joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045970
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x100459a3
push esi
call fcn.10053cc0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x1004599c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10045a29
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10045a12
mov eax, dword [esi + 8]
test eax, eax
je 0x100459c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x10045a0e
cmp eax, 2
je 0x10045a12
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100459ba
cmp eax, 3
je 0x100459ed
cmp eax, 1
jne 0x100459ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x100459ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x100459ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.10045a50
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10045a38
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.10045a50
add esp, 4
pop esi
ret

Function at 0x100462d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x100462f1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x100462f1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x100462f1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10046740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1004674b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1004684e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x1008fff0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1008fff0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1008fff0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1008fff0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1008fff0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1008fff0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1008fff0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1008fff0]
xor eax, edx
inc ecx
dec edi
jne 0x10046766
pop edi
test esi, esi
je 0x10046870
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1008fff0]
xor eax, edx
inc ecx
dec esi
jne 0x10046852
pop esi
pop ebx
not eax
ret
Function at 0x10073e45
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10073e7d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10071efc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10071ed4
jmp 0x10073e89
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10075537
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10075579
call fcn.1007b00e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10075579
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10075570
xor eax, eax
jmp 0x10075581
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10075587
pop edi
pop esi
pop ebx
ret 4
Function at 0x4fe43a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
test eax, 0x13e346a3
mov byte [esp], 0x93
add edx, eax
pushfd
push 0xdb943660
push 0x8ec68259
push dword [esp]
lea esp, [esp + 0x3c]
jmp fcn.00502eba

Function at 0x50d384
Capabilities:
Encode data using xor

Disassembly:
xor ebx, edx
xor ebx, edx
inc ebx
loop 0x50d33f
or cl, byte [ebx]
push es
xchg ebx, eax
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
mov fs, word [edi - 0x66]
pop es
push ss
inc ebx
salc
movsb byte es:[edi], byte [esi]
sbb esp, esi
jb 0x50d3ca
mov ah, 0x9f
stosb byte es:[edi], al
push 0xf59226ad
lea esp, [esp + 8]
call fcn.00570635
call fcn.00506ae6
jns 0x50d33e
in al, 0x95
add al, 0x5d
mov al, 0xfe
jns 0x50d3f4
aam 0xd9
dec eax
mov bl, 0xcc
ljmp 0x50a6
out dx, eax
jnp 0x50d373
inc esp
mov fs, word [edi + 0x45]
mul dword [esi + 0x4aac757a]
fadd st(7)
dec ecx
mov al, 0xe1
inc eax
mov es, word [edx + 0x68]
pop ds
test al, 0x77
cdq
inc edx
dec esi
mov eax, dword [0x40e09d70]
sbb esp, edi
test dword [esi + edx*8 - 0x59ab5f1e], edx
aaa
scasb al, byte es:[edi]
and dword [ecx], 0xffffffd7
and al, 0x36
inc ebx
not byte [ebx]
pop ds
and edx, dword [ebx]
mov bh, byte [eax]
xor al, 0xda
xchg esp, eax
cmp dword [ebx], ecx
sub esp, ecx
aad 0x68
dec ecx
aam 0xb2
nop
daa
pop eax
sub eax, 0x2b5c012b
aam 0x76
sti
sal dword cs:[edx - 0x29], cl
movsd dword es:[edi], dword [esi]
test byte [ebx + ebx - 0x7013f8aa], dl
push edi
salc
call dword [edx]
cmpsd dword [esi], dword es:[edi]
mov al, byte [ebx - 0x46]
inc ebx
rcl byte [ebx], cl
not byte [edi]
push ss
dec ebx
mov edx, 0x4ab7c283
inc edi
out dx, al
cmp dword [edx - 0x31], 0x42
adc byte [ebx], bl
out 0x71, al
or byte [eax], ah
adc edx, dword [esi]
mov ch, 0x6a
xchg ecx, eax
shr dword [ebp + edi*2 + 0x2f725274], 1
cmp esi, dword [edx]
lodsb al, byte [esi]
mov ch, 0x6c
cmpsd dword [esi], dword es:[edi]
out dx, al
mov dword [0x70216452], edi
aaa
outsd dx, dword [esi]
nop
cli
xchg edi, eax
mov ah, byte [ebp + 0x55]
push esp
in eax, 0x16
xchg esp, eax
jg 0xdcff3fed
pop edx
cmpsd dword [esi], dword es:[edi]
dec edi
pop ss
ret
Function at 0x401e60
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x598
mov eax, dword [0x4bacc0]
xor eax, esp
mov dword [esp + 0x594], eax
mov eax, dword [esp + 0x5a8]
mov ecx, dword [esp + 0x5b4]
mov edx, dword [esp + 0x5b8]
push ebx
mov ebx, dword [esp + 0x5c0]
push ebp
mov ebp, dword [esp + 0x5b8]
push esi
mov esi, dword [esp + 0x5a8]
mov dword [esp + 0x3c], eax
xor eax, eax
cmp ebp, eax
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x5ac]
push edi
mov edi, dword [esp + 0x5b4]
mov dword [esp + 0x38], edx
mov dword [esp + 0x10], 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
je 0x401ef7
push 0x4000
push 0x160
lea edx, [esp + 0x4c]
push edx
push eax
push edi
call dword [0x49e2d0]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x2c], eax
jmp 0x401eff
mov dword [esp + 0x2c], 0xffffffff
mov ecx, dword [esp + 0x5b0]
push edi
push 0x49e5ac
add ecx, 1
push ecx
lea edx, [esp + 0x1b0]
push str.__02d_s_s
push edx
call dword [0x49e4bc]
mov edx, dword [esi + 0x19c]
mov edi, dword [0x49e4d4]
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x1007
lea eax, [esp + 0x1b0]
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], ebp
call edi
mov edx, dword [esi + 0x19c]
lea ecx, [esp + 0x10]
push ecx
mov eax, 1
push 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x48]
push 0x1006
push edx
mov dword [esp + 0x34], eax
call edi
mov eax, dword [esp + 0x5bc]
push eax
lea ecx, [esp + 0x1a8]
push 0x49e59c
push ecx
mov dword [esp + 0x24], 2
call dword [0x49e4bc]
mov ecx, dword [esi + 0x19c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0
push 0x1006
lea edx, [esp + 0x1b0]
push ecx
mov dword [esp + 0x34], edx
call edi
mov edx, dword [0x50a360]
push edx
lea eax, [esp + 0x1a8]
push ebp
push eax
mov dword [esp + 0x24], 3
call fcn.0046ee70
mov eax, dword [esi + 0x19c]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0
push 0x1006
lea ecx, [esp + 0x1b0]
push eax
mov dword [esp + 0x34], ecx
call edi
mov eax, dword [esi + 0x19c]
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x10]
push edx
push 0
push 0x1006
push eax
mov dword [esp + 0x28], 4
mov dword [esp + 0x34], ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 5
mov dword [esp + 0x24], ebx
push ecx
mov edx, dword [esi + 0x19c]
push 0
push 0x1006
push edx
call edi
cmp byte [ebx], 0
je 0x4020a8
cmp dword [esp + 0x5b0], 0
jne 0x4020a8
mov eax, dword [esi + 0x19c]
push 0
push 0
push 0x1004
push eax
call edi
cmp eax, 2
jne 0x4020a8
mov edx, dword [esi + 0x1a0]
push 0x400
lea ecx, [esp + 0x1a8]
push ecx
push 0x4d1
push edx
call dword [0x49e4b8]
cmp byte [esp + 0x1a4], 0
jne 0x4020a8
mov eax, dword [esi + 0x1a0]
push ebx
push 0x4d1
push eax
call dword [0x49e4c0]
mov eax, dword [esi + 0x19c]
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x10]
push edx
push 0
push 0x1006
push eax
mov dword [esp + 0x28], 6
mov dword [esp + 0x34], ecx
call edi
mov ecx, dword [esp + 0x5a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004810ab
add esp, 0x598
ret
Function at 0x4020f0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x4d4
mov eax, dword [0x4bacc0]
xor eax, esp
mov dword [esp + 0x4d0], eax
push ebp
mov ebp, dword [esp + 0x4e0]
push esi
mov esi, dword [esp + 0x4e0]
mov edx, dword [esi + 0x19c]
push edi
mov edi, dword [0x49e4d4]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x1005
lea eax, [esp + 0x2e8]
push edx
mov dword [esp + 0x20], 5
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], 0
mov dword [esp + 0x38], 0x200
mov dword [esp + 0x34], eax
call edi
lea eax, [esp + 0x2dc]
push 0x49e5ac
push eax
call fcn.004810c0
add eax, 3
lea edx, [esp + 0x1e4]
add esp, 8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402178
lea ecx, [esp + 0x1dc]
push ecx
call fcn.00475fe0
add esp, 4
cmp eax, 1
je 0x4021cf
push 0x49e5dc
push 0xc4
call fcn.0046d6b0
add esp, 4
push eax
push 0x49e5d8
lea edx, [esp + 0x1a8]
push str._s_s_s
push edx
call dword [0x49e4bc]
add esp, 0x14
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x402235
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x1ac]
push ecx
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x1f4]
push eax
call fcn.00466bd0
add esp, 0x1c
test eax, eax
jne 0x402231
push 0x49e5dc
push 0xae
call fcn.0046d6b0
add esp, 4
push eax
push 0x49e5d8
lea ecx, [esp + 0x1a8]
push str._s_s_s
push ecx
call dword [0x49e4bc]
add esp, 0x14
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x402235
mov eax, dword [esp + 0xc]
test eax, eax
mov dword [esp + 0x10], 6
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], eax
je 0x40227a
push 0x4000
push 0x160
lea edx, [esp + 0x44]
push edx
push 0
lea eax, [esp + 0x1ec]
push eax
call dword [0x49e2d0]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
jmp 0x402282
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esi + 0x19c]
lea edx, [esp + 0x10]
push edx
push 0
push 0x1006
push eax
call edi
lea edx, [esp + 0x10]
push edx
mov eax, 1
push 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x19c]
push 0x1006
lea ecx, [esp + 0x1a8]
push eax
mov dword [esp + 0x34], ecx
call edi
mov ecx, dword [0x50a360]
mov edx, dword [esp + 0xc]
push ecx
push edx
lea eax, [esp + 0x2e4]
push eax
mov dword [esp + 0x24], 3
call fcn.0046ee70
mov eax, dword [esi + 0x19c]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0
push 0x1006
lea ecx, [esp + 0x2e8]
push eax
mov dword [esp + 0x34], ecx
call edi
mov ecx, dword [esp + 0x4dc]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004810ab
add esp, 0x4d4
ret
Function at 0x40a7e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x408
mov eax, dword [0x4bacc0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
push ebp
mov ebp, dword [0x49e4c0]
push esi
mov esi, dword [esp + 0x418]
cmp byte [esi + 0x884], 0
lea ebx, [esi + 0x884]
je 0x40a924
push 0x14
call dword [0x49e4ac]
test ax, ax
js 0x40a832
push ebx
call fcn.004322c0
test eax, eax
jne 0x40a8dc
lea eax, [esp + 0x10]
push eax
push str.Type
push ebx
call fcn.00431e00
test eax, eax
jne 0x40a8dc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push 0x49e59c
push edx
call fcn.0048108c
add esp, 0xc
cmp dword [esp + 0xc], 0x25
je 0x40a872
mov dword [esp + 0xc], 0x199
jmp 0x40a8e4
lea eax, [esp + 0x10]
push eax
push str.Filename
push ebx
call fcn.00431e00
test eax, eax
jne 0x40a8dc
lea eax, [esp + 0x10]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40a890
sub eax, edx
cmp eax, 0x100
ja 0x40a8dc
push edi
lea eax, [esp + 0x14]
lea edi, [esi + 0x6f8]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x40a8b3
mov edx, dword [esi + 0x1a0]
push edi
push 0x4af
push edx
call ebp
push esi
call fcn.00462810
add esp, 4
test eax, eax
pop edi
jne 0x40a93c
mov dword [esp + 0xc], 0x19a
mov eax, dword [esi + 0x1b0]
push 0
push 0
push 0x402
push 0x407
push eax
call dword [0x49e4b4]
mov ecx, dword [esp + 0xc]
push 0x30
push 0x4dec98
push ebx
push ecx
call fcn.0046d6b0
mov edx, dword [esi + 0x18]
add esp, 8
push eax
push edx
call fcn.00470860
add esp, 0x10
mov byte [ebx], 0
lea eax, [esi + 0x6f8]
push eax
mov byte [eax], 0
mov eax, dword [esi + 0x1a0]
push 0x4af
push eax
call ebp
mov ecx, dword [esi + 0x1a0]
push 0
push 0x104af
push 0x111
push ecx
call dword [0x49e4d4]
push 0
push esi
call fcn.0045dd90
mov ecx, dword [esp + 0x418]
add esp, 8
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004810ab
add esp, 0x408
ret
Function at 0x410190
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x408
mov eax, dword [0x4bacc0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [0x49e4c0]
push esi
mov esi, dword [esp + 0x414]
cmp byte [esi + 0x884], 0
push edi
lea edi, [esi + 0x884]
je 0x41032a
push 0x14
call dword [0x49e4ac]
test ax, ax
js 0x4101e2
push edi
call fcn.004322c0
test eax, eax
jne 0x4102e2
lea eax, [esp + 0x10]
push eax
push str.Type
push edi
call fcn.00431e00
test eax, eax
jne 0x4102e2
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push 0x49e59c
push edx
call fcn.0048108c
add esp, 0xc
cmp dword [esp + 0xc], 0x20
je 0x410225
mov dword [esp + 0xc], 0x199
jmp 0x4102ea
lea eax, [esp + 0x10]
push eax
push str.Filename
push edi
call fcn.00431e00
test eax, eax
jne 0x4102e2
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x410244
sub eax, edx
cmp eax, 0x100
ja 0x4102e2
push ebx
lea eax, [esp + 0x14]
lea ebx, [esi + 0x6f8]
mov edx, ebx
mov ecx, eax
sub edx, ecx
jmp 0x410270
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x410270
mov edx, dword [esi + 0x1a0]
push ebx
push 0x4af
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push str.Async
push edi
call fcn.00432020
test eax, eax
pop ebx
jne 0x4102af
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4102b5
cmp eax, 1
jne 0x4102e2
jmp 0x4102b5
xor eax, eax
mov dword [esp + 0xc], eax
mov edx, dword [esi + 0x1a0]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x6a0], eax
push ecx
push 0x527
push edx
call dword [0x49e4b0]
push esi
call fcn.00462810
add esp, 4
test eax, eax
jne 0x410360
mov dword [esp + 0xc], 0x19a
mov eax, dword [esi + 0x1b0]
push 0
push 0
push 0x402
push 0x407
push eax
call dword [0x49e4b4]
mov ecx, dword [esp + 0xc]
push 0x30
push 0x4dec98
push edi
push ecx
call fcn.0046d6b0
mov edx, dword [esi + 0x18]
add esp, 8
push eax
push edx
call fcn.00470860
add esp, 0x10
mov byte [edi], 0
lea eax, [esi + 0x6f8]
push eax
mov byte [eax], 0
mov eax, dword [esi + 0x1a0]
push 0x4af
push eax
call ebp
mov ecx, dword [esi + 0x1a0]
push 0x527
push ecx
mov dword [esi + 0x6a0], 0
call fcn.004743a0
add esp, 8
mov edx, dword [esi + 0x1a0]
push 0
push 0x104af
push 0x111
push edx
call dword [0x49e4d4]
push 0
push esi
call fcn.0045dd90
mov ecx, dword [esp + 0x418]
add esp, 8
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.004810ab
add esp, 0x408
ret
Function at 0x420f70
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x408
mov eax, dword [0x4bacc0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [0x49e4c0]
push esi
mov esi, dword [esp + 0x414]
cmp byte [esi + 0x884], 0
push edi
lea edi, [esi + 0x884]
je 0x421165
push 0x14
call dword [0x49e4ac]
test ax, ax
js 0x420fc2
push edi
call fcn.004322c0
test eax, eax
jne 0x42111d
lea eax, [esp + 0x10]
push eax
push str.Type
push edi
call fcn.00431e00
test eax, eax
jne 0x42111d
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push 0x49e59c
push edx
call fcn.0048108c
add esp, 0xc
cmp dword [esp + 0xc], 0x21
je 0x421005
mov dword [esp + 0xc], 0x199
jmp 0x421125
lea eax, [esp + 0x10]
push eax
push str.Filename
push edi
call fcn.00431e00
test eax, eax
jne 0x42111d
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x421024
sub eax, edx
cmp eax, 0x100
ja 0x42111d
push ebx
lea eax, [esp + 0x14]
lea ebx, [esi + 0x6f8]
mov edx, ebx
mov ecx, eax
sub edx, ecx
jmp 0x421050
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x421050
mov edx, dword [esi + 0x1a0]
push ebx
push 0x4af
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push str.Blocking
push edi
call fcn.00432020
test eax, eax
pop ebx
jne 0x42111d
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x1a0]
push 0x800
push ecx
push 0x4a5
push edx
call fcn.00474940
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push str.RecType
push edi
call fcn.00432020
test eax, eax
jne 0x42111d
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x1a0]
push 0xb
push ecx
push 0x4a4
push edx
call fcn.00474940
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push 0x49e8a4
push edi
call fcn.00432020
