joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b7a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c5e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
lea eax, [ebp - 0x10]
push edi
push eax
push ebx
lea ecx, [esi + 0x1f0]
mov dword [ebp - 0x18], edi
call fcn.004d2e80
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push edi
push ecx
mov eax, dword [edx + 8]
lea ecx, [esi + 0x20c]
push eax
call fcn.004d2e80
jmp 0x42b7f6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x59a500]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x1770
jbe 0x42b824
push 1
push 0x587890
mov ecx, 0x599b30
mov dword [0x59a500], eax
call fcn.0045d320
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push edx
push eax
push ebx
lea ecx, [ebp - 0x204]
call fcn.0040fe70
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
add ecx, 0x14
push ecx
mov ecx, esi
call fcn.00410820
mov dword [ebp - 0x180], eax
call 0x42b854
add dword [esp], 6
ret
Function at 0x441bb0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x53ec66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x184
mov eax, dword [esp + 0x198]
push ebx
push ebp
push esi
mov esi, ecx
push edi
test eax, eax
mov dword [esp + 0x14], esi
mov eax, 0x588d04
je 0x441bea
mov eax, 0x588cfc
mov edi, dword [esp + 0x1a4]
push eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00519c4f
mov eax, dword [eax]
lea ecx, [esp + 0x54]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00519a06
mov ebp, dword [esi + 0x134]
cmp ebx, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x441ccb
mov ebp, dword [esp + 0x1ac]
add esi, 0x12c
push 0x57347c
lea edx, [esp + 0x20]
push edi
push edx
call fcn.00519c4f
lea ecx, [esp + 0x80]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov dword [esp + 0x1a8], 0
call fcn.00519c4f
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x1a4], 1
call fcn.00518881
lea ecx, [esp + 0x10]
mov byte [esp + 0x19c], 0
call fcn.00519a06
lea ecx, [esp + 0x1c]
mov dword [esp + 0x19c], 0xffffffff
call fcn.00519a06
test ebp, ebp
je 0x441ca8
mov dword [ebp], 1
lea eax, [esp + 0x54]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x441c36
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp dword [esp + 0x1a8], 2
je 0x441d04
mov ecx, dword [esi + 0x134]
lea edx, [esp + 0x20]
sub ecx, ebp
push ecx
push 0x574800
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esi + 0x12c]
push 1
push eax
push ebp
call fcn.00518923
mov ecx, dword [esp + 0x194]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x190
ret 0xc

Function at 0x442e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53edd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x596a5c]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea edi, [esi + 0x23c]
push eax
lea ecx, [esi + 0x240]
push edi
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esi + 0x230]
push eax
push ecx
push edx
mov ecx, 0x599b30
mov byte [esp + 0x38], 2
call fcn.00465d10
test eax, eax
jne 0x442ee3
mov dword [edi], eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00442f40
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call fcn.00519a06
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.00519a06
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00519a06
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x44b590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53fb9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
push ebx
push esi
mov esi, ecx
push 0x400
lea ecx, [esp + 0xc]
call fcn.00527979
xor ebx, ebx
lea eax, [esp + 8]
push ebx
push 0x1000
push ebx
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0xd0], ebx
call fcn.00521948
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x40]
push ebx
push ecx
mov ecx, esi
mov byte [esp + 0xd8], 1
call fcn.00449e40
test eax, eax
mov byte [esp + 0xc0], bl
lea ecx, [esp + 0x30]
jne 0x44b623
call fcn.00521a24
lea ecx, [esp + 8]
mov dword [esp + 0xc0], 0xffffffff
call fcn.00527a02
xor eax, eax
jmp 0x44b6c0
call fcn.00521a24
mov edx, dword [esp + 8]
push ebx
push ebx
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push ebx
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.00521948
mov esi, dword [esi + 0x2c8]
push ebx
push 1
push ebx
push ebx
lea ecx, [esp + 0x84]
push esi
push ecx
mov ecx, dword [esp + 0xe0]
mov byte [esp + 0xd8], 2
call fcn.0044c190
test eax, eax
mov byte [esp + 0xc0], bl
lea ecx, [esp + 0x74]
jne 0x44b6a2
call fcn.00521a24
lea ecx, [esp + 8]
mov dword [esp + 0xc0], 0xffffffff
call fcn.00527a02
xor eax, eax
jmp 0x44b6c0
call fcn.00521a24
lea ecx, [esp + 8]
mov dword [esp + 0xc0], 0xffffffff
call fcn.00527a02
mov eax, 1
mov ecx, dword [esp + 0xb8]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xbc
ret 4

Function at 0x44b6e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x53fbc3
push eax
mov dword fs:[0], esp
sub esp, 0x78
push esi
push edi
mov edi, ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x44b71c
pop edi
pop esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
add esp, 0x84
ret
xor eax, eax
mov ax, word [0x59a604]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x44b74d
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
add esp, 0x84
ret
push 0x1000
push 0x2002
lea ecx, [esp + 0x10]
call fcn.00533197
push 0
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x90], 0
call fcn.0053321b
push 0
push 0x1000
lea ecx, [esp + 0x10]
push 1
push ecx
lea ecx, [esp + 0x4c]
call fcn.00521948
push 0
push 1
push 0
push 0
lea edx, [esp + 0x4c]
push 0
push edx
mov ecx, edi
mov byte [esp + 0xa0], 1
call fcn.0044c190
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.00521aac
lea ecx, [esp + 8]
call fcn.005332bc
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x88], 0
call fcn.00521a24
lea ecx, [esp + 8]
mov dword [esp + 0x88], 0xffffffff
call fcn.005331dd
mov ecx, dword [esp + 0x80]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x84
ret
Function at 0x455cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x540580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x596a5c]
push ebx
push ebp
push edi
mov ebp, ecx
mov dword [esp + 0x14], eax
xor edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x38]
mov byte [esp + 0x30], 2
cmp edi, edx
je 0x455d33
mov dword [edi], edx
mov ecx, dword [ebp + 0x170]
mov dword [esp + 0x38], edx
cmp ecx, edx
mov dword [esp + 0x24], ecx
jle 0x455e07
push esi
mov bl, 4
mov eax, dword [ebp + 0x16c]
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x18]
mov esi, dword [eax + ecx*4]
lea eax, [esp + 0x14]
push edx
push eax
push ebp
mov ecx, esi
call fcn.00450980
test eax, eax
je 0x455ded
add esi, 4
push 0x588ecc
lea ecx, [esp + 0x28]
push esi
push ecx
call fcn.00519c4f
lea edx, [esp + 0x14]
mov byte [esp + 0x34], 3
push edx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00519be9
push 0x588770
lea ecx, [esp + 0x20]
push eax
push ecx
mov byte [esp + 0x40], bl
call fcn.00519c4f
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 5
call fcn.00519dd2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], bl
call fcn.00519a06
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 3
call fcn.00519a06
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 2
call fcn.00519a06
test edi, edi
je 0x455ded
mov dword [edi], 1
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
inc eax
cmp eax, ecx
mov dword [esp + 0x3c], eax
jl 0x455d4c
mov eax, dword [esp + 0x18]
pop esi
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x455e19
push eax
call fcn.004dc5d0
add esp, 4
jmp 0x455e8b
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 8]
test eax, eax
je 0x455ece
lea eax, [esp + 0xc]
lea ecx, [esp + 0x24]
push eax
push 0x5899d8
push ecx
call fcn.00519cc3
push 0x5899c0
lea edx, [esp + 0x3c]
push eax
push edx
mov byte [esp + 0x3c], 6
call fcn.00519c4f
mov eax, dword [eax]
push 0x24
push eax
mov ecx, 0x599b30
mov byte [esp + 0x38], 7
call fcn.00432e20
cmp eax, 6
lea ecx, [esp + 0x38]
setne bl
mov byte [esp + 0x30], 6
call fcn.00519a06
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 2
call fcn.00519a06
test bl, bl
je 0x455ece
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00519a06
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.00519a06
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00519a06
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00519a06
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.00519a06
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00519a06
mov ecx, dword [esp + 0x28]
pop edi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x457790
Capabilities:
Encode data using xor

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
xor ecx, ecx
test edi, edi
mov dword [esp + 4], eax
jle 0x4577c7
push ebx
push esi
mov esi, dword [esp + 0x14]
mov eax, ecx
mov dl, byte [esi]
and eax, 3
mov bl, byte [esp + eax + 0xc]
lea eax, [esp + eax + 0xc]
xor bl, dl
inc ecx
inc esi
cmp ecx, edi
mov byte [eax], bl
jl 0x4577a8
mov eax, dword [esp + 0xc]
pop esi
pop ebx
pop edi
pop ecx
ret
Function at 0x458b30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540ff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x394]
test eax, eax
je 0x458b84
push 0x124
push 0x589ed8
call fcn.00432e20
cmp eax, 6
je 0x458b7d
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00425f30
jmp 0x458b87
lea edi, [esi + 0xc0]
mov ecx, edi
call fcn.004504a0
cmp eax, 1
jne 0x458c38
push 0x23
push 0x589eb4
mov ecx, esi
call fcn.00432e20
cmp eax, 2
jne 0x458bc2
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x458c0e
mov eax, dword [0x596a5c]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
push 0
push ecx
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00448010
test eax, eax
je 0x458c4d
mov edx, dword [ebp - 0x10]
push 1
push edx
mov ecx, edi
call fcn.00448670
test eax, eax
je 0x458c4d
mov ecx, edi
call fcn.004504d0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00519a06
mov eax, dword [esi + 0x8a4]
test eax, eax
jne 0x458c38
cmp dword [esi + 0x958], 1
jne 0x458c38
mov eax, dword [esi + 0x8a0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi + 0x8a4], 1
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00519a06
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x459350
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
call fcn.00457120
mov eax, dword [esi + 0x8ac]
test eax, eax
je 0x459380
push 0
lea ecx, [eax + 0x818]
call fcn.00494980
mov ecx, dword [esi + 0x8ac]
add ecx, 0x818
call fcn.00495160
mov eax, dword [esi + 0x384]
not eax
test al, 1
jne 0x45943e
push ebp
push edi
lea edi, [esi + 0xc0]
mov ecx, edi
call fcn.004504f0
push 1
mov ecx, esi
mov ebp, eax
call fcn.00528f96
mov ecx, edi
call fcn.00450500
mov ecx, 0x59a5d4
mov dword [0x59a5cc], 0xffffffff
mov dword [0x59a5d0], 0
call fcn.004735a0
mov ecx, 0x59a5e8
call fcn.004735a0
mov ecx, esi
mov dword [0x59a5fc], 0
call fcn.00458090
mov ecx, edi
call fcn.004504f0
xor ecx, ecx
cmp ebp, eax
setne cl
push ecx
mov ecx, esi
call fcn.00457420
mov eax, dword [esi + 0x8a4]
test eax, eax
jne 0x45942c
mov eax, dword [esi + 0x958]
mov edi, 1
cmp eax, edi
jne 0x45942c
mov edx, dword [esi + 0x8a0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi + 0x8a4], edi
mov ecx, dword [esi + 0x8ac]
push 1
mov eax, dword [ecx]
call dword [eax + 0xe0]
pop edi
pop ebp
pop esi
ret
Function at 0x459b00
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5410d0
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x384]
not eax
test al, 1
jne 0x459c1a
lea edi, [esi + 0xc0]
mov ecx, edi
call fcn.004504a0
cmp eax, 1
jne 0x459c1a
mov ecx, dword [0x596a5c]
push ebp
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 0x8ac]
lea edx, [esp + 0xc]
push edx
add ecx, 0xc0
mov dword [esp + 0x20], 0
call fcn.004db830
push 0
push 0x589ffc
mov ecx, esi
call fcn.00463a00
lea ebp, [esi + 0x388]
lea ecx, [esp + 0x10]
push ebp
call fcn.0051977b
mov eax, dword [esi + 0x8a0]
push 1
push eax
mov ecx, edi
mov byte [esp + 0x24], 1
call fcn.00448670
test eax, eax
jne 0x459bc8
push eax
push 0x589fdc
mov ecx, esi
call fcn.00463a00
mov eax, dword [esi + 0x8a0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi + 0x8a4], 1
jmp 0x459bee
mov eax, dword [esp + 0xc]
push 0
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x459bd8
push eax
jmp 0x459bdd
push 0x589fc0
mov ecx, esi
call fcn.00463a00
mov dword [esi + 0x8a4], 0
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.00519af3
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 0
call fcn.00519a06
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00519a06
pop ebp
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x45f6f0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x10c
push esi
mov esi, dword [esp + 0x114]
push esi
call fcn.004741f0
add esp, 4
test eax, eax
jne 0x45f764
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0051f5a5
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
test ax, ax
je 0x45f764
lea edx, [esp + 4]
mov word [esp + 4], ax
push edx
push 0x45f770
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp word [esp + 4], 0
jne 0x45f759
mov eax, dword [esp + 8]
pop esi
add esp, 0x10c
ret 4
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
xor eax, eax
pop esi
add esp, 0x10c
ret 4
Function at 0x464c98
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x542a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x3b4]
mov ecx, edi
call fcn.0052298c
push 0x599934
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov ecx, edi
call fcn.00522935
push 0
lea ecx, [esp + 0x18]
call fcn.0052268d
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0
call fcn.0052202a
push 1
push 0x57
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00515c22
mov eax, dword [eax]
lea edx, [esp + 0xc]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x3bc], ecx
lea ecx, [esp + 8]
mov dword [esi + 0x3c0], edx
call fcn.00519a06
push edi
lea ecx, [esp + 0x18]
call fcn.0052202a
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.005226ff
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x46b6a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x46b702
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret

Function at 0x46b710
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [esp + 0x214]
push esi
push edi
push ebx
push 0
push 0
push ebp
push 0x5734c8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x46b7fe
lea eax, [esp + 0x10]
mov byte [esp + 0x10], 0
push eax
push 0x58ece8
push 0x80000000
call fcn.0046b6a0
add esp, 0xc
test eax, eax
jne 0x46b7fe
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push 0x58ecd4
push ecx
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push eax
push 0x80000000
call fcn.0046b6a0
add esp, 0xc
test eax, eax
jne 0x46b7fe
lea ecx, [esp + 0x10]
push 0x58eccc
push ecx
call fcn.00503cfa
mov esi, eax
add esp, 8
test esi, esi
jne 0x46b7d8
lea edx, [esp + 0x10]
push 0x58ecc8
push edx
call fcn.00502010
mov esi, eax
add esp, 8
test esi, esi
jne 0x46b7d8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x46b7db
mov byte [esi], 0
push 0x588658
push esi
call edi
push ebp
push esi
call edi
lea ecx, [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x475210
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0xa8], eax
mov dword [esi + 0xa4], 1
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [esi + 0xa8]
mov ecx, esi
push edx
push 2
call fcn.00474cb0
mov dword [0x5a6848], esi
mov dword [esi + 0xa4], edi
call fcn.0053597d
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x2c]
push eax
push edi
push 0x4751c0
push 0xffffffffffffffff
call ebx
mov dword [0x5a684c], eax
mov ecx, dword [esi + 0xa8]
mov dword [esi + 0x88], 2
mov edx, dword [esi + 0x90]
push esi
mov ecx, dword [edx + ecx*4]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x5a684c]
push ecx
call ebp
mov dword [0x5a684c], edi
mov dword [0x5a6848], edi
cmp dword [esi + 0xa4], 1
je 0x475238
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00474cb0
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4782a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x543b28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x26
lea eax, [esi + 8]
lea edi, [esi + 0x28]
mov ecx, dword [eax]
mov dword [esp + 0x30], ecx
mov ecx, dword [edi]
mov ebp, dword [eax + 4]
mov ebx, dword [ecx - 8]
mov ecx, edi
mov edx, dword [eax + 8]
mov dword [esp + 0x38], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x3c], eax
call fcn.00519e81
sub ebx, eax
lea edx, [esp + 0x28]
dec ebx
mov ecx, edi
push ebx
push edx
mov dword [esp + 0x1c], eax
call fcn.00515fac
mov ebx, eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x5c], 0
call fcn.00516028
push ebx
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x60], 1
call fcn.00519be9
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 4
call fcn.00519a06
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 3
call fcn.00519a06
mov edi, dword [esp + 0x5c]
push 1
mov ecx, edi
call fcn.005220c1
mov eax, dword [edi]
push 0x5a6840
mov ecx, edi
call dword [eax + 0x28]
mov ecx, dword [0x58f084]
mov ebx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x34]
sub eax, ecx
lea ecx, [ebp + 5]
add ebx, ecx
add edx, eax
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x1c], edx
push ebx
lea edx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x3c]
push 0x920
mov dword [esp + 0x48], edx
mov edx, dword [edi]
push ecx
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x68]
mov eax, dword [esp + 0x5c]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x28]
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov edx, dword [esp + 0x2c]
add ecx, ebp
add eax, edx
mov edx, dword [esp + 0x60]
add ecx, ebx
add eax, edx
push ecx
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.0052247a
mov eax, dword [esi + 0x38]
mov esi, dword [esi + 0x3c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x60]
add ebp, esi
add eax, ecx
add ebx, ebp
add eax, edx
push ebx
push eax
mov ecx, edi
call fcn.005224c6
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], 0xffffffff
call fcn.00519a06
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 0xc