joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44098a
Capabilities:
Create thread

Disassembly:
push 0x5c
mov eax, 0x44f640
call fcn.0041be8d
cmp byte [0x4920cd], 0
jne 0x440a07
xor esi, esi
lea eax, [ebp - 0x48]
push eax
push esi
push 0x491cc0
push 0x401fed
push esi
push esi
mov dword [0x492038], esi
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], esi
call fcn.00447660
or dword [ebp - 4], 0xffffffff
mov dword [0x492038], eax
jmp 0x4409e0
cmp dword [ebp - 0x48], 0
je 0x4409fe
push esi
push esi
push 0x502
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x492038], 0
je 0x440a0d
call fcn.0041bddf
ret
lea ecx, [ebp - 0x2c]
call fcn.00406bd8
mov dword [ebp - 4], 2
call fcn.004066a2
test al, al
lea eax, [ebp - 0x44]
je 0x440a4d
push 0x2b
push 0x13
push eax
call fcn.0043fdba
push eax
lea ecx, [ebp - 0x2c]
call fcn.004059ed
lea ecx, [ebp - 0x44]
call fcn.00404c1e
lea ecx, [ebp - 0x2c]
call fcn.004462e1
jmp 0x440a68
push 0x29
push 0x11
push eax
call fcn.0043fdba
push eax
lea ecx, [ebp - 0x2c]
call fcn.004059ed
lea ecx, [ebp - 0x44]
call fcn.00404c1e
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00404ba2
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x68]
call fcn.00403e3d
push 0x467cec
lea eax, [ebp - 0x68]
push eax
call fcn.0041e77e
int3

Function at 0x440a93
Capabilities:
Create thread

Disassembly:
push esi
call fcn.0042018e
cmp byte [0x4920cd], 0
mov esi, eax
jne 0x440af0
cmp dword [0x492034], 0
jne 0x440af0
cmp word [0x4920d6], 3
push edi
mov edi, 0x4920d0
jne 0x440ad4
mov ecx, edi
call fcn.00406072
test al, 1
je 0x440ad4
mov eax, dword [0x491de8]
shr eax, 9
test al, 1
je 0x440aef
push 0x49203c
xor eax, eax
push eax
push edi
push 0x404ee3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x492040], eax
pop edi
mov eax, esi
pop esi
ret
Function at 0x440bbe
Capabilities:
Check mutex on windows

Disassembly:
push 0x6c
mov eax, 0x44f6d0
call fcn.0041be21
mov eax, dword [0x491de8]
shr eax, 0xe
test al, 1
je 0x440d34
xor ebx, ebx
lea ecx, [ebp - 0x58]
push 0x491cd8
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call fcn.00404c23
push 7
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
pop esi
xor eax, eax
mov dword [ebp - 0x40], ebx
push 0x4624e8
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00402e90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x28], ebx
push 0x4624b0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov word [ebp - 0x28], ax
call fcn.00402e90
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.00409760
mov eax, dword [ebp - 0x14]
mov edi, 0x1000
pop ecx
push 8
pop esi
cmp eax, esi
jb 0x440c89
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], ecx
cmp eax, edi
jb 0x440c80
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00401dfe
mov eax, dword [ebp - 0x74]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x78]
push eax
push ecx
call fcn.0041b4fb
pop ecx
pop ecx
xor eax, eax
mov byte [ebp - 4], bl
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
cmp eax, esi
jb 0x440cd5
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
cmp eax, edi
jb 0x440ccc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00401dfe
mov eax, dword [ebp - 0x78]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
push eax
push ecx
call fcn.0041b4fb
pop ecx
pop ecx
cmp dword [ebp - 0x44], esi
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x492044], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x440d3a
mov eax, dword [ebp - 0x44]
cmp eax, esi
jb 0x440d34
mov ecx, dword [ebp - 0x58]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
cmp eax, edi
jb 0x440d2b
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00401dfe
mov eax, dword [ebp - 0x78]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
push eax
push ecx
call fcn.0041b4fb
pop ecx
pop ecx
call fcn.0041bdd0
ret
push 0x2e
push 0x29
lea eax, [ebp - 0x70]
push eax
call fcn.0043fdba
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.004462e1
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x38]
call fcn.00404ba2
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00403e3d
push 0x467cec
lea eax, [ebp - 0x20]
push eax
call fcn.0041e77e
int3
Function at 0x441214
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x46b034]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x491d00], 0
push esi
mov esi, 0x491cf0
jne 0x44132f
push ebx
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x804]
mov ecx, esi
push eax
call fcn.00402e90
cmp dword [0x491d04], 8
mov eax, esi
cmovae eax, dword [0x491cf0]
xor ebx, ebx
push ebx
push eax
call fcn.00425f42
pop ecx
pop ecx
test eax, eax
je 0x44128d
push 0x45ffd0
mov ecx, esi
call fcn.00402e90
mov ecx, esi
call fcn.00407ee5
cmp dword [0x491d00], ebx
je 0x4412b2
cmp dword [0x491d04], 8
mov eax, esi
push ebx
cmovae eax, dword [0x491cf0]
push eax
call fcn.00425f42
pop ecx
pop ecx
test eax, eax
je 0x4412c5
push str.TEMP
call fcn.00426d35
pop ecx
push eax
mov ecx, esi
call fcn.00402e90
cmp dword [0x491d00], ebx
je 0x4412ea
cmp dword [0x491d04], 8
mov eax, esi
push ebx
cmovae eax, dword [0x491cf0]
push eax
call fcn.00425f42
pop ecx
pop ecx
test eax, eax
je 0x4412fd
push 0x4624e0
call fcn.00426d35
pop ecx
push eax
mov ecx, esi
call fcn.00402e90
cmp dword [0x491d00], ebx
je 0x441322
cmp dword [0x491d04], 8
mov eax, esi
push ebx
cmovae eax, dword [0x491cf0]
push eax
call fcn.00425f42
pop ecx
pop ecx
test eax, eax
je 0x44132e
push 0x491cc0
mov ecx, esi
call fcn.00404c8b
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041b4ed
leave
ret
Function at 0x44566c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x46b034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [esi + 0xc], 0x201
jne 0x44575d
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041d260
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x218]
push eax
push edi
push 0x44b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x244], eax
xor eax, eax
push 7
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
lea edi, [ebp - 0x234]
pop ecx
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebx + 0xb8]
pop edi
cmp eax, dword [ebx + 0xbc]
je 0x445760
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x445760
and dword [eax], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b4ed
leave
ret 0xc
Function at 0x44af80
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor bl, bl
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x44af9d
mov eax, dword [esi]
test eax, eax
je 0x44b0c1
cmp word [eax], 0
je 0x44b0c1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44b0c1
test al, 0x10
jne 0x44b0c1
cmp dword [esi + 0x14], 8
jb 0x44afcf
mov esi, dword [esi]
push 0x462510
push esi
call fcn.00426e01
mov esi, eax
add esp, 8
test esi, esi
je 0x44b0c1
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x18], xmm0
call fcn.004287db
push 2
push 0
push esi
call fcn.00427e7b
lea eax, [esp + 0x24]
push eax
push esi
call fcn.004287db
lea eax, [esp + 0x34]
push eax
push esi
call fcn.00428d12
add esp, 0x24
cmp dword [esp + 0x10], 0x28
jbe 0x44b0b8
xor eax, eax
mov dword [esp + 0x20], 0x48535844
push esi
push 1
mov word [esp + 0x40], ax
xorps xmm0, xmm0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
push 0x28
push eax
mov dword [esp + 0x34], 0x28
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
movsd qword [esp + 0x40], xmm0
call fcn.00427464
add esp, 0x10
test eax, eax
je 0x44b0b8
mov eax, dword [esp + 0x2c]
not eax
ror eax, 3
cmp eax, dword [esp + 0xc]
jne 0x44b0b8
cmp dword [esp + 0x20], 0x48535844
jne 0x44b0b8
cmp dword [esp + 0x24], 0x28
jne 0x44b0b8
movzx ecx, word [esp + 0x38]
add ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
add ecx, dword [esp + 0x40]
add eax, 0x28
add eax, ecx
cmp eax, dword [esp + 0x10]
sete bl
push esi
call fcn.00426518
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003538
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x10003547
pop dword [ebp - 4]
mov eax, 0x58eae0ae
sub eax, 0x48eaab67
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xe4e6dbca
sub dword [ebp - 0x14], 0x9694967f
mov dword [ebp - 0x10], 0x1ad94fa7
add dword [ebp - 0x10], 0x1759fc9e
mov dword [ebp - 0xc], 0x6dc04d3c
add dword [ebp - 0xc], 0xde8bf6f2
mov dword [ebp - 8], 0x4705b879
sub dword [ebp - 8], 0x4705b879
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x7d1ddbbc
sub dword [ebp - 0x14], 0x8ab7266
mov dword [ebp - 0x10], 0x87e23211
add dword [ebp - 0x10], 0xb98a2f64
mov dword [ebp - 0xc], 0x844d623e
add dword [ebp - 0xc], 0xdf220a2e
mov dword [ebp - 8], 0x3ed54e77
add dword [ebp - 8], 0xc12ab189
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x3f34d71c
add eax, 0xd0cd1930
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3d3c6
push 0
call eax
mov ecx, 0xe75bab04
add ecx, 0x18a49b3b
xor edx, edx
add edx, eax
mov esi, 0x1002ac00
add esi, dword [ebp - 4]
mov ebx, 0xbc1ce95a
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
add edx, 0x6c740944
sub edx, 0x6c740940
add esi, 0xd7eb5205
add esi, 0x2814adff
loop 0x1000365a
add eax, 0x73f2d703
add eax, 0x8c0e34cc
xor ebx, ebx
add ebx, eax
add eax, 0xa5a19d0e
sub eax, 0xa5a19d09
mov ecx, 0x98a1c1c2
sub ecx, 0x88a1c1c2
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4156d2
Capabilities:
Log keystrokes

