joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e03
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.01043686
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x408e2f
call fcn.00408d15
mov esi, eax
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x40aee8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
xor ebx, ebx
lea ecx, [ebp - 4]
push 0x2002
mov dword [ebp - 4], ebx
call fcn.0040d996
test al, al
je 0x40af41
push esi
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40af40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0103fb00
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x40af40
mov dword [ebp - 4], ebx
mov bl, 1
pop esi
lea ecx, [ebp - 4]
call fcn.0040d9b9
mov al, bl
pop ebx
leave
ret 0xc

Function at 0x40af50
Capabilities:
Open clipboard

Disassembly:
push 0x18
mov eax, 0x1065992
call fcn.00fee6ba
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
mov byte [ebp + 0xb], al
test al, al
je 0x40b011
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40b00e
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
lea eax, [eax*2 + 2]
push eax
push dword [esi]
push 0xd
call fcn.0040aee8
push 0
mov bl, al
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0040a4c9
mov ecx, dword [ebp - 0x14]
xor eax, eax
inc eax
inc ecx
push ecx
push dword [ebp - 0x18]
mov byte [ebp - 4], al
push eax
call fcn.0040aee8
push 1
pop edi
push edi
test al, al
movzx ebx, bl
push esi
lea eax, [ebp - 0x24]
cmovne ebx, edi
push eax
call fcn.0040a4c9
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00409521
push dword [ebp - 0x24]
call fcn.00fee675
mov eax, dword [ebp - 0x14]
pop ecx
inc eax
push eax
push dword [ebp - 0x18]
push 7
call fcn.0040aee8
push dword [ebp - 0x18]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.00fee675
pop ecx
jmp 0x40b017
mov al, byte [ebp + 0xb]
xor bl, bl
test al, al
je 0x40b01d
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
call fcn.00fee688
ret 8
Function at 0x40bbe5
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x1065a8a
call fcn.00fee6ba
cmp byte [0x10bd4d4], 0
mov edi, dword [ebp + 8]
jne 0x40bc21
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.0040a299
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.00fee675
pop ecx
test esi, esi
jmp 0x40bc2d
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bc33
mov al, 1
jmp 0x40bc79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40bc44
xor al, al
jmp 0x40bc79
lea ecx, [ebp - 0x50]
call fcn.0040c07e
lea ecx, [ebp - 0x28]
call fcn.004094fd
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040c2e8
test al, al
je 0x40bc6e
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.00fee675
pop ecx
mov al, bl
call fcn.00fee688
ret 4

Function at 0x40bc81
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10bd4d4], 0
jne 0x40bcb7
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00fee675
pop ecx
test esi, esi
pop esi
jmp 0x40bcc4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40bcca
mov al, 1
jmp 0x40bccc
xor al, al
leave
ret 4

Function at 0x40bcd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040c91e
cmp eax, 0xffffffff
je 0x40bcfd
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x40bcfd
and eax, 0xfffffffe
push eax
push esi
call fcn.0040bf9e
test al, al
je 0x40bd35
cmp byte [0x10bd4d4], 0
push esi
jne 0x40bd27
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00fee675
pop ecx
test esi, esi
jmp 0x40bd2f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40bd35
mov al, 1
jmp 0x40bd37
xor al, al
pop esi
leave
ret 4

Function at 0x40bef3
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10bd4d4], 0
jne 0x40bf27
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00fee675
pop ecx
test esi, esi
pop esi
jmp 0x40bf32
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40bf38
mov al, 1
jmp 0x40bf3a
xor al, al
leave
ret 4
Function at 0x40bf9e
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10bd4d4], 0
jne 0x40bfd5
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00fee675
pop ecx
test esi, esi
pop esi
jmp 0x40bfe3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40bfe9
mov al, 1
jmp 0x40bfeb
xor al, al
leave
ret 8

Function at 0x40c91e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10bd4d4], 0
jne 0x40c952
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040a299
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00fee675
pop ecx
mov eax, esi
pop esi
jmp 0x40c965
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret 4
Function at 0x40c9f0
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0x1065bac
call fcn.00fee6ba
mov ecx, dword [ebp + 8]
call fcn.00408f10
cmp byte [0x10bd4d4], 0
jne 0x40cadd
mov ecx, dword [ebp + 8]
call fcn.00408f10
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x40caf0
push edi
call fcn.00fee66c
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x40cb92
cmp edi, dword [ebp - 0x18]
ja 0x40cb92
lea ecx, [ebp - 0x2c]
call fcn.0040933c
mov byte [ebp - 4], 1
test edi, edi
je 0x40cad3
xor eax, eax
mov dword [ebp - 0x14], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x10], eax
cmp byte [esi + eax - 1], 0
jne 0x40cac4
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00409571
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040a257
mov edi, eax
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00408f92
mov ecx, dword [ebp + 8]
push edi
call fcn.00408ecc
push dword [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00fee675
pop ecx
mov ecx, dword [ebp - 0x14]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
jne 0x40ca78
mov edi, dword [ebp - 0x1c]
push dword [ebp - 0x2c]
cmp ebx, edi
jmp 0x40cb89
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x40caf7
xor al, al
jmp 0x40cb9b
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040c013
mov esi, dword [ebp - 0x1c]
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x40cb92
cmp edi, dword [ebp - 0x18]
ja 0x40cb92
lea ecx, [ebp - 0x38]
call fcn.004094fd
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x18], edx
mov eax, ebx
mov dword [ebp - 0x10], eax
test edi, edi
je 0x40cb84
push 2
pop ecx
mov dword [ebp - 0x14], ecx
cmp word [esi + ecx - 2], bx
jne 0x40cb73
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x38]
call fcn.004096a8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
inc eax
mov dword [ebp - 0x18], eax
call fcn.00408f92
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
call fcn.00408ecc
mov ecx, dword [ebp - 0x14]
mov edx, ecx
mov eax, dword [ebp - 0x10]
inc eax
add ecx, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, edi
jb 0x40cb3d
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x38]
cmp edx, edi
sete bl
call fcn.00fee675
pop ecx
push esi
call fcn.00fee675
mov al, bl
pop ecx
call fcn.00fee688
ret 4
Function at 0x40cd7f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40cda9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40cda9
xor al, al
jmp 0x40cdbd
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x4171b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x4171c1
mov dword [esi], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x417207
push edi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], edi
test esi, esi
je 0x4171fc
add dword [esi], edx
test eax, eax
jne 0x417207
call fcn.0040cd5f
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x41e0a3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1066269
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10b906c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00421936
lea ecx, [esi + 0x30]
call fcn.0041e046
push dword [esi + 0x24]
call fcn.00fee675
pop ecx
lea ecx, [esi + 0xc]
call fcn.00408e58
mov ecx, esi
call fcn.0041df5a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret

Function at 0x4223ad
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x10b906c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov edx, 0x4011
test al, al
mov ecx, 0x4110
lea eax, [ebp - 0x164]
cmovne ecx, edx
push ecx
push 0x160
push eax
push 0x90
push 0x106a8e4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00fee415
leave
ret 4
Function at 0x422ad0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
mov edx, ecx
cmp edx, 8
je 0x422b15
cmp edx, 0x52
je 0x422b04
cmp ecx, 0x76
jne 0x422b11
mov ecx, esi
call fcn.0042254b
jmp 0x422b1c
test al, al
je 0x422b11
mov ecx, esi
call fcn.00423455
jmp 0x422b1c
xor al, al
jmp 0x422b1e
mov ecx, esi
call fcn.00422d9a
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x424840
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x10]
push eax
push 0x64
push 0x66
call fcn.00424939
lea eax, [edi + 0x38]
mov ecx, edi
push eax
push 0x65
push 0x67
call fcn.00424939
mov ecx, edi
call fcn.0040b3cf
cmp byte [edi + 9], 0
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
jne 0x4248a7
push 0x1b8
push dword [edi + 4]
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1b9
push dword [edi + 4]
call ebx
push 0
push eax
call esi
push 0xdb1
push dword [edi + 4]
call ebx
push 0
push eax
call esi
cmp byte [edi + 0xa], 0
je 0x4248d2
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 7
push 0x401
push dword [edi + 4]
call esi
push 7
push dword [edi + 4]
call ebx
push 1
push eax
push 0x28
push dword [edi + 4]
call esi
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x424939
Capabilities:
Get file system object information

Disassembly:
push 0x1d4
mov eax, 0x106788e
call fcn.00fee6ed
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d4]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1a4], eax
call fcn.004094fd
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x4249be
push dword [edi + 0xc]
lea eax, [ebp - 0x1e0]
push dword [edi + 8]
push eax
call fcn.004247c7
push eax
push 0xdb0
lea eax, [ebp - 0x1b0]
mov byte [ebp - 4], 1
push eax
call fcn.00424788
push eax
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 2
call fcn.004095c8
push dword [ebp - 0x1b0]
call fcn.00fee675
push dword [ebp - 0x1e0]
mov byte [ebp - 4], 0
call fcn.00fee675
pop ecx
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1a0], eax
call fcn.00409fcf
mov esi, eax
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x1c8]
call fcn.004093a4
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x1bc]
add eax, 2
mov byte [ebp - 4], 3
lea eax, [eax + esi*2]
push eax
call fcn.004094c7
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.004248d8
lea eax, [ebp - 0x1bc]
mov ecx, ebx
push eax
call fcn.004248d8
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00409429
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.00409867
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040979a
lea ecx, [ebp - 0x19c]
call fcn.00409867
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040979a
lea ecx, [ebp - 0x19c]
call fcn.00409867
cmp byte [edi + 1], 0
je 0x424abc
push 0x3f4
lea eax, [ebp - 0x19c]
push eax
call fcn.004238cc
push 0x106bc94
lea ecx, [ebp - 0x19c]
call fcn.004097d8
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0040dde1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.004097d8
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
push dword [ebp - 0x19c]
push eax
call fcn.0040e812
push 0
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x1b0]
push eax
call fcn.0040a4c9
push 0x110
push 0x160
lea eax, [ebp - 0x190]
push eax
push 0x80
push dword [ebp - 0x1b0]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1b0]
mov esi, eax
call fcn.00fee675
pop ecx
test esi, esi
je 0x424b3d
push dword [ebp - 0x1a4]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.00fee675
push dword [ebp - 0x1bc]
call fcn.00fee675
push dword [ebp - 0x1c8]
call fcn.00fee675
push dword [ebp - 0x1d4]
call fcn.00fee675
add esp, 0x10
call fcn.00fee69c
ret 0xc
Function at 0x4259ab
Capabilities:
Hide graphical window

Disassembly:
push 0x44
mov eax, 0x1067b29
call fcn.00fee6ba
mov ebx, ecx
push 0
call fcn.0042663e
push 1
mov ecx, ebx
call fcn.00426b29
push 0x198
lea eax, [ebp - 0x20]
push eax
call fcn.0040dea1
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x20]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 2
push dword [ebx + 4]
call edi
push esi
push eax
call fcn.0040e812
push dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
call fcn.00fee675
pop ecx
push 1
push 1
push 0xf4
push 2
push dword [ebx + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x1bc
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1be
push dword [ebx + 4]
call edi
push 0
push eax
call esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
lea ecx, [ebp - 0x50]
call fcn.00424e2d
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 1
call fcn.00424e2d
lea esi, [ebx + 0x214]
mov dword [ebp - 4], 2
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x1dc]
lea edi, [ebx + 0x1e4]
push edi
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], eax
call fcn.00425067
lea eax, [edi + 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.00425067
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x40], 0
je 0x425af3
cmp dword [ebp - 0x4c], 0
mov byte [ebx + 0x233], 1
jne 0x425ac2
push 0x106bd6c
lea ecx, [ebp - 0x50]
call fcn.0040962f
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x425b29
cmp byte [ebx + 0x156], 0
jne 0x425b29
mov ecx, ebx
mov byte [ebx + 0x155], 1
call fcn.004269b5
jmp 0x425b32
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x425ada
mov byte [ebx + 0x233], 1
cmp dword [ebp - 0x28], eax
je 0x425b29
cmp dword [ebp - 0x34], eax
jne 0x425b18
push 0x106bd6c
lea ecx, [ebp - 0x38]
call fcn.0040962f
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
mov ecx, ebx
call fcn.004221a2
lea ecx, [ebp - 0x50]
call fcn.00425003
mov al, 1
call fcn.00fee688
ret
Function at 0x425e8f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov eax, dword [edx]
lea esi, [edi + 0xb4]
cmp eax, dword [esi]
jne 0x425ec2
cmp dword [edx + 8], 0xffffff65
jne 0x425ec2
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x425ee4
sub eax, 0x14
je 0x425eca
dec eax
sub eax, 1
je 0x425ee4
xor al, al
pop edi
pop esi
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x425ec2
mov ecx, esi
call fcn.00426485
mov al, 1
jmp 0x425ec4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x425ec2
mov ecx, edi
call fcn.00425358
jmp 0x425ee0

Function at 0x42773f
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x10b906c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10bd4d4], 0
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
jne 0x4277ac
push esi
push edx
lea eax, [ebp - 0x2c4]
push eax
call fcn.0040a299
push 0x4010
push 0x160
lea ecx, [ebp - 0x164]
push ecx
mov ecx, dword [ebp + 0xc]
or ecx, 0x80
push ecx
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x2c4]
mov esi, eax
call fcn.00fee675
pop ecx
mov ecx, dword [ebp - 0x160]
mov eax, esi
pop esi
jmp 0x4277d9
mov eax, dword [0x10bd4d0]
test eax, eax
je 0x4277d3
push 0x4010
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
mov ecx, dword [ebp + 0xc]
or ecx, 0x80
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x2b4]
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00fee415
leave
ret 0xc
Function at 0x4289f0
Capabilities:
Check if file exists
Create thread
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.00feee20
mov eax, dword [0x10b906c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1804]
push 0x1800
push 0
push eax
call fcn.0103f9a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x428a35
test al, 0x10
je 0x428ab8
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1804]
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x428a40
lea ecx, [ebp - 0x1004]
sub ecx, esi
nop dword [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x428a60
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x804]
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x428a80
push 0
push 0
lea eax, [ebp - 0x1804]
push eax
push 0x428ad0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
je 0x428ab8
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00fee415
mov esp, ebp
pop ebp
ret

Function at 0x428c20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10b906c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x428c8b
push 0
lea eax, [ebp - 8]
push eax
push edi
push esi
call fcn.00428800
add esp, 0x10
test al, al
je 0x428c8b
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp + 0x1c]
push 0
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00fee415
mov esp, ebp
pop ebp
ret
Function at 0x428ca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10b906c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [str.SoftwareClasses]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov ax, word [0x106c24c]
push edi
mov edi, dword [ebp + 0x20]
mov word [ebp - 8], ax
or edi, 0x2001f
lea eax, [ebp - 0x30]
push eax
push edi
push 0
lea eax, [ebp - 0x28]
push eax
movzx eax, byte [ebp + 8]
movups xmmword [ebp - 0x28], xmm0
sub eax, 0x7fffffff
movups xmm0, xmmword [0x106c23c]
push eax
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428d56
push esi
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
push edi
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x428d55
push dword [ebp + 0x20]
lea eax, [ebp - 0x2c]
push eax
push ebx
push esi
call fcn.00428800
add esp, 0x10
test al, al
je 0x428d55
push dword [ebp + 0x18]
push dword [ebp - 0x34]
push dword [ebp + 0x1c]
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00fee415
mov esp, ebp
pop ebp
ret
Function at 0x531140
Capabilities:
Access peb ldr_data
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1068370
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10b906c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
push 0
push 0x106a8e4
mov dword [ebp - 4], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.00532660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret