joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416ec0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf4]
mov ecx, 0x3d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xff0]
mov edx, dword [ebp - 8]
cmp dword [edx + ecx*4 + 0x50], 0
je 0x416f54
cmp dword [ebp + 0x10], 1
jne 0x416f4d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00416db0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xffffffff
je 0x416f2d
cmp dword [ebp - 0xf4], 0
je 0x416f37
jmp 0x416f41
mov eax, 0xffffff7e
jmp 0x417015
mov eax, 0xffffff7a
jmp 0x417015
mov eax, 0xffffff80
jmp 0x417015
xor eax, eax
jmp 0x417015
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jge 0x417012
push 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call sub.WS2_32.dll_send
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x417004
call sub.WS2_32.dll_WSAGetLastError
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x2733
je 0x416faf
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 4], ecx
mov eax, 0xffffff7f
jmp 0x417015
cmp dword [ebp + 0x10], 1
jne 0x416ffb
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00416db0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xffffffff
je 0x416feb
cmp dword [ebp - 0xf4], 0
je 0x416ff4
jmp 0x416ffb
mov eax, 0xffffff7e
jmp 0x417015
mov eax, 0xffffff7a
jmp 0x417015
mov eax, 0xffffff80
jmp 0x417015
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
jmp 0x416f5b
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0xf4
cmp ebp, esp
call fcn.00418a80
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417220
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jge 0x4172ac
push 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call sub.WS2_32.dll_send
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4172a1
call sub.WS2_32.dll_WSAGetLastError
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x2733
je 0x41729a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 4], ecx
mov eax, 0xffffff7f
jmp 0x4172af
mov eax, dword [ebp - 0x14]
jmp 0x4172af
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
jmp 0x41724a
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.00418a80
mov esp, ebp
pop ebp
ret 8
Function at 0x430260
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43027f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x430286
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x43029d
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042b7f0
add esp, 4
or eax, 0xffffffff
jmp 0x43029f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4011bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], eax
jae 0x4012f5
push 0x50bb637
call fcn.00401472
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
add eax, 1
and eax, 0xff
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0x573feee
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x116fd46
je 0x401220
jmp 0x401229
mov dword [ebp - 0x1c], 0x46e9164
jmp 0x401232
mov dword [ebp - 0x1c], 0x1a919e1
jmp 0x401232
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
movzx ecx, byte [ecx + edx]
add eax, ecx
and eax, 0xff
mov dword [ebp - 0xc], eax
call fcn.0040141e
mov esi, eax
lea eax, [esi + 0x2cc03]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
push ecx
call section..text
add esp, 8
mov dword [ebp - 0x28], 0x43c8a01
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xd9940e
je 0x401287
jmp 0x401290
mov dword [ebp - 0x28], 0x43540e0
jmp 0x401299
mov dword [ebp - 0x28], 0x15a2d8e
jmp 0x401299
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
movzx ecx, byte [ecx + edx]
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
movzx edx, byte [edx + ebx]
add ecx, edx
and ecx, 0xff
movsx eax, byte [eax + ecx]
mov dword [ebp - 0x30], eax
call fcn.0040141e
mov esi, eax
lea eax, [esi + 0x2cc24]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x10]
movsx edx, byte [edx + ebx]
xor ecx, edx
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x10]
mov byte [edx + ebx], cl
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x10]
jmp 0x4011de
mov dword [ebp - 0x10], 0x22368a2
mov eax, 0
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100129ec
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002cef1
call fcn.10014f28
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012a09
xor eax, eax
jmp 0x10012adf
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012add
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10012ab3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.100125e1
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.100125e1
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10012b61
lea ecx, [ebp - 0x240]
call fcn.10012b61
push dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
call main
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012abd
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012c52
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10012a36
jmp 0x10012ad6
mov edi, dword [ebp - 0x234]
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10012c52
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10014ed2
ret

Function at 0x10028acd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10028adc
pop dword [ebp - 0x38]
mov eax, 0x10028adc
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x4059d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xba4ef9ca
add ecx, 0x45b14f20
mov edi, eax
mov ebx, 0x10049800
add ebx, dword [ebp - 0x38]
mov esi, 0xf306922b
mov dword [ebp - 0x14], 0xe9b6fff0
mov edx, dword [ebx]
xor edx, esi
sub dword [ebp - 0x1c], 0x20636bb9
mov dword [edi], edx
add dword [ebp - 0x28], 0xcb5b699c
add edi, 4
add ebx, 0x7902635c
add ebx, 0x86fd9ca8
loop 0x10028b25
add eax, 0xc757040c
sub eax, 0xc755ed91
xor ebx, ebx
add ebx, eax
add eax, 0x34218cdf
add eax, 0xcbde7326
mov ecx, 0x1136a3df
add ecx, 0xfec95c21
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6b0f05c9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6274033a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4010f3
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c20c1]
push ebx
push esi
push edi
mov esi, ecx
push 0x8000
push esi
mov edi, edx
mov byte [ebp - 1], al
call fcn.00424013
pop ecx
push eax
call fcn.00423e45
pop ecx
pop ecx
push 0xb
mov ecx, edi
mov ebx, eax
call fcn.0040d31c
test al, al
jne 0x475723
lea ecx, [ebp - 0x18]
call fcn.0040a76e
mov ecx, edi
call fcn.004085d8
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.0040121a
push dword [ebp - 0x18]
push 0x4afc3c
push esi
call fcn.0042420c
add esp, 0xc
cmp byte [ebp - 1], 0
mov dword [ebp - 8], eax
jne 0x475743
lea ecx, [ebp - 0x18]
call fcn.00407dce
mov edi, dword [ebp - 8]
push esi
call fcn.004243d1
pop ecx
cmp ebx, 0xffffffff
je 0x47575a
push ebx
push esi
call fcn.00424013
pop ecx
push eax
call fcn.00423e45
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
push esi
mov ecx, edi
call fcn.0044c9cf
push eax
push 1
call fcn.0044c986
push eax
call fcn.0042418e
add esp, 0x10
mov edi, eax
jmp 0x401173
mov ecx, edi
call fcn.004085d8
mov eax, dword [edi + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x401168
push 0x4000
jmp 0x401184
Function at 0x402b44
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
mov edi, ecx
push 5
pop eax
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
push ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x4031b7
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
push eax
xor bl, bl
push 0x104
mov byte [ebp - 5], bl
xor bh, bh
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 6]
push eax
push dword [ebp + 8]
call fcn.00403505
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x472de3
mov eax, dword [0x4c2124]
test eax, eax
je 0x4032d6
xor edi, edi
inc edi
mov esi, 0x4c32e8
cmp eax, edi
je 0x472dfc
lea eax, [ebp - 5]
push eax
push ecx
push 0x4c2124
push 0x4c213c
mov ecx, esi
call fcn.004038f1
test al, al
je 0x4032df
mov al, byte [0x4c32e8]
mov bh, byte [0x4c32e9]
push 0x4c2120
mov byte [0x4c2128], al
lea eax, [ebp - 0x43c]
push eax
push 0x104
push 0x4c213c
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov bl, byte [ebp - 5]
push dword [0x4c2124]
push 0x4c213c
call fcn.0040482c
test eax, eax
jne 0x472e1b
cmp bh, 1
je 0x472e3a
call fcn.00402424
call fcn.00402608
cmp byte [0x4c2128], 0
mov ebx, 0x4c28f0
jne 0x4032a0
mov ecx, ebx
call fcn.004032e7
push edi
mov ecx, 0x4c2348
call fcn.0040e570
cmp byte [0x4c2128], 0
jne 0x4032bb
mov ecx, ebx
call fcn.00402d89
mov ecx, esi
call fcn.00402fd5
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
leave
ret 4
or dword [0x4c20bc], 0xffffffff
jmp 0x4032c2
mov dword [0x4c20bc], edi
jmp 0x4032c2
push 0x10
push 0x4b393c
push str.Compiled_AutoIT_Script_by_CWAutComp_v2.16
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4032cf
push 0xffffffffffffffff
push dword [0x4c212c]
mov ecx, esi
push edi
call fcn.004439ab
mov al, byte [0x4c20c2]
mov byte [0x4c32ea], al
jmp 0x403260
mov ecx, esi
call fcn.00402fd5
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4c20bc], edi
jmp 0x4032cf
call fcn.0043c89b
test al, al
jne 0x403281
cmp byte [ebp - 6], al
jne 0x403281
push 0x104
lea eax, [ebp - 0x43c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x49eaa4
lea ecx, [ebp - 0x18]
call fcn.0040cb26
lea ecx, [ebp - 0x18]
test bl, bl
je 0x472e9d
mov edi, 0x4b39a8
push edi
call fcn.00404809
push 0x4c213c
lea ecx, [ebp - 0x18]
call fcn.00404809
push edi
lea ecx, [ebp - 0x18]
call fcn.00404809
push 1
jmp 0x472ea6
push dword [ebp + 8]
call fcn.00404809
push edi
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x43c]
push eax
push 0x4b39ac
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.00407dce
jmp 0x4032bb
Function at 0x403c7d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x476431
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00424efe
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
mov edx, dword [ecx]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x403ca3

Function at 0x403ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x403f14
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, ebx
je 0x403ed7
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x403ee7
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0xc]
inc edi
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
mov byte [edi + ecx - 1], al
inc dword [esi + 0xc]
cmp edi, ebx
jb 0x403eb7
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop esi
pop ebx
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
push eax
push 0x10000
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403ed7
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x403ed7
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x403ebf
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.00403fc1
jmp 0x403eae
Function at 0x40548d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x4054c5
push edi
push 0
push str.SCRIPT
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x476387
pop edi
pop esi
pop ebx
leave
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4054c4
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x4054c4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4054c4
mov ecx, dword [ebx]
push 0
mov edx, dword [ecx]
push edi
push eax
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
mov ecx, dword [eax]
push edx
push edx
push edx
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0x4054c4
Function at 0x41c65a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
mov esi, dword [edi]
push eax
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
mov dword [edi + 0x16c], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x170], eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp ecx, dword [edi + 0x174]
jne 0x41c6ff
cmp eax, dword [edi + 0x178]
jne 0x41c6ff
push dword [ebx + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
push dword [ebx + 0x1c]
movzx eax, ax
shr eax, 0xf
mov dword [ebp + 8], eax
call esi
movzx esi, ax
mov eax, dword [ebp + 8]
shr esi, 0xf
cmp eax, dword [edi + 0x17c]
jne 0x47fbd1
cmp dword [ebp + 0xc], 0
je 0x41c6e0
mov dword [edi + 0x17c], eax
cmp esi, dword [edi + 0x180]
jne 0x47fc3d
cmp dword [ebp + 0xc], 0
je 0x41c6f8
mov dword [edi + 0x180], esi
pop edi
pop esi
pop ebx
leave
ret 8
cmp dword [ebp + 0xc], 1
mov dword [edi + 0x174], ecx
mov dword [edi + 0x178], eax
jl 0x41c6a6
jmp 0x47fbc0
push eax
push ecx
push edi
push 0xfffffffffffffff5
mov ecx, ebx
call fcn.004698e2
jmp 0x41c6a6
cmp dword [ebp + 0xc], 1
jl 0x41c6d4
cmp byte [edi + 0x1a8], 0
je 0x41c6d4
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test eax, eax
je 0x47fbf9
push 0xfffffffffffffff9
jmp 0x47fc29
push 0xfffffffffffffff8
call fcn.004698e2
cmp byte [edi + 0x184], 0
je 0x47fc2e
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test eax, 0x1000000
je 0x47fc27
push 0xfffffffffffffffa
jmp 0x47fc29
push 0xfffffffffffffff4
call fcn.004698e2
mov eax, dword [ebp + 8]
mov byte [edi + 0x184], 0
jmp 0x41c6d4
cmp dword [ebp + 0xc], 1
jl 0x41c6ec
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test esi, esi
je 0x47fc58
push 0xfffffffffffffff7
jmp 0x47fc5a
push 0xfffffffffffffff6
call fcn.004698e2
jmp 0x41c6ec

Function at 0x41d8d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x41d956
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41d956
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d956
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41d93d
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x41d94d
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x41d93b
xor al, al
jmp 0x41d949
Function at 0x41e9ae
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
xor edx, edx
xor ebx, ebx
push esi
inc ebx
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], edx
cmp dword [eax + 4], edx
je 0x474e37
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov dword [edi], edx
mov byte [ecx], dl
mov byte [eax], dl
mov dword [ebp - 0xc], 0x2b
mov dword [ebp - 8], 0x23
mov edi, edx
push edi
mov ecx, esi
call fcn.0041eac3
movzx eax, word [eax]
push 0x2b
pop ecx
push 0x5e
cmp ax, cx
pop ecx
push 0x21
pop edx
je 0x474e3e
cmp ax, cx
je 0x474e3e
cmp ax, dx
je 0x474e3e
cmp ax, word [ebp - 8]
je 0x474e3e
push edi
inc edi
mov ecx, esi
mov dword [ebp + 0x1c], edi
call fcn.0041eac3
movzx eax, word [eax]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, 0x7b
jne 0x474eb9
push 0x40
lea ecx, [ebp - 0x20]
call fcn.00404b94
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x7d
call fcn.0041e958
test al, al
je 0x41eabf
push dword [ebp - 0x20]
push dword [esi*4 + 0x4bc5d0]
call fcn.00422627
pop ecx
pop ecx
test eax, eax
je 0x41ea8d
inc esi
cmp esi, 0x62
jl 0x41ea72
cmp esi, 0x62
je 0x474e70
cmp byte [esi + 0x4bc568], 0
jne 0x41eabf
movzx eax, byte [esi + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [edi], eax
lea ecx, [ebp - 0x20]
call fcn.00407dce
and dword [edi], 0xff
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x18
xor bl, bl
jmp 0x41eaa8
lea ecx, [ebp - 0x20]
call fcn.00407dce
xor al, al
jmp 0x41eab8
cmp ax, word [ebp - 0xc]
jne 0x474e49
mov eax, dword [ebp + 0x10]
jmp 0x474e68
cmp ax, cx
jne 0x474e53
mov eax, dword [ebp + 0x14]
jmp 0x474e68
cmp ax, dx
jne 0x474e5d
mov eax, dword [ebp + 0x18]
jmp 0x474e68
push 0x23
pop ecx
cmp ax, cx
jne 0x474e6a
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
inc edi
jmp 0x41e9fa
push 0
lea ecx, [ebp - 0x20]
call fcn.0040a5fe
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x474e2f
test eax, 0x200
je 0x474e98
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x474ea4
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x41eaa8
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x41eaa8
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x474e37
test eax, 0x200
je 0x474ed8
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x474ee4
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x41eab0
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x41eab0
Function at 0x41ece6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4755ff
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x475617
or eax, eax
jmp 0x41ed05
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
jmp 0x41ed05
Function at 0x41f82a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
push ebx
call fcn.0040c53d
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x475699
xor al, al
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push 0x49ec40
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x475713
mov eax, dword [ebp - 4]
push esi
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420b6a
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00404280
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push 0x49ec40
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47570a
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 4], eax
mov word [esi + eax*2], cx
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00404a3e
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.004041e4
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x41f85c