joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51db40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51dbf6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00406e90
lea eax, [ebp - 0x14]
call fcn.00407030
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.004318a0
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x68]
mov edx, 0x10
call fcn.004318a0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040767c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x51dbe0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51dbfd
lea eax, [ebp - 0x14]
call fcn.00406a84
ret
Function at 0x51dce0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51de4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax], edx
cmp dword [ebp - 4], 0
je 0x51de2f
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00406e90
mov eax, dword [ebp - 0x18]
cmp word [eax], 0x22
je 0x51dd49
push 0x51de68
push dword [ebp - 0x18]
push 0x51de68
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004078f4
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x51de78
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.00432200
mov eax, dword [ebp - 0x1c]
call fcn.0040767c
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x68]
mov edx, 0x44
call fcn.004318a0
mov dword [ebp - 0x68], 0x44
mov word [ebp - 0x38], 1
lea eax, [ebp - 0x78]
mov edx, 0x10
call fcn.004318a0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x51de2f
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x51de28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0xffffffff
jne 0x51dde8
call fcn.00406244
jmp 0x51de2f
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x51de05
call fcn.00406244
jmp 0x51de2f
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51de2f
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51de51
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00406ae4
ret

Function at 0x5224d0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52255c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x522538
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00522470
mov eax, dword [ebp - 0x1c]
call fcn.0040767c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
jne 0x522546
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522563
lea eax, [ebp - 0x1c]
call fcn.00406a84
ret
Function at 0x5225d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52276b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x522611
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x522743
cmp dword [ebp + 0xc], 0
jne 0x522622
cmp dword [ebp + 8], 0x80000000
ja 0x522635
jmp 0x522624
jg 0x522635
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x522743
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0x7fffffff
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00522470
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov ecx, 0x52278c
call fcn.0040786c
lea eax, [ebp - 0x18]
mov edx, 0x105
call fcn.00407794
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
call fcn.00406f58
push eax
mov eax, dword [ebp - 0x18]
call fcn.0040767c
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.0040767c
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
jne 0x5226d0
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 4]
mov edx, 0x52279c
call fcn.0040786c
mov edx, dword [ebp - 0x28]
mov eax, dword [0x653d30]
mov eax, dword [eax]
mov ecx, 0x522804
call fcn.0043ee40
jmp 0x522743
mov eax, dword [ebp - 0x18]
call fcn.0040767c
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.004076d4
mov edx, 0x52283c
mov eax, dword [ebp - 0x18]
call fcn.0042e480
test eax, eax
jne 0x522703
mov dword [ebp - 0x10], 0x80000000
mov dword [ebp - 0xc], 0
jmp 0x522743
mov edx, 0x522854
mov eax, dword [ebp - 0x18]
call fcn.0042e480
test eax, eax
jne 0x522724
mov dword [ebp - 0x10], 0x80000000
mov dword [ebp - 0xc], 0
jmp 0x522743
mov edx, 0x522868
mov eax, dword [ebp - 0x18]
call fcn.0042e480
test eax, eax
jne 0x522743
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522772
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00406ae4
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00406ae4
ret
Function at 0x5538b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov byte [ebp - 5], 0
push 0x553b18
push 0x553b28
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040bce4
mov dword [ebp - 4], eax
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x5538f7
push ebp
mov eax, 0x553b4c
call fcn.005537b0
pop ecx
jmp 0x553b10
xor eax, eax
push ebp
push 0x553b09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 1
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0xffff
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_setsockopt
inc eax
jne 0x553931
push ebp
mov eax, 0x553ba0
call fcn.005537b0
pop ecx
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
call fcn.004318a0
mov word [ebp - 0x2c], 2
push 0x553be0
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_bind
inc eax
jne 0x553980
push ebp
mov eax, 0x553bf8
call fcn.005537b0
pop ecx
call fcn.00406244
jmp 0x553b10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_getsockname
inc eax
jne 0x5539aa
push ebp
mov eax, 0x553c34
call fcn.005537b0
pop ecx
call fcn.00406244
jmp 0x553b10
push 0x553be0
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x28], eax
push 0x7fffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_listen
inc eax
jne 0x5539de
push ebp
mov eax, 0x553c80
call fcn.005537b0
pop ecx
call fcn.00406244
jmp 0x553b10
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x553a08
push ebp
mov eax, 0x553cd0
call fcn.005537b0
pop ecx
call fcn.00406244
jmp 0x553b10
xor eax, eax
push ebp
push 0x553adc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.ws2_32.dll_connect
inc eax
jne 0x553a45
push ebp
mov eax, 0x553d20
call fcn.005537b0
pop ecx
call fcn.00406244
call fcn.00406244
jmp 0x553b10
push ebp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00553770
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x553a77
push ebp
mov eax, 0x553d60
call fcn.005537b0
pop ecx
call fcn.00406244
call fcn.00406244
jmp 0x553b10
xor eax, eax
push ebp
push 0x553aaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553ab6
mov eax, dword [ebp - 0x18]
push eax
call sub.ws2_32.dll_closesocket
inc eax
jne 0x553aae
push ebp
mov eax, 0x553d9c
call fcn.005537b0
pop ecx
ret
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x553eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f64
mov edx, eax
mov eax, dword [ebp - 8]
xor ecx, ecx
call fcn.004074a4
mov eax, dword [ebp - 4]
call fcn.00406f64
test eax, eax
jle 0x553f12
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
call fcn.00406f64
sub eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov bl, byte [edx + eax]
xor bl, 0x2a
mov eax, dword [ebp - 8]
call fcn.00407028
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x553ee7
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x565710
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.user32.dll_GetShellWindow
cmp eax, dword [ebp - 4]
je 0x565738
push 0
push 0x565744
call sub.user32.dll_FindWindowW
cmp eax, dword [ebp - 4]
je 0x565738
xor eax, eax
jmp 0x56573a
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x589f80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x58a069
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x58a04e
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00406e90
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x22
je 0x589fdf
push 0x58a084
push dword [ebp - 0x10]
push 0x58a084
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004078f4
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x58a094
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00432200
mov eax, dword [ebp - 0x14]
call fcn.0040767c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.004318a0
mov dword [ebp - 0x5c], 0x44
mov word [ebp - 0x2c], 1
lea eax, [ebp - 0x6c]
mov edx, 0x10
call fcn.004318a0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x58a04e
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58a070
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ae4
ret
Function at 0x5db630
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov edx, dword [0x5db558]
call fcn.00407d18
xor eax, eax
push ebp
push 0x5db6fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x5db50c]
call fcn.00408ba0
add esp, 4
lea eax, [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0x5db590
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0x14]
call fcn.00408984
test eax, eax
jne 0x5db69a
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x5db6e2
mov eax, dword [ebp - 0x14]
call fcn.0040898c
test eax, eax
jl 0x5db6da
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5db6d2
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0xc], eax
jmp 0x5db6e2
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x5db6b1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5db705
lea eax, [ebp - 0x18]
mov edx, dword [0x5db558]
call fcn.00407df0
ret
Function at 0x5ee7a0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x5ee886
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
inc dword [eax - 4]
lea ecx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00433970
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.00432b40
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0041b37c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
lea eax, [ebp - 0xc]
call fcn.0040786c
push 1
mov eax, dword [ebp - 0xc]
call fcn.0040767c
push eax
mov eax, dword [ebp - 8]
call fcn.0040767c
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x5ee843
push 4
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040767c
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
jne 0x5ee83d
mov dl, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
call fcn.0043fe70
mov byte [ebp - 2], 1
jmp 0x5ee85e
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.0040767c
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee88d
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ae4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406ae4
ret
Function at 0x5f8dc0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f8f2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040767c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5f8f12
test byte [ebp - 0x10], 1
je 0x5f8f12
push 0x5f8f48
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0041b37c
push dword [ebp - 0x18]
push 0x5f8fa4
push dword [ebp - 4]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004078f4
mov eax, dword [ebp - 0x14]
push eax
call fcn.0061cac0
xor ecx, ecx
pop edx
call fcn.0043ee40
mov eax, dword [ebp - 0x10]
and eax, 0xfffffffe
push eax
mov eax, dword [ebp - 4]
call fcn.0040767c
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.0040767c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0x10], eax
test byte [ebp - 0x10], 1
jne 0x5f8ec5
cmp byte [0x653312], 0
jne 0x5f8ea2
mov byte [0x653312], 1
mov al, byte [0x5f8fb4]
push eax
push 0
mov ecx, dword [ebp - 8]
mov eax, dword [0x65466c]
mov eax, dword [eax]
mov edx, 0x7d
call fcn.005e1390
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x5f8fc4
call fcn.0040786c
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0061cac0
xor ecx, ecx
pop edx
call fcn.0043f390
jmp 0x5f8f12
cmp byte [0x653311], 0
jne 0x5f8ef1
mov byte [0x653311], 1
mov al, byte [0x5f8fb4]
push eax
push 0
mov ecx, dword [ebp - 8]
mov eax, dword [0x65466c]
mov eax, dword [eax]
mov edx, 0x7e
call fcn.005e1390
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, 0x5f9020
call fcn.0040786c
mov eax, dword [ebp - 0x20]
push eax
call fcn.0061cac0
xor ecx, ecx
pop edx
call fcn.0043ee40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f8f34
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406ae4
ret
Function at 0x600bb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x600cc2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0042edf0
mov eax, dword [0x653398]
call fcn.00433c40
dec eax
cmp eax, 0
jl 0x600ca7
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x653398]
call fcn.00433970
mov byte [ebp - 0x19], 0
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, 1
mov eax, dword [ebp - 0x14]
call fcn.00407b98
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jl 0x600c9a
cmp byte [ebp - 0x19], 0
jne 0x600c72
mov byte [ebp - 0x19], 1
lea eax, [ebp - 0x18]
mov edx, 0x105
call fcn.00407794
mov eax, dword [ebp - 0x18]
call fcn.0040767c
push eax
push 0
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [0x653398]
call fcn.00433a40
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x600c6a
lea eax, [ebp - 0x18]
call fcn.00431d20
jmp 0x600c72
lea eax, [ebp - 0x18]
call fcn.00406a84
mov eax, dword [ebp - 0x14]
call fcn.00406f58
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00407a84
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.00407ae0
jmp 0x600c08
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x600bf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x600cc9
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00406ae4
ret

Function at 0x605fb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x60607a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65409c]
mov eax, dword [eax]
cmp byte [eax + 0x16], 0
je 0x605ffa
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x605ffa
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x605ffa
mov byte [ebp - 5], 1
jmp 0x60605f
mov eax, dword [ebp - 4]
test byte [eax + 0xa0], 0x20
setne byte [ebp - 5]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.004abbd0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0x606094
call fcn.0040786c
mov edx, dword [0x6540b0]
mov edx, dword [edx]
mov eax, dword [0x65409c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.0047ea50
test al, al
je 0x60605f
mov al, byte [ebp - 5]
push eax
mov edx, dword [0x6540b0]
mov edx, dword [edx]
mov eax, dword [0x65409c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.0047e200
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x606081
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406ae4
ret
Function at 0x613dd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x613f07
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
add eax, 0xb0
mov ecx, 1
mov edx, dword [0x5fcbac]
call fcn.00408ba0
add esp, 4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x16c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xb0]
mov dword [edx], eax
mov eax, dword [ebp - 4]
add eax, 0x1e0
mov edx, dword [ebp - 8]
mov ecx, dword [0x5fe6b0]
call fcn.00408084
mov eax, dword [ebp - 4]
mov dx, word [0x613f14]
mov word [eax + 0xb4], dx
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
call fcn.00406ee4
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x18]
call fcn.00406e48
mov eax, dword [ebp - 4]
add eax, 0x14
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
call fcn.00406e48
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c8], eax
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x34]
mov edx, dword [ebp - 4]
mov byte [edx + 0x1c1], al
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x35]
mov edx, dword [ebp - 4]
mov byte [edx + 0xa8], al
mov eax, dword [ebp - 8]
push dword [eax + 0x2c]
push dword [eax + 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x14]
call fcn.004d7fd0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x140
call fcn.00406ee4
mov eax, dword [ebp - 4]
add eax, 0x54
mov edx, 0x613f24
call fcn.00406e48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x613f0e
lea eax, [ebp - 0xc]
call fcn.00406aa8
ret