joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d040
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539d28
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x59e074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 8]
lea ecx, [ebx + 8]
push dword [esi + 4]
call fcn.004404b0
mov eax, dword [ebx + 8]
lea ecx, [ebx + 0x18]
mov dword [eax + 4], esi
mov eax, dword [ebx + 8]
mov dword [eax], esi
mov eax, dword [ebx + 8]
mov dword [eax + 8], esi
mov dword [ebx + 0xc], 0
mov esi, dword [ebx + 0x18]
push dword [esi + 4]
call fcn.004404b0
mov eax, dword [ebx + 0x18]
lea ecx, [ebx + 0x10]
mov dword [eax + 4], esi
mov eax, dword [ebx + 0x18]
mov dword [eax], esi
mov eax, dword [ebx + 0x18]
mov dword [eax + 8], esi
mov dword [ebx + 0x1c], 0
call fcn.004400c0
mov esi, dword [ebx + 0x20]
lea ecx, [ebx + 0x20]
push dword [esi + 4]
call fcn.00440410
mov eax, dword [ebx + 0x20]
lea ecx, [ebx + 0x28]
mov dword [eax + 4], esi
mov eax, dword [ebx + 0x20]
mov dword [eax], esi
mov eax, dword [ebx + 0x20]
mov dword [eax + 8], esi
mov dword [ebx + 0x24], 0
call fcn.0043ff50
lea ecx, [ebx + 0x30]
call fcn.0043fe50
push 0
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.0042fb90
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 2
lea eax, [ebp - 0x14]
cmp ebx, eax
je 0x43d131
mov eax, dword [ebx]
mov dword [ebx], ecx
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.0042f9e0
mov dword [ebp - 4], 0xffffffff
push 0x54
push dword [ebp - 0x14]
call fcn.00509dd1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461100
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x59e074]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.0050c400
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x46115c
cmp dword [esp + 4], 6
jb 0x46115c
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00509af6
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.00509af6
add esp, 0x118
ret
Function at 0x462f60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540398
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [ebp - 0x14], 0
call fcn.00509b07
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [eax], 0
lea eax, [ebp - 0x134]
push 0x118
push 0
push eax
call fcn.0050c400
add esp, 0xc
mov dword [ebp - 0x138], 0x11c
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x462fe7
cmp dword [ebp - 0x134], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x14]
call fcn.00410820
test al, al
je 0x463011
lea ecx, [ebp - 0x14]
call fcn.004101c0
test al, al
jne 0x463011
xor bl, bl
jmp 0x463077
lea edx, [esi + 4]
xor ecx, ecx
call fcn.00412430
test al, al
jne 0x463027
lea ecx, [esi + 4]
call fcn.0040a5a0
lea edx, [esi + 0x1c]
mov ecx, 0x1a
call fcn.00412430
test al, al
jne 0x463040
lea ecx, [esi + 0x1c]
call fcn.0040a5a0
lea edx, [esi + 0x34]
mov ecx, 2
call fcn.00412430
test al, al
jne 0x463059
lea ecx, [esi + 0x34]
call fcn.0040a5a0
lea edx, [esi + 0x4c]
mov ecx, 0xb
call fcn.00412430
test al, al
jne 0x463072
lea ecx, [esi + 0x4c]
call fcn.0040a5a0
mov byte [esi], 1
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040fb00
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret
Function at 0x4630b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5403e1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0
call fcn.00404680
mov ebx, eax
cmp dword [eax + 0x14], 8
jb 0x4630fc
mov ebx, dword [eax]
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x14], 0x25
test edx, edx
je 0x4631e7
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00406200
add esp, 4
test eax, eax
je 0x4631e7
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x4631e7
push edi
lea ecx, [ebp - 0x2c]
call fcn.004056c0
mov dword [ebp - 4], 1
mov ecx, edi
push 0
push 0
call fcn.004045c0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x46317a
push edi
mov ecx, esi
call fcn.004056c0
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00404600
jmp 0x4631fd
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00509f18
mov edx, dword [ebp - 0x14]
add esp, 4
inc edx
mov ebx, eax
mov ecx, edi
push edx
push ebx
call fcn.004045c0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4631ce
cmp eax, dword [ebp - 0x14]
ja 0x4631ce
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call fcn.00404920
add esp, 4
lea ecx, [ebp - 0x2c]
push eax
push ebx
call fcn.00404720
push ebx
call fcn.00509f13
add esp, 4
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00404ba0
jmp 0x463162
push edi
mov ecx, esi
call fcn.004056c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret 8
Function at 0x463a60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54050e
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x208
push 0
push eax
call fcn.0050c400
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.MacromedFlashFlashHelperService.exe
lea ecx, [ebp - 0x26c]
call fcn.00404610
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x254]
call fcn.00404610
mov byte [ebp - 4], 1
lea eax, [ebp - 0x26c]
push eax
lea edx, [ebp - 0x254]
lea ecx, [ebp - 0x238]
call fcn.004122b0
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x254]
call fcn.00404600
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x26c]
call fcn.00404600
lea ecx, [ebp - 0x238]
call fcn.0040cd40
test al, al
je 0x463bd7
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x220], 0
call fcn.00509b07
add esp, 4
mov dword [ebp - 0x23c], eax
mov byte [ebp - 4], 5
mov dword [eax], 0
mov dword [eax], 0xffffffff
mov byte [ebp - 4], 4
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x238]
push 0x80
push 4
push ecx
push SysReAllocString
push eax
lea ecx, [ebp - 0x220]
call fcn.0041efb0
test al, al
jne 0x463bdb
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x220]
test esi, esi
je 0x463bd7
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x463bc2
test eax, eax
je 0x463bc2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.00509dd1
add esp, 8
mov dword [ebp - 0x220], 0
xor bl, bl
jmp 0x463c24
push esi
lea ecx, [ebp - 0x220]
call fcn.0041f100
mov bl, al
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x220]
test esi, esi
je 0x463c24
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x463c0f
test eax, eax
je 0x463c0f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.00509dd1
add esp, 8
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00404600
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret 4
Function at 0x467120
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540c9c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59e074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 4
lea ecx, [esi + 0x48]
call fcn.00404600
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.00404600
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.00404600
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00404600
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00404600
push 0x88
push ebx
call fcn.00509dd1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x467590
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540cf9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x59e074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.00404690
mov ecx, ebx
call fcn.00404680
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push eax
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
call fcn.004062f0
add esp, 8
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x467765
dec eax
mov dword [ebp + 8], eax
mov al, byte [edi]
inc edi
mov byte [ebp + esi - 0x14], al
inc esi
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edi
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x4676a7
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
mov byte [ebp - 0x16], cl
and al, 0x3f
mov ecx, 0x5a44a0
mov byte [ebp - 0x15], al
call fcn.00404680
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x467682
mov ecx, dword [esi]
movzx eax, byte [ebp + edi - 0x18]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
call fcn.004431f0
inc edi
cmp edi, 4
jl 0x467678
mov edi, dword [ebp - 0x20]
xor esi, esi
mov dl, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x467613
mov dword [ebp + 8], esi
test esi, esi
je 0x467765
mov eax, esi
cmp esi, 3
jge 0x4676e1
cmp eax, 3
jae 0x467779
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x4676c7
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [esi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x46774b
mov ecx, 0x5a44a0
call fcn.00404680
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x467731
mov ecx, dword [esi]
movzx eax, byte [ebp + edi - 0x18]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
call fcn.004431f0
inc edi
cmp edi, dword [ebp - 0x20]
jl 0x467727
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x467765
mov edi, 3
sub edi, esi
push 0x3d
mov ecx, ebx
call fcn.004431f0
sub edi, 1
jne 0x467757
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0050a28d
int3
Function at 0x467860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540d89
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x59e074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 8]
mov dword [edi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 4
lea ecx, [edi + 0x24]
call fcn.004688f0
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0x30]
mov eax, dword [ebp + 8]
mov dword [edi], vtable.RC::RCMiniUISimpleWindow.0
mov dword [edi + 0x24], vtable.RC::RCMiniUISimpleWindow.1.0
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x468540
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x59e074]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
mov edi, dword [esp + 0x128]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.0050c400
push 0x110
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0x114
push 0
push eax
call fcn.0050c400
add esp, 0x18
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4685a0
cmp dword [esp + 0xc], 6
mov eax, 0x30
jae 0x4685a5
mov eax, 0x2c
push edi
mov dword [esi], eax
mov dword [esi + 4], 0
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi + 0xc], edi
mov ecx, dword [0x5a2fc8]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x134]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x11c]
pop edi
mov dword [esi + 0x28], 0
pop esi
xor ecx, esp
call fcn.00509af6
add esp, 0x118
ret 0x18
Function at 0x4688f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541232
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x59e074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 0x14
mov dword [eax], vtable.RC::RCMiniUIWindow.0
call fcn.00509b07
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
lea esi, [edi + 4]
mov dword [edi], 1
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004111a0
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [edi + 0xc]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004620f0
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [ebp - 4], 7
mov edi, eax
push 0x78
mov dword [edi], vtable.RC::RCMiniUIDialogView.0
lea esi, [edi + 0x4c]
mov dword [edi + 0x10], 0xae
mov dword [edi + 0x14], 0xaf
mov dword [edi + 0x1c], edi
mov dword [edi + 0x24], edi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], vtable.RC::RCMiniUIBounceWndHandler.0
mov dword [edi + 0x48], edi
call fcn.00509b07
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
movaps xmm0, xmmword [0x574400]
movsd xmm1, qword [0x5741a8]
mov byte [eax], 0
movups xmmword [eax + 8], xmm0
movaps xmm0, xmmword [0x5743d0]
movsd qword [eax + 0x18], xmm1
movups xmmword [eax + 0x20], xmm0
movsd qword [eax + 0x30], xmm1
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 1
mov dword [eax + 0x48], 0
mov byte [ebp - 4], 9
mov dword [eax + 0x4c], 0
mov byte [ebp - 4], 0xa
mov dword [eax + 0x50], 0
mov byte [ebp - 4], 0xb
mov dword [eax + 0x54], 0
mov byte [ebp - 4], 0xc
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 0
xorps xmm0, xmm0
mov dword [eax + 0x64], 0
movsd qword [eax + 0x68], xmm0
mov dword [eax + 0x70], 1
mov dword [eax + 0x38], SysReAllocString
mov dword [eax + 0x3c], SysReAllocString
mov byte [ebp - 4], 7
mov dword [edi + 0x44], eax
mov byte [ebp - 4], 0xd
push 0x60
mov byte [esi], 0
mov byte [edi + 0x4d], 0xff
call fcn.00509b07
add esp, 8
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
mov ecx, eax
call fcn.00468620
mov byte [ebp - 4], 0xd
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46aae0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5362e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x46ac53
mov eax, dword [ecx + 0xb8]
mov eax, dword [eax + 0x38]
test eax, eax
je 0x46ac53
cmp dword [eax + 4], 0
je 0x46ac53
call fcn.0047ef10
mov edi, eax
test edi, edi
je 0x46ac53
mov eax, dword [ebp + 8]
sub eax, 0x10d
je 0x46ac44
sub eax, 1
je 0x46ac2c
sub eax, 1
jne 0x46ac53
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
cmp dword [edi + 4], 0
mov ebx, eax
mov dword [ebp - 0x30], ebx
je 0x46ac53
mov ecx, edi
call fcn.00480bc0
push ebx
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov ebx, eax
test ebx, ebx
je 0x46ac53
lea ecx, [ebp - 0x28]
call fcn.00404660
mov dword [ebp - 4], 0
test dword [ebp + 0x10], 0x800
je 0x46ac05
push 0
push 0
push 0x800
push ebx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov dword [ebp - 0x2c], eax
test eax, eax
jle 0x46ac05
mov esi, eax
shr esi, 1
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00404af0
push 0
push esi
lea ecx, [ebp - 0x28]
call fcn.00480cd0
lea ecx, [ebp - 0x28]
call fcn.00404680
cmp dword [eax + 0x14], 8
jb 0x46abf5
mov eax, dword [eax]
push dword [ebp - 0x2c]
push eax
push 0x800
push ebx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404600
jmp 0x46ac53
mov byte [edi + 8], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
jmp 0x46ac53
mov ecx, edi
mov byte [edi + 8], 0
call fcn.00480bc0
mov byte [edi + 0x10], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00509af6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46d470
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
test edi, edi
je 0x46d4d5
cmp dword [edi], 0
mov esi, dword [esi]
je 0x46d4b5
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46d4cb
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46d4cb
push 0
push dword [edi]
push 0
push 0
push dword [esp + 0x1c]
push esi
call eax
pop edi
pop esi
ret 4
cmp dword [edi + 4], 0
je 0x46d4cb
push dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
cmp byte [0x5a4c40], 0
jne 0x46d515
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46d507
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5a4c44], eax
mov byte [0x5a4c40], 1
jmp 0x46d51a
mov eax, dword [0x5a4c44]
mov byte [0x5a4c40], 1
jmp 0x46d51a
mov eax, dword [0x5a4c44]
test eax, eax
je 0x46d530
push 0
push dword [esi + 4]
push dword [esp + 0x14]
push dword [esi]
call eax
pop edi
pop esi
ret 4
push dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
Function at 0x46ddb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xffffffffffffffff
push 0x541c03
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x59e074]
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x41c]
mov eax, dword [ebp + 0x420]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x424]
mov dword [ebp - 0x14], eax
mov dword [ebp + 0x40c], 0
mov dword [ebp + 0x40c], 0
mov dword [ebp - 4], 0
mov dword [ebp + 0x408], ecx
mov dword [ebp + 0x404], 0
push 0x404
push 0
lea eax, [ebp]
push eax
call fcn.0050c400
add esp, 0xc
mov dword [ebp], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x46de7e
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x46de7e
call fcn.0046d180
mov edi, eax
jmp 0x46df89
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x46de9b
call fcn.0046d180
jmp 0x46df7c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x46deb6
call fcn.0046d180
jmp 0x46df7c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x14], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x46ded4
mov edi, 0x8007000e
jmp 0x46df7e
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
test edx, edx
ja 0x46dfcb
jb 0x46def8
cmp eax, 0xffffffff
ja 0x46dfcb
cmp eax, 0x400
jbe 0x46df11
push eax
lea ecx, [ebp]
call fcn.00471010
mov dword [ebp - 4], 1
jmp 0x46df36
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x46df36
mov eax, dword [ebp]
test eax, eax
jne 0x46df44
mov edi, 0x8007000e
jmp 0x46df7e
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x46df5f
call fcn.0046d180
jmp 0x46df7c
xor edx, edx
mov eax, dword [ebp]
mov word [eax + ecx*2], dx
push dword [ebp + 0x428]
push dword [ebp]
lea ecx, [ebp + 0x404]
call fcn.0046ec20
mov edi, eax
test esi, esi
je 0x46df89
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x46df9d
lea ecx, [ebp]
call fcn.00471000
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.00509af6
lea esp, [ebp + 0x414]
pop ebp
ret 0x10
push 0x80070216
call fcn.004677b0
int3