eax
je 0x53b97d
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.0053b217
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x53b97f
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x53b991
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x53b99f
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00569b0f
leave
ret 4
xor eax, eax
jmp 0x53b9a2
Function at 0x544b74
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0041ae02
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x544bb0
call fcn.00544d91
mov dword [esi + 0xc], 1
jmp 0x544bb5
call fcn.00544d91
cmp dword [esi], 0
je 0x544c00
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x544bdb
push edi
call fcn.004142ad
lea ecx, [edi + 1]
push ecx
jmp 0x544bea
push 0xff
call fcn.00403f30
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004113b4
pop edi
jmp 0x544c24
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x544c24
push dword [esi]
push dword [ebp - 4]
call fcn.004c1284
pop esi
leave
ret 0xc

Function at 0x544ce8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00544d91
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x544d30
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004142ad
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004113b4
jmp 0x544d3b
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004c1284
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x54816a
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x5482b0
mov ecx, 0x5f4c04
call fcn.004c0d57
mov esi, eax
test esi, esi
je 0x5482a5
xor eax, eax
cmp word [esi + 8], ax
jne 0x54826f
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x54822b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [ebp + 0x10]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x5481f1
push 0x5c2040
call fcn.005482ee
pop ecx
test eax, eax
je 0x5481f1
mov eax, edi
neg eax
push 0xfc11
sbb eax, eax
and eax, 0xe
add eax, 0x3ee
push eax
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x54820c
neg edi
push 5
sbb edi, edi
and edi, 0xe
add edi, 0x3ee
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x54822b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x548231
push ebx
push edi
push eax
call fcn.0053aa32
add esp, 0xc
jmp 0x548231
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 2
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.0041b471
pop ecx
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
mov dword [esi + 4], ecx
test ecx, ecx
je 0x5482aa
mov eax, dword [edi]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push ecx
call fcn.004e1004
mov ax, word [ebx]
add esp, 0xc
mov word [esi + 8], ax
xor eax, eax
jmp 0x548272
mov ebx, dword [ebp + 0xc]
mov edi, dword [esi + 4]
test edi, edi
je 0x548280
push edi
call fcn.00570a94
pop ecx
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.00403b10
movzx ecx, word [esi + 8]
mov edx, 0xffff
xor eax, eax
mov word [ebx], cx
pop edi
cmp cx, dx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
call fcn.0044a0ce
call fcn.0044a0e8
int3
Function at 0x55664e
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 8
mov eax, 0x58a9ad
call fcn.00569fb6
mov edi, ecx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x100
jne 0x55673a
mov esi, dword [ebx + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x55673a
cmp esi, 0x43
je 0x556690
cmp esi, 0x2d
jne 0x55673a
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x55673a
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x10]
call fcn.004036d0
movzx eax, byte [edi + 0xe6]
and dword [ebp - 4], 0
push eax
movzx eax, byte [edi + 0xe5]
push eax
movzx eax, byte [edi + 0xe4]
push eax
lea eax, [ebp - 0x10]
push 0x5c6da8
push eax
call fcn.00404180
mov esi, dword [ebp - 0x10]
add esp, 0x14
lea eax, [esi - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 4]
lea eax, [eax*2 + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x556728
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x556728
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
call fcn.00403db0
push ebx
mov ecx, edi
call fcn.0049ee99
call fcn.00569f84
ret 4