joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f4a6
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0xc7c]
sub esp, 0xcfc
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0xc78], eax
push ebx
mov ebx, dword [ebp + 0xc84]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x80], eax
mov eax, 0x400
mov ecx, eax
push esi
mov dword [ebp - 0x70], eax
push edi
xor eax, eax
mov word [ebp - 0x7c], cx
mov word [ebp - 0x7a], cx
lea ecx, [ebp + 0x478]
mov word [ebp + 0x478], ax
push 0x3f5
mov eax, ecx
push eax
push str._PATHEXT_
mov dword [ebp - 0x78], 0x475d84
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x6c], 0x82
mov dword [ebp - 0x60], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp + 0x478], 0
je 0x40f53b
lea edi, [ebp + 0x478]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x40f52a
mov esi, 0x475d80
movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x478]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x40f543
push 0xa
pop ecx
lea eax, [ebp + 0x478]
push eax
lea eax, [ebp - 0x58]
mov esi, str..COM_.EXE_.BAT_.CMD
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.PPLIB32W.DLL__MakeFN_REGEXP_8]
mov ecx, dword [ebx + 0x1d40]
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebx + 0x1d50]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebx + 0x1d34]
imul eax, eax, 0x278
lea eax, [eax + ecx + 0x50]
push eax
call dword [sym.imp.PPLIB32W.DLL__FilenameRegularExpression_8]
test eax, eax
je 0x40f5a4
mov eax, 0x7fffffff
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
jmp 0x40f5ac
and dword [ebp - 0x68], 0
and dword [ebp - 0x64], 0
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.PPLIB32W.DLL__FreeFN_REGEXP_4]
mov ecx, dword [ebx + 0x1d40]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebx + 0x1d50]
mov eax, dword [ecx + eax*4]
imul eax, eax, 0x278
add eax, dword [ebx + 0x1d34]
push eax
push ebx
call fcn.0042d463
mov esi, eax
mov eax, dword [ebx + 0x1d20]
cmp eax, 0x40
je 0x40f5f3
cmp eax, 0x60
je 0x40f5f3
cmp eax, 0x50
jne 0x40f605
push esi
mov dword [ebx + 0x3114], 1
call fcn.004270bd
mov esi, eax
push 0x20
push esi
call fcn.0046891a
pop ecx
pop ecx
test eax, eax
push esi
lea eax, [ebp + 0x478]
je 0x40f621
push 0x475d48
jmp 0x40f626
push str.__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.PPLIB32W.DLL__tInputEx_4]
cmp dword [ebx + 0x3114], 0
mov esi, eax
je 0x40f64b
push ebx
call fcn.00449edb
test esi, esi
jg 0x40f656
mov eax, 0x4c7
jmp 0x40f665
lea edx, [ebp + 0x478]
mov ecx, ebx
call fcn.0040f40c
xor eax, eax
mov ecx, dword [ebp + 0xc78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0xc7c
leave
ret 4
Function at 0x40f74d
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x440]
sub esp, 0x4c0
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x43c], eax
push esi
mov esi, dword [ebp + 0x448]
push edi
push 0xc
lea eax, [ebp - 0x80]
push eax
xor edi, edi
push str.X_dlf
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], 0x80
call dword [sym.imp.PPLIB32W.DLL__GetCustData_12]
mov al, byte [ebp + 0x44c]
add al, 0x10
test dword [ebp + 0x44c], 0x400
movzx ax, al
mov word [ebp - 0x74], ax
je 0x40f7b1
add word [ebp - 0x74], 9
push 0x3a
pop eax
mov word [ebp - 0x72], ax
push 0x5c
pop eax
mov word [ebp - 0x70], ax
xor eax, eax
mov word [ebp - 0x6e], ax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [ebp - 0x74]
xor edx, edx
add ecx, 0xffffffbf
inc edx
shl edx, cl
test edx, eax
je 0x40f883
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f883
cmp dword [esi + 0x3814], edi
je 0x40f806
lea eax, [esi + 0x1d98]
push eax
push esi
call fcn.0040c67b
mov ax, word [esi + 0x584]
cmp ax, word [ebp - 0x74]
je 0x40f87a
test byte [ebp - 0x78], 1
jne 0x40f855
call dword [sym.imp.PPLIB32W.DLL__UsePPx_0]
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x78]
and eax, 0xffffff80
shl eax, 0x18
or eax, 0x4000
push eax
call dword [sym.imp.PPLIB32W.DLL__SearchPHistory_8]
cmp eax, edi
je 0x40f84f
lea edx, [ebp - 0x74]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x40f841
call dword [sym.imp.PPLIB32W.DLL__FreePPx_0]
cmp dword [esi + 0x3104], edi
je 0x40f869
lea edx, [ebp - 0x74]
mov ecx, esi
call fcn.004016aa
jmp 0x40f88e
push esi
call fcn.00427c7a
push edi
lea eax, [ebp - 0x74]
push eax
push esi
call fcn.00427b6e
push edi
push esi
call fcn.00418778
jmp 0x40f88e
push edi
push 0xf
pop edx
mov ecx, esi
call fcn.00427caa
mov ecx, dword [ebp + 0x43c]
pop edi
xor ecx, ebp
pop esi
call fcn.0046890b
add ebp, 0x440
leave
ret 8
Function at 0x411a77
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.0040e88b
test eax, eax
je 0x411bf9
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
push 0xf
call esi
cmp eax, ebx
je 0x411b42
lea ecx, [ebp - 0x18]
push ecx
xor edi, edi
push eax
inc edi
call fcn.00425f03
push str.Preferred_DropEffect
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push eax
call esi
mov esi, eax
cmp esi, ebx
je 0x411ae1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp + 0xc], ebx
jne 0x411b1a
mov esi, str.PasteMove
cmp edi, 2
je 0x411af5
mov esi, str.PasteCopy
push ebx
push ebx
push esi
push str.X_fopt
call dword [sym.imp.PPLIB32W.DLL__GetCustTable_16]
test eax, eax
jge 0x411b1f
cmp edi, 2
jne 0x411b13
mov esi, str.Move
jmp 0x411b1f
mov esi, str.Copy
jmp 0x411b1f
mov esi, str.MakeShortCut
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 8]
push 9
push ebx
lea ecx, [eax + 0x584]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push esi
push eax
call fcn.0044535a
jmp 0x411bf7
push str.FileContents
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push ebx
mov ebx, dword [sym.imp.USER32.dll_EnumClipboardFormats]
mov dword [ebp - 4], eax
jmp 0x411b69
cmp edi, dword [ebp - 4]
je 0x411bd3
cmp edi, 8
je 0x411bb4
cmp edi, 0x11
je 0x411bb4
push edi
call ebx
mov edi, eax
test edi, edi
jne 0x411b59
cmp edi, dword [ebp - 4]
je 0x411bd3
push 0xd
call esi
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x411bbe
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 8]
push ecx
push edi
push edi
push edi
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 4], edi
je 0x411bbe
cmp dword [ebp - 8], edi
je 0x411bbe
push 0xd
push ebx
jmp 0x411bc9
push edi
call esi
test eax, eax
je 0x411b71
push edi
jmp 0x411bc8
push 1
call esi
cmp eax, edi
je 0x411bd3
push 1
push eax
push dword [ebp + 8]
call fcn.00410254
jmp 0x411bf7
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp + 0xc], 0
mov eax, str.paste
je 0x411be9
mov eax, str.pastelink
push eax
push 0x473ab4
push dword [ebp + 8]
call fcn.00410286
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41254f
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2280]
push esi
mov esi, dword [eax + 0x3b9c]
push edi
xor edi, edi
jmp 0x4125bc
movzx eax, al
mov edx, dword [eax*4 + 0x473d00]
test dl, 1
je 0x41257e
movzx eax, byte [esi + 1]
imul eax, ebx
jmp 0x4125ca
test dl, 2
je 0x4125b3
cmp eax, 0x35
jg 0x4125d2
cmp eax, 0x34
jge 0x412604
cmp eax, 3
je 0x4125ce
jle 0x4125b3
cmp eax, 5
jle 0x412604
cmp eax, 0xe
je 0x4125ce
cmp eax, 0x24
je 0x412635
cmp eax, 0x25
je 0x4125c6
cmp eax, 0x2f
jne 0x4125b3
xor edi, edi
mov ecx, esi
call fcn.0041c246
add esi, eax
mov cl, byte [esi]
mov al, cl
test al, al
jne 0x412566
jmp 0x41262f
movzx eax, byte [esi + 1]
add edi, eax
jmp 0x4125b3
add edi, ebx
jmp 0x4125b3
cmp eax, 0x36
je 0x41263d
cmp eax, 0x3a
jle 0x4125b3
cmp eax, 0x3c
jle 0x412635
cmp eax, 0x3d
jle 0x4125b3
cmp eax, 0x3f
jle 0x412604
cmp eax, 0x40
je 0x4125fa
cmp eax, 0x41
jne 0x4125b3
movzx edi, cl
jmp 0x4125b3
movzx eax, word [esi]
cdq
idiv ebx
mov edi, eax
jmp 0x4125b3
movzx eax, byte [esi + 2]
cmp eax, 0xff
movzx ecx, byte [esi + 1]
jl 0x412615
xor eax, eax
add eax, ecx
imul eax, ebx
add edi, eax
test ecx, ecx
je 0x4125b3
mov eax, dword [esp + 0x10]
add eax, 0x3108
cmp edi, dword [eax]
jae 0x41262f
mov dword [eax], edi
pop edi
pop esi
pop ebx
ret 4
lea edi, [edi + ebx*2]
jmp 0x4125b3
movzx eax, byte [esi + 6]
add edi, eax
movzx eax, byte [esi + 4]
jmp 0x4125ba
Function at 0x413953
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8f0]
sub esp, 0x970
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x8ec], eax
push esi
push edi
mov edi, dword [ebp + 0x8f8]
mov eax, dword [edi + 0xc]
mov esi, 0x8000000
mov dword [ebp - 0x80], 0xa
test esi, eax
je 0x413aed
mov eax, dword [edi + 0x9b4]
cmp eax, 2
je 0x413aed
cmp eax, 4
je 0x413aed
push ebx
xor ebx, ebx
push ebx
lea eax, [edi + 0x2c]
push eax
lea eax, [ebp + 0x43c]
push eax
call fcn.004136d1
push ebx
push esi
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp + 0x43c]
push eax
call dword [sym.imp.PPLIB32W.DLL__CreateFileL_28]
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x413a2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x413a18
mov eax, dword [ebp - 0x80]
dec dword [ebp - 0x80]
test eax, eax
je 0x413a25
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp + 0x43c]
push eax
call dword [sym.imp.PPLIB32W.DLL__CreateFileL_28]
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
je 0x4139d9
jmp 0x413a25
push eax
push str.Dir_Cache_save_error
push ebx
call dword [sym.imp.PPLIB32W.DLL__PPErrorBox_12]
cmp dword [ebp - 0x78], 0xffffffff
je 0x413aec
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0x7c]
push eax
push 2
push 0x4758e4
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x22
push str._ListFile_r_n_Base
push dword [ebp - 0x78]
call esi
lea eax, [edi + 0x2c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x413a5d
sub eax, ecx
push ebx
sar eax, 1
lea ecx, [ebp - 0x7c]
push ecx
add eax, eax
push eax
lea eax, [edi + 0x2c]
push eax
push dword [ebp - 0x78]
call esi
push dword [edi + 0x9b4]
lea eax, [ebp - 0x74]
push str._d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
mov dword [ebp - 0x7c], eax
lea ecx, [ebp - 0x7c]
push ecx
add eax, eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
call esi
mov esi, dword [edi + 0x20]
mov edi, dword [edi + 0x18]
cmp edi, ebx
je 0x413ae3
lea ecx, [esi + 0x2c]
cmp word [ecx], 0x2e
jne 0x413ad0
movzx eax, word [esi + 0x2e]
cmp ax, bx
je 0x413ada
cmp ax, 0x2e
jne 0x413ad0
cmp word [esi + 0x30], bx
je 0x413ada
push ecx
push esi
push dword [ebp - 0x78]
call fcn.004287e2
add esi, 0x250
dec edi
jne 0x413ab2
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp + 0x8ec]
pop edi
xor ecx, ebp
pop esi
call fcn.0046890b
add ebp, 0x8f0
leave
ret 4
Function at 0x41460b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x25
push esi
call fcn.0046891a
pop ecx
pop ecx
test eax, eax
je 0x414654
mov edi, 0x258
push edi
lea eax, [ebp - 0x4b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
jb 0x41464e
xor eax, eax
inc eax
jmp 0x4146b9
lea esi, [ebp - 0x4b4]
push 0x3a
push esi
call fcn.0046891a
pop ecx
pop ecx
test eax, eax
jne 0x414649
movzx eax, word [esi]
cmp ax, 0x5c
je 0x414649
test ax, ax
je 0x4146b7
push 2
pop edi
xor ecx, ecx
cmp ax, 0x2e
jne 0x414688
add esi, edi
inc ecx
cmp word [esi], 0x2e
je 0x41467b
jmp 0x414688
add esi, edi
cmp word [esi], 0x20
je 0x414686
cmp ecx, edi
jl 0x4146a0
movzx eax, word [esi]
test ax, ax
je 0x414649
cmp ax, 0x5c
je 0x414649
push esi
call dword [sym.imp.PPLIB32W.DLL__FindPathSeparator_4]
mov esi, eax
test esi, esi
je 0x4146b7
add esi, edi
movzx eax, word [esi]
test ax, ax
jne 0x414673
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046890b
leave
ret 4
Function at 0x41943e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x21a4]
mov eax, 0x2224
call fcn.00468c00
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x21a0], eax
mov eax, dword [ebp + 0x21ac]
push esi
push 0x2e
push eax
call fcn.00468940
xor esi, esi
pop ecx
pop ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x7c], esi
cmp eax, esi
jne 0x419481
