joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438ea8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x49cb60]
cmp dword [eax + 0x30], 0
je 0x438f52
cmp dword [ebx + 0x94], 0
jne 0x438f4c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x438e38
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x438f4c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x438f12
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x438f4c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041594c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x438f21
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x439a30
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x439a65
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404f8c
jmp 0x439a72
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404ef0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x43a8fc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x43a93d
mov eax, esi
call fcn.0044e594
test al, al
je 0x43a93d
mov eax, dword [ebx + 0x84]
call fcn.0044e290
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43a93d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044e290
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x43d574
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404e9c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43d5c3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00405104
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44575c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x49cbd8], 0
je 0x4458ab
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x49b3f8]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x4458ab
mov eax, dword [0x49cbdc]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x49cbd8]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44587a
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x49cbd8]
call fcn.0041594c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x445872
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x445872
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x445872
mov eax, dword [ebp - 0x14]
call fcn.0044e290
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x445872
push ebp
call fcn.00445718
pop ecx
test al, al
jne 0x445872
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x44582e
mov eax, dword [ebp - 0x14]
call fcn.0044cdec
dec eax
jle 0x445872
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.0040430c
cmp byte [ebp - 1], 0
je 0x445872
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x445872
mov edx, dword [ebp - 0x14]
mov eax, dword [0x49cbdc]
call fcn.00444ee0
inc edi
dec ebx
jne 0x4457c1
mov eax, dword [0x49cbdc]
cmp dword [eax + 8], 0
jle 0x445892
mov eax, dword [0x49cbdc]
call fcn.00444f70
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4458ab
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00445580
pop ecx
test al, al
jne 0x4458ab
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448e58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x448ea4
mov eax, esi
call fcn.00431304
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x448ea4
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x448ea4
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x448fe8
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x448ee4
cmp eax, 0x108
ja 0x448ee4
mov eax, esi
call fcn.00431304
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x448fdf
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x448fe8
jmp 0x448fdf
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x448fc6
cmp eax, 0x20a
ja 0x448fc6
test byte [esi + 0x50], 0x80
jne 0x448f16
sub eax, 0x203
je 0x448f13
sub eax, 3
je 0x448f13
sub eax, 3
jne 0x448f16
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x448f2a
dec eax
je 0x448f3f
dec eax
je 0x448f5f
dec eax
je 0x448f3f
jmp 0x448f66
mov ecx, ebx
mov eax, dword [0x49b3f8]
mov eax, dword [eax]
mov edx, esi
call fcn.0043a7b4
jmp 0x448fdf
cmp byte [esi + 0x5d], 1
jne 0x448f55
mov eax, esi
mov si, 0xffed
call fcn.0040430c
jmp 0x448fe8
or word [esi + 0x54], 1
jmp 0x448fdf
and word [esi + 0x54], 0xfffe
jmp 0x448fdf
mov eax, dword [0x49cb94]
cmp byte [eax + 0x20], 0
je 0x448fdf
mov eax, dword [0x49cb94]
cmp dword [eax + 0x1c], 0
je 0x448fdf
mov eax, dword [ebx]
mov edx, dword [0x49cb94]
cmp eax, dword [edx + 0x1c]
jne 0x448fdf
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00431248
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.0040430c
jmp 0x448fe8
mov eax, dword [ebx]
cmp eax, 0xb00b
jne 0x448fdf
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00447794
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c488
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x44c4a4
cmp dword [esi + 4], 0
je 0x44c4d1
test byte [ebx + 0x55], 1
jne 0x44c4c3
mov eax, ebx
call fcn.0044b0e0
test eax, eax
jne 0x44c4c3
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x44c5e1
mov edx, esi
mov eax, ebx
call fcn.0044bfa8
jmp 0x44c5e1
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44c5da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0044e290
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00448d8c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0044c488
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0044e290
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c5e1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452ab8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x49b5b4]
cmp byte [eax + 0xc], 0
je 0x452c25
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452c1e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49cbe8], 0
jne 0x452b0c
push 0x452c2c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x452c34
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cbe8], eax
cmp dword [0x498bc0], 0
jne 0x452c07
push 0x452c44
call sub.kernel32.dll_LoadLibraryA
mov dword [0x498bc0], eax
cmp dword [0x498bc0], 0
je 0x452c07
push 0x452c50
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cbec], eax
push 0x452c60
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cbf0], eax
push 0x452c74
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cbf4], eax
push 0x452c8c
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cbf8], eax
push 0x452ca4
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cbfc], eax
push 0x452cb8
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cc00], eax
push 0x452cd0
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cc04], eax
push 0x452ce8
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cc08], eax
push 0x452d04
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cc0c], eax
push 0x452d10
mov eax, dword [0x498bc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cc10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452c25
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x453818
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040533c
xor eax, eax
push ebp
push 0x453946
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x453919
xor eax, eax
push ebp
push 0x453912
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405154
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4538e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4538d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405154
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0040534c
mov edx, ebx
pop ecx
call fcn.00402ad8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4538dd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x49b1a4]
mov dl, 1
mov eax, dword [0x408498]
call fcn.0040b550
call fcn.004048dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45394d
lea eax, [ebp - 4]
call fcn.00404e9c
ret
Function at 0x453954
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x453b05
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0040553c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x453b1c
call fcn.004051a0
mov eax, ebx
call fcn.0041d870
mov edi, eax
dec edi
test edi, edi
jl 0x453a0c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041d844
mov edx, dword [0x42a694]
call fcn.0040429c
test al, al
je 0x453a08
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041d844
lea edx, [ebp - 0x14]
call fcn.00447be4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0040553c
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405214
inc esi
dec edi
jne 0x4539ba
mov al, byte [0x453b20]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x453b2c
mov eax, dword [ebp - 0xc]
call fcn.0040c59c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404f34
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00447be4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x453b1c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.00447be4
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x453b1c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x453b1c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x453b38
call fcn.0040a1c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453b0c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404ec0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404ec0
lea eax, [ebp - 0x14]
call fcn.00404e9c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404ec0
ret
Function at 0x454574
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040533c
xor eax, eax
push ebp
push 0x45469e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.00454510
mov esi, eax
test esi, esi
jle 0x454680
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004053ac
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040534c
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x454680
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405154
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.004053ac
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040534c
mov edi, eax
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x454677
mov eax, dword [ebp - 0x18]
call fcn.00402790
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x454670
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x454667
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x454677
mov eax, esi
call fcn.004027b0
jmp 0x454677
mov eax, esi
call fcn.004027b0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4546a5
lea eax, [ebp - 0xc]
call fcn.00404e9c
lea eax, [ebp - 4]
call fcn.00404e9c
ret
Function at 0x4548f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov word [ebp - 4], cx
mov word [ebp - 2], dx
mov ebx, eax
cmp word [ebp - 4], 0x10
jne 0x454935
movzx eax, word [ebp - 2]
shr eax, 1
mov word [ebp - 2], ax
movzx esi, word [ebp - 2]
dec esi
test esi, esi
jl 0x454935
inc esi
xor eax, eax
mov edx, eax
add edx, edx
mov dl, byte [ebx + edx + 1]
xor dl, 0x80
mov byte [ebx + eax], dl
inc eax
dec esi
jne 0x454923
movzx eax, word [ebp - 2]
cmp word [ebp - 2], 0x3e8
jb 0x454a62
xor edx, edx
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, 0xc8
mov dword [ebp - 0x14], 0x50
mov dword [ebp - 0x18], 0x32
cmp word [ebp + 8], 0x2b11
je 0x45497c
shl eax, 2
mov ecx, dword [ebp - 0x14]
shl ecx, 2
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x18]
shl ecx, 2
mov dword [ebp - 0x18], ecx
mov esi, dword [ebp - 0x14]
add esi, eax
add esi, dword [ebp - 0x18]
sub esi, eax
jl 0x454998
inc esi
cmp dl, byte [ebx + eax]
jae 0x454994
mov dl, byte [ebx + eax]
mov dword [ebp - 0x10], eax
inc eax
dec esi
jne 0x454989
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x454a15
xor edx, edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 8]
add esi, dword [ebp - 0x18]
sub esi, eax
jl 0x4549cb
inc esi
cmp dl, byte [ebx + eax]
jae 0x4549c7
mov dl, byte [ebx + eax]
mov dword [ebp - 0x10], eax
inc eax
dec esi
jne 0x4549bc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
mov esi, eax
add esi, dword [ebp - 0x18]
sub esi, eax
jl 0x4549f2
inc esi
cmp dl, byte [ebx + eax]
jae 0x4549ee
mov dl, byte [ebx + eax]
mov dword [ebp - 0x10], eax
inc eax
dec esi
jne 0x4549e3
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 8]
inc esi
mov eax, dword [ebp - 0xc]
lea edx, [ebx + eax]
mov eax, dword [ebp - 8]
lea eax, [ebx + eax]
mov ecx, esi
call fcn.00402ad8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
add dword [ebp - 0xc], esi
movzx eax, word [ebp - 2]
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
add edx, edx
sub eax, edx
cmp eax, dword [ebp - 8]
jg 0x4549a6
jmp 0x454a40
mov eax, dword [ebp - 8]
mov al, byte [ebx + eax]
mov edx, dword [ebp - 0xc]
mov byte [ebx + edx], al
inc dword [ebp - 0xc]
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebx + eax]
sub eax, 0x80
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x14
jle 0x454a5f
movzx eax, word [ebp - 2]
cmp eax, dword [ebp - 8]
jg 0x454a2e
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45e5bc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x40d53c]
call fcn.004058ac
xor eax, eax
push ebp
push 0x45e700
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x499830], 0
jne 0x45e60f
mov ecx, dword [0x49b14c]
mov dl, 1
mov eax, dword [0x408498]
call fcn.0040b550
call fcn.004048dc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040350c
mov eax, ebx
call fcn.0040571c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45e710
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406d08
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0040572c
test eax, eax
jle 0x45e6a7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45e6a0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040511c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00405104
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004092e0
test eax, eax
jne 0x45e6a0
mov ebx, 0x15
jmp 0x45e6ac
mov ebx, 0x10
jmp 0x45e6ac
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x499830]
call fcn.0045e514
mov eax, dword [ebp - 8]
call fcn.0045e514
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406d20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e707
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404ec0
lea eax, [ebp - 0x10]
mov edx, dword [0x40d53c]
call fcn.0040597c
ret
Function at 0x46cc68
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test edi, edi
je 0x46cccd
mov eax, dword [0x51e200]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x46cccd
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
je 0x46ccc4
push ebx
call sub.kernel32.dll_GlobalLock
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00409a54
mov esi, eax
inc esi
cmp edi, esi
jge 0x46ccab
mov esi, edi
mov edx, ebp
mov eax, dword [esp]
mov ecx, esi
call fcn.00402ad8
mov byte [ebp + esi - 1], 0
push ebx
call sub.kernel32.dll_GlobalUnlock
jmp 0x46ccc8
mov byte [ebp], 0
call sub.user32.dll_CloseClipboard
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46cf38
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x51e378], 0
je 0x46cf5c
mov edx, eax
sub dl, 0x20
je 0x46cfd3
add dl, 0xdf
sub dl, 0x1a
jb 0x46cfd3
add dl, 0xfa
sub dl, 0x1a
jb 0x46cfd3
cmp dword [0x499f8c], 0x40
jge 0x46cfd3
mov edx, eax
cmp dl, 8
jne 0x46cf94
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46cf86
mov eax, dword [0x499f8c]
mov byte [eax + 0x51e334], 0x7f
jmp 0x46cfcd
mov eax, dword [0x499f8c]
mov byte [eax + 0x51e334], 8
jmp 0x46cfcd
cmp dl, 0xd
jne 0x46cfc1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46cfb3
mov eax, dword [0x499f8c]
mov byte [eax + 0x51e334], 0xa
jmp 0x46cfcd
mov eax, dword [0x499f8c]
mov byte [eax + 0x51e334], 0xd
jmp 0x46cfcd
mov edx, dword [0x499f8c]
mov byte [edx + 0x51e334], al
inc dword [0x499f8c]
ret