joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42714a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push esi
lea eax, [ebp - 0x24c]
push 0x104
push eax
push dword [0x492fe8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [eax - 8], esi
jne 0x42719d
lea eax, [ebp - 0x24c]
test eax, eax
je 0x42718d
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x24c]
push ecx
push eax
lea ecx, [ebp + 8]
call fcn.0040148d
push 0x3c
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.0046aa50
add esp, 0xc
lea eax, [ebp + 8]
lea ecx, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
push eax
call fcn.00401356
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x40], esi
call fcn.004016d4
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x28], 1
call fcn.00401356
mov eax, dword [ebp - 8]
cmp dword [ebp + 0x10], esi
mov dword [ebp - 0x30], eax
je 0x4271f9
mov dword [ebp - 0x38], 0x47eea8
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.0040139c
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp + 8]
call fcn.0040139c
lea ecx, [ebp + 0xc]
call fcn.0040139c
mov eax, esi
pop esi
leave
ret
Function at 0x4272df
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
push str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
lea ecx, [ebp - 0x10]
call fcn.0040811c
mov eax, dword [0x488b6c]
mov ebx, 0x81
mov dword [ebp - 0x844], eax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x840]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
lea eax, [ebp - 0x844]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ecx
lea eax, [ebp - 0x844]
mov ecx, esp
push eax
call fcn.0040811c
lea eax, [ebp - 0x18]
push eax
call fcn.0042722a
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push str._selfdestruct.bat
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00408569
mov edx, dword [0x488b6c]
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x42c]
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x228], edx
rep stosd dword es:[edi], eax
mov ecx, ebx
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
mov ecx, ebx
lea edi, [ebp - 0x634]
mov dword [ebp - 0x638], edx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x228]
push eax
push esi
call edi
lea eax, [ebp - 0x638]
push eax
push esi
call edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x228]
push eax
call fcn.0046bb42
pop ecx
lea eax, [ebp - 0x430]
pop ecx
push esi
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x430]
lea ecx, [ebp - 8]
push eax
call fcn.0040811c
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x4274b1
push dword [ebp - 0xc]
mov eax, dword [0x47e520]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call fcn.004017cc
add esp, 0x14
lea ecx, [ebp - 4]
push 0x47ea4c
push 0x47ea44
call fcn.00401b5d
mov eax, dword [ebp - 4]
cmp eax, esi
mov dword [ebp - 0x1c], eax
jne 0x427442
xor edi, edi
jmp 0x427472
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.0046aab0
mov edi, esp
push esi
push esi
push ebx
and byte [edi], 0
push edi
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x20]
push esi
push ecx
push dword [eax - 8]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x638]
push esi
push eax
lea eax, [ebp - 0x228]
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp - 8]
call fcn.0040139c
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea ecx, [ebp - 0x18]
call fcn.0040139c
lea ecx, [ebp - 0x10]
call fcn.0040139c
lea esp, [ebp - 0x850]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427a41
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x427a7f
cmp dword [ebp + 0x10], esi
je 0x427aa1
push esi
push str.Create_Error_
push dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x427aa1
lea eax, [ebp - 4]
push esi
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [eax + 0x14]
push dword [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop esi
lea ecx, [ebp + 8]
call fcn.0040139c
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x427aaf
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SHChangeNotifyDeregister
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x427aea
push ebx
push str.Error1_
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x427b2b
push esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 8], ebx
lea eax, [edi + 1]
lea ecx, [esi + 4]
push eax
call fcn.004016d4
lea ecx, [ebp - 8]
push ebx
push ecx
push edi
push eax
mov dword [esi], eax
push dword [ebp - 4]
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
lea ecx, [ebp + 8]
call fcn.0040139c
mov eax, ebx
pop ebx
leave
ret

Function at 0x429d5a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov esi, ecx
push 0x11
mov dword [edi], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
mov eax, dword [esp + 0x14]
setl cl
sub eax, 0x23
je 0x429df8
dec eax
je 0x429dde
dec eax
je 0x429dd2
dec eax
je 0x429dca
dec eax
je 0x429db6
dec eax
je 0x429da6
sub eax, 0x49
jne 0x429e30
push dword [esi + 4]
call fcn.00450266
pop ecx
jmp 0x429e30
mov dword [edi], 1
push ebx
mov ecx, esi
call fcn.0042a275
jmp 0x429e30
cmp ecx, ebx
je 0x429e30
mov dword [edi], 1
push ebx
mov ecx, esi
call fcn.0042a2aa
jmp 0x429e30
push 1
pop eax
mov dword [edi], eax
push eax
jmp 0x429dad
cmp ecx, ebx
je 0x429e30
push 1
pop eax
mov dword [edi], eax
push eax
jmp 0x429dc1
cmp ecx, ebx
je 0x429e30
push dword [esi + 0x24]
mov ecx, dword [esi + 0x38]
call fcn.00428ebf
push esi
push eax
mov dword [edi], 1
push ebx
jmp 0x429e28
cmp ecx, ebx
je 0x429e30
mov dword [edi], 1
mov eax, dword [esi + 0x38]
push ebx
add eax, 4
push ebx
push 0x1004
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esi + 0x24]
mov ecx, dword [esi + 0x38]
mov edi, eax
call fcn.00428ebf
push esi
dec edi
push eax
push edi
mov ecx, dword [esi + 0x38]
call fcn.00429430
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x429e38
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
push 1
mov esi, ecx
pop ebx
push 0x10
mov dword [edi], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
movzx eax, word [ebp + 0xc]
setl cl
cmp eax, 9
je 0x429fcf
cmp eax, 0xd
je 0x429fbd
cmp eax, 0x1b
je 0x429fa8
xor ebx, ebx
lea ecx, [ebp + 0x14]
mov dword [edi], ebx
mov eax, dword [0x47e520]
mov edi, 0x400
mov dword [ebp + 0x14], eax
push edi
call fcn.004016d4
push edi
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
call fcn.0040173c
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], ebx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetWindowDC]
push dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0xc], eax
call edi
push ebx
push ebx
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp - 0xc]
call ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push dword [ebp - 4]
push dword [ebp - 0xc]
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetClientRect]
add dword [ebp - 0x14], 5
lea eax, [ebp - 0x24]
push eax
push dword [esi + 4]
call ebx
push dword [esi + 4]
call edi
lea ecx, [ebp - 0x34]
push ecx
push eax
call ebx
push dword [esi + 4]
call edi
mov edi, dword [sym.imp.USER32.dll_ClientToScreen]
mov ebx, eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x429f49
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 4]
call edi
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x24]
push eax
push ebx
call edi
test eax, eax
je 0x429f61
lea eax, [ebp - 0x1c]
push eax
push ebx
call edi
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
sub edx, ecx
cmp eax, edx
jle 0x429f96
add eax, ecx
cmp eax, dword [ebp - 0x2c]
jl 0x429f7a
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
sub edx, dword [ebp - 0x20]
push 1
sub eax, ecx
push edx
push eax
push dword [ebp - 0x20]
push ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
lea ecx, [ebp - 0xc]
call fcn.00408545
lea ecx, [ebp + 0x14]
call fcn.0040139c
jmp 0x429fdf
push dword [esi + 4]
mov dword [esi + 0x30], ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x429fdf
test ecx, ecx
je 0x429fc4
push ebx
jmp 0x429fc6
push 0
mov ecx, esi
call fcn.0042a275
jmp 0x429fdf
test ecx, ecx
je 0x429fd6
push ebx
jmp 0x429fd8
push 0
mov ecx, esi
call fcn.0042a2aa
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x42a1a8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x47e520]
push ebx
push esi
push edi
mov esi, ecx
mov edi, 0x800
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.004016d4
push edi
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.0040173c
push dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
mov ebx, dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x38]
add eax, 4
push dword [eax]
call ebx
push dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x30], 0xffffff50
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x2c]
push eax
mov dword [ebp - 0x2c], 1
call fcn.0046b615
pop ecx
test eax, eax
pop ecx
jne 0x42a22f
or dword [ebp - 0x24], 0xffffffff
mov ecx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [eax - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x38]
add eax, 4
push dword [eax]
call ebx
push dword [esi + 4]
mov ebx, eax
call edi
lea ecx, [ebp - 0x38]
push ecx
push ebx
push 0x4e
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 4]
call fcn.0040139c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42d7b2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x114
push edi
mov esi, 0x48ef10
push 0
push esi
call fcn.0046aa50
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
mov dword [0x48ef10], edi
push esi
call ebx
mov eax, dword [0x48ef14]
movzx edx, word [0x48ef18]
movzx ecx, ax
shl ecx, 0x10
or ecx, edx
cmp eax, 5
mov dword [0x48f870], ecx
mov ecx, dword [0x47e520]
mov dword [ebp - 4], ecx
jb 0x42d86c
add edi, 8
mov esi, 0x48edf0
push edi
push 0
push esi
call fcn.0046aa50
add esp, 0xc
mov dword [0x48edf0], edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x42d84b
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d84b
push esi
call eax
mov eax, dword [0x48edf4]
test eax, eax
jne 0x42d853
push esi
call ebx
mov eax, dword [0x48edf4]
mov dword [0x48ef14], eax
mov eax, dword [0x48edf8]
mov dword [0x48ef18], eax
mov eax, dword [0x48edfc]
mov dword [0x48ef1c], eax
lea ecx, [ebp - 4]
call fcn.0040139c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e1d6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
cmp dword [0x48f870], esi
push edi
jne 0x42e1ed
call fcn.0042d7b2
cmp dword [0x48ef14], 6
jb 0x42e404
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jl 0x42e213
mov dword [ebp + 8], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x42e225
mov ecx, dword [0x47e520]
push eax
mov dword [ebp + 8], ecx
lea ecx, [ebp + 8]
call fcn.0040833f
push esi
push 0x481c14
lea ecx, [ebp + 8]
call fcn.0040179a
test eax, eax
jne 0x42e37a
mov eax, dword [0x47e520]
push 0x3e
push 1
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
call fcn.00460c9e
push 0x3e
push 2
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00460c9e
add esp, 0x20
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
call fcn.00401522
mov eax, dword [ebp - 4]
cmp dword [eax - 8], esi
lea eax, [ebp - 4]
jne 0x42e289
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00401522
push esi
push str._select
lea ecx, [ebp + 8]
call fcn.0040179a
cmp eax, esi
jl 0x42e34f
mov ecx, dword [ebp + 8]
add eax, 8
mov ecx, dword [ecx - 8]
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 8]
lea ecx, [ebp + 8]
push eax
call fcn.00408906
lea ecx, [ebp - 8]
call fcn.00408a6f
lea ecx, [ebp - 8]
call fcn.00408a1f
push 0x488b68
push 0x4803a8
lea ecx, [ebp - 8]
call fcn.00401b5d
push esi
lea ecx, [ebp - 0x28]
push dword [ebp - 8]
call fcn.0045c222
lea eax, [ebp - 0x20]
push 0x8000
push eax
lea ecx, [ebp - 0x28]
call fcn.0045c2b5
mov esi, 0x48f750
push eax
mov ecx, esi
call fcn.00401522
lea ecx, [ebp - 0x20]
call fcn.0040139c
push esi
mov ecx, 0x48f754
call fcn.00401522
lea ecx, [ebp - 0x28]
call fcn.0045bcda
lea ecx, [ebp - 8]
call fcn.0040139c
lea ecx, [ebp - 0x1c]
call fcn.0040139c
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp - 0x14]
call fcn.0040139c
lea ecx, [ebp - 0x10]
jmp 0x42e3f7
push edi
mov ecx, 0x48f754
call fcn.00401522
lea ecx, [ebp - 0x1c]
call fcn.0040139c
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp - 0x14]
call fcn.0040139c
lea ecx, [ebp - 0x10]
call fcn.0040139c
push str.::26EE0668_A00A_44D7_9371_BEB064C98683
lea ecx, [ebp - 0x18]
call fcn.004013c8
push edi
lea ecx, [ebp - 0xc]
call fcn.00401356
lea ecx, [ebp - 0xc]
call fcn.00401765
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_CharUpperW]
push esi
lea ecx, [ebp - 0xc]
push dword [ebp - 0x18]
call fcn.0040179a
test eax, eax
jl 0x42e3ec
push 1
push esi
push esi
push dword [edi]
push str.explore
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x488b98
mov ecx, edi
call fcn.00401572
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea ecx, [ebp - 0x18]
call fcn.0040139c
lea ecx, [ebp + 8]
call fcn.0040139c
push 1
pop eax
jmp 0x42e406
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea ecx, [ebp - 0x18]
call fcn.0040139c
lea ecx, [ebp + 8]
call fcn.0040139c
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x42e757
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4819c4]
cmp eax, 0xffffffff
jne 0x42e800
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
push 2
push esi
push esi
mov ebx, str.Q_Dir_Admin_Test
push esi
mov edi, SHChangeNotifyDeregister
push ebx
push edi
mov dword [0x4819c4], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x42e7e7
xor eax, eax
cmp dword [ebp - 4], esi
je 0x42e7b0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
cmp eax, esi
mov dword [ebp - 4], ecx
jne 0x42e7e7
push 0xf003f
push esi
push edi
lea ecx, [ebp - 4]
mov dword [0x4819c4], 1
call fcn.00403829
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x42e7e7
mov dword [0x4819c4], esi
cmp dword [ebp - 4], esi
mov edi, dword [0x4819c4]
je 0x42e7fb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4313ae
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 1
pop ebx
mov dword [0x4819a8], ebx
call edi
mov si, ax
and esi, 0x3ff
call edi
push 7
pop edi
shr ax, 0xa
cmp si, di
jne 0x4313e5
and dword [0x4819a8], 0
jmp 0x4315c7
push 9
pop ecx
cmp si, cx
jne 0x4313f8
mov dword [0x4819a8], ebx
jmp 0x4315c7
cmp si, 0xc
jne 0x43140d
mov dword [0x4819a8], 2
jmp 0x4315c7
cmp si, 0x10
jne 0x431422
mov dword [0x4819a8], 3
jmp 0x4315c7
push 0xa
pop edx
cmp si, dx
jne 0x43144d
cmp ax, 0xb
mov dword [0x4819a8], 4
jne 0x4315c7
mov dword [0x4819a8], 0xe
jmp 0x4315c7
cmp si, 4
jne 0x431471
cmp ax, bx
mov dword [0x4819a8], ecx
jne 0x4315c7
mov dword [0x4819a8], 5
jmp 0x4315c7
cmp si, 0x11
jne 0x431486
mov dword [0x4819a8], 6
jmp 0x4315c7
push 0x12
pop eax
cmp si, ax
jne 0x431499
mov dword [0x4819a8], edi
jmp 0x4315c7
cmp si, 0x15
jne 0x4314ae
mov dword [0x4819a8], 8
jmp 0x4315c7
cmp si, 0x19
jne 0x4314bf
mov dword [0x4819a8], edx
jmp 0x4315c7
push 0x13
pop ecx
cmp si, cx
jne 0x4314d6
mov dword [0x4819a8], 0xb
jmp 0x4315c7
cmp si, 0x1f
jne 0x4314eb
mov dword [0x4819a8], 0xc
jmp 0x4315c7
cmp si, 8
jne 0x431500
mov dword [0x4819a8], 0xd
jmp 0x4315c7
push 0x1b
pop edi
cmp si, di
jne 0x431517
mov dword [0x4819a8], 0xf
jmp 0x4315c7
cmp si, 5
jne 0x43152c
mov dword [0x4819a8], 0x10
jmp 0x4315c7
cmp si, 6
jne 0x431541
mov dword [0x4819a8], 0x11
jmp 0x4315c7
push 0x16
pop edx
cmp si, dx
jne 0x431550
mov dword [0x4819a8], eax
jmp 0x4315c7
push 0x18
pop eax
cmp si, ax
jne 0x431560
mov dword [0x4819a8], ecx
jmp 0x4315c7
push 0x1a
pop ecx
cmp si, cx
jne 0x431574
mov dword [0x4819a8], 0x17
jmp 0x4315c7
cmp si, 0x24
je 0x431549
cmp si, 0xb
jne 0x43158c
mov dword [0x4819a8], 0x15
jmp 0x4315c7
cmp si, bx
jne 0x43159d
mov dword [0x4819a8], 0x19
jmp 0x4315c7
cmp si, 0xe
je 0x4314b4
cmp si, 0x22
je 0x431558
cmp si, 0x25
je 0x43148e
cmp si, 0x14
jne 0x4315c7
mov dword [0x4819a8], 0x1d
pop edi
pop esi
pop ebx
ret

Function at 0x4321e7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push esi
lea eax, [ebp - 0x248]
push 0x104
push eax
push dword [0x492fe8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
push 0x3c
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.0046aa50
add esp, 0xc
lea eax, [ebp - 0x248]
lea ecx, [ebp - 4]
mov dword [ebp - 0x40], 0x3c
push eax
call fcn.0040811c
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x3c], esi
call fcn.004016d4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
mov dword [ebp - 0x18], esi
and eax, 0x47eea8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop esi
je 0x43227b
push 0xfefe
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp + 0xc]
call fcn.0040139c
leave
ret
Function at 0x433678
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [0x4820d4]
test eax, eax
je 0x4336b6
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov edi, 0x4820d4
push 0
push eax
push 0x419
push dword [esp + 0x18]
call esi
push 0
push eax
push 0x416
push dword [esp + 0x18]
call esi
mov eax, dword [edi + 4]
add edi, 4
test eax, eax
jne 0x43368e
pop edi
pop esi
ret
Function at 0x433f91
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi + 0x2c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, esi
neg eax
sbb eax, eax
and eax, 4
push eax
push dword [edi + 0x2c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
push 0xe801
lea ecx, [edi + 0x44]
call fcn.004217e0
push 1
mov ecx, edi
call fcn.004340dd
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x434513
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040811c
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
xor ebx, ebx
test edi, eax
jne 0x4345b2
push 0x11
call esi
test edi, eax
jne 0x4345b2
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x229
push dword [eax + 8]
call esi
mov edi, eax
cmp edi, ebx
je 0x4345b2
lea eax, [ebp + 0xc]
mov ecx, 0x48fd0c
push eax
call fcn.00401522
push ebx
lea ecx, [ebp - 0xc]
push dword [0x48fd0c]
call fcn.0045c222
lea eax, [ebp - 0xc]
lea ecx, [ebp - 8]
neg eax
sbb eax, eax
and eax, ecx
push dword [eax]
call dword [sym.imp.SHELL32.dll_ILClone]
push ebx
push 0xe103
push 0x111
push edi
mov dword [0x48fd28], eax
call esi
test eax, eax
lea ecx, [ebp - 0xc]
jne 0x4345d6
call fcn.0045bcda
push ebx
lea ecx, [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.0045c222
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
push dword [ecx]
mov ecx, dword [ebp - 4]
call fcn.0043423f
lea ecx, [ebp - 0xc]
call fcn.0045bcda
lea ecx, [ebp + 0xc]
call fcn.0040139c
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x43462d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_ILClone]
push eax
lea ecx, [ebp - 0xc]
mov dword [0x48fd28], eax
call fcn.0045bcba
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.0045bcba
mov esi, 0x8000
lea eax, [ebp - 4]
push esi
push eax
lea ecx, [ebp - 0xc]
call fcn.0045c2b5
mov eax, dword [ebp - 4]
cmp dword [eax - 8], 0
je 0x4346d0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
test esi, eax
jne 0x4346c6
push 0x11
call edi
test esi, eax
jne 0x4346c6
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x229
push dword [ebx + 8]
call esi
mov edi, eax
test edi, edi
je 0x4346c6
lea eax, [ebp - 4]
mov ecx, 0x48fd0c
push eax
call fcn.00401522
push 0
push 0xe103
push 0x111
push edi
call esi
test eax, eax
jne 0x4346d0
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.0043423f
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp - 0x14]
call fcn.0045bcda
lea ecx, [ebp - 0xc]
call fcn.0045bcda
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10