joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c848
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
xor edx, edx
xor ebx, ebx
push esi
inc ebx
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], edx
cmp dword [eax + 4], edx
je 0x474feb
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov dword [edi], edx
mov byte [ecx], dl
mov byte [eax], dl
mov dword [ebp - 0xc], 0x2b
mov dword [ebp - 8], 0x23
mov edi, edx
push edi
mov ecx, esi
call fcn.0041c9b3
movzx eax, word [eax]
push 0x2b
pop ecx
push 0x5e
cmp ax, cx
pop ecx
push 0x21
pop edx
je 0x474ff2
cmp ax, cx
je 0x474ff2
cmp ax, dx
je 0x474ff2
cmp ax, word [ebp - 8]
je 0x474ff2
push edi
inc edi
mov ecx, esi
mov dword [ebp + 0x1c], edi
call fcn.0041c9b3
movzx eax, word [eax]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, 0x7b
jne 0x47506d
push 0x40
lea ecx, [ebp - 0x20]
call fcn.0040324a
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x7d
call fcn.0041c95d
test al, al
je 0x41c959
push dword [ebp - 0x20]
push dword [esi*4 + 0x4bc5d0]
call fcn.004226a7
pop ecx
pop ecx
test eax, eax
je 0x41c927
inc esi
cmp esi, 0x62
jl 0x41c90c
cmp esi, 0x62
je 0x475024
cmp byte [esi + 0x4bc568], 0
jne 0x41c959
movzx eax, byte [esi + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [edi], eax
lea ecx, [ebp - 0x20]
call fcn.00407487
and dword [edi], 0xff
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x18
xor bl, bl
jmp 0x41c942
lea ecx, [ebp - 0x20]
call fcn.00407487
xor al, al
jmp 0x41c952
cmp ax, word [ebp - 0xc]
jne 0x474ffd
mov eax, dword [ebp + 0x10]
jmp 0x47501c
cmp ax, cx
jne 0x475007
mov eax, dword [ebp + 0x14]
jmp 0x47501c
cmp ax, dx
jne 0x475011
mov eax, dword [ebp + 0x18]
jmp 0x47501c
push 0x23
pop ecx
cmp ax, cx
jne 0x47501e
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
inc edi
jmp 0x41c894
push 0
lea ecx, [ebp - 0x20]
call fcn.00409d6e
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x474fe3
test eax, 0x200
je 0x47504c
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x475058
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x41c942
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x41c942
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x474feb
test eax, 0x200
je 0x47508c
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x475098
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x41c94a
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x41c94a
Function at 0x41cb40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4757b3
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x4757cb
or eax, eax
jmp 0x41cb5f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 8]
jmp 0x41cb5f

Function at 0x41cfd5
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
mov edi, ecx
push 5
pop eax
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
push ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x41ed44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x41edc1
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41edc1
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41edc1
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41eda8
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x41edb8
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x41eda6
xor al, al
jmp 0x41edb4
Function at 0x41f9f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
push ebx
call fcn.0040bb2d
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47584d
xor al, al
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push 0x49ec40
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4758c7
mov eax, dword [ebp - 4]
push esi
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420bea
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00401ea4
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push 0x49ec40
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4758be
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 4], eax
mov word [esi + eax*2], cx
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00407719
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.00401ecf
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x41fa26
Function at 0x4201be
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push edi
mov edi, 0x4c2810
jne 0x47f99c
mov ecx, dword [0x4c287c]
cmp ecx, 0xffffffff
je 0x420264
mov eax, dword [0x4c2870]
push ebx
mov eax, dword [eax + ecx*4]
push esi
mov esi, dword [eax]
xor ecx, ecx
mov ebx, dword [esi]
cmp byte [esi + 0x3a], cl
je 0x420210
mov byte [esi + 0x3a], cl
cmp dword [esi + 0x18c], ecx
jge 0x47f9b3
cmp dword [esi + 0x1a4], ecx
jne 0x47f9da
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x47fa01
je 0x420238
test edi, edi
je 0x420285
cmp edi, 1
je 0x420238
cmp edi, 2
je 0x42027c
cmp edi, 3
je 0x420273
jle 0x42025a
cmp edi, 5
jg 0x420268
cmp byte [esi + 0x38], 0
jne 0x420293
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 8
je 0x420256
cmp edi, 4
je 0x420256
push ebx
call fcn.00420297
mov byte [esi + 0x38], 1
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 8
xor eax, eax
jmp 0x42025f
cmp edi, 6
je 0x47f9e9
jmp 0x42025a
mov byte [esi + 0x38], 1
jmp 0x47fa56
mov byte [esi + 0x38], 1
jmp 0x47f9e9
push ecx
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x38], 0
jmp 0x42025a
xor eax, eax
jmp 0x42025d
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0041b63a
mov ecx, eax
mov dword [0x4c287c], ecx
jmp 0x4201d7
cmp byte [esi + 0x198], cl
je 0x420204
push dword [esi + 0x194]
mov ecx, edi
push esi
call fcn.0046ef12
xor ecx, ecx
mov byte [esi + 0x198], cl
jmp 0x420204
push dword [esi]
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor ecx, ecx
jmp 0x420210
cmp byte [esi + 0x38], 0
je 0x420293
push 6
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42025a
mov eax, edi
sub eax, 9
je 0x47fa56
sub eax, 0x37
je 0x47fa48
dec eax
je 0x47fa45
dec eax
je 0x47fa35
dec eax
jne 0x42025a
push ecx
mov byte [esi + 0x39], cl
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push 1
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x42025a
push ebx
mov byte [esi + 0x39], 1
call dword [sym.imp.USER32.dll_LockWindowUpdate]
jmp 0x42025a
push ecx
jmp 0x47fa4a
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x42025a
cmp byte [esi + 0x38], 0
je 0x420293
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call fcn.00420297
jmp 0x42025a
Function at 0x420297
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [ebp + 8]
mov esi, eax
cmp ebx, esi
jne 0x4750ad
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 4
push edi
xor edi, edi
test esi, esi
jne 0x4750c2
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4750d6
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x4751b1
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp + 8], eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
push 1
push edi
push dword [ebp + 8]
call esi
push 1
push dword [ebp - 4]
push edi
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x47518d
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 8]
test eax, eax
je 0x475192
push 4
jmp 0x47518f
push 3
pop ebx
jmp 0x475195
mov ebx, dword [ebp - 0xc]
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call esi
push 0
push edi
push dword [ebp + 8]
call esi
push 0
push dword [ebp - 4]
push edi
call esi
jmp 0x4751b4
push 2
pop ebx
mov eax, ebx
pop edi
jmp 0x4202b5
Function at 0x4351a2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bbdc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [section..data]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0042966c
mov dword [ebp - 0x14], eax
cmp dword [0x4c2048], edi
jne 0x435293
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x435220
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x435373
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x435373
push 0x49ca50
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435373
push eax
call ebx
push 0x49ca5c
push esi
mov dword [0x4c2048], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4c204c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4c2050], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c2058], eax
test eax, eax
je 0x435290
push 0x49ca9c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c2054], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4352b8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4352ab
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4352cd
push 4
pop eax
jmp 0x435375
cmp dword [ebp - 0x14], edi
je 0x4352cd
push dword [0x4c2048]
call dword [0x4bb004]
push 3
jmp 0x4352b2
mov eax, dword [0x4c2054]
mov ebx, dword [0x4bb004]
cmp eax, esi
je 0x43532b
cmp dword [0x4c2058], esi
je 0x43532b
push eax
call ebx
push dword [0x4c2058]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43532b
test eax, eax
je 0x43532b
call ecx
test eax, eax
je 0x435320
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x435320
test byte [ebp - 8], 1
jne 0x43532b
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x43535b
mov eax, dword [0x4c204c]
cmp eax, esi
je 0x435358
push eax
call ebx
test eax, eax
je 0x435358
call eax
mov edi, eax
test edi, edi
je 0x435358
mov eax, dword [0x4c2050]
cmp eax, esi
je 0x435358
push eax
call ebx
test eax, eax
je 0x435358
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4c2048]
call ebx
test eax, eax
je 0x435373
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x435375
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bf8f
leave
ret
Function at 0x43b9be
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x30]
mov edi, edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call fcn.0040ca0b
lea ecx, [ebp - 0x20]
call fcn.0040ca0b
lea ecx, [ebp - 0x40]
call fcn.0040ca0b
push 0x4b38f4
lea ecx, [ebp - 0x30]
call fcn.00407719
push esi
lea ecx, [ebp - 0x30]
call fcn.00403465
push str.CLSID
lea ecx, [ebp - 0x30]
call fcn.00403465
lea ecx, [ebp - 0x20]
call fcn.0040bb2d
test edi, edi
je 0x43ba41
push 0x5c
pop eax
cmp word [edi], ax
je 0x43ba41
cmp word [edi + 2], ax
je 0x43ba41
push 0x4b3928
lea ecx, [ebp - 0x20]
call fcn.00407719
push edi
lea ecx, [ebp - 0x20]
call fcn.00403465
cmp dword [ebp + 0xc], ebx
je 0x43ba92
push 0x20
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00422450
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x5c], ebx
call fcn.0040bf9c
push str.IPC_
lea ecx, [ebp - 0x40]
call fcn.00403465
mov eax, dword [ebp - 0x40]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov esi, eax
test esi, esi
js 0x43bb1e
lea eax, [ebp - 0x10]
push eax
push reloc.WSOCK32.dll_bind
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x43bb1e
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x43bb19
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x43bb14
mov eax, dword [ebp - 0xc]
push dword [ebp + 8]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov word [ebp + eax*2 - 0x26c], cx
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov esi, eax
push dword [ebp - 8]
call edi
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0x40]
call fcn.00407487
lea ecx, [ebp - 0x20]
call fcn.00407487
lea ecx, [ebp - 0x30]
call fcn.00407487
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x43c2d5
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push esi
xor ebx, ebx
push ebx
push dword [eax]
mov edi, ecx
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x43c32c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43c32f
push dword [esi]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x43c32f
push esi
push dword [esi]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x43c32f
xor ebx, ebx
inc ebx
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x43c779
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
call fcn.0043c49e
test al, al
je 0x43c78b
pop ebp
jmp fcn.0043c4d7
pop ebp
jmp fcn.0043c791

Function at 0x43c922
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0x14]
push dword [ebp + 0x1c]
and eax, 2
push 0
or eax, 4
shr eax, 1
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
neg eax
sbb eax, eax
neg eax
pop ebp
ret 0x18

Function at 0x43ca84
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0xc
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
mov ebx, eax
push 0
push ebx
call edi
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 2
push 0
push 0
lea eax, [ebx + 8]
push eax
call edi
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + 4], eax
xor eax, eax
push eax
push eax
push ebx
push 0x43caf5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x43ce2c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov esi, ecx
push 0xb0
push dword [esi]
mov dword [ebp - 0x10], esi
call edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jb 0x43ce5c
xor al, al
jmp 0x43ced6
push ebx
xor ebx, ebx
push ebx
push ebx
push 0xe
push dword [esi]
call edi
mov edi, eax
test edi, edi
je 0x43ced3
cmp edi, dword [ebp - 8]
jb 0x43ced3
cmp edi, dword [ebp - 4]
jb 0x43ced3
xor ecx, ecx
push 2
lea esi, [edi + 1]
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420bea
pop ecx
push eax
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push 0xd
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0xc]
test eax, eax
je 0x43cec8
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x43ceb7
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea eax, [esi + eax*2]
push eax
call fcn.00407719
mov bl, 1
push esi
call fcn.00420c5e
pop ecx
mov al, bl
jmp 0x43ced5
xor al, al
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x43d874
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 1
push dword [esi]
mov dword [ebp - 4], esi
call fcn.0043ea80
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 1
push eax
cmp dword [ebp + 8], ebx
jge 0x43d8cc
push 0x25
push 0x100
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x43d8f4
push 0x27
push 0x100
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
mov edi, dword [ebp - 4]
push 0x101
push dword [edi]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [edi]
call fcn.0043ea80
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 4

Function at 0x43e0b2
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp byte [ebp + 0xc], 1
jne 0x43e0dd
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x43e0f6
push 1
jmp 0x43e0de
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
pop ebp
ret 8

Function at 0x43ec30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.0040bb2d
push dword [ebx]
call fcn.00401532
test al, al
je 0x43ec52
xor al, al
jmp 0x43ecce
mov ecx, ebx
call fcn.0043ecd5
test eax, eax
mov ecx, 0x7fff
cmove eax, ecx
mov dword [ebp - 8], eax
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420bea
pop ecx
mov edi, eax
push edi
push esi
push 0xd
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x43ecc5
push edi
call fcn.00422ed0
pop ecx
push edi
cmp eax, dword [ebp - 8]
jne 0x43ecbd
lea ecx, [ebp - 0x18]
call fcn.0043ea3d
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040bb90
lea ecx, [ebp - 0x18]
call fcn.00407487
jmp 0x43ecc5
mov ecx, dword [ebp + 8]
call fcn.00407719
push edi
call fcn.00420c5e
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4