joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6291f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x62933a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x6292c2
mov eax, dword [0x7a83dc]
cmp dword [eax], 0
jne 0x629281
lea eax, [ebp - 0x109]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.0040552c
mov eax, dword [ebp - 0x214]
call fcn.0061e328
lea eax, [ebp - 0x20e]
push eax
push 0
push 0x62934c
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetTempFileNameA
jmp 0x6292ad
mov eax, dword [0x7a83dc]
mov eax, dword [eax]
call fcn.0061e328
lea eax, [ebp - 0x20e]
push eax
push 0
push 0x62934c
mov eax, dword [0x7a83dc]
mov eax, dword [eax]
call fcn.0040577c
push eax
call sub.kernel32.dll_GetTempFileNameA
lea eax, [ebx + 8]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040552c
jmp 0x6292cd
lea eax, [ebx + 8]
mov edx, dword [ebp - 4]
call fcn.00405310
xor eax, eax
push ebp
push 0x62930d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebx + 8]
mov dl, 1
mov eax, dword [0x419978]
call fcn.0041ee50
mov esi, eax
mov dword [ebx + 4], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, esi
call fcn.0041e9bc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x629319
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x629341
lea eax, [ebp - 0x214]
call fcn.004052bc
lea eax, [ebp - 4]
call fcn.004052bc
ret
Function at 0x629354
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
call fcn.006291e8
test al, al
je 0x6294a5
mov eax, dword [ebp - 4]
call fcn.006291e8
test al, al
je 0x6294a5
mov eax, ebx
call fcn.006295d4
mov eax, dword [ebp - 4]
call fcn.006295d4
cmp dword [ebp + 0x14], 0
jne 0x62941e
cmp dword [ebp + 0x10], 0
jne 0x62941e
mov eax, dword [ebx + 4]
mov edx, dword [eax]
call dword [edx]
cmp edx, dword [ebp + 0xc]
jne 0x62941e
cmp eax, dword [ebp + 8]
jne 0x62941e
mov eax, dword [ebx + 4]
call fcn.004044a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004044a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040a700
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040577c
push eax
mov eax, dword [ebx + 8]
call fcn.0040577c
push eax
call sub.kernel32.dll_CopyFileA
push 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dl, 1
mov eax, dword [0x419978]
call fcn.0041ee50
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
push 2
mov ecx, dword [ebx + 8]
mov dl, 1
mov eax, dword [0x419978]
call fcn.0041ee50
mov dword [ebx + 4], eax
jmp 0x6294a5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [ebx + 4]
call fcn.0041e958
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0041e958
mov eax, 0x100000
call fcn.00402a94
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jne 0x62945b
cmp dword [ebp + 8], 0x100000
jae 0x629462
jmp 0x62945d
jge 0x629462
mov esi, dword [ebp + 8]
jmp 0x629467
mov esi, 0x100000
mov edx, dword [ebp - 8]
mov ecx, esi
mov eax, dword [ebx + 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, esi
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, esi
cdq
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
jne 0x62949b
cmp dword [ebp + 8], 0
ja 0x62944a
jmp 0x62949d
jg 0x62944a
mov eax, dword [ebp - 8]
call fcn.00402ab4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10

Function at 0x629608
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x63b9f8
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, 0x7a08d0
mov eax, dword [0x7a8cc8]
cmp dword [eax], 2
jne 0x63bb5c
push 0x63bb74
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [ebx], eax
cmp dword [ebx], 0
sete byte [0x7b5944]
cmp dword [ebx], 0
jne 0x63ba33
push 0x63bb74
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x63bb5c
push 0x63bb80
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08dc], eax
push 0x63bb98
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08e0], eax
push 0x63bbac
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08d4], eax
push 0x63bbbc
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08d8], eax
push 0x63bbc4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08e4], eax
push 0x63bbd4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08e8], eax
push 0x63bbf0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08ec], eax
push 0x63bc00
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08f0], eax
push 0x63bc14
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08f4], eax
push 0x63bc2c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08fc], eax
push 0x63bc38
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a08f8], eax
push 0x63bc48
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a0900], eax
push 0x63bc58
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a0904], eax
push 0x63bc74
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a0908], eax
push 0x63bc90
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a090c], eax
push 0x63bca8
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7a0910], eax
cmp dword [ebx], 0
je 0x63bb6a
cmp dword [0x7a0900], 0
jne 0x63bb6e
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x63c0f8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x9c], edx
mov esi, eax
lea edi, [ebp - 0x94]
xor eax, eax
push ebp
push 0x63c340
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x94
call fcn.0040863c
mov dword [edi], 0x94
push edi
call sub.kernel32.dll_GetVersionExA
mov eax, esi
lea edx, [edi + 0x14]
mov ecx, 0x80
call fcn.0040552c
mov eax, dword [edi + 4]
mov dword [0x7b5978], eax
mov edx, dword [edi + 8]
mov dword [0x7b597c], edx
mov edx, dword [edi + 0xc]
mov dword [0x7b5980], edx
xor ebx, ebx
cmp dword [edi + 0x10], 2
jne 0x63c23a
sub eax, 3
je 0x63c19a
dec eax
je 0x63c19e
dec eax
je 0x63c1a2
jmp 0x63c1a4
mov bl, 1
jmp 0x63c1a4
mov bl, 3
jmp 0x63c1a4
mov bl, 0xa
cmp dword [edi + 4], 5
jne 0x63c1b2
cmp dword [edi + 8], 1
jne 0x63c1b2
mov bl, 0xb
cmp dword [edi + 4], 5
jne 0x63c1c0
cmp dword [edi + 8], 2
jne 0x63c1c0
mov bl, 0xc
mov eax, dword [esi]
mov edx, 0x63c358
call fcn.004056c8
jne 0x63c322
mov dl, 1
mov eax, dword [0x443038]
call fcn.00443138
mov edi, eax
mov edx, 0x80000002
mov eax, edi
call fcn.004431d8
mov edx, 0x63c370
mov eax, edi
call fcn.00443364
test al, al
je 0x63c22e
mov edx, 0x63c3b8
mov eax, edi
call fcn.00443bdc
test al, al
je 0x63c227
mov edx, 0x63c3b8
mov eax, edi
call fcn.00443a00
dec eax
jne 0x63c227
mov eax, esi
mov edx, 0x63c3cc
call fcn.00405310
mov eax, edi
call fcn.004431a8
mov eax, edi
call fcn.004044a8
jmp 0x63c322
cmp dword [edi + 4], 4
jne 0x63c2fa
cmp dword [edi + 8], 0
jne 0x63c2fa
mov bl, 2
lea eax, [ebp - 0x9c]
lea edx, [edi + 0x14]
mov ecx, 0x80
call fcn.0040552c
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.00409c30
mov eax, dword [ebp - 0x98]
mov edx, 0x63c3e4
call fcn.004056c8
jne 0x63c288
mov bl, 4
lea eax, [ebp - 0xa4]
lea edx, [edi + 0x14]
mov ecx, 0x80
call fcn.0040552c
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.00409c30
mov eax, dword [ebp - 0xa0]
mov edx, 0x63c3f0
call fcn.004056c8
jne 0x63c2c0
mov bl, 5
lea eax, [ebp - 0xac]
lea edx, [edi + 0x14]
mov ecx, 0x80
call fcn.0040552c
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
call fcn.00409c30
mov eax, dword [ebp - 0xa8]
mov edx, 0x63c3fc
call fcn.004056c8
jne 0x63c322
mov bl, 6
jmp 0x63c322
cmp dword [edi + 4], 4
jne 0x63c314
cmp dword [edi + 8], 0xa
jne 0x63c314
mov bl, 7
cmp word [edi + 0xc], 0x8ae
jne 0x63c322
mov bl, 8
jmp 0x63c322
cmp dword [edi + 4], 4
jne 0x63c322
cmp dword [edi + 8], 0x5a
jne 0x63c322
mov bl, 9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63c347
lea eax, [ebp - 0xac]
mov edx, 6
call fcn.004052e0
ret
Function at 0x63cac0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x63cb57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004059f0
mov eax, 0x104
call fcn.0040b0e0
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x63cb1b
mov eax, esi
mov edx, ebx
call fcn.00405b00
mov eax, ebx
call fcn.0040b12c
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.00418928
test al, al
je 0x63cb41
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63cb5e
lea eax, [ebp - 0xc]
call fcn.00406ef0
ret

Function at 0x63cb68
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov esi, eax
lea edi, [ebp - 4]
xor ecx, ecx
mov cl, byte [esi]
cmp cl, 2
jb 0x63cb86
mov cl, 2
mov byte [edi], cl
inc esi
inc edi
rep movsb byte es:[edi], byte [esi]
xor eax, eax
push ebp
push 0x63cc78
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.0040b0e0
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
lea eax, [ebp - 0x24]
call fcn.00403464
mov edx, 0x63cc8c
lea eax, [ebp - 0x24]
mov cl, 3
call fcn.00403434
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00405520
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0040af28
push 0x8001
call sub.kernel32.dll_SetErrorMode
mov word [ebp - 8], ax
xor eax, eax
push ebp
push 0x63cc5b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x63cc2d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63cc3b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63cc62
mov eax, dword [ebp - 0xc]
call fcn.0040b12c
movzx eax, word [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x6408d4
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebx
add esp, 0xffffffc0
call fcn.006408d0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 5
jb 0x6408f6
call fcn.006408d0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
lea eax, [esp + 0x28]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, dword [esp + 0x10]
sbb edx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
fild qword [esp + 0x30]
fild qword [esp + 0x28]
fdivp st(1)
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, dword [esp + 8]
sbb edx, dword [esp + 0xc]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
fild qword [esp + 0x38]
fdivrp st(1)
fdiv dword [0x640978]
fstp qword [esp]
wait
fld qword [esp]
add esp, 0x40
pop ebx
ret

Function at 0x6409ec
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov ebx, eax
mov eax, ebx
sub al, 0x20
jae 0x640a4b
call sub.kernel32.dll_GetCurrentProcess
mov esi, eax
push esp
push 0x7b5a04
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetProcessAffinityMask
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
xor eax, eax
mov al, bl
mov edx, dword [esp + 0x18]
dec edx
cmp eax, edx
jbe 0x640a2a
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
cmp dword [0x7b59f8], 0
je 0x640a44
push eax
push esi
call dword [0x7b59f8]
push 0
call sub.kernel32.dll_Sleep
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x642398
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov al, byte [esp + 0x14]
add esp, 0x24
ret
Function at 0x648974
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x648aac
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00405908
push 0x104
lea eax, [ebp - 8]
call fcn.004057d4
push eax
push 0x648ac0
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405908
mov eax, dword [ebp - 8]
call fcn.0040557c
test eax, eax
jle 0x648a8e
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004035b8
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push dword [ebp - 8]
push 0x648ad0
push ebx
push 0x648ae0
push esi
lea eax, [ebp - 0x60]
mov edx, 5
call fcn.0040563c
mov eax, dword [ebp - 0x60]
call fcn.0040577c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x648a8e
xor eax, eax
push ebp
push 0x648a87
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x648a8e
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x648ab3
lea eax, [ebp - 0x60]
call fcn.004052bc
lea eax, [ebp - 8]
call fcn.004052bc
ret

Function at 0x648ae4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040577c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x648b01
and eax, 0x10
cmp eax, 0x10
je 0x648b05
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x649144
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x649158
add esp, 0xfffffff0
call fcn.0040480c
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00404478
lea eax, [ebp - 0x24]
mov edx, 0x24
call fcn.0040863c
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 4], eax
mov dl, byte [0x6491ac]
mov eax, esi
call fcn.00649390
mov eax, esi
test bl, bl
je 0x6491a3
call fcn.00404864
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6527a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x652874
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x652857
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040577c
mov esi, eax
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0xc]
call fcn.0040991c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x652842
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
mov ecx, edi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00652884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x652849
mov eax, dword [ebp - 8]
call fcn.00402ab4
ret
Function at 0x657e84
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x657fd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.006584f0
cmp ebx, 1
jne 0x657ed1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov edx, 1
call fcn.0064bfb0
xor eax, eax
push ebp
push 0x657f29
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x10c], eax
xor eax, eax
mov dword [ebp - 0x108], eax
fild qword [ebp - 0x10c]
fdiv dword [0x657fe8]
fdiv dword [0x657fec]
fstp xword [ebp - 0x118]
wait
call fcn.0040c5d8
fld xword [ebp - 0x118]
fsubp st(1)
mov eax, dword [ebp - 4]
fstp qword [eax + 8]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657f3e
mov eax, dword [ebp - 4]
call fcn.00657e04
mov eax, dword [ebp - 4]
fstp xword [eax + 0x18]
wait
lea eax, [ebp - 0x11c]
call fcn.0063c99c
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00405310
lea eax, [ebp - 0x120]
call fcn.0063ca80
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00405310
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetKeyboardState
cmp byte [ebp - 0xf0], 1
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0x24], al
cmp byte [ebp - 0x74], 1
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0x23], al
cmp byte [ebp - 0x73], 1
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0x22], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657fe0
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.004052e0
ret

Function at 0x668268
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x66829b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
mov edx, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6682ad
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x66c488
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push esi
test dl, dl
je 0x66c496
add esp, 0xfffffff0
call fcn.0040480c
mov ebx, edx
mov esi, eax
mov al, byte [0x66c4f8]
mov byte [esi + 0x19], al
mov dl, byte [0x66c4fc]
mov eax, esi
call fcn.0066ddb4
mov eax, dword [0x7a8cc8]
cmp dword [eax], 2
jne 0x66c4dc
mov eax, 0x66c508
call fcn.0063d2c4
mov eax, 0x66c524
call fcn.0063d2c4
call fcn.0066bb14
call fcn.0063b9f8
call fcn.0066b274
mov eax, esi
test bl, bl
je 0x66c4f1
call fcn.00404864
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x68ccf8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x68cd69
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x7a1bb0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x68cd53
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0068cce8
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x68b4cc]
call fcn.0068dbb8
mov dword [0x7a1c18], eax
mov eax, dword [ebp - 4]
call fcn.0068cb74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68cd70
lea eax, [ebp - 8]
call fcn.00406ef0
ret

Function at 0x68ce08
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x68ce1b
or esi, 2
test dl, dl
je 0x68ce24
or esi, 0
jmp 0x68ce27
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x68da44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x68db9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x68b2b4]
call fcn.00417978
test eax, eax
jl 0x68daab
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0068cdec
and eax, 0x7f
mov eax, dword [eax*4 + 0x7a1bb0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x68db0e
mov eax, dword [ebx]
call fcn.0040557c
test eax, eax
jle 0x68db0e
mov eax, dword [ebx]
call fcn.0040557c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x68dad2
mov eax, ebx
mov edx, 0x68dbb4
call fcn.00405584
mov eax, dword [ebx]
call fcn.0040557c
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.004062a4
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.0068cce8
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x68db59
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x7a7f38]
call fcn.004073b4
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040b5bc
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405310
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x408cb0]
call fcn.0040e380
call fcn.00404c74
mov eax, dword [ebp - 8]
call fcn.0068d9bc
mov ebx, eax
test edi, edi
je 0x68db6e
mov eax, edi
call fcn.004044a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68dba3
lea eax, [ebp - 0x1c]
call fcn.004052bc
lea eax, [ebp - 0x18]
call fcn.00406ef0
lea eax, [ebp - 0x14]
call fcn.004052bc
lea eax, [ebp - 4]
call fcn.004052bc
ret