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.005b13d0
push dword [esp + 0x14]
call fcn.00595cc2
mov dword [esp], eax
push 0xfffffff0
push dword [esp + 4]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x20000000
and ebx, ebx
je 0x415711
push 9
push dword [esp + 4]
call sub.USER32.dll_ShowWindow
push 0
call sub.USER32.dll_GetForegroundWindow
push eax
call sub.USER32.dll_GetWindowThreadProcessId
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [esp + 8], eax
mov ebx, dword [esp + 4]
cmp ebx, dword [esp + 8]
je 0x41574a
push 1
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.USER32.dll_AttachThreadInput
push dword [esp]
call sub.USER32.dll_SetForegroundWindow
mov ebx, dword [esp + 4]
cmp ebx, dword [esp + 8]
je 0x41576e
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.USER32.dll_AttachThreadInput
push 0x401
push 0
push 0
push dword [esp + 0xc]
call sub.USER32.dll_RedrawWindow
xor eax, eax
add esp, 0xc
pop ebx
ret 4

Function at 0x41b6a2
Capabilities:
Get geographical location

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
call fcn.005b13d0
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push 6
call fcn.005af190
lea eax, [esp + 4]
push eax
call fcn.005b12d0
push 6
mov eax, dword [esp + 4]
push eax
push 0x1004
call sub.KERNEL32.dll_GetSystemDefaultLCID
push eax
call sub.KERNEL32.dll_GetLocaleInfoW
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
and ebx, ebx
jle 0x41b76c
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.005ae0f0
call fcn.0054d542
add dword [esp], edx
call fcn.005ae5a0
call fcn.0054d560
push edx
push eax
pop ebx
pop edi
cmp ebx, 0
jne 0x41b745
cmp edi, 0
jne 0x41b745
xor eax, eax
jmp 0x41b74a
mov eax, 1
or eax, eax
je 0x41b76c
push 0
push 0x10
push 0x459
push dword [esp + 0x20]
call fcn.00584871
push eax
call sub.USER32.dll_SendMessageW
xor eax, eax
push dword [esp]
call fcn.005b1460
add esp, 8
pop edi
pop ebx
ret 4
Function at 0x4283a1
Capabilities:
Reference sql statements

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
call fcn.005b13d0
mov ebx, dword [0x7c1e78]
cmp ebx, dword [esp + 0x14]
jne 0x4283bd
jmp 0x42850e
mov eax, dword [esp + 0x14]
mov dword [0x7c1e78], eax
push 0
push 0
push 0x868
push 0x34b
call fcn.0057f15d
mov dword [esp], eax
push dword [esp]
push dword [0x7c1cc4]
push dword [0x7c35c4]
call fcn.0059b3cb
mov ebp, eax
pop eax
mov dword [ebp], eax
push dword [esp + 0x14]
call fcn.0047b13b
mov dword [esp + 4], eax
mov ebp, dword [esp + 4]
cmp dword [ebp + 8], 0
je 0x42842d
mov ebp, dword [esp + 4]
push dword [ebp + 4]
mov ebp, dword [esp + 8]
push dword [ebp + 8]
push 0x34b
call fcn.00534d44
jmp 0x428442
push 0
mov eax, 0x72b0ec
push eax
push 0x34b
call fcn.00534d44
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
mov edx, str.SELECT_filename_FROM_event_WHERE_event_id_
push edx
call fcn.005b1270
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
mov eax, dword [esp + 0x24]
cdq
push edx
push eax
call fcn.005adc10
pop eax
call fcn.005b1360
push 1
call fcn.0054d542
add dword [esp + 4], edx
call fcn.0059de4c
call fcn.0054d560
and eax, eax
je 0x42850c
push 1
call fcn.0059de5e
and eax, eax
je 0x428502
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push 0
push 1
call fcn.0059deb2
push 0x7c1cc4
call fcn.005b12d0
push dword [0x7c1cc4]
push dword [0x7c35c4]
call fcn.0059b3cb
mov ebp, eax
mov eax, dword [ebp]
mov dword [esp], eax
push dword [esp]
push 0
push 0x878
push 0x34b
call fcn.0057f15d
push 1
call fcn.0059dedf
xor eax, eax
add esp, 8
pop ebx
pop ebp
ret 4
Function at 0x433b7e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x433b84
call fcn.005b13d0
mov edx, dword [esp + 0x2c]
lea ecx, [esp]
call fcn.0054d000
mov edx, dword [esp + 0x30]
lea ecx, [esp + 4]
call fcn.0054d000
mov dword [esp + 8], 1
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
xor eax, eax
push eax
push 0
push dword [esp + 0x1c]
push dword [esp + 0x48]
call sub.ADVAPI32.dll_RegCreateKeyExW
mov ebx, eax
and ebx, ebx
jne 0x433ca2
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push 0x208
call fcn.005af190
lea eax, [esp + 0x18]
push eax
call fcn.005b12d0
push dword [esp + 0x14]
call fcn.005ade50
mov ebx, eax
add ebx, ebx
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push 0
mov eax, 0x72b0ec
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
and ebx, ebx
jne 0x433c65
push dword [esp + 4]
mov edx, dword [esp + 0x18]
pop ecx
call fcn.0054d570
je 0x433c65
mov dword [esp + 8], 0
cmp dword [esp + 8], 0
je 0x433c99
push dword [esp + 4]
call fcn.005ade50
mov ebx, eax
inc ebx
add ebx, ebx
push ebx
mov eax, dword [esp + 8]
push eax
push 1
push 0
mov eax, 0x72b0ec
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegSetValueExW
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 8]
jmp 0x433caa
push dword [esp + 4]
call fcn.005b1460
push dword [esp]
call fcn.005b1460
push dword [esp + 0x14]
call fcn.005b1460
add esp, 0x20
pop ebx
ret 0xc
Function at 0x455d1c
Capabilities:
Reference sql statements

