joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4371ab
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4371f3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push 1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
push 0x2db3
push dword [ebp - 0x14]
push 0x40d5
call fcn.004372e2
add esp, 0x1c
jmp 0x4372de
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4372bc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x437253
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x4372ba
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x437275
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x4372ba
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x40], 0x2bbef7d6
push 0
push 0x249b
push 0x6ace
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
push 1
lea eax, [ebp - 0x44]
push eax
push 0
call fcn.00439ee2
add esp, 0x24
jmp 0x43726a
jmp 0x4372de
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x4372d6
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x4372de
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret
Function at 0x437312
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x437424
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4373bb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43738d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4373b9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4373b9
push 0
push 0
push 0x175a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
jmp 0x437422
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x43741a
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x54]
mov edx, dword [edx]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0xc], eax
jmp 0x437422
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x43744d
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
push eax
push 0
call fcn.0043163e
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43a74e
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43a865
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43a833
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43a7df
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43a7dd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1601
push 0xce0
push 0x162b
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x43a831
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x43a801
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 8
jg 0x43a831
mov byte [ebp - 1], 0
push 1
push 0
push 1
push 0x61f1
push 1
lea eax, [ebp - 1]
push eax
push 0x2072
push 0
push 1
call fcn.004453a2
add esp, 0x24
jmp 0x43a7f6
jmp 0x43a863
push 0x76f8
push 0
push 0x1924
push 0
push 1
push 0xfd
push 0x52d6
push 1
push 1
push 0x6380
push 0x7af4
call fcn.0043cc31
add esp, 0x2c
jmp 0x43a873
push 0
push 0x11b5
call fcn.00436506
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43b15e
Capabilities:
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43b22b
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43b1d6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43b1bb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43b1b9
push 0x1ba0
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x43b1d4
push 0
push 0
push 0
push 0
push 0
push 0
push 0xdb8
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x43b229
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43b205
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x43b229
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43b229
push 0x1ee7
push 1
push 0x4b99
push 1
push 0
call fcn.004318bd
add esp, 0x14
jmp 0x43b24a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push 0xda9
push dword [ebp - 0x2c]
push 0x6c66
push 1
push 0
call fcn.0043658b
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x43c78b
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43c7b6
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push 0x6e08
call fcn.0043c843
add esp, 0xc
jmp 0x43c83f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43c825
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43c7fe
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43c7fc
push 0
push 0x14b8
call fcn.0043debf
pop ecx
pop ecx
jmp 0x43c823
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1601
push 0xce0
push 0x162b
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x43c83f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push 1
push 0x4c1f
push dword [ebp - 0x1c]
call fcn.00434953
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43df53
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43e036
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43dfd2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43dfc3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43dfc1
push 0
call fcn.0043f61f
pop ecx
jmp 0x43dfd0
push 0x137c
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
jmp 0x43e034
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43dff6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x43e034
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x43e034
push 0x243f
push 0x1d1b
push 0x1554
push 0xb54
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
jmp 0x43e060
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push 0x6ae7
push dword [ebp - 0x3c]
push 1
push dword [ebp - 0x40]
call fcn.004341ce
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43f4ad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x43f4f0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x3673
push 1
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 1
call fcn.0043f596
add esp, 0x18
jmp 0x43f592
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43f568
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43f559
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43f557
push 0x20
push 0
push 0x513b
push 0
call fcn.0043fc03
add esp, 0x10
jmp 0x43f566
push 0x78f
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x43f592
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x34]
push 0x55c3
push 0
push 0x1e1f
push 1
push dword [ebp - 0x38]
push 1
call fcn.00431792
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x43fb26
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43fb53
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 1
push 0x6355
push 1
call fcn.0043fc03
add esp, 0x10
jmp 0x43fbff
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43fbaa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43fb91
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x43fba8
push 0x494
push 0x1236
push 0x1370
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x43fbff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43fbe8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43fbe6
push 0x2413
push 0x1f48
push 0x1892
push 0x1ad9
call dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x43fbff
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x444ec4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x445047
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x444f4b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x444f28
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x444f26
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x444f46
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x444f46
push 0
call fcn.00447265
pop ecx
jmp 0x445045
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x445020
mov dword [ebp - 8], 0
jmp 0x444f75
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x444f88
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], 0x824a8c6a
jmp 0x444f6e
push 0
push 1
push 0
push 0x324b
call fcn.0043f5b9
add esp, 0x10
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x54], 0xc
jmp 0x444fbd
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x54]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x54], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x54], 3
jge 0x44501e
mov dword [ebp - 0xc], 0x7b1891f7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0
je 0x444fdf
jmp 0x44501e
mov dword [ebp - 0xc], 0
jmp 0x444fef
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffe4
jle 0x44501c
mov byte [ebp - 2], 0
push 1
push 0x6262
push 0x513e
push 0
push 1
push 0x2158
lea eax, [ebp - 2]
push eax
call fcn.0043aeb4
add esp, 0x1c
jmp 0x444fe8
jmp 0x444faa
jmp 0x445045
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x445045
push 0x1cf8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x44505f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
push 0x6a7d
push dword [ebp - 0x44]
push 1
call fcn.0043cdc7
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x445130
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x445195
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x445164
push 1
push 0x69b8
push 0x5ced
call fcn.004452b4
add esp, 0xc
jmp 0x445190
push 0x6503
push 1
push 1
push 0x34e9
push 0x211c
push 0x5093
push 1
push 0x157f
push 0x1ea
call fcn.00440058
add esp, 0x24
jmp 0x4452b0
lea eax, [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x445242
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44522b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x445229
push 0
push 0x232e
push 0x1eba
push 0x9c4
push 0x1d61
push 0x12fc
push 0x1c47
push 0xda1
push 0x10bc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
jmp 0x445240
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0x1220985a
jmp 0x4452b0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x445262
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x4452b0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x4452b0
push 0x6cf
push 0x21bc
push 0x1535
push 0x180c
push 1
push 0x46a3
push 1
push 0x59b2
push 1
push 0x5155
push 0x1987
push 0
call fcn.004319cc
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x4452d5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x445310
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
call fcn.0044537b
add esp, 0x14
jmp 0x445377
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x445365
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44534f
push 0
push 0x2282
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x445363
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x445363
push 0
call fcn.00445980
pop ecx
jmp 0x445377
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x24]
call fcn.0043a0d7
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x445f2c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x445fce
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x445f98
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x445f6e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x445f96
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x445f96
push 0
push 0xee8
push 0x24ae
push 0x1e59
push 0x1398
call dword [sym.imp.GDI32.dll_CreateBitmap]
jmp 0x445fc9
push 0x960
push 0x16a
push 0x4e6
push 0
push 0x6cf4
push 1
push 1
push 0x4a17
push 0x17b9
push 0x3e2a
call fcn.0044e697
add esp, 0x28
jmp 0x4460f3
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4460cc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x446097
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x17
jmp 0x44602a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x10
jge 0x446095
mov dword [ebp - 0x30], 0xfffffffc
mov byte [ebp - 2], 0
lea eax, [ebp - 2]
push eax
push 0
call fcn.0043d8a7
pop ecx
pop ecx
push 0x4779
push 0x23c
push 0x6342
push 0x7a26
push 0x3298
push 0x3cd2
lea eax, [ebp - 0x30]
push eax
push 0
push 0x3cc9
push 1
push 0x189b
push 0
push 0x5c77
push 0xef7
push 0x65f3
call fcn.00440bfb
add esp, 0x3c
jmp 0x44601f
jmp 0x4460ca
mov byte [ebp - 3], 0
movzx eax, byte [ebp - 3]
test eax, eax
je 0x4460ca
push 0x446b
push 1
push 1
push 0x2de2
push 0xfde
push 0x47fe
push 0x94e
push 0
call fcn.00448db1
add esp, 0x20
jmp 0x4460f3
push 1
push 0x431f
push 0x4512
push 0x7065
push 1
push 1
push 0xffa
push 0x67ff
call fcn.0043774a
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x44879f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4487d7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x33cf
call fcn.00448886
add esp, 0x10
jmp 0x448882
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44884b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x448820
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44881e
push 0x21de
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x448849
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x448849
push 1
push 0
push 0x4fe4
push 0x19ac
push 0x2324
push 1
call fcn.00445dcc
add esp, 0x18
jmp 0x448882
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x448878
mov byte [ebp - 3], 0
push 1
push 0
push 1
push 0x7f1f
lea eax, [ebp - 3]
push eax
call fcn.0043d79a
add esp, 0x14
jmp 0x448882
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esp, ebp
pop ebp
ret