joyce8/EMBER2024-capa huggingface dataset:
Function at 0x145be
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
xor ebx, ebx
push ebx
push 0xa
push ebx
call esi
mov edi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
push ebx
push edi
cmp eax, 0xc0000004
jne 0x1465e
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call edi
push ebx
push dword [ebp - 4]
push ebx
call esi
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, ebx
je 0x14664
push ebx
push dword [ebp - 4]
push esi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jge 0x1461d
push ebx
push esi
call edi
jmp 0x14664
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, esi
add eax, 0x38
jmp 0x1463c
mov eax, dword [esi]
cmp eax, ebx
je 0x14652
add esi, eax
lea eax, [esi + 0x38]
push 1
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x14631
mov esi, dword [esi + 0x44]
jmp 0x14654
mov esi, ebx
push ebx
push dword [ebp - 8]
call edi
mov eax, esi
jmp 0x14666
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x14672
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ebp + 0xc]
add eax, ecx
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
cmp edx, dword [ecx + 0xc]
jae 0x14693
mov eax, edx
jmp 0x146be
push ebx
push esi
movzx esi, word [eax + 6]
push edi
xor edi, edi
test esi, esi
jbe 0x146b8
mov eax, dword [ecx + 0xc]
cmp edx, eax
jb 0x146b0
mov ebx, dword [ecx + 8]
add ebx, eax
cmp edx, ebx
jb 0x146c2
add ecx, 0x28
inc edi
cmp edi, esi
jb 0x146a0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edx
jmp 0x146bb

Function at 0x14b4f
Capabilities:
Create device object
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00014b16
pop ebp
jmp fcn.00014184
Function at 0x402035
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.0044b400
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40207a
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4020a5
push 6
call fcn.0044aa1c
add esp, 4
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.0044b210
add esp, 0x10
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
mov ecx, 2
call fcn.004017a9
add esp, 8
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4020ec
push ebx
call fcn.0044aa16
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x4020f4
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402105
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x40210a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x402137
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40214e
mov eax, 1
jmp 0x402158
mov eax, 0
jmp 0x402158
mov esp, ebp
pop ebp
ret 4

Function at 0x402215
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x402242
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402259
mov eax, 1
jmp 0x402263
mov eax, 0
jmp 0x402263
mov esp, ebp
pop ebp
ret 4

Function at 0x402269
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4022a5
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4022bc
mov eax, 1
jmp 0x4022c6
mov eax, 0
jmp 0x4022c6
mov esp, ebp
pop ebp
ret 8

Function at 0x4025d0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4025fd
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402614
mov eax, 1
jmp 0x40261e
mov eax, 0
jmp 0x40261e
mov esp, ebp
pop ebp
ret 4
Function at 0x402624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.0044b400
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402669
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402694
push 6
call fcn.0044aa1c
add esp, 4
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.0044b210
add esp, 0x10
mov dword [ebp - 8], eax
push reloc.WSOCK32.dll_bind
push 0
push 0
push 0
push 0
push 0
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4026da
mov eax, 0x476315
push eax
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4026ee
mov eax, 0x476315
push eax
push 4
mov ebx, 0x14c
call fcn.0044b6a0
add esp, 0x34
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402714
push ebx
call fcn.0044aa16
add esp, 4
push 0x80000301
push 0
push dword [ebp - 0xc]
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402731
mov eax, 0x476315
push eax
push 2
mov ebx, 0x134
call fcn.0044b750
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x40274f
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402760
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x405cc8
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
call fcn.00405e53
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x405d17
push ebx
call fcn.0044aa16
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x405e4d
call fcn.004060cd
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405e4d
mov eax, str.B4DBA4C1DCC07018456EBDD0D2F72132E7B6A364CC8BE892D2CB4530126DF581B9F3B7C570CE3E00DAE3ACD0BAB37B553B19C8CCB58FB99566484C79DCEFD1DEDFD2643C481EBBFBC6D1CAD17C054111B885DE88A190081C2742DE8ED1C8DC9E60282047AB96
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040555c
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x405d57
push ebx
call fcn.0044aa16
add esp, 4
push 0x30
mov eax, 0x47697b
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0040351b
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x405d84
push ebx
call fcn.0044aa16
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x405d94
push ebx
call fcn.0044aa16
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405dc0
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405de5
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jl 0x405e2b
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc ecx
push ecx
push eax
cmp ecx, eax
jg 0x405e28
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405e24
push 6
call fcn.0044aa1c
add esp, 4
pop eax
pop ecx
jmp 0x405df7
add esp, 8
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405e4d
push 6
call fcn.0044aa1c
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x4087e5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.0044b400
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40882a
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x200
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x408869
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x408897
mov eax, dword [ebp - 4]
test eax, eax
je 0x408892
push eax
mov ebx, eax
call fcn.0040154a
inc eax
push eax
call fcn.0044aa10
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4088ba
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
test eax, eax
je 0x4088b5
push eax
mov ebx, eax
call fcn.0040154a
inc eax
push eax
call fcn.0044aa10
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4088ba
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4088cb
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4092f3
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x409325
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40933c
mov eax, 0
jmp 0x409346
mov eax, 1
jmp 0x409346
mov esp, ebp
pop ebp
ret 8

Function at 0x40bc47
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x54caf6]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40bc94
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40bcab
mov eax, 0x47634a
jmp 0x40bda9
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x54caf6]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40bcd3
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40bcea
mov eax, 0x47634a
jmp 0x40bda9
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40bd0c
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40bd23
mov eax, 0x47634a
jmp 0x40bda9
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.0044d240
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40bd56
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40bd6d
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40bd8a
push 6
call fcn.0044aa1c
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40bda4
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0044aa10
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40bda9
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40bdba
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40e8be
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.0044b400
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40e903
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40e931
push 6
call fcn.0044aa1c
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x40e94d
push eax
mov ebx, eax
call fcn.0040154a
inc eax
push eax
call fcn.0044aa10
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40e952
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40e963
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x415fc4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 8
call fcn.0044aa10
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41600e
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41603f
mov ebx, dword [0x54cc6e]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov dword [ebx + 4], edx
jmp 0x416063
mov ebx, dword [0x54cc6e]
mov dword [ebp - 8], ebx
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
cdq
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov ebx, dword [0x54cc6e]
mov dword [ebp - 8], ebx
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
cdq
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov ebx, dword [ebp - 4]
push ebx
call fcn.0044aa16
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x416793
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ebx, dword [0x54cb3e]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esp
push 1
push 0x476315
push 0x476315
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4167e2
push 6
call fcn.0044aa1c
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x417f36
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x48
call fcn.0044aa10
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x12
rep stosd dword es:[edi], eax
push 0x10
call fcn.0044aa10
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push dword [ebp + 8]
call fcn.00402502
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x417faf
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push 0x10
push 2
mov ebx, 0xc8
call fcn.0044ae60
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push dword [ebp - 0x10]
push 0
push 0
push 0
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x418029
push 6
call fcn.0044aa1c
add esp, 4
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx]
jmp 0x41803c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41804d
push ebx
call fcn.0044aa16
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.0044aa16
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x41c3d3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41c40e
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0044d220
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c471
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0044ae60
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41c495
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0044d220
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c4f8
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0044ae60
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41c51c
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0044d220
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c57f
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0044ae60
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x41c587
mov esp, ebp
pop ebp
ret
Function at 0x420963
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4209a9
push 6
call fcn.0044aa1c
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x476808]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.00403613
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0044b400
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4209fc
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x420a35
push 6
call fcn.0044aa1c
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x420a51
push eax
mov ebx, eax
call fcn.0040154a
inc eax
push eax
call fcn.0044aa10
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x420a56
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x420a67
push ebx
call fcn.0044aa16
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x44b000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.004501d0
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x44b150
test ecx, ecx
je 0x44b150
inc ecx
push ecx
call fcn.00465b8d
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00458f60
mov edi, eax
add esp, 0xc
test edi, edi
je 0x44b079
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44b13d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.00465b8d
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x44b101
cmp eax, 0xea
jne 0x44b129
push esi
call fcn.00465bb6
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00465b8d
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x44b0cc
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x44b10f
cmp eax, 2
jne 0x44b129
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00450140
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.00465bb6
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00465bb6
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x44b17e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x44b18a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x44b18a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00450140
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret