joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov edx, 0x530b40
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
call fcn.00416860
add esp, 4
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c], 0x6e0041
mov dword [ebp - 0x38], 0x740079
mov dword [ebp - 0x34], 0x690068
mov dword [ebp - 0x30], 0x67006e
mov dword [ebp - 0x2c], 0x6c002e
mov dword [ebp - 0x28], 0x6b006e
mov word [ebp - 0x24], ax
call fcn.00405dc0
push eax
push 0xc
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404e60
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.004169a0
add esp, 4
mov byte [ebp - 4], 3
or esi, 0xffffffff
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419d0c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x1c]
call fcn.0041afb0
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419d32
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419d53
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov edx, 0x530b10
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.00416860
add esp, 4
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x3c], 0x6e0041
mov dword [ebp - 0x38], 0x740079
mov dword [ebp - 0x34], 0x690068
mov dword [ebp - 0x30], 0x67006e
mov dword [ebp - 0x2c], 0x6c002e
mov dword [ebp - 0x28], 0x6b006e
mov word [ebp - 0x24], ax
call fcn.00405dc0
push eax
push 0xc
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00404e60
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 5
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x20]
call fcn.004169a0
add esp, 4
mov byte [ebp - 4], 7
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419df1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x20]
call fcn.0041afb0
mov byte [ebp - 4], 4
mov eax, esi
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419e17
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x419e36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
Function at 0x419ef0
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503aeb
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
push ebx
push esi
push edi
mov eax, dword [0x5473d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x4c]
call fcn.00418e90
mov dword [ebp - 4], 0
mov edi, dword [eax]
mov dword [ebp - 0x44], 0x650044
mov dword [ebp - 0x40], 0x65006c
mov dword [ebp - 0x3c], 0x650074
mov dword [ebp - 0x38], 0x750020
mov dword [ebp - 0x34], 0x69006e
mov dword [ebp - 0x30], 0x73006e
mov dword [ebp - 0x2c], 0x610074
mov dword [ebp - 0x28], 0x6c006c
mov dword [ebp - 0x24], 0x720020
mov dword [ebp - 0x20], 0x670065
mov dword [ebp - 0x1c], 0x730069
mov dword [ebp - 0x18], 0x720074
mov dword [ebp - 0x14], 0x79
call fcn.00405dc0
push eax
push 0x19
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x10]
call fcn.00404e60
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe4]
call fcn.0040b430
mov byte [ebp - 4], 2
mov eax, 0x531ef4
mov esi, dword [ebp - 0x10]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.00409e50
mov eax, dword [edi]
lea ecx, [ebp - 0xe4]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe4], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0xe8], eax
lea ecx, [ebp - 0xe0]
call fcn.0040c1d0
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe4], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xe8], eax
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x94], vtable.std::ios_base.0
call fcn.0041c00c
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esp, 4
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41a070
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 4
mov esi, dword [ebp - 0x48]
test esi, esi
je 0x41a09d
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x41a09d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x41a09d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.0041a0f0
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x41a0d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a0f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x7c], 0x4f0053
push edi
mov dword [ebp - 0x78], 0x540046
mov dword [ebp - 0x74], 0x410057
mov dword [ebp - 0x70], 0x450052
mov dword [ebp - 0x6c], 0x4d005c
mov dword [ebp - 0x68], 0x630069
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x6f0073
mov dword [ebp - 0x5c], 0x740066
mov dword [ebp - 0x58], 0x57005c
mov dword [ebp - 0x54], 0x6e0069
mov dword [ebp - 0x50], 0x6f0064
mov dword [ebp - 0x4c], 0x730077
mov dword [ebp - 0x48], 0x43005c
mov dword [ebp - 0x44], 0x720075
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x74006e
mov dword [ebp - 0x38], 0x650056
mov dword [ebp - 0x34], 0x730072
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6e0055
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov dword [ebp - 0x1c], 0x6c0061
mov dword [ebp - 0x18], 0x5c006c
mov dword [ebp - 0x14], 0x6e0041
mov dword [ebp - 0x10], 0x740079
mov dword [ebp - 0xc], 0x690068
mov dword [ebp - 8], 0x67006e
mov word [ebp - 4], ax
call fcn.00405dc0
mov ecx, dword [ebp + 8]
push eax
push 0x3c
lea eax, [ebp - 0x7c]
push eax
call fcn.00404e60
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41ab00
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41ab78
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
Function at 0x41ab90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c0
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov ebx, edx
mov dword [ebp - 0x4c0], eax
push esi
push edi
test eax, eax
je 0x41ac5b
test ebx, ebx
je 0x41ac5b
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x41ac5b
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x41ac5b
xor ecx, ecx
movzx edx, ax
nop dword [eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x41ac46
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [ebp - 0xd4]
push edi
push eax
push dword [ebp - 0x4c0]
call fcn.004d8d2c
add esp, 0xc
test eax, eax
je 0x41ac6e
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x41abf0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
lea esi, [ebp - 0xc]
mov edx, 0x400
mov ecx, ebx
sub esi, ebx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbfe]
test eax, eax
je 0x41ac9e
movzx eax, word [esi + ecx]
test ax, ax
je 0x41ac9e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x41ac80
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x400
mov eax, ebx
cmp word [eax], 0
je 0x41acc0
add eax, 2
sub ecx, 1
jne 0x41acb2
mov edx, 0x400
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x41ad16
lea ecx, [ebx + esi*2]
sub edx, esi
je 0x41ad09
lea eax, [edi + edi]
mov esi, SysReAllocString
mov edi, dword [ebp - 0x4c0]
sub eax, ecx
add edi, eax
nop
test esi, esi
je 0x41ad09
movzx eax, word [edi + ecx]
test ax, ax
je 0x41ad09
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x41acf0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00499723
mov esp, ebp
pop ebp
ret
Function at 0x41ad30
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0049a0d0
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
push edi
test esi, esi
je 0x41aed9
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x41aed9
push ebx
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004c5380
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
mov ebx, eax
test ebx, ebx
je 0x41ae95
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004c5380
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.004c4cf3
add esp, 0x14
test eax, eax
je 0x41ae43
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x41ae43
lea edx, [ebp - 0x1004]
mov ecx, 0x400
sub edx, esi
nop word [eax + eax]
lea eax, [ecx + 0x7ffffbfe]
test eax, eax
je 0x41ae6e
movzx eax, word [edx + esi]
test ax, ax
je 0x41ae6e
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x41ae00
test ecx, ecx
lea eax, [esi - 2]
push edi
cmovne eax, esi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x804]
mov ecx, 0x400
sub edx, esi
lea eax, [ecx + 0x7ffffbfe]
test eax, eax
je 0x41ae6e
movzx eax, word [edx + esi]
test ax, ax
je 0x41ae6e
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x41ae50
test ecx, ecx
lea eax, [esi - 2]
push edi
cmovne eax, esi
xor ecx, ecx
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x41aebf
push ecx
mov edx, esi
lea ecx, [ebp - 0x804]
call fcn.0041ab90
add esp, 4
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00499723
mov esp, ebp
pop ebp
ret
Function at 0x41aef0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.0049a0d0
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x41af1f
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.004c5380
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.004d0fac
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00499723
mov esp, ebp
pop ebp
ret
Function at 0x41ba70
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x41bb31
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004c5380
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x41bb1b
push edi
push 0x104
lea edi, [ebx + 4]
push 0
push edi
call fcn.004c5380
add esp, 0xc
lea eax, [ebp - 0x108]
push edi
push 0
push str.NINE
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx], eax
pop edi
cmp dword [ebx], 0
jne 0x41bb31
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.004c5380
add esp, 0xc
mov dword [ebp - 0x314], 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x310]
push 0x207
push eax
call fcn.00407810
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004cb826
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x41bb91
cmp eax, 0x207
ja 0x41bb91
jne 0x41bb98
mov byte [ebp - 0x109], 0
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bba1
push 0
lea eax, [ebp - 0x314]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x310]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00499723
mov esp, ebp
pop ebp
ret
Function at 0x41bbe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, ecx
push ebx
mov dword [ebp - 4], eax
cmp dword [eax], 0
je 0x41bcd0
cmp byte [eax + 4], 0
lea ebx, [eax + 4]
je 0x41bcd0
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x41bc10
movaps xmm0, xmmword [0x5326f0]
sub esi, ecx
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 8], 0x65
movaps xmm0, xmmword [0x5326e0]
movups xmmword [ebp - 0x28], xmm0
movaps xmm0, xmmword [str.ntVersionRunOncftWindowsCurreSOFTWAREMicroso]
movups xmmword [ebp - 0x18], xmm0
call fcn.00405dc0
mov ecx, eax
test ecx, ecx
je 0x41bcd7
mov eax, dword [ecx]
push 1
push 0x31
call dword [eax]
test eax, eax
je 0x41bce1
cmp dword [eax + 8], 0x31
lea edi, [eax + 0x10]
jl 0x41bce6
push 0x31
lea eax, [ebp - 0x38]
mov dword [edi - 0xc], 0x31
push eax
push 0x31
push edi
mov byte [edi + 0x31], 0
call fcn.00412600
mov eax, dword [ebp - 4]
add esp, 0x10
cmp dword [eax], 0
jne 0x41bc90
xor eax, eax
jmp 0x41bc97
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push esi
push ebx
push 1
push eax
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov esi, eax
add edi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41bcc2
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00405ba0
call fcn.004050c0
push 0x80070057
call fcn.00405ba0
int3

Function at 0x41f760
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x41f785
or esi, 1
push 1
call edi
test ax, ax
jns 0x41f791
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x41f79d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x41f7a9
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x422760
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0xe0]
call fcn.004253a0
mov edi, dword [ebp + 8]
test eax, eax
jle 0x4227bb
nop
push esi
lea ecx, [ebx + 0xe0]
mov byte [ebp + 0xb], 0
call fcn.00426470
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x4228ec
lea ecx, [ebx + 0xe0]
inc esi
call fcn.004253a0
cmp esi, eax
jl 0x422780
sub edi, 0x100
je 0x422881
sub edi, 4
je 0x422822
sub edi, 2
jne 0x422876
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call fcn.004d0f7c
mov ecx, dword [ebx + 0x58]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x8000000a
push edx
push 0x4245f0
call dword [eax + 0x14c]
mov esi, eax
test esi, esi
je 0x422876
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x13c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x5c], 0
je 0x422876
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x74]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.0041f760
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x5c]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + pe_nt_image_headers32]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x422876
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
je 0x4228d3
mov eax, dword [ecx]
mov eax, dword [eax + 0x110]
call eax
test al, al
je 0x4228d3
mov ecx, dword [ebx + 0x5c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x11c]
call eax
test al, al
je 0x4228d3
mov ecx, dword [ebx + 0x5c]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.004c4a77
add esp, 8
test eax, eax
je 0x4228d3
mov ecx, dword [ebx + 0x5c]
call fcn.0043a290
test al, al
jne 0x422876
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, ebx
setns al
movzx eax, al
push eax
call fcn.00423d60
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425bc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 0
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [esi + 4]
xorps xmm0, xmm0
push esi
movups xmmword [ebp - 0x20], xmm0
xor ebx, ebx
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x425c89
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x425c89
cmp dword [ebp - 0x1c], 0x10
jne 0x425c50
cmp dword [ebp - 0x20], esi
jne 0x425c50
mov eax, dword [ebp - 0x18]
push 1
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov ebx, 1
lea eax, [ebp - 0x20]
push eax
call fcn.00424380
add esp, 4
test al, al
jne 0x425c74
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x425c89
test ebx, ebx
jne 0x425c89
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x425c16
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x425cab
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x425cc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x425d05
cmp byte [ebp + 8], 0
je 0x425cf9
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8