joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd699
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x244
xor eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push ebp
push esi
push edi
mov ebp, ecx
xor esi, esi
push esi
push ebp
push 0x104
push 0x73
mov word [ebp], ax
call ebx
test eax, eax
je 0x4dd7b6
lea eax, [esp + 0x54]
push eax
push esi
push esi
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x54]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x4dd6dd
push 0xa
pop ecx
mov esi, str.Aeroadmin_black.bmp
lea eax, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
push 0x54e8cc
push eax
movsw word es:[edi], word [esi]
call fcn.0051872c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4dd7b4
xor eax, eax
mov dword [esp + 0x10], 0x3a4d42
push esi
push 0x3a
mov dword [esp + 0x1c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov word [esp + 0x50], ax
lea eax, [esp + 0x18]
push 1
push eax
mov dword [esp + 0x28], 0x360000
mov dword [esp + 0x2c], 0x280000
mov dword [esp + 0x30], 0x10000
mov dword [esp + 0x34], 0x10000
mov dword [esp + 0x38], 0x10000
mov dword [esp + 0x3c], 0x18
mov dword [esp + 0x40], 0x40000
mov dword [esp + 0x44], 0xb130000
mov dword [esp + 0x48], 0xb130000
call fcn.0051899d
push esi
call fcn.00518a6b
add esp, 0x14
lea eax, [esp + 0x54]
xor esi, esi
push 2
push eax
push esi
push 0x14
call ebx
test eax, eax
je 0x4dd7b6
push esi
push esi
push 0x1a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4dd7b6
xor esi, esi
push 8
pop edi
push esi
lea eax, [ebp + 0x208]
push eax
push edi
push 0x48
mov dword [eax], edi
call ebx
test eax, eax
je 0x4dd7e8
cmp dword [ebp + 0x20c], esi
je 0x4dd7e8
push 2
lea eax, [esp + 0x50]
mov dword [esp + 0x50], edi
push eax
push esi
push 0x49
mov dword [esp + 0x60], esi
call ebx
push esi
mov dword [ebp + 0x210], esi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 0x76
push ebx
call esi
push 8
push ebx
mov edi, eax
call esi
push ebx
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp esi, edi
jne 0x4dd86e
push str.dwmapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4dd86e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmIsCompositionEnabled
push edi
call esi
push str.DwmEnableComposition
push edi
mov ebx, eax
call esi
mov dword [ebp + 0x210], eax
test ebx, ebx
je 0x4dd86e
test eax, eax
je 0x4dd86e
lea eax, [esp + 0x4c]
push eax
call ebx
cmp dword [esp + 0x4c], 0
je 0x4dd867
push 0
call dword [ebp + 0x210]
jmp 0x4dd86e
and dword [ebp + 0x210], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x244
ret
Function at 0x4de9e1
Capabilities:
Migrate process to active window station

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
push edi
mov ebp, 0x2000000
xor ebx, ebx
push ebp
push ebx
push str.WinSta0
mov edi, ecx
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov esi, eax
test esi, esi
je 0x4dea15
push esi
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
push 0x212
lea eax, [esp + 0x1c]
mov byte [esp + 0x17], bl
push ebx
push eax
call fcn.005055e0
add esp, 0xc
push ebp
push ebx
push ebx
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov ebp, dword [sym.imp.USER32.dll_CloseDesktop]
mov esi, eax
test esi, esi
je 0x4dead7
push ebx
push 0x212
lea eax, [esp + 0x20]
push eax
push 2
push esi
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x4dead4
lea ecx, [esp + 0x18]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4dea64
sub ecx, edx
sar ecx, 1
je 0x4dead4
lea ecx, [esp + 0x18]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4deaa1
test dx, dx
je 0x4dea9d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4deaa1
add eax, 4
add ecx, 4
test dx, dx
jne 0x4dea7b
mov eax, ebx
jmp 0x4deaa6
sbb eax, eax
or eax, 1
test eax, eax
je 0x4dead4
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp eax, 1
jne 0x4dead4
lea ecx, [esp + 0x18]
mov edx, edi
mov eax, ecx
sub edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4deac0
mov byte [esp + 0x13], 1
push esi
call ebp
lea ecx, [esp + 0x18]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4deade
sub ecx, edx
sar ecx, 1
jne 0x4deb1f
push 0x2000000
push ebx
push ebx
mov esi, str.Default
push esi
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov ebx, eax
test ebx, ebx
je 0x4deb1f
push ebx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp eax, 1
jne 0x4deb1c
movsd dword es:[edi], dword [esi]
mov byte [esp + 0x13], al
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
call ebp
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
Function at 0x4e4154
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
movzx edx, byte [ebp + 0x18]
movzx eax, byte [ebp + 0x1c]
push esi
push ecx
push ecx
push dword [ebp + 0x28]
shl edx, 0xd
mov esi, ecx
push dword [ebp + 0x20]
shl eax, 0xb
or edx, eax
or edx, 0x50010082
push edx
push dword [ebp + 0x10]
push str.edit
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004e3ea9
mov eax, dword [ebp + 0x2c]
push 1
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x24]
push eax
push 0x30
push dword [esi + 8]
mov dword [esi], 0x55d118
mov dword [esi + 0x40], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop esi
pop ebp
ret 0x2c

