joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40665a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push 0x42b598
lea ecx, [ebp - 0xc]
call fcn.00401000
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov ecx, dword [ebp + 8]
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
lea ecx, [ebp - 0xc]
call fcn.004010e1
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
dec eax
push eax
call fcn.00401083
cmp byte [eax], 0x5c
je 0x4066b1
push 0x42653c
lea ecx, [ebp - 0xc]
call fcn.004011b9
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 1
je 0x406701
dec eax
dec eax
je 0x4066fa
dec eax
je 0x4066eb
dec eax
je 0x4066e4
dec eax
je 0x4066dd
dec eax
je 0x4066d6
push str.Unknown
jmp 0x4066f0
push str.RAMDisk
jmp 0x4066f0
push str.CDROM
jmp 0x4066f0
push str.Network
jmp 0x4066f0
push str.Fixed
mov ecx, dword [ebp + 0xc]
call fcn.00401af4
jmp 0x40670a
push str.Removable
jmp 0x4066f0
push 1
mov ecx, esi
call fcn.00402b3b
lea ecx, [ebp - 0xc]
call fcn.0040107a
xor eax, eax
pop esi
leave
ret 8

Function at 0x406719
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, ecx
push 0x42b598
lea ecx, [ebp - 0x3c]
call fcn.00401000
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov ecx, dword [ebp + 8]
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
lea ecx, [ebp - 0x3c]
call fcn.004010e1
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x3c]
dec eax
push eax
call fcn.00401083
cmp byte [eax], 0x5c
je 0x406770
push 0x42653c
lea ecx, [ebp - 0x3c]
call fcn.004011b9
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x4067a9
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExA]
test eax, eax
je 0x4067f0
fild qword [ebp - 0x20]
jmp 0x4067db
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x4067f0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x18]
fmul qword [0x422460]
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
fstp qword [esp]
call fcn.00401ad1
jmp 0x4067f9
push 1
mov ecx, esi
call fcn.00402b3b
lea ecx, [ebp - 0x3c]
call fcn.0040107a
xor eax, eax
pop esi
leave
ret 8
Function at 0x406808
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, ecx
push 0x42b598
lea ecx, [ebp - 0x3c]
call fcn.00401000
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov ecx, dword [ebp + 8]
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
lea ecx, [ebp - 0x3c]
call fcn.004010e1
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x3c]
dec eax
push eax
call fcn.00401083
cmp byte [eax], 0x5c
je 0x40685f
push 0x42653c
lea ecx, [ebp - 0x3c]
call fcn.004011b9
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x406898
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExA]
test eax, eax
je 0x4068df
fild qword [ebp - 0x20]
jmp 0x4068ca
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x4068df
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
fild qword [ebp - 0x18]
fmul qword [0x422460]
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
fstp qword [esp]
call fcn.00401ad1
jmp 0x4068e8
push 1
mov ecx, esi
call fcn.00402b3b
lea ecx, [ebp - 0x3c]
call fcn.0040107a
xor eax, eax
pop esi
leave
ret 8

Function at 0x4068f7
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, ecx
push 0x42b598
lea ecx, [ebp - 0x1c]
call fcn.00401000
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov ecx, dword [ebp + 8]
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
lea ecx, [ebp - 0x1c]
call fcn.004010e1
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
dec eax
push eax
call fcn.00401083
cmp byte [eax], 0x5c
je 0x40694f
push 0x42653c
lea ecx, [ebp - 0x1c]
call fcn.004011b9
lea eax, [ebp - 4]
xor esi, esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
jne 0x406976
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
mov eax, esi
sub eax, 0
je 0x4069af
sub eax, 3
je 0x4069a0
sub eax, 0x10
je 0x406999
dec eax
dec eax
je 0x406992
push str.UNKNOWN
jmp 0x4069b4
push str.NOTREADY
jmp 0x4069a5
push str.READONLY
jmp 0x4069a5
push str.INVALID
mov ecx, dword [ebp + 0xc]
call fcn.00401af4
jmp 0x4069c0
push str.READY
mov ecx, dword [ebp + 0xc]
call fcn.00401af4
test esi, esi
jle 0x4069c9
push 1
mov ecx, edi
call fcn.00402b3b
lea ecx, [ebp - 0x1c]
call fcn.0040107a
pop edi
xor eax, eax
pop esi
leave
ret 8
Function at 0x4069d9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
mov esi, ecx
push 0x42b598
lea ecx, [ebp - 0xc]
call fcn.00401000
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov ecx, dword [ebp + 8]
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
lea ecx, [ebp - 0xc]
call fcn.004010e1
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
dec eax
push eax
call fcn.00401083
cmp byte [eax], 0x5c
je 0x406a33
push 0x42653c
lea ecx, [ebp - 0xc]
call fcn.004011b9
mov eax, 0xff
lea ecx, [ebp - 0x118]
push eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x406a72
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push eax
call fcn.00401af4
jmp 0x406a7b
push 1
mov ecx, esi
call fcn.00402b3b
lea ecx, [ebp - 0xc]
call fcn.0040107a
xor eax, eax
pop esi
leave
ret 8

Function at 0x406a8a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
mov esi, ecx
push 0x42b598
lea ecx, [ebp - 0xc]
call fcn.00401000
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov ecx, dword [ebp + 8]
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
lea ecx, [ebp - 0xc]
call fcn.004010e1
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
dec eax
push eax
call fcn.00401083
cmp byte [eax], 0x5c
je 0x406ae4
push 0x42653c
lea ecx, [ebp - 0xc]
call fcn.004011b9
mov eax, 0xff
lea ecx, [ebp - 0x218]
push eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x406b3a
push dword [ebp - 0x10]
lea eax, [ebp - 0x118]
push 0x426660
push eax
call fcn.00417b44
mov ecx, dword [ebp + 0xc]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call fcn.00401af4
jmp 0x406b43
push 1
mov ecx, esi
call fcn.00402b3b
lea ecx, [ebp - 0xc]
call fcn.0040107a
xor eax, eax
pop esi
leave
ret 8

Function at 0x406b52
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
mov esi, ecx
push 0x42b598
lea ecx, [ebp - 0xc]
call fcn.00401000
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov ecx, dword [ebp + 8]
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
lea ecx, [ebp - 0xc]
call fcn.004010e1
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
dec eax
push eax
call fcn.00401083
cmp byte [eax], 0x5c
je 0x406bac
push 0x42653c
lea ecx, [ebp - 0xc]
call fcn.004011b9
mov eax, 0xff
lea ecx, [ebp - 0x218]
push eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x406beb
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push eax
call fcn.00401af4
jmp 0x406bf4
push 1
mov ecx, esi
call fcn.00402b3b
lea ecx, [ebp - 0xc]
call fcn.0040107a
xor eax, eax
pop esi
leave
ret 8
Function at 0x406c90
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
xor esi, esi
mov dword [ebp - 0x18], ecx
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x422488
push 1
push esi
push 0x422478
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x406e3a
mov eax, dword [ebp - 4]
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [eax]
mov ecx, esi
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push dword [ebp - 4]
call dword [edi + 0x50]
mov edi, dword [ebp + 0xc]
cmp edi, 2
jbe 0x406d0c
mov eax, dword [ebp - 4]
push 2
mov ecx, esi
mov ebx, dword [eax]
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push dword [ebp - 4]
call dword [ebx + 0x24]
cmp edi, 3
jbe 0x406d2d
mov eax, dword [ebp - 4]
push 3
mov ecx, esi
mov ebx, dword [eax]
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push dword [ebp - 4]
call dword [ebx + 0x2c]
cmp edi, 4
jbe 0x406d4e
mov eax, dword [ebp - 4]
push 4
mov ecx, esi
mov ebx, dword [eax]
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push dword [ebp - 4]
call dword [ebx + 0x1c]
cmp edi, 5
jbe 0x406d71
mov eax, dword [ebp - 4]
push 0
push 5
mov ecx, esi
mov ebx, dword [eax]
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push dword [ebp - 4]
call dword [ebx + 0x44]
cmp edi, 6
jbe 0x406dc7
lea eax, [ebp - 8]
mov ecx, esi
push eax
lea eax, [ebp - 6]
push eax
lea eax, [ebp - 7]
push eax
lea eax, [ebp - 5]
push eax
lea eax, [ebp - 0x14]
push eax
push 6
call fcn.00402301
mov ecx, eax
call fcn.004018ad
mov ecx, dword [ebp - 0x18]
push eax
call fcn.004148f3
push 1
pop ecx
cmp al, cl
jne 0x406dc7
cmp byte [ebp - 5], 0
jne 0x406db3
mov cl, byte [ebp - 0x10]
mov eax, dword [ebp - 4]
or cl, 6
xor ebx, ebx
mov edx, dword [eax]
mov bh, cl
or ebx, dword [ebp - 0x14]
push ebx
push eax
call dword [edx + 0x34]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push 0x422498
mov ecx, dword [eax]
push eax
call dword [ecx]
pop edi
pop ebx
test eax, eax
jl 0x406e2f
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0xffffffffffffffff
push 1
mov ecx, esi
call fcn.00402301
mov ecx, eax
call fcn.004018ad
xor esi, esi
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x220]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jge 0x406e26
mov ecx, dword [ebp + 0x10]
push esi
call fcn.00401aa7
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x406e43
mov ecx, dword [ebp + 0x10]
push esi
call fcn.00401aa7
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
leave
ret 0xc
Function at 0x406fef
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov ecx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x128]
xor ebx, ebx
push eax
push ebx
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.0041530e
lea eax, [ebp - 0x128]
push eax
call fcn.00417850
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x128]
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0xa], ebx
push eax
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x54
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je 0x40706a
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.00401aa7
xor eax, eax
pop ebx
leave
ret 8

Function at 0x407071
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push 0x42b598
lea ecx, [ebp - 0xc]
call fcn.00401000
mov ecx, dword [ebp + 8]
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40714f
test bl, 1
je 0x4070bd
push 0x42668c
lea ecx, [ebp - 0xc]
call fcn.004011b9
test bl, 0x20
je 0x4070cf
push 0x426688
lea ecx, [ebp - 0xc]
call fcn.004011b9
test bl, 4
je 0x4070e1
push 0x426684
lea ecx, [ebp - 0xc]
call fcn.004011b9
test bl, 2
je 0x4070f3
push 0x426680
lea ecx, [ebp - 0xc]
call fcn.004011b9
test bl, 0x80
je 0x407105
push 0x42667c
lea ecx, [ebp - 0xc]
call fcn.004011b9
test bl, 0x10
je 0x407117
push 0x426678
lea ecx, [ebp - 0xc]
call fcn.004011b9
test bh, 0x10
je 0x407129
push 0x426674
lea ecx, [ebp - 0xc]
call fcn.004011b9
test bh, 8
je 0x40713b
push 0x426670
lea ecx, [ebp - 0xc]
call fcn.004011b9
test bh, 1
je 0x407158
push 0x42666c
lea ecx, [ebp - 0xc]
call fcn.004011b9
jmp 0x407158
push 1
mov ecx, esi
call fcn.00402b3b
push dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
call fcn.00401af4
lea ecx, [ebp - 0xc]
call fcn.0040107a
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x4073c0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
lea eax, [ebp - 0x140]
push edi
push eax
push dword [ebp + 8]
mov ebx, ecx
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x407457
lea eax, [ebp - 0x114]
push str..__
push eax
call fcn.004178e0
pop ecx
test eax, eax
pop ecx
je 0x40743e
lea eax, [ebp - 0x114]
push 0x426520
push eax
call fcn.004178e0
pop ecx
test eax, eax
pop ecx
je 0x40743e
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov ecx, dword [ebp + 0x10]
or eax, dword [ebp + 0xc]
not ecx
and eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
je 0x407450
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jmp 0x4073e5
xor bl, bl
jmp 0x407500
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x14], 0
jne 0x40746b
mov al, 1
jmp 0x407509
lea eax, [ebp - 0x140]
push eax
push 0x42651c
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x4074fe
mov esi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov eax, dword [ebp - 0x140]
and eax, 0x10
cmp al, 0x10
jne 0x4074ec
lea eax, [ebp - 0x114]
push str..__
push eax
call fcn.004178e0
pop ecx
test eax, eax
pop ecx
je 0x4074ec
lea eax, [ebp - 0x114]
push 0x426520
push eax
call fcn.004178e0
pop ecx
test eax, eax
pop ecx
je 0x4074ec
lea eax, [ebp - 0x114]
push eax
call esi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004073c0
test al, al
je 0x407450
push 0x426520
call esi
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x407486
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x40800d
Capabilities:
Set environment variable

Disassembly:
cmp dword [esp + 8], 2
jb 0x408029
mov ecx, dword [esp + 4]
push 1
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
jmp 0x40802b
push 0
mov ecx, dword [esp + 8]
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
xor eax, eax
ret 8

Function at 0x40807f
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
mov edi, ecx
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4080ba
push dword [0x433c98]
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4080ba
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
jne 0x4080ca
call dword [sym.imp.USER32.dll_CloseClipboard]
push 1
mov ecx, edi
call fcn.00402b3b
pop edi
xor eax, eax
pop esi
ret 4
mov ecx, dword [esp + 0xc]
push eax
call fcn.00401af4
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4080c3
Function at 0x4080e3
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
push 0
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.00417850
pop ecx
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x408111
push eax
jmp 0x408120
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edi, eax
push 0
test edi, edi
jne 0x40812b
mov ecx, dword [esp + 0x14]
call fcn.00401aa7
jmp 0x40816c
mov ecx, dword [esp + 0x10]
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push edi
call fcn.00417750
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push dword [0x433c98]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x409307
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push edi
xor edi, edi
push 0x7f8a
push edi
call esi
push 0x7f00
push edi
mov dword [ebp - 0x50], eax
call esi
push 0x7f03
push edi
mov dword [ebp - 0x4c], eax
call esi
push 0x7f8b
push edi
mov dword [ebp - 0x48], eax
call esi
push 0x7f01
push edi
mov dword [ebp - 0x44], eax
call esi
push 0x7f81
push edi
mov dword [ebp - 0x40], eax
call esi
push 0x7f88
push edi
mov dword [ebp - 0x3c], eax
call esi
push 0x7f80
push edi
mov dword [ebp - 0x38], eax
call esi
push 0x7f86
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f83
push edi
mov dword [ebp - 0x30], eax
call esi
push 0x7f85
push edi
mov dword [ebp - 0x2c], eax
call esi
push 0x7f82
push edi
mov dword [ebp - 0x28], eax
call esi
push 0x7f84
push edi
mov dword [ebp - 0x24], eax
call esi
push 0x7f04
push edi
mov dword [ebp - 0x20], eax
call esi
push 0x7f02
push edi
mov dword [ebp - 0x1c], eax
call esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
push edi
push eax
mov dword [ebp - 4], eax
call esi
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
call dword [sym.imp.USER32.dll_GetCursor]
push edi
push edi
push dword [ebp - 4]
mov dword [ebp - 8], eax
call esi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor ecx, ecx
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 8]
cmp edx, edi
je 0x40941c
cmp edx, dword [eax]
je 0x409425
inc ecx
add eax, 4
cmp ecx, 0xe
jle 0x409411
cmp ecx, 0xe
jg 0x40942e
inc ecx
push ecx
jmp 0x40942f
push edi
mov ecx, dword [ebp + 8]
call fcn.00401aa7
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x40e031
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 1]
push esi
push eax
lea eax, [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 1], bl
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
call fcn.00414d23
add esp, 0xc
test al, al
jne 0x40e076
push 0xffffffffffffffff
push 0x88
mov ecx, esi
call fcn.004027ec
push 1
pop eax
jmp 0x40e09d
cmp byte [ebp - 1], bl
je 0x40e09b
push dword [ebp + 8]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop esi
pop ebx
leave
ret 4
Function at 0x40ebfb
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x42b598
lea ecx, [ebp - 0x20]
push esi
call fcn.00401000
push esi
lea ecx, [ebp - 0x14]
call fcn.00401000
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
push ebx
mov ecx, esi
call fcn.00402301
mov ecx, eax
call fcn.004018ad
sub esp, 0xc
mov ecx, esp
push eax
call fcn.00401000
mov ecx, edi
call fcn.0040e41d
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040e480
test al, al
jne 0x40ec71
push 0xffffffffffffffff
push 0x89
mov ecx, edi
call fcn.004027ec
push 1
pop esi
jmp 0x40ec96
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40ecad
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.00401aa7
xor esi, esi
lea ecx, [ebp - 0x14]
call fcn.0040107a
lea ecx, [ebp - 0x20]
call fcn.0040107a
mov eax, esi
jmp 0x40ed34
mov eax, dword [esi]
dec eax
je 0x40ecf0
dec eax
jne 0x40ed22
push 1
mov ecx, esi
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x40ece5
cmp eax, 2
jne 0x40ecdb
push ebx
jmp 0x40ecdd
push 2
mov ecx, dword [ebp + 0xc]
call fcn.00401aa7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ed22
push dword [ebp - 4]
call fcn.0040ed3b
pop ecx
mov bl, al
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x40ed18
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x40ed22
mov ecx, dword [ebp + 0xc]
push 2
call fcn.00401aa7
lea ecx, [ebp - 0x14]
call fcn.0040107a
lea ecx, [ebp - 0x20]
call fcn.0040107a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40ed3b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
xor ebx, ebx
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 8], 0xff
push eax
push ebx
push dword [ebp + 8]
call esi
mov edi, 0x103
cmp eax, edi
je 0x40ede4
lea eax, [ebp - 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x114]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ede8
push dword [ebp - 0xc]
call fcn.0040ed3b
pop ecx
mov byte [ebp - 1], al
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x40ede8
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x40ede8
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0xff
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
call esi
jmp 0x40ed73
mov al, 1
jmp 0x40edea
xor al, al
pop edi
pop esi
pop ebx
leave
ret