joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ff740
Capabilities:
Check os version

Disassembly:
mov edx, dword [0x7f8da8]
sub esp, 0x23c
test edx, edx
push esi
push edi
jne 0x5ff786
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, eax
test edx, edx
mov dword [0x7f8da8], edx
jne 0x5ff786
push eax
push 0x773f2c
push 0x773f1c
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
add esp, 0x23c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x46
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0x11c
push str.RtlGetVersion
rep stosd dword es:[edi], eax
push edx
call esi
test eax, eax
je 0x5ff7c9
lea ecx, [esp + 8]
push ecx
call eax
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov al, byte [esp + 0x122]
jmp 0x5ff843
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x128]
lea edx, [esp + 0x128]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x12c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x5ff77b
mov eax, dword [0x7f8da8]
push str.RtlGetNtVersionNumbers
push eax
call esi
lea ecx, [esp + 0x134]
lea edx, [esp + 0x130]
push ecx
lea ecx, [esp + 0x130]
push edx
push ecx
call eax
mov al, byte [esp + 0x24e]
mov esi, dword [esp + 0x138]
mov ecx, dword [esp + 0x13c]
mov edi, dword [esp + 0x140]
add esp, 0xc
mov byte [esp + 0x122], al
mov edx, dword [esp + 0x248]
test edx, edx
je 0x5ff866
mov dword [edx + 8], edi
mov edi, dword [esp + 0x122]
and edi, 0xff
mov dword [edx], esi
mov dword [edx + 4], ecx
mov dword [edx + 0xc], edi
cmp esi, 5
jne 0x5ff8de
test ecx, ecx
jne 0x5ff87d
pop edi
mov eax, 0x14
pop esi
add esp, 0x23c
ret
cmp ecx, 1
jne 0x5ff890
pop edi
mov eax, 0x13
pop esi
add esp, 0x23c
ret
cmp ecx, 2
jne 0x5ff77b
cmp al, 1
jne 0x5ff8ab
pop edi
mov eax, 0x12
pop esi
add esp, 0x23c
ret
cmp word [esp + 0x120], 0x8000
jne 0x5ff8c5
pop edi
mov eax, 0xf
pop esi
add esp, 0x23c
ret
xor eax, eax
pop edi
cmp word [esp + 0x118], ax
pop esi
setne al
add eax, 0x10
add esp, 0x23c
ret
cmp esi, 6
jne 0x5ff945
test ecx, ecx
jne 0x5ff8f9
dec al
pop edi
neg al
sbb eax, eax
pop esi
add eax, 0xd
add esp, 0x23c
ret
cmp ecx, 1
jne 0x5ff910
dec al
pop edi
neg al
sbb eax, eax
pop esi
add eax, 0xb
add esp, 0x23c
ret
cmp ecx, 2
jne 0x5ff927
dec al
pop edi
neg al
sbb eax, eax
pop esi
add eax, 9
add esp, 0x23c
ret
cmp ecx, 3
jne 0x5ff77b
xor edx, edx
cmp al, 1
setne dl
add edx, 6
pop edi
mov eax, edx
pop esi
add esp, 0x23c
ret
cmp esi, 0xa
jne 0x5ff77b
test ecx, ecx
jne 0x5ff77b
dec al
pop edi
neg al
sbb eax, eax
pop esi
and al, 0xfe
add eax, 5
add esp, 0x23c
ret

Function at 0x601740
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [ecx]
test eax, eax
jne 0x60174b
pop ecx
ret 8
mov edx, dword [esp + 0xc]
lea ecx, [esp]
push 0
push ecx
mov ecx, dword [esp + 0x10]
push edx
push ecx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
ret 8
Function at 0x601a00
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov word [ebp], di
je 0x601b5c
mov esi, dword [esp + 0x1c]
cmp esi, edi
je 0x601b5c
push 0xf0000000
push 1
push edi
lea eax, [esp + 0x28]
push edi
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x601b33
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edi
push edi
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x601b33
mov eax, dword [esp + 0x20]
push edi
push esi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x601b33
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea ecx, [esp + 0x18]
push edi
push ecx
push edi
push 2
push edx
mov dword [esp + 0x2c], 4
call esi
test eax, eax
je 0x601b33
mov eax, dword [esp + 0x18]
push eax
call fcn.00643667
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x601b33
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push edi
push ecx
push ebx
push 2
push edx
call esi
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x601b2a
mov eax, dword [esp + 0x18]
cmp eax, 0x10
jb 0x601afa
mov eax, ebx
mov ecx, ebp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
jmp 0x601b26
mov ecx, eax
mov esi, ebx
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x10
lea edi, [ebp + eax*2]
sub ecx, eax
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor edi, edi
mov word [ebp + 0x20], di
push ebx
call fcn.0064357e
add esp, 4
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x601b42
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x601b52
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x601b70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
test eax, eax
je 0x601b97
cmp word [eax], 0x5a4d
jne 0x601b97
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x601b97
test word [eax + 4], 0x14c
jne 0x601b9f
xor eax, eax
add esp, 0xc
ret 8
mov edx, dword [eax + 0x54]
mov cx, word [eax + 6]
push ebx
mov dword [esp + 4], edx
push ebp
xor edx, edx
mov dx, word [eax + 0x14]
push esi
mov esi, dword [eax + 0x50]
push edi
mov edi, dword [esp + 0x24]
mov word [esp + 0x14], cx
lea ecx, [edx + eax + 0x18]
mov eax, dword [edi]
mov dword [esp + 0x18], ecx
test eax, eax
jne 0x601be8
cmp esi, dword [0x6f657c]
jne 0x601bd8
xor esi, esi
push 0
push esi
mov ecx, edi
call fcn.005ff2f0
mov edx, dword [edi]
mov dword [edx], esi
jmp 0x601c26
mov ebx, dword [eax]
mov eax, dword [eax + 0xc]
cmp eax, esi
jae 0x601c02
lea eax, [eax + esi + 0x1000]
push 0
push eax
mov ecx, edi
call fcn.005ff2f0
mov ecx, dword [edi]
cmp esi, ebx
mov dword [ecx], esi
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov eax, dword [eax]
mov byte [edx + eax], 0
ja 0x601c26
jae 0x601c26
mov ecx, dword [edi]
inc esi
cmp esi, ebx
mov edx, dword [ecx + 8]
mov byte [edx + esi - 1], 0
jb 0x601c17
mov edi, dword [edi]
test edi, edi
je 0x601c31
mov ebp, dword [edi + 8]
jmp 0x601c33
xor ebp, ebp
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x24], ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
test cx, cx
jbe 0x601cb4
mov ebx, dword [esp + 0x18]
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x14]
add ebx, 0x10
and ecx, 0xffff
mov dword [esp + 0x10], ecx
mov edi, dword [eax]
test edi, edi
je 0x601ca0
mov ecx, dword [ebx]
test ecx, ecx
je 0x601ca0
mov esi, dword [edx]
add edi, ebp
add esi, dword [esp + 0x20]
mov ebp, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, dword [esp + 0x24]
and ecx, 3
add ebx, 0x28
add edx, 0x28
add eax, 0x28
rep movsb byte es:[edi], byte [esi]
jmp 0x601ca9
add ebx, 0x28
add edx, 0x28
add eax, 0x28
mov ecx, dword [esp + 0x10]
dec ecx
mov dword [esp + 0x10], ecx
jne 0x601c6f
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x609390
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
lea eax, [esp]
push esi
push eax
push 1
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
mov esi, 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x609403
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.WheelScrollLines
push ecx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6093f8
push 0xa
lea edx, [esp + 0x14]
push eax
push edx
call fcn.00644e30
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x8c
ret
Function at 0x61ae10
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x669246
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x7a87d4]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
lea ecx, [esp + 8]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xac], ebx
call fcn.006574b2
cmp dword [0x7d2e38], ebx
je 0x61ae80
lea ecx, [esp + 8]
mov dword [esp + 0xa8], 0xffffffff
call fcn.0065503e
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
add esp, 0xa4
ret
mov edx, dword [0x7a87d4]
push ebp
push edi
mov edi, 1
mov dword [0x7d2e38], edi
mov dword [esp + 0x40], edx
cmp esi, ebx
mov byte [esp + 0xb0], 1
jne 0x61aea9
mov dword [esp + 0x20], ebx
jmp 0x61aeb0
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, esi
call fcn.00659616
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x88]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0xffffff96
mov dword [esp + 0x38], 5
mov dword [esp + 0x34], edx
call fcn.0065512b
mov eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0x94]
mov edx, dword [esi + 0x1c]
cmp eax, ebx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x1c], edx
jne 0x61af0e
mov dword [esp + 0x14], ebx
jmp 0x61af15
mov ebp, dword [eax + 0x1c]
mov dword [esp + 0x14], ebp
cmp ecx, 0xd
jne 0x61af2f
mov eax, dword [eax + 0x3c8]
cmp eax, edi
je 0x61af29
cmp eax, 2
jne 0x61af2f
mov dword [esp + 0x18], edi
jmp 0x61af33
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x61af41
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00656ae7
mov edi, eax
cmp edi, ebx
jne 0x61af51
xor eax, eax
jmp 0x61af54
mov eax, dword [edi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x61af7c
mov ecx, esi
call fcn.00659616
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x4e
push edx
call ebp
mov esi, dword [esp + 0x1c]
push esi
call ebx
test eax, eax
je 0x61af94
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x18]
mov dword [0x7d2e38], 0
test eax, eax
je 0x61afbd
mov esi, dword [esp + 0x14]
push esi
call ebx
test eax, eax
je 0x61afbd
push 1
push 0xd
push 0x100
push esi
call ebp
lea ecx, [esp + 0x40]
mov byte [esp + 0xb0], 0
call fcn.0065503e
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0xffffffff
call fcn.0065503e
mov ecx, dword [esp + 0xa8]
pop edi
pop ebp
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x61ceb0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x669438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0065bd04
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov ecx, esi
mov dword [esp + 0x44], 0
call fcn.0061cdf0
mov ecx, dword [esi + 0x174]
mov eax, dword [esi + 0x178]
add ecx, 0x64
add eax, 0x64
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0065bc32
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x61cf77
cmp dword [esp + 0x40], 1
jne 0x61cf75
cmp ecx, eax
jge 0x61cf77
mov eax, ecx
cmp eax, 0x12c
jge 0x61cf83
mov eax, 0x12c
mov ecx, esi
mov dword [esi + 0x194], eax
mov dword [esi + 0x1dc], 1
call fcn.0061cfd0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0065bd76
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x621250
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x669926
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x7a87d4]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xb0], ebx
call fcn.006574b2
mov edx, dword [0x7a87d4]
mov dword [esp + 0x3c], edx
cmp esi, ebx
mov byte [esp + 0xac], 1
jne 0x6212aa
mov dword [esp + 0x1c], ebx
jmp 0x6212b1
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x1c], eax
push edi
mov ecx, esi
call fcn.00659616
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x40]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov edi, 1
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0xffffff96
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edx
call fcn.0065512b
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x1c]
cmp eax, ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x1c], ecx
jne 0x621302
mov dword [esp + 0x14], ebx
jmp 0x621309
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x14], edx
cmp dword [esi + 0x44], 0xd
jne 0x621324
mov eax, dword [eax + 0x3c8]
cmp eax, edi
je 0x62131e
cmp eax, 2
jne 0x621324
mov dword [esp + 0x18], edi
jmp 0x621328
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x621336
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00656ae7
mov edi, eax
cmp edi, ebx
jne 0x621346
xor eax, eax
jmp 0x621349
mov eax, dword [edi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x621371
mov ecx, esi
call fcn.00659616
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x4e
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebx
test eax, eax
pop edi
je 0x62138d
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6213ac
mov esi, dword [esp + 0x10]
push esi
call ebx
test eax, eax
je 0x6213ac
push 1
push 0xd
push 0x100
push esi
call ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0xac], 0
call fcn.0065503e
lea ecx, [esp + 0xc]
mov dword [esp + 0xac], 0xffffffff
call fcn.0065503e
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x62fc20
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
call fcn.006360a0
mov ebp, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push ebp
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
cmp edi, 0x20
ja 0x62fd19
lea ecx, [esp + 0x10]
push ecx
push str..htm
push closesocket
mov ecx, esi
call fcn.0062fd30
test eax, eax
jne 0x62fd19
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push closesocket
mov ecx, esi
call fcn.0062fd30
test eax, eax
jne 0x62fd19
lea edx, [esp + 0x10]
push 0x777f48
push edx
call fcn.00643c90
mov esi, eax
add esp, 8
test esi, esi
jne 0x62fcea
lea eax, [esp + 0x10]
push 0x777f44
push eax
call fcn.00643c90
mov esi, eax
add esp, 8
test esi, esi
jne 0x62fcea
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x62fced
mov byte [esi], 0
push 0x77770c
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x62fd30
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x62fd92
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x635fe0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x66a818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x636090
mov eax, dword [0x7a87d4]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.00655422
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.00655471
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.006553ce
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x636077
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x636077
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0065503e
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x639190
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x66aca0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x639337
mov ecx, dword [0x7a87d4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x63928c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00637eb0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0065512b
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0065503e
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x77770c
call fcn.006550ac
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.00638270
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.0065512b
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0065503e
lea ecx, [esp + 0xc]
call fcn.0065552d
mov ecx, dword [esp + 0xc]
push 0x77814c
push ecx
call fcn.00642b44
add esp, 8
test eax, eax
je 0x6392b4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x6391ed
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0065503e
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0065503e
jmp 0x63933b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00638f30
test eax, eax
push 0
je 0x63931f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.006375d0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x639305
cmp eax, 0x64
jg 0x6392f3
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x639290
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x639290
cmp eax, 0x64
jge 0x63928c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x639290
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.006375d0
mov esi, eax
jmp 0x639290
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x639345
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x6574b2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6574ea
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00655499
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00655471
jmp 0x6574f6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x658d2a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x658d6c
call fcn.0065f6cd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x658d6c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x658d63
xor eax, eax
jmp 0x658d74
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00658d7a
pop edi
pop esi
pop ebx
ret 4

Function at 0x65fbfd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x65fc2b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x65fc49
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0065fb63
jmp 0x65fc49
mov eax, dword [esi + 0x14]
test eax, eax
je 0x65fc49
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0065fb63
test edi, edi
mov eax, edi
jne 0x65fc33
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x6624a6
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x6624ce
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x6624df
push 2
call edi
test ax, ax
jge 0x6624df
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00656ae7
cmp dword [esi + 0x30], ebx
jne 0x6625b9
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.00656ae7
cmp eax, dword [esp + 0x34]
jne 0x6625b9
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x662555
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x66259a
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x6625b9
cmp eax, 0x205
je 0x6625b9
cmp eax, 0x201
je 0x6625b9
cmp eax, 0x204
je 0x6625b9
cmp eax, ebx
jne 0x662580
cmp dword [esp + 0x1c], 0x1b
je 0x6625b9
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x7f85c8]
jbe 0x6625af
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x662512
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4