joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412680
Capabilities:
Log keystrokes

Disassembly:
push esi
push edi
mov edi, ecx
movzx ecx, word [edi]
test cx, cx
je 0x412721
cmp word [edi + 2], 0
jne 0x4126a6
push dword [esp + 0x14]
call fcn.00412730
add esp, 4
pop edi
pop esi
ret
cmp byte [esp + 0x10], 0
je 0x4126da
call fcn.0040ab40
cmp ax, 0x56
jne 0x4126da
mov cx, word [edi + 2]
call fcn.0040ab40
cmp ax, 0x4b
jne 0x4126da
push 0x10
lea eax, [edi + 4]
push 0
push eax
call fcn.00492e76
add esp, 0xc
pop edi
pop esi
ret
xor esi, esi
nop dword [eax]
push edi
push dword [esi*8 + 0x4ce940]
call fcn.0048f253
add esp, 8
test eax, eax
je 0x412717
inc esi
cmp esi, 0x6d
jl 0x4126e0
cmp byte [esp + 0xc], 0
jne 0x412721
mov ecx, edi
call fcn.004125c0
movzx ecx, ax
test cx, cx
je 0x412721
pop edi
pop esi
jmp fcn.00412e40
mov al, byte [esi*8 + 0x4ce944]
pop edi
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x412730
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, edx
cmp cx, 0xa
jne 0x41273d
mov al, 0xd
pop esi
ret
push dword [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx edx, ax
mov ecx, edx
shr ecx, 8
cmp cl, 0xff
jne 0x41275a
cmp dl, 0xff
je 0x41275f
test cl, 0x38
je 0x412763
xor al, al
pop esi
ret
test esi, esi
je 0x4127a3
mov al, cl
and al, 6
cmp al, 6
jne 0x412774
or byte [esi], 8
jmp 0x412792
test cl, 2
je 0x412783
mov al, byte [esi]
test al, 3
jne 0x412783
or al, 1
mov byte [esi], al
test cl, 4
je 0x412792
mov al, byte [esi]
test al, 0xc
jne 0x412792
or al, 4
mov byte [esi], al
test cl, 1
je 0x4127a3
mov cl, byte [esi]
test cl, 0x30
jne 0x4127a3
or cl, 0x10
mov byte [esi], cl
mov al, dl
pop esi
ret

Function at 0x412e40
Capabilities:
Log keystrokes

Disassembly:
movzx eax, cx
cmp eax, 0x11c
ja 0x412e98
je 0x412e95
sub eax, 0x1d
cmp eax, 0x36
ja case.0x412ea9.286
movzx eax, byte [eax + 0x412f18]
jmp dword [eax*4 + 0x412ed0]
mov al, 0xa0
ret
mov al, 0xa2
ret
mov al, 0xa4
ret
mov al, 0x6a
ret
mov al, 0x6d
ret
mov al, 0x6b
ret
mov al, 0x2e
ret
mov al, 0xc
ret
mov al, 0x2d
ret
mov al, 0x26
ret
mov al, 0x28
ret
mov al, 0x25
ret
mov al, 0x27
ret
mov al, 0x24
ret
mov al, 0x23
ret
mov al, 0x21
ret
mov al, 0x22
ret
mov al, 0xd
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x412ea9.286
movzx eax, byte [eax + 0x412f6c]
jmp dword [eax*4 + 0x412f50]
mov al, 0xa1
ret
mov al, 0xa3
ret
mov al, 0xa5
ret
mov al, 0x90
ret
mov al, 0x6f
ret
mov al, 0x5d
ret
push 1
movzx eax, cl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
ret

Function at 0x412fb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x4d4c60], ecx
mov eax, 1
nop dword [eax + eax]
mov ecx, dword [eax*4 + 0x4d4c5c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
mov dword [eax*4 + 0x4d4c60], ecx
inc eax
cmp eax, 0x270
jl 0x412fc0
mov dword [0x4cffbc], 1
mov dword [0x4d4c5c], 1
ret
Function at 0x413000
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4d4c5c], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x4d4c60
jne 0x41301f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.00412fb0
mov eax, dword [0x4d4c60]
mov ebx, 0xe3
mov dword [0x4cffbc], 0x270
mov dword [0x4d5620], 0x4d4c60
nop dword [eax]
mov edi, dword [esi + 4]
mov ecx, edi
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi + 0x634]
mov dword [esi], ecx
add esi, 4
sub ebx, 1
jne 0x413040
mov ebp, 0x18c
nop word [eax + eax]
mov ebx, dword [esi + 4]
lea esi, [esi + 4]
mov ecx, ebx
mov eax, ebx
xor ecx, edi
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, edi
mov edi, ebx
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x390]
mov dword [esi - 4], ecx
sub ebp, 1
jne 0x413080
mov eax, dword [0x4d4c60]
mov ecx, ebx
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, ebx
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
pop ebp
pop ebx
ret

Function at 0x4130f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4cffbc], 1
jne 0x4130fe
call fcn.00413000
mov eax, dword [0x4d5620]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d5620], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x413140
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4cffbc], 1
jne 0x41314e
call fcn.00413000
mov eax, dword [0x4d5620]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d5620], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4c96f0]
mulsd xmm0, qword [0x4c9560]
ret

Function at 0x413c00
Capabilities:
Write clipboard data

Disassembly:
cmp byte [ecx + 0x17], 0
jne 0x413c09
mov ecx, dword [ecx + 0xc]
cmp byte [ecx + 0x17], 2
jne 0x413c22
cmp dword [0x4d3e90], 0
je 0x413c22
mov ecx, 0x4d3e84
jmp fcn.00405670
mov al, byte [ecx + 0x15]
and al, 0x86
cmp byte [esp + 4], 0
mov byte [ecx + 0x15], al
je 0x413c36
or al, 1
mov byte [ecx + 0x15], al
mov eax, 1
ret 4
Function at 0x41c320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [esp + 0x40]
mov eax, 0x20
mov word [esp + 0xc], ax
mov ebx, ebp
mov ax, word [0x4cfab0]
mov word [esp + 0xe], ax
mov dword [esp + 0x10], 0x90028
mov dword [esp + 0x14], 0x3e003c
mov dword [esp + 0x18], 0x3d003a
mov dword [esp + 0x1c], 0x2d002b
mov dword [esp + 0x20], 0x2f002a
mov dword [esp + 0x24], 0x7e0021
mov dword [esp + 0x28], 0x7c0026
mov dword [esp + 0x2c], 0x5b005e
mov dword [esp + 0x30], 0x3f002e
mov dword [esp + 0x34], 0x7b
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
push edi
test ebp, ebp
je 0x41c3e5
movzx eax, word [ebp]
test ax, ax
je 0x41c3fb
mov esi, eax
nop word [eax + eax]
lea eax, [esp + 0x14]
mov edx, 0x20
nop dword [eax]
cmp si, dx
je 0x41c3f5
movzx ecx, word [eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x41c3c0
movzx eax, word [ebx + 2]
add ebx, 2
mov esi, eax
test ax, ax
jne 0x41c3b0
mov esi, dword [esp + 0x10]
xor ebx, ebx
test ebx, ebx
je 0x41c3fb
cmp ebx, ebp
lea edi, [ebx - 2]
cmovbe edi, ebx
jmp 0x41c415
mov esi, dword [esp + 0x10]
jmp 0x41c3e7
mov ecx, ebp
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c400
sub ecx, edx
lea edi, [ebp - 2]
sar ecx, 1
lea edi, [edi + ecx*2]
cmp edi, ebp
jbe 0x41c434
nop dword [eax]
movzx eax, word [edi]
cmp eax, 0x20
je 0x41c42d
cmp eax, 9
jne 0x41c434
sub edi, 2
cmp edi, ebp
ja 0x41c420
mov ebx, edi
sub ebx, ebp
sar ebx, 1
inc ebx
cmp ebx, 0xfd
jbe 0x41c463
cmp byte [esp + 0x4c], 0
je 0x41c457
push ebp
push str.This_line_does_not_contain_a_recognized_action.
mov ecx, esi
call fcn.0042d580
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0xc
mov esi, dword [esp + 0x44]
push ebx
push ebp
push esi
call fcn.00497e59
add esp, 0xc
xor eax, eax
mov word [esi + ebx*2], ax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0xc
Function at 0x42cd80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xcc
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], 0
mov dword [esp + 4], eax
mov edx, ecx
lea eax, [esp + 0x3c]
mov dword [esp + 0x2c], str.What
mov dword [esp + 8], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x8c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0xac]
mov dword [esp + 0x24], eax
lea eax, [esp + 0xbc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x44], 0
push esi
mov esi, 8
test eax, eax
jne 0x42ce20
movzx ecx, byte [edx]
lea eax, [ecx*8]
sub eax, ecx
mov eax, dword [eax*2 + 0x4ced70]
mov dword [esp + 0x40], eax
movzx eax, word [edx + 2]
mov dword [esp + 0x58], 0
mov dword [esp + 0x50], 0x4c45f0
mov dword [esp + 0x68], 0
mov eax, dword [eax*4 + 0x4d3114]
mov dword [esp + 0x60], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x78], 0
mov dword [esp + 0x70], str.Line
mov dword [esp + 0x88], 1
mov dword [esp + 0x84], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x90], str.Message
mov dword [esp + 0xa8], 0
test eax, eax
je 0x42cee8
cmp word [eax], 0
je 0x42cee8
mov esi, 0xa
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb0], str.Extra
mov dword [esp + 0xc8], 0
mov dword [esp + 0xc0], eax
mov edx, esi
lea ecx, [esp + 8]
call fcn.0046b610
pop esi
add esp, 0xcc
ret 0xc
Function at 0x42d9f0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4004
call fcn.004a4980
push ebx
mov ebx, dword [esp + 0x400c]
push ebp
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x42db0e
mov esi, dword [esp + 0x4024]
test esi, esi
jne 0x42da33
mov esi, dword [edi + 0x630]
test esi, esi
jne 0x42da33
mov ecx, dword [edi + 0x26c]
movzx eax, word [edi + 0x270]
jmp 0x42da3b
movzx ecx, word [esi + 2]
movzx eax, word [esi + 4]
push dword [esp + 0x401c]
movzx eax, ax
push eax
push dword [ecx*4 + 0x4d3114]
lea eax, [esp + 0x1c]
push str._s___d__:___Warning:__s_n
push 0x2000
push eax
call fcn.00472ce0
mov ebp, dword [esp + 0x4038]
mov edx, eax
add esp, 0x18
add edx, edx
cmp word [ebp], 0
je 0x42da97
mov ecx, edx
mov eax, 0x2000
push ebp
sar ecx, 1
sub eax, ecx
push str._____Specifically:__s_n
push eax
lea eax, [esp + 0x1c]
add eax, edx
push eax
call fcn.00472ce0
add esp, 0x10
cmp ebx, 3
jne 0x42dac1
push 1
call fcn.004912b2
add esp, 4
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00497178
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4004
ret 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebx, 2
jne 0x42db0e
test esi, esi
jne 0x42dafc
mov esi, dword [edi + 0x630]
test esi, esi
jne 0x42dafc
mov eax, dword [esp + 0x401c]
mov ecx, edi
push ebp
push eax
call fcn.0042d580
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4004
ret 0x10
mov eax, dword [esp + 0x401c]
mov ecx, esi
push ebp
push 1
push eax
call fcn.0042d1e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4004
ret 0x10
Function at 0x42de40
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3cc
push ebx
mov ebx, dword [esp + 0x3d4]
push ebp
push esi
push edi
mov ebp, ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x42de70
push 0x64
lea ecx, [esp + 0x114]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42de7a
xor eax, eax
mov word [esp + 0x110], ax
push pe_nt_image_headers32
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0048ce40
mov esi, dword [0x4d496c]
add esp, 0xc
test esi, esi
je 0x42ded7
cmp byte [esi + 0x11], 0
je 0x42ded0
mov ecx, dword [esi]
call fcn.0046e480
sub eax, 0
je 0x42deb6
sub eax, 1
je 0x42deb6
mov eax, str.Object
jmp 0x42debb
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
push 0x4c4ce8
lea eax, [esp + 0x18]
push 0x7d
push eax
call fcn.00472d30
add esp, 0x10
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x42de98
cmp word [esp + 0x10], 0
je 0x42df2e
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42dee6
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7b
jbe 0x42df1f
mov esi, 0x7f
lea edi, [esp + 0x10]
sub esi, ecx
lea edi, [edi + ecx*2]
push esi
push 0x4c0260
push edi
call fcn.00497e59
add esp, 0xc
xor eax, eax
mov word [edi + esi*2], ax
jmp 0x42df2e
cmp word [esp + ecx*2 + 0xe], 0x20
jne 0x42df2e
xor eax, eax
mov word [esp + ecx*2 + 0xe], ax
mov eax, dword [0x4d133c]
cmp byte [eax + 0xf8], 0
je 0x42df4c
cmp byte [0x4d49ad], 0
jne 0x42df4c
mov esi, 1
jmp 0x42df4e
xor esi, esi
mov eax, dword [0x4d1670]
cmp eax, 1
jle 0x42df5d
lea edi, [eax - 1]
jmp 0x42df5f
xor edi, edi
mov cl, 1
call fcn.00411ce0
lea edx, [esp + 0x1d8]
mov cl, al
call fcn.004120f0
mov ecx, dword [0x4d1670]
mov edx, 0x4ac22c
push eax
push dword [0x4d1688]
mov eax, dword [0x4d1454]
push ecx
sub eax, esi
cmp ecx, 1
push eax
mov eax, str.__preempted:_they_will_resume_when_the_current_thread_finishes_
mov ecx, 0x4bf008
cmovle eax, edx
cmp dword [0x4d169c], 0
push eax
push edi
lea eax, [esp + 0x28]
mov edx, 0x4bf000
push eax
push dword [0x4d4974]
mov eax, ecx
push dword [0x4d4978]
cmovne eax, edx
cmp dword [0x4d16a0], 0
push eax
cmovne ecx, edx
lea eax, [esp + 0x138]
push ecx
push eax
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
push 0xfffe
push ebx
call fcn.00472ce0
add eax, eax
mov edi, 0xfffe
add ebx, eax
add esp, 0x3c
sar eax, 1
mov edx, edi
sub edx, eax
mov ecx, ebx
call fcn.0040a8e0
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42e005
sub ecx, edx
mov eax, str._r_nPress__F5__to_refresh.
sar ecx, 1
cmp dword [0x4d1694], 0
lea esi, [ebx + ecx*2]
mov ecx, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
cmove eax, ecx
push eax
mov eax, esi
sub eax, ebp
sar eax, 1
sub edi, eax
push edi
push esi
call fcn.00472ce0
add esp, 0xc
lea eax, [esi + eax*2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3cc
ret 8
Function at 0x433f20
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x18]
mov esi, ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00442320
mov edi, eax
test edi, edi
je 0x433ff7
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00477340
mov dword [esp + 0xc], eax
test eax, eax
je 0x433ff7
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
test esi, esi
je 0x433f99
cmp esi, dword [0x4d3e6c]
je 0x433f99
mov ecx, edi
call fcn.00477810
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
test al, al
jne 0x433f9f
push 1
push esi
push dword [0x4d3e6c]
call edi
test eax, eax
setne bl
jmp 0x433f9f
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x433fda
mov ecx, dword [0x4d166c]
push 1
push 0
push 0xffffffffffffffff
push 0x4ac300
call fcn.00475930
mov eax, dword [0x4ce8c8]
mov ecx, dword [eax + 0x58]
cmp ecx, 0xffffffff
jle 0x433fda
mov edx, 1
call fcn.00401e60
test bl, bl
je 0x433fe9
push 0
push esi
push dword [0x4d3e6c]
call edi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [0x4ce8c8]
cmp byte [eax + 0x108], 0
jne 0x434024
mov ecx, dword [0x4d166c]
push 1
push 0
push 0xffffffffffffffff
push 0x4bf994
call fcn.00475930
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x4ac22c
push 0
push 0x4bf994
mov ecx, esi
call fcn.0042cf00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x434fa0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x435215
cmp word [esi], 0
je 0x435215
push str.Exist
push esi
call fcn.0048f253
add esp, 8
test eax, eax
jne 0x434fda
lea edi, [eax + 1]
jmp 0x43503a
push str.Close
push esi
call fcn.0048f253
add esp, 8
test eax, eax
jne 0x434ff1
lea edi, [eax + 2]
jmp 0x43503a
push str.Priority
push esi
call fcn.0048f253
add esp, 8
test eax, eax
jne 0x435008
lea edi, [eax + 3]
jmp 0x43503a
push str.Wait
push esi
call fcn.0048f253
add esp, 8
test eax, eax
jne 0x43501f
lea edi, [eax + 4]
jmp 0x43503a
push str.WaitClose
push esi
call fcn.0048f253
add esp, 8
test eax, eax
jne 0x435215
mov edi, 5
lea eax, [edi - 1]
jmp dword [eax*4 + 0x435230]
push esi
push 0
push str.Parameter_1_invalid.
mov ecx, edi
call fcn.0042d1e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x436f00
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10000
call fcn.004a4980
push ebx
push esi
mov esi, dword [0x4d3d98]
lea eax, [esp + 8]
push 0x7fff
push eax
push dword [esp + 0x10014]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
push 1
cmp ebx, 0x7fff
jb 0x4370ae
push 1
lea ecx, [ebx - 1]
push ecx
push 0
mov ecx, esi
call fcn.00475930
test eax, eax
jne 0x436f57
pop esi
pop ebx
add esp, 0x10000
ret 4
cmp byte [esi + 0x17], 0
push ebp
push edi
jne 0x436f64
mov edi, dword [esi + 0xc]
jmp 0x436f66
mov edi, esi
test byte [edi + 0x15], 8
je 0x436f73
mov ecx, edi
call fcn.00401b40
mov al, byte [edi + 0x17]
mov ebp, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
cmp al, 1
jne 0x436f91
test byte [edi + 0x15], 4
je 0x436f8c
push edi
call fcn.0042db20
mov ecx, dword [edi + 8]
jmp 0x436fd9
cmp al, 2
jne 0x436fd4
mov ecx, dword [0x4d3e90]
test ecx, ecx
jne 0x436fd9
push 0xd
call ebp
test eax, eax
jne 0x436fbc
push 0xf
call ebp
test eax, eax
mov ecx, 0x4ac220
mov eax, 0x4ac22c
cmove ecx, eax
jmp 0x436fd9
push 0
call fcn.004053d0
cmp eax, 0xffffffff
mov ecx, 0x4ac22c
cmovne ecx, dword [0x4d3e8c]
jmp 0x436fd9
mov ecx, 0x4d3e58
push ebx
push ecx
push dword [esp + 0x1001c]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x43706a
cmp byte [esi + 0x17], al
jne 0x436ff6
mov edi, dword [esi + 0xc]
jmp 0x436ff8
mov edi, esi
test byte [edi + 0x15], 8
je 0x437005
mov ecx, edi
call fcn.00401b40
mov al, byte [edi + 0x17]
cmp al, 1
jne 0x43701d
test byte [edi + 0x15], 4
je 0x437018
push edi
call fcn.0042db20
mov ecx, dword [edi + 8]
jmp 0x437065
cmp al, 2
jne 0x437060
mov ecx, dword [0x4d3e90]
test ecx, ecx
jne 0x437065
push 0xd
call ebp
test eax, eax
jne 0x437048
push 0xf
call ebp
test eax, eax
mov ecx, 0x4ac220
mov eax, 0x4ac22c
cmove ecx, eax
jmp 0x437065
push 0
call fcn.004053d0
cmp eax, 0xffffffff
mov ecx, 0x4ac22c
cmovne ecx, dword [0x4d3e8c]
jmp 0x437065
mov ecx, 0x4d3e58
xor eax, eax
mov word [ecx], ax
cmp byte [esi + 0x17], 0
pop edi
pop ebp
jne 0x437075
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x43709a
cmp dword [0x4d3e90], 0
je 0x43709a
push ecx
mov ecx, 0x4d3e84
call fcn.00405670
pop esi
pop ebx
add esp, 0x10000
ret 4
and byte [esi + 0x15], 0x86
mov eax, 1
pop esi
pop ebx
add esp, 0x10000
ret 4
push 0
test ebx, ebx
lea eax, [esp + 0x10]
mov ecx, 0x4ac22c
cmove eax, ecx
mov ecx, esi
push ebx
push eax
call fcn.00475930
pop esi
pop ebx
add esp, 0x10000
ret 4
Function at 0x439d10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, ecx
push edi
xor edi, edi
push esi
lea eax, [esp + 0x14]
push eax
mov eax, edi
or eax, 1
push eax
push 0
push str.SOFTWAREAECS
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x439dfa
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push str.InstallDir
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x439dfa
mov edx, dword [esp + 0x10]
test edx, edx
je 0x439dfa
shr edx, 1
lea eax, [edx - 1]
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp word [esp + ecx*2 + 0x18], si
jne 0x439db8
test eax, eax
je 0x439e03
lea edx, [esp + ecx*2 + 0x16]
cmp word [edx], 0
jne 0x439db2
lea eax, [ecx - 1]
sub edx, 2
mov ecx, eax
test ecx, ecx
jne 0x439da0
mov dword [esp + 0x10], ecx
jmp 0x439dcd
xor eax, eax
mov dword [esp + 0x10], edx
cmp edx, 0x104
jae 0x439dfc
mov word [esp + edx*2 + 0x18], ax
mov eax, edx
test eax, eax
je 0x439e03
pop esi
test ebx, ebx
je 0x439df0
lea edx, [esp + 0x14]
mov ecx, edx
sub ebx, ecx
nop
movzx ecx, word [edx]
lea edx, [edx + 2]
mov word [ebx + edx - 2], cx
test cx, cx
jne 0x439de0
pop edi
pop ebp
pop ebx
add esp, 0x210
ret
xor eax, eax
mov word [esp + 0x18], ax
xor eax, eax
test edi, edi
jne 0x439dd1
mov edi, pe_nt_image_headers32
jmp 0x439d24
Function at 0x43d6f0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
push edi
mov edi, dword [0x4d3d98]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, dword [ebp + 8]
xor edx, edx
push eax
push 1
push 0
mov ecx, esi
call fcn.00412680
mov bl, al
add esp, 0xc
test bl, bl
jne 0x43d78f
push 0
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.0044eb40
add esp, 4
test eax, eax
jne 0x43d755
push 1
push eax
push 0xffffffffffffffff
push 0x4ac22c
mov ecx, edi
call fcn.00475930
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push 0
push ecx
mov ecx, eax
mov dword [esp + 0x20], 0
call fcn.0044ee00
add esp, 8
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00475220
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
movzx esi, word [eax]
test esi, 0xffffff80
je 0x43d7a1
xor eax, eax
jmp 0x43d7ac
push 2
push esi
call fcn.00491ac4
add esp, 8
mov ecx, esi
and ecx, 0xffffffdf
test eax, eax
cmove ecx, esi
cmp ecx, 0x50
je 0x43d7ca
xor eax, eax
mov edx, 2
cmp ecx, 0x54
cmovne edx, eax
jmp 0x43d7cf
mov edx, 1
mov cl, bl
call fcn.0044ed60
push 1
test al, al
mov edx, 0x4c64d8
push 0
mov ecx, 0x4c08b4
cmove ecx, edx
push 0xffffffffffffffff
push ecx
mov ecx, edi
call fcn.00475930
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43d800
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x238
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x4d3d98]
push 0
call fcn.00475930
mov eax, dword [ebp + 8]
test eax, eax
je 0x43d9a1
cmp word [eax], 0
je 0x43d9a1
push 0x104
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00497e59
add esp, 0xc
lea ecx, [esp + 0x30]
xor eax, eax
lea edx, [ecx + 2]
mov word [esp + 0x238], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43d860
sub ecx, edx
sar ecx, 1
cmp word [esp + ecx*2 + 0x2e], 0x5c
je 0x43d88d
lea eax, [ecx + 1]
cmp eax, 0x105
jae 0x43d9a1
mov dword [esp + ecx*2 + 0x30], 0x5c
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4d60fc]
cmp eax, dword [ecx + 4]
jle 0x43d8e1
push 0x4d60fc
call fcn.0048b5e3
add esp, 4
cmp dword [0x4d60fc], 0xffffffff
jne 0x43d8e1
push str.GetDiskFreeSpaceExW
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4d60fc
mov dword [0x4d6100], eax
call fcn.0048b599
add esp, 4
mov eax, dword [0x4d6100]
test eax, eax
je 0x43d930
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x43d9a1
cmp byte [ebp + 0xc], 0
je 0x43d91f
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
shrd esi, edi, 0x14
shr edi, 0x14
jmp 0x43d96f
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
shrd esi, edi, 0x14
shr edi, 0x14
jmp 0x43d96f
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x43d9a1
cmp byte [ebp + 0xc], 0
mov esi, dword [esp + 8]
cmovne esi, dword [esp + 0xc]
imul esi, dword [esp + 0x10]
imul esi, dword [esp + 0x14]
shr esi, 0x14
xor edi, edi
mov ecx, dword [0x4d166c]
push 1
push 0
push 0xffffffffffffffff
push 0x4ac300
call fcn.00475930
mov ecx, dword [0x4d3d98]
push 0x18
push edi
push esi
call fcn.00401ac0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4ce8c8]
cmp byte [eax + 0x108], 0
jne 0x43d9cd
mov ecx, dword [0x4d166c]
push 1
push 0
push 0xffffffffffffffff
push 0x4bf994
call fcn.00475930
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x4ac22c
push 0
push 0x4bf994
mov ecx, esi
call fcn.0042cf00
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8