joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41842a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateDecoder
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0xc], edi
mov ebx, dword [ecx + eax*4 - 4]
mov eax, dword [ebx]
push eax
call esi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx]
push str.CreateEncoder
push eax
call esi
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx]
push str.GetMethodProperty
push eax
call esi
test eax, eax
mov dword [ebx + 0x14], eax
je 0x418554
mov eax, dword [ebx]
push str.GetNumberOfMethods
push eax
mov dword [ebp - 8], 1
call esi
test eax, eax
je 0x41849a
lea ecx, [ebp - 8]
push ecx
call eax
test eax, eax
jne 0x4185b1
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
jbe 0x418554
jmp 0x4184ad
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x10]
mov edx, dword [ebp - 4]
dec eax
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push 3
mov dword [ebp - 0x34], edx
call fcn.004185b6
test eax, eax
jne 0x4185b1
mov edx, dword [ebp - 4]
mov ecx, dword [ebx + 0x14]
lea eax, [ebp - 0x2f]
push eax
lea eax, [ebp - 0x1c]
push eax
push 2
call fcn.004185b6
test eax, eax
jne 0x4185b1
mov edx, dword [ebp - 4]
mov ecx, dword [ebx + 0x14]
lea eax, [ebp - 0x2d]
push eax
lea eax, [ebp - 0x2e]
push eax
push 0xa
call fcn.00418637
test eax, eax
jne 0x4185b1
mov eax, dword [ebp - 0xc]
push 0xb
pop ecx
lea esi, [ebp - 0x38]
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x40]
mov ecx, esi
call fcn.00419b81
mov edi, dword [esi + 4]
push 0xb
pop ecx
lea eax, [edi + 1]
imul edi, edi, 0x2c
add edi, dword [esi]
inc dword [ebp - 4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
cmp eax, dword [ebp - 8]
jb 0x4184aa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp - 0xc]
mov eax, dword [ebx]
push str.GetHashers
push eax
call esi
test eax, eax
je 0x4185af
add ebx, 0x24
push ebx
call eax
test eax, eax
jne 0x4185b1
mov ebx, dword [ebx]
test ebx, ebx
je 0x4185af
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
and dword [ebp - 0xc], 0
mov dword [ebp - 8], eax
test eax, eax
jbe 0x4185af
lea ebx, [edi + 0x4c]
mov esi, dword [edi + 0x10]
mov ecx, ebx
dec esi
call fcn.00428303
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
lea ecx, [eax + 1]
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*8], esi
mov dword [edx + eax*8 + 4], ecx
inc ecx
cmp ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
jb 0x418586
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f7fc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x461929
call fcn.0045f4a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bl
mov byte [esi + 0x17], bl
call fcn.00402410
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.00402410
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.00402410
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 6
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov word [esi + 0x4c], bx
mov byte [esi + 0x4e], bl
mov byte [esi + 0x4f], bl
call fcn.0041f886
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.0041f886
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41fb44
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4619ea
call fcn.0045f4a0
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esi], 0x4696d8
mov dword [esi + 4], 0x469658
mov dword [esi + 8], 0x4696c8
mov dword [esi + 0xc], 0x468ca0
mov dword [esi + 0x10], 0x46959c
mov dword [esi + 0x14], eax
mov byte [esi + 0x18], al
mov dword [ebp - 0x10], esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
call fcn.00402410
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402410
lea edi, [esi + 0x60]
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.004057dc
lea ecx, [edi + 0x28]
call fcn.00402410
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 5
call fcn.00412082
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x4696b4
mov dword [esi + 4], 0x4696a0
mov dword [esi + 8], 0x469690
mov dword [esi + 0xc], 0x469680
mov dword [esi + 0x10], 0x46966c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4206d2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x461b11
call fcn.0045f4a0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.00402547
and dword [ebp - 4], 0
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.00402547
mov eax, dword [edi + 0x28]
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
lea eax, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402547
lea eax, [edi + 0x3c]
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00402547
mov al, byte [edi + 0x48]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x48], al
mov al, byte [edi + 0x49]
mov byte [esi + 0x49], al
mov al, byte [edi + 0x4a]
mov byte [esi + 0x4a], al
mov al, byte [edi + 0x4b]
mov byte [esi + 0x4b], al
mov al, byte [edi + 0x4c]
mov byte [esi + 0x4c], al
mov al, byte [edi + 0x4d]
mov byte [esi + 0x4d], al
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov al, byte [edi + 0x6c]
mov byte [esi + 0x6c], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4208b3
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x461b99
call fcn.0045f4a0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
test eax, eax
mov dword [ebx], eax
je 0x4208d7
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
test eax, eax
mov dword [ebx + 4], eax
je 0x4208eb
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 8]
mov byte [ebp - 4], 1
test eax, eax
mov dword [ebx + 8], eax
je 0x4208ff
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 0xc]
mov byte [ebp - 4], 2
test eax, eax
mov dword [ebx + 0xc], eax
je 0x420913
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.00402547
lea eax, [esi + 0x24]
lea ecx, [ebx + 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.00402547
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 5
call fcn.00402547
mov eax, dword [esi + 0x3c]
add esi, 0x44
mov dword [ebx + 0x3c], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x40], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x78]
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x50]
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [ebx + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x5c], eax
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [ebx + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x74], eax
lea eax, [esi + 0x78]
push eax
call fcn.00420a12
lea eax, [esi + 0xa8]
lea ecx, [ebx + 0xa8]
push eax
mov byte [ebp - 4], 7
call fcn.00420a12
mov eax, dword [esi + 0xd8]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xdc], eax
mov eax, ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42464e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x462053
call fcn.0045f4a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x46a5a4
mov dword [esi + 4], 0x46a58c
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov dword [ebp - 4], ebx
call fcn.00402410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov dword [esi], 0x46a570
mov dword [esi + 4], 0x46a558
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42706f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x462282
call fcn.0045f4a0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.00402410
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041f886
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4270c9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4622b5
call fcn.0045f4a0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0041f124
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041f8d8
push dword [esi + 0x24]
call fcn.00402de4
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.0042bfff
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00428074
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4270d4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4622b5
call fcn.0045f4a0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0041f124
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041f8d8
push dword [esi + 0x24]
call fcn.00402de4
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.0042bfff
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00428074
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x431817
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x463365
call fcn.0045f4a0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x46b2b8
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.00402410
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402410
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402410
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00402410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi], 0x46b284
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4318b6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4633a4
call fcn.0045f4a0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 4
call fcn.0042bfff
push dword [esi + 0x30]
call fcn.00402de4
push dword [esi + 0x24]
call fcn.00402de4
push dword [esi + 0x18]
call fcn.00402de4
push dword [esi + 0xc]
call fcn.00402de4
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword [esi], 0x46b2ec
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x4323bb
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 8]
shr eax, 0xf
movzx ecx, word [ecx + 0xc]
and al, 1
cmp ecx, 8
je 0x4323fc
cmp ecx, 0x52
je 0x4323ef
cmp ecx, 0x76
je 0x4323e6
xor al, al
jmp 0x432405
mov ecx, esi
call fcn.00432dce
jmp 0x432403
test al, al
je 0x4323e2
mov ecx, esi
call fcn.00432c1c
jmp 0x432403
mov ecx, esi
call fcn.00432cbe
mov al, 1
pop esi
ret 4

Function at 0x4331f1
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4635ea
call fcn.0045f4a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x46b2b8
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.00402410
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402410
or dword [esi + 0x64], 0xffffffff
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 5
call fcn.00402410
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 6
call fcn.00402410
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x46b39c
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x433937
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x46371a
call fcn.0045f4a0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x46b2b8
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.00402410
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402410
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi], 0x46b3fc
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x433999
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x46374d
call fcn.0045f4a0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.0042bfff
push dword [esi + 0x24]
call fcn.00402de4
push dword [esi + 0x18]
call fcn.00402de4
push dword [esi + 0xc]
call fcn.00402de4
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x46b2ec
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x43674f
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x463c19
call fcn.0045f4a0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402410
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.00402410
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402410
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402410
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00402410
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4369a4
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x463ce1
call fcn.0045f4a0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00402547
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00402547
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00402547
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00402547
add edi, 0x30
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 3
call fcn.00402547
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4373f0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x463fd4
call fcn.0045f4a0
sub esp, 0x58
mov ecx, 0x47e888
call fcn.0040a19e
mov byte [0x47e890], al
call fcn.00437609
test al, al
jne 0x437427
mov ecx, str.Unsupported_Windows_version
call fcn.004373ce
push 1
pop eax
jmp 0x4375fb
push esi
call fcn.0043b7ba
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, str.comctl32.dll
call fcn.0043763f
cmp eax, 0x40047
mov dword [0x47e85c], eax
sbb al, al
inc al
mov byte [0x47e0d4], al
call fcn.0043787c
xor esi, esi
mov ecx, 0xc8
push esi
mov edx, ecx
call fcn.0040a471
neg al
sbb al, al
push esi
inc al
mov byte [0x47e893], al
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [ebp - 0x30]
call fcn.00402410
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], esi
call fcn.00402410
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00402472
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00452f03
push dword [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00402de4
pop ecx
lea ecx, [ebp - 0x30]
call fcn.004029bf
lea ecx, [ebp - 0x30]
call fcn.00402974
lea ecx, [ebp - 0x24]
call fcn.00402410
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00402410
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00452f03
lea ecx, [ebp - 0x24]
call fcn.004029bf
lea ecx, [ebp - 0x24]
call fcn.00402974
lea ecx, [ebp - 0x18]
call fcn.004029bf
lea ecx, [ebp - 0x18]
call fcn.00402974
mov ecx, dword [ebp - 0x18]
mov edx, 0x46bcf8
call fcn.00401a54
test al, al
je 0x437535
mov eax, dword [ebp - 0x18]
mov ecx, 0x47e860
add eax, 4
push eax
call fcn.004025b3
cmp dword [ebp - 0x20], esi
je 0x437548
lea eax, [ebp - 0x24]
mov ecx, 0x47e870
push eax
call fcn.00402617
call fcn.004378c5
call fcn.004378f7
mov ecx, 0x47e498
call fcn.00430066
mov ecx, dword [ebp + 8]
call fcn.004376a5
test eax, eax
je 0x4375d5
push ebx
push edi
push 0x48
push dword [0x47e880]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
mov ebx, eax
push esi
push esi
lea eax, [ebp - 0x64]
push esi
push eax
call edi
test eax, eax
je 0x4375bf
lea eax, [ebp - 0x64]
push eax
push ebx
push dword [0x47e87c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x4375b6
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
lea eax, [ebp - 0x64]
push esi
push eax
jmp 0x437587
call fcn.004244d7
mov dword [0x47e87c], esi
call dword [sym.imp.ole32.dll_OleUninitialize]
mov esi, dword [ebp - 0x5c]
pop edi
pop ebx
push dword [ebp - 0x18]
call fcn.00402de4
push dword [ebp - 0x24]
call fcn.00402de4
push dword [ebp - 0x48]
call fcn.00402de4
push dword [ebp - 0x30]
call fcn.00402de4
add esp, 0x10
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4378f7
Capabilities:
Check os version

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x43790d
mov byte [0x47e89e], 1
jmp 0x43790e
ret
mov dl, 1
mov ecx, str.SeRestorePrivilege
call fcn.004085dc
mov dl, 1
mov ecx, str.SeCreateSymbolicLinkPrivilege
jmp fcn.004085dc

Function at 0x43b9f4
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.004198b3
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp bx, ax
jne 0x43ba2d
movzx ecx, ax
mov eax, ecx
mov edx, edi
shr eax, 0xa
and ecx, 0x3ff
mov dword [esi], eax
call fcn.0043ba31
pop edi
pop esi
pop ebx
ret
Function at 0x43d32d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ecx, 0x44c
jb 0x43d39a
push esi
push ecx
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.0044deac
mov eax, dword [0x47e4a4]
mov esi, eax
imul esi, esi, 0x184
add esi, 0x47e678
mov ecx, dword [esi]
test ecx, ecx
je 0x43d379
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi], 0
mov eax, dword [0x47e4a4]
imul eax, eax, 0x184
add eax, 0x47e67c
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x43d395
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi], 0
mov al, 1
pop esi
leave
ret
mov eax, 0x224
cmp ecx, eax
ja 0x43d4de
je 0x43d4ad
add eax, 0xfffffff9
cmp ecx, eax
ja 0x43d411
je 0x43d40a
sub ecx, 0x65
je 0x43d403
dec ecx
je 0x43d3fc
dec ecx
je 0x43d3f5
dec ecx
je 0x43d3ee
dec ecx
je 0x43d3da
sub ecx, 0x1b3
jne case.0x43d4f4.553
push 1
jmp 0x43d491
push str.SHA256
mov ecx, 0x47e498
call fcn.004419c7
jmp 0x43d5e7
push str.SHA1
jmp 0x43d3df
push str.CRC64
jmp 0x43d3df
push str.CRC32
jmp 0x43d3df
push 0x4684b0
jmp 0x43d3df
push 0
jmp 0x43d507
sub ecx, 0x21e
je 0x43d48f
dec ecx
je 0x43d48b
dec ecx
je 0x43d46d
dec ecx
je 0x43d451
dec ecx
je 0x43d445
dec ecx
jne case.0x43d4f4.553
push dword [0x47e4a4]
push 0
push 1
mov ecx, 0x47e498
call fcn.00430ccc
jmp 0x43d5e7
push dword [0x47e4a4]
push 0
push 0
jmp 0x43d436
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.0044f046
jmp 0x43d5e7
push 1
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.0044a77a
jmp 0x43d5e7
push 0
jmp 0x43d46f
push 0
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.0044a8db
jmp 0x43d5e7
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
shr eax, 0xf
not al
and al, 1
add ecx, 0x47e50c
mov byte [ebp - 4], al
push dword [ebp - 4]
call fcn.0044e39a
jmp 0x43d5e7
lea eax, [ecx - 0x225]
cmp eax, 0x2a
ja case.0x43d4f4.553
movzx eax, byte [eax + 0x43d623]
jmp dword [eax*4 + 0x43d5ef]
push str._.
jmp 0x43d507
push 0x46bb30
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.0044a896
jmp 0x43d5e7
mov ecx, 0x47e498
call fcn.004466fd
jmp 0x43d5e7
push ecx
mov ecx, 0x47e498
call fcn.0045a414
jmp 0x43d5e7
mov ecx, 0x47e498
call fcn.00450529
jmp 0x43d5e7
mov ecx, 0x47e498
call fcn.00450da8
jmp 0x43d5e7
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.0044ca7d
jmp 0x43d5e7
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.0044f077
jmp 0x43d5e7
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.0044eb62
jmp 0x43d5e7
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.0044edc5
jmp 0x43d5e7
mov ecx, 0x47e498
call fcn.0045d580
jmp 0x43d5e7
mov ecx, dword [0x47e4a4]
imul ecx, ecx, 0x184
add ecx, 0x47e50c
call fcn.00445cb9
mov al, 1
leave
ret
xor al, al
leave
ret