Function at 0x4e41fe
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp - 0x200]
push eax
push 0x100
push 0xd
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x200]
push eax
call fcn.0043a44d
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x4e4281
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push esi
lea eax, [ebp - 0xb0]
push eax
push 0x40
push 0xd
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
xor eax, eax
push 7
pop esi
mov word [ebp - 0x18], ax
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 4], esi
call fcn.0043c2b9
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.004a4938
lea ecx, [ebp - 0x18]
call fcn.0043c274
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
xor eax, eax
mov dword [ebp - 4], esi
mov word [ebp - 0x18], ax
lea eax, [ebp - 0xb0]
push eax
call fcn.0043c2b9
lea ecx, [ebp - 0x18]
call fcn.004a4a35
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0043c274
lea ecx, [ebp - 0x30]
call fcn.0043c446
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e79f0
Capabilities:
Hash data with crc32

Disassembly:
test edx, edx
jne 0x4e79f7
xor eax, eax
ret
jmp fcn.004e79fc
Function at 0x4e886b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov ebx, dword [edi + 0x2c]
mov ebp, dword [edi + 0x74]
mov dword [esp + 0x18], ebx
mov eax, dword [edi + 0x2c]
mov esi, dword [edi + 0x3c]
add eax, 0xfffffefa
sub esi, dword [edi + 0x6c]
add eax, ebx
sub esi, ebp
cmp dword [edi + 0x6c], eax
jb 0x4e8916
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.00505060
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [esp + 0x14], ecx
lea ebp, [eax + ecx*2]
lea ebp, [ebp - 2]
xor ecx, ecx
movzx eax, word [ebp]
mov edx, eax
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [ebp], cx
sub edi, 1
jne 0x4e88c2
mov edi, dword [esp + 0x10]
mov ecx, ebx
mov dword [esp + 0x14], ecx
mov eax, dword [edi + 0x40]
mov edi, ebx
lea ebp, [eax + ecx*2]
lea ebp, [ebp - 2]
xor ecx, ecx
movzx eax, word [ebp]
mov edx, eax
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [ebp], cx
sub edi, 1
jne 0x4e88f2
mov edi, dword [esp + 0x10]
add esi, ebx
mov ebx, dword [edi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4e8a35
mov ebp, dword [edi + 0x6c]
mov ecx, dword [edi + 0x74]
add ebp, ecx
add ebp, dword [edi + 0x38]
cmp eax, esi
cmovbe esi, eax
test esi, esi
je 0x4e8984
sub eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4e8954
mov edx, dword [ebx]
mov ecx, dword [ebx + 0x30]
push esi
call fcn.004e6f20
jmp 0x4e896c
cmp eax, 2
jne 0x4e8970
mov edx, dword [ebx]
test edx, edx
jne 0x4e8963
xor eax, eax
jmp 0x4e896d
mov ecx, dword [ebx + 0x30]
push esi
call fcn.004e79fc
pop ecx
mov dword [ebx + 0x30], eax
push esi
push dword [ebx]
push ebp
call fcn.00505060
add dword [ebx], esi
add esp, 0xc
add dword [ebx + 8], esi
mov ecx, dword [edi + 0x74]
lea ebp, [ecx + esi]
mov dword [edi + 0x74], ebp
cmp ebp, 3
jb 0x4e89ae
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp ebp, 0x106
jae 0x4e89c7
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4e89c7
mov ebx, dword [esp + 0x18]
jmp 0x4e8882
mov ecx, dword [edi + 0x16c0]
mov esi, dword [edi + 0x3c]
cmp ecx, esi
jae 0x4e8a35
mov ebx, dword [edi + 0x6c]
add ebx, ebp
cmp ecx, ebx
jae 0x4e8a05
mov eax, 0x102
sub esi, ebx
cmp esi, eax
cmova esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, ebx
push 0
push eax
call fcn.005055e0
lea eax, [esi + ebx]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x4e8a35
lea eax, [ebx + 0x102]
cmp ecx, eax
jae 0x4e8a35
sub ebx, ecx
sub esi, ecx
lea eax, [ebx + 0x102]
cmp eax, esi
cmovbe esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, ecx
push 0
push eax
call fcn.005055e0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4f0442
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4f07e1
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x4f07fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x4f0802
jmp 0x4f080a
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.004f0d04
push 0x566b24
lea eax, [ebp - 0x10]
push eax
call fcn.0050573a
int3

Function at 0x4f9914
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x5372be
call fcn.004ede08
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], accept
mov dword [edi + 0x18], ebx
mov dword [edi + 0x38], ebx
call fcn.004ef342
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
test dword [0x56c1a4], 0x80000000
je 0x4f9985
push dword [0x5f153c]
call fcn.004f0830
pop ecx
test eax, eax
jne 0x4f998a
call fcn.004f5ea6
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x4f99a5
cmp eax, 2
je 0x4f99a5
lock inc dword [eax + 4]
mov ecx, edi
call fcn.004fa431
lea ecx, [edi + 0x3c]
call fcn.004efc50
cmp byte [ebp + 0xc], 0
je 0x4f99e6
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x4f99e0
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
jne 0x4f99cf
jmp 0x4f99ee
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.004f6091
mov esi, eax
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x4f9a06
mov ecx, esi
call fcn.004f8e7c
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.004edde2
ret 8

Function at 0x501aec
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x5f15a4], eax
cmp eax, 0xffffffff
jne 0x501b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x501b12
jmp 0x501b1a
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.004f0d04
push 0x566b24
lea eax, [ebp - 0x10]
push eax
call fcn.0050573a
int3
Function at 0x507bf5
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x544024
push 0x54401c
push str.FlsAlloc
push 0
call fcn.00507b6e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x507c27
push dword [ebp + 8]
mov ecx, esi
call fcn.004edddc
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x507c69
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x544034
push 0x54402c
push str.FlsGetValue
push 2
call fcn.00507b6e
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x507c9a
mov ecx, esi
call fcn.004edddc
call esi
jmp 0x507ca0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x507ca3
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x54403c
push 0x544034
push str.FlsSetValue
push 3
call fcn.00507b6e
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x507cd7
mov ecx, esi
call fcn.004edddc
call esi
jmp 0x507cdd
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x5273fe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005270c1

Function at 0x527409
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00527242

Function at 0x52db19
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052d487

Function at 0x52db24
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052d6c2
Function at 0x401ccf
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x401d09
push 6
call fcn.00461a2f
add esp, 4
jmp 0x401d0e
mov esp, ebp
pop ebp
ret 4
Function at 0x413ad2
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x413b09
push 6
call fcn.00461a2f
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x413b1d
mov esp, ebp
pop ebp
ret 8

Function at 0x42accd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x200
call fcn.00401ccf
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x200
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x42ad1b
push 6
call fcn.00461a2f
add esp, 4
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x480b3c]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.00401049
push 0x80000301
push 0
push eax
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.00462120
add esp, 0x1c
mov dword [ebp - 0x1c], eax
push 0x4fe38a
push dword [ebp - 0x1c]
mov ecx, 2
call fcn.00402350
add esp, 8
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x42ad87
push ebx
call fcn.00461a29
add esp, 4
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.004020c9
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x42adaf
push ebx
call fcn.00461a29
add esp, 4
mov eax, dword [ebp - 0x28]
jmp 0x42adb7
mov esp, ebp
pop ebp
ret 4
Function at 0x440ffd
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
call dword [sym.imp.IMM32.dll_ImmGetContext]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x44103d
push 6
call fcn.00461a2f
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44116e
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004627d0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0
push dword [ebp - 0x10]
push 0x800
push dword [ebp - 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x44109a
push 6
call fcn.00461a2f
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4410ad
push ebx
call fcn.00461a29
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x184
call fcn.004624e0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4410e6
push ebx
call fcn.00461a29
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x800
push dword [ebp - 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x441117
push 6
call fcn.00461a2f
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x44113c
push 6
call fcn.00461a2f
add esp, 4
lea eax, [ebp - 0xc]
push eax
call fcn.00441190
test eax, eax
je 0x44116e
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x441169
push eax
mov ebx, eax
call fcn.004019d5
inc eax
push eax
call fcn.00461a23
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x441178
mov eax, 0x480b67
jmp 0x441178
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x441189
push ebx
call fcn.00461a29
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x44e544
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x20], 0
jne 0x44e55e
mov dword [ebp + 0x1c], 1
cmp dword [ebp + 0x18], 0
jne 0x44e586
mov eax, str.open
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x44e580
push ebx
call fcn.00461a29
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push dword [ebp + 0x1c]
push 0x480b67
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x44e5c1
push 6
call fcn.00461a2f
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
mov eax, 0
setg al
jmp 0x44e5d5
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4629e0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x462a10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00464d90
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x462b60
test ecx, ecx
je 0x462b60
inc ecx
push ecx
call fcn.00471ec7
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00466330
mov edi, eax
add esp, 0xc
test edi, edi
je 0x462a89
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x462b4d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.00471ec7
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x462b11
cmp eax, 0xea
jne 0x462b39
push esi
call fcn.00471ef0
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00471ec7
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x462adc
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x462b1f
cmp eax, 2
jne 0x462b39
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00464d00
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.00471ef0
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00471ef0
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x462b8e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x462b9a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x462b9a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00464d00
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x462bb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x462bce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x462bc3
pop esi
ret