joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62

Function at 0x1409b3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409b31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409b3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409b306f
add dl, dl
jne 0x1409b3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409b30f6
xor eax, eax
add dl, dl
jne 0x1409b30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409b31ad
add dl, dl
jne 0x1409b30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409b30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409b30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409b30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409b30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409b307e
mov eax, 1
add dl, dl
jne 0x1409b3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409b3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409b30fb
sub eax, ebx
mov ebx, 1
jne 0x1409b314c
mov ecx, 1
add dl, dl
jne 0x1409b312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409b313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409b3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409b307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409b3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409b3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409b315d
cmp eax, 0x7d00
jae 0x1409b319b
cmp eax, 0x500
jb 0x1409b3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409b307e
cmp eax, 0x7f
ja 0x1409b319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409b307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409b31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409b307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x414ab0
Capabilities:
Get graphical window text

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x414b06
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xa0], 0
jne 0x414b06
mov edx, 0x100
lea rcx, [0x005a1290]
call fcn.00422700
test eax, eax
je 0x414b06
int3
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xa0], 0
jne 0x414b32
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x414ba6
lea rcx, [rsp + 0x20]
call fcn.0044b5b0
nop
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rax]
lea rdx, [rsp + 0x20]
call qword [rax + 0x128]
lea rcx, [rsp + 0x20]
call fcn.004c1cf0
movsxd rcx, dword [rsp + 0x60]
mov r9, 0xffffffffffffffff
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.004160f0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call fcn.00407d10
mov eax, dword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x41f4c0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x58], 0
jne 0x41f4ed
mov edx, 0x407
lea rcx, [0x005a5720]
call fcn.00422700
test eax, eax
je 0x41f4ed
int3
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add rsp, 0x28
ret
Function at 0x420470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
shr rax, 0x10
test rax, rax
je 0x4204bc
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call fcn.004a0e80
test eax, eax
jne 0x4204bc
mov edx, 0x98
lea rcx, [0x005a7408]
call fcn.00422700
test eax, eax
je 0x4204bc
int3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0xb0], rcx
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0xb0]
shr rax, 0x10
test rax, rax
jne 0x420510
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0xa8], 0
jne 0x420510
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0xb0]
and rax, 0xffff
movzx eax, ax
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0xa8], eax
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.00422140
test eax, eax
jne 0x420555
xor eax, eax
test eax, eax
jne 0x42053e
mov edx, reloc.OLEAUT32.dll_LoadRegTypeLib
lea rcx, [0x005a7440]
call fcn.00422700
test eax, eax
je 0x42053e
int3
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x238]
xor eax, eax
jmp 0x4205bb
call fcn.00459300
mov qword [rsp + 0x28], rax
mov r8d, 5
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.00420610
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x420770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
call fcn.00459300
mov qword [rsp + 0x28], rax
mov r8d, 5
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x4207e7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x420807
mov edx, 0xdf
lea rcx, [0x005a74e8]
call fcn.00422700
test eax, eax
je 0x420807
int3
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.00420850
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x40]
call fcn.0040f370
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x43a7b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.00476940
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x78]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.00416cb0
test rax, rax
je 0x43a7f4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
mov rcx, qword [rsp + 0x28]
call fcn.00416d90
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x20], rax
cmp dword [rsp + 0x50], 0
je 0x43a83e
cmp qword [rsp + 0x20], 0
je 0x43a83e
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jl 0x43a83e
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x20]
call qword [rax + 0x2e0]
add rsp, 0x48
ret

Function at 0x43a950
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x43a989
mov edx, 0x44f
lea rcx, [0x005b2d30]
call fcn.00422700
test eax, eax
je 0x43a989
int3
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0xa0], 0
jne 0x43a9ee
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x24], eax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.00447d20
mov ecx, dword [rsp + 0x24]
mov r8d, ecx
mov rdx, rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x48]
call fcn.00411dd0
jmp 0x43aa14
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x48]
call qword [rax + 0x128]
add rsp, 0x38
ret

