joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d6af
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x42d7ad
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42d748
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42d73c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x42d746
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x42d7ab
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0x5f6e
push 0x2bac
push 0x68d5
push 0
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 0
call fcn.00439faf
add esp, 0x34
jmp 0x42d7cf
push 0x2f83
push 0
push 0x3fa3
push 0x3e
push 0x554a
push 0x4b39
push 1
call fcn.0042efb3
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x4321c6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x432287
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x432246
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x432237
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x4e4d
push 0
push 0x2bad
push 0xff6
push 0x4f86
push 0x24a0
push 1
push 1
push 1
call fcn.0042dc7a
add esp, 0x28
jmp 0x432244
push 0
push 0x139c
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x432285
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0x4736
push 0
push 0x33db
push 0x1080
push 0x125b
push 0x5b83
push 0x469
push 0x3050
push 1
push 0x6f47
push 1
call fcn.0042e174
add esp, 0x30
jmp 0x4322f6
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4322ad
push 0x2729
push 1
push 0x6528
call fcn.00431b39
add esp, 0xc
jmp 0x4322f6
push 0xd4d
push 0x1957
push 0x480f
push 0
push 0x225e
push 0
push 1
push 0x3489
push 1
push 0x5152
push 0x4f82
push 0xbe6
push 0x7385
push 0x1b49
push 1
push 0x9a2
call fcn.004415a4
add esp, 0x40
mov esp, ebp
pop ebp
ret

Function at 0x433bc3
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x433c02
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 1
push 0x3c56
push 0x2a54
push dword [ebp - 8]
push 0x342
push 0x3bd6
push 0x6dd8
call fcn.00433ccd
add esp, 0x1c
jmp 0x433cc9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x433cbb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x433c91
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x433c72
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x433c8f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.0042713b
mov dword [eax], 0xfffffffe
jmp 0x433c67
jmp 0x433cb9
push 0
push 0x1d2a
push 0x122f
push 0x229c
push 0x2419
push 0x12a0
push 0x1a52
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x433cc9
push 0x1010
push 0
call fcn.004312ee
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x436f83
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x437006
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x436fc3
push 0x4c1e
push 1
push 0x1f01
call fcn.00437046
add esp, 0xc
jmp 0x437004
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x436fe1
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x437004
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x437004
push 0x1638
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x437042
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x374c
call fcn.0043b3ab
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x43b60c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43b692
lea eax, [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43b656
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 1
push 0x7069
push dword [ebp - 0x10]
call fcn.0043b715
add esp, 0xc
jmp 0x43b690
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43b685
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x43b690
push 0xb00
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x43b711
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43b6e2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 1
push 0x3ec6
push 0x4800
push 0x475b
push 0x72b4
push dword [ebp - 0x30]
push 0x4066
call fcn.00438d15
add esp, 0x1c
jmp 0x43b711
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 1
push dword [ebp - 0x3c]
push 0x5ef0
push dword [ebp - 0x40]
push 0x3e2
push 0
push 1
push 0x1866
call fcn.0043e4ab
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x43b7d9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x43b89a
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43b873
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43b85a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43b858
push 0x1638
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x43b871
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x43b898
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 1
push 0
push dword [ebp - 0x3c]
push 0x42ec
push 0
call fcn.00438906
add esp, 0x18
jmp 0x43b8d4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
push 0x649d
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 1
push 0
push 0x1f62
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.00441f78
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x43da3d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43db1c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43daef
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43dae0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43dac1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x43dade
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.0042713b
mov dword [eax], 7
jmp 0x43dab6
jmp 0x43daed
push 0x18ed
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x43db1a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
push 0x42f0
push 0x6cc5
push 0x4fae
push 0x7348
push 0
push 1
push dword [ebp - 0x34]
call fcn.0043e4ab
add esp, 0x20
jmp 0x43db24
push 1
call fcn.0042bbe5
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43eeef
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push esi
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x43efb3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x88]
movzx eax, byte [eax]
test eax, eax
je 0x43ef92
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x30], eax
push 1
push 0x1514
push 0x7b4c
push dword [ebp - 0x28]
push 0x6aa6
push 0x2826
push dword [ebp - 0x80]
push dword [ebp - 0x30]
push dword [ebp - 0x60]
push dword [ebp - 0x38]
call fcn.0043f098
add esp, 0x28
jmp 0x43efae
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x68]
push dword [ebp - 0x48]
push 0
call fcn.00444d24
add esp, 0xc
jmp 0x43f093
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43f008
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
push 1
call fcn.0043d9b1
add esp, 0xc
jmp 0x43f093
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x43f043
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43f041
push 0x5d6
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x43f093
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.0042713b
mov esi, eax
mov eax, dword [ebp - 0x8c]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.0042713b
mov ecx, dword [esi]
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x440980
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 8]
test eax, eax
je 0x440a5f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4409dd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x2c42
push dword [ebp - 0x10]
push 1
call fcn.00440a74
add esp, 0xc
jmp 0x440a5d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x440a2e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
jmp 0x440a5d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x440a5d
push 0
push 0
push 0
push 0
push 0
push 0
push 0x359
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x440a70
push 0x4911
push 1
push 1
call fcn.00436f52
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x487199
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x49c364
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4af6c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00482f1f
mov dword [ebp - 0x14], eax
cmp dword [0xab7e2c], esi
jne 0x49c457
push 0x800
push esi
push 0xaa2d9c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x49c3e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x49c537
push esi
push esi
push 0xaa2d9c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x49c537
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49c537
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xab7e2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xab7e30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xab7e34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xab7e3c], eax
test eax, eax
je 0x49c454
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xab7e38], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x49c47c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49c46f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x49c491
push 4
pop eax
jmp 0x49c539
cmp dword [ebp - 0x14], esi
je 0x49c491
push dword [0xab7e2c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x49c476
mov eax, dword [0xab7e38]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x49c4ef
cmp dword [0xab7e3c], edi
je 0x49c4ef
push eax
call ebx
push dword [0xab7e3c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x49c4ef
test eax, eax
je 0x49c4ef
call ecx
test eax, eax
je 0x49c4e4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x49c4e4
test byte [ebp - 8], 1
jne 0x49c4ef
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x49c51f
mov eax, dword [0xab7e30]
cmp eax, edi
je 0x49c51c
push eax
call ebx
test eax, eax
je 0x49c51c
call eax
mov esi, eax
test esi, esi
je 0x49c51c
mov eax, dword [0xab7e34]
cmp eax, edi
je 0x49c51c
push eax
call ebx
test eax, eax
je 0x49c51c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xab7e2c]
call ebx
test eax, eax
je 0x49c537
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x49c539
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048202b
mov esp, ebp
pop ebp
ret
Function at 0x4019db
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x58ced85
jg 0x401a01
inc edi
cmp edi, 0x1f6502b1
jl 0x4019e7
cmp dword [0x287441c], 0x400
jne 0x401a41
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelIo]
push esi
call fcn.00401e41
push esi
call fcn.00401f83
push esi
call fcn.00401f92
add esp, 0xc
xor edi, edi
cmp edi, 0xd036
jge 0x401a52
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0xd2ced2
jg 0x401a78
inc edi
cmp edi, 0x263ff
jl 0x401a43
mov eax, dword [0x486564]
mov dword [0x287441c], eax
call fcn.00401746
mov edi, 0x3078f
cmp dword [0x287441c], 0x51f
jne 0x401aa4
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401a8c
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10
Function at 0x40408b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46c310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403012
and dword [ebp - 0x14], 0
cmp dword [0x4910c0], 0
mov dword [ebp - 0x18], eax
jne 0x40413e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4041e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4041e6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4910c0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4910c4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4910c8], eax
call edi
push eax
call esi
mov dword [0x4910d0], eax
test eax, eax
je 0x40413e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4910cc], eax
mov eax, dword [0x4910cc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404197
cmp dword [0x4910d0], ecx
je 0x404197
push eax
call esi
push dword [0x4910d0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404197
test ebx, ebx
je 0x404197
call edi
test eax, eax
je 0x40418e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40418e
test byte [ebp - 8], 1
jne 0x404197
or dword [ebp + 0x10], 0x200000
jmp 0x4041ca
mov eax, dword [0x4910c4]
cmp eax, dword [ebp - 0x18]
je 0x4041ca
push eax
call esi
test eax, eax
je 0x4041ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4041ca
mov eax, dword [0x4910c8]
cmp eax, dword [ebp - 0x18]
je 0x4041ca
push eax
call esi
test eax, eax
je 0x4041ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4910c0]
call esi
test eax, eax
je 0x4041e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4041e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004043f6
leave
ret

Function at 0x4043f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46c310]
jne 0x404400
repz ret
jmp fcn.004052c9