joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b5ec0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xa5]
test ecx, ecx
jne 0x5b604d
mov ecx, dword [ebp - 4]
call fcn.0041f6f0
nop
mov edx, dword [ebp - 4]
cmp dword [edx + 0xcc], 0
jne 0x5b5f15
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xcc], ecx
mov edx, dword [ebp - 4]
mov byte [edx + 0xa5], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x214]
mov dword [ebp - 8], edx
mov esi, esp
push 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edi, esp
mov ecx, dword [ebp - 0xc]
call dword [0x7f5aac]
cmp edi, esp
call fcn.00784930
mov ecx, dword [ebp - 4]
call dword [ebp - 0xc]
cmp esi, esp
call fcn.00784930
mov ecx, dword [ebp - 4]
add ecx, 0x130
mov esi, esp
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp esi, esp
call fcn.00784930
nop
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [eax + 0x1b8]
mov dword [ebp - 0x10], ecx
mov edi, esp
mov ecx, dword [ebp - 0x10]
call dword [0x7f5aac]
cmp edi, esp
call fcn.00784930
mov ecx, dword [ebp - 4]
call dword [ebp - 0x10]
cmp esi, esp
call fcn.00784930
and eax, 1
je 0x5b6000
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [eax + 0x1b8]
mov dword [ebp - 0x14], ecx
mov edi, esp
mov ecx, dword [ebp - 0x14]
call dword [0x7f5aac]
cmp edi, esp
call fcn.00784930
mov ecx, dword [ebp - 4]
call dword [ebp - 0x14]
cmp esi, esp
call fcn.00784930
and eax, 0x80
jne 0x5b6000
call fcn.00490d20
mov dword [ebp - 0x18], eax
push 0x7f86
mov ecx, dword [ebp - 0x18]
call fcn.0041ea30
mov esi, esp
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp esi, esp
call fcn.00784930
nop
mov edx, dword [ebp - 4]
add edx, 0x100
mov esi, esp
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp esi, esp
call fcn.00784930
nop
mov eax, dword [ebp - 4]
cmp dword [eax + 0x184], 0
je 0x5b6037
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x184]
call fcn.0052bb00
nop
jmp 0x5b604d
mov edx, dword [ebp - 4]
push edx
mov ecx, 0x8882d0
call fcn.005b3280
mov ecx, eax
call fcn.0052bb00
nop
pop edi
pop esi
add esp, 0x18
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 4
Function at 0x5d8400
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x5d8429
call fcn.004d7c10
nop
mov dword [ebp - 8], 0x811c9dc5
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0079f990
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, 0xa
div ecx
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x5d8463
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jae 0x5d8482
imul ecx, dword [ebp - 8], 0x1000193
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movsx eax, byte [edx]
xor ecx, eax
mov dword [ebp - 8], ecx
jmp 0x5d845a
mov eax, dword [ebp - 8]
add esp, 0x14
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 4
Function at 0x5e6f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x5e6fb4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x5e702d
mov esi, esp
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5e6fe2
call fcn.004b48f0
nop
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5e700b
call fcn.004b48f0
nop
mov esi, esp
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5e702d
call fcn.004b48f0
nop
call fcn.005d0240
cmp dword [eax + 0x3c], 0
je 0x5e7047
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.005e5810
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005e74f0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x88], 0
je 0x5e7089
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, esp
call fcn.00784930
mov eax, dword [ebp - 4]
mov dword [eax + 0x88], 0
cmp dword [ebp - 0x14], 0
je 0x5e70a1
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x88], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 8
Function at 0x5f89b0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7e7088
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
push esi
push edi
push ecx
