joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003518a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100351d4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1003517b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1003518a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043ae2d
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100351db
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001c051
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1003527a
add edi, 4
add eax, 2
dec ecx
jne 0x100351c0
call 0x10035227
loope 0x1003521d
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10035277
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10035288
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1003523b
cmp eax, ecx
ja 0x1003523b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100352c5
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100352bb
lea edi, [ebp - 0x100]
push pe_nt_image_headers32
push edi
push esi
call fcn.1001c530
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4022f2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
xor edx, edx
xor ebx, ebx
push esi
inc ebx
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], edx
cmp dword [eax + 4], edx
je 0x474fa9
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov dword [edi], edx
mov byte [ecx], dl
mov byte [eax], dl
mov dword [ebp - 0xc], 0x2b
mov dword [ebp - 8], 0x23
mov edi, edx
push edi
mov ecx, esi
call fcn.00402407
movzx eax, word [eax]
push 0x2b
pop ecx
push 0x5e
cmp ax, cx
pop ecx
push 0x21
pop edx
je 0x474fb0
cmp ax, cx
je 0x474fb0
cmp ax, dx
je 0x474fb0
cmp ax, word [ebp - 8]
je 0x474fb0
push edi
inc edi
mov ecx, esi
mov dword [ebp + 0x1c], edi
call fcn.00402407
movzx eax, word [eax]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, 0x7b
jne 0x47502b
push 0x40
lea ecx, [ebp - 0x20]
call fcn.00404191
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x7d
call fcn.0040229c
test al, al
je 0x402403
push dword [ebp - 0x20]
push dword [esi*4 + 0x4bc5d0]
call fcn.00422687
pop ecx
pop ecx
test eax, eax
je 0x4023d1
inc esi
cmp esi, 0x62
jl 0x4023b6
cmp esi, 0x62
je 0x474fe2
cmp byte [esi + 0x4bc568], 0
jne 0x402403
movzx eax, byte [esi + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [edi], eax
lea ecx, [ebp - 0x20]
call fcn.00406e3b
and dword [edi], 0xff
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x18
xor bl, bl
jmp 0x4023ec
lea ecx, [ebp - 0x20]
call fcn.00406e3b
xor al, al
jmp 0x4023fc
cmp ax, word [ebp - 0xc]
jne 0x474fbb
mov eax, dword [ebp + 0x10]
jmp 0x474fda
cmp ax, cx
jne 0x474fc5
mov eax, dword [ebp + 0x14]
jmp 0x474fda
cmp ax, dx
jne 0x474fcf
mov eax, dword [ebp + 0x18]
jmp 0x474fda
push 0x23
pop ecx
cmp ax, cx
jne 0x474fdc
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
inc edi
jmp 0x40233e
push 0
lea ecx, [ebp - 0x20]
call fcn.00406c5e
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x474fa1
test eax, 0x200
je 0x47500a
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x475016
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x4023ec
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x4023ec
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x474fa9
test eax, 0x200
je 0x47504a
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x475056
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x4023f4
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x4023f4
Function at 0x40245d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x475771
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x475789
or eax, eax
jmp 0x40247c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
jmp 0x40247c

Function at 0x402dfd
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
mov edi, ecx
push 5
pop eax
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
push ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x417e17
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
mov esi, dword [edi]
push eax
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
mov dword [edi + 0x16c], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x170], eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp ecx, dword [edi + 0x174]
jne 0x417ebc
cmp eax, dword [edi + 0x178]
jne 0x417ebc
push dword [ebx + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
push dword [ebx + 0x1c]
movzx eax, ax
shr eax, 0xf
mov dword [ebp + 8], eax
call esi
movzx esi, ax
mov eax, dword [ebp + 8]
shr esi, 0xf
cmp eax, dword [edi + 0x17c]
jne 0x47fcb7
cmp dword [ebp + 0xc], 0
je 0x417e9d
mov dword [edi + 0x17c], eax
cmp esi, dword [edi + 0x180]
jne 0x47fd23
cmp dword [ebp + 0xc], 0
je 0x417eb5
mov dword [edi + 0x180], esi
pop edi
pop esi
pop ebx
leave
ret 8
cmp dword [ebp + 0xc], 1
mov dword [edi + 0x174], ecx
mov dword [edi + 0x178], eax
jl 0x417e63
jmp 0x47fca6
push eax
push ecx
push edi
push 0xfffffffffffffff5
mov ecx, ebx
call fcn.004699ae
jmp 0x417e63
cmp dword [ebp + 0xc], 1
jl 0x417e91
cmp byte [edi + 0x1a8], 0
je 0x417e91
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test eax, eax
je 0x47fcdf
push 0xfffffffffffffff9
jmp 0x47fd0f
push 0xfffffffffffffff8
call fcn.004699ae
cmp byte [edi + 0x184], 0
je 0x47fd14
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test eax, 0x1000000
je 0x47fd0d
push 0xfffffffffffffffa
jmp 0x47fd0f
push 0xfffffffffffffff4
call fcn.004699ae
mov eax, dword [ebp + 8]
mov byte [edi + 0x184], 0
jmp 0x417e91
cmp dword [ebp + 0xc], 1
jl 0x417ea9
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test esi, esi
je 0x47fd3e
push 0xfffffffffffffff7
jmp 0x47fd40
push 0xfffffffffffffff6
call fcn.004699ae
jmp 0x417ea9
Function at 0x418cf6
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c20c1]
push ebx
push esi
push edi
mov esi, ecx
push 0x8000
push esi
mov edi, edx
mov byte [ebp - 1], al
call fcn.00424073
pop ecx
push eax
call fcn.00423ea5
pop ecx
pop ecx
push 0xb
mov ecx, edi
mov ebx, eax
call fcn.00409726
test al, al
jne 0x475895
lea ecx, [ebp - 0x18]
call fcn.00406dce
mov ecx, edi
call fcn.00404c31
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.00418d9d
push dword [ebp - 0x18]
push 0x4afc3c
push esi
call fcn.0042426c
add esp, 0xc
cmp byte [ebp - 1], 0
mov dword [ebp - 8], eax
jne 0x4758b5
lea ecx, [ebp - 0x18]
call fcn.00406e3b
mov edi, dword [ebp - 8]
push esi
call fcn.00424431
pop ecx
cmp ebx, 0xffffffff
je 0x4758cc
push ebx
push esi
call fcn.00424073
pop ecx
push eax
call fcn.00423ea5
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
push esi
mov ecx, edi
call fcn.0044ca50
push eax
push 1
call fcn.0044ca07
push eax
call fcn.004241ee
add esp, 0x10
mov edi, eax
jmp 0x418d76
mov ecx, edi
call fcn.00404c31
mov eax, dword [edi + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x418d6b
push 0x4000
jmp 0x418d87
Function at 0x419c5f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x419c97
push edi
push 0
push 0x4afecc
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x4764e7
pop edi
pop esi
pop ebx
leave
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x419c96
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x419c96
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x419c96
mov ecx, dword [ebx]
push 0
mov edx, dword [ecx]
push edi
push eax
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
mov ecx, dword [eax]
push edx
push edx
push edx
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0x419c96
Function at 0x419fc2
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
push eax
xor bl, bl
push 0x104
mov byte [ebp - 5], bl
xor bh, bh
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 6]
push eax
push dword [ebp + 8]
call fcn.0041a643
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x472ea3
mov eax, dword [0x4c2124]
test eax, eax
je 0x41a0e1
xor edi, edi
inc edi
mov esi, 0x4c32e8
cmp eax, edi
je 0x472ebc
lea eax, [ebp - 5]
push eax
push ecx
push 0x4c2124
push 0x4c213c
mov ecx, esi
call fcn.00403c06
test al, al
je 0x41a0ea
mov al, byte [0x4c32e8]
mov bh, byte [0x4c32e9]
push 0x4c2120
mov byte [0x4c2128], al
lea eax, [ebp - 0x43c]
push eax
push 0x104
push 0x4c213c
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov bl, byte [ebp - 5]
push dword [0x4c2124]
push 0x4c213c
call fcn.00403f54
test eax, eax
jne 0x472edb
cmp bh, 1
je 0x472efa
call fcn.004195ec
call fcn.004197fd
cmp byte [0x4c2128], 0
mov ebx, 0x4c28f0
jne 0x41a0ab
mov ecx, ebx
call fcn.00419a05
push edi
mov ecx, 0x4c2348
call fcn.0040aaa0
cmp byte [0x4c2128], 0
jne 0x41a0c6
mov ecx, ebx
call fcn.00419bfb
mov ecx, esi
call fcn.00419e46
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
leave
ret 4
or dword [0x4c20bc], 0xffffffff
jmp 0x41a0cd
mov dword [0x4c20bc], edi
jmp 0x41a0cd
push 0x10
push 0x4b393c
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41a0da
push 0xffffffffffffffff
push dword [0x4c212c]
mov ecx, esi
push edi
call fcn.00443992
mov al, byte [0x4c20c2]
mov byte [0x4c32ea], al
jmp 0x41a06b
mov ecx, esi
call fcn.00419e46
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4c20bc], edi
jmp 0x41a0da
call fcn.00448601
test al, al
jne 0x41a08c
cmp byte [ebp - 6], al
jne 0x41a08c
push 0x104
lea eax, [ebp - 0x43c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x49eaa4
lea ecx, [ebp - 0x18]
call fcn.00408f82
lea ecx, [ebp - 0x18]
test bl, bl
je 0x472f5d
mov edi, 0x4b39a8
push edi
call fcn.00403e34
push 0x4c213c
lea ecx, [ebp - 0x18]
call fcn.00403e34
push edi
lea ecx, [ebp - 0x18]
call fcn.00403e34
push 1
jmp 0x472f66
push dword [ebp + 8]
call fcn.00403e34
push edi
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x43c]
push eax
push 0x4b39ac
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.00406e3b
jmp 0x41a0c6
Function at 0x41a3fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x476591
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00424f5e
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
mov edx, dword [ecx]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x41a423

Function at 0x41b070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x41b0e4
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, ebx
je 0x41b0a7
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x41b0b7
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0xc]
inc edi
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
mov byte [edi + ecx - 1], al
inc dword [esi + 0xc]
cmp edi, ebx
jb 0x41b087
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop esi
pop ebx
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
push eax
push 0x10000
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b0a7
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41b0a7
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x41b08f
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0041b153
jmp 0x41b07e
Function at 0x41f33f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x41f3bc
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41f3bc
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f3bc
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f3a3
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x41f3b3
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x41f3a1
xor al, al
jmp 0x41f3af

Function at 0x41fa58
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
push ebx
call fcn.00408a3d
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47580b
xor al, al
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push 0x49ec40
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x475885
mov eax, dword [ebp - 4]
push esi
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420bca
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00402424
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push 0x49ec40
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47587c
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 4], eax
mov word [esi + eax*2], cx
mov ecx, dword [ebp + 0xc]
push esi
call fcn.004045de
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.004025e3
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x41fa8a
Function at 0x420188
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push edi
mov edi, 0x4c2810
jne 0x47f92f
mov ecx, dword [0x4c287c]
cmp ecx, 0xffffffff
je 0x42022e
mov eax, dword [0x4c2870]
push ebx
mov eax, dword [eax + ecx*4]
push esi
mov esi, dword [eax]
xor ecx, ecx
mov ebx, dword [esi]
cmp byte [esi + 0x3a], cl
je 0x4201da
mov byte [esi + 0x3a], cl
cmp dword [esi + 0x18c], ecx
jge 0x47f946
cmp dword [esi + 0x1a4], ecx
jne 0x47f96d
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x47f994
je 0x420202
test edi, edi
je 0x42024f
cmp edi, 1
je 0x420202
cmp edi, 2
je 0x420246
cmp edi, 3
je 0x42023d
jle 0x420224
cmp edi, 5
jg 0x420232
cmp byte [esi + 0x38], 0
jne 0x42025d
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 8
je 0x420220
cmp edi, 4
je 0x420220
push ebx
call fcn.00420261
mov byte [esi + 0x38], 1
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 8
xor eax, eax
jmp 0x420229
cmp edi, 6
je 0x47f97c
jmp 0x420224
mov byte [esi + 0x38], 1
jmp 0x47f9e9
mov byte [esi + 0x38], 1
jmp 0x47f97c
push ecx
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x38], 0
jmp 0x420224
xor eax, eax
jmp 0x420227
push dword [ebp + 0xc]
mov ecx, edi
call fcn.004187bf
mov ecx, eax
mov dword [0x4c287c], ecx
jmp 0x4201a1
cmp byte [esi + 0x198], cl
je 0x4201ce
push dword [esi + 0x194]
mov ecx, edi
push esi
call fcn.0046eeed
xor ecx, ecx
mov byte [esi + 0x198], cl
jmp 0x4201ce
push dword [esi]
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor ecx, ecx
jmp 0x4201da
cmp byte [esi + 0x38], 0
je 0x42025d
push 6
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x420224
mov eax, edi
sub eax, 9
je 0x47f9e9
sub eax, 0x37
je 0x47f9db
dec eax
je 0x47f9d8
dec eax
je 0x47f9c8
dec eax
jne 0x420224
push ecx
mov byte [esi + 0x39], cl
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push 1
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x420224
push ebx
mov byte [esi + 0x39], 1
call dword [sym.imp.USER32.dll_LockWindowUpdate]
jmp 0x420224
push ecx
jmp 0x47f9dd
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x420224
cmp byte [esi + 0x38], 0
je 0x42025d
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call fcn.00420261
jmp 0x420224
Function at 0x420261
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [ebp + 8]
mov esi, eax
cmp ebx, esi
jne 0x47506b
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 4
push edi
xor edi, edi
test esi, esi
jne 0x475080
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x475094
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x47516f
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp + 8], eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
push 1
push edi
push dword [ebp + 8]
call esi
push 1
push dword [ebp - 4]
push edi
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x47514b
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 8]
test eax, eax
je 0x475150
push 4
jmp 0x47514d
push 3
pop ebx
jmp 0x475153
mov ebx, dword [ebp - 0xc]
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call esi
push 0
push edi
push dword [ebp + 8]
call esi
push 0
push dword [ebp - 4]
push edi
call esi
jmp 0x475172
push 2
pop ebx
mov eax, ebx
pop edi
jmp 0x42027f
Function at 0x435180
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bbdc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [section..data]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0042964c
mov dword [ebp - 0x14], eax
cmp dword [0x4c2048], edi
jne 0x435271
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4351fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x435351
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x435351
push 0x49ca50
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435351
push eax
call ebx
push 0x49ca5c
push esi
mov dword [0x4c2048], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4c204c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4c2050], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c2058], eax
test eax, eax
je 0x43526e
push 0x49ca9c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c2054], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x435296
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x435289
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4352ab
push 4
pop eax
jmp 0x435353
cmp dword [ebp - 0x14], edi
je 0x4352ab
push dword [0x4c2048]
call dword [0x4bb004]
push 3
jmp 0x435290
mov eax, dword [0x4c2054]
mov ebx, dword [0x4bb004]
cmp eax, esi
je 0x435309
cmp dword [0x4c2058], esi
je 0x435309
push eax
call ebx
push dword [0x4c2058]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x435309
test eax, eax
je 0x435309
call ecx
test eax, eax
je 0x4352fe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4352fe
test byte [ebp - 8], 1
jne 0x435309
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x435339
mov eax, dword [0x4c204c]
cmp eax, esi
je 0x435336
push eax
call ebx
test eax, eax
je 0x435336
call eax
mov edi, eax
test edi, edi
je 0x435336
mov eax, dword [0x4c2050]
cmp eax, esi
je 0x435336
push eax
call ebx
test eax, eax
je 0x435336
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4c2048]
call ebx
test eax, eax
je 0x435351
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x435353
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bf6f
leave
ret