joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437210
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a4fa
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x556754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.0040b050
mov ecx, eax
test ecx, ecx
je 0x4373d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.0040b050
mov ecx, eax
test ecx, ecx
je 0x4373de
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.0040b050
mov ecx, eax
test ecx, ecx
je 0x4373e8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x4372f2
xor ecx, ecx
jmp 0x437310
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437300
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040b860
push edi
mov ecx, ebx
call fcn.00408da0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x43732c
xor ecx, ecx
jmp 0x437344
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437334
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.0040b860
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00437c00
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00408da0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x437385
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4373be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4373be
cmp dword [esi + 0x10], 0
je 0x4373b5
push dword [edi]
call fcn.004e66f0
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00404b30
push 0x80004005
call fcn.00404b30
push 0x80004005
call fcn.00404b30
int3
Function at 0x437a00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x556754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x437bd4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x437a55
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x437bd4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x437a73
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x437bd4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x437a91
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x437bd4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x437aaf
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x437bd4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x437bd4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x437ad4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x437b07
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x437b1f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x437b5d
mov esi, ecx
mov eax, Ordinal_1
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.0040bce0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.004d5380
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x51a304
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00438680
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437b8b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x437bc4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x437bc4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.004366f8
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.00408670
lea ecx, [ebp - 0x28]
call fcn.00408670
lea ecx, [ebp - 0x34]
call fcn.004374a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5d96
mov esp, ebp
pop ebp
ret 4
Function at 0x437f70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a6a7
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x556754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x437fba
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437fc6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.0040c140
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x438033
push 0x48
call fcn.004b58fc
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x438027
push 0x48
push 0
push ebx
call fcn.004d5900
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00437210
jmp 0x438029
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438060
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040c140
push 3
push 0x51a304
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0041eb80
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4380af
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x4380fe
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4380fe
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.0040c140
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.00408670
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x438134
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43812a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438171
push edx
push ecx
call fcn.004b592c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x438153
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5d96
mov esp, ebp
pop ebp
ret 0x14
call fcn.004d899e
int3
Function at 0x438ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a7a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x556754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004b58fc
mov edi, eax
add esp, 4
test edi, edi
je 0x438b83
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00430751
add esp, 4
mov dword [edi + 4], eax
jmp 0x438b85
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00407510
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x438be5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x438be5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x438c09
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x438c2b
cmp byte [ebp + 0xc], 0
je 0x438c18
push esi
call fcn.00430e2a
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x438c37
mov esi, str.ios_base::badbit_set
jmp 0x438c47
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040c6c0
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00408290
push 0x545b78
lea eax, [ebp - 0x30]
push eax
call fcn.004d4f53
int3
Function at 0x439280
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x43928f
pop ebp
jmp fcn.0043a010
xor eax, eax
pop ebp
ret 0xc
Function at 0x43a1f0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50aa93
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x556754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x43a295
cmp word [esi], di
je 0x43a295
test eax, eax
je 0x43a251
cmp word [eax], di
je 0x43a251
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x43a295
jmp 0x43a290
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004d5900
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x43a295
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x43a30c
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x43a2f7
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x43a2c5
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x43a2e6
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x43a32c
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x43a2f7
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x43a30c
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5d96
mov esp, ebp
pop ebp
ret 0x30
call fcn.00430538
int3
Function at 0x43ad80
Capabilities:
Check if file exists
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x549a90
push 0x4d5bd0
mov eax, dword fs:[0]
push eax
sub esp, 0x57c
mov eax, dword [0x556754]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
test esi, esi
je 0x43aef3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43aef3
push 0x118
push 0
lea eax, [ebp - 0x544]
push eax
call fcn.004d5900
add esp, 0xc
mov dword [ebp - 0x548], 0x11c
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x544], 6
jae 0x43ae13
mov eax, 1
jmp 0x43aef5