xor eax, eax
jmp 0x41954f
push eax
lea eax, [ebp - 0x68]
push str._sOpenWithProgids
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x68]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41947a
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x1f98]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x419523
cmp word [ebp + 0x1f98], 0x57
jne 0x419504
cmp word [ebp + 0x1f9a], 0x4d
jne 0x419504
cmp word [ebp + 0x1f9c], 0x50
jne 0x419504
cmp word [ebp + 0x1f9e], 0x30
jb 0x419504
cmp word [ebp + 0x1f9e], 0x39
jbe 0x41953c
inc dword [ebp - 0x70]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x1f98]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], 0x104
mov dword [ebp - 0x78], 0x1000
call esi
test eax, eax
je 0x4194d2
jmp 0x419543
mov dword [ebp - 0x7c], 1
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp + 0x21a0]
xor ecx, ebp
pop esi
call fcn.0046890b
add ebp, 0x21a4
leave
ret 4
Function at 0x41a005
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 0x6d
push dword [esi + 0xc]
call edi
push 0x71
push dword [esi + 0xc]
call edi
lea edi, [esi + 0x3800]
mov eax, dword [edi]
test eax, eax
je 0x41a049
cmp dword [esi + 0x3804], 4
jne 0x41a040
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [edi], 0
jmp 0x41a049
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0x3808], 0xfffffc00
pop edi
pop esi
ret 4

Function at 0x41b0cd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3ac]
sub esp, 0x42c
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x3a8], eax
or dword [0x489634], 0xffffffff
push esi
lea eax, [ebp - 0x74]
push eax
push 0x20019
xor esi, esi
push esi
push 0x476c58
push 0x80000002
mov dword [ebp - 0x70], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b1dc
mov eax, 0x104
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1a0]
push eax
push esi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x41b1d3
push ebx
push edi
mov edi, dword [sym.imp.PPLIB32W.DLL__GetNumber_4]
lea eax, [ebp + 0x1a0]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
call edi
mov ebx, eax
cmp ebx, 0x7e3
jbe 0x41b19a
add dword [ebp - 0x6c], 2
lea eax, [ebp - 0x6c]
push eax
call edi
imul ebx, ebx, 0x64
add dword [ebp - 0x6c], 2
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
add esi, ebx
call edi
imul esi, esi, 0x64
add eax, esi
cmp dword [0x489634], eax
jbe 0x41b19a
mov dword [0x489634], eax
inc dword [ebp - 0x70]
mov eax, 0x104
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1a0]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x41b154
pop edi
pop ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x3a8]
xor ecx, ebp
pop esi
call fcn.0046890b
add ebp, 0x3ac
leave
ret
Function at 0x41b1f2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3bc]
sub esp, 0x43c
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x3b8], eax
mov eax, dword [ebp + 0x3c8]
push esi
mov esi, dword [ebp + 0x3c4]
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x64]
push eax
push 0x20019
xor edi, edi
push edi
push 0x476c58
push 0x80000002
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x60], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41b24e
xor eax, eax
jmp 0x41b3b5
cmp word [ebp + 0x3cc], 0x20
ja 0x41b270
movzx eax, word [esi]
movzx ecx, word [esi + 2]
imul eax, eax, 0x64
add eax, ecx
movzx ecx, word [esi + 6]
imul eax, eax, 0x64
add eax, ecx
mov dword [ebp - 0x7c], eax
mov eax, 0x104
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x1b0]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x41b3a9
mov edi, dword [sym.imp.PPLIB32W.DLL__GetNumber_4]
push ebx
mov ax, word [ebp + 0x3cc]
cmp ax, 0x20
ja 0x41b352
lea eax, [ebp - 0x58]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
call edi
add dword [ebp - 0x5c], 2
mov ebx, eax
lea eax, [ebp - 0x5c]
push eax
call edi
imul ebx, ebx, 0x64
add dword [ebp - 0x5c], 2
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
add esi, ebx
call edi
imul esi, esi, 0x64
add eax, esi
cmp dword [ebp - 0x7c], eax
jb 0x41b35b
xor edx, edx
cmp word [ebp + 0x3cc], dx
jne 0x41b31b
mov ecx, 0x2710
div ecx
mov ecx, dword [ebp - 0x78]
movzx ecx, word [ecx]
sub ecx, eax
movzx eax, word [ebp + 0x1ba]
inc ecx
push ecx
push eax
push str._c_02d
jmp 0x41b341
xor ecx, ecx
mov word [ebp + 0x1b4], cx
mov ecx, 0x2710
div ecx
mov ecx, dword [ebp - 0x78]
movzx ecx, word [ecx]
sub ecx, eax
inc ecx
push ecx
lea eax, [ebp + 0x1b0]
push eax
push str._s_02d
push dword [ebp - 0x74]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x60], eax
jmp 0x41b35b
cmp ax, word [ebp + 0x1ba]
je 0x41b398
inc dword [ebp - 0x68]
mov eax, 0x104
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x1b0]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x41b2ac
jmp 0x41b3a8
lea eax, [ebp - 0x58]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
call edi
dec eax
mov dword [ebp - 0x60], eax
pop ebx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp + 0x3b8]
pop edi
xor ecx, ebp
pop esi
call fcn.0046890b
add ebp, 0x3bc
leave
ret 0xc
Function at 0x42328c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4232a2
xor eax, eax
inc eax
jmp 0x423417
push 0x91
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4232be
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.USER32.dll_BeginPaint]
jmp 0x42329a
cmp dword [esi + 0xc], 0
jne 0x4232ce
push esi
call fcn.00422d77
test eax, eax
je 0x4232b1
cmp dword [esi + 0xc0], 0
fld qword [0x477110]
push ebx
push edi
mov ebx, 0xff00ff00
mov edi, 0xff
jne 0x423357
mov ecx, dword [esi + 0xc4]
movzx edx, byte [esi + 0xc6]
movzx eax, cl
and ecx, ebx
shl eax, 0x10
or eax, edx
or eax, ecx
mov ecx, eax
shr ecx, 0x10
and ecx, edi
mov dword [ebp + 8], ecx
mov ecx, eax
shr ecx, 8
fild dword [ebp + 8]
and ecx, edi
mov dword [ebp + 8], ecx
movzx eax, al
fdiv st(1)
movss xmm0, dword [0x477118]
lea ecx, [esi + 0xc0]
push ecx
push 0
lea ecx, [ebp - 0x10]
push ecx
movss dword [ebp - 4], xmm0
fstp dword [ebp - 0x10]
fild dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0xc]
push eax
fdiv st(1)
fstp dword [ebp - 0xc]
fidivr dword [ebp + 8]
fstp dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
jmp 0x423359
fstp st(0)
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xe4]
test al, 1
je 0x42337a
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
jmp 0x423415
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc0]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
lea edx, [esi + 0x18]
push edx
push eax
call dword [ecx + 0x78]
mov ecx, dword [esi + 0x70]
movzx edx, byte [esi + 0x72]
movzx eax, cl
and ecx, ebx
shl eax, 0x10
or eax, edx
or eax, ecx
mov ecx, eax
shr ecx, 0x10
and ecx, edi
mov dword [ebp + 8], ecx
mov ecx, eax
shr ecx, 8
fild dword [ebp + 8]
and ecx, edi
fld qword [0x477110]
mov dword [ebp + 8], ecx
movzx eax, al
fdiv st(1), st(0)
movss xmm0, dword [0x477118]
lea edx, [ebp - 0x10]
push edx
movss dword [ebp - 4], xmm0
fxch st(1)
fstp dword [ebp - 0x10]
fild dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0xc]
push eax
fdiv st(1)
fstp dword [ebp - 0xc]
fidivr dword [ebp + 8]
fstp dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0xbc]
mov eax, dword [ebp + 0xc]
and dword [eax], 0
and dword [eax + 4], 0
add esi, 0x84
lea edi, [eax + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 2
movsd dword es:[edi], dword [esi]
pop eax
pop edi
pop ebx
pop esi
leave
ret 8

Function at 0x42688b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
call fcn.00456f7f
mov ecx, 0x4d42
mov word [ebp - 0x10], cx
mov ecx, dword [ebp + 0x10]
add eax, 0xe
mov dword [ebp - 0xe], ecx
xor ecx, ecx
push ecx
mov dword [ebp - 6], eax
lea eax, [ebp + 0xc]
push eax
push 0xe
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov word [ebp - 0xa], cx
mov word [ebp - 8], cx
call dword [sym.imp.KERNEL32.dll_WriteFile]
leave
ret 0xc