Function at 0x442da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x68], 0
je 0x442e46
call fcn.00459300
mov qword [rsp + 0x38], rax
mov r8d, pe_nt_image_headers64
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x442e46
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x442e16
xor eax, eax
jmp 0x442e82
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x442e46
mov edx, 0x1007
lea rcx, [0x005b44f0]
call fcn.00422700
test eax, eax
je 0x442e46
int3
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
call fcn.00442e90
mov dword [rsp + 0x28], eax
cmp qword [rsp + 0x20], 0
je 0x442e7e
cmp qword [rsp + 0x30], 0
je 0x442e7e
mov rcx, qword [rsp + 0x30]
call fcn.0040f370
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x28]
add rsp, 0x58
ret
Function at 0x44a5c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x44a69c
cmp qword [rsp + 0x60], 0
je 0x44a69c
lea r8, [rsp + 0x30]
lea rdx, [0x005b9150]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_StringFromCLSID]
mov rcx, qword [rsp + 0x48]
call fcn.004eede0
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
mov r8d, 1
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x4508e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov r8d, 0x16d
lea rdx, [0x005bca68]
mov rcx, qword [rsp + 0xa0]
call fcn.00422960
cmp qword [rsp + 0xa8], 0
jne 0x45092e
mov edx, 0x16e
lea rcx, [0x005bcaa0]
call fcn.00422700
test eax, eax
je 0x45092e
int3
call fcn.00459300
mov qword [rsp + 0x30], rax
mov r8d, 0xf1
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x450965
xor eax, eax
jmp 0x450b4f
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x450989
xor eax, eax
jmp 0x450b4f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x4509a8
xor eax, eax
jmp 0x450b4f
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 1
je 0x4509cd
mov edx, 0x17d
lea rcx, [0x005bcad8]
call fcn.00422700
test eax, eax
je 0x4509cd
int3
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
mov qword [rsp + 0x88], rax
mov eax, 4
mov rcx, qword [rsp + 0x88]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov r8d, 0x17f
lea rdx, [0x005bcb10]
mov rcx, rax
call fcn.004064a0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x50], 0
jmp 0x450a32
mov eax, dword [rsp + 0x50]
add eax, 1
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x50], eax
jge 0x450a63
mov rcx, qword [rsp + 0x20]
call fcn.00454c10
movsxd rcx, dword [rsp + 0x50]
movzx eax, word [rax + rcx*2]
movsxd rcx, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
jmp 0x450a27
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0xa0]
call fcn.00450e60
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.00406c20
cmp dword [rsp + 0x38], 0
je 0x450b36
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 4]
mov rcx, qword [rsp + 0x20]
movzx ecx, word [rcx + 2]
mov r8d, eax
mov edx, ecx
lea rcx, [rsp + 0x58]
call fcn.00589730
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 4]
add eax, 7
mov rcx, qword [rsp + 0x20]
movzx ecx, word [rcx + 2]
add ecx, 7
mov r8d, eax
mov edx, ecx
lea rcx, [rsp + 0x60]
call fcn.00589730
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
call fcn.00450510
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.00450b60
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x40]
call fcn.0040f370
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x38]
add rsp, 0x98
ret
Function at 0x47d6c0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x78], 0
jne 0x47d6f3
mov edx, 0x158
lea rcx, [0x005d2610]
call fcn.00422700
test eax, eax
je 0x47d6f3
int3
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x24], 1
jmp 0x47d710
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x10]
cmp dword [rsp + 0x24], eax
jge 0x47d7d5
cmp qword [rsp + 0x80], 0
je 0x47d74e
movsxd rax, dword [rsp + 0x24]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rsp + 0x80]
cmp qword [rcx + rax + 8], rdx
jne 0x47d7b3
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x47d792
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x28]
call qword [rax]
mov qword [rsp + 0x48], rax
jmp 0x47d79b
mov qword [rsp + 0x48], 0
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x18]
mov qword [rcx + rax*8], 0
jmp 0x47d7d0
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x18]
cmp qword [rcx + rax*8], 0
je 0x47d7d0
mov dword [rsp + 0x20], 0
jmp 0x47d705
cmp dword [rsp + 0x20], 0
je 0x47d878
mov rax, qword [rsp + 0x70]
add rax, 0x28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x70]
add rax, 0x18
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call fcn.0047e080
mov rax, qword [rsp + 0x70]
add rax, 0x28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x47d860
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x38]
call qword [rax]
mov qword [rsp + 0x50], rax
jmp 0x47d869
mov qword [rsp + 0x50], 0
xor edx, edx
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x68
ret

Function at 0x4a5de0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x4a5e14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x30]
mov ecx, eax
call fcn.004cf490
add rsp, 0x28
ret

Function at 0x4a5e20
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4a5e4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x30]
mov ecx, eax
call fcn.004cf490
add rsp, 0x28
ret
Function at 0x4a7300
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
jne 0x4a73c0
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x88]
mov r8d, 1
mov rdx, qword [rsp + 0x80]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x4a73b1
lea rcx, [0x00688c10]
call fcn.00406080
mov qword [rsp + 0x60], rax
mov r8d, VarDateFromDisp
lea rdx, [0x005e2640]
lea rcx, [rsp + 0x40]
call fcn.00406030
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rcx
lea r9, [0x005e2678]
xor r8d, r8d
mov rcx, qword [rsp + 0x60]
mov rdx, rcx
mov rcx, rax
call fcn.00406040
xor eax, eax
jmp 0x4a748e
mov eax, 1
jmp 0x4a748e
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x80]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4a743d
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4a743d
cmp dword [rsp + 0x38], 0
jne 0x4a743d
mov eax, 1
jmp 0x4a748e
lea rcx, [0x00688c10]
call fcn.00406080
mov qword [rsp + 0x68], rax
mov r8d, VarBstrFromDate
lea rdx, [0x005e26b8]
lea rcx, [rsp + 0x50]
call fcn.00406030
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rcx
lea r9, str.Warning:_registration_database_update_failed_for_key__s._n
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
mov rcx, rax
call fcn.00406040
xor eax, eax
add rsp, 0x78
ret
Function at 0x4b7510
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov dword [rsp + 0x40], 0
xor edx, edx
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x70], 0
je 0x4b755a
mov eax, dword [rsp + 0x24]
or eax, 0x1000000
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x30]
call fcn.0044b5b0
nop
mov dword [rsp + 0x28], 0x40
mov eax, dword [rsp + 0x28]
shl eax, 1
mov dword [rsp + 0x28], eax
mov edx, dword [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.00447d20
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x28]
add eax, 1
mov r8d, eax
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.00411dd0
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
je 0x4b756d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.00411da0
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x30]
call fcn.00407d10
mov rax, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x4e1850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 4]
and eax, 1
test eax, eax
je 0x4e1882
mov rax, qword [rsp + 0x78]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
jmp 0x4e18f5
mov r8d, 5
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x4e18b2
call fcn.00473c20
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x4e18d8
call fcn.00473c20
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x4e18f5
call fcn.00473c20
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 2]
cmp eax, 0xffff
jne 0x4e19dd
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
and eax, 0x80000000
test eax, eax
je 0x4e19a4
call fcn.004767a0
mov rax, qword [rax + 0xc8]
mov rcx, qword [rax]
call fcn.00407c00
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x4e195d
mov edx, 0x12b
lea rcx, [0x006038a8]
call fcn.00422700
test eax, eax
je 0x4e195d
int3
cmp qword [rsp + 0x48], 0
je 0x4e19a2
lea rdx, str.DllGetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x4e19a2
xor eax, eax
test eax, eax
jne 0x4e19a2
mov edx, 0x130
lea rcx, [0x006038f0]
call fcn.00422700
test eax, eax
je 0x4e19a2
int3
jmp 0x4e19dd
mov eax, dword [rsp + 0x40]
and rax, 0xffff
movzx eax, ax
and rax, 0xff
movzx eax, al
cmp eax, 3
jne 0x4e19dd
xor eax, eax
test eax, eax
jne 0x4e19dd
mov edx, 0x136
lea rcx, [0x00603928]
call fcn.00422700
test eax, eax
je 0x4e19dd
int3
call fcn.004767a0
cmp qword [rax + 0x68], 0
je 0x4e19fd
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call fcn.004e17e0
mov qword [rsp + 0x28], rax
mov edx, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
call fcn.004e1640
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0xb8], 0
je 0x4e1a44
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0xb8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, qword [rsp + 0x70]
mov qword [rax + 0xb8], 0
cmp qword [rsp + 0x20], 0
je 0x4e1a67
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0xb8], rcx
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 4]
or eax, 1
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 4], eax
add rsp, 0x68
ret