joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403965
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x40f014]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x10c]
push eax
push 1
xor ebx, ebx
push ebx
push 0x401350
push 0x80000002
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x110], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x4039d3
push ebx
push eax
push 0x401340
push 0x401328
push 0xbf
push 0x401240
call fcn.004062d4
add esp, 0x18
xor eax, eax
jmp 0x403a83
push esi
push edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x401320
push dword [ebp - 0x10c]
mov dword [ebp - 0x114], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov edi, 0x401328
mov esi, 0x401240
jne 0x403a3f
push dword [ebp - 0x118]
lea eax, [ebp - 0x108]
push eax
call fcn.00405fe1
test eax, eax
jne 0x403a33
push 0x401300
push ebx
push ebx
push edi
push 0xd0
jmp 0x403a4c
mov dword [ebp - 0x110], 1
jmp 0x403a55
push ebx
push eax
push 0x4012ec
push edi
push 0xd4
push esi
call fcn.004062d4
add esp, 0x18
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x403a7b
push ebx
push eax
push 0x4012dc
push edi
push 0xd7
push esi
call fcn.004062d4
add esp, 0x18
mov eax, dword [ebp - 0x110]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.004065c9
leave
ret 4
Function at 0x40504b
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x40f014]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
push 0x401df4
mov dword [ebp - 4], eax
call fcn.004061e0
add esp, 0xc
push 0x401de0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
test ebx, ebx
je 0x4050c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4050c9
test si, 0x1a27
je 0x4050a0
or esi, 0x10018
mov dword [0x40fba8], edi
mov dword [0x40fbb0], esi
call fcn.00404adc
test eax, eax
je 0x4050c9
push esi
push dword [ebp + 0xc]
push dword [0x40fba8]
call dword [0x40fbc8]
mov esi, eax
jmp 0x4050cc
push 0xfffffffffffffff7
pop esi
test ebx, ebx
je 0x405103
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x405103
push 0x4014ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40128c
push 0x401dd0
push 0x3a2
push 0x401240
call fcn.004062d4
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.004065c9
leave
ret 0xc
Function at 0x4060c9
Capabilities:
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x378
cmp byte [0x40fbe0], 0
mov eax, dword [0x40f014]
push esi
mov dword [ebp - 4], eax
push edi
mov esi, 0x40fbe0
jne 0x406135
mov edi, 0x104
push edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40610a
push 0x40226c
jmp 0x40614d
push 0x402260
push 0x401518
lea eax, [ebp - 0x120]
push eax
push 0x402258
push edi
push esi
call fcn.00404a14
add esp, 0x18
test eax, eax
jge 0x406135
push 0x402234
jmp 0x40614d
push 0x402230
push esi
call fcn.00406f88
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x406155
push 0x402204
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4061cf
lea eax, [ebp - 0x10]
push eax
call fcn.00406eb0
lea eax, [ebp - 0x1c]
push eax
call fcn.00406e42
test ebx, ebx
pop ecx
pop ecx
lea eax, [ebp - 0x1c]
je 0x406196
push ebx
push 0x4021fc
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4021ec
lea eax, [ebp - 0x378]
push 0x258
push eax
call fcn.00404a14
add esp, 0x1c
jmp 0x4061b9
push 0x4021fc
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4021d8
lea eax, [ebp - 0x378]
push 0x258
push eax
call fcn.00404a14
add esp, 0x18
lea eax, [ebp - 0x378]
push esi
push eax
call fcn.00406dc6
push esi
call fcn.00406d70
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.004065c9
leave
ret

Function at 0x406227
Capabilities:
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
cmp byte [0x40fce8], 0
mov eax, dword [0x40f014]
push esi
mov dword [ebp - 4], eax
push edi
mov esi, 0x40fce8
jne 0x406293
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x406268
push 0x40226c
jmp 0x4062ab
push 0x40229c
push 0x401518
lea eax, [ebp - 0x108]
push eax
push 0x402258
push edi
push esi
call fcn.00404a14
add esp, 0x18
test eax, eax
jge 0x406293
push 0x402234
jmp 0x4062ab
push 0x402230
push esi
call fcn.00406f88
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x4062b3
push 0x402204
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4062c3
push esi
push ebx
call fcn.00406dc6
push esi
call fcn.00406d70
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.004065c9
leave
ret

Function at 0x4065c9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f014]
jne 0x4065da
test ecx, 0xffff0000
jne 0x4065da
ret
jmp fcn.004065e4
Function at 0x407a9d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x410388]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jne 0x407ae9
call esi
mov edi, eax
cmp edi, ebx
je 0x407acf
mov dword [0x410388], 1
jmp 0x407aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x407ae4
push 2
pop eax
mov dword [0x410388], eax
jmp 0x407ae9
mov eax, dword [0x410388]
cmp eax, 1
jne 0x407b66
cmp edi, ebx
jne 0x407afa
call esi
mov edi, eax
cmp edi, ebx
je 0x407b6f
cmp word [edi], bx
mov eax, edi
je 0x407b0f
inc eax
inc eax
cmp word [eax], bx
jne 0x407b01
inc eax
inc eax
cmp word [eax], bx
jne 0x407b01
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
mov ecx, eax
cmp ecx, ebx
mov dword [ebp - 8], ecx
je 0x407b5d
call fcn.004074a7
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x407b5d
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
jne 0x407b5a
push dword [ebp - 4]
call fcn.00406a62
pop ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x407bbe
cmp eax, 2
je 0x407b73
cmp eax, ebx
je 0x407b73
xor eax, eax
jmp 0x407bc0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x407b6f
cmp byte [esi], bl
je 0x407b90
inc eax
cmp byte [eax], bl
jne 0x407b86
inc eax
cmp byte [eax], bl
jne 0x407b86
sub eax, esi
inc eax
mov edi, eax
mov ecx, edi
call fcn.004074a7
cmp eax, ebx
je 0x407bb7
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407cd6
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp ecx, dword [esi*8 + 0x40f050]
je 0x407cf8
inc esi
cmp esi, 0x13
mov dword [ebp - 4], esi
jb 0x407ce6
cmp esi, 0x13
je 0x407e34
mov eax, dword [0x410220]
cmp eax, 1
push ebx
je 0x407e03
test eax, eax
jne 0x407d21
cmp dword [0x410224], 1
je 0x407e03
cmp ecx, 0xfc
je 0x407e33
push edi
push 6
pop ecx
mov esi, 0x40289c
mov edi, 0x410390
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x4103aa
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x4104ae], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407d6f
push 5
pop ecx
mov esi, 0x402884
mov edi, 0x4103aa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407d74
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x407da7
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407d88
sub eax, edx
push 3
lea eax, [eax + 0x41036f]
push 0x402880
push eax
call fcn.0040b4e0
add esp, 0xc
mov edx, 0x410390
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407daf
mov eax, dword [ebp - 4]
mov eax, dword [eax*8 + 0x40f054]
mov esi, 0x4022d8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407dcb
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x407dd7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x402858
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0040b3d7
add esp, 0xc
pop edi
jmp 0x407e33
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x407e33
mov edx, dword [esi*8 + 0x40f054]
mov ecx, edx
lea esi, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x407e1b
push 0
sub ecx, esi
lea esi, [ebp - 8]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret
Function at 0x40b3d7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x410820], ebx
push esi
push edi
jne 0x40b459
push 0x402bc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40b494
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402bb4
push edi
call esi
test eax, eax
mov dword [0x410820], eax
je 0x40b494
push 0x402ba4
push edi
call esi
push 0x402b90
push edi
mov dword [0x410824], eax
call esi
cmp dword [0x41022c], 2
mov dword [0x410828], eax
jne 0x40b459
push 0x402b74
push edi
call esi
test eax, eax
mov dword [0x410830], eax
je 0x40b459
push 0x402b5c
push edi
call esi
mov dword [0x41082c], eax
mov eax, dword [0x41082c]
test eax, eax
je 0x40b49e
call eax
test eax, eax
je 0x40b485
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x410830]
test eax, eax
je 0x40b485
test byte [ebp - 8], 1
jne 0x40b49e
cmp dword [0x410238], 4
jb 0x40b498
or byte [ebp + 0x12], 0x20
jmp 0x40b4bd
xor eax, eax
jmp 0x40b4cd
or byte [ebp + 0x12], 4
jmp 0x40b4bd
mov eax, dword [0x410824]
test eax, eax
je 0x40b4bd
call eax
mov ebx, eax
test ebx, ebx
je 0x40b4bd
mov eax, dword [0x410828]
test eax, eax
je 0x40b4bd
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x410820]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b735
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x40f014]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x41c], ecx
jne 0x40b76c
xor eax, eax
jmp 0x40b91f
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x411c80]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x40b7a1
push 2
push ecx
push ecx
push dword [ebp + 8]
call fcn.0040d5d3
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40b86f
cmp dword [ebp + 0x10], ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x40c], ecx
jbe 0x40b8ed
jmp 0x40b7c8
xor ecx, ecx
mov dword [ebp - 0x410], ecx
mov ecx, dword [ebp - 0x414]
sub ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x40b81e
mov edx, dword [ebp - 0x414]
inc dword [ebp - 0x414]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40b809
inc dword [ebp - 0x41c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x410]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x410]
cmp dword [ebp - 0x410], 0x400
jl 0x40b7e0
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x424]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b89c
mov eax, dword [ebp - 0x424]
add dword [ebp - 0x418], eax
cmp eax, edi
jl 0x40b8a8
mov eax, dword [ebp - 0x414]
sub eax, dword [ebp - 0x420]
cmp eax, dword [ebp + 0x10]
jb 0x40b7c6
jmp 0x40b8a8
push ecx
lea ecx, [ebp - 0x424]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b89c
mov eax, dword [ebp - 0x424]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x418], eax
jmp 0x40b8a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x40b917
cmp dword [ebp - 0x40c], eax
je 0x40b8e7
push 5
pop esi
cmp dword [ebp - 0x40c], esi
jne 0x40b8d9
call fcn.0040ab63
mov dword [eax], 9
call fcn.0040ab7b
mov dword [eax], esi
jmp 0x40b912
push dword [ebp - 0x40c]
call fcn.0040ab93
pop ecx
jmp 0x40b912
mov edi, dword [ebp - 0x420]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40b8ff
cmp byte [edi], 0x1a
jne 0x40b8ff
xor eax, eax
jmp 0x40b91d
call fcn.0040ab63
mov dword [eax], 0x1c
call fcn.0040ab7b
and dword [eax], 0
or eax, 0xffffffff
jmp 0x40b91d
sub eax, dword [ebp - 0x41c]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.004065c9
leave
ret
Function at 0x40d9d3
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040dae0
mov dword [ebp - 8], esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40dacf
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x4c]
xor esi, esi
cmp dword [0x41022c], 2
jne 0x40da54
push 0x402514
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
je 0x40da54
push 0x4035bc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x40da54
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], esi
call eax
cmp eax, 1
pop ecx
jne 0x40da54
cmp dword [ebp - 4], esi
jbe 0x40da54
mov esi, dword [ebp - 4]
mov edx, dword [0x41022c]
mov ebx, edx
dec ebx
neg ebx
sbb ebx, ebx
and ebx, 0x103
lea ecx, [edi - 1]
lea eax, [esi + edi - 1]
not ecx
inc ebx
and eax, ecx
mov dword [ebp - 4], eax
je 0x40da7d
add eax, edi
mov dword [ebp - 4], eax
lea ecx, [edi + edi]
cmp eax, ecx
jae 0x40da89
mov dword [ebp - 4], ecx
mov eax, ecx
lea esi, [edi - 1]
not esi
and esi, dword [ebp - 8]
sub esi, eax
cmp edx, 1
jne 0x40da9b
push 0x11
pop edi
mov ecx, dword [ebp - 0xc]
add edi, ecx
cmp esi, edi
jb 0x40dacf
push 4
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x40dacf
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40dacf
xor eax, eax
inc eax
jmp 0x40dad1
xor eax, eax
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40db83
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
call fcn.0040b609
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x40dcca
push 2
push esi
push dword [ebp + 8]
call fcn.0040b609
add esp, 0xc
cmp eax, ebx
je 0x40dcca
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x40dc6d
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x40dbfe
call fcn.0040ab63
mov dword [eax], 0xc
or esi, 0xffffffff
jmp 0x40dcb5
push 0x8000
push dword [ebp + 8]
call fcn.0040df36
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp edi, ebx
mov eax, ebx
jge 0x40dc18
mov eax, edi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040b735
add esp, 0xc
cmp eax, 0xffffffff
je 0x40dc34
sub edi, eax
test edi, edi
jg 0x40dc10
jmp 0x40dc4c
call fcn.0040ab7b
cmp dword [eax], 5
jne 0x40dc49
call fcn.0040ab63
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0040df36
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40dcb5
jge 0x40dcb5
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040b609
push dword [ebp + 8]
call fcn.0040cab3
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x40dcb5
call fcn.0040ab63
mov dword [eax], 0xd
call fcn.0040ab7b
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0040b609
add esp, 0xc
mov eax, esi
pop edi
jmp 0x40dccc
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x40dcd5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x40deb7
mov esi, dword [ebp + 8]
mov eax, esi
sar eax, 5
and esi, 0x1f
lea edi, [eax*4 + 0x411c80]
mov eax, dword [edi]
lea esi, [esi + esi*8]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x40deb7
test cl, 0x48
je 0x40dd42
cmp byte [eax + 5], 0xa
je 0x40dd42
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40dd94
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x40dd7c
call fcn.0040ab63
mov dword [eax], 9
call fcn.0040ab7b
mov dword [eax], esi
jmp 0x40dd8c
cmp eax, 0x6d
je 0x40deb7
push eax
call fcn.0040ab93
pop ecx
or eax, 0xffffffff
jmp 0x40deb9
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x40deb2
test eax, eax
je 0x40ddbb
cmp byte [ebx], 0xa
jne 0x40ddbb
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40ddc4
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x40deac
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x40de92
cmp al, 0xd
je 0x40ddf6
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x40de84
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x40de10
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x40de0b
add dword [ebp + 0x10], 2
jmp 0x40de64
mov dword [ebp + 0x10], eax
jmp 0x40de80
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40de38
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40de80
cmp dword [ebp - 0xc], 0
je 0x40de80
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40de59
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40de64
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x40de83
cmp ebx, dword [ebp + 0xc]
jne 0x40de69
cmp byte [ebp - 1], 0xa
jne 0x40de69
mov byte [ebx], 0xa
jmp 0x40de83
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040d5d3
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x40de84
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x40ddda
jmp 0x40deac
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x40dea4
lea esi, [eax + esi + 4]
or byte [esi], 2
jmp 0x40deac
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
mov byte [ebx], al
inc ebx
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x40deb9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44a5e4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a789
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40fd60]
call fcn.00402f24
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403bcc
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44a75f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00439dc8
test al, al
je 0x44a752
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44a798
lea eax, [ebp - 0x254]
call fcn.0040997c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44a752
xor eax, eax
push ebp
push 0x44a74b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44a7d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44a734
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403df8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x44a734
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a752
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44a655
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0041387c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a790
lea eax, [ebp - 0x260]
call fcn.00403bcc
ret

Function at 0x44af2c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4a37ac]
cmp byte [eax + 0x8d], 0
jne 0x44af9d
cmp dword [0x4a37ec], 0
jne 0x44af5e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44aee8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a37ec], eax
cmp dword [0x4a37e8], 0
jne 0x44af79
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a37e8], eax
cmp dword [0x4a37f0], 0
jne 0x44af9d
push esp
push 0
push 0
push 0x44ae8c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a37f0], eax
pop edx
ret