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.005b13d0
push 0x350
call fcn.0057fc17
push 0x34f
call fcn.0057fb82
mov dword [esp], eax
mov ebx, dword [esp]
cmp ebx, 0xffffffff
jne 0x455d4e
jmp 0x455f5c
push dword [esp]
push 0x34f
call fcn.0057fc68
mov dword [esp + 4], eax
mov edx, 0x72b0ec
lea ecx, [esp + 8]
call fcn.0054d008
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
mov edx, str.SELECT_filename_FROM_event_WHERE_event_id_
push edx
call fcn.005b1270
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
mov eax, dword [esp + 0x14]
cdq
push edx
push eax
call fcn.005adc10
pop eax
call fcn.005b1360
push 1
call fcn.0054d542
add dword [esp + 4], edx
call fcn.0059de4c
call fcn.0054d560
and eax, eax
je 0x455e07
push 1
call fcn.0059de5e
and eax, eax
je 0x455dfd
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push 0
push 1
call fcn.0059deb2
lea eax, [esp + 0xc]
push eax
call fcn.005b12d0
push 1
call fcn.0059dedf
push dword [esp + 8]
mov edx, 0x72b0ec
pop ecx
call fcn.0054d570
je 0x455e1d
jmp 0x455f5c
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
mov edx, str.SELECT_event_id__time__event_FROM_event_WHERE_filename__
push edx
call fcn.005b1270
push edx
call fcn.005b1230
pop edx
push eax
push dword [esp + 0x14]
call fcn.005141ad
pop eax
mov edx, str._ORDER_BY_time_ASC
push edx
call fcn.005b1270
call fcn.005b1360
push 1
call fcn.0054d542
add dword [esp + 4], edx
call fcn.0059de4c
call fcn.0054d560
and eax, eax
je 0x455f42
mov dword [esp], 0
push 1
call fcn.0059de5e
and eax, eax
je 0x455f38
push 0
push 1
call fcn.0059de86
mov dword [esp + 4], eax
push 1
push 1
call fcn.0059de86
mov dword [esp + 0xc], eax
push 2
push 1
call fcn.0059de86
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
add ebx, 0xd2
push ebx
call fcn.00423717
mov dword [esp + 0x14], eax
push edx
call fcn.005b1230
pop edx
push eax
push dword [esp + 0x18]
push edx
call fcn.005b1230
pop edx
push eax
push dword [esp + 0x18]
call fcn.004a72b2
call fcn.005b1360
push dword [esp + 0xc]
push 0x350
call fcn.0054d542
add dword [esp + 8], edx
call fcn.00580a35
call fcn.0054d560
push dword [esp + 4]
push dword [esp + 4]
push 0x350
call fcn.0057fc3a
inc dword [esp]
jmp 0x455e81
push 1
call fcn.0059dedf
push 0x350
call fcn.0057fad2
mov ebx, eax
dec ebx
push ebx
push 0x350
call fcn.0057f9c7
xor eax, eax
push dword [esp + 8]
call fcn.005b1460
add esp, 0x18
pop ebx
ret
Function at 0x4bdef5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.005b13d0
push dword [esp + 0xc]
mov ebx, 0x10000
cmp ebx, dword [esp]
jne 0x4bdf16
mov dword [esp + 4], 0x10
jmp 0x4bdf3c
mov ebx, 0x20000
cmp ebx, dword [esp]
jne 0x4bdf2a
mov dword [esp + 4], 0x11
jmp 0x4bdf3c
mov ebx, 0x40000
cmp ebx, dword [esp]
jne 0x4bdf3c
mov dword [esp + 4], 0x12
pop eax
push dword [esp]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x4bdf5a
mov eax, 1
jmp 0x4bdf60
xor eax, eax
jmp 0x4bdf60
add esp, 4
pop ebx
ret 4

Function at 0x4d1c07
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push eax
call fcn.005b13d0
mov edx, dword [esp + 8]
lea ecx, [esp]
call fcn.0054d000
push 1
mov eax, 0x72b0ec
push eax
mov eax, 0x72b0ec
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, str.open
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
xor eax, eax
push dword [esp]
call fcn.005b1460
add esp, 4
ret 4

Function at 0x4d1cac
Capabilities:
Reference sql statements

Disassembly:
xor eax, eax
push eax
push eax
call fcn.005b13d0
push dword [esp + 0x10]
call fcn.0054d560
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.0054d000
mov edx, 0x72b0ec
lea ecx, [esp + 4]
call fcn.0054d008
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
mov edx, str.SELECT_value_FROM_options_WHERE_key__
push edx
call fcn.005b1270
push edx
call fcn.005b1230
pop edx
push eax
push dword [esp + 0xc]
call fcn.005141ad
pop eax
mov edx, 0x72c470
push edx
call fcn.005b1270
call fcn.005b1360
push 1
call fcn.0054d542
add dword [esp + 4], edx
call fcn.0059de4c
call fcn.0054d560
and eax, eax
je 0x4d1d72
push 1
call fcn.0059de5e
and eax, eax
je 0x4d1d68
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push 0
push 1
call fcn.0059deb2
lea eax, [esp + 8]
push eax
call fcn.005b12d0
push 1
call fcn.0059dedf
mov edx, dword [esp + 4]
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1270
pop eax
push eax
call fcn.0054d530
pop edx
add eax, edx
jmp 0x4d1d9a
push dword [esp + 4]
call fcn.005b1460
push dword [esp]
call fcn.005b1460
add esp, 8
ret 4
Function at 0x50bd9b
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push eax
call fcn.005b13d0
mov edx, dword [esp + 8]
lea ecx, [esp]
call fcn.0054d000
push 1
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, str.explore
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
xor eax, eax
push dword [esp]
call fcn.005b1460
add esp, 4
ret 4