joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b878
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x440e10]
je 0x41b893
inc edi
cmp edi, 0x17
jb 0x41b884
cmp edi, 0x17
jae 0x41ba13
push ebp
push 3
call fcn.00427998
cmp eax, 1
pop ecx
je 0x41b9df
push 3
call fcn.00427998
test eax, eax
pop ecx
jne 0x41b8c7
cmp dword [0x440260], 1
je 0x41b9df
cmp ebx, 0xfc
je 0x41ba12
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x442990
push ebp
call fcn.004111fa
add esp, 0xc
test eax, eax
je 0x41b8fd
push esi
push esi
push esi
push esi
push esi
call fcn.00413f3b
add esp, 0x14
push 0x104
mov esi, 0x4429a9
push esi
push 0
mov byte [0x442aad], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41b941
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004111fa
add esp, 0xc
test eax, eax
je 0x41b941
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00413f3b
add esp, 0x14
push esi
call fcn.00416630
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41b986
push esi
call fcn.00416630
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x442ca4
push 0x43b0b4
sub ecx, eax
push ecx
push eax
call fcn.0041f614
add esp, 0x14
test eax, eax
je 0x41b986
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00413f3b
add esp, 0x14
jmp 0x41b988
xor esi, esi
push 0x43b0b0
push ebx
push ebp
call fcn.00411ae8
add esp, 0xc
test eax, eax
je 0x41b9a8
push esi
push esi
push esi
push esi
push esi
call fcn.00413f3b
add esp, 0x14
push dword [edi*8 + 0x440e14]
push ebx
push ebp
call fcn.00411ae8
add esp, 0xc
test eax, eax
je 0x41b9ca
push esi
push esi
push esi
push esi
push esi
call fcn.00413f3b
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004277db
add esp, 0xc
jmp 0x41ba12
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x41ba12
cmp ebp, 0xffffffff
je 0x41ba12
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x440e14]
push dword [esi]
call fcn.00416630
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41ead0
Capabilities:
Enumerate pe sections

Disassembly:
dec esp
and al, 8
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x41eb0a
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x41eaf1
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x41eb02
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x41eb0c
inc edi
add eax, 0x28
cmp edi, esi
jb 0x41eae7
xor eax, eax
pop edi
pop esi
ret
Function at 0x41eddc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.0041ea54
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0041ea8f
xchg ecx, eax
test eax, 0x458d2cad
call 0x512a4b85
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0041ea9f
push eax
push esi
push dword [ebp + 8]
call fcn.0041ea54
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0041ea9f
push eax
push esi
push dword [ebp + 8]
call fcn.0041ea54
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041ea9f
push eax
push esi
push dword [ebp + 8]
call fcn.0041ea54
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041ea8f
jmp 0x887a7e55

Function at 0x41f2f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0041ea9f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041ea54
add esp, 0xc
mov dword [ebp - 0x68c], eax
invalid
xchg ebp, eax
je 0x41f346
Function at 0x4277db
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00416072
xor ebx, ebx
cmp dword [0x442e00], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4278b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x427991
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x427991
push eax
call fcn.00416004
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x442e00], eax
call esi
push eax
call fcn.00416004
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x442e04], eax
call esi
push eax
call fcn.00416004
mov dword [0x442e08], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041b4e3
test eax, eax
pop ecx
pop ecx
je 0x42787f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00413f3b
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4278b1
push 0x43c30c
push edi
call esi
push eax
call fcn.00416004
cmp eax, ebx
pop ecx
mov dword [0x442e10], eax
je 0x4278b1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00416004
pop ecx
mov dword [0x442e0c], eax
mov eax, dword [0x442e0c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x427936
cmp dword [0x442e10], ecx
je 0x427936
push eax
call fcn.0041607b
push dword [0x442e10]
mov esi, eax
call fcn.0041607b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x427936
cmp edi, ebx
je 0x427936
call esi
cmp eax, ebx
je 0x427903
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x427903
test byte [ebp - 0x18], 1
jne 0x427936
lea eax, [ebp - 0x10]
push eax
call fcn.0041b592
test eax, eax
pop ecx
je 0x42791e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00413f3b
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x42792d
or dword [ebp + 0x10], 0x200000
jmp 0x427971
or dword [ebp + 0x10], 0x40000
jmp 0x427971
mov eax, dword [0x442e04]
cmp eax, dword [ebp - 8]
je 0x427971
push eax
call fcn.0041607b
cmp eax, ebx
pop ecx
je 0x427971
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x427971
mov eax, dword [0x442e08]
cmp eax, dword [ebp - 8]
je 0x427971
push eax
call fcn.0041607b
cmp eax, ebx
pop ecx
je 0x427971
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x442e00]
call fcn.0041607b
cmp eax, ebx
pop ecx
je 0x427991
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x427993
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011c5
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c10c1]
push ebx
push esi
push edi
mov esi, ecx
push 0x8000
push esi
mov edi, edx
mov byte [ebp - 1], al
call fcn.00422b03
pop ecx
push eax
call fcn.00422935
pop ecx
pop ecx
push 0xb
mov ecx, edi
mov ebx, eax
call fcn.00402042
test al, al
jne 0x4746f4
lea ecx, [ebp - 0x18]
call fcn.004029cf
mov ecx, edi
call fcn.0040a59a
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.0040128f
push dword [ebp - 0x18]
push 0x4aec44
push esi
call fcn.00422cfc
add esp, 0xc
cmp byte [ebp - 1], 0
mov dword [ebp - 8], eax
jne 0x474714
lea ecx, [ebp - 0x18]
call fcn.0040126c
mov edi, dword [ebp - 8]
push esi
call fcn.00422ec1
pop ecx
cmp ebx, 0xffffffff
je 0x47472b
push ebx
push esi
call fcn.00422b03
pop ecx
push eax
call fcn.00422935
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
push esi
mov ecx, edi
call fcn.0044b476
push eax
push 1
call fcn.0044b433
push eax
call fcn.00422c7e
add esp, 0x10
mov edi, eax
jmp 0x401245
mov ecx, edi
call fcn.0040a59a
mov eax, dword [edi + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40123a
push 0x4000
jmp 0x401256
Function at 0x4024f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
xor edx, edx
xor ebx, ebx
push esi
inc ebx
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], edx
cmp dword [eax + 4], edx
je 0x473e6a
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov dword [edi], edx
mov byte [ecx], dl
mov byte [eax], dl
mov dword [ebp - 0xc], 0x2b
mov dword [ebp - 8], 0x23
mov edi, edx
push edi
mov ecx, esi
call fcn.00402609
movzx eax, word [eax]
push 0x2b
pop ecx
push 0x5e
cmp ax, cx
pop ecx
push 0x21
pop edx
je 0x473e71
cmp ax, cx
je 0x473e71
cmp ax, dx
je 0x473e71
cmp ax, word [ebp - 8]
je 0x473e71
push edi
inc edi
mov ecx, esi
mov dword [ebp + 0x1c], edi
call fcn.00402609
movzx eax, word [eax]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, 0x7b
jne 0x473eec
push 0x40
lea ecx, [ebp - 0x20]
call fcn.0040626b
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x7d
call fcn.004024a4
test al, al
je 0x402605
push dword [ebp - 0x20]
push dword [esi*4 + 0x4bb5d0]
call fcn.00421177
pop ecx
pop ecx
test eax, eax
je 0x4025d3
inc esi
cmp esi, 0x62
jl 0x4025b8
cmp esi, 0x62
je 0x473ea3
cmp byte [esi + 0x4bb568], 0
jne 0x402605
movzx eax, byte [esi + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [edi], eax
lea ecx, [ebp - 0x20]
call fcn.0040126c
and dword [edi], 0xff
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x18
xor bl, bl
jmp 0x4025ee
lea ecx, [ebp - 0x20]
call fcn.0040126c
xor al, al
jmp 0x4025fe
cmp ax, word [ebp - 0xc]
jne 0x473e7c
mov eax, dword [ebp + 0x10]
jmp 0x473e9b
cmp ax, cx
jne 0x473e86
mov eax, dword [ebp + 0x14]
jmp 0x473e9b
cmp ax, dx
jne 0x473e90
mov eax, dword [ebp + 0x18]
jmp 0x473e9b
push 0x23
pop ecx
cmp ax, cx
jne 0x473e9d
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
inc edi
jmp 0x402540
push 0
lea ecx, [ebp - 0x20]
call fcn.00405445
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x473e62
test eax, 0x200
je 0x473ecb
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x473ed7
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x4025ee
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x4025ee
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x473e6a
test eax, 0x200
je 0x473f0b
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x473f17
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x4025f6
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x4025f6
Function at 0x4033c4
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
mov edi, ecx
push 5
pop eax
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
push ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x403d28
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20030
call fcn.0042fa80
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040dc00
lea eax, [ebp - 0x1002c]
push eax
xor ebx, ebx
push 0x7fff
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 7]
push eax
push dword [ebp + 8]
call fcn.00405dc2
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x472136
xor edi, edi
inc edi
mov esi, 0x4c2100
cmp dword [0x4c1130], edi
je 0x47214e
lea eax, [ebp - 6]
push eax
push ecx
push 0x4c1130
push 0x4c1148
mov ecx, esi
call fcn.00404344
test al, al
je 0x403e63
mov al, byte [0x4c2100]
mov byte [0x4c1134], al
mov al, byte [0x4c2101]
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2002c]
push eax
push 0x7fff
push dword [0x4c1148]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [ebp - 0xc]
mov ecx, 0x4c1120
call fcn.00404f02
mov bl, byte [ebp - 6]
push dword [0x4c1130]
push 0x4c1148
call fcn.00404e20
test eax, eax
jne 0x47216d
cmp byte [ebp - 5], 1
je 0x47218c
call fcn.00403b40
call fcn.00403e6b
cmp byte [0x4c1134], 0
mov ebx, 0x4c1708
jne 0x403e25
mov ecx, ebx
call fcn.004041c1
push edi
mov ecx, 0x4c1160
call fcn.0040edf0
cmp byte [0x4c1134], 0
jne 0x403e40
mov ecx, ebx
call fcn.00403fe1
mov ecx, esi
call fcn.00404112
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x2c]
call fcn.0040126c
pop edi
pop esi
pop ebx
leave
ret 4
mov dword [0x4c10bc], edi
jmp 0x403e47
push 0x10
push str.AutoIt
push str.It_is_a_violation_of_the_AutoIt_EULA_to_attempt_to_reverse_engineer_this_program.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403e54
push 0xffffffffffffffff
push dword [0x4c1138]
mov ecx, esi
push edi
call fcn.004078eb
mov al, byte [0x4c10c2]
mov byte [0x4c2102], al
jmp 0x403de4
mov ecx, esi
call fcn.00404112
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4c10bc], edi
jmp 0x403e54
call fcn.004470eb
test al, al
jne 0x403e06
cmp byte [ebp - 7], al
jne 0x403e06
lea ecx, [ebp - 0x2c]
call fcn.0040451e
push 0x49dab4
lea ecx, [ebp - 0x1c]
call fcn.0040cf2d
lea ecx, [ebp - 0x1c]
test bl, bl
je 0x4721e3
mov edi, 0x4b2924
push edi
call fcn.004055cc
push 0x4c1148
lea ecx, [ebp - 0x1c]
call fcn.00404cce
push edi
lea ecx, [ebp - 0x1c]
call fcn.004055cc
push 1
jmp 0x4721ec
push dword [ebp + 8]
call fcn.004055cc
push edi
lea eax, [ebp - 0x1002c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
push 0x4b2928
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.0040126c
jmp 0x403e40
Function at 0x404398
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
push ebx
call fcn.0040d90b
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47466a
xor al, al
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push str.Include
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4746e4
mov eax, dword [ebp - 4]
push esi
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041f6ba
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00402626
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push str.Include
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4746db
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 4], eax
mov word [esi + eax*2], cx
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00404f02
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.00406724
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x4043ca
Function at 0x4055a2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x47541e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004239ee
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
mov edx, dword [ecx]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x4055c8
Function at 0x40ca00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x40ca74
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, ebx
je 0x40ca37
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x40ca47
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0xc]
inc edi
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
mov byte [edi + ecx - 1], al
inc dword [esi + 0xc]
cmp edi, ebx
jb 0x40ca17
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop esi
pop ebx
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
push eax
push 0x10000
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40ca37
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40ca37
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x40ca1f
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.00406797
jmp 0x40ca0e
Function at 0x41b67f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
mov esi, dword [edi]
push eax
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
mov dword [edi + 0x16c], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x170], eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp ecx, dword [edi + 0x174]
jne 0x41b724
cmp eax, dword [edi + 0x178]
jne 0x41b724
push dword [ebx + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
push dword [ebx + 0x1c]
movzx eax, ax
shr eax, 0xf
mov dword [ebp + 8], eax
call esi
movzx esi, ax
mov eax, dword [ebp + 8]
shr esi, 0xf
cmp eax, dword [edi + 0x17c]
jne 0x47e969
cmp dword [ebp + 0xc], 0
je 0x41b705
mov dword [edi + 0x17c], eax
cmp esi, dword [edi + 0x180]
jne 0x47e9d5
cmp dword [ebp + 0xc], 0
je 0x41b71d
mov dword [edi + 0x180], esi
pop edi
pop esi
pop ebx
leave
ret 8
cmp dword [ebp + 0xc], 1
mov dword [edi + 0x174], ecx
mov dword [edi + 0x178], eax
jl 0x41b6cb
jmp 0x47e958
push eax
push ecx
push edi
push 0xfffffffffffffff5
mov ecx, ebx
call fcn.00468d62
jmp 0x41b6cb
cmp dword [ebp + 0xc], 1
jl 0x41b6f9
cmp byte [edi + 0x1a8], 0
je 0x41b6f9
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test eax, eax
je 0x47e991
push 0xfffffffffffffff9
jmp 0x47e9c1
push 0xfffffffffffffff8
call fcn.00468d62
cmp byte [edi + 0x184], 0
je 0x47e9c6
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test eax, 0x1000000
je 0x47e9bf
push 0xfffffffffffffffa
jmp 0x47e9c1
push 0xfffffffffffffff4
call fcn.00468d62
mov eax, dword [ebp + 8]
mov byte [edi + 0x184], 0
jmp 0x41b6f9
cmp dword [ebp + 0xc], 1
jl 0x41b711
push dword [ebp - 4]
mov ecx, ebx
push dword [ebp - 8]
push edi
test esi, esi
je 0x47e9f0
push 0xfffffffffffffff7
jmp 0x47e9f2
push 0xfffffffffffffff6
call fcn.00468d62
jmp 0x41b711

Function at 0x41db84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x41dc01
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41dc01
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41dc01
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41dbe8
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x41dbf8
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x41dbe6
xor al, al
jmp 0x41dbf4
Function at 0x41ecab
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push edi
mov edi, 0x4c1628
jne 0x47e604
mov ecx, dword [0x4c1694]
cmp ecx, 0xffffffff
je 0x41ed51
mov eax, dword [0x4c1688]
push ebx
mov eax, dword [eax + ecx*4]
push esi
mov esi, dword [eax]
xor ecx, ecx
mov ebx, dword [esi]
cmp byte [esi + 0x3a], cl
je 0x41ecfd
mov byte [esi + 0x3a], cl
cmp dword [esi + 0x18c], ecx
jge 0x47e61b
cmp dword [esi + 0x1a4], ecx
jne 0x47e642
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x47e669
je 0x41ed25
test edi, edi
je 0x41ed72
cmp edi, 1
je 0x41ed25
cmp edi, 2
je 0x41ed69
cmp edi, 3
je 0x41ed60
jle 0x41ed47
cmp edi, 5
jg 0x41ed55
cmp byte [esi + 0x38], 0
jne 0x41ed80
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 8
je 0x41ed43
cmp edi, 4
je 0x41ed43
push ebx
call fcn.0041ed84
mov byte [esi + 0x38], 1
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 8
xor eax, eax
jmp 0x41ed4c
cmp edi, 6
je 0x47e651
jmp 0x41ed47
mov byte [esi + 0x38], 1
jmp 0x47e6be
mov byte [esi + 0x38], 1
jmp 0x47e651
push ecx
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x38], 0
jmp 0x41ed47
xor eax, eax
jmp 0x41ed4a
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0041bf13
mov ecx, eax
mov dword [0x4c1694], ecx
jmp 0x41ecc4
cmp byte [esi + 0x198], cl
je 0x41ecf1
push dword [esi + 0x194]
mov ecx, edi
push esi
call fcn.0046e29b
xor ecx, ecx
mov byte [esi + 0x198], cl
jmp 0x41ecf1
push dword [esi]
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor ecx, ecx
jmp 0x41ecfd
cmp byte [esi + 0x38], 0
je 0x41ed80
push 6
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41ed47
mov eax, edi
sub eax, 9
je 0x47e6be
sub eax, 0x37
je 0x47e6b0
dec eax
je 0x47e6ad
dec eax
je 0x47e69d
dec eax
jne 0x41ed47
push ecx
mov byte [esi + 0x39], cl
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push 1
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x41ed47
push ebx
mov byte [esi + 0x39], 1
call dword [sym.imp.USER32.dll_LockWindowUpdate]
jmp 0x41ed47
push ecx
jmp 0x47e6b2
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x41ed47
cmp byte [esi + 0x38], 0
je 0x41ed80
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call fcn.0041ed84
jmp 0x41ed47