joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bd6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0xc], 0xffffffff
push 4
lea ecx, [ebp - 0x2c]
mov edi, edx
call fcn.004013fc
xor esi, esi
mov dword [ebp - 0x10], 0xffffffff
inc esi
lea ecx, [ebp - 0x20]
push esi
call fcn.004013fc
mov dword [ebp - 8], 0xf0c3da55
mov dword [ebp - 8], 0
jmp 0x401c23
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x401c17
mov dword [ebp - 8], 0
jmp 0x401c42
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x401c32
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x2c]
add eax, 6
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, dword [esi + 4]
setne al
xor edx, edx
mov dword [esi + 4], eax
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp dword [eax], edx
jg 0x401cb8
mov byte [ebp - 1], cl
cmp byte [ebp - 1], cl
je 0x401c9b
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
xor ecx, ecx
mov byte [ebp - 1], cl
cmp byte [ebp - 1], 0
je 0x401d15
push 0x15da
push ecx
push 0xb78
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x401d13
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0xcbedfa9
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov byte [ebp - 1], cl
cmp byte [ebp - 1], cl
je 0x401cfe
push ecx
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor ecx, ecx
mov byte [ebp - 1], cl
cmp byte [ebp - 1], 0
je 0x401d15
push 0xc51
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor ecx, ecx
mov byte [ebp - 1], cl
cmp byte [ebp - 1], 0
je 0x401d2c
push 0x22cb
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [ebp - 0x20]
call fcn.004014ce
lea ecx, [ebp - 0x2c]
call fcn.004014ce
push edi
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call fcn.004078d1
mov eax, dword [ebp - 0x14]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406870
Capabilities:
Get file attributes
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4068c5
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4068a5
push 0
push 0x1228
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x4068c3
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4068c3
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4068d3
push 0x16eb
push 0
call fcn.004134df
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x406a2c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x406a86
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x406a6d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x406a6b
push 0xb96
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x406a84
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x406abd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x406aa9
push 0x182e
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406abd
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
and dword [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x4073de
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4074b6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x407469
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xa
jmp 0x407446
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffffd
je 0x407467
push 0x2b14
push 0
push 0x7a7a
push dword [ebp - 0x20]
call fcn.00411cd7
add esp, 0x10
jmp 0x40743b
jmp 0x4074b4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x407497
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x4074b4
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.004014ea
mov dword [eax], 3
jmp 0x40748c
jmp 0x4074e6
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x4074da
push 1
push 0x6a2
push 0x5af
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x4074e6
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
mov esp, ebp
pop ebp
ret

Function at 0x4077fb
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x407874
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40784f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40784d
push 1
push 0x3563
push 0x66d4
push 0
push 0x2ae7
push 0x4938
push 1
call fcn.0040770a
add esp, 0x1c
jmp 0x407872
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x407872
push 0
push 0x10e5
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x40789a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 0x6992
push dword [ebp - 0x18]
push 0
push 0x16ca
push dword [ebp - 0x1c]
call fcn.004073be
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x408e71
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x408ea6
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x408e9c
push 0x2222
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x408ea4
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x408ec9
push 0x18d2
push 0x1274
push 0x2c13
push 0x168f
push 0
push 0xb8
call fcn.004080fe
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x4112c5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4112e0
push 1
call fcn.004113fc
pop ecx
jmp 0x4113f8
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4113dc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41136a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffff0
jle 0x4113da
push 4
lea ecx, [ebp - 0x5c]
call fcn.004013fc
push 0x7008
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0x6267
push 0
call fcn.00408221
add esp, 0x14
push dword [ebp - 0x34]
push 0x6570
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x7562
push 0x62e7
push 0
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x3393
push dword [ebp - 0x40]
push dword [ebp - 4]
push 0x5c76
call fcn.00412c8e
add esp, 0x34
lea ecx, [ebp - 0x5c]
call fcn.004014ce
jmp 0x41135f
jmp 0x4113f8
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x4113f8
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esp, ebp
pop ebp
ret
Function at 0x413030
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x413154
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x413131
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
push 2
pop eax
test eax, eax
je 0x41310c
mov eax, dword [ebp - 0x54]
cmp dword [eax], 0
je 0x41310c
mov dword [ebp - 4], 1
jmp 0x413110
and dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x58]
call fcn.004014ea
mov eax, dword [eax]
imul eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x413152
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
test eax, eax
je 0x413152
push 0x257d
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x413162
push 0x225f
push 0
call fcn.00406c1b
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x414110
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x41426c
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x414243
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xfffffff7
jmp 0x4141be
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffff5
je 0x414241
mov dword [ebp - 0x54], 0xd6b65720
mov dword [ebp - 0x58], 0x3b1dab55
mov dword [ebp - 0x40], 0xffff
push 1
push 0x5930
push 0x3361
push dword [ebp - 0x3c]
push 0x7018
lea eax, [ebp - 0x40]
push eax
push 0x4fd9
push 0x385e
push 0x7403
push dword [ebp - 0x44]
push 0x43e2
push 0x757e
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 4]
push 0x6177
push 0x2049
push dword [ebp - 0x50]
push 1
lea eax, [ebp - 0x54]
push eax
push 0x3dc6
lea eax, [ebp - 0x58]
push eax
call fcn.00412564
add esp, 0x58
jmp 0x4141b3
jmp 0x41426a
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x41426a
push 0x22cb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x41428d
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x68], eax
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push 0x5bdd
push 1
call fcn.00411db8
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x41449f
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4144ee
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4144dc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4144ec
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x414526
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push 0x6def
push dword [ebp - 0x14]
push 0x5949
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0
call fcn.004074ea
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x422edb
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x1f7e2799
mov dword [ebp - 8], 0xfffffffe
jmp 0x422ef7
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x422f27
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x422f11
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x422f25
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x422ef0
push dword [ebp + 0xc]
push 0x32af
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push 0x1081
call fcn.00423225
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x427033
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x427086
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x427072
push 0
push 0xf4c
push 0x145
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x427084
push 1
push 0x6a2
push 0x5af
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x42709e
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
push 0x56e4
push dword [ebp - 8]
call fcn.004270f4
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4270a2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4270d8
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4270c9
push 0
call fcn.004277fd
pop ecx
jmp 0x4270d6
push 0x1e7
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4270f0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x64bf
push 0
push dword [ebp - 8]
call fcn.0042ae0b
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x42b01a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x42b078
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42b05d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x42b076
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 0x10
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x42b0ce
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x42b0b9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x42b0b7
push 0x1e7
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x42b0ce
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [eax], 2
mov esp, ebp
pop ebp
ret
Function at 0x448964
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4489da
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4489ae
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4489ac
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x4489d8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4489d8
push 0x627e
push 0
push 0x24bf
call fcn.0044914e
add esp, 0xc
jmp 0x4489e8
push 0x419d
push 0
call fcn.00453790
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x449166
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4491e4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4491da
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4491be
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x4491d8
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.004014ea
or dword [eax], 0xffffffff
jmp 0x4491b3
jmp 0x4491e2
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x449207
push 0x6d28
push 0
push 0x4d1f
push 0x757f
push 0x37ea
push 0x47fd
call fcn.0044b090
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x44948b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4494d4
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4494c3
mov byte [ebp - 1], 0
push 0x5271
lea eax, [ebp - 1]
push eax
push 1
push 1
call fcn.00448964
add esp, 0x10
jmp 0x4494d2
push 0xb96
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x4494e2
push 0x76ca
push 1
call fcn.0044805f
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x44a5a2
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x44a5d3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x764e
push 1
call fcn.0044a616
add esp, 0x10
jmp 0x44a612
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44a5fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x44a612
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret