joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412274
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x412382
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x41232d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x412314
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x412312
push 0x27cd
push 0x1d72
push 0
push 1
push 1
push 1
push 1
push 0x7f60
push 0x64f
call fcn.0041c2e1
add esp, 0x24
jmp 0x41232b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x412380
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x412369
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x412367
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x412380
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x412390
push 0
push 0x4444
call fcn.0040b2f6
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4131a9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x413265
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41324e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x413223
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x413221
push 1
push 0x20c8
push 1
push 0x1213
push 0
call fcn.00412457
add esp, 0x14
jmp 0x41324c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41324c
push 0
push 0
push 0
push 0
push 0x1622
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x413263
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0
push 1
push dword [ebp - 0x28]
call fcn.00408262
add esp, 0xc
jmp 0x413288
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push 0
push 1
push 0x5af4
push dword [ebp - 0x30]
call fcn.0040b220
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x413420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x413441
push 1
push 0x65ed
call fcn.004134e1
pop ecx
pop ecx
jmp 0x4134dd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4134bd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4134a4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4134a2
push 0x1372
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4134bb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4134dd
push 0x666b
push 0x1127
push 1
push 0x75b6
push 0x4f41
push 1
call fcn.00408399
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x415dd4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x415e1b
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
push 0x66e5
push 1
push dword [ebp - 8]
push 0x46a5
push 0x1560
push 0x73f6
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
call fcn.00415f0e
add esp, 0x1c
jmp 0x415f0a
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x415e66
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0x55f4
push 1
push dword [ebp - 0x18]
call fcn.00412ee8
add esp, 0xc
jmp 0x415f0a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x415eee
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffeb
jmp 0x415eb6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x415eec
push 0
push 1
push 0x3701
push dword [ebp - 0x40]
push 0x5a40
push 1
push 0
push 0x6c10
push 0x5aec
push 0x3a75
call fcn.0040cba2
add esp, 0x28
jmp 0x415eab
jmp 0x415f0a
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x415f0a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x41d010
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x41d055
mov eax, dword [ebp + 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 1
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
call fcn.0041d0f1
add esp, 0x14
jmp 0x41d0ed
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41d081
push 0x5e30
push 1
call fcn.004097ae
pop ecx
pop ecx
jmp 0x41d0ed
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41d0c5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41d0c3
push 0
push 0
push 0x1659
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x41d0ed
push 0
push 0x193d
push 0xcfd
push 0xeb5
push 0xabb
push 0xc48
push 0x26ce
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esp, ebp
pop ebp
ret
Function at 0x42bb0c
Capabilities:
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x42bbbc
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42bb4c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42bb4a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x42bbb7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xf
jmp 0x42bb6e
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x11
jl 0x42bbb7
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0x5c7a00f4
mov dword [ebp - 0x58], 8
mov dword [ebp - 0x54], 8
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0xc], 0x16e289aa
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
jmp 0x42bb63
jmp 0x42bc5f
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x42bc1a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x42bc0d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x42bc18
push 0xe74
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x42bc5f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x42bc42
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x42bc5f
push 0
push 0
push 0
push 0
push 0x1622
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x42f33a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x42f42f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42f3e0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x42f3d6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42f3d4
push 1
push 0x2e3d
push 0x5287
push 0x3df2
push 0x1d8a
push 1
push 0x2a06
push 0
push 0x190
push 1
call fcn.0042c573
add esp, 0x28
jmp 0x42f3de
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42f42d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x42f420
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x42f42d
push 0x1372
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x42f44e
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
push 1
push 0x6700
push 0x1975
push 1
push dword [ebp - 0x48]
call fcn.0042b81b
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x42f5d2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42f5f7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0
push 1
push dword [ebp - 8]
call fcn.0043201d
add esp, 0xc
jmp 0x42f669
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42f61d
push 0
call fcn.0042de7c
pop ecx
jmp 0x42f669
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42f652
push 0
push 0
push 0
push 0
push 0x1622
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x42f669
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x434338
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43435a
push 0x985
push 1
call fcn.00434406
pop ecx
pop ecx
jmp 0x434401
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x434386
push 1
call fcn.00430849
pop ecx
jmp 0x434401
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4343cd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4343cb
push 0
push 0
push 0
push 0
push 0x1622
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x434401
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
call fcn.00464f02
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.0040397d
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434edd
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x434f34
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
push 0x3be
push 0x52df
push 1
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push 1
push 0x77f1
push 0x1ce5
push 0x6523
call fcn.0043501d
add esp, 0x28
jmp 0x435019
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x434ff2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x434fa8
mov byte [ebp - 1], 0
push 0x21bd
lea eax, [ebp - 1]
push eax
push 0
push 1
push 0x4fbc
call fcn.00433f49
add esp, 0x14
jmp 0x434ff0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 1
mov eax, dword [ebp - 0x44]
push dword [eax]
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x48]
call fcn.0044aba4
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.0040782c
lea ecx, [ebp - 0x6c]
call fcn.00402af1
jmp 0x435019
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x43500c
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x435019
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov esp, ebp
pop ebp
ret
Function at 0x437d2b
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x437dfd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x437d8c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
push dword [ebp - 0x20]
call fcn.00439ef1
add esp, 0x10
jmp 0x437dfb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x437dc6
push 0
push 0x193d
push 0xcfd
push 0xeb5
push 0xabb
push 0xc48
push 0x26ce
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x437dfb
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 1
push 0
push 0x7d1
push 1
push 0x1ee7
push 0
push 0x36b1
push 0x79b5
push 0x2090
push 1
call fcn.00434982
add esp, 0x30
jmp 0x437e0b
push 0
push 0x2f78
call fcn.00430976
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4386cb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x438719
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
call fcn.00438803
add esp, 0x18
jmp 0x4387ff
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x438782
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x438775
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 1
push 0x3029
push 0
push 1
push 0x6ed6
push 1
call fcn.00434429
add esp, 0x1c
jmp 0x438780
push 0x127e
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4387ff
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4387e3
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4387e1
push 0x243f
push 1
push 0x55f7
push 0x2da9
push 1
push 0x7efe
push 1
push 0x205c
push 1
push 1
push 1
call fcn.0042fa0f
add esp, 0x2c
jmp 0x4387ff
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x4387ff
call dword [sym.imp.USER32.dll_GetCapture]
mov esp, ebp
pop ebp
ret
Function at 0x43a211
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43a397
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43a374
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43a36a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [eax], 1
jmp 0x43a29d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x43a368
mov dword [ebp - 0x48], 0xa0734f09
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x34], 0x12a3cc92
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x4c], 0xce028f4e
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x3c], 6
mov dword [ebp - 8], 0
jmp 0x43a2f1
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x43a304
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x68], 7
jmp 0x43a2ea
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x1a22
lea eax, [ebp - 0x38]
push eax
push 0x72a9
push 1
push 1
push 0
lea eax, [ebp - 0x3c]
push eax
push 1
push dword [ebp - 0x40]
push 0x6032
push 1
lea eax, [ebp - 0x44]
push eax
push 0x1141
push dword [ebp - 4]
push 0x2c70
push 1
lea eax, [ebp - 0x48]
push eax
push 0x1833
push 1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x100c
call fcn.00430a8e
add esp, 0x60
jmp 0x43a292
jmp 0x43a372
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x43a395
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push 1
push 1
push 0x2d96
push 0x3521
push 0
push dword [ebp - 0x58]
call fcn.0043714d
add esp, 0x18
jmp 0x43a3a5
push 0x7774
push 0
call fcn.0043922c
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret