joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x474b49
jmp 0x474bde
lea ecx, [ebp - 0xc]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 1
je 0x474b78
cmp dword [ebp - 8], 2
je 0x474b78
jmp 0x474bde
mov ecx, dword [ebp + 0xc]
call fcn.00406ae0
mov eax, dword [ebp - 0xc]
shr eax, 1
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00406830
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x474bbf
jmp 0x474bde
mov ecx, dword [ebp - 0xc]
shr ecx, 1
mov edx, dword [ebp - 4]
mov word [edx + ecx*2], 0
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.0040d520
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x476630
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x476656
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47675e
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 2
push 0x10
push 0x32
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47672b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x4766b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x14]
jmp 0x47675e
push 2
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4766e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x18]
jmp 0x47675e
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
push 1
push 2
push 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47672b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1c]
jmp 0x47675e
mov dword [ebp - 8], 0
mov edx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
lea eax, [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x476770
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x476793
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47680d
push 0x10000
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4767c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
jmp 0x47680d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4767f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10]
jmp 0x47680d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x476820
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x476849
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x476976
push 0x14
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47687d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x2c]
jmp 0x476976
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4768b7
cmp dword [ebp - 0x20], 4
jne 0x4768b7
xor eax, eax
jmp 0x476976
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4768ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x30]
jmp 0x476976
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x47695f
mov dword [ebp - 0x34], 0
cmp dword [ebp + 0xc], 0
jl 0x476913
mov eax, dword [ebp - 0x34]
imul eax, eax, 0x64
cmp eax, dword [ebp + 0xc]
jge 0x47695f
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x476935
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x47695f
cmp dword [ebp - 0x20], 1
jne 0x476944
mov dword [ebp - 4], 0xe0000018
jmp 0x47695f
cmp dword [ebp - 0x20], 4
jne 0x47694c
jmp 0x47695f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
jmp 0x476902
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x476980
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4769a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x476ac5
push 0x24
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4769dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x2c]
jmp 0x476ac5
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x24]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x476a31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x30]
jmp 0x476ac5
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x476aae
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x50], 0
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
cmp dword [ebp + 0xc], 0
jl 0x476a71
mov eax, dword [ebp - 0x34]
imul eax, eax, 0x64
cmp eax, dword [ebp + 0xc]
jge 0x476aae
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x476a93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x476aae
cmp dword [ebp - 0x4c], 1
jne 0x476a9b
jmp 0x476aae
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
jmp 0x476a60
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4775f0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47762c
jmp 0x4776af
lea ecx, [ebp - 0x1c]
push ecx
push 0x545c68
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x477648
jmp 0x4776af
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
push 0
push 0
push 0
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x477678
jmp 0x4776af
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 6
push 0x40000
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
je 0x4776a0
jmp 0x4776af
mov dword [ebp - 4], 1
xor edx, edx
jne 0x47760b
cmp dword [ebp - 8], 0
je 0x4776bf
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x486140
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5297c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
mov dword [ebp - 0x220], ecx
mov eax, dword [ebp - 0x220]
cmp dword [eax + 4], 0
je 0x48617e
mov ecx, dword [ebp - 0x220]
mov eax, dword [ecx + 4]
jmp 0x4862f2
mov ecx, dword [ebp - 0x220]
add ecx, 0x60
call fcn.00477060
push eax
lea ecx, [ebp - 0x110]
call fcn.0044c800
mov dword [ebp - 0x224], eax
mov edx, dword [ebp - 0x224]
mov dword [ebp - 0x228], edx
mov dword [ebp - 4], 0
push 0x545e14
mov eax, dword [ebp - 0x220]
add eax, 0x4c
push eax
mov ecx, dword [ebp - 0x228]
call fcn.00477060
push eax
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx + 8]
push edx
call fcn.0047def0
add esp, 0x10
mov ecx, dword [ebp - 0x220]
mov dword [ecx + 4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.0040d580
mov ecx, dword [ebp - 0x220]
add ecx, 0x64
call fcn.0040b3b0
movzx edx, al
test edx, edx
jne 0x4862ed
push 0x400000
lea eax, [ebp - 0x114]
push eax
call fcn.0050db60
add esp, 8
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], ecx
mov dword [ebp - 4], 1
push str.data_skin_skincfg.ini
mov edx, dword [ebp - 0x230]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.0040b1c0
add esp, 0xc
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x238], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x220]
add ecx, 0x64
call fcn.00477060
push eax
lea ecx, [ebp - 0x21c]
call fcn.0044c800
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x238]
call fcn.00477060
push eax
push 0xff
mov ecx, dword [ebp - 0x23c]
call fcn.00477060
push eax
push str.alpha
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x220]
mov dword [edx + 0x30], eax
lea ecx, [ebp - 0x21c]
call fcn.0040d580
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x118]
call fcn.004070b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.004070b0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4886f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
lea ecx, [ebp - 0x70]
call fcn.004070d0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x545b84
lea edx, [ebp - 0x70]
push edx
call fcn.00407e40
add esp, 0x10
mov dword [ebp - 0x6c], 0
push 0x40
push 0
lea eax, [ebp - 0x68]
push eax
call fcn.0049e730
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 1
mov word [ebp - 0x3c], 0
cmp dword [ebp + 0x10], 0
je 0x48876a
mov word [ebp - 0x3c], 0xa
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x70]
call fcn.00477060
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x20], 0
je 0x4887d1
cmp dword [ebp - 0x10], 0
je 0x4887c0
cmp dword [ebp + 0x14], 0
je 0x4887c0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
jmp 0x4887d1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x1c], 0
je 0x4887e8
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x74], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.004070b0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x488810
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529709
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.0049e730
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.004070d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.004070d0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x220]
call fcn.00406b50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.0040b3b0
movzx edx, al
test edx, edx
je 0x4888a9
lea eax, [ebp - 0x220]
push eax
call fcn.0045c480
add esp, 4
push str.data_baseconfig.dat
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x228]
push edx
call fcn.0040b1c0
add esp, 0xc
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x224]
call fcn.00404380
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.004070b0
lea ecx, [ebp - 0x224]
call fcn.00477060
push eax
push 0x208
lea edx, [ebp - 0x21c]
push edx
push 0x544bdc
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x48893b
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00407020
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406750
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
call fcn.004070b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.004070b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004070b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x489c70
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x489c9d
call fcn.00437cc0
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x489c9d
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x489ccf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp + 8], eax
je 0x489ccf
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x489ccf
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x4dc], 0
push ecx
mov ecx, esp
push 0
call fcn.00492af0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0048b800
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x489d12
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x489e34
mov eax, dword [ebp - 8]
push eax
call fcn.00437c80
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x489d33
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0044f270
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x4d0], 0
je 0x489dbb
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x10]
je 0x489d99
push 1
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x10]
je 0x489dbb
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp - 0x1c]
call fcn.0048bb70
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x4dc], 0
push 0x97
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.0045b370
cmp dword [ebp - 4], 0
je 0x489e1a
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp + 8], 0
je 0x489e1a
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ecx + 4]
jne 0x489e1a
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [ebp - 0xc]
push eax
call fcn.00437c80
add esp, 4
mov ecx, dword [ebp - 0x1c]
call fcn.0044eec0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 0x28]
mov esp, ebp
pop ebp
ret 8
Function at 0x48df60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
add ecx, 4
call fcn.0045a780
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x3c0], 0
je 0x48dfa8
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0x3c0], 0
mov edx, dword [ebp - 0x34]
cmp dword [edx + 0x3b4], 0
je 0x48e08f
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x3b4]
push ecx
call fcn.00416df0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48e082
push 2
push 0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x34]
call fcn.0048f860
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov edx, dword [eax + 0x3b4]
cmp edx, dword [ecx + 0x3b0]
jne 0x48e082
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movzx eax, dx
shl eax, 0x10
or ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push ecx
push 0x202
mov ecx, dword [ebp - 8]
call fcn.00417630
mov ecx, dword [ebp - 8]
call fcn.00417900
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x48e064
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
test eax, eax
je 0x48e064
push 1
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
jmp 0x48e082
mov ecx, dword [ebp - 8]
call fcn.00402b20
test eax, eax
je 0x48e082
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
call fcn.00402b20
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x3b4], 0
cmp dword [ebp - 0xc], 0
je 0x48e0f3
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x34]
add ecx, 4
call fcn.00493150
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x4e
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 4
call fcn.00493170
mov ecx, eax
call fcn.00477060
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x2c], eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x48ec40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00492da0
test eax, eax
je 0x48eca5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x48ec9b
cmp dword [ebp + 8], 0x1b
jne 0x48ec81
push 0
push 2
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0045b4d0
jmp 0x48ec9b
cmp dword [ebp + 8], 0xd
jne 0x48ec9b
push 0
push 1
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0045b4d0
push 0
mov ecx, dword [ebp - 4]
call fcn.0048f010
mov esp, ebp
pop ebp
ret 0xc