test eax, eax
jne 0x42111d
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4210f2
cmp eax, 1
jne 0x42111d
mov edx, dword [esi + 0x1a0]
xor ecx, ecx
test eax, eax
setne cl
push ecx
push 0x4a8
push edx
call dword [0x49e4b0]
push esi
call fcn.00462810
add esp, 4
test eax, eax
jne 0x4211c5
mov dword [esp + 0xc], 0x19a
mov eax, dword [esi + 0x1b0]
push 0
push 0
push 0x402
push 0x407
push eax
call dword [0x49e4b4]
mov ecx, dword [esp + 0xc]
push 0x30
push 0x4dec98
push edi
push ecx
call fcn.0046d6b0
mov edx, dword [esi + 0x18]
add esp, 8
push eax
push edx
call fcn.00470860
add esp, 0x10
mov byte [edi], 0
lea eax, [esi + 0x6f8]
push eax
mov byte [eax], 0
mov eax, dword [esi + 0x1a0]
push 0x4af
push eax
call ebp
mov ecx, dword [esi + 0x1a0]
push 0
push 0
push 0x14e
push 0x4a5
push ecx
call dword [0x49e4b4]
mov edx, dword [esi + 0x1a0]
push 0
push 0x104a5
push 0x111
push edx
call dword [0x49e4d4]
mov eax, dword [esi + 0x1a0]
push 1
push 0x4a8
push eax
call dword [0x49e4b0]
push esi
call fcn.00420e70
push 0
push esi
call fcn.0045dd90
mov ecx, dword [esp + 0x41c]
add esp, 0xc
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.004810ab
add esp, 0x408
ret
Function at 0x42d1d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [0x4bacc0]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
mov ebx, dword [esp + 0x10c]
push 0x7b
call dword [0x49e4ac]
test ax, ax
jns 0x42d251
push esi
push edi
mov edi, dword [0x49e4bc]
mov esi, 0xf
mov byte [esp + 0xc], 0
jmp 0x42d210
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42d217
movzx ecx, byte [ebx + esi]
push ecx
sub eax, edx
lea edx, [esp + eax + 0x10]
push 0x49f4d4
push edx
call edi
add esp, 0xc
sub esi, 1
jns 0x42d210
push 0
push 0x49e5e0
lea eax, [esp + 0x14]
push eax
push 0
call dword [0x49e3c8]
pop edi
pop esi
mov ecx, dword [esp + 0x104]
pop ebx
xor ecx, esp
call fcn.004810ab
add esp, 0x104
ret
Function at 0x45e3f0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x108
mov eax, dword [0x4bacc0]
xor eax, esp
mov dword [esp + 0x104], eax
lea eax, [esp]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [0x49e014]
test eax, eax
je 0x45e433
xor eax, eax
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004810ab
add esp, 0x108
ret
cmp dword [esp + 0x10c], 0
je 0x45e49f
push 0x100
lea ecx, [esp + 8]
push ecx
push 0
call dword [0x49e194]
lea eax, [esp + 4]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x45e456
mov edx, dword [str.__IC]
mov cl, byte [0x4a1a58]
mov dword [eax], edx
mov byte [eax + 4], cl
lea eax, [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x45e478
sub eax, edx
push eax
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 1
push 0
push 0x4a19e0
push eax
call dword [0x49e01c]
jmp 0x45e4ae
mov ecx, dword [esp]
push 0x4a19e0
push ecx
call dword [0x49e038]
mov edx, dword [esp]
push edx
call dword [0x49e020]
mov ecx, dword [esp + 0x104]
xor ecx, esp
mov eax, 1
call fcn.004810ab
add esp, 0x108
ret

Function at 0x45e4e0
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAutoplayHandlersCancelAutoplayClsid
push 0x80000002
call dword [0x49e014]
test eax, eax
jne 0x45e51c
mov ecx, dword [esp]
push 1
push 0x49e5e0
push 1
push eax
push str.9E7BEACB_33F4_4c97_9775_239BB82C690E
push ecx
call dword [0x49e01c]
mov edx, dword [esp]
push edx
call dword [0x49e020]
pop ecx
ret

Function at 0x45e520
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push 1
push 5
push esi
push 0
call dword [0x49e2d4]
test eax, eax
jne 0x45e53c
mov dword [esi], 0x5c3a63
push esi
call fcn.00475fa0
add esp, 4
mov eax, 1
pop esi
ret

Function at 0x45e550
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [0x49e2d4]
push 1
push 0xd
push esi
push 0
call edi
test eax, eax
jne 0x45e593
push 1
push 5
push esi
push eax
call edi
test eax, eax
jne 0x45e593
push 1
push 0x35
push esi
push eax
call edi
test eax, eax
jne 0x45e593
push 1
push 0x2e
push esi
push eax
call edi
test eax, eax
jne 0x45e593
mov dword [esi], 0x5c3a63
push esi
call fcn.00475fa0
add esp, 4
pop edi
mov eax, 1
pop esi
ret