joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5548d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405a50
xor eax, eax
push ebp
push 0x554a39
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x32
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
mov cl, 1
mov edx, 0x554a48
call fcn.004af0b8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00404f2c
mov eax, dword [ebp - 0x14]
call fcn.0040a754
cmp eax, 0x36
jbe 0x554942
call fcn.00403c14
mov eax, dword [eax*4 + str._pqrsxyz__QWERASDF_tuvwTYUIOPGHJKLZXCVBNM1234567890]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
mov cl, 1
mov edx, 0x554a48
call fcn.004af0b8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00404f2c
mov eax, dword [ebp - 0x1c]
call fcn.0040a754
cmp eax, 5
jbe 0x554982
call fcn.00403c14
mov eax, dword [eax*4 + 0x573e8c]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x32
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x5549fa
test byte [ebp - 0x10], 2
je 0x5549b8
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x5549fa
test byte [ebp - 0x10], 8
je 0x5549d6
push 0x5b
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x5549fa
push 0x5c
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x5549fa
test byte [ebp - 0x10], 1
je 0x5549e8
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x5549fa
test byte [ebp - 0x10], 4
je 0x554a03
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
je 0x554a03
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x3d
jne 0x554991
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554a40
lea eax, [ebp - 0x20]
call fcn.004054b0
lea eax, [ebp - 0x1c]
call fcn.00404c88
lea eax, [ebp - 0x18]
call fcn.004054b0
lea eax, [ebp - 0x14]
call fcn.00404c88
lea eax, [ebp - 4]
call fcn.004054b0
ret
Function at 0x55f014
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4d0], ebx
mov dword [ebp - 0x4cc], ebx
mov dword [ebp - 0x4c8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55f1e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.004054b0
xor eax, eax
push ebp
push 0x55f1a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x800
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
lea eax, [ebp - 0x4c8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.00404f2c
mov eax, dword [ebp - 0x4c8]
call fcn.00405168
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x55f196
test byte [ebp - 0x16e], 1
je 0x55f196
lea edx, [ebp - 0x4cc]
mov eax, dword [0x574420]
call fcn.0048265c
mov edx, dword [ebp - 0x4cc]
lea eax, [ebp - 0x14]
mov ecx, 0x55f1fc
call fcn.00406cd0
lea eax, [ebp - 0x18]
call fcn.00406c8c
push eax
push 0x55f20c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax]
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040568c
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov byte [ebp - 0x3bd], 0
push 4
lea eax, [ebp - 0x2b8]
push eax
push 0x104
lea eax, [ebp - 0x3bd]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
cmp byte [ebp - 0x3bd], 0
je 0x55f196
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x3bd]
mov ecx, 0x105
call fcn.00405648
mov byte [ebp - 0x4c2], 0
push 0x104
lea eax, [ebp - 0x4c2]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
cmp byte [ebp - 0x4c2], 0
je 0x55f192
lea eax, [ebp - 0x4d0]
lea edx, [ebp - 0x4c2]
mov ecx, 0x105
call fcn.00405648
mov ecx, dword [ebp - 0x4d0]
mov eax, dword [ebp - 0xc]
mov edx, 0x55f220
call fcn.00405708
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55f1aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f1f0
lea eax, [ebp - 0x4d0]
call fcn.004054b0
lea eax, [ebp - 0x4cc]
call fcn.00406c8c
lea eax, [ebp - 0x4c8]
call fcn.00404c88
lea eax, [ebp - 0x18]
call fcn.00406c8c
lea eax, [ebp - 0x14]
call fcn.00406c8c
ret
Function at 0x5605f4
Capabilities:
Access peb ldr_data
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56077b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x720], 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0046e7c0
push 0
mov eax, dword [0x574520]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
add eax, 0x538
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x1e8
mov eax, dword [ebp - 4]
call fcn.0045ff94
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 8], 1
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 7
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x8006
push 0x8000
push 0x10
push 0x10
push 1
push 0x560788
mov eax, dword [0x5777f8]
push eax
call sub.user32.dll_LoadImageA
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
jne 0x5606bb
mov eax, dword [0x574520]
mov eax, dword [eax]
mov eax, dword [eax + 0xa0]
call fcn.00436074
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004a96b4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404f2c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add eax, 0x18
call fcn.0040ad88
mov eax, dword [ebp - 4]
add eax, 0x538
push eax
push 0
call sub.shell32.dll_Shell_NotifyIconA
mov eax, dword [0x5743fc]
cmp byte [eax], 0
je 0x56070e
mov edx, 0x560798
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.004ab2d4
jmp 0x560721
mov edx, 0x5607bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.004ab2d4
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.0044eeac
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x390]
call fcn.0044eeac
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x574520]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowPos
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560782
lea eax, [ebp - 0x10]
call fcn.004054b0
lea eax, [ebp - 0xc]
call fcn.00404c88
ret
Function at 0x5607dc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 5
mov eax, dword [0x574520]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov byte [eax + 0x720], 0
mov eax, dword [ebp - 4]
add eax, 0x538
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x1e8
mov eax, dword [ebp - 4]
call fcn.0045ff94
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 8], 1
mov eax, dword [ebp - 4]
add eax, 0x538
push eax
push 2
call sub.shell32.dll_Shell_NotifyIconA
mov eax, dword [ebp - 4]
cmp byte [eax + 0x534], 0
jne 0x5608d7
mov eax, dword [0x5743fc]
cmp byte [eax], 0
je 0x56086c
mov edx, 0x5608e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.004ab2d4
jmp 0x56087f
mov edx, 0x560904
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.004ab2d4
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.0044eeac
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x390]
call fcn.0044eeac
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0055d670
mov eax, dword [ebp - 4]
call fcn.0045ff94
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00560ac0
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [0x574520]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowPos
pop ecx
pop ecx
pop ebp
ret

Function at 0x560a58
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 4]
je 0x560ab9
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 8], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_BringWindowToTop
mov esp, ebp
pop ebp
ret
Function at 0x5640c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x54e074]
call fcn.00405a70
xor eax, eax
push ebp
push 0x5641d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1c], 1
lea eax, [ebp - 0x1c]
push eax
push 0x552564
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0x18]
call fcn.004063e0
sub eax, 1
jno 0x56410d
call fcn.00403c1c
test eax, eax
jl 0x5641b7
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x56412f
cmp eax, dword [edx - 4]
jb 0x564134
call fcn.00403c14
mov eax, dword [edx + eax*4]
mov edx, 0x5641e4
call fcn.004057c0
jne 0x5641ab
mov eax, dword [ebp - 4]
call fcn.0045ff94
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x56415a
cmp edx, dword [ecx - 4]
jb 0x56415f
call fcn.00403c14
cmp eax, dword [ecx + edx*4]
je 0x5641ab
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7dc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7d8]
push eax
push 0x805a
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x56418c
cmp eax, dword [edx - 4]
jb 0x564191
call fcn.00403c14
mov eax, dword [edx + eax*4]
push eax
call sub.user32.dll_PostMessageA
push 0x28
call sub.kernel32.dll_Sleep_1
mov eax, 0x14
call fcn.0056e268
inc dword [ebp - 8]
dec dword [ebp - 0xc]
jne 0x564120
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5641da
lea eax, [ebp - 0x1c]
mov edx, dword [0x54e074]
call fcn.00405b40
ret
Function at 0x56bea0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 8]
test eax, eax
jns 0x56bebd
call fcn.00403c14
push eax
call sub.user32.dll_MapVirtualKeyA
test eax, eax
jns 0x56becc
call fcn.00403c14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0x11
jne 0x56c039
cmp dword [ebp - 0xc], 0
je 0x56bee9
cmp dword [ebp - 0xc], 1
jne 0x56bf93
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
mov dword [ebp - 0x14], eax
mov eax, dword [0x574720]
mov eax, dword [eax]
cmp dword [eax + 0xaa0], 0
jne 0x56bf33
push 0
push 0
mov eax, dword [ebp - 0x10]
cmp eax, 0xff
jbe 0x56bf1b
call fcn.00403c14
push eax
mov eax, dword [ebp - 8]
cmp eax, 0xff
jbe 0x56bf2b
call fcn.00403c14
push eax
call sub.user32.dll_keybd_event
jmp 0x56bf84
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x56bf49
call fcn.00403c14
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffff
jbe 0x56bf5c
call fcn.00403c14
mov word [ebp - 0x2e], ax
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
push 0x1c
lea eax, [ebp - 0x34]
push eax
push 1
mov eax, dword [0x574720]
mov eax, dword [eax]
call dword [eax + 0xaa0]
cmp dword [ebp - 0x14], 0
jne 0x56bf93
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetAsyncKeyState
cmp dword [ebp - 0xc], 0
je 0x56bfa3
cmp dword [ebp - 0xc], 2
jne 0x56c0c2
mov eax, dword [0x574720]
mov eax, dword [eax]
cmp dword [eax + 0xaa0], 0
jne 0x56bfe1
push 0
push 2
mov eax, dword [ebp - 0x10]
cmp eax, 0xff
jbe 0x56bfc6
call fcn.00403c14
push eax
mov eax, dword [ebp - 8]
cmp eax, 0xff
jbe 0x56bfd6
call fcn.00403c14
push eax
call sub.user32.dll_keybd_event
jmp 0x56c0c2
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x56bff7
call fcn.00403c14
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffff
jbe 0x56c00a
call fcn.00403c14
mov word [ebp - 0x2e], ax
mov dword [ebp - 0x2c], 2
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
push 0x1c
lea eax, [ebp - 0x34]
push eax
push 1
mov eax, dword [0x574720]
mov eax, dword [eax]
call dword [eax + 0xaa0]
jmp 0x56c0c2
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x10]
and eax, 0xff
shl eax, 0x10
add dword [ebp - 0x18], eax
jae 0x56c055
call fcn.00403c1c
cmp dword [ebp - 0xc], 0
je 0x56c061
cmp dword [ebp - 0xc], 1
jne 0x56c088
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
push 0x14
call sub.kernel32.dll_Sleep_1
mov eax, 0x14
call fcn.0056e268
cmp dword [ebp - 0xc], 0
je 0x56c094
cmp dword [ebp - 0xc], 2
jne 0x56c0c2
mov eax, dword [ebp - 0x18]
add eax, 0x40000000
jae 0x56c0a3
call fcn.00403c1c
add eax, 0x80000000
jae 0x56c0af
call fcn.00403c1c
push eax
mov eax, dword [ebp - 8]
push eax
push 0x101
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
mov esp, ebp
pop ebp
ret
Function at 0x56d9c4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x57b410], 0
je 0x56da18
lea eax, [ebp - 0x308]
xor ecx, ecx
mov edx, 0x200
call fcn.00403628
push pe_nt_image_headers32
lea eax, [ebp - 0x308]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x308]
mov ecx, pe_nt_image_headers32
call fcn.00405660
jmp 0x56da52
lea eax, [ebp - 0x108]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403628
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.00405648
mov esp, ebp
pop ebp
ret

Function at 0x56e080
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3fc
mov dword [ebp - 4], eax
cmp byte [0x57b410], 0
je 0x56e0bb
lea eax, [ebp - 0xc04]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc04]
mov ecx, 0x400
call fcn.00405660
jmp 0x56e0df
lea eax, [ebp - 0x404]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00405648
mov esp, ebp
pop ebp
ret

Function at 0x56e0e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3f8
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
cmp byte [0x57b410], 0
je 0x56e123
push 0
push 0x1a
lea eax, [ebp - 0xc08]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc08]
mov ecx, 0x400
call fcn.00405660
jmp 0x56e148
push 0
push 0x1a
lea eax, [ebp - 0x408]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.00405648
cmp byte [ebp - 1], 0
je 0x56e15e
mov eax, dword [ebp - 8]
mov edx, 0x56e168
call fcn.004056a8
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x401482
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x124]
sub esp, 0x14c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [0x42bc10]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
or eax, 8
mov dword [esp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x4015a6
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edi, [ebp - 0x11d]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x124]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x12c]
sub esp, 0x10
test eax, eax
jne 0x401540
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 0x124]
je 0x401525
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, 1
jmp 0x4015a6
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00401482
sub esp, 0xc
test eax, eax
je 0x4014db
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 4
call fcn.00408273
test eax, eax
push edi
je 0x401581
mov edx, dword [0x42bc10]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], edx
call eax
sub esp, 0x10
jmp 0x4015a6
cmp dword [0x42bc10], 0
mov eax, 1
jne 0x4015a6
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
push edx
push edx
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4039e6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
cmp dword [ebp + 8], 0
je 0x403a15
mov eax, dword [0x41bc60]
test eax, eax
je 0x403a06
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x41bc60], 0
jmp 0x403acc
cmp dword [0x41bc60], 0
je 0x403a30
mov dword [esp], 0
call fcn.00408822
push edx
jmp 0x403acc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x42bc80]
jbe 0x403acc
cmp dword [0x42bca4], 0
je 0x403a83
test byte [0x42bc14], 1
je 0x403acc
lea ebx, [ebp - 0x48]
call fcn.00403914
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str....__d__
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00406fb7
jmp 0x403aca
mov eax, dword [0x42bca8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403946
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x41bc60], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x403ad1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x403b12
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x403b4b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
add ebx, dword [0x427d18]
sub ebx, dword [0x427d1c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
mov dword [0x42bc80], eax
test ebx, ebx
jle 0x403d1d
mov eax, dword [0x427d14]
lea edi, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00403b19
mov eax, dword [0x427d1c]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call esi
mov dword [0x427d0c], ebx
sub esp, 0x10
mov dword [0x427d08], 0
mov dword [ebp - 0x2c], esi
mov ebx, dword [0x427d10]
sub ebx, dword [0x427d14]
mov eax, 0x4000
mov dword [esp], 0x423c80
cmp ebx, 0x4000
cmovg ebx, eax
mov dword [esp + 4], ebx
call fcn.00403ad1
test eax, eax
push edx
push edx
je 0x403d2d
add dword [0x427d14], ebx
mov dword [0x427c98], 0x423c80
mov dword [0x427c9c], ebx
cmp dword [0x42bc20], 0
je 0x403c50
cmp dword [0x42bc00], 0
jne 0x403c50
mov eax, dword [ebp + 8]
add eax, dword [0x427d18]
sub eax, dword [0x427d1c]
mov ecx, dword [0x427d0c]
mov dword [esp], 0
sub ecx, eax
mov dword [0x427d08], ecx
call fcn.004039e6
mov ecx, 0x427c80
mov dword [0x427ca0], 0x41bc80
mov dword [0x427ca4], 0x8000
call fcn.00408919
test eax, eax
js 0x403cd4
mov esi, dword [0x427ca0]
sub esi, 0x41bc80
je 0x403cc7
mov eax, dword [0x40a010]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0x41bc80
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x403cdb
cmp esi, dword [ebp - 0x1c]
jne 0x403cdb
add dword [0x427d1c], esi
cmp dword [0x427c9c], 0
jne 0x403c15
jmp 0x403ce2
cmp dword [0x427c9c], 0
jne 0x403cd4
test ebx, ebx
jne 0x403ce2
mov eax, 0xfffffffd
jmp 0x403d30
mov eax, 0xfffffffe
jmp 0x403d30
mov edx, dword [0x427d18]
mov eax, dword [ebp + 8]
add eax, edx
sub eax, dword [0x427d1c]
test eax, eax
jg 0x403bcb
mov eax, dword [0x40a010]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [ebp - 0x2c]
sub esp, 0x10
mov dword [esp], 1
call fcn.004039e6
xor eax, eax
jmp 0x403d30
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x403d3a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
test eax, eax
js 0x403d7a
add eax, dword [0x42bc78]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [0x427d18], eax
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp], 4
call fcn.00403b4b
test eax, eax
push ecx
mov edx, eax
js 0x403edf
lea eax, [ebp - 0x20]
lea edi, [ebp - 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp + 0xc], edi
mov dword [esp], eax
call ebx
sub esp, 0x14
test eax, eax
je 0x403e90
cmp dword [ebp - 0x24], 4
jne 0x403e90
mov eax, dword [ebp - 0x20]
add dword [0x427d18], 4
mov dword [esp], eax
call fcn.00403b4b
test eax, eax
push edx
mov esi, eax
mov edx, eax
js 0x403edf
cmp dword [ebp + 0x10], 0
jne 0x403ea2
mov dword [ebp - 0x2c], ebx
jmp 0x403e4c
cmp ebx, dword [ebp - 0x24]
jne 0x403e90
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x423c80
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x403e97
cmp ebx, dword [ebp - 0x1c]
jne 0x403e97
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x20], eax
add dword [0x427d18], eax
add esi, eax
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x403e9e
mov edx, 0x4000
cmp eax, 0x4000
mov dword [esp + 0x10], 0
mov ebx, edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x423c80
cmovle ebx, eax
mov eax, dword [0x40a010]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
jne 0x403e02
mov edx, 0xfffffffd
jmp 0x403edf
mov edx, 0xfffffffe
jmp 0x403edf
mov edx, esi
jmp 0x403edf
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x20], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov esi, eax
mov eax, dword [ebp + 0x10]
cmovle esi, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp + 8], esi
mov dword [esp], eax
call ebx
sub esp, 0x14
test eax, eax
je 0x403e90
mov edx, dword [ebp - 0x24]
add dword [0x427d18], edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10