mov dword [ebp - 0x588], 0x10
mov dword [ebp - 0x584], esi
mov dword [ebp - 0x580], 0
mov dword [ebp - 0x57c], 0
mov dword [ebp - 0x42c], 0xaac56b
mov dword [ebp - 0x428], 0x11d0cd44
mov dword [ebp - 0x424], 0xc000c28c
mov dword [ebp - 0x420], 0xee95c24f
xor eax, eax
mov dword [ebp - 0x578], 0x30
mov dword [ebp - 0x574], eax
mov dword [ebp - 0x570], eax
mov dword [ebp - 0x56c], 2
mov dword [ebp - 0x568], eax
mov dword [ebp - 0x564], 1
mov dword [ebp - 0x55c], 1
mov dword [ebp - 0x558], eax
mov dword [ebp - 0x554], eax
or eax, 0x1080
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x54c], 0
lea eax, [ebp - 0x588]
mov dword [ebp - 0x560], eax
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
je 0x43af11
cmp eax, 0x800b0101
je 0x43af11
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004b5d96
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x558]
call sub.WINTRUST.dll_WTHelperProvDataFromStateData
test eax, eax
je 0x43afc7
cmp dword [eax + 0x40], 0
jbe 0x43afc7
mov eax, dword [eax + 0x44]
test eax, eax
je 0x43afc7
mov eax, dword [eax + 0x28]
test eax, eax
je 0x43afc7
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43afc7
cmp dword [eax + 0xc], 0
jbe 0x43afc7
mov eax, dword [ecx]
test eax, eax
je 0x43afc7
cmp dword [eax + 0xc], 0
jbe 0x43afc7
mov eax, dword [eax + 0x10]
test eax, eax
je 0x43afc7
mov eax, dword [eax]
test eax, eax
je 0x43afc7
mov esi, dword [eax + 4]
test esi, esi
je 0x43afc7
push 0x400
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.004d5900
add esp, 0xc
push 0x200
lea eax, [ebp - 0x41c]
push eax
push 0
push 0
push 4
push esi
call dword [sym.imp.CRYPT32.dll_CertGetNameStringW]
dec eax
cmp eax, 0x1fe
ja 0x43afc7
lea eax, [ebp - 0x41c]
push eax
call fcn.0043b040
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
mov dword [ebp - 0x58c], edi
mov esi, dword [ebp - 0x558]
push 0x30
push 0
lea eax, [ebp - 0x578]
push eax
call fcn.004d5900
add esp, 0xc
mov dword [ebp - 0x578], 0x30
mov dword [ebp - 0x558], esi
mov dword [ebp - 0x55c], 2
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
call sub.WINTRUST.dll_WinVerifyTrust
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x43aef5
Function at 0x43ea30
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x43ea55
or esi, 1
push 1
call edi
test ax, ax
jns 0x43ea61
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x43ea6d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x43ea79
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4408d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0x17c]
call fcn.0043c0e0
mov edi, dword [ebp + 8]
test eax, eax
jle 0x44092b
nop
push esi
lea ecx, [ebx + 0x17c]
mov byte [ebp + 0xb], 0
call fcn.0043b920
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x440a5c
lea ecx, [ebx + 0x17c]
inc esi
call fcn.0043c0e0
cmp esi, eax
jl 0x4408f0
sub edi, 0x100
je 0x4409f1
sub edi, 4
je 0x440992
sub edi, 2
jne 0x4409e6
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call fcn.004e6698
mov ecx, dword [ebx + 0x54]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x8000000a
push edx
push 0x441ea0
call dword [eax + 0x144]
mov esi, eax
test esi, esi
je 0x4409e6
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x134]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x58], 0
je 0x4409e6
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [ebx + 0x6c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x70]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.0043ea30
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x58]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + pe_nt_image_headers32]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4409e6
mov ecx, dword [ebx + 0x58]
test ecx, ecx
je 0x440a43
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
call eax
test al, al
je 0x440a43
mov ecx, dword [ebx + 0x58]
mov eax, dword [ecx]
mov eax, dword [eax + 0x114]
call eax
test al, al
je 0x440a43
mov ecx, dword [ebx + 0x58]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.004d4ce8
add esp, 8
test eax, eax
je 0x440a43
mov ecx, dword [ebx + 0x58]
call fcn.00452950
test al, al
jne 0x4409e6
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, ebx
setns al
movzx eax, al
push eax
call fcn.00441610
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4428e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
push 4
mov dword [ebp - 8], edi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov edi, dword [edi + 4]
xorps xmm0, xmm0
push edi
movups xmmword [ebp - 0x24], xmm0
xor ebx, ebx
mov dword [ebp - 0xc], 0
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4429b6
nop dword [eax]
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4429b6
cmp dword [ebp - 0x20], 0x10
jne 0x44297a
cmp dword [ebp - 0x24], edi
jne 0x44297a
mov eax, dword [ebp - 0x1c]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov ebx, 1
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
call fcn.00441b70
test al, al
jne 0x4429a1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x20], 0x12
je 0x4429b6
test ebx, ebx
jne 0x4429b6
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x442940
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x20], 0x12
pop edi
pop esi
pop ebx
jne 0x4429d8
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x454250
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x594], 0
je 0x4542bd
cmp dword [ebp + 8], 0x100
jne 0x4542ad
cmp word [ebp + 0xc], 0xd
jne 0x4542ad
cmp byte [esi + 0x59a], 0
je 0x45428e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4542ad
cmp byte [esi + 0x59b], 0
jne 0x4542ad
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x4542a6
push 0
push 0
push 0
push str.return
push esi
call fcn.00440f30
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x594]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x45b100
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bf28
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x556754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.00423700
mov edi, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
jb 0x45b145
mov eax, dword [edi]
push dword [esi + 0xc]
push eax
lea eax, [ebp - 0x10]
push str.AddTabWebViewCount__group_id:_s_total_size:_d
push eax
call fcn.00409580
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esi, 8
lea eax, [ebp - 0x14]
push edi
push eax
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0045bd00
mov eax, dword [esi]
mov esi, dword [ebp - 0x14]
mov dword [ebp + 8], eax
cmp esi, eax
je 0x45b195
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 0x10]
push eax
push edi
call fcn.0045b080
test al, al
mov eax, dword [ebp + 8]
je 0x45b197
mov esi, eax
cmp esi, eax
je 0x45b1bf
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
cmp dword [edi + 0x14], 8
jb 0x45b1aa
mov edi, dword [edi]
push eax
push edi
lea eax, [ebp - 0x10]
push str.AddTabWebViewCount__group_id:_s_count:_d
push eax
call fcn.00409580
add esp, 0x10
jmp 0x45b1e5
movups xmm0, xmmword [edi]
sub esp, 0x18
mov eax, esp
push str.AddTabWebViewCount__group_id:_s_Not_Found
movups xmmword [eax], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [eax + 0x10], xmm0
lea eax, [ebp - 0x10]
push eax
call fcn.00409580
add esp, 0x20
mov esi, dword [ebp - 0x10]
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call eax
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45b20f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4