joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fca0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43fd3f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00447be7
lea ecx, [0x4459d0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call dbg.runtime.systemstack
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.callers
Function at 0x447570
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4475b0
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x5551a0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4475eb
je 0x44763a
cmp ebx, 0x20
jbe 0x447640
cmp ebx, 0x40
jbe 0x44767e
jmp 0x44770f
test ebx, ebx
je 0x447630
add eax, 0x10
test ax, 0xff0
je 0x44761c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4df880]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4df980]
jmp 0x447608
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x447608
pxor xmm1, xmmword [0x5551b0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5551b0]
pxor xmm2, xmmword [0x5551c0]
pxor xmm3, xmmword [0x5551d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5551b0]
pxor xmm2, xmmword [0x5551c0]
pxor xmm3, xmmword [0x5551d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x44776e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
Function at 0x448630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x238
mov dword [esp], esp
mov dword [esp + 4], 0x238
call dbg.runtime.memclrNoHeapPointers
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call dbg.runtime.memclrNoHeapPointers
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x448730
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call dbg.runtime.stackcheck
call dbg.runtime.mstart
ret
Function at 0x4580e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x458202
sub esp, 0x4c
mov eax, dword [esp + 0x64]
test eax, eax
jle 0x4581fb
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x40], ecx
mov eax, dword [0x542744]
mov dword [esp], eax
call dbg.syscall.(*LazyProc).Addr
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov dword [esp], eax
mov dword [esp + 4], 7
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dbg.syscall.Syscall9
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x4581f5
test ecx, ecx
je 0x4581e7
cmp ecx, 0x3e5
jne 0x4581bb
mov ecx, dword [0x53eefc]
mov edx, dword [0x53eef8]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
lea eax, [0x4df2b0]
mov dword [esp], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call dbg.runtime.convT2I32
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x38]
jmp 0x4581ab
lea ecx, [0x4deb44]
lea edx, [0x4df2b0]
jmp 0x4581ab
xor edx, edx
mov ecx, edx
jmp 0x4581ab
xor ecx, ecx
jmp 0x458109
call dbg.runtime.morestack_noctxt
jmp dbg.syscall.formatMessage
Function at 0x459570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45967c
sub esp, 0x4c
mov eax, dword [0x54287c]
mov dword [esp], eax
call dbg.syscall.(*LazyProc).Addr
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], eax
call dbg.syscall.Syscall9
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x459676
test ecx, ecx
je 0x459668
cmp ecx, 0x3e5
jne 0x459644
mov eax, dword [0x53eef8]
mov ecx, dword [0x53eefc]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], ecx
lea eax, [0x4df2b0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call dbg.runtime.convT2I32
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x459638
lea ecx, [0x4deb24]
lea eax, [0x4df2b0]
jmp 0x459638
xor ecx, ecx
mov eax, ecx
jmp 0x459638
call dbg.runtime.morestack_noctxt
jmp dbg.syscall.WSAIoctl
Function at 0x401000
Capabilities:
Execute command
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp word [ebp - 0x12], 9
jne 0x40109c
cmp word [ebp - 0xe], 8
jne 0x40109c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
push 0x7530
call ebx
push 1
push str.Background.png
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x20001
push 0
push str.Audio.wav
call dword [sym.imp.WINMM.dll_PlaySoundW]
push 0x1770
call ebx
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov esi, 0xb
