joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408aac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408c11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406b24
cmp si, word [0x455a08]
jb 0x408b44
cmp si, word [0x455c08]
ja 0x408b44
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x408b44
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x455a08]
jae 0x408b1e
mov edi, ebx
dec edi
jmp 0x408b3f
cmp si, word [ebx*8 + 0x455a08]
jbe 0x408b2e
inc ebx
mov dword [ebp - 8], ebx
jmp 0x408b3f
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x455a0c]
call fcn.004089bc
jmp 0x408b44
cmp edi, dword [ebp - 8]
jae 0x408b08
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x408bf3
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408bf3
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407478
push dword [ebp - 0x160]
push 0x408c2c
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00407478
push dword [ebp - 0x164]
push 0x408c3c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407478
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004076b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408c18
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406b84
ret
Function at 0x408dc4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408ec7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45db80
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x45db98]
jne 0x408e10
mov eax, esi
mov edx, 0x45db9a
mov ecx, 0x55
call fcn.00407478
push 0x45db80
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408eb1
push 0x45db80
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406b24
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408e7f
cmp byte [0x45db7c], 0
je 0x408e44
mov edx, esi
mov eax, ebx
call fcn.00408ca8
jmp 0x408e7f
mov edx, esi
mov eax, ebx
call fcn.00408aac
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408e7f
cmp dword [esi], 0
je 0x408e68
mov eax, esi
mov edx, 0x408ee0
call fcn.004075d0
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408aac
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004075d0
push 0x45db80
call sub.kernel32.dll_EnterCriticalSection
mov word [0x45db98], bx
push 0xaa
mov eax, dword [esi]
call fcn.004073e4
push eax
push 0x45db9a
call sub.kernel32.dll_lstrcpynW
push 0x45db80
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ece
lea eax, [ebp - 4]
call fcn.00406b24
ret
Function at 0x4090fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c08
xor eax, eax
push ebp
push 0x409321
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40913c
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x409156
push 0x105
mov eax, dword [ebp - 4]
call fcn.004073e4
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40930b
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409330
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409225
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409330
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409225
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40936c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409225
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40936c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409225
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4093a0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409225
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4093d4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40930b
xor eax, eax
push ebp
push 0x409304
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408f08
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409294
mov eax, dword [ebp - 0x10]
call fcn.0040436c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040743c
jmp 0x4092df
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x409414
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4092df
mov eax, dword [ebp - 0x10]
call fcn.0040436c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x409414
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040743c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40930b
cmp dword [ebp - 8], 0
je 0x4092fa
mov eax, dword [ebp - 8]
call fcn.00404388
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409328
lea eax, [ebp - 4]
call fcn.00406b24
ret
Function at 0x409604
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c08
xor eax, eax
push ebp
push 0x4096c4
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407478
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407628
mov eax, dword [ebx]
call fcn.004094cc
test al, al
jne 0x4096a1
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407478
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407628
mov eax, dword [ebx]
call fcn.004094cc
test al, al
jne 0x4096a1
mov eax, ebx
call fcn.00406b24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4096cb
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406b84
lea eax, [ebp - 4]
call fcn.00406b24
ret

Function at 0x40b930
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x455ca0
test edx, edx
jne 0x40b94f
xor eax, eax
jmp 0x40ba6d
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x40b96c
push esi
push edx
push eax
call fcn.0040ba74
add esp, 0xc
jmp 0x40ba6d
push esi
push edx
push eax
call fcn.0040bd34
add esp, 0xc
jmp 0x40ba6d
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x40f240
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x4589d8
push 0x45dc84
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x40f305
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x40f2d5
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4589d4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4589dc
mov ecx, 2
call fcn.00404510
mov edx, 0x40f144
lea eax, [esi + 5]
call fcn.0040f164
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0040f164
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x40f2aa
mov dword [0x4589d4], esi
mov eax, dword [edi]
mov dword [ebp - 4], eax
mov ebx, dword [edi]
mov eax, dword [ebx + 5]
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 5], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 9], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f30c
push 0x45dc84
call sub.kernel32.dll_LeaveCriticalSection_1
ret

Function at 0x40f480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x40f493
add esp, 0xfffffff0
call fcn.0040584c
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.00405558
xor eax, eax
mov dword [edi + 4], eax
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 1
lea eax, [ebp - 4]
push eax
push 0
push edi
push 0x40f58c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov esi, eax
mov dword [edi + 0x14], esi
cmp esi, 0xffffffff
jne 0x40f4dc
xor eax, eax
mov dword [edi + 0x14], eax
mov eax, edi
test bl, bl
je 0x40f4f1
call fcn.004058a4
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x40fa90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x40b3a4]
call fcn.0040852c
add esp, 4
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov eax, esi
test eax, eax
je 0x40fac9
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x40fad4
xor ebx, ebx
jmp 0x40fc60
push 0xa
lea eax, [ebp - 0xd]
push eax
mov ecx, esi
mov edx, dword [ebp - 4]
mov eax, dword [0x40e950]
call fcn.0040f8e8
mov ebx, eax
test ebx, ebx
je 0x40faf7
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
jmp 0x40fafb
mov byte [ebp - 0xd], 0
test ebx, ebx
jne 0x40fb1e
push 0xe
mov eax, esi
call fcn.004073e4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x40fb1e
mov eax, dword [ebp + 0xc]
mov byte [eax], 3
test ebx, ebx
jne 0x40fb41
push 2
mov eax, esi
call fcn.004073e4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x40fb41
mov eax, dword [ebp + 0xc]
mov byte [eax], 2
test ebx, ebx
jne 0x40fb64
push 0xc
mov eax, esi
call fcn.004073e4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x40fb64
mov eax, dword [ebp + 0xc]
mov byte [eax], 4
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp al, 7
ja 0x40fb78
and eax, 0x7f
movzx edx, byte [ebp + 8]
bt edx, eax
jae 0x40fb81
mov bl, 1
jmp 0x40fc60
test ebx, ebx
je 0x40fc39
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40fc39
cmp dword [ebp - 0xc], 0xffffffff
je 0x40fc39
xor eax, eax
push ebp
push 0x40fc32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov esi, eax
xor eax, eax
push ebp
push 0x40fc14
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
test ebx, ebx
jbe 0x40fc06
push ebx
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x40b3a4]
call fcn.0040852c
add esp, 4
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, esi
mov ecx, ebx
call fcn.00404510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fc1b
ret
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00408378
test eax, eax
setg bl
test bl, bl
je 0x40fc60
cmp byte [ebp - 0xd], 0
je 0x40fc60
mov eax, dword [ebp - 8]
call fcn.0040b418
test al, al
je 0x40fc60
xor ebx, ebx
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x410130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.004073e4
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41019d
test ah, 4
je 0x410196
test bl, bl
jne 0x41015b
mov al, 1
jmp 0x4101c4
test al, 0x10
je 0x410163
xor eax, eax
jmp 0x4101c4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x410187
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x4101c4
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x4101c4
test al, 0x10
sete al
jmp 0x4101c4
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x4101be
cmp ebx, 3
je 0x4101be
cmp ebx, 0x7b
je 0x4101be
mov eax, esi
call fcn.004100f0
test al, al
jne 0x4101c2
xor eax, eax
jmp 0x4101c4
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x411748
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4118d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00406b24
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40b3a4]
call fcn.0040852c
add esp, 4
push 0xa
lea eax, [ebp - 0xd]
push eax
mov ecx, ebx
mov edx, esi
mov eax, dword [0x40e950]
call fcn.0040f8e8
mov ebx, eax
test ebx, ebx
je 0x411854
push ebx
push esi
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x411854
cmp dword [ebp - 0xc], 0xffffffff
je 0x411854
xor eax, eax
push ebp
push 0x41184d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov edi, eax
xor eax, eax
push ebp
push 0x41182f
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push esi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
test ebx, ebx
jbe 0x411821
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40b3a4]
call fcn.0040852c
add esp, 4
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, ebx
call fcn.00404510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411836
ret
mov eax, dword [ebp - 4]
call fcn.00408378
test eax, eax
je 0x4118ba
cmp byte [ebp - 0xd], 0
je 0x411872
lea eax, [ebp - 4]
call fcn.0040b418
test al, al
jne 0x4118ba
mov eax, dword [ebp - 4]
call fcn.00408378
cmp eax, 2
jl 0x4118ba
mov eax, dword [ebp - 4]
call fcn.00408378
mov edx, eax
sar edx, 1
jns 0x411890
adc edx, 0
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00407550
mov eax, dword [ebp - 4]
call fcn.00408378
push eax
mov eax, dword [ebp - 8]
add eax, 4
call fcn.004070a4
mov edx, eax
mov eax, dword [ebp - 4]
pop ecx
call fcn.00404510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4118dd
lea eax, [ebp - 4]
mov edx, dword [0x40b3a4]
call fcn.00408538
ret
Function at 0x412164
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x412179
add esp, 0xfffffff0
call fcn.0040584c
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00405558
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x18], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 4], edx
xor edi, edi
mov eax, dword [ebp - 4]
mov byte [eax + 0x20], 0
test bl, bl
je 0x4121c7
or edi, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
jmp 0x4121d1
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 2
mov eax, dword [ebp - 4]
add eax, 4
push eax
push edi
mov eax, dword [ebp - 4]
push eax
push 0x412548
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], esi
cmp esi, 0xffffffff
jne 0x412200
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x41221b
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 4
push 0x45dc84
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x412258
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [0x45dc70]
call fcn.004127e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41225f
push 0x45dc84
call sub.kernel32.dll_LeaveCriticalSection_1
ret

Function at 0x41248c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp dword [ebx + 8], 0
je 0x4124b7
xor edx, edx
mov eax, ebx
call fcn.004124ec
cmp al, 1
jne 0x4124b7
mov dl, 2
mov eax, ebx
call fcn.004124ec
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
pop ebx
pop ebp
ret

Function at 0x412944
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov ebx, eax
lea eax, [ebp - 0x20a]
xor ecx, ecx
mov edx, 0x20a
call fcn.00404a8c
push 0
push 0x10
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4129d6
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00407478
mov edx, dword [ebx]
mov eax, edx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4129a3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4129dd
mov eax, edx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4129be
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4129dd
mov eax, ebx
mov edx, 0x4129f0
call fcn.004075d0
jmp 0x4129dd
mov eax, ebx
call fcn.00406b24
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412a28
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x412bad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x412b97
xor edx, edx
push ebp
push 0x412b90
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
push 1
push 2
push 0
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
jne 0x412a9b
call fcn.0040634c
jmp 0x412b97
xor edx, edx
push ebp
push 0x412b72
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.00404a8c
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004074c8
push esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00407330
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x412b5b
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x522
jne 0x412b4f
push esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, ebx
call fcn.004073e4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x412b5b
call fcn.0040634c
call fcn.0040634c
jmp 0x412b97
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412b79
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412bb4
lea eax, [ebp - 4]
call fcn.00406b6c
ret
Function at 0x412d54
Capabilities:
Check for foreground window switch
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
setne byte [ebp - 0x19]
movzx eax, byte [ebp - 0x19]
or al, byte [ebp - 5]
je 0x412d96
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x412dab
push 3
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetWindowPos
xor eax, eax
push ebp
push 0x412eef
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 4]
sete bl
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x412eb3
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x412e4e
xor eax, eax
push ebp
push 0x412e47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_BringWindowToTop
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetForegroundWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412e4e
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 4]
sete bl
ret
test bl, bl
jne 0x412ea3
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_BringWindowToTop
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 4]
sete bl
cmp dword [ebp - 0x18], 0
je 0x412eb0
push 0x32
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0x18]
test bl, bl
jne 0x412ec1
cmp dword [ebp - 0x18], 0xa
jle 0x412dce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412ef6
movzx eax, byte [ebp - 0x19]
xor al, 1
and al, byte [ebp - 5]
je 0x412eee
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetWindowPos
ret