joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c5a4
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
cmp ecx, 0x3e8
jl 0x40c60e
push esi
push ecx
mov ecx, dword [0x45d4cc]
imul ecx, ecx, 0x188
add ecx, 0x45d544
call fcn.0041988c
mov eax, dword [0x45d4cc]
mov esi, eax
imul esi, esi, 0x188
add esi, 0x45d6b4
mov ecx, dword [esi]
test ecx, ecx
je 0x40c5ed
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi], 0
mov eax, dword [0x45d4cc]
imul eax, eax, 0x188
add eax, 0x45d6b8
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x40c609
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi], 0
mov al, 1
pop esi
pop ecx
ret
lea eax, [ecx - 0xd2]
cmp eax, 0x29
ja case.0x40c624.213
movzx eax, byte [eax + 0x40c7dc]
jmp dword [eax*4 + 0x40c794]
push 1
jmp 0x40c64d
mov ecx, dword [0x45d4cc]
imul ecx, ecx, 0x188
add ecx, 0x45d544
call fcn.004171e1
jmp case.0x40c624.220
push 0
mov ecx, dword [0x45d4cc]
imul ecx, ecx, 0x188
add ecx, 0x45d544
call fcn.00417220
jmp case.0x40c624.220
mov ecx, dword [0x45d4cc]
imul ecx, ecx, 0x188
add ecx, 0x45d544
call fcn.004171ab
jmp case.0x40c624.220
mov ecx, dword [0x45d4cc]
imul ecx, ecx, 0x188
add ecx, 0x45d544
call fcn.0041ae8d
jmp case.0x40c624.220
push dword [0x45d4cc]
push 0
push 0
jmp 0x40c6b7
push dword [0x45d4cc]
push 0
push 1
mov ecx, 0x45d4c0
call fcn.00401e65
jmp case.0x40c624.220
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [0x45d4cc]
shr eax, 0xf
and al, 1
mov byte [esp + 3], al
sete al
imul ecx, ecx, 0x188
push eax
add ecx, 0x45d544
call fcn.00419de1
jmp case.0x40c624.220
mov ecx, 0x45d4c0
call fcn.00410bfa
jmp case.0x40c624.220
mov ecx, 0x45d4c0
call fcn.0041496d
jmp case.0x40c624.220
mov ecx, 0x45d4c0
call fcn.0041c3f6
jmp case.0x40c624.220
mov ecx, 0x45d4c0
call fcn.0041cd07
jmp case.0x40c624.220
mov ecx, dword [0x45d4cc]
imul ecx, ecx, 0x188
add ecx, 0x45d544
call fcn.00418b0b
jmp case.0x40c624.220
mov ecx, dword [0x45d4cc]
imul ecx, ecx, 0x188
add ecx, 0x45d544
call fcn.0041aeae
jmp case.0x40c624.220
mov ecx, dword [0x45d4cc]
imul ecx, ecx, 0x188
add ecx, 0x45d544
call fcn.0041a83f
jmp case.0x40c624.220
mov ecx, dword [0x45d4cc]
imul ecx, ecx, 0x188
add ecx, 0x45d544
call fcn.0041ac27
mov al, 1
pop ecx
ret
xor al, al
pop ecx
ret

Function at 0x40e264
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
lea eax, [esp]
neg cl
sbb ecx, ecx
and cl, 1
add ecx, 0x100
or cx, 0x4010
push ecx
push 0x160
push eax
push 0x90
push 0x45d914
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
add esp, 0x160
ret
Function at 0x415020
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x444c7c
call fcn.00441b80
sub esp, 0x60
push ebx
xor ebx, ebx
cmp byte [0x45d8b4], bl
push esi
mov esi, ecx
je 0x4150a1
mov eax, dword [edx]
cmp dword [esi + 4], ebx
mov dword [ebp - 0x6c], 0x3c
mov dword [ebp - 0x68], 0x140
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ebx
jne 0x415060
xor esi, esi
jmp 0x415062
mov esi, dword [esi]
push str.ShellExecuteExW
push 0x45ba48
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x34], ebx
call dword [0x44b1cc]
push eax
call dword [0x44b1f8]
cmp eax, ebx
je 0x41514a
lea ecx, [ebp - 0x6c]
push ecx
call eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x4c]
mov dword [eax], ecx
jmp 0x415115
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x6c], 0x3c
mov dword [ebp - 0x68], 0x140
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call fcn.0043a785
mov edx, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.0043a785
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
mov dword [ebp - 0x50], 1
and eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
push dword [ebp - 0x18]
mov esi, dword [ebp - 0x4c]
mov dword [eax], ecx
call fcn.004284d8
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call fcn.004284d8
pop ecx
pop ecx
cmp esi, 0x20
ja 0x41514a
cmp esi, 0x1f
jne 0x41514a
call dword [0x44b200]
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0040421e
push 0x10
push 0x45b7f8
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x30]
call fcn.004284d8
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x41ab15
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x44576e
call fcn.00441b80
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x44b558
lea ecx, [esi + 0xc]
mov dword [esi + 8], edi
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403396
lea ecx, [esi + 0x18]
push 3
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403396
lea ecx, [esi + 0x24]
push 3
mov byte [ebp - 4], 2
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403396
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 4
mov dword [esi + 0x30], 0x44b510
mov dword [esi], 0x44c3b8
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41aba3
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4457a9
call fcn.00441b80
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea edi, [esi + 0x30]
mov dword [ebp - 0x14], edi
mov dword [edi], 0x44b510
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00428327
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.004282fe
push dword [esi + 0x24]
call fcn.004284d8
push dword [esi + 0x18]
call fcn.004284d8
push dword [esi + 0xc]
call fcn.004284d8
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x44b588
mov dword fs:[0], ecx
pop edi
pop esi
leave
ret

Function at 0x41c913
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x445ac3
call fcn.00441b80
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x44b558
lea ecx, [esi + 0x10]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403396
lea ecx, [esi + 0x1c]
push 3
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403396
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], 8
mov dword [esi + 0x28], 0x44c418
mov dword [esi], 0x44c3e8
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41ecdc
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4460b0
call fcn.00441b80
sub esp, 0x18
push esi
mov esi, ecx
lea ecx, [ebp - 0x18]
lea edx, [esi + 0x3c]
call fcn.0041ec55
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0xc]
call fcn.0040312c
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.004284d8
pop ecx
lea edx, [esi + 0x40]
lea ecx, [ebp - 0x18]
call fcn.0041ecaf
push eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 1
call fcn.0040312c
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.004284d8
pop ecx
lea edx, [esi + 0x44]
lea ecx, [ebp - 0x24]
call fcn.0041ec82
push eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 2
call fcn.0040312c
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call fcn.004284d8
pop ecx
push dword [0x45c05c]
lea ecx, [esi + 0x30]
call fcn.00404722
push 0x11
pop ecx
call fcn.0041f94c
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], eax
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41f94c
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 4], 0
je 0x41f9b6
push 0x4008
lea eax, [ebp - 0x168]
push 0x160
push eax
push 0x80
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x41f9ae
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x164]
leave
ret
xor eax, eax
leave
ret

Function at 0x41f9ba
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push 0x4010
lea eax, [ebp - 0x160]
push 0x160
or dl, 0x80
push eax
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x15c]
mov dword [ecx], edx
leave
ret 4
Function at 0x41fabb
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x44626c
call fcn.00441b80
sub esp, 0x42c
cmp byte [0x45d8b4], 0
push esi
mov esi, edx
jne 0x41fb56
and byte [ebp - 0x74], 0
mov edx, ecx
lea ecx, [ebp - 0x18]
call fcn.0043a785
mov eax, dword [eax]
lea ecx, [ebp - 0x184]
push 0x4410
push 0x160
or esi, 0x80
push ecx
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov esi, eax
push dword [ebp - 0x18]
call fcn.004284d8
pop ecx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041e0dd
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.0041242c
mov ecx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 1
call fcn.0040312c
push dword [ebp - 0x24]
call fcn.004284d8
push dword [ebp - 0x18]
call fcn.004284d8
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x180]
jmp 0x41fb95
mov ecx, dword [ecx]
and word [ebp - 0x224], 0
push 0x4410
lea eax, [ebp - 0x438]
mov edx, esi
push 0x2b4
push eax
or dl, 0x80
call fcn.0041fa9f
mov ecx, dword [ebp + 0xc]
mov esi, eax
lea eax, [ebp - 0x224]
push eax
call fcn.00404722
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x434]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x422fd6
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get number of processors

Disassembly:
mov eax, 0x4468aa
call fcn.00441b80
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 3
xor ebx, ebx
or eax, 0xffffffff
lea ecx, [esi + 0x38]
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
push edi
mov dword [ebp - 0x10], esi
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403396
lea ecx, [esi + 0x44]
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403396
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], 4
mov dword [esi + 0x50], 0x44b510
lea ecx, [esi + 0x64]
push edi
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403396
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403396
lea ecx, [esi + 0x7c]
push edi
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403396
lea ecx, [esi + 0x88]
push edi
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403396
lea ecx, [esi + 0x94]
call fcn.00441910
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42620c
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 8]
shr eax, 0xf
movzx ecx, word [ecx + 0xc]
and al, 1
sub ecx, 0x26
je 0x426239
dec ecx
dec ecx
je 0x426231
xor al, al
jmp 0x426248
test al, al
je 0x426246
push 0
jmp 0x42623f
test al, al
je 0x426246
push 1
mov ecx, esi
call fcn.0042624c
mov al, 1
pop esi
ret 4

Function at 0x4271cd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x446f1a
call fcn.00441b80
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004030f2
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.004030f2
mov al, byte [edi + 0x18]
lea ecx, [esi + 0x38]
mov byte [esi + 0x18], al
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
lea eax, [edi + 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.004030f2
lea eax, [edi + 0x44]
lea ecx, [esi + 0x44]
push eax
mov byte [ebp - 4], 2
call fcn.004030f2
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4293af
Capabilities:
Write clipboard data

Disassembly:
mov eax, 0x447268
call fcn.00441b80
push ecx
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0x2002
call fcn.0042c483
test al, al
jne 0x4293e1
xor bl, bl
jmp 0x429417
mov esi, dword [ebp - 0x10]
push esi
call dword [0x44b1b8]
test eax, eax
je 0x4293dd
push dword [ebp + 8]
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [0x44b1bc]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4293dd
and dword [ebp - 0x10], 0
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042c4a4
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42d3b6
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x447894
call fcn.00441b80
sub esp, 0x11c
push esi
xor esi, esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], esi
push 0x2001f
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ecx]
lea ecx, [ebp - 0x10]
call fcn.0042d35b
cmp eax, esi
jne 0x42d457
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x14], 0x105
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x42d444
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x10]
push eax
call fcn.0042d3b6
cmp eax, esi
jne 0x42d457
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x105
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x128]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x42d40c
lea ecx, [ebp - 0x10]
call fcn.0042d390
push dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
call fcn.0042d3a7
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0042d390
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x42d4a3
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 0xc]
call dword [0x44b190]
inc eax
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8

Function at 0x42d4ca
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4478e5
call fcn.00441b80
sub esp, 0x34
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp byte [0x45d8b4], bl
push edi
mov edi, ecx
mov dword [ebp - 0x10], ebx
je 0x42d510
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x42d5bd
cmp dword [ebp + 0xc], esi
je 0x42d540
push dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
call fcn.00403091
push 1
pop esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0043a785
push 3
pop ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], esi
mov esi, dword [eax]
xor eax, eax
cmp dword [ebp + 8], eax
je 0x42d56f
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.00403091
or ebx, 4
mov dword [ebp - 0x10], ebx
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 2
call fcn.0043a785
mov eax, dword [eax]
or ebx, 8
push esi
push eax
mov ecx, edi
call fcn.0042d4a3
test bl, 8
mov esi, eax
je 0x42d58b
push dword [ebp - 0x34]
and ebx, 0xfffffff7
call fcn.004284d8
pop ecx
test bl, 4
je 0x42d59c
push dword [ebp - 0x1c]
and ebx, 0xfffffffb
call fcn.004284d8
pop ecx
test bl, 2
je 0x42d5ad
push dword [ebp - 0x40]
and ebx, 0xfffffffd
call fcn.004284d8
pop ecx
test bl, 1
je 0x42d5bb
push dword [ebp - 0x28]
call fcn.004284d8
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x42d5ce
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc

Function at 0x42d70f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x44792e
call fcn.00441b80
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, ecx
mov eax, dword [esi]
mov dword [esi + 4], ebx
mov dword [ebp - 0x10], ebx
mov word [eax], bx
cmp byte [0x45d8b4], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0xc], ebx
je 0x42d7a5
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x42d763
cmp eax, 0xea
jne 0x42d853
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 8]
jl 0x42d773
push eax
mov ecx, esi
call fcn.00403396
mov eax, dword [esi]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.0042d6ec
mov edi, eax
mov eax, dword [esi]
xor ecx, ecx
cmp word [eax], bx
je 0x42d799
mov edx, eax
inc ecx
inc edx
inc edx
cmp word [edx], bx
jne 0x42d791
mov word [eax + ecx*2], bx
mov dword [esi + 4], ecx
jmp 0x42d851
push 3
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.004034e3
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
jne 0x42d7c4
xor eax, eax
jmp 0x42d7f5
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.00403091
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0043a785
mov dword [ebp - 0x10], 3
mov eax, dword [eax]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
push ecx
push eax
mov ecx, edi
call fcn.0042d67e
test byte [ebp - 0x10], 2
mov edi, eax
je 0x42d816
push dword [ebp - 0x38]
and dword [ebp - 0x10], 0xfffffffd
call fcn.004284d8
pop ecx
test byte [ebp - 0x10], 1
mov dword [ebp - 4], ebx
je 0x42d828
push dword [ebp - 0x2c]
call fcn.004284d8
pop ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0041242c
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0040312c
push dword [ebp - 0x38]
call fcn.004284d8
push dword [ebp - 0x20]
call fcn.004284d8
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x42e72f
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
push edi
mov eax, dword [esi]
and dword [esi + 4], 0
and byte [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
jne 0x42e75c
call dword [0x44b200]
neg eax
sbb eax, eax
inc eax
jmp 0x42e793
cmp edi, dword [esi + 8]
jl 0x42e769
push edi
mov ecx, esi
call fcn.004034e3
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, esi
mov edi, eax
call fcn.00428d27
test edi, edi
jne 0x42e791
call dword [0x44b200]
neg eax
sbb eax, eax
neg eax
jmp 0x42e793
mov al, 1
pop edi
pop esi
pop ebx
ret 4
Function at 0x42e799
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x447b40
call fcn.00441b80
sub esp, 0x18
cmp byte [0x45d8b4], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x42e81a
mov esi, dword [ebp + 8]
mov eax, dword [esi]
and dword [esi + 4], 0
and word [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
je 0x42e809
cmp edi, dword [esi + 8]
jl 0x42e7dc
push edi
mov ecx, esi
call fcn.00403396
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi]
xor ebx, ebx
xor edx, edx
cmp word [ecx], bx
je 0x42e7fe
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x42e7f6
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
jne 0x42e816
call dword [0x44b200]
neg eax
sbb eax, eax
inc eax
jmp 0x42e86b
mov al, 1
jmp 0x42e86b
xor esi, esi
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.004034e3
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
mov dword [ebp - 4], esi
call fcn.0042e72f
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov bl, al
call fcn.0041242c
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.0040312c
push dword [ebp - 0x24]
call fcn.004284d8
push dword [ebp - 0x18]
call fcn.004284d8
pop ecx
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x42f751
Capabilities:
Get session user name

Disassembly:
mov eax, 0x447d34
call fcn.00441b80
sub esp, 0x334
push ebx
push esi
xor ebx, ebx
push str.Advapi32.dll
mov dword [ebp - 0x18], ebx
call dword [0x44b1d4]
mov dword [ebp - 0x14], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
je 0x42f851
push str.LsaOpenPolicy
push eax
call dword [0x44b1f8]
mov esi, eax
cmp esi, ebx
je 0x42f851
lea ecx, [ebp - 0x18]
call fcn.0042f872
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push 0xf0fff
push eax
push ebx
call esi
cmp eax, ebx
jne 0x42f851
push edi
push 0xb
pop ecx
mov esi, str.SeLockMemoryPrivilege
lea edi, [ebp - 0x13c]
push 0x35
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x110]
lea edx, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x13c]
call fcn.0042f8d8
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x100
push eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
pop edi
je 0x42f851
lea ecx, [ebp - 0x340]
call fcn.0042f8fa
mov esi, eax
cmp esi, ebx
je 0x42f851
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x18]
push eax
push esi
mov byte [ebp - 0xd], bl
call fcn.0042f8a5
cmp eax, ebx
jne 0x42f83f
mov byte [ebp - 0xd], 1
push esi
push ebx
call dword [0x44b090]
push eax
call dword [0x44b094]
mov bl, byte [ebp - 0xd]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042f872
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret