joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453a15
Capabilities:
Move file

Disassembly:
mov eax, 0x56f6a4
call fcn.00566e38
sub esp, 0x20
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 0x14], ebx
call fcn.00409f27
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.00409f27
mov esi, eax
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x453a88
cmp esi, 1
je 0x453a7c
push 2
push ebx
push 0x45360d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
test eax, eax
je 0x453a6a
mov al, 1
jmp 0x453b36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x453b1c
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x453a88
test esi, esi
je 0x453b1c
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp dword [eax + 0x1c], ebx
jne 0x453b34
lea ecx, [ebp - 0x2c]
call fcn.004025e6
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.004025e6
cmp dword [ebp - 0x10], 1
mov byte [ebp - 4], 1
je 0x453aba
mov al, 1
cmp esi, 1
jne 0x453abc
mov al, bl
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00409ebb
test al, al
je 0x453af0
push 2
push dword [ebp - 0x14]
push 0x45360d
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
test eax, eax
je 0x453b06
mov bl, 1
push dword [ebp - 0x20]
call fcn.00566e0e
push dword [ebp - 0x2c]
call fcn.00566e0e
pop ecx
pop ecx
mov al, bl
jmp 0x453b36
push dword [ebp - 0x20]
call fcn.00566e0e
push dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
call fcn.00566e0e
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x453b34
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00407a14
jmp 0x453b36
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4550c0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp ecx, 0x44c
jb 0x455123
push esi
push ecx
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.004656cf
mov eax, dword [0x5b389c]
imul esi, eax, 0x184
add esi, 0x5b3a70
mov ecx, dword [esi]
test ecx, ecx
je 0x455104
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi], 0
mov eax, dword [0x5b389c]
imul esi, eax, 0x184
add esi, 0x5b3a74
mov ecx, dword [esi]
test ecx, ecx
je 0x45511f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi], 0
mov al, 1
pop esi
ret
mov eax, 0x224
cmp ecx, eax
ja 0x4552a0
je 0x455273
add eax, 0xfffffff8
cmp ecx, eax
ja 0x4551c4
je 0x4551a8
sub ecx, 0x65
je 0x455194
sub ecx, 1
je 0x45518d
sub ecx, 1
je 0x455186
sub ecx, 1
je 0x45517f
sub ecx, 1
je 0x455178
sub ecx, 1
je 0x455171
sub ecx, 1
jne case.0x4552b6.553
push 0x57c884
jmp 0x455199
push 0x5798c0
jmp 0x455199
push str.SHA256
jmp 0x455199
push str.SHA1
jmp 0x455199
push str.CRC64
jmp 0x455199
push str.CRC32
jmp 0x455199
push 0x579880
mov ecx, 0x5b3890
call fcn.00459a53
jmp 0x455382
push 1
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.00462d93
jmp 0x455382
sub ecx, 0x21d
je 0x455257
sub ecx, 1
je 0x455250
sub ecx, 1
je 0x455234
sub ecx, 1
je 0x455230
sub ecx, 1
je 0x455216
sub ecx, 1
je 0x4551fd
sub ecx, 1
jne case.0x4552b6.553
push dword [0x5b389c]
push ecx
push 1
jmp 0x455207
push dword [0x5b389c]
push 0
push 0
mov ecx, 0x5b3890
call fcn.00446e85
jmp 0x455382
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.00467bdb
jmp 0x455382
push 1
jmp 0x455236
push 0
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.00461cf1
jmp 0x455382
push 0
jmp 0x4551aa
push 0
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.00462d46
jmp 0x455382
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
imul ecx, dword [0x5b389c], 0x184
shr eax, 0xf
not al
and al, 1
movzx eax, al
push eax
add ecx, 0x5b3904
call fcn.00467327
jmp 0x455382
lea eax, [ecx - 0x225]
cmp eax, 0x2a
ja case.0x4552b6.553
movzx eax, byte [eax + 0x4553bc]
jmp dword [eax*4 + 0x455388]
push str._.
jmp 0x455259
push 0x57c3ec
jmp 0x455259
mov ecx, 0x5b3890
call fcn.0045edae
jmp 0x455382
push ecx
mov ecx, 0x5b3890
call fcn.0047297c
jmp 0x455382
mov ecx, 0x5b3890
call fcn.0046997e
jmp 0x455382
mov ecx, 0x5b3890
call fcn.00468a31
jmp 0x455382
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.00465b5e
jmp 0x455382
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.00466c8c
jmp 0x455382
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.004670fa
jmp 0x455382
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.00466ef1
jmp 0x455382
mov ecx, 0x5b3890
call fcn.0047503b
jmp 0x455382
imul ecx, dword [0x5b389c], 0x184
add ecx, 0x5b3904
call fcn.0045ddb0
mov al, 1
ret
xor al, al
ret
Function at 0x45a345
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
mov eax, 0x56fcfb
call fcn.00566e38
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], ebx
mov dword [edi], 0x57e804
mov dword [edi + 0x58], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ebx
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 2
call fcn.004025e6
lea ecx, [edi + 0x7c]
mov byte [ebp - 4], 3
call fcn.004025e6
lea ecx, [edi + 0x98]
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], ebx
call fcn.0045a47a
or dword [edi + 0x18], 0xffffffff
mov esi, dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push 0xf
pop eax
mov word [edi + 0xc], ax
xor eax, eax
inc eax
mov dword [edi + 0x10], ebx
push str.7_Zip::SetTargetFolder
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], eax
call esi
push str.7_Zip::SetTransfer
mov dword [edi + 0x20], eax
call esi
push str.7_Zip::GetTransfer
mov dword [edi + 0x24], eax
call esi
push 0x57e834
mov dword [edi + 0x28], eax
call esi
push str.Logical_Performed_DropEffect
mov dword [edi + 0x2c], eax
call esi
push str.DisableDragText
mov dword [edi + 0x30], eax
call esi
push str.IsShowingLayered
mov dword [edi + 0x34], eax
call esi
push str.IsShowingText
mov dword [edi + 0x38], eax
call esi
push str.DropDescription
mov dword [edi + 0x3c], eax
call esi
push str.TargetCLSID
mov dword [edi + 0x40], eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x44], eax
mov eax, edi
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x50], ebx
mov word [edi + 0x54], bx
mov dword [edi + 0x88], ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x45c883
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56edb6
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x57e98c
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov word [esi + 0x18], bx
mov byte [esi + 0x1a], bl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
or dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x38], 1
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x45ec92
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x60], 0
je 0x45ecac
mov ecx, dword [esi + 0x1c]
call fcn.0040764a
mov ecx, dword [esi + 0x10]
pop esi
jmp fcn.00407b41
pop esi
ret
Function at 0x45f102
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x570389
call fcn.00566e38
sub esp, 0x244
push esi
push edi
mov edi, ecx
call fcn.0042ca08
and dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
je 0x45f1c4
push ebx
lea ecx, [ebp - 0x18]
call fcn.004025e6
mov ebx, 0x22c
mov byte [ebp - 4], 1
push ebx
lea eax, [ebp - 0x250]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x250], ebx
lea eax, [ebp - 0x250]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
pop ebx
jmp 0x45f1b0
mov eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x22c]
push eax
call fcn.004027d6
mov ecx, edi
call fcn.0040393c
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.0045ebd7
lea eax, [ebp - 0x250]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45f170
push dword [ebp - 0x18]
call fcn.00566e0e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4687ba
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x570f87
call fcn.00566e38
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x57ee6c
lea ecx, [esi + 0x10]
mov dword [esi + 8], edi
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
call fcn.004025e6
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x46af9e
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x56eeba
call fcn.00566e38
sub esp, 0x18
push esi
mov esi, ecx
lea ecx, [ebp - 0x18]
lea edx, [esi + 0x3c]
call fcn.0046b229
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
push eax
call fcn.00402707
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00566e0e
pop ecx
lea edx, [esi + 0x40]
lea ecx, [ebp - 0x18]
call fcn.0046b253
push eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 1
call fcn.00402707
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00566e0e
pop ecx
lea edx, [esi + 0x44]
lea ecx, [ebp - 0x24]
call fcn.0046b27d
push eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 2
call fcn.00402707
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call fcn.00566e0e
lea ecx, [esi + 0x30]
mov dword [esp], 0x57f194
call fcn.00402765
push 0x11
pop ecx
call fcn.0046b713
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], eax
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x46b713
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push ecx
push esi
mov dword [ebp - 4], esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], esi
je 0x46b76e
push 0x4008
push 0x2b4
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x2b4], esi
push eax
push 0x80
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
je 0x46b76e
mov eax, dword [ebp - 0x2b4]
jmp 0x46b770
xor eax, eax
pop esi
leave
ret

Function at 0x46b773
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2b4]
or edx, 0x80
push eax
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x2b0]
mov dword [edx], ecx
leave
ret 4

Function at 0x46b7aa
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
mov edx, 0x4011
test cl, cl
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x90
push 0x579d0c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0x2b4
ret
Function at 0x46ddc8
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x12
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x46dde8
cmp dword [esi + 0x38], 1
ja 0x46dde8
mov eax, dword [esi]
mov ecx, esi
pop esi
jmp dword [eax + 0x20]
mov ecx, esi
pop esi
jmp 0x46e1f8
mov eax, 0x5715dd
call fcn.00566e38
sub esp, 0x48
xor eax, eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea ecx, [esi + 8]
mov dword [ebp - 4], eax
lea edx, [ebp - 0x18]
call fcn.0046dd95
cmp dword [ebp - 0x14], 1
mov ebx, dword [ebp - 0x18]
jne 0x46e2d2
push edi
mov edi, dword [ebx]
lea ecx, [ebp - 0x54]
call fcn.0046dbc5
cmp dword [esi + 0x38], 1
mov eax, dword [esi + 0x1c]
mov byte [ebp - 4], 1
push dword [eax + edi*4]
je 0x46e25d
lea ecx, [ebp - 0x48]
call fcn.00402707
cmp edi, dword [esi + 0x2c]
jae 0x46e265
mov eax, dword [esi + 0x28]
push dword [eax + edi*4]
lea ecx, [ebp - 0x3c]
call fcn.00402707
mov ecx, dword [ebp - 0x3c]
push 0xd
pop edx
call fcn.00402f5f
pop edi
test eax, eax
jns 0x46e2bd
push 0x57f610
lea ecx, [ebp - 0x30]
call fcn.004025b0
push 0x57f618
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004025b0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00403889
push dword [ebp - 0x24]
call fcn.00566e0e
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00566e0e
pop ecx
pop ecx
push dword [esi + 4]
lea ecx, [ebp - 0x54]
push 0x5e
call fcn.0040e985
lea ecx, [ebp - 0x54]
call fcn.0046dc0a
push ebx
call fcn.00566e0e
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x46e6b8
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x57161e
call fcn.00566e38
sub esp, 0x340
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x3c]
push edi
call fcn.004025e6
mov edi, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x46e724
push dword [edi + 0xc]
lea ecx, [ebp - 0x58]
push dword [edi + 8]
call fcn.00450df4
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00450daf
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00402707
push dword [ebp - 0x4c]
call fcn.00566e0e
push dword [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.00566e0e
pop ecx
pop ecx
lea ecx, [edi + 0x18]
call fcn.004039d0
mov esi, eax
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x30]
call fcn.0040242f
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x24]
add eax, 2
mov byte [ebp - 4], 3
lea eax, [eax + esi*2]
push eax
call fcn.004025b0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.0046e63f
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.0046e63f
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
call fcn.004024ee
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00402c82
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402a38
lea ecx, [ebp - 0x18]
call fcn.00402c82
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402a38
lea ecx, [ebp - 0x18]
call fcn.00402c82
cmp byte [edi + 1], 0
je 0x46e7ed
mov edx, 0x3f4
lea ecx, [ebp - 0x18]
call fcn.00453e33
push 0x579c84
lea ecx, [ebp - 0x18]
call fcn.00402a6d
push 0
lea ecx, [edi + 0x10]
lea edx, [ebp - 0x98]
call fcn.0040adde
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402a6d
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call esi
push dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x110
push 0x2b4
lea eax, [ebp - 0x34c]
push eax
push 0x80
push dword [edi + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x46e844
push dword [ebp + 0xc]
push dword [ebx + 4]
call esi
push 0
push dword [ebp - 0x34c]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x18]
call fcn.00566e0e
push dword [ebp - 0x24]
call fcn.00566e0e
push dword [ebp - 0x30]
call fcn.00566e0e
push dword [ebp - 0x3c]
call fcn.00566e0e
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x46eb54
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x571763
call fcn.00566e38
push ecx
push ebx
or eax, 0xffffffff
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x38]
mov dword [esi], 0x10000
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
call fcn.004025e6
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.004025e6
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.004025e6
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
call fcn.00458507
lea ecx, [esi + 0x98]
call fcn.0055b310
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x471bf9
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x56acfd
call fcn.00566e38
sub esp, 0x10
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [ebx + 4], eax
jne 0x471c1c
or eax, 0xffffffff
jmp 0x471ce0
push esi
xor eax, eax
lea ecx, [ebp - 0x1c]
or esi, 0xffffffff
cmp dword [ebp + 0xc], esi
cmovne eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.004025e6
xor eax, eax
mov dword [ebp - 4], eax
mov eax, 0x110
cmp dword [ebp - 0x14], eax
jae 0x471c4c
push eax
lea ecx, [ebp - 0x1c]
call fcn.004036d2
push 0x10e
push dword [ebp - 0x1c]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
xor ebx, ebx
mov word [edx + 0x21c], cx
cmp word [edx], bx
mov ebx, dword [ebp + 8]
je 0x471c7e
xor ebx, ebx
inc ecx
cmp word [edx + ecx*2], bx
jne 0x471c74
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x471c8c
cmp eax, 0x10e
jb 0x471c95
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00402707
push 1
lea eax, [ebp + 0xc]
push eax
xor eax, eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
cmp eax, 1
jne 0x471cd4
cmp dword [ebp + 0xc], 0
je 0x471cd4
push dword [ebp + 0xc]
push esi
push dword [edi + 0x24]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov esi, dword [edi + 0x20]
lea eax, [esi + 1]
mov dword [edi + 0x20], eax
push dword [ebp - 0x1c]
call fcn.00566e0e
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x472519
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x10]
mov ebp, ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
shr ebx, 0xf
push 0x12
and bl, 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x4725a4
movzx eax, word [edi + 0xc]
mov ecx, eax
test bl, bl
je 0x472593
cmp eax, 0x41
je 0x472598
movzx ecx, cx
push 0x20
mov eax, ecx
pop edx
sub eax, edx
je 0x47257d
sub eax, 0x4b
je 0x47257d
sub eax, 1
je 0x47257d
sub eax, 1
je 0x47257d
dec eax
sub eax, 1
je 0x47257d
sub eax, 0x4c
je 0x47257d
dec eax
sub eax, 1
jne 0x4725a4
test bl, bl
jne 0x4725a4
xor eax, eax
cmp cx, dx
mov ecx, ebp
setne al
push eax
call fcn.00471d4f
jmp 0x4725a0
cmp eax, 0x6a
jne 0x472551
lea ecx, [ebp + 0x28]
call fcn.0044c507
mov al, 1
jmp 0x4725a6
xor al, al
pop edi
pop ebp
pop ebx
ret 4

Function at 0x47413f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x571a88
call fcn.00566e38
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.004024ee
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.004024ee
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
lea eax, [esi + 0x30]
mov dword [edi + 0x2c], ecx
lea ecx, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.004024ee
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x3c]
call fcn.004024ee
mov eax, dword [esi + 0x48]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x48], eax
mov al, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
mov al, byte [esi + 0x4d]
mov byte [edi + 0x4d], al
mov al, byte [esi + 0x4e]
mov byte [edi + 0x4e], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4741d8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x571a88
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004025e6
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.004025e6
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.004025e6
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 2
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov word [esi + 0x4c], bx
mov byte [esi + 0x4e], bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x478464
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x571eab
call fcn.00566e38
push ecx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ecx
mov eax, dword [ebp + 8]
mov dword [esi], 0x580164
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [esi + 0x3c], ecx
lea ecx, [esi + 0x48]
call fcn.004025e6
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.004025e6
or dword [esi + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x47db8e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5720ff
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x580318
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x26], ebx
mov dword [esi + 0x2a], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 1
call fcn.004025e6
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
call fcn.004025e6
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov word [esi + 0x60], bx
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x6e], 1
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret