joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409970
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x218
mov edx, dword [esp + 0x21c]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edi
mov eax, dword [edi]
push ecx
push 0x2001f
push 0
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4099d0
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4099c0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
mov esi, eax
test eax, eax
mov dword [esp + 8], ecx
je 0x4099f0
jmp 0x4099d4
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x409a93
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x218
ret 4
lea eax, [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push 0
push 0
lea edx, [esp + 0x18]
push 0
lea eax, [esp + 0x30]
push edx
push eax
push 0
push ecx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
jne 0x409a5a
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0xc]
call fcn.00409970
mov edi, eax
test edi, edi
jne 0x409aa0
lea edx, [esp + 0x18]
lea ecx, [esp + 0x20]
push edx
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
je 0x409a1c
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 8]
test eax, eax
je 0x409a71
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x224]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x409a93
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x218
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x409aaf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 0x218
ret 4
Function at 0x40df20
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 8
Function at 0x40e310
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x218
mov eax, dword [0x553d9c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x20], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x24]
xor ebx, ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
push ecx
push 0x5422f4
push 1
push ebx
push 0x542394
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebp, dword [esp + 0x234]
mov esi, dword [esp + 0x22c]
test eax, eax
jl 0x40e432
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push 0x5423c4
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl 0x40e432
mov ecx, dword [esp + 0x244]
mov eax, dword [esp + 0x10]
cmp ecx, ebx
mov edx, dword [eax]
jne 0x40e3a3
push esi
push eax
call dword [edx + 0x50]
jmp 0x40e3a8
push ecx
push eax
call dword [edx + 0x14]
cmp eax, ebx
jl 0x40e432
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x238]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jl 0x40e432
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x23c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jl 0x40e432
mov eax, dword [esp + 0x18]
push 1
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x240]
push ecx
push esi
mov edx, dword [eax]
push eax
call dword [edx + 0x44]
test eax, eax
jl 0x40e432
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x24]
mov edx, dword [eax]
push 0x104
push ecx
push eax
call dword [edx + 0x40]
test eax, eax
jl 0x40e432
mov eax, dword [esp + 0x18]
push 1
push ebp
push eax
mov edx, dword [eax]
mov dword [esp + 0x20], 1
call dword [edx + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x40e440
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40e44e
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [0x546564]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esi - 0xc]
cmp eax, ecx
je 0x40e474
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x40e474
push esi
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x230]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40e49b
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x40e49b
push esi
call fcn.00531732
add esp, 4
mov eax, dword [0x546564]
lea edx, [ebp - 0xc]
cmp edx, eax
je 0x40e4ba
lea esi, [ebp - 0xc]
push esi
call edi
test eax, eax
jg 0x40e4ba
push esi
call fcn.00531732
add esp, 4
mov esi, dword [esp + 0x238]
mov ecx, dword [0x546564]
lea eax, [esi - 0xc]
cmp eax, ecx
je 0x40e4e1
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x40e4e1
push esi
call fcn.00531732
add esp, 4
mov esi, dword [esp + 0x23c]
mov eax, dword [0x546564]
lea ecx, [esi - 0xc]
cmp ecx, eax
je 0x40e507
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x40e507
push esi
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
Function at 0x40e770
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov edx, dword [0x553d9c]
push esi
mov esi, ecx
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x410]
mov dword [esp + 0x40c], edx
rep stosd dword es:[edi], eax
mov ecx, 0xff
lea edi, [esp + 0x10]
mov dword [esp + 0xc], edx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x40e7ca
mov ecx, dword [esi + 4]
lea eax, [esp + 8]
push eax
push 2
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push eax
jmp 0x40e7e5
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push ecx
push 0x17
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea edx, [esp + 0xc]
lea eax, [esp + 0x40c]
push edx
push 0x546e2c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 4]
add esp, 0xc
push eax
push 0x3e9
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x814]
mov eax, dword [esp + 0x810]
push edx
push eax
mov ecx, esi
call fcn.0040e520
pop edi
pop esi
add esp, 0x804
ret 8
Function at 0x40eaa0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
mov eax, dword [0x5468e4]
push esi
cmp eax, 0xffffffff
jne 0x40eb48
lea eax, [esp + 4]
xor esi, esi
push eax
push 0x20006
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.SHELL32.dll_SHChangeNotifyRegister
mov dword [0x5468e4], 0
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40eae3
mov esi, dword [esp + 4]
call dword [sym.imp.WINMM.dll_timeGetTime]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str._________ADMIN_TEST_SoftwareOK
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40eb22
test esi, esi
mov dword [0x5468e4], 0
je 0x40eb1d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret
push str._________ADMIN_TEST_SoftwareOK
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
mov dword [0x5468e4], 1
je 0x40eb43
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x410430
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x410474
mov eax, dword [esp + 4]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41046f
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41046f
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
xor eax, eax
ret 4
test al, 1
je 0x41049a
mov eax, dword [esp + 4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
lea ecx, [esp + 4]
jne 0x41049e
call fcn.00405700
xor eax, eax
ret 4
lea ecx, [esp + 4]
call fcn.00405700
mov eax, 1
ret 4
Function at 0x4116c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x553d94]
mov ecx, dword [esp + 4]
push esi
push 2
mov esi, dword [eax + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ax, word [eax + 0xe]
pop esi
ret
Function at 0x4128d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov bl, 1
mov eax, dword [esi + 0x50]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
jne 0x41292d
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 4]
mov dword [esp + 0x10], eax
push edx
mov dword [esp + 0x18], 0xfffffffe
call edi
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [esp + 0xc]
push ecx
push edi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
shr eax, 2
test al, 1
je 0x41296a
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esi + 4]
and edi, 0xffff
push ecx
push edi
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 0x24]
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x4129a1
mov al, byte [esi + 0x54]
push 1
or al, 2
push 0
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x414460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov al, 0x6c
push ebx
mov byte [esp + 0x11], al
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
mov eax, dword [0x546560]
lea ecx, [esp + 0xc]
push ebp
xor ebx, ebx
push esi
test ecx, ecx
push edi
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x65
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], bl
mov dword [esp + 0x10], eax
je 0x414525
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
cmp esi, ebx
je 0x414525
lea eax, [esi + esi + 0xe]
push eax
call fcn.00531ba5
add esp, 4
cmp eax, ebx
je 0x414525
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], bx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
lea ecx, [esi + 1]
add eax, 0xc
cmp ecx, ebx
mov dword [esp + 0x10], eax
mov esi, eax
jne 0x414500
cmp eax, ebx
jne 0x41451a
push ecx
push eax
lea ecx, [esp + 0x20]
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jle 0x41451a
mov word [esi + eax*2 - 2], bx
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00405bb0
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edx
call ebp
mov edx, dword [0x546564]
mov esi, eax
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x414563
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x414563
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, ebx
je 0x4145e5
mov al, 0x67
mov cl, 0x73
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], al
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0x49
push eax
push esi
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], 0x44
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], 0x62
mov byte [esp + 0x35], 0x75
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x72
mov byte [esp + 0x3a], 0x50
mov byte [esp + 0x3b], 0x72
mov byte [esp + 0x3c], 0x65
mov byte [esp + 0x3d], cl
mov byte [esp + 0x3e], 0x65
mov byte [esp + 0x3f], 0x6e
mov byte [esp + 0x40], 0x74
mov byte [esp + 0x41], bl
call edi
cmp eax, ebx
je 0x4145e5
call eax
test eax, eax
je 0x4145e5
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
push str.ntdll.dll
mov dword [esp + 0x18], ebx
call ebp
cmp eax, ebx
je 0x41462c
push str.NtQueryInformationProcess
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x41462c
push ebx
lea ecx, [esp + 0x18]
push 4
push ecx
push 7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x41462c
cmp dword [esp + 0x14], ebx
je 0x41462c
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret
Function at 0x414720
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40
push esi
push edi
call fcn.00414700
xor edx, edx
mov ecx, 0x11
div ecx
xor edi, edi
mov esi, edx
add esi, ecx
test esi, esi
jle 0x414764
call fcn.005327b3
test eax, eax
je 0x414752
and eax, 0x8000000f
jns 0x414752
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
inc edi
cmp edi, esi
mov al, byte [edx + eax]
mov byte [esp + edi + 7], al
jl 0x41473d
lea ecx, [esp + 8]
mov byte [esp + esi + 8], 0xd
mov byte [esp + esi + 9], 0xa
push ecx
mov byte [esp + esi + 0xe], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
add esp, 0x40
ret
Function at 0x414c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov dword [esp + 0x38], eax
mov dword [0x554054], eax
mov eax, dword [esp + 0x44]
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x1c], 0x540a28
mov dword [esp + 0x38], ebp
je 0x414cf2
call fcn.00480340
mov ecx, 0x55e54c
call fcn.0048f1c0
mov eax, dword [0x54a30c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push str.m_lang_id
push 0x546aec
call fcn.0048dbb0
add esp, 0x14
mov dword [0x54a30c], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x55e32c
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x55e360]
lea eax, [esp + 0x24]
push 0x55e32c
mov dword [esp + 0x30], edx
mov dword [0x55e360], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x55e300]
call fcn.00416860
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push 0x1a3
push esi
call edi
push 0xf0
push 0x1a3
push esi
mov ebx, eax
call edi
mov edi, eax
mov dword [esp + 0x4c], ebp
test edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x48], 0xffffffff
je 0x414d8c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebx, ebx
je 0x414dea
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebp
push ebx
call fcn.004163f0
mov ecx, dword [esp + 0x18]
add esp, 8
mov edi, eax
push 0
push 0x414350
push ecx
push edi
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
cmp edi, ebx
mov dword [esp + 0x48], eax
je 0x414ddb
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [esp + 0x18]
test ebp, ebp
je 0x414dfd
test edi, edi
je 0x414dfd
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x41d7e0
Capabilities:
Get common file path
Hide graphical window

Disassembly:
sub esp, 0x3c
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x41d7f4
xor eax, eax
pop esi
add esp, 0x3c
ret
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esi + 0xc4]
mov ecx, dword [esp + 4]
test eax, eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
jne 0x41d8a9
push ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x1c], 0x30
mov dword [esp + 0x24], 0x41d790
mov dword [esp + 0x44], str.NotifyWnd_123
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push SHChangeNotifyDeregister
push 0
push str.NotifyWnd_123
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [esi + 0xc4], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc4]
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop ebx
mov eax, dword [esi + 0x40]
test eax, eax
je 0x41d8be
push eax
call dword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [esi + 0x40], 0
mov edx, dword [esi + 0xc4]
lea ecx, [esp + 8]
push ecx
push 1
push 0x400
push 0x201ff
push 2
push edx
call dword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [esi + 0x40], eax
mov eax, 1
pop esi
add esp, 0x3c
ret
Function at 0x41f920
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, ecx
lea edx, [esp + 8]
mov ecx, eax
push edi
and ecx, 0xffff
push edx
shr eax, 0x10
mov dword [ebx], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x20], edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
push edx
push 0
push 0x1111
push eax
mov dword [esp + 0x28], ecx
call edi
lea ecx, [esp + 0x34]
test ecx, ecx
mov ecx, dword [esp + 0x1c]
jne 0x41f9a9
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
je 0x41fa0c
mov dword [ebx], 1
mov edx, dword [esi + 4]
push eax
push 9
push 0x110b
push edx
call edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x41f9fd
mov dword [0x55e1e8], 1
mov eax, dword [esi + 0x24]
push 0
push 0x6f
push 0x111
push eax
call edi
pop edi
pop esi
mov dword [0x55e1e8], 0
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [esi + 0x24]
push 0
push 0x6f
push 0x111
push ecx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
Function at 0x420e20
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x420e39
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov ecx, dword [esi + 0x2c]
push 0
push ecx
call edi
lea eax, [esi + 0x50]
sub esp, 8
test eax, eax
mov edi, esp
je 0x420e63
add eax, 4
jmp 0x420e65
xor eax, eax
push eax
lea ecx, [edi + 4]
call fcn.00406280
lea edx, [esp + 0x10]
mov ecx, esi
push edx
mov dword [edi], 0x5409d8
call fcn.00420aa0
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0xec]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push edx
call edi
mov eax, dword [esi + 0xec]
push 0
push 0
push 0xb7
push eax
call edi
mov ecx, dword [esi + 4]
push 0
push 0x64
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi + 0xec]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 8]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x420f0b
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x420f0b
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
pop edi
pop esi
pop ecx
ret 4
Function at 0x420f20
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
cmp eax, 0x3e8
push edi
mov esi, ecx
jne 0x420f74
mov edi, dword [esi + 0xec]
call dword [sym.imp.USER32.dll_GetFocus]
cmp edi, eax
je 0x421077
mov eax, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call edi
mov ecx, dword [esi + 0x2c]
push 5
push ecx
call edi
mov edx, dword [esi + 4]
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop edi
pop esi
pop ebx
ret 0x10
cmp eax, 0x7d0
jne 0x421077
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, dword [sym.imp.USER32.dll_GetFocus]
mov ebx, dword [esi + 0xec]
call edi
cmp ebx, eax
je 0x421077
call edi
mov ecx, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ecx
mov dword [esi + 0x34], eax
call edi
mov edx, dword [esi + 0x2c]
push 0
push edx
call edi
lea eax, [esi + 0x50]
sub esp, 8
test eax, eax
mov edi, esp
je 0x420fcf
add eax, 4
jmp 0x420fd1
xor eax, eax
push eax
lea ecx, [edi + 4]
call fcn.00406280
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
mov dword [edi], 0x5409d8
call fcn.00420aa0
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0xec]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0xec]
push 0
push 0
push 0xb7
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push 0x64
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 0xec]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 0x14]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x421077
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x421077
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10