lea edi, [ebp - 0x2b4]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x87fbc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x14
push eax
lea ecx, [ebp - 0x1c]
call fcn.00412700
mov dword [ebp - 4], 0
push 0
push 0x84fe80
lea ecx, [ebp - 0x1c]
call fcn.00476b10
cmp eax, 0xffffffff
jne 0x5f8b1c
push 0
push 0x7fbec8
lea ecx, [ebp - 0x1c]
call fcn.00476b10
cmp eax, 0xffffffff
jne 0x5f8b1c
push 0
push 0x7fbecc
lea ecx, [ebp - 0x1c]
call fcn.00476b10
cmp eax, 0xffffffff
jne 0x5f8b1c
mov ecx, dword [ebp - 0x14]
add ecx, 0x14
push ecx
lea ecx, [ebp - 0x134]
call fcn.00412700
mov byte [ebp - 4], 1
mov esi, esp
push 0
lea edx, [ebp - 0x128]
push edx
push 0x104
push 0
lea ecx, [ebp - 0x134]
call fcn.0040b730
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
cmp esi, esp
call fcn.00784930
test eax, eax
jne 0x5f8afd
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x2b0], edx
mov edi, esp
mov ecx, dword [ebp - 0x2b0]
call dword [0x7f5aac]
cmp edi, esp
call fcn.00784930
mov ecx, dword [ebp - 0x14]
call dword [ebp - 0x2b0]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0040bc80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040bc80
mov eax, dword [ebp - 0x2a4]
jmp 0x5f8bbe
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00411dd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0040bc80
nop
mov esi, esp
push 0x105
push 0x160
lea ecx, [ebp - 0x29c]
push ecx
push 0
lea ecx, [ebp - 0x1c]
call fcn.0040b730
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00784930
test eax, eax
je 0x5f8b6e
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 0x2a8], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040bc80
mov eax, dword [ebp - 0x2a8]
jmp 0x5f8bbe
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x2b4], edx
mov edi, esp
mov ecx, dword [ebp - 0x2b4]
call dword [0x7f5aac]
cmp edi, esp
call fcn.00784930
mov ecx, dword [ebp - 0x14]
call dword [ebp - 0x2b4]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040bc80
mov eax, dword [ebp - 0x2ac]
push edx
mov ecx, ebp
push eax
lea edx, [0x5f8bf8]
call fcn.007848d0
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00783b00
add esp, 0x2b4
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret
Function at 0x5fd740
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7d9f90
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x87fbc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x5fd7ac
push str.m_hKey___0
push 0x84e5d8
push 0
push 0x167f
push 0x7f9450
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x5fd7ac
int3
xor edx, edx
jne 0x5fd77e
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
je 0x5fd7d9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.004ebba0
jmp 0x5fd889
movzx eax, byte [0x888684]
test eax, eax
jne 0x5fd825
mov esi, esp
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5fd81e
mov esi, esp
push str.RegDeleteKeyExA
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00784930
mov dword [0x888680], eax
mov byte [0x888684], 1
cmp dword [0x888680], 0
je 0x5fd870
mov edx, dword [0x888680]
mov dword [ebp - 0x1c], edx
mov esi, esp
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov edi, esp
mov ecx, dword [ebp - 0x20]
call dword [0x7f5aac]
cmp edi, esp
call fcn.00784930
call dword [ebp - 0x20]
cmp esi, esp
call fcn.00784930
jmp 0x5fd889
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp esi, esp
call fcn.00784930
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 4

Function at 0x5fd8b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x5fd8ed
push str.m_hKey___0
push 0x84e5d8
push 0
push 0x16a8
push 0x7f9450
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x5fd8ed
int3
xor edx, edx
jne 0x5fd8bf
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp esi, esp
call fcn.00784930
pop esi
add esp, 4
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 4
Function at 0x5fdd40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x10], 0
jne 0x5fdd8a
push str.pnBytes___0
push 0x84e5d8
push 0
push 0x178f
push 0x7f9450
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x5fdd8a
int3
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
jne 0x5fddb8
push str.m_hKey___0
push 0x84e5d8
push 0
push 0x1790
push 0x7f9450
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x5fddb8
int3
xor eax, eax
jne 0x5fdd8a
mov esi, esp
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5fddf1
mov eax, dword [ebp - 8]
jmp 0x5fde00
cmp dword [ebp - 0x10], 3
je 0x5fddfe
mov eax, 0xd
jmp 0x5fde00
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x5fde24]
call fcn.007848d0
pop eax
pop edx
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5fde40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x5fde95
push str.m_hKey___0
push 0x84e5d8
push 0
push 0x1766
push 0x7f9450
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x5fde95
int3
xor edx, edx
jne 0x5fde67
mov dword [ebp - 0x10], 4
mov esi, esp
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5fded5
mov eax, dword [ebp - 8]
jmp 0x5fdee4
cmp dword [ebp - 0x1c], 4
je 0x5fdee2
mov eax, 0xd
jmp 0x5fdee4
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x5fdf08]
call fcn.007848d0
pop eax
pop edx
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 8
Function at 0x5fdf40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x5fdf95
push str.m_hKey___0
push 0x84e5d8
push 0
push 0x17a7
push 0x7f9450
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x5fdf95
int3
xor edx, edx
jne 0x5fdf67
cmp dword [ebp + 0x10], 0
jne 0x5fdfc5
push str.pnChars___0
push 0x84e5d8
push 0
push 0x17a8
push 0x7f9450
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x5fdfc5
int3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov esi, esp
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5fe00b
mov eax, dword [ebp - 8]
jmp 0x5fe06e
cmp dword [ebp - 0x10], 1
je 0x5fe01e
cmp dword [ebp - 0x10], 2
je 0x5fe01e
mov eax, 0xd
jmp 0x5fe06e
cmp dword [ebp + 0xc], 0
je 0x5fe064
cmp dword [ebp - 0x1c], 0
je 0x5fe055
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, 1
div ecx
test edx, edx
jne 0x5fe04c
mov edx, dword [ebp - 0x1c]
shr edx, 0
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax + edx - 1]
test ecx, ecx
je 0x5fe053
mov eax, 0xd
jmp 0x5fe06e
jmp 0x5fe064
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 0xc]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x5fe090]
call fcn.007848d0
pop eax
pop edx
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5ff070
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x5ff0ad
push str.m_hKey___0
push 0x84e5d8
push 0
push 0x1861
push 0x7f9450
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x5ff0ad
int3
xor edx, edx
jne 0x5ff07f
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 3
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, esp
call fcn.00784930
pop esi
add esp, 4
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5ff0f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x5ff12d
push str.m_hKey___0
push 0x84e5d8
push 0
push 0x1869
push 0x7f9450
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x5ff12d
int3
xor edx, edx
jne 0x5ff0ff
mov esi, esp
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, esp
call fcn.00784930
pop esi
add esp, 4
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 8
Function at 0x601290
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push edi
lea edi, [ebp - 0x134]
mov ecx, 0x4d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x87fbc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x60
jb 0x6012dc
cmp dword [ebp + 8], 0x69
ja 0x6012dc
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.00784930
cwde
and eax, 0x8000
je 0x601332
cmp dword [0x886fc4], 0
jne 0x601332
cmp dword [ebp + 8], 0x41
jb 0x6012f1
cmp dword [ebp + 8], 0x5a
jbe 0x60132a
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.00784930
movsx ecx, ax
and ecx, 0x8000
je 0x601317
mov eax, dword [ebp + 8]
jmp 0x601441
mov edx, dword [ebp + 8]
push edx
call fcn.007ae0f0
add esp, 4
jmp 0x601441
mov eax, dword [ebp + 8]
jmp 0x601441
xor eax, eax
mov word [ebp - 0xc], ax
mov esi, esp
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp esi, esp
call fcn.00784930
test eax, eax
je 0x60135e
mov dword [ebp - 0x12c], 1
jmp 0x601368
mov dword [ebp - 0x12c], 0
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0x11c], edx
cmp dword [ebp - 0x11c], 0
jne 0x601391
push 0x1f9
push str.D:_a_work1_s_src_vctoolsVC7LibsShipATLMFCSrcMFC_afxkeyboardmanager.cpp
call fcn.004053b0
test eax, eax
je 0x601391
int3
cmp dword [ebp - 0x11c], 0
jne 0x6013a0
call fcn.004d7c10
nop
xor ecx, ecx
jne 0x601338
call fcn.004f5f70
mov esi, esp
mov edx, dword [eax + 0x30]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 0x130], eax
mov esi, esp
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 0x134], eax
mov esi, esp
mov ecx, dword [ebp - 0x130]
push ecx
push 1
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ToAsciiEx]
cmp esi, esp
call fcn.00784930
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x124], al
mov byte [ebp - 0x123], 0
mov esi, esp
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
cmp esi, esp
call fcn.00784930
mov edx, 1
imul eax, edx, 0
movsx eax, byte [ebp + eax - 0x124]
push edx
mov ecx, ebp
push eax
lea edx, [0x601474]
call fcn.007848d0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00783b00
add esp, 0x134
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 4
Function at 0x603c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
call fcn.00603ed0
test eax, eax
jne 0x603cb3
jmp 0x603d99
cmp dword [0x87f518], 0xfffffffe
jne 0x603d7d
cmp dword [ebp + 8], 0xffffffff
jne 0x603ccb
jmp 0x603d99
mov ecx, 0x8886b0
call fcn.00633aa0
nop
cmp dword [0x8886d4], 0
jne 0x603ce8
mov dword [ebp - 8], 1
jmp 0x603cef
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x603d0c
push 0x56
push str.D:_a_work1_s_src_vctoolsVC7LibsShipATLMFCSrcMFC_afxsound.cpp
call fcn.004053b0
test eax, eax
je 0x603d0c
int3
cmp dword [ebp - 4], 0
jne 0x603d18
call fcn.004d7c10
nop
xor edx, edx
jne 0x603cd6
push 0
push 0
push 0x603db0
call fcn.007a3e00
add esp, 0xc
mov dword [0x8886d4], eax
cmp dword [0x8886d4], 0
jbe 0x603d66
cmp dword [0x8886d4], 0xffffffff
je 0x603d66
mov esi, esp
push 0xffffffffffffffff
mov eax, dword [0x8886d4]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp esi, esp
call fcn.00784930
mov ecx, dword [ebp + 8]
mov dword [0x87f518], ecx
jmp 0x603d70
mov dword [0x8886d4], 0
mov ecx, 0x8886b0
call fcn.00633b80
nop
jmp 0x603d99
mov edx, dword [ebp + 8]
mov dword [0x87f518], edx
cmp dword [0x87f518], 0xffffffff
jne 0x603d99
mov dword [0x8886d4], 0
pop esi
add esp, 8
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret
Function at 0x6314a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x631571
mov esi, esp
push 0x8190b4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x63150e
push str.hKernel32___0
push 0x84e5d8
push 0
push 0x197
push str.D:_a_work1_s_src_vctoolsVC7LibsShipATLMFCInclude_atltransactionmanager.h
push 2
call fcn.00790e50
add esp, 0x18
cmp eax, 1
jne 0x63150e
int3
cmp dword [ebp - 8], 0
jne 0x631518
xor eax, eax
jmp 0x631591
mov esi, esp
push str.DeleteFileTransactedA
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x63156f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edi, esp
mov ecx, dword [ebp - 0x14]
call dword [0x7f5aac]
cmp edi, esp
call fcn.00784930
call dword [ebp - 0x14]
cmp esi, esp
call fcn.00784930
jmp 0x631591
jmp 0x63158f
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x63158f
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.00784930
jmp 0x631591
xor eax, eax
pop edi
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 4