joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444ae8
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x444b02
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x444b19
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x444b71
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.00447977
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x444b71
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x444b71
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x444b71
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x444b6b
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x444b6d
xor bl, bl
mov al, bl
jmp 0x444b73
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x4469ab
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x446a48
push ebx
push esi
call fcn.00446974
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00445a16
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4469f5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x446a47
push edi
push eax
call fcn.00443810
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x446a15
call fcn.00441530
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x446a46
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00445a16
add esp, 0x20
test eax, eax
jne 0x446a34
push edi
call fcn.00441530
jmp 0x446a3c
push ebx
call fcn.00441530
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x446a4b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x446a5c
pop esi
ret
push ebx
push edi
push esi
call fcn.00446974
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00443810
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x446a84
push ebx
push esi
push edi
call fcn.00435f00
add esp, 0xc
push 0
call fcn.00441530
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4471db
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00446cf7

Function at 0x44d880
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44d8ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44d8ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0xf722ac2
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
cmp dword [0xf7ae760], 0
push ebx
push esi
push edi
push ebp
jne 0xf73dade
push dword [esp + 0x28]
mov ebp, dword [esp + 0x28]
push ebp
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 0x10
lea edx, [esp + 0x10]
mov ecx, dword [esp + 0x20]
call fcn.0f79d30d
test eax, eax
je 0xf73daf9
mov eax, 0xe
jmp 0xf722aed
lea eax, [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push eax
push 0
push dword [esp + 0x18]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov esi, eax
test esi, esi
je 0xf73db25
mov ecx, dword [esp + 0x10]
call fcn.0f79d382
mov eax, esi
jmp 0xf722aed
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0xf73db53
inc dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.0f726e61
mov esi, eax
test esi, esi
jne 0xf73db55
mov ecx, dword [esp + 0x10]
call fcn.0f79d382
mov eax, 0xe
jmp 0xf722aed
xor esi, esi
lea eax, [esp + 0x14]
push eax
push esi
push dword [esp + 0x18]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov edi, eax
test edi, edi
jne 0xf73db92
test ebp, ebp
je 0xf73dba8
mov ecx, dword [esp + 0x28]
push dword [ecx]
push ebp
push dword [esp + 0x1c]
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0xf73db92
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call fcn.0f726e12
mov ecx, dword [esp + 0x10]
call fcn.0f79d382
mov eax, edi
jmp 0xf722aed
push dword [esp + 0x14]
call fcn.0f726e61
mov esi, eax
test esi, esi
jne 0xf73dbca
mov ecx, dword [esp + 0x10]
call fcn.0f79d382
mov eax, 0xe
jmp 0xf722aed
lea eax, [esp + 0x14]
push eax
push esi
push dword [esp + 0x18]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov edi, eax
test edi, edi
jne 0xf73db92
push 0
push 0
push dword [esp + 0x1c]
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add eax, eax
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
jmp 0xf73db92
Function at 0xf72613c
Capabilities:
Hide graphical window

Disassembly:
push esi
mov edx, dword [0xf7b85e0]
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x34]
test byte [ecx + edx], 4
je 0xf726163
push dword [esp + 0x10]
push esi
call fcn.0f735a65
pop edi
pop esi
ret 8
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x114]
and eax, 0x600
shr eax, 9
test eax, eax
jne 0xf726186
cmp dword [esp + 0x10], 1
sbb eax, eax
and eax, 3
inc eax
push eax
jmp 0xf726196
cmp eax, 1
je 0xf74051c
cmp eax, 2
jne 0xf72619d
push 3
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xf7ae164]
cmp edi, eax
jne 0xf72615e
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0xf72615e
cmp dword [esp + 0x10], 1
mov eax, 7
adc eax, 0xffffffff
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 7
push esi
call fcn.0f72f6a9
jmp 0xf72619d
Function at 0xf7272e0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf7b1690
push 0xf782d19
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov dword [ebp - 0x20], 0xffffffff
push ebx
mov eax, dword [ebp + 8]
push esi
mov dword [0xf7ae730], eax
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
je 0xf740cf2
test al, al
je 0xf72733d
cmp byte [esi], 0x20
je 0xf72733d
inc esi
cmp byte [esi], 0
jne 0xf727332
cmp byte [esi], 0
jne 0xf740d16
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
movzx eax, word [ebp - 0x34]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0f7283f1
jmp 0xf740d2b
inc esi
cmp byte [esi], 0
je 0xf72733d
cmp byte [esi], 0x22
je 0xf740d07
inc esi
cmp byte [esi], 0
jne 0xf740cfc
cmp byte [esi], 0
je 0xf727346
inc esi
jmp 0xf72733d
cmp byte [esi], 0x20
jne 0xf727346
inc esi
cmp byte [esi], 0
je 0xf727346
jmp 0xf740d16
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0xf7284b3
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
push 0x12
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0
call esi
test ax, ax
jl 0xf7417a4
push 0x10
call esi
test ax, ax
mov eax, 0
jl 0xf7417ae
or edi, eax
push 0x11
call esi
test ax, ax
mov eax, 0
jl 0xf7417b8
or edi, eax
mov eax, edi
pop edi
pop esi
ret
mov edi, 4
jmp 0xf7284cd
mov eax, 1
jmp 0xf7284df
mov eax, 2
jmp 0xf7284f3

Function at 0xf72a1a0
Capabilities:
Get geographical location

Disassembly:
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
mov dword [0xf7ae478], eax
call fcn.0f72a1e2
lea ecx, [esp + 2]
push 2
push ecx
mov dword [0xf7ae47c], eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0xf741fc1
mov al, byte [esp + 2]
mov byte [0xf7ae480], al
add esp, 4
ret
mov byte [0xf7ae480], 0x2e
jmp 0xf72a1de

Function at 0xf72a315
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, eax
push 5
push ebx
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
call ebp
mov edi, eax
test edi, edi
je 0xf72a34e
mov esi, dword [esp + 0x14]
push 4
push edi
call ebp
cmp eax, esi
je 0xf7420ff
push 2
push edi
call ebp
mov edi, eax
test edi, edi
jne 0xf72a336
pop ebp
pop edi
pop esi
pop ebx
ret 4
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0xf72a343
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ebx
jmp 0xf72a346

Function at 0xf72c351
Capabilities:
Query environment variable

Disassembly:
cmp dword [esp + 4], 0
push esi
jne 0xf743630
xor eax, eax
pop esi
ret 4
cmp dword [0xf7b8554], 0
jne 0xf72c35d
mov dword [0xf7ae180], 0xf7437ae
mov dword [0xf7ae184], 0xf7437a8
mov dword [0xf7ae198], 0xf7437a2
mov dword [0xf7ae17c], 0xf74379c
mov dword [0xf7ae1b8], 0xf743796
mov dword [0xf7ae1c8], 0xf743790
mov dword [0xf7ae194], 0xf74378a
mov dword [0xf7ae1b4], 0xf743784
mov dword [0xf7ae1a8], 0xf74377e
mov dword [0xf7ae1bc], 0xf743778
mov dword [0xf7ae190], 0xf743772
mov dword [0xf7ae1c0], 0xf74376c
mov dword [0xf7ae1cc], 0xf743766
mov dword [0xf7ae1a0], 0xf743760
mov esi, 0x180020
push str.SRDDE
mov dword [0xf7ae1ac], 0xf74375a
mov dword [0xf7ae188], 0xf743754
mov dword [0xf7ae1a4], 0xf74374e
call dword [sym.imp.MSVCRT20.dll_getenv]
add esp, 4
test eax, eax
je 0xf743713
push str.aoxomoxoa
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, 1
je 0xf743715
xor eax, eax
mov dword [0xf7b8550], eax
test eax, eax
jne 0xf743723
mov esi, 0x181020
push 0
push esi
push 0xf75d1d8
push 0xf7b8554
call dword [0xf7ae180]
test eax, eax
je 0xf743744
call fcn.0f75e224
jmp 0xf72c35f
call fcn.0f75d4aa
jmp 0xf72c35d
Function at 0xf72d7f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0x10]
push edi
test bh, 0x80
push ebp
mov ebp, 1
jne 0xf7440b5
push dword [esp + 0x14]
call fcn.0f72d6c1
mov eax, dword [0xf7b869c]
mov esi, dword [esp + 0x14]
lea edi, [eax + esi]
mov ax, word [edi + 8]
and ax, 0xff00
cmp ax, 0x600
jne 0xf7440bf
test byte [edi + 0x1c], 1
jne 0xf744144
mov eax, dword [0xf7b869c]
and byte [eax + esi + 0x1c], 0xfb
mov eax, dword [0xf7b869c]
mov dword [eax + esi + 0xc], 0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret 8
and bh, 0x7f
xor ebp, ebp
jmp 0xf72d80f
cmp ax, 0x200
jne 0xf7440cd
push dword [edi + 4]
call fcn.0f760ee2
mov edi, dword [0xf7b869c]
mov eax, ebx
add edi, esi
or ah, 0x80
push eax
lea ecx, [edi + 0x20]
push ecx
push 0
call fcn.0f733347
mov dword [edi], eax
mov edi, dword [0xf7b869c]
add edi, esi
cmp dword [edi], 0xffffffff
jne 0xf744111
mov ecx, dword [edi + 4]
call fcn.0f733604
push eax
push dword [edi + 0x20]
call fcn.0f782664
push eax
call fcn.0f7826a1
jmp 0xf72d859
test ebp, ebp
je 0xf72d857
test ebx, ebx
jne 0xf72d857
push dword [esp + 0x14]
call fcn.0f733026
mov edi, eax
test edi, edi
je 0xf72d857
push dword [esp + 0x14]
call fcn.0f72d6c1
mov eax, edi
jmp 0xf72d859
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [edi], eax
jmp 0xf72d840
Function at 0xf730ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x20
mov word [ebp - 0x10], 0x2bc
push esi
mov dword [ebp - 0x14], eax
push edi
mov dword [ebp - 4], eax
mov ecx, dword [0xf7ae710]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
cmp ecx, eax
mov dword [ebp - 0x20], 0x20
jne 0xf746392
mov dword [ebp - 0x18], 0x13880
mov esi, dword [str.MS_Sans_Serif]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0xf74638a
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx*2 + 3]
and al, 0xfc
call fcn.0f7270c0
mov eax, esp
push esi
push eax
call fcn.0f72a0e0
mov dword [ebp - 0x1c], eax
mov word [ebp - 0xe], 1
push 0xf7ae268
lea eax, [ebp - 0x20]
mov word [ebp - 0x10], 0x190
push 0xf7b0dc8
push eax
call sub.OLEPRO32.DLL_OleCreateFontIndirect
test eax, eax
mov eax, 0
jl 0xf730f92
push 0x9ec
mov eax, dword [0xf7ae514]
push eax
mov ecx, dword [0xf7ae268]
mov eax, dword [ecx]
push dword [0xf7ae268]
call dword [eax + 0x58]
push 0xf7ae26c
mov ecx, dword [0xf7ae268]
mov eax, dword [ecx]
push dword [0xf7ae268]
call dword [eax + 0x4c]
mov eax, 1
lea esp, [ebp - 0x28]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
std
invalid
ror byte [ebp - 0x22e43], 0xff

Function at 0xf730fba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov dword [esp + 8], 0
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
push ebp
mov eax, dword [esi + 0x15c]
test eax, eax
jne 0xf7463ec
mov eax, dword [esp + 0x18]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
clc
das
Function at 0xf73179c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test byte [esi + 0x10], 0x10
jne 0xf7318c7
call fcn.0f72cc49
mov ecx, dword [esi + 0x10]
test ch, 0x10
je 0xf74676b
test cl, 1
mov edi, dword [esi + 0x80]
jne 0xf746778
cmp dword [esi + 0x34], 0
je 0xf7318e7
test edi, edi
je 0xf7318e7
mov eax, dword [edi + 0x30]
mov edx, dword [0xf7b85e0]
mov ebx, dword [eax + 0x34]
test byte [ebx + edx], 4
jne 0xf7318d5
or cl, 0x10
mov ebx, dword [esi + 0x1c]
mov dword [esi + 0x10], ecx
test ebx, ebx
je 0xf731864
cmp dword [0xf7ae430], 2
je 0xf7467d2
cmp ebx, dword [0xf7ae164]
je 0xf7318f2
cmp dword [0xf7ae430], 2
je 0xf746866
test byte [esi + 0x10], 1
jne 0xf7468c7
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, ebx
je 0xf7468d1
push eax
push ebx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0xf7468d1
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0xf7b85e0]
mov dword [0xf7ae1d0], esi
mov dword [0xf7ae1f0], edi
test edi, edi
je 0xf7318b3
mov eax, dword [esi + 0x34]
test byte [eax + edx], 2
jne 0xf7468db
mov eax, dword [edi + 0x24]
test eax, eax
je 0xf731895
push eax
call fcn.0f730d81
mov eax, dword [edi + 0x24]
test eax, eax
jne 0xf731888
mov dword [0xf7b86ec], 0
mov eax, dword [edi + 0x124]
test eax, eax
jne 0xf7468ea
push edi
call fcn.0f730d81
and byte [esi + 0x10], 0xef
push esi
call fcn.0f72cccd
mov dword [0xf7ae1f0], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0xf7b84cc], 0
je 0xf7317fa
jmp 0xf7467a3
mov edx, dword [0xf7b85e0]
jmp 0xf7317fa
push dword [ebp + 0xc]
mov eax, dword [esi + 0x10]
and eax, 0xe0
shr eax, 5
push eax
call fcn.0f7345db
test eax, eax
jne 0xf731820
jmp 0xf74685b
pop ds
in eax, dx
invalid
dec dword [edi]
test byte [edx + 0x6a00000e], dh
add bh, bh
mov ch, 0x94
stc
invalid
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0xf74765c
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.0f74543a
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0xf7468d6
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
test dword [eax], eax
stc
invalid
cmp dword [ebp - 0x700], 5
jge 0xf74691f
inc dword [0x858b407d]
add cl, bh
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0xf7468c9
cld
invalid
call fcn.0f7454c9
Function at 0xf73347c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.0f733469
fld dword [ebp + 8]
mov edx, dword [eax + 0x2c]
mov ecx, eax
fstp qword [ebp - 8]
test dword [ebp + 8], 0x7fffffff
je 0xf7334bb
fldz
fcomp qword [ebp - 8]
fnstsw ax
sahf
ja 0xf74766c
imul edx, edx, 0xfffd43fd
sub edx, 0x3c613d
and edx, 0xffffff
mov dword [ecx + 0x2c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
fild qword [ebp - 8]
mov esp, ebp
fmul dword [0xf7b253c]
pop ebp
ret 4
lds esp, [esp + edx*2]
call fcn.0f7454c9
and dword [esi + 7], 0xffffffcc
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
Function at 0xf735a65
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov ecx, dword [0xf7ae15c]
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
mov edx, dword [ecx + 0x30]
inc word [eax + 0x74]
mov eax, dword [0xf7ae164]
inc word [edx + 0x74]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0xf7493cc
mov eax, dword [esi + 0x30]
mov ecx, dword [0xf7ae15c]
dec word [eax + 0x74]
mov edx, dword [ecx + 0x30]
dec word [edx + 0x74]
mov eax, dword [esi + 0x114]
and eax, 0x600
shr eax, 9
test eax, eax
jne 0xf7493eb
push 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0x223
push dword [0xf7ae160]
call ebx
cmp dword [esp + 0x24], 0
je 0xf735af1
push 0
push edi
push 0x222
push dword [0xf7ae160]
call ebx
mov eax, dword [esi + 0x30]
test byte [eax + 0x10], 8
je 0xf735b3c
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0xf735b3c
push edi
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0xf735b3c
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
movzx eax, word [esp + 0x18]
movzx ecx, word [esp + 0x14]
shl eax, 0x10
or eax, ecx
push eax
push 0
push 5
mov eax, dword [esi + 0x20]
mov ebx, dword [eax]
push dword [esi + 0x2c]
push esi
call dword [ebx + 8]
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
mov eax, dword [0xf7ae15c]
push 0
push 1
push 0x105d
mov edx, dword [eax + 0x20]
push dword [eax + 0x2c]
push eax
mov ebx, dword [edx]
call dword [ebx + 8]
jmp 0xf735a9a
cmp eax, 1
je 0xf749412
cmp eax, 2
jne 0xf735b3c
push 0
mov eax, dword [0xf7ae160]
push edi
push 0x225
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0xf735b3c
push 6
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 7
push esi
call fcn.0f72f6a9
jmp 0xf735b3c
Function at 0xf736390
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
je 0xf74a198
cmp dword [esi + 0x3c], 0
je 0xf74a198
cmp dword [ebp + 0x10], 0
je 0xf74a16d

Function at 0xf736e1c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
lea eax, [ebp - 4]
push esi
mov ebx, dword [ebp - 4]
push edi
mov esi, dword [ebp + 0xc]
xor edi, edi
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0xf74b046
push eax
call fcn.0f73a9de
mov dword [ebp - 8], eax
test eax, eax
jne 0xf736eb4
push 0x105
lea eax, [ebp - 0x110]
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0
push dword [ebp - 4]
call ebx
test eax, eax
jne 0xf736e9d
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 4]
call fcn.0f736e1c
test eax, eax
jne 0xf74b04e
push 0x105
lea eax, [ebp - 0x110]
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0xf736e70
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.0f73a9de
test eax, eax
jne 0xf74b057
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push eax
call fcn.0f73a9de
test eax, eax
jne 0xf74b05f
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], ebx
jmp 0xf736e46
inc edi
mov dword [ebp - 8], eax
jmp 0xf736e87
mov dword [ebp - 8], eax
jmp 0xf736eb4
mov dword [ebp - 8], eax
jmp 0xf736ecc
Function at 0xf7394c8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 4]
push 0x1e
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 1
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0xf73954d
push 0x10
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.MSVCRT20.dll_strtoul]
add esp, 0xc
cmp word [ebp + 0xc], ax
jne 0xf739535
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x2e
jne 0xf739535
push 0x10
inc eax
push 0
push eax
call dword [sym.imp.MSVCRT20.dll_strtoul]
add esp, 0xc
cmp word [ebp + 0x10], ax
ja 0xf74cb3b
mov eax, dword [ebp - 0x10]
push 0x1e
lea ecx, [ebp - 0x34]
inc dword [ebp - 0x10]
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0xf7394fb
cmp dword [ebp - 0x14], 0
jne 0xf7394da
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x34]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0xf74cb5c
mov dword [ebp - 4], ebx
test eax, eax
jne 0xf739535
mov ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push 0xf7b3424
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0xf74cb7c
mov dword [ebp - 8], ebx
test eax, eax
jne 0xf74cbc6
push str.win32
push dword [ebp - 8]
call fcn.0f736e1c
push pe_nt_image_headers32
lea eax, [ebp - 0xb4]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push dword [ebp - 8]
sub eax, 0x103
cmp eax, 1
sbb edi, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg edi
test edi, edi
je 0xf74cbc6
push 0xf7b3424
push dword [ebp - 4]
call fcn.0f736e1c
xor ebx, ebx
test edi, edi
je 0xf74cc20
push pe_nt_image_headers32
lea eax, [ebp - 0xb4]
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
je 0xf74cc20
test eax, eax
jne 0xf74cc19
push str.HelpDir
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0xf74cc1b
push str.Flags
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0xf74cc1b
xor edi, edi
inc ebx
test edi, edi
jne 0xf74cbcc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0xf739535
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.0f736e1c
test eax, eax
jne 0xf739535
mov dword [ebp - 0x14], 1
jmp 0xf739535