joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406a26
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a4a
xor eax, eax
test eax, eax
je 0x406a5d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a5d
xor ecx, ecx
jmp 0x406a60
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b83
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ec], 0
push esi
jne 0x406bba
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b94
mov dword [ecx*4 + 0x4275e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b8f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406beb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275e8]
xor eax, esi
inc ecx
dec edx
jne 0x406bcd
pop edi
not eax
pop esi
ret 0xc

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rdata
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x78681c52
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6b1e014b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x51cc2051
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x3ce76726
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x8ec48d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xd6d47a
jmp fcn.00d6d5a0
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
movaps xmm2, xmmword [str.WWWWWWWWWWWWWWWW]
mov edx, 0x403060
push esi
push edi
mov esi, 0x403080
mov edi, 0x403090
mov ecx, 2
nop dword [eax]
xor eax, eax
movups xmm0, xmmword [edx + eax]
movaps xmm1, xmm2
xorps xmm0, xmm2
movups xmmword [edx + eax], xmm0
movups xmm0, xmmword [eax + 0x403070]
xorps xmm1, xmm0
movups xmmword [eax + 0x403070], xmm1
movups xmm0, xmmword [esi + eax]
xorps xmm0, xmm2
movups xmmword [esi + eax], xmm0
movups xmm0, xmmword [edi + eax]
xorps xmm0, xmm2
movups xmmword [edi + eax], xmm0
add eax, 0x40
cmp eax, 0x140
jb 0x401022
cmp eax, 0x162
jae 0x40107f
nop dword [eax + eax]
xor byte [eax + 0x403060], 0x57
inc eax
cmp eax, 0x162
jb 0x401070
sub ecx, 1
jne 0x401020
push 0x40
push 0x1000
push 0x163
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov ecx, 0x58
mov esi, 0x403060
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call eax
pop edi
xor eax, eax
pop esi
ret

Function at 0x401431
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x401466
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x401463
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x40146f
add edx, 0x28
cmp edx, esi
jne 0x401451
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x40146c

Function at 0x4018b4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018f3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018f3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018f3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018f3
cmp dword [ecx + 0x74], 0xe
jbe 0x4018f3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401120
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565731
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0xfca848]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CAmkProgDlg.0
mov dword [ebp - 4], 2
mov ecx, dword [0xfcc838]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [0xfcc838]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
add ecx, 0xe4
call fcn.0050ae83
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0xd0
call fcn.004274a0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.0050ad04
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
call fcn.0050a2b5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4018d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565828
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0xfca848]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp + 8]
mov dword [0xfcc850], eax
cmp dword [0xfcc840], 0
je 0x401931
cmp dword [0xfcca60], 0
je 0x401931
cmp dword [0xfcc850], 0
je 0x401927
push 8
mov ecx, dword [ebp - 0x64]
call fcn.0051107e
jmp 0x401931
push 0
mov ecx, dword [ebp - 0x64]
call fcn.0051107e
cmp dword [0xfcc850], 0
je 0x401a34
mov ecx, dword [0xfcc838]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
call fcn.0042f6b0
mov ecx, dword [ebp - 0x64]
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0xe0], edx
mov edx, dword [ebp - 0x64]
add edx, 0xd4
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x64]
add eax, 0xd0
push eax
mov ecx, dword [0xfcc4c4]
add ecx, 0x7c
call fcn.0050ea66
lea ecx, [ebp - 0x18]
call fcn.00426c20
mov dword [ebp - 4], 0
push 2
push 0x50
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0x57efb4
call fcn.0041d360
add esp, 0x14
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0041c3d0
add esp, 0xc
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x18]
call fcn.004024a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004274a0
lea ecx, [ebp - 0x10]
call fcn.00426c20
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x18]
push edx
push 0x57f038
lea eax, [ebp - 0x10]
push eax
call fcn.00402a20
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0x7c
call fcn.00510fdc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004274a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004274a0
jmp 0x401a95
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0xd0]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0x7c
call fcn.00510fdc
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0xd8]
push eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0xd4]
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
call fcn.0042f6b0
mov ecx, dword [ebp - 0x64]
sub eax, dword [ecx + 0xdc]
sbb edx, dword [ecx + 0xe0]
mov dword [0xfccb48], eax
mov dword [0xfccb4c], edx
mov edx, dword [0xfcc838]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x401e20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0xfcc4c4], 0
push 0
push 0
push 0
push 0x401e70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [0xfcc4c4], 0
jne 0x401e62
push 0xfcc81c
push 0x32
push 0xa
call fcn.004056f0
add esp, 0xc
jmp 0x401e46
mov esp, ebp
pop ebp
ret
Function at 0x403180
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4031ec
lea ecx, [ebp - 0x1c]
push ecx
push 0x57f70c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 2
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4031ec
xor eax, eax
jmp 0x403204
push 0x80020003
mov eax, dword [ebp + 8]
or eax, 0x10
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x4046b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565bd8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0xfca848]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x10]
call fcn.00426c20
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x404780
mov eax, dword [0xfcc8b0]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40477a
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
movsx eax, byte [edx]
test eax, eax
je 0x404770
xor ecx, ecx
mov word [ebp - 0x20], cx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.004042f0
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x40474e
movzx ecx, word [ebp - 0x20]
test ecx, ecx
jne 0x404750
jmp 0x404770
mov dx, word [ebp - 0x20]
mov word [ebp - 0x4e], dx
movzx eax, word [ebp - 0x4e]
push eax
lea ecx, [ebp - 0x10]
call fcn.00427540
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
jmp 0x40471d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x10]
sub eax, 0x10
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.00402800
add esp, 4
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
add edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004274a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4067b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0xfcc82c], 0
je 0x4067c7
push 0xfffffffffffffffe
call dword [0xfcc82c]
call fcn.0042fd70
mov dword [0xfcc838], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0xfcc824]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0xfcc820], 0
mov dword [0xfcc854], 0
mov ecx, 0x1029c80
call fcn.00428390
call fcn.00480700
mov dword [0xfccb14], 0
mov dword [0xfccb10], 0
fld1
fstp qword [0xfc7168]
mov dword [0xfc7e48], 0x7530
mov dword [0xfccb48], 0
mov dword [0xfccb4c], 0
mov dword [0xfccc08], 1
call fcn.00405f20
test eax, eax
jne 0x406859
xor eax, eax
jmp 0x406963
mov edx, dword [0xfcc8a8]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [0xfcc8a4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0xfcc8a8]
mov dword [ebp - 0x14], eax
mov ecx, dword [0xfcc8a4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4068df
mov dword [0xfcc844], 1
mov dword [0xfc7170], 8
mov dword [0xfc7174], 0x10
mov dword [0xfc7178], 2
mov dword [0xfc717c], 4
jmp 0x406911
mov dword [0xfcc844], 0
mov dword [0xfc7170], 2
mov dword [0xfc7174], 4
mov dword [0xfc7178], 8
mov dword [0xfc717c], 0x10
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0xfcc84c], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0xfcc848], eax
mov dword [0x1029c4c], 0
call fcn.0042f6b0
mov dword [0xfcc858], eax
mov dword [0xfcc85c], edx
call fcn.00424bc0
call fcn.00401e20
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40b8b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56723b
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0xfca848]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
push 0xac
call fcn.0050a232
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x40b902
mov ecx, dword [ebp - 0x18]
call fcn.0040b540
mov dword [ebp - 0x5c], eax
jmp 0x40b909
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x58]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0040b980
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x54], eax
push 1
mov ecx, dword [ebp - 0x54]
call fcn.0041e1e0
mov ecx, dword [ebp - 0x54]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x54]
mov dword [edx + 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x30
call fcn.004055f0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41bbf0
Capabilities:
Acquire debug privileges
Allocate thread local storage
Get common file path
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567976
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0xfca848]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe4], ecx
push 0
push 0xfcc610
call fcn.0041bad0
add esp, 8
push 0xfcc610
mov ecx, 0xfcca3c
call fcn.00426d10
push 0
push 0x1a
push 0x104
mov ecx, 0xfcca38
call fcn.00427160
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, 0xfcca38
call fcn.00426aa0
push 1
push 0x581d48
call fcn.0041bb60
add esp, 8
mov dword [0xfcc4f8], 0x114
push 0xfcc4f8
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.00516152
mov eax, dword [eax + 4]
mov dword [ebp - 0xc4], eax
call fcn.00516152
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc8], ecx
mov edx, 0x80
movzx eax, dx
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [0xfcc4f4], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xe4]
add eax, 0xa4
push eax
call sub.gdiplus.dll_GdiplusStartup
push 0
call fcn.00515325
add esp, 4
push 0
lea ecx, [ebp - 0x98]
push ecx
call fcn.0042ebd0
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x98]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0xcc], eax
xor ecx, ecx
cmp dword [ebp - 0xcc], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x41bd47
mov eax, dword [ebp - 0x98]
push eax
call fcn.00430760
add esp, 4
jmp 0x41bd54
push 0x581d0c
call fcn.00430760
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.004274a0
mov dword [ebp - 0xac], vtable.VObj.0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], vtable.ExprItem.0
mov dword [ebp - 0xac], vtable.AnyArray.0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp - 0xd4]
mov dword [edx], 0
mov eax, dword [ebp - 0xd4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0xac]
mov eax, dword [edx + 4]
mov dword [0xfcc4f0], eax
lea ecx, [ebp - 0xac]
call fcn.0041beb0
push 0
call fcn.0052cf3c
add esp, 4
push eax
call fcn.0052a091
add esp, 4
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ecx + 0x44]
push edx
call fcn.004d4910
add esp, 4
call fcn.00471de0
call fcn.004b6400
push 0x581c94
push 2
call fcn.0052cdcc
add esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xfcc824], eax
push 0
lea ecx, [ebp - 0x94]
call fcn.00429c40
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xe4]
lea ecx, [ebp - 0x94]
mov dword [eax + 0x20], ecx
push 0
mov edx, 0x66
movzx eax, dx
push eax
lea ecx, [ebp - 0x94]
call fcn.0050ac6c
push 0
lea ecx, [ebp - 0x94]
call fcn.0050d382
mov ecx, dword [0xfcc824]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0xfcc824], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0050a2b5
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41c2d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5679d8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0xfca848]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
je 0x41c320
mov ecx, dword [ebp - 0x14]
or ecx, 0x1000000
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1c]
call fcn.00426c20
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40
mov edx, dword [ebp - 0x18]
shl edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00426a10
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00426aa0
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
je 0x41c336
mov eax, dword [ebp - 0x1c]
sub eax, 0x10
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.00402800
add esp, 4
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
add edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004274a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x42b750
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568348
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0xfca848]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42b82f
push 8
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x42b829
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42b829
mov eax, dword [ebp - 0x14]
push eax
call fcn.0042b930
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42b829
mov dword [ebp - 0x20], vtable.CGdiObject.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], vtable.CBitmap.0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
call fcn.005126d2
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004398f0
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 4], 0
sete cl
neg ecx
sbb ecx, ecx
add ecx, 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], vtable.CBitmap.0
lea ecx, [ebp - 0x20]
call fcn.00402b20
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret