joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d700
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x52a046
call fcn.004e27d2
mov esi, ecx
mov dword [ebp - 0x220], esi
xor edi, edi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x224], edi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 2
push edi
push eax
call fcn.004fb430
add esp, 0xc
mov dword [ebp - 0x228], 0x104
xor ebx, ebx
mov ecx, esi
inc ebx
mov dword [ebp - 0x220], ebx
push 0x554928
call fcn.004099b0
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x21c]
push ecx
push 0xf003f
lea eax, [ebp + 8]
mov dword [ebp - 0x224], ebx
cmovae eax, dword [ebp + 8]
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42d7e8
cmp dword [ebp + 0x34], 8
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push edi
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42d7dc
lea eax, [ebp - 0x218]
push eax
call fcn.00401963
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402310
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.00402226
push edi
push ebx
lea ecx, [ebp + 0x20]
call fcn.00402226
mov eax, esi
call fcn.004e277c
ret

Function at 0x42d804
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor bl, bl
lea ecx, [ebp - 4]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor esi, esi
inc esi
test eax, eax
jne 0x42d869
cmp dword [ebp + 0x4c], 8
lea edx, [ebp + 0x38]
mov eax, dword [ebp + 0x48]
lea ecx, [ebp + 0x20]
cmovae edx, dword [ebp + 0x38]
cmp dword [ebp + 0x34], 8
cmovae ecx, dword [ebp + 0x20]
add eax, eax
push eax
push edx
push esi
push 0
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
movzx ebx, bl
cmove ebx, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push esi
lea ecx, [ebp + 8]
call fcn.00402226
push 0
push esi
lea ecx, [ebp + 0x20]
call fcn.00402226
push 0
push esi
lea ecx, [ebp + 0x38]
call fcn.00402226
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e319
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a1ad
mov eax, dword fs:[0]
push eax
mov eax, 0x402c
call fcn.004e2d90
mov eax, dword [0x578704]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x402c], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x557b61
mov dword [ebp - 0x4038], esi
mov dword [ebp - 0x4030], ebx
call fcn.00409c4d
push 0x4000
lea eax, [ebp - 0x4024]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x4030], 1
call fcn.004fb430
add esp, 0xc
mov dword [ebp - 0x4034], ebx
lea eax, [ebp - 0x4034]
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x42e441
lea ecx, [ebp - 0x4024]
push ecx
push eax
push ebx
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x42e441
lea eax, [ebp - 0x402c]
mov dword [ebp - 0x4028], ebx
push eax
lea eax, [ebp - 0x4028]
mov dword [ebp - 0x402c], ebx
push eax
push 0x559cf0
lea eax, [ebp - 0x4024]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x42e441
mov ecx, dword [ebp - 0x4028]
lea edi, [ebp - 0x23]
xor eax, eax
mov byte [ebp - 0x24], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x24]
push str._d._d._d._d
push eax
call fcn.00430a77
lea eax, [ebp - 0x24]
push eax
call fcn.00402ce5
add esp, 0x1c
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040c552
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1d28
mov esp, ebp
pop ebp
ret
Function at 0x42ecfd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x578704]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x210]
push edi
push eax
mov ebx, 0xf003f
xor edi, edi
push ebx
push edi
push str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x42ed59
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x42ed59
xor al, al
jmp 0x42ee18
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 1
push edi
push eax
call fcn.004fb430
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x214]
add esp, 0xc
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push str.CurrentBuild
push dword [ebp - 0x210]
call esi
test eax, eax
je 0x42ede7
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push str.CurrentBuildNumber
push dword [ebp - 0x210]
call esi
test eax, eax
je 0x42ede7
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42ed52
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00508b73
fstp qword [ebp - 0x21c]
cvttsd2si eax, qword [ebp - 0x21c]
pop ecx
pop ecx
cmp eax, 0x55f0
setge al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e1d28
mov esp, ebp
pop ebp
ret

Function at 0x42f540
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x578704]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
xor edi, edi
push edi
push eax
call fcn.004fb430
push esi
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.004fb430
push esi
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004fb430
push esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.004fb430
add esp, 0x30
lea eax, [ebp - 0x20c]
push 0x100
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push edi
push edi
push edi
push edi
mov ecx, 0x104
lea eax, [ebp - 0x414]
push ecx
push eax
push ecx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0050dea5
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push str._s_sts_downloader.cfg
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, dword [ebp - 4]
cmp eax, 0xffffffff
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.004e1d28
mov esp, ebp
pop ebp
ret
Function at 0x42fd6d
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0x130
mov eax, 0x52a53a
call fcn.004e27d2
mov dword [ebp - 0x130], ecx
xor ebx, ebx
lea eax, [ebp - 0x94]
push 3
push eax
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
call fcn.0044e60e
push ebx
mov dword [ebp - 4], ebx
mov edi, dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
push ebx
call edi
mov esi, eax
mov dword [ebp - 0x11c], ebx
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x13c], ebx
push eax
push esi
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
call fcn.00430a0c
mov byte [ebp - 4], 1
mov ebx, dword [ebp - 0x13c]
push ebx
push esi
call edi
xor eax, eax
cmp word [ebx], ax
je 0x42fea9
mov esi, dword [ebp - 0x124]
mov edi, dword [ebp - 0x128]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x42fe80
mov cx, word [ebx]
call fcn.0042ff2b
cmp eax, 7
je 0x42fe80
xor eax, eax
push eax
push eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x120]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
je 0x42fe80
cmp dword [ebp - 0x11c], esi
jb 0x42fe80
ja 0x42fe50
cmp dword [ebp - 0x120], edi
jbe 0x42fe80
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x11c]
push ebx
mov dword [ebp - 0x124], eax
call fcn.0044dfb7
mov esi, dword [ebp - 0x124]
mov edi, dword [ebp - 0x128]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x12c]
jne 0x42fe85
sub ecx, edx
xor eax, eax
sar ecx, 1
lea ebx, [ebx + ecx*2]
add ebx, 2
cmp word [ebx], ax
jne 0x42fe03
mov ebx, dword [ebp - 0x130]
mov ecx, ebx
call fcn.0044e477
sub eax, 3
mov ecx, ebx
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0044e9c5
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0044df98
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.0044df15
push ebx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x94]
call fcn.0044dfff
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0044df98
lea ecx, [ebp - 0x118]
call fcn.0044df15
lea ecx, [ebp - 0x13c]
call fcn.004309e4
lea ecx, [ebp - 0x94]
call fcn.0044df15
call fcn.004e277c
ret
Function at 0x42ff2b
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x578704]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x55ed5c
mov dword [ebp - 0x244], ecx
lea edi, [ebp - 0x20c]
xor ebx, ebx
push 0x1fa
lea eax, [ebp - 0x1fe]
movsd dword es:[edi], dword [esi]
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004fb430
xor eax, eax
mov dword [ebp - 0x248], ebx
lea edi, [ebp - 0x218]
add esp, 0xc
stosd dword es:[edi], eax
push 0xa
stosd dword es:[edi], eax
pop ecx
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x244]
cmp cx, 0x41
jb 0x42ff9e
cmp cx, 0x5a
jbe 0x42ffa7
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x430018
push ebx
push 0x80
push 3
push ebx
push 3
push closesocket
lea eax, [ebp - 0x20c]
mov word [ebp - 0x204], cx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x430014
push ebx
lea eax, [ebp - 0x248]
mov dword [ebp - 0x214], ebx
push eax
push 0x28
lea eax, [ebp - 0x240]
mov dword [ebp - 0x218], ebx
push eax
push 0xc
lea eax, [ebp - 0x218]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
cmovne ebx, dword [ebp - 0x224]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
jmp 0x43001a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e1d28
mov esp, ebp
pop ebp
ret

Function at 0x43002b
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x578704]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
xor edi, edi
push edi
push eax
call fcn.004fb430
push esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.004fb430
push esi
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.004fb430
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004fb430
add esp, 0x30
lea eax, [ebp - 0x414]
push 0x100
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push edi
push edi
push edi
push edi
mov ecx, 0x104
lea eax, [ebp - 0x61c]
push ecx
push eax
push ecx
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0050dea5
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push str._s_sts_downloader.cfg
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43010f
lea eax, [ebp - 0x20c]
push eax
push edi
push str.AutoRun
push str.Settings
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x430111
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e1d28
mov esp, ebp
pop ebp
ret
Function at 0x430bc9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [eax + 0x108]
cmp eax, dword [esi + 0x360]
jne 0x430c2a
mov eax, dword [esi + 0x370]
cmp eax, 8
je 0x430d0c
cmp eax, 9
je 0x430d0c
cmp eax, 0xa
je 0x430d0c
cmp eax, 7
je 0x430c10
cmp eax, 6
jne 0x430d0c
push 0
push 0
push 0xb7f
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x430d0c
cmp eax, dword [esi + 0x35c]
jne 0x430c48
push 0
push 0xf020
push 0x112
call fcn.0044f053
jmp 0x430d15
cmp eax, dword [esi + 0x364]
jne 0x430cb1
mov eax, dword [esi + 0x370]
xor edi, edi
inc edi
cmp eax, 2
je 0x430c99
cmp eax, edi
je 0x430c99
cmp eax, 8
je 0x430c7b
cmp eax, 9
je 0x430c7b
cmp eax, 0xa
je 0x430c7b
cmp eax, 7
je 0x430c81
cmp eax, 6
je 0x430c81
push edi
jmp 0x430d10
push 0
push 0
push 0xb7f
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
jmp 0x430d0e
push edi
push 0
call fcn.0044f1d3
push 0
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x430c96
cmp eax, dword [esi + 0x368]
jne 0x430d15
mov eax, dword [esi + 0x370]
cmp eax, 8
je 0x430cf1
cmp eax, 9
je 0x430cf1
cmp eax, 0xa
je 0x430cf1
cmp eax, 7
je 0x430cd8
cmp eax, 6
jne 0x430d0c
push 0
push 0
push 0xb7f
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_PostMessageW]
push 1
jmp 0x430d05
push 0
push 0
push 0x10
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_PostMessageW]
push 2
mov ecx, esi
call fcn.0044ec77
push 2
mov ecx, esi
call fcn.0044ec77
pop edi
pop esi
pop ebp
ret 4
Function at 0x434ac2
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x437e47
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.00437d96
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00504169
push edi
call fcn.00501f61
add esp, 0x10
cmp eax, 0xffffffff
jne 0x437e96
push edi
call fcn.0050df85
pop ecx
test eax, eax
je 0x437e96
lea ecx, [esi + 0x40]
mov dword [esi + 0x38], 5
call fcn.0043668c
lea ecx, [esi + 0x4c]
call fcn.0043668c
mov dword [esi + 0x58], ebx
jmp 0x437f13
push 2
push ebx
push edi
call fcn.00504169
push edi
call fcn.0050d293
push 0
push 0
push edi
mov ebx, eax
call fcn.00504169
add esp, 0x1c
cmp ebx, 0xffffffff
jne 0x437ed6
mov dword [esi + 0x38], 5
lea ecx, [esi + 0x40]
call fcn.0043668c
lea ecx, [esi + 0x4c]
call fcn.0043668c
and dword [esi + 0x58], 0
jmp 0x437f13
cmp ebx, 0xffffffff
jae 0x437eb9
test ebx, ebx
jne 0x437ee8
mov dword [esi + 0x38], 0xf
jmp 0x437ec0
lea eax, [ebx + 1]
push eax
call fcn.004e2329
push edi
push ebx
push 1
push eax
mov dword [esi + 0x5c], eax
call fcn.0050e17c
add esp, 0x14
cmp eax, ebx
jne 0x437eb9
mov eax, dword [esi + 0x5c]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.00438088
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4400a0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bf5b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x578704]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0
mov dword [ebx], 0x5609dc
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push 0
push 0
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00403405
push 8
call fcn.004e1d39
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 2
call fcn.00445134
mov dword [esi + 4], eax
add esp, 4
lea eax, [ebx + 0x10]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov ecx, edi
lea eax, [ebp - 0x20]
mov dword [edi + 0x3c], 0
push eax
call fcn.004034c2
push eax
mov dword [ebp - 4], 3
call fcn.0040e239
add esp, 4
mov esi, eax
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4401d9
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x4401d9
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov byte [ebp - 4], 1
mov ecx, esi
mov eax, dword [esi]
push 0x20
mov eax, dword [eax + 0x20]
call eax
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x440201
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.00403405
mov dword [ebp - 4], 5
mov eax, dword [ebx]
push ecx
push dword [ebp + 8]
lea ecx, [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x60]
mov dword [edx + ebx - 4], eax
call fcn.004406d0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4406d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bfce
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x578704]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004e1d39
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00445134
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 1
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x440792
mov eax, dword [eax]
push 2
push ecx
push eax
mov ecx, edi
call fcn.0040d8e7
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x448a99
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x448abc
or esi, 1
push 1
call edi
test ax, ax
jns 0x448ac8
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x448ad4
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x448ae0
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x449f39
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x1bc]
call fcn.00468380
mov edi, dword [ebp + 8]
test eax, eax
jle 0x449f8f
push ebx
lea ecx, [esi + 0x1bc]
mov byte [ebp + 0xb], 0
call fcn.0044dff0
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x449fed
lea ecx, [esi + 0x1bc]
inc ebx
call fcn.00468380
cmp ebx, eax
jl 0x449f58
sub edi, 0x100
je 0x44a05a
sub edi, 4
je 0x449ff1
dec edi
sub edi, 1
jne 0x44a051
push dword [ebp + 0xc]
and dword [ebp + 8], edi
call fcn.005096fe
pop ecx
mov ecx, dword [esi + 0x13c]
lea edx, [ebp + 8]
push reloc.WS2_32.dll_ioctlsocket
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x44b25c
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x44a051
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x44a053
cmp dword [esi + 0x140], 0
je 0x44a051
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x150]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x154]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.00448a99
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x44a051
mov ecx, dword [esi + 0x140]
test ecx, ecx
je 0x44a0b3
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x44a0b3
mov ecx, dword [esi + 0x140]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x44a0b3
mov ecx, dword [esi + 0x140]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.004fcd0a
pop ecx
pop ecx
test eax, eax
je 0x44a0b3
mov ecx, dword [esi + 0x140]
call fcn.0045cd97
test al, al
jne 0x44a051
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.0044aba4
jmp 0x449fed
Function at 0x44a949
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [edi]
je 0x44a970
cmp esi, dword [edi + 0x140]
je 0x44a970
push dword [edi]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x140]
cmp esi, eax
je 0x44aa56
test eax, eax
je 0x44a9d7
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x14
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [edi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0x140]
call fcn.0044a6a5
and dword [edi + 0x140], 0
test esi, esi
je 0x44aa56
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x44aa56
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x44aa56
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x44aa56
xorps xmm0, xmm0
mov dword [edi + 0x140], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [edi + 0x140]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0x140]
call fcn.0044a6a5
pop edi
pop esi
leave
ret 4