joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422cf1
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x56b456
call fcn.00566548
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040260e
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.0040260e
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040260e
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0040260e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0040260e
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
mov byte [esi + 0x3c], 0
call fcn.0040260e
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x422dae
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56b4e4
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x3c]
mov dword [esi], 0x579c0c
mov dword [esi + 4], 0x579c30
mov dword [esi + 8], 0x579c44
mov dword [esi + 0xc], 0x579c58
mov dword [esi + 0x10], 0x579c68
mov dword [esi + 0x14], 0x579c8c
mov dword [esi + 0x18], 0x579ca8
mov dword [esi + 0x1c], 0x579cb8
mov dword [esi + 0x20], 0x579cc8
mov dword [esi + 0x2a], 0x1000000
mov byte [esi + 0x2e], bl
mov word [esi + 0x30], bx
mov word [esi + 0x38], bx
call fcn.0040260e
lea ecx, [esi + 0x48]
mov dword [ebp - 4], ebx
call fcn.0040260e
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.0040260e
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x78], ebx
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 4
mov dword [esi + 0x94], ebx
mov word [esi + 0x98], bx
call fcn.0040260e
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 5
call fcn.0040260e
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 6
call fcn.0040260e
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 7
call fcn.0040260e
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 8
call fcn.0040260e
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 9
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x422ed4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56b500
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
lea ecx, [esi + 0x18]
mov word [esi + 4], bx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00417018
lea ecx, [esi + 0x30]
call fcn.0040260e
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x422fdc
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x56b52f
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.0040260e
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040260e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov word [esi + 0x24], bx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42488f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56b777
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea ecx, [esi + 0x38]
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
call fcn.00422d86
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.004193d4
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x426d99
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56bab3
call fcn.00566548
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
call fcn.0040260e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00426d50
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x426e63
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56babf
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.00426f0a
lea ecx, [esi + 0x78]
call fcn.00426f0a
push dword [esi + 0x30]
call fcn.0056651e
push dword [esi + 0x24]
call fcn.0056651e
push dword [esi + 0x18]
call fcn.0056651e
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x426ebd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x426ed1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x426ee5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x426ef8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x426f5c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56a5b0
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
call fcn.00432aaa
lea ecx, [esi + 0x30]
call fcn.00426f0a
push dword [esi + 0x24]
call fcn.0056651e
pop ecx
lea ecx, [esi + 0xc]
call fcn.0040591a
mov ecx, esi
call fcn.00426e29
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x42835c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x56bc0d
call fcn.00566548
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
mov dword [edi], eax
lea ecx, [edi + 0x10]
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x10]
push eax
call fcn.00402516
and dword [ebp - 4], 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.004282ae
mov eax, dword [esi + 0x28]
lea ecx, [edi + 0x34]
mov dword [edi + 0x28], eax
mov al, byte [esi + 0x2c]
mov byte [edi + 0x2c], al
mov al, byte [esi + 0x2d]
mov byte [edi + 0x2d], al
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
lea eax, [esi + 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.00428305
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42854d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56bc82
call fcn.00566548
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
xor edi, edi
mov dword [esi], fcn.0042aaca
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.0040260e
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42cf4f
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x56c12e
call fcn.00566548
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push edi
mov ecx, dword [esi]
mov dword [ebx], ecx
test ecx, ecx
je 0x42cf73
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 4]
and dword [ebp - 4], 0
mov dword [ebx + 4], ecx
test ecx, ecx
je 0x42cf87
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 8]
mov byte [ebp - 4], 1
mov dword [ebx + 8], ecx
test ecx, ecx
je 0x42cf9b
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 0xc]
mov byte [ebp - 4], 2
mov dword [ebx + 0xc], ecx
test ecx, ecx
je 0x42cfaf
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.00402516
lea eax, [esi + 0x24]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebx + 0x24]
call fcn.00402516
lea eax, [esi + 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebx + 0x30]
call fcn.00402516
mov eax, dword [esi + 0x3c]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
add esi, 0x44
mov dword [ebx + 0x40], eax
mov byte [ebp - 4], 6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], ecx
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], ecx
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
mov dword [ebx + 0x70], eax
lea eax, [esi + 0x78]
mov dword [ebx + 0x74], ecx
lea ecx, [ebx + 0x78]
push eax
call fcn.0042d134
lea eax, [esi + 0xa8]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebx + 0xa8]
call fcn.0042d134
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi + 0xdc]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, ebx
mov dword [ebx + 0xdc], ecx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42d0ae
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56c12e
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov dword [esi + 0x11], ebx
mov word [esi + 0x15], bx
mov byte [esi + 0x17], bl
call fcn.0040260e
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.0040260e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.0040260e
xor eax, eax
mov byte [ebp - 4], 6
lea ecx, [esi + 0x78]
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], eax
call fcn.00426d50
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.00426d50
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42d23c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56c181
call fcn.00566548
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [edi + 0x14], eax
mov dword [edi], 0x57a14c
mov dword [edi + 4], 0x57a160
mov dword [edi + 8], 0x57a174
mov dword [edi + 0xc], 0x57a184
mov dword [edi + 0x10], 0x57a194
mov word [edi + 0x18], ax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [ebp - 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 2
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
call fcn.0040260e
lea ecx, [edi + 0x54]
mov byte [ebp - 4], 3
call fcn.0040260e
lea esi, [edi + 0x60]
mov byte [ebp - 4], 4
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00407fd5
lea ecx, [esi + 0x28]
call fcn.0040260e
lea ecx, [edi + 0x98]
mov byte [ebp - 4], 5
call fcn.0041b41f
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42d2ee
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x56c1b3
call fcn.00566548
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [edi], eax
lea ecx, [edi + 0x10]
mov dword [edi + 4], edx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi + 8], eax
lea eax, [esi + 0x10]
push eax
mov dword [edi + 0xc], edx
call fcn.00402516
and dword [ebp - 4], 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.00402516
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
lea eax, [esi + 0x30]
mov dword [edi + 0x2c], ecx
lea ecx, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402516
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x3c]
call fcn.00402516
mov al, byte [esi + 0x48]
mov byte [edi + 0x48], al
mov al, byte [esi + 0x49]
mov byte [edi + 0x49], al
mov al, byte [esi + 0x4a]
mov byte [edi + 0x4a], al
mov al, byte [esi + 0x4b]
mov byte [edi + 0x4b], al
mov al, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
mov al, byte [esi + 0x4d]
mov byte [edi + 0x4d], al
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], ecx
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x64]
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], ecx
mov eax, dword [esi + 0x68]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x68], eax
mov al, byte [esi + 0x6c]
mov byte [edi + 0x6c], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x446449
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x56dc19
call fcn.00566548
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x57bee8
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.0040260e
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040260e
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0040260e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44814d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56de0c
call fcn.00566548
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x57bfc8
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.0040260e
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.0040260e
or dword [esi + 0x64], 0xffffffff
mov word [esi + 0x60], bx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 5
call fcn.0040260e
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 6
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x448228
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x56de54
call fcn.00566548
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x57bf90
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.0040260e
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040260e
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4494cc
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
mov edx, ecx
cmp edx, 8
je 0x44950f
cmp edx, 0x52
je 0x4494fe
cmp ecx, 0x76
jne 0x44950b
mov ecx, esi
call fcn.00448f61
jmp 0x449516
test al, al
je 0x44950b
mov ecx, esi
call fcn.00449d9f
jmp 0x449516
xor al, al
jmp 0x449518
mov ecx, esi
call fcn.0044979c
mov al, 1
pop esi
ret 4
Function at 0x449f48
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56e04f
call fcn.00566548
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi], 0x57c0f8
mov dword [ebp - 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 3
mov byte [esi + 0x59], al
call fcn.0040260e
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 4
call fcn.0040260e
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 5
call fcn.0040260e
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 6
call fcn.0040260e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x44b2d6
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x56e1fd
call fcn.00566548
sub esp, 0x2c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x12
mov edi, ecx
call esi
movzx ebx, ax
shr ebx, 0xf
push 0x11
and bl, 1
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x10
mov dword [ebp - 0x14], eax
call esi
push 2
push 0xffffffffffffffff
shr eax, 0xf
push 0x100c
push dword [edi + 0x20]
and eax, 0xffffff01
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
test esi, esi
js 0x44b44d
push 2
push esi
push 0x100c
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jns 0x44b44d
push esi
mov ecx, edi
call fcn.0044a66b
cmp eax, 0xffffffff
jne 0x44b367
mov ecx, edi
call fcn.0044b727
jmp 0x44b44d
shl eax, 5
add eax, dword [edi + 8]
mov ecx, dword [eax]
mov eax, dword [edi + 0x14]
mov edx, dword [eax + ecx*4]
test bl, bl
je 0x44b386
push edx
mov ecx, edi
call fcn.0044c646
jmp 0x44b44d
mov ecx, dword [edx + 0x20]
mov eax, ecx
shr eax, 0xa
test al, 1
je 0x44b3a5
mov edx, dword [str.link_openning_was_blocked_by_7_Zip]
mov ecx, dword [edi + 4]
call fcn.00445fbb
jmp 0x44b44d
mov bl, 1
shr ecx, 4
test bl, cl
je 0x44b3bc
cmp byte [ebp - 0x10], 0
je 0x44b3ba
cmp byte [ebp - 0x14], 0
je 0x44b3bc
xor bl, bl
lea eax, [edx + 0x28]
push eax
lea edx, [edi + 0x68]
lea ecx, [ebp - 0x2c]
call fcn.00402987
and dword [ebp - 4], 0
test bl, bl
je 0x44b3eb
push dword [edi + 4]
lea edx, [ebp - 0x2c]
lea ecx, [edi + 0x68]
call fcn.0044c7a5
push dword [ebp - 0x2c]
call fcn.0056651e
jmp 0x44b44c
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00402516
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00406049
lea ecx, [ebp - 0x38]
call fcn.0040260e
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.0044baf7
push dword [ebp - 0x38]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.0056651e
pop ecx
test esi, esi
je 0x44b43b
push dword [ebp - 0x20]
mov ecx, dword [edi + 4]
mov edx, esi
call fcn.0044a6d3
push dword [ebp - 0x20]
call fcn.0056651e
push dword [ebp - 0x2c]
call fcn.0056651e
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x44b45c
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 0xc]
shr eax, 0xf
and al, 1
movzx edx, word [ecx + 0xc]
mov ecx, edx
sub ecx, 8
je 0x44b4e0
sub ecx, 0x26
je 0x44b4d7
sub ecx, 0x13
je 0x44b4c9
sub ecx, 0x11
je 0x44b4c1
push 2
pop edi
sub ecx, 0x20
je 0x44b49c
sub ecx, edi
je 0x44b49c
sub ecx, 1
jne 0x44b4c5
test al, al
je 0x44b4c5
xor eax, eax
cmp edx, 0x74
jne 0x44b4aa
inc eax
jmp 0x44b4b0
cmp edx, 0x75
cmove eax, edi
push eax
mov ecx, esi
call fcn.0044a1ea
mov ecx, esi
call fcn.0044c59c
jmp 0x44b4e7
test al, al
jne 0x44b4b8
xor al, al
jmp 0x44b4e9
test al, al
je 0x44b4c5
lea ecx, [esi + 0x20]
call fcn.0044c5fb
jmp 0x44b4e7
mov ecx, esi
call fcn.0044ace3
jmp 0x44b4e7
mov ecx, esi
call fcn.0044b727
mov al, 1
pop edi
pop esi
ret 4