push str.start_chrome__https:__www.google.com_search_q_D0_A1_D0_B4_D0_BD_D1_91_D0_BC_D1_80_D0_BE_D0_B6_D0_B4_D0_B5_D0_BD_D0_B8_D1_8F_oq_D0_A1_D0_B4_D0_BD_D1_91_D0_BC_D1_80_D0_BE_D0_B6_D0_B4_D0_B5_D0_BD_D0_B8_D1_8F_gs_lcrpEgZjaHJvbWUyBggAEEUYOdIBCDg3NjNqMGoxqAIAsAIBsourceidchromeieUTF_8_
call edi
add esp, 4
sub esi, 1
jne 0x401083
push 0xea60
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004010ac
mov esp, ebp
pop ebp
ret

Function at 0x4018b7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018f6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018f6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018f6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018f6
cmp dword [ecx + 0x74], 0xe
jbe 0x4018f6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401087
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push edi
lea eax, [ebp - 0x118]
push eax
mov edi, 0x104
push edi
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
call fcn.00401401
call fcn.00443420
test eax, eax
je 0x4010d6
push 0x10
push 0x468eee
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4012b8
cmp dword [0x47d670], 0
push ebx
push esi
jne 0x401106
push 0xffffffffffffffff
push dword [0x47d678]
mov esi, 0x47ee88
push 1
call fcn.00405f74
mov al, byte [0x47354c]
mov byte [0x47ee8a], al
mov ebx, 0x47d684
jmp 0x40115c
lea eax, [ebp - 2]
push eax
push 0x47d670
mov esi, 0x47d684
mov ebx, 0x47ee88
call fcn.00406540
test al, al
jne 0x401131
mov dword [0x473564], 1
jmp 0x4012a9
mov al, byte [0x47ee88]
mov byte [0x47d674], al
mov al, byte [0x47ee89]
push 0x47d66c
mov byte [ebp - 1], al
lea eax, [ebp - 0x220]
push eax
push edi
mov ebx, 0x47d684
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push dword [0x47d670]
push ebx
call fcn.0041886f
test eax, eax
je 0x401192
mov edi, 0x47ee88
call fcn.004060c7
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [0x473564], 1
jmp 0x4012b6
cmp byte [ebp - 1], 1
jne 0x401244
cmp byte [0x47d645], 1
jne 0x401244
call fcn.0040d188
test al, al
jne 0x401244
push edi
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 2], 0
je 0x40121d
mov edi, 0x468f58
push edi
lea esi, [ebp - 0x10]
call fcn.0040dab0
push ebx
mov eax, esi
call fcn.0040dc7f
push edi
mov eax, esi
call fcn.0040dc7f
push 1
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x220]
push eax
push str.runas
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push dword [ebp - 0x10]
call fcn.0044d0f0
pop ecx
jmp 0x40129f
push 1
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x220]
push eax
push str.runas
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40129f
call fcn.004012bd
call fcn.00401390
cmp byte [0x47d674], 0
jne 0x401261
mov edi, 0x47dec8
call fcn.004097d6
push 1
mov eax, 0x47d790
call fcn.004189cf
cmp byte [0x47d674], 0
jne 0x40129f
mov edi, 0x47e654
mov esi, dword [edi]
test esi, esi
je 0x401294
push dword [esi + 8]
call fcn.0044d0f0
push esi
call fcn.0044d0f0
and dword [edi], 0
pop ecx
pop ecx
add edi, 4
cmp edi, 0x47ee70
jl 0x40127b
mov edi, 0x47ee88
call fcn.004060c7
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x401e6d
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esi]
push ebp
xor ebp, ebp
cmp eax, ebp
jne 0x401e7d
xor al, al
jmp 0x401f07
push ebx
push edi
push 1
push eax
call fcn.00403148
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebp
push 0x25
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x10], ebp
push eax
jge 0x401ec9
push 0x25
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x401eeb
push 0x27
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push dword [esi]
call fcn.00403148
pop edi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x40238a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
jne 0x40239d
xor al, al
jmp 0x4023d5
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0xb0
push eax
call esi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x4023c0
xor al, al
jmp 0x4023d4
push edi
push 0
push 0
push 0xe
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jne 0x4023da
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
lea eax, [edi + 0x101]
push eax
call fcn.0044d086
pop ecx
push eax
mov dword [ebp - 4], eax
lea eax, [edi + 1]
push eax
push 0xd
push dword [ebx]
call esi
test eax, eax
je 0x402427
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x402407
mov ecx, dword [ebp - 4]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp + 8]
push ecx
call fcn.0040dbc1
mov bl, 1
push dword [ebp - 4]
call fcn.0044d0f0
pop ecx
mov al, bl
jmp 0x4023d3
xor bl, bl
jmp 0x40241a
Function at 0x402e3b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp byte [esi + 8], 0
push edi
je 0x402e73
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [esi + 0x30], eax
jne 0x402e6c
mov dword [esi + 0x3c], edi
xor eax, eax
jmp 0x402f84
mov dword [ebp - 4], 1
cmp byte [esi + 4], 0
mov edi, dword [sym.imp.USER32.dll_GetClassNameA]
push ebx
mov ebx, 0x100
je 0x402eb2
push ebx
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 8]
call edi
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x40c]
push ecx
push eax
call fcn.0044d5b0
test eax, eax
pop ecx
pop ecx
jne 0x402eaf
mov dword [ebp - 8], 1
inc dword [ebp - 4]
cmp byte [esi + 7], 0
je 0x402f1d
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x40c]
push eax
push ebx
call edi
mov edi, dword [esi + 0x18]
lea eax, [ebp - 0x40c]
push eax
call fcn.0044d720
push eax
lea eax, [ebp - 0x40c]
push eax
push edi
call fcn.0044d65f
add esp, 0x10
test eax, eax
jne 0x402f18
inc dword [esi + 0x40]
push dword [esi + 0x40]
lea eax, [ebp - 0x40c]
push eax
push str._s_u
push eax
call fcn.0044d7ab
push dword [esi + 0x18]
lea eax, [ebp - 0x40c]
push eax
call fcn.0044d5b0
add esp, 0x18
test eax, eax
je 0x402f79
inc dword [ebp - 4]
jmp 0x402f20
mov ebx, dword [ebp + 8]
cmp byte [esi + 6], 0
je 0x402f52
push 0x400
lea eax, [ebp - 0x40c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0x40c]
push ecx
push eax
call fcn.0044d5b0
test eax, eax
pop ecx
pop ecx
je 0x402f79
inc dword [ebp - 4]
cmp byte [esi + 5], 0
je 0x402f71
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x402f6e
inc dword [esi + 0x40]
mov eax, dword [esi + 0x40]
cmp eax, dword [esi + 0x34]
jne 0x402f6e
inc dword [ebp - 8]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jne 0x402f80
mov dword [esi + 0x3c], ebx
xor eax, eax
jmp 0x402f83
xor eax, eax
inc eax
pop ebx
pop edi
leave
ret 4

Function at 0x403148
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x403173
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x40318e
push 1
jmp 0x403175
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret 8
Function at 0x40322b
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [esp + 8]
push 0x468eee
call fcn.0040dbc1
mov eax, dword [ebx]
test eax, eax
jne 0x403248
xor al, al
pop ebx
ret 4
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push edi
push 0
push 0
push 0xe
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x403265
mov esi, 0x7fff
lea eax, [esi + 2]
push eax
call fcn.0044d086
pop ecx
mov edi, eax
push edi
lea eax, [esi + 1]
push eax
push 0xd
push dword [ebx]
call ebp
mov byte [edi + esi], 0
test eax, eax
jle 0x40329e
mov eax, dword [esp + 0x14]
push edi
call fcn.0040dbc1
mov bl, 1
push edi
call fcn.0044d0f0
pop ecx
pop edi
pop esi
mov al, bl
pop ebp
jmp 0x403244
xor bl, bl
jmp 0x403290
Function at 0x403979
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
and dword [ebp - 4], 0
and dword [ebp - 8], 0
cmp byte [ebx + 0xb], 0
je 0x403999
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp byte [ebx + 9], 0
push esi
mov esi, 0x400
je 0x4039d2
push esi
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameA]
mov eax, dword [ebx + 0x58]
lea ecx, [ebp - 0x418]
push ecx
push eax
call fcn.0044d5b0
test eax, eax
pop ecx
pop ecx
jne 0x4039cf
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [ebx + 6], 0
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
je 0x403a68
push esi
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 8]
call edi
cmp byte [ebx + 0xc], 0
jne 0x403a11
lea eax, [ebp - 0x418]
push eax
call fcn.0044d720
pop ecx
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffA]
mov eax, dword [ebx + 0x10]
dec eax
je 0x403a47
dec eax
je 0x403a30
dec eax
jne 0x403a65
push dword [ebx + 0x14]
lea eax, [ebp - 0x418]
push eax
call fcn.0044d5b0
pop ecx
pop ecx
jmp 0x403a5e
push dword [ebx + 0x14]
lea eax, [ebp - 0x418]
push eax
call fcn.0044d830
test eax, eax
pop ecx
pop ecx
je 0x403a65
jmp 0x403a62
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push eax
lea eax, [ebp - 0x418]
push eax
push ecx
call fcn.0044d65f
add esp, 0xc
test eax, eax
jne 0x403a65
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [ebx + 7], 0
je 0x403ad5
push esi
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x418]
push eax
lea esi, [ebp - 0x14]
call fcn.0040dab0
lea esi, [ebx + 0x2c]
lea edi, [ebp - 0x14]
call fcn.004055c3
push dword [ebp - 0x14]
call fcn.0044d0f0
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, edi
pop ecx
je 0x403ad2
mov ecx, dword [esi]
cmp ecx, edi
je 0x403ad2
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0x28]
push edi
push dword [esi + 0xc]
push ecx
push edi
push eax
call fcn.0044c009
add esp, 0x20
cmp eax, edi
mov dword [esi + 0x18], eax
jle 0x403ad2
inc dword [ebp - 4]
mov dword [esi + 0x18], edi
inc dword [ebp - 8]
cmp byte [ebx + 8], 0
pop edi
je 0x403af8
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x403af5
push dword [ebp + 8]
mov esi, ebx
call fcn.00403b40
test al, al
je 0x403af5
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [ebx + 0xa], 0
je 0x403b17
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x403b14
inc dword [ebx + 0x68]
mov eax, dword [ebx + 0x68]
cmp eax, dword [ebx + 0x64]
jne 0x403b14
inc dword [ebp - 4]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x403b38
lea eax, [ebp + 8]
push eax
lea esi, [ebx + 0x78]
call fcn.00403c65
inc dword [ebx + 0x6c]
xor eax, eax
cmp byte [ebx + 4], al
sete al
jmp 0x403b3b
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x405aa3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10324
call fcn.00452790
push ebx
xor ebx, ebx
push esi
push edi
push 0x400
mov byte [0x47ee88], bl
mov byte [0x47ee89], bl
mov byte [0x47ee8a], bl
mov dword [0x47ee8c], ebx
mov dword [0x47ee90], ebx
mov dword [0x47ee94], ebx
mov dword [0x47ee98], ebx
mov dword [0x47ee9c], 0x469170
mov dword [0x47eea0], ebx
mov dword [0x47eea4], ebx
mov dword [0x47eea8], ebx
mov dword [0x47eeac], 0x469170
mov dword [0x47eeb0], ebx
mov dword [0x47eeb4], ebx
mov dword [0x47eeb8], ebx
mov dword [0x47eec0], ebx
mov dword [0x47eec8], ebx
call fcn.0044d086
pop ecx
mov dword [0x47eebc], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x118]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0044fa34
push esi
lea eax, [ebp - 0x21c]
push str.Include
push eax
call fcn.0044fa80
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0044fbb5
lea edi, [esi + 1]
push edi
call fcn.0044d086
mov ecx, dword [0x47eebc]
mov edx, dword [0x47eec0]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x47eec0]
mov eax, dword [0x47eebc]
mov eax, dword [eax + ecx*4]
inc dword [0x47eec0]
lea ecx, [ebp - 0x118]
push ecx
push eax
call fcn.0044cf30
add esp, 0x40
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405cf9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10324]
push eax
push ebx
push ebx
push str.Include
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0xffff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405cf0
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x10324], bl
mov byte [ebp + eax - 0x10323], bl
lea eax, [ebp - 0x10324]
mov byte [ebp - 0x118], bl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, bl
mov byte [ebp - 4], al
mov byte [ebp - 3], bl
je 0x405c63
cmp al, 0x3b
je 0x405c63
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0044cf40
pop ecx
pop ecx
jmp 0x405ce8
lea eax, [ebp - 0x118]
push eax
call fcn.0044d720
test eax, eax
pop ecx
je 0x405ca1
lea eax, [ebp - 0x118]
push eax
call fcn.0044d720
pop ecx
lea ecx, [ebp - 0x118]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x405ca1
lea eax, [ebp - 0x118]
push 0x469344
push eax
call fcn.0044cf40
pop ecx
pop ecx
push edi
call fcn.0044d086
mov ecx, dword [0x47eebc]
mov edx, dword [0x47eec0]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x47eec0]
mov eax, dword [0x47eebc]
mov eax, dword [eax + ecx*4]
inc dword [0x47eec0]
push esi
lea ecx, [ebp - 0x118]
push ecx
push eax
call fcn.0044fbe0
mov eax, dword [ebp - 8]
add esp, 0x10
cmp byte [eax], bl
mov byte [ebp - 0x118], bl
je 0x405cf0
inc dword [ebp - 8]
jmp 0x405c39
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x47ee88
pop ebx
leave
ret