joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445004
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x27
pop ecx
xor eax, eax
lea edi, [ebp - 0xa0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x9c
push eax
call esi
test eax, eax
jne 0x445058
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x94
push eax
call esi
test eax, eax
jne 0x445058
xor ax, ax
jmp 0x4450e1
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub eax, ecx
je 0x4450d6
dec eax
je 0x4450a5
dec eax
je 0x44506f
mov dword [ebp - 4], ecx
jmp 0x4450dd
push 4
pop eax
cmp dword [ebp - 0x9c], eax
ja 0x44507d
mov dword [ebp - 4], eax
push 5
pop eax
cmp dword [ebp - 0x9c], eax
jne 0x4450dd
cmp dword [ebp - 0x98], ecx
jne 0x445093
mov dword [ebp - 4], eax
cmp dword [ebp - 0x98], 1
jne 0x4450dd
mov dword [ebp - 4], 6
jmp 0x4450dd
cmp dword [ebp - 0x9c], 4
jne 0x4450dd
cmp dword [ebp - 0x98], ecx
push 2
pop eax
jne 0x4450bc
mov dword [ebp - 4], eax
cmp dword [ebp - 0x98], 0xa
jne 0x4450c8
mov dword [ebp - 4], eax
cmp dword [ebp - 0x98], 0x5a
jne 0x4450dd
mov dword [ebp - 4], eax
jmp 0x4450dd
mov dword [ebp - 4], 1
mov ax, word [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x4453ea
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0xc], edi
mov dword [ebp - 4], edi
je 0x4454f1
lea eax, [ebp - 4]
push esi
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x40000
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4454e2
push dword [ebp + 0x10]
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x4454e2
cmp dword [ebp + 0x14], edi
je 0x4454df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4454e2
push edi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4454e2
mov esi, 0x105
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [ebp - 8], edi
pop ecx
mov ebx, eax
mov dword [ebp + 0xc], edi
jbe 0x4454d8
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, edi
jne 0x4454c6
push 1
push dword [ebp + 0x10]
push ebx
push dword [ebp - 4]
call fcn.004453ea
add esp, 0x10
jmp 0x4454cd
cmp eax, 0x103
je 0x4454d8
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jb 0x4454a1
push ebx
call fcn.0045c12b
pop ecx
push 1
pop ebx
cmp dword [ebp - 4], edi
pop esi
je 0x4454f1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop ebx
leave
ret
Function at 0x4455bf
Capabilities:
Enumerate browser history

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x403940
push 3
push 0
push str._J7_
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], 0x28
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x34]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x445625
mov eax, dword [ebp - 4]
push 0
push dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
jmp 0x4455fe
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
leave
ret

Function at 0x445642
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
mov ebx, 0x1000
push esi
push ebx
mov dword [ebp - 4], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push 0x40e84c
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
test eax, eax
mov dword [ebp - 8], eax
jne 0x445686
push esi
call fcn.0045c12b
pop ecx
jmp 0x445753
push edi
xor eax, eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4456b0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov al, byte [0x45e298]
mov ecx, 0x1ff
mov byte [ebp - 0x824], al
xor eax, eax
lea edi, [ebp - 0x823]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push dword [esi + 4]
lea eax, [ebp - 0x824]
push 0x40a158
push 0x800
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
mov edi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
add esp, 0x10
push dword [esi + 4]
call edi
test eax, eax
jne 0x445714
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x445714
push 0
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFile]
push dword [esi + 4]
call edi
push esi
call fcn.0045c12b
push ebx
mov dword [ebp - 4], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [esi], eax
pop ecx
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x445687
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.0045c12b
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x445757
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
sub esp, 0x20
push ebp
push esi
push edi
mov edi, 0x1000
push edi
mov dword [esp + 0x10], edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x10]
pop ecx
mov dword [esi], eax
lea eax, [esp + 0xc]
push eax
push esi
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov ebp, eax
test ebp, ebp
je 0x445830
push ebx
mov ebx, dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
xor eax, eax
push 1
push eax
push eax
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4457c0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, dword [esi + 0xc]
mov eax, 0x100000
and ecx, eax
cmp ecx, eax
je 0x4457f2
push dword [esi + 4]
call ebx
test eax, eax
jne 0x4457f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4457f2
push 0
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFile]
push dword [esi + 4]
call ebx
push esi
call fcn.0045c12b
push edi
mov dword [esp + 0x18], edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x18]
pop ecx
mov dword [esi], eax
pop ecx
lea eax, [esp + 0x10]
push eax
push esi
push ebp
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x445794
push ebp
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.0045c12b
pop ecx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x4466f5
Capabilities:
Allocate thread local storage
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x40e94c
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
xor esi, esi
test eax, eax
pop ecx
jne 0x446715
xor edi, edi
call fcn.00427374
mov dword [0x460944], eax
call fcn.00425c38
mov dword [0x531f58], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, 0x45eda8
mov dword [0x531f60], eax
call fcn.00421235
mov ecx, 0x460748
call fcn.00433439
call fcn.00447117
push dword [0x472a90]
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
cmp dword [0x470ef8], esi
je 0x44679a
push 0x40e988
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
mov dword [0x531f0c], eax
je 0x4467ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4467ba
push dword [0x531f0c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00446672
pop ecx
jmp 0x4467e6
push esi
push 0x40a2d4
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, esi
mov dword [0x531f5c], eax
je 0x4467ba
push edi
call fcn.00446672
test eax, eax
pop ecx
jne 0x4467e6
lea eax, [ebp - 8]
mov dword [ebp - 8], 8
push eax
mov dword [ebp - 4], 0x604
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push dword [ebp + 8]
call fcn.00446415
test eax, eax
pop ecx
jne 0x4467ed
xor eax, eax
jmp 0x446893
call fcn.00426820
test eax, eax
je 0x446802
cmp dword [0x472a88], esi
je 0x446802
push 5
jmp 0x446804
push 4
pop eax
mov edi, dword [sym.imp.GDI32.dll_CreateFontA]
push ebx
push 0x40a978
push esi
push eax
push esi
push esi
push 1
push esi
push esi
mov ebx, 0x190
push esi
push ebx
push esi
push esi
push esi
push 0xe
call edi
push 0x40a978
push esi
mov dword [0x473eac], eax
call fcn.00426820
neg eax
sbb eax, eax
neg eax
add eax, 4
push eax
push esi
push esi
push 1
push esi
push esi
push esi
push ebx
push esi
push esi
push esi
push 0xb
call edi
push 1
mov dword [0x473ea8], eax
call fcn.0041c1ba
pop ecx
mov ecx, 0x474b48
call fcn.00439920
mov ecx, 0x474ae0
call fcn.0043ef38
call fcn.0041e082
mov ecx, 0x4947d8
call fcn.00435ff8
call fcn.00414858
mov ecx, 0x473eb8
call fcn.0045b3dc
push 1
pop eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x446897
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403020
push 0x45c1d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push 1
call fcn.0043e6ff
pop ecx
push dword [0x531f60]
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, 0x474ae0
call fcn.0043edf7
mov ecx, 0x45f838
call fcn.0045908f
mov ecx, 0x5367d0
call fcn.0045908f
push ebx
call fcn.0041c1ba
pop ecx
call fcn.0041e0c0
mov eax, dword [0x473eac]
cmp eax, ebx
je 0x446913
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x473ea8]
cmp eax, ebx
je 0x446923
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.00446997
call fcn.0042adf4
call dword [sym.imp.ole32.dll_OleUninitialize]
mov byte [ebp - 0x11c], bl
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x103
lea eax, [ebp - 0x11c]
push eax
push 0x40a244
call fcn.00412a6b
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x446978
or dword [ebp - 4], 0xffffffff
push dword [0x531f0c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x446e07
Capabilities:
Delete file
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x40a2d4
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x446e30
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push ebx
push ebx
call fcn.0043d273
add esp, 0xc
call fcn.0043d54f
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov edi, 0x40ad8c
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push edi
push SysReAllocStringLen
call esi
push 0x40ea34
push SysReAllocStringLen
call esi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
push 0x40b32c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x103
push eax
push dword [0x531f10]
call fcn.00425d30
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.00425e07
add esp, 0x18
test eax, eax
pop edi
pop esi
pop ebx
je 0x446ebd
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
leave
ret

Function at 0x446f8b
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x472860], 0
push esi
je 0x446fee
mov esi, 0x472874
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x446fee
push esi
call fcn.00427747
pop ecx
test eax, eax
push esi
je 0x446fcd
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x531f10]
call fcn.00425d30
jmp 0x446fde
push 0x40a158
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add esp, 0x10
and byte [eax + ecx - 1], 0
jmp 0x447014
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push dword [ebp + 8]
push eax
push 0x40ea94
push 0x40ea50
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
push dword [ebp + 8]
call fcn.00424c03
pop ecx
pop esi
leave
ret
Function at 0x447442
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0045c140
and byte [ebp - 0x814], 0
push ebx
push esi
mov dword [ebp - 8], ecx
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
cmp dword [0x460944], 0
mov ebx, dword [ebp + 0x10]
stosw word es:[edi], ax
mov dword [ebp - 4], 3
mov esi, SysReAllocStringLen
stosb byte es:[edi], al
je 0x4474ca
cmp dword [ebp + 8], 0
jne 0x4474ca
lea eax, [ebp + 0x10]
push esi
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
push 0x40b770
mov dword [ebp + 0x10], 0x800
call fcn.00423bf1
add esp, 0x14
cmp eax, 1
jne 0x4474ca
push dword [ebp + 0x10]
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
push 0x41a
call fcn.0045b257
cmp dword [0x460944], 0
je 0x447564
cmp dword [ebp + 8], 0
je 0x447547
lea eax, [ebp - 0x1014]
mov dword [ebp + 8], 0x800
test eax, eax
je 0x447547
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x447547
push esi
lea eax, [ebp - 0x1014]
push dword [ebp + 8]
push eax
push ebx
push 0x40b770
call fcn.00423dc7
add esp, 0x14
cmp dword [0x460944], 0
je 0x447564
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x40ad8c
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44aef7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push esi
push edi
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 2
mov edi, eax
lea ecx, [ebp - 0x10]
pop eax
test ecx, ecx
mov dword [ebp - 0x58], eax
je 0x44af27
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
jmp 0x44af29
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push dword [ebp + 0x10]
push 0x100e
push edi
call esi
lea eax, [ebp - 0x58]
push eax
push 1
push 0x1019
push edi
call esi
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x10], eax
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], 0x104
mov dword [ebp - 8], eax
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
push 0x102d
push edi
call esi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x15c]
push eax
push 0
push 0x14d
push edi
call esi
mov eax, dword [ebp - 8]
push 0x40
sub eax, dword [ebp - 0x10]
push 0x12c
push eax
mov eax, dword [ebp - 0xc]
dec eax
push eax
push dword [ebp - 0x10]
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push 1
push 0x14f
push edi
call esi
pop edi
pop esi
leave
ret
Function at 0x44afce
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x44]
shr ebx, 8
and byte [ebp], 0
push esi
test bl, 2
push edi
je 0x44b048
lea eax, [esp + 0x10]
push eax
push 0x11
call fcn.0044afce
pop ecx
lea edi, [esp + 0x14]
pop ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4103c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test bl, 1
je 0x44b0ac
lea eax, [esp + 0x10]
push eax
push 0x10
call fcn.0044afce
pop ecx
lea edi, [esp + 0x14]
pop ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4103c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test bl, 4
je 0x44b10f
lea eax, [esp + 0x10]
push eax
push 0x12
call fcn.0044afce
pop ecx
or edx, 0xffffffff
pop ecx
lea edi, [esp + 0x10]
mov ecx, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, ebp
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4103c8
mov ecx, edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, ebp
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx eax, byte [esp + 0x48]
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
lea ecx, [esp + 0x10]
push 0x32
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x44dc58
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0045c140
and byte [ebp - 0x1004], 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, 0x40a6a0
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1004]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1000
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1004]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00426b23
lea eax, [ebp - 0x1004]
push eax
call fcn.004233e6
lea eax, [ebp - 0x1004]
push eax
call fcn.00425890
add esp, 0x10
test eax, eax
je 0x44dcf7
cmp dword [ebp + 8], 0
je 0x44dce6
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1004]
push eax
call fcn.00450d8c
jmp 0x44dd0a
push 0
push 0
push 1
push 1
push ebx
mov ecx, 0x474b78
call fcn.00415920
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x450008
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x40afd4]
push esi
push edi
mov dword [ebp - 0x18], eax
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 1
mov dword [ebp - 0x1c], ecx
stosb byte es:[edi], al
pop esi
lea eax, [ebp - 0xc]
push eax
push 0x4105fc
push SysReAllocStringLen
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45010d
push ebx
lea eax, [ebp - 0x15]
push 0xa
push eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll__itoa]
mov dword [ebp - 8], 0x103
call esi
add esp, 0xc
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x40], 7
push eax
lea eax, [ebp - 0x144]
push eax
push 0
lea eax, [ebp - 0x18]
push 0
push eax
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x450103
lea edi, [ebp - 0x144]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4500d3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x144]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x144]
push eax
call fcn.0045049b
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push eax
push 0xffffffffffffffff
push 0x401
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
inc dword [ebp - 4]
lea eax, [ebp - 0x15]
push 0xa
push eax
push dword [ebp - 4]
call esi
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x103
push eax
lea eax, [ebp - 0x144]
push eax
push 0
lea eax, [ebp - 0x18]
push 0
push eax
push dword [ebp - 0xc]
jmp 0x450084
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
leave
ret 4