joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ae65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040aa4f
push eax
push esi
push dword [ebp + 8]
call fcn.0040aa04
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040aa3f
add byte [ecx], 0x4a
invalid

Function at 0x40d0a8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x10], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 4], eax
jbe 0x40d23a
push ebx
mov eax, edi
call fcn.00406c80
push dword [ebp - 4]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ebx, eax
push ebx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x40f18c
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40d12b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov dword [edi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov ecx, dword [eax + 0x14]
mov dword [edi + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edi + 8], ecx
mov ecx, dword [eax + 0x24]
mov dword [edi + 0x10], ecx
mov eax, dword [eax + 0x28]
mov dword [edi + 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40d17a
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._4.4X_4.4X
lea eax, [ebp - 0x38]
push 0x14
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
push 0x40e548
lea eax, [ebp - 0x38]
push eax
push ebx
lea esi, [ebp - 0x238]
call fcn.0040d019
test eax, eax
jne 0x40d18a
lea eax, [ebp - 0x38]
push str.040904E4
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
push 0x4102a4
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x18]
push ebx
call fcn.0040d019
push 0x4102bc
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x218]
push ebx
call fcn.0040d019
push 0x4102dc
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x418]
push ebx
call fcn.0040d019
push 0x4102f4
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x618]
push ebx
call fcn.0040d019
push 0x410314
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x818]
push ebx
call fcn.0040d019
push 0x41032c
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xa18]
push ebx
call fcn.0040d019
push 0x410348
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xc18]
push ebx
call fcn.0040d019
push str.OriginalFileName
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xe18]
push ebx
call fcn.0040d019
xor esi, esi
push ebx
inc esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov eax, esi
pop esi
leave
ret 4
Function at 0x41952b
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d0
pushal
lea eax, [ebp - 0x720]
mov dword [ebp - 0x10], eax
push eax
call fcn.00417332
lea eax, [ebp - 0x520]
mov dword [ebp - 4], eax
push eax
call fcn.00417b4a
lea eax, [ebp - 0x620]
mov dword [ebp - 0xc], eax
push eax
jmp loc.0041c8f8

Function at 0x4195ec
Capabilities:
Terminate process

Disassembly:
call fcn.004195f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x24883b18
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xbdb4084
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401f78
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x404230
call fcn.004020dc
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x405478
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x401d39
cmp eax, esi
jne 0x401d2c
xor esi, esi
inc esi
mov ebx, esi
jmp 0x401d3c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401d13
xor esi, esi
inc esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401d4f
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401d7e
mov eax, dword [0x405474]
test eax, eax
jne 0x401d78
mov dword [0x405474], esi
push 0x4030e4
push 0x4030d8
call fcn.00401c82
pop ecx
pop ecx
test eax, eax
je 0x401d7e
jmp 0x401ea6
mov dword [0x40513c], esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401da2
push 0x4030d4
push 0x4030cc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x405474], 2
test ebx, ebx
jne 0x401dae
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40547c], 0
je 0x401dd2
push 0x40547c
call fcn.00402064
pop ecx
test eax, eax
je 0x401dd2
push 0
push 2
push 0
call dword [0x40547c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401e2e
test al, al
je 0x401dec
cmp dword [ebp - 0x1c], 0
jne 0x401e2e
mov al, byte [esi]
test al, al
je 0x401dfc
cmp al, 0x20
ja 0x401dfc
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401dec
test byte [ebp - 0x3c], 1
je 0x401e08
movzx eax, word [ebp - 0x38]
jmp 0x401e0b
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x405138], eax
cmp dword [0x40512c], 0
jne 0x401e82
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x401e3d
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x401e50
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x401dd9
cmp dword [0x40513c], 0
jne 0x401e91
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x405138]
jmp 0x401eb2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00402121
ret
call fcn.0040220b
jmp 0x401cd9
Function at 0x40f3f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6d8d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040ae60
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040ae60
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00413510
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x40dcc0
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.0041afc0
push eax
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0
call fcn.005881eb
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x40f487
lea ecx, [ebp - 0x14]
call fcn.0043aaf0
jmp 0x40f498
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call fcn.005654a3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00419750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x40f4c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6dad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ae60
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00413590
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40dd60
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.0041afc0
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call fcn.005881eb
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x40f53e
lea ecx, [ebp - 0x14]
call fcn.0043ab20
jmp 0x40f54f
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call fcn.005654a3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00419790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40f570
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6dcd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ae60
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00413600
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40dde0
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.0041afc0
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call fcn.005881eb
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x40f5ee
lea ecx, [ebp - 0x14]
call fcn.0043ab20
jmp 0x40f5ff
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call fcn.005654a3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004197d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f620
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6ded
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ae60
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.004136a0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40de60
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.0041afc0
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call fcn.005881eb
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x40f69e
lea ecx, [ebp - 0x14]
call fcn.0043ab20
jmp 0x40f6af
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call fcn.005654a3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00419810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40f6d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6dad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ae60
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00413590
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40dee0
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.0041afc0
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call fcn.005881eb
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x40f74e
lea ecx, [ebp - 0x14]
call fcn.0043ab20
jmp 0x40f75f
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call fcn.005654a3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00419790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x417270
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a747d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.004155f0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 0x18]
call fcn.004155f0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x38]
mov edx, dword [edx + 0x3c]
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x422cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
add ecx, 0x38
call fcn.0041afc0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0xc]
push edx
push 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422d0d
cmp dword [ebp - 8], 3
je 0x422d07
cmp dword [ebp - 8], 4
je 0x422d07
cmp dword [ebp - 8], 0xb
jne 0x422d0d
cmp dword [ebp - 0xc], 4
je 0x422d11
xor al, al
jmp 0x422d4e
mov ecx, dword [ebp - 4]
add ecx, 0x38
call fcn.0041afc0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x422d4c
xor al, al
jmp 0x422d4e
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x425ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x425f14
xor eax, eax
jmp 0x425f94
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x425f2b
xor eax, eax
jmp 0x425f94
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x425f77
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x425f77
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x425f4e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x425f83
xor eax, eax
jmp 0x425f94
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x425f91
xor eax, eax
jmp 0x425f94
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x42c530
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret 8
Function at 0x4303b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8d9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
mov dword [ebp - 0x64], ecx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x6c], esp
push 0x5b6080
call fcn.00415e60
lea eax, [ebp - 0x24]
push eax
call fcn.00462850
add esp, 0x1c
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.0041afc0
push eax
lea ecx, [ebp - 0xa8]
call fcn.00415e60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004185c0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x70], esp
push 0x5b60a8
call fcn.00415e60
lea edx, [ebp - 0x30]
push edx
call fcn.00462850
add esp, 0x1c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
call fcn.0041afc0
push eax
lea ecx, [ebp - 0x90]
call fcn.00415e60
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x30]
call fcn.004185c0
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x50], 4
lea ecx, [ebp - 0x18]
push ecx
push 0xf003f
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x74], esp
lea edx, [ebp - 0xa8]
push edx
call fcn.00415d00
lea eax, [ebp - 0x40]
push eax
call fcn.00462330
add esp, 0x1c
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
call fcn.0041afc0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x44], edx
lea ecx, [ebp - 0x40]
call fcn.004185c0
cmp dword [ebp - 0x44], 0
jne 0x430553
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x78], esp
lea eax, [ebp - 0x90]
push eax
call fcn.00415d00
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00462330
add esp, 0x1c
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp - 0x4c]
call fcn.0041afc0
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x5c]
call fcn.004185c0
cmp dword [ebp - 0x60], 0
jne 0x430549
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x110], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x90]
call fcn.00419220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.00419220
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43b8f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9f08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x284
mov dword [ebp - 0x48], ecx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x5b53fc
call fcn.00415e60
lea eax, [ebp - 0x1c]
push eax
call fcn.00462850
add esp, 0x1c
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.0041afc0
push eax
lea ecx, [ebp - 0x70]
call fcn.00415e60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004185c0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x50], esp
push 0x5b5424
call fcn.00415e60
lea edx, [ebp - 0x28]
push edx
call fcn.00462850
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x24]
call fcn.0041afc0
push eax
lea ecx, [ebp - 0x88]
call fcn.00415e60
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.004185c0
push 0x104
lea ecx, [ebp - 0x290]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x10]
push edx
push 0xf003f
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x54], esp
lea eax, [ebp - 0x70]
push eax
call fcn.00415d00
lea ecx, [ebp - 0x38]
push ecx
call fcn.00462330
add esp, 0x1c
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x30]
call fcn.0041afc0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x38]
call fcn.004185c0
cmp dword [ebp - 0x3c], 0
jne 0x43ba58
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 4
mov edx, dword [ebp - 0x40]
push edx
lea eax, [ebp - 0x44]
push eax
push 4
push 0
push 0x5b543c
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov dword [edx + 0x110], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.00419220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00419220
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x43f250
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa4d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 1
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x43f29a
mov dword [ebp - 0x24], 2
lea ecx, [ebp - 0x20]
call fcn.00414580
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00414580
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0xc8
cmp dword [ebp - 0x14], 0xc8
je 0x43f2d3
mov dword [ebp - 0x14], 0xc8
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x50]
call fcn.00438f30
test eax, eax
jne 0x43f36f
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jge 0x43f36f
movzx ecx, byte [0x5e300c]
test ecx, ecx
je 0x43f36f
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetPhysicalCursorPos]
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00492200
add esp, 8
movzx eax, al
test eax, eax
je 0x43f36f
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
lea edx, [ebp - 0x20]
push edx
call fcn.00414330
mov ecx, dword [ebp - 0x18]
call fcn.0043a7e0
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0xe], al
movzx ecx, byte [ebp - 0xe]
test ecx, ecx
je 0x43f36f
mov dword [ebp - 0x14], 0x1b7740
mov edx, dword [ebp - 0x14]
push edx
push 0
lea eax, [ebp - 0x48]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x43f38e
jmp 0x43f3a8
cmp dword [ebp - 0x1c], 1
jne 0x43f39b
mov dword [ebp - 0x14], 0xc8
mov ecx, 1
test ecx, ecx
jne 0x43f2c3
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004185c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004185c0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret