joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4303f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x483453
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00431ad0
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], ebx
call fcn.0042ec10
mov dword [esi + 0x18], ebx
mov al, 1
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], al
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x38], bl
mov byte [esi + 0x39], bl
mov byte [esi + 0x3a], bl
mov byte [esi + 0x3b], al
mov byte [esi + 0x3c], bl
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov byte [esi + 0x5c], bl
mov dword [esi + 0x64], 0xffffffff
mov dword [esi + 0x68], ebx
mov byte [esi + 0x6c], bl
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
call fcn.00436400
mov al, byte [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov byte [esi + 0xcd], al
mov dword [esi + 0x9c], ebx
mov byte [esi + 0xa0], bl
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xb0], ebx
mov byte [esi + 0xc4], bl
mov byte [esi + 0xc5], bl
mov dword [esi + 0xc8], 0x3f800000
mov byte [esi + 0xcc], bl
mov dword [esi], 0x489770
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x437019
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x483753
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00436a90
mov al, byte [esp + 0xb]
xor ebx, ebx
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], bl
mov dword [esi + 0x28], ebx
mov dword [esp + 0x18], ebx
mov byte [esi + 0x2c], al
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x44], ebx
call fcn.0042ec10
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi], 0x489930
mov dword [esi + 4], 6
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4370b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x483773
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
push ebp
mov dword [esp + 8], ebx
mov dword [ebx], 0x489930
mov ebp, dword [ebx + 0x34]
mov edx, dword [ebx + 0x30]
mov eax, ebp
mov dword [esp + 0x18], 1
cmp eax, ebp
je 0x437103
push esi
push edi
mov esi, eax
mov edi, edx
add eax, 0x28
mov ecx, 0xa
add edx, 0x28
cmp eax, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4370ec
pop edi
pop esi
mov eax, dword [ebx + 0x34]
lea ecx, [ebx + 0x48]
mov dword [esp + 0xc], eax
mov dword [ebx + 0x34], edx
call fcn.0042edb0
mov eax, dword [ebx + 0x30]
push eax
mov dword [esp + 0x10], eax
call fcn.004240a0
mov ecx, dword [esp + 0x14]
add esp, 4
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebx], 0x489910
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x437230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4837c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00436a90
xor edi, edi
lea ecx, [esi + 0x28]
mov dword [esp + 0x14], edi
mov dword [esi + 0x20], 0xffffffff
call fcn.0042ec10
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0xff
mov dword [esi], 0x489938
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x437246
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4837c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00436a90
xor edi, edi
lea ecx, [esi + 0x28]
mov dword [esp + 0x14], edi
mov dword [esi + 0x20], 0xffffffff
call fcn.0042ec10
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0xff
mov dword [esi], 0x489938
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x438680
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [ecx + 4]
sub esp, 0x114
lea eax, [esp + 0xc]
push esi
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x43872b
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x43872b
push edi
push esi
call fcn.004244ce
add esp, 4
mov edi, eax
lea ecx, [esp + 0x14]
push edi
push esi
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x438721
lea edx, [esp + 0x10]
lea eax, [esp + 8]
push edx
push eax
push 0x496478
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x438721
mov eax, dword [esp + 8]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
shr edx, 0x10
push ecx
push edx
push str.v._d._d._d._d
push 0x4a04d0
call fcn.0042fcf0
add esp, 0x18
push edi
call fcn.004240a0
add esp, 4
pop edi
pop esi
add esp, 0x114
ret

Function at 0x43a470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x483ba3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
mov dword [esp + 8], ebx
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
push ebx
lea edx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x38], ebx
call fcn.0043bf00
add esp, 0x10
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.0043c420
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.0043c230
cmp dword [esp + 0x14], ebx
jne 0x43a577
lea eax, [esp + 0x30]
push ebx
push eax
lea ecx, [esp + 0x10]
call fcn.0043c4f0
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 2
call fcn.0043c4d0
test eax, eax
je 0x43a56a
push str.Layer
lea ecx, [esp + 0x34]
call fcn.0043c4d0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x43a53a
push 0x78
call fcn.004244ce
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x28], 3
je 0x43a531
mov ecx, eax
call fcn.00442bf0
mov byte [esp + 0x28], 2
jmp 0x43a54c
xor eax, eax
mov byte [esp + 0x28], 2
jmp 0x43a54c
lea ecx, [esp + 0x30]
call fcn.0043c4d0
push eax
call fcn.0040a820
add esp, 4
mov esi, eax
cmp esi, ebx
je 0x43a56a
mov edx, dword [esi]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call dword [edx + 4]
test al, al
jne 0x43a59b
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.0043c230
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.0043c230
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.0043c230
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.0043c230
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x43c800
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
call fcn.0043d5a0
call fcn.0043d800
mov esi, dword [0x496428]
mov edi, dword [esp + 0xc]
test esi, esi
je 0x43c841
mov eax, dword [esp + 0x10]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esi + 0xc]
call fcn.0042ef50
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x14], ecx
mov ecx, esi
call fcn.0043cff0
mov ecx, esi
call fcn.0043cf70
test eax, eax
jne 0x43c851
pop edi
pop esi
ret 0x10
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
test eax, eax
jne 0x43c861
pop edi
pop esi
ret 0x10
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax]
pop edi
pop esi
ret 0x10

Function at 0x43c950
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov al, byte [0x4a0588]
push esi
test al, al
jne 0x43c9b9
mov ecx, 0x4a0560
call fcn.004303a0
test al, al
jne 0x43c9b9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call fcn.0043cde0
mov esi, eax
add esp, 8
test esi, esi
je 0x43c9b9
lea edx, [esp + 0x18]
push edi
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push edx
push esi
mov dword [esp + 0x34], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
test edi, edi
pop edi
je 0x43c9bd
mov eax, dword [esp + 0x14]
pop esi
pop ecx
ret
Function at 0x43c9c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x483d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [0x4a0588]
push esi
xor esi, esi
push edi
test al, al
mov dword [esp + 8], esi
jne 0x43cad1
mov ecx, 0x4a0560
call fcn.004303a0
test al, al
jne 0x43cad1
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
push eax
push ecx
call fcn.0043cde0
mov edi, eax
add esp, 8
cmp edi, esi
jne 0x43ca21
mov edx, dword [esp + 0x2c]
push edx
jmp 0x43cad6
push ebx
push ebp
lea ecx, [esp + 0x10]
call fcn.0042ec10
mov ebp, dword [esp + 0x30]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x2c]
push eax
push esi
push ecx
push esi
push ebp
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x50], esi
call ebx
mov esi, eax
test esi, esi
jne 0x43ca7f
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.0042f2e0
lea ecx, [esp + 0x30]
push eax
push ecx
push esi
push ebp
push edi
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0042f350
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop ebx
test esi, esi
jne 0x43cac0
mov esi, dword [esp + 0x20]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0042ec20
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0042edb0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0042edb0
mov eax, dword [esp + 0x2c]
push eax
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.0042ee40
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x43cb00
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4a0588]
push esi
test al, al
jne 0x43cb68
mov ecx, 0x4a0560
call fcn.004303a0
test al, al
jne 0x43cb68
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0043cde0
mov esi, eax
add esp, 8
test esi, esi
je 0x43cb68
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x1c]
push edi
mov dword [esp + 0x20], edx
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x43cb68
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x43cb70
Capabilities:
Set registry value

Disassembly:
push esi
mov ecx, 0x4a0560
call fcn.004303a0
test al, al
jne 0x43cbbd
mov eax, dword [esp + 8]
push eax
call fcn.0043cd80
mov esi, eax
add esp, 4
test esi, esi
je 0x43cbbd
mov edx, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
ret
xor eax, eax
pop esi
ret
Function at 0x43cbd0
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
mov ecx, 0x4a0560
call fcn.004303a0
test al, al
jne 0x43cc68
mov ebx, dword [esp + 0x14]
test ebx, ebx
jne 0x43cc06
call fcn.0043ccc0
mov esi, eax
test esi, esi
je 0x43cc68
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x43cc54
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x43cc2b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0043cd80
mov esi, eax
add esp, 4
test esi, esi
je 0x43cc68
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x43cc54
mov edx, dword [esp + 0x10]
push edx
call fcn.0043cd80
mov esi, eax
add esp, 4
test esi, esi
je 0x43cc68
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x43d380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x483db0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0xc]
xor edi, edi
mov ecx, esi
mov dword [esp + 0x10], edi
xor bl, bl
call fcn.00430390
lea ecx, [esp + 0x14]
mov ebp, eax
call fcn.0042ec10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x20
push ecx
mov ecx, esi
mov dword [esp + 0x38], edi
call fcn.0042f380
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0042eef0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.0042edb0
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
push edi
push edx
call fcn.0047cfe6
add esp, 8
test eax, eax
jne 0x43d404
mov bl, 1
cmp dword [esp + 0x10], ebp
jge 0x43d45e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x20
push ecx
mov ecx, esi
call fcn.0042f380
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0042eef0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 0
call fcn.0042edb0
test bl, bl
je 0x43d3f0
lea ecx, [esp + 0x14]
call fcn.0042f4b0
lea ecx, [esp + 0x14]
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042edb0
mov eax, esi
jmp 0x43d471
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042edb0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x43d490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x483dd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
lea esi, [ecx + 0xc]
xor ebx, ebx
push edi
mov ecx, esi
mov dword [esp + 0x10], ebx
call fcn.00430390
lea ecx, [esp + 0x14]
mov ebp, eax
call fcn.0042ec10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x20
push ecx
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.0042f380
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0042eef0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.0042edb0
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
push edi
push edx
call fcn.0047cfe6
add esp, 8
test eax, eax
je 0x43d557
cmp dword [esp + 0x10], ebp
jge 0x43d56c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x20
push ecx
mov ecx, esi
call fcn.0042f380
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0042eef0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.0042edb0
mov edx, dword [esp + 0x14]
push edi
push edx
call fcn.0047cfe6
add esp, 8
test eax, eax
jne 0x43d510
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042edb0
mov al, 1
jmp 0x43d57f
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042edb0
xor al, al
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x43d5a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
xor dl, dl
cmp eax, 2
mov eax, dword [esp + 4]
mov ecx, 1
jne 0x43d5d8
cmp eax, 5
mov byte [0x4a0589], cl
jae 0x43d5de
mov byte [0x4a0589], dl
cmp eax, 5
ja 0x43d5f8
jne 0x43d5eb
cmp dword [esp + 8], ecx
jae 0x43d5f8
mov byte [0x4a058a], dl
add esp, 0x94
ret
mov byte [0x4a058a], cl
add esp, 0x94
ret
Function at 0x447c49
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x484548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.0042ec10
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
push 0
push 0
push eax
mov ecx, edi
mov dword [esp + 0x28], 0
call fcn.0043c470
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.0043aa10
mov edx, dword [0x496428]
mov eax, dword [esp + 0x30]
push 0
push 0
mov ebx, dword [edx + 0x34]
push eax
mov ecx, edi
call fcn.0043c470
push eax
call fcn.0043a5d0
mov ecx, dword [esp + 0x34]
add esp, 4
push eax
push ecx
push edi
mov ecx, esi
call fcn.0043a830
push eax
push 0
lea ecx, [esp + 0x1c]
call fcn.004303b0
push eax
mov ecx, ebx
call fcn.0043e6c0
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.0042edb0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10

Function at 0x44d100
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x44d10a
mov eax, dword [eax + 4]
push esi
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x44d11c
xor al, al
pop esi
ret 4
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x44d136
call dword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
pop esi
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x44d14d
call dword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
pop esi
ret 4
mov ecx, dword [esp + 8]
push eax
call fcn.0042ef50
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, 1
pop esi
ret 4

Function at 0x44d210
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
xor esi, esi
call edi
test ax, ax
jge 0x44d228
mov esi, 1
push 4
call edi
test ax, ax
jge 0x44d234
or esi, 0x10
push 2
call edi
test ax, ax
jge 0x44d240
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x44d24c
or esi, 4
push 0x11
call edi
test ax, ax
jge 0x44d258
or esi, 8
mov eax, esi
pop edi
pop esi
ret
Function at 0x44dc10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
call fcn.0044dbd0
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
and edi, 0xffff
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x44dc45
mov ebp, 1
jmp 0x44dc85
push 0x496ff8
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x44dc5b
mov ebp, 2
jmp 0x44dc85
push 0x496ff4
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x44dc71
mov ebp, 3
jmp 0x44dc85
push 0x496ff0
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x44dcba
mov ebp, 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44dcba
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x44dcba
mov ecx, dword [esp + 0x10]
push ebp
push edi
push eax
call fcn.0044dcd0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
Function at 0x451e30
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x48472b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x451ec7
push 0x2584
call fcn.004244ce
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x451e90
push edi
push fcn.00451d90
push 0x451d60
lea edi, [eax + 4]
push 0x64
push 0x60
push edi
mov dword [eax], 0x64
call fcn.004245bb
mov edx, edi
pop edi
jmp 0x451e92
xor edx, edx
mov eax, dword [esi + 4]
mov dword [esi + eax*4 + 8], edx
mov dword [esi + 0x30], edx
mov eax, 0x60
mov ecx, dword [esi + 4]
mov ecx, dword [esi + ecx*4 + 8]
add ecx, eax
add eax, 0x60
mov dword [edx + 0x30], ecx
cmp eax, 0x2580
mov edx, ecx
jl 0x451ea1
mov dword [edx + 0x30], 0
mov eax, dword [esi + 4]
inc eax
mov dword [esi + 4], eax
mov eax, dword [esi + 0x30]
mov ecx, dword [esp + 8]
mov edx, dword [eax + 0x30]
mov dword [esi + 0x30], edx
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x451fd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov ebx, ecx
jne 0x451fe5
mov eax, dword [0x496428]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0x10]
push 0x4973fc
and ecx, 0xffff
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x45200a
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x452029
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebx + 4], eax
jne 0x45203f
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, ebx
push edx
call fcn.004520a0
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc