joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4628c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x462929
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push 0
push dword [ebp + 0x10]
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4629d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x800
xor bl, bl
mov dword [ebp - 4], 0x800
call fcn.005823cc
push dword [ebp - 4]
mov esi, eax
push 0
push esi
call fcn.0057e5f0
add esp, 0x10
test esi, esi
je 0x462b34
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 8]
cmp ecx, 1
je 0x462a34
cmp ecx, 2
jne 0x462b22
cmp eax, 0xea
jne 0x462a66
push dword [ebp - 4]
push esi
call fcn.0058a5de
mov esi, eax
add esp, 8
test esi, esi
je 0x462b34
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x462b22
mov eax, dword [ebp - 4]
cmp eax, 2
jbe 0x462b20
shr eax, 1
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x462a90
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x462a90
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp + 0x10]
push esi
call fcn.0040491a
cmp dword [ebp - 8], 2
jne 0x462b20
mov ebx, dword [ebp - 4]
and ebx, 0xfffffffe
lea eax, [ebx + ebx]
push eax
call fcn.005823cc
mov edi, eax
add esp, 4
test edi, edi
je 0x462b20
lea eax, [ebx + ebx]
push eax
push 0
push edi
call fcn.0057e5f0
add esp, 0xc
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
jbe 0x462b03
add eax, eax
push eax
push edi
call fcn.0058a5de
mov edi, eax
add esp, 8
test edi, edi
je 0x462b03
push dword [ebp - 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x462b17
mov ecx, dword [ebp + 0x10]
push edi
call fcn.00457cf0
push edi
call fcn.005823b1
add esp, 4
mov bl, 1
push esi
call fcn.005823b1
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468aa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9930
mov eax, dword fs:[0]
push eax
mov eax, 0x1084
call fcn.0057bfb0
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
cmp dword [eax + 0x10], 0
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x103c], ecx
mov dword [ebp - 0x1030], eax
jne 0x468b04
push ebx
push esi
push edi
push ecx
call fcn.00469300
add esp, 0x10
jmp 0x468ce5
lea eax, [ebp - 0x1028]
push eax
call fcn.00468d20
add esp, 4
cmp dword [ebp - 0x1018], 0
mov dword [ebp - 4], 0
je 0x468cb0
cmp dword [esi + 0x14], 8
mov byte [ebp - 0x1029], 0
mov dword [ebp - 0x1034], esi
jb 0x468b42
mov eax, dword [esi]
mov dword [ebp - 0x1034], eax
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x1038], edi
jb 0x468b56
mov eax, dword [edi]
mov dword [ebp - 0x1038], eax
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x468b60
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x1030]
cmp dword [ecx + 0x14], 8
jb 0x468b6e
mov ecx, dword [ecx]
push dword [ebp - 0x1034]
cmp dword [ebp - 0x1014], 8
lea eax, [ebp - 0x1028]
push dword [ebp - 0x1038]
cmovae eax, dword [ebp - 0x1028]
push edx
push ecx
push eax
push 0x5d39d0
lea eax, [ebp - 0x1010]
push 0x800
push eax
call fcn.0045b020
add esp, 0x20
mov dword [ebp - 0x108c], 0
xor eax, eax
mov dword [ebp - 0x1088], 0
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1048], eax
mov dword [ebp - 0x1044], eax
mov dword [ebp - 0x1040], eax
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1090]
mov dword [ebp - 0x1084], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1080], 0
push eax
push 0
mov dword [ebp - 0x107c], 0
mov dword [ebp - 0x1078], 0
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0x1070], 0
mov dword [ebp - 0x106c], 0
mov dword [ebp - 0x1068], 0
mov dword [ebp - 0x1064], 0
mov dword [ebp - 0x1060], 0
mov dword [ebp - 0x105c], 0
mov dword [ebp - 0x1058], 0
mov dword [ebp - 0x1054], 0
mov dword [ebp - 0x1050], 0
mov dword [ebp - 0x1090], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
movzx ecx, byte [ebp - 0x1029]
test eax, eax
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x1030], ecx
jmp 0x468ccd
push dword [ebp - 0x1030]
push ebx
push esi
push edi
push dword [ebp - 0x103c]
call fcn.00468650
add esp, 0x14
mov byte [ebp - 0x1030], al
lea ecx, [ebp - 0x1028]
mov dword [ebp - 4], 0xffffffff
call fcn.004047c6
mov eax, dword [ebp - 0x1030]
test al, al
jne 0x468cfa
push ebx
push esi
push edi
push dword [ebp - 0x103c]
call fcn.00469300
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
Function at 0x4695e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9a52
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x218], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x214], eax
mov word [esi], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov dword [ebp - 0x218], 1
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x469771
push ebx
call fcn.005460f3
mov edi, eax
add esp, 4
test edi, edi
je 0x46968a
push ebx
push 0
push edi
call fcn.0057e5f0
add esp, 0xc
jmp 0x46968c
xor edi, edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x218], 3
mov dword [ebp - 4], 1
test edi, edi
je 0x469771
push edi
push ebx
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0
push dword [ebp - 0x214]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x5d2854
push edi
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [ebp - 0x214]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x210]
push 0x5d3aa8
push eax
call fcn.004695b0
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 0x220], 0
je 0x469768
mov edx, dword [ebp - 0x224]
test edx, edx
je 0x469768
mov ecx, edx
lea ebx, [ecx + 2]
jmp 0x469750
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469750
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.0040491a
push edi
call fcn.005460ee
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
Function at 0x46b1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x46b34e
cmp dword [edi + 0x20], 0
je 0x46b34e
cmp dword [edi + 0x24], 0
je 0x46b34e
mov esi, dword [edi + 0x1c]
test esi, esi
je 0x46b34e
cmp dword [esi], edi
jne 0x46b34e
mov eax, dword [esi + 4]
cmp eax, 0x2a
je 0x46b228
cmp eax, 0x39
je 0x46b228
cmp eax, 0x45
je 0x46b228
cmp eax, 0x49
je 0x46b228
cmp eax, 0x5b
je 0x46b228
cmp eax, 0x67
je 0x46b228
cmp eax, 0x71
je 0x46b228
cmp eax, 0x29a
jne 0x46b34e
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x2c], 2
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
test ecx, ecx
jns 0x46b25d
neg ecx
mov dword [esi + 0x18], ecx
push 0
push 0
push 0
cmp ecx, 2
jne 0x46b276
mov dword [esi + 4], 0x39
call fcn.0046f610
jmp 0x46b28d
test ecx, ecx
mov edx, 0x2a
mov eax, 0x71
cmovne eax, edx
mov dword [esi + 4], eax
call fcn.0046f380
add esp, 0xc
mov dword [edi + 0x30], eax
mov dword [esi + 0x28], 0
push esi
call fcn.0046dea0
mov esi, dword [edi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.0057e5f0
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x5d3b52]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x5d3b50]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x5d3b54]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x5d3b56]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebp
ret
pop edi
mov eax, 0xfffffffe
pop esi
pop ebp
ret
Function at 0x46f380
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046f390

Function at 0x46f610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x46f61c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.0046f630

Function at 0x47b270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x628]
test eax, eax
jne 0x47b2ac
push 0x32
call fcn.005823cc
push 0x32
push 0
push eax
mov dword [esi + 0x628], eax
call fcn.0057e5f0
mov eax, dword [esi + 0x628]
add esp, 0x10
test eax, eax
jne 0x47b2ac
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1d4]
mov ecx, dword [esi + 0x628]
mov dword [ecx], eax
mov eax, dword [esi + 0x26c]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x628]
and ecx, 0x2000
shl ecx, 9
mov dword [eax + 4], ecx
cmp dword [esi + 0x8c], 0
jne 0x47b2f3
push 0
push 0
push dword [esi + 0x628]
mov ecx, esi
call fcn.0054ef4d
mov ecx, esi
pop esi
jmp fcn.0054ec6d
Function at 0x480a40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x480ad9
push 0
lea eax, [ebp - 0x40]
push eax
push 0xe
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x480ad2
cmp dword [ebp - 0x40], 0xe
jne 0x480ad2
push 0
lea eax, [ebp - 0x40]
push eax
push 0x28
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x480ad2
cmp dword [ebp - 0x40], 0x28
jne 0x480ad2
push ebx
xor ebx, ebx
cmp word [ebp - 0x2e], 0x20
push esi
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret

Function at 0x480af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x480b2c
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x480b2c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x480b2c
xor eax, eax
cmp word [ecx + 0xe], 0x20
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x480bc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x480c70
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x474e5089
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x480c69
cmp dword [ebp - 8], 4
jne 0x480c69
lea ecx, [ebp - 0xc]
mov eax, dword [ecx]
lea edx, [ebp - 4]
push esi
cmp eax, dword [edx]
je 0x480c3a
cmp al, byte [edx]
jne 0x480c50
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x480c50
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x480c50
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x480c50
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
pop esi
sete al
pop edi
mov esp, ebp
pop ebp
ret
sbb esi, esi
push edi
or esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
pop esi
sete al
pop edi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x480e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba8ad
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x634b28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 2
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x480eda
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x480eda
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x480eda
mov ebx, dword [esi + 8]
xor eax, eax
imul ebx, dword [esi + 4]
mov dword [ebp - 0x14], eax
shl ebx, 2
cmp word [esi + 0xe], 0x20
jne 0x480edc
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebx + 0x28]
cmp eax, ecx
jb 0x480eda
lea ecx, [ebp - 0x2c]
call fcn.0055295f
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00553268
push 0x34
call fcn.005823cc
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x480eee
lea ecx, [ebp - 0x2c]
call fcn.00552a71
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
mov edi, eax
mov dword [ebp - 0x10], 0
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [ebp - 0x10]
mov dword [eax + 0x14], ebx
push ecx
push 0
push eax
push dword [ebp - 0x28]
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov esi, eax
test esi, esi
je 0x480f5b
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x480f5b
mov eax, dword [ebp - 0x18]
add eax, 0x28
test ebx, ebx
je 0x480f58
push ebx
test eax, eax
je 0x480f3d
push eax
push ecx
call fcn.0057e070
add esp, 0xc
jmp 0x480f58
push 0
push ecx
call fcn.0057e5f0
add esp, 0xc
call fcn.00582661
mov dword [eax], 0x16
call fcn.00582350
mov dword [ebp - 0x14], esi
push dword [ebp - 0x1c]
call fcn.005823b1
add esp, 4
lea ecx, [ebp - 0x2c]
call fcn.00552a71
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x482f30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5baf65
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x634b28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0xe
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48306e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x483058
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x483058
xor eax, eax
xor esi, esi
cmp ax, word [ebx + 4]
jae 0x483037
lea ecx, [ebp - 0x38]
call fcn.0047c330
mov edx, dword [ebp + 0x14]
movzx ecx, si
mov dword [ebp - 4], 0
lea eax, [ecx*8]
sub eax, ecx
movzx ecx, byte [ebx + eax*2 + 6]
movzx edi, byte [ebx + eax*2 + 7]
lea eax, [ebx + eax*2]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], ecx
cmp edx, ecx
jne 0x482fe0
cmp eax, edi
je 0x482fe8
test edx, edx
jne 0x48301d
test eax, eax
jne 0x48301d
mov eax, dword [ebp + 0xc]
push 0
push edi
push ecx
movzx eax, word [eax + 0x12]
lea ecx, [ebp - 0x38]
push eax
push dword [ebp + 8]
call fcn.0047e5d0
test eax, eax
je 0x483050
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x38]
push edi
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push eax
call fcn.00482900
test eax, eax
je 0x483050
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0047c740
inc esi
cmp si, word [ebx + 4]
jb 0x482fa4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x38]
call fcn.0047c740
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x38]
call fcn.0047c330
push 0
push dword [ebp + 0x18]
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 1
push dword [ebp + 0x14]
push esi
push ebx
call fcn.0047e5d0
test eax, eax
jne 0x483097
xor esi, esi
jmp 0x4830b0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x38]
mov ecx, edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call fcn.00482900
mov esi, eax
lea ecx, [ebp - 0x38]
call fcn.0047c740
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x483c60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb0c0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x634b28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x30]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CXTPResize.0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push 0x5ca050
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00404ab8
lea ecx, [esi + 0x38]
mov dword [ebp - 4], 0
call fcn.00483d70
lea ecx, [esi + 0xc0]
call fcn.00483c30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x48a5d0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, dword [ebx + 0x74]
cmp dword [ecx + 0x60], 2
je 0x48a715
mov edx, dword [ebp + 8]
lea eax, [edx - 0x60]
cmp eax, 9
ja 0x48a5fe
cmp dword [ecx + 0x80], 0
je 0x48a715
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x48a715
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x50]
mov esi, eax
push esi
call fcn.0048a500
add esp, 4
neg eax
sbb edi, edi
and edi, esi
xor esi, esi
cmp dword [ebx + 0x84], esi
jle 0x48a66e
push esi
mov ecx, ebx
call fcn.00489db0
mov dword [ebp - 4], eax
cmp dword [eax + 0xc8], 0
jne 0x48a66c
mov ecx, dword [ebx + 0x74]
test byte [ecx + 0x60], 1
je 0x48a661
test edi, edi
jne 0x48a661
push eax
call fcn.0048a500
add esp, 4
test eax, eax
cmovne edi, dword [ebp - 4]
inc esi
cmp esi, dword [ebx + 0x84]
jl 0x48a631
jmp 0x48a66e
mov edi, eax
test edi, edi
je 0x48a715
push edi
call fcn.0048a500
add esp, 4
test eax, eax
je 0x48a715
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
call dword [eax + 0x220]
test eax, eax
jne 0x48a707
lea eax, [ebp - 4]
mov ecx, ebx
push eax
push esi
push edi
call fcn.00489810
mov esi, eax
test esi, esi
je 0x48a715
mov edi, dword [esi + 0xc0]
mov eax, dword [esi + 0x40]
mov dword [ebp + 8], eax
cmp dword [edi + 0xc8], 0
jne 0x48a6c8
mov ecx, ebx
call fcn.00488ec0
push 1
mov ecx, ebx
call fcn.0048b8b0
push 1
mov dword [ebx + 0x44], 1
mov ecx, edi
mov eax, dword [edi]
push 0
push 1
call dword [eax + 0x168]
mov eax, dword [edi]
mov ecx, edi
push 1
push dword [ebp + 8]
call dword [eax + 0x170]
cmp dword [ebp - 4], 0
jne 0x48a707
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xb0]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48acd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [edi + 4], 0x104
jne 0x48ad79
mov eax, 0x2000
test word [edi + 0xe], ax
je 0x48ad79
call fcn.0048a0b0
cmp dword [eax + 4], 0
jg 0x48ad79
push 0
mov ecx, esi
call fcn.0048a0b0
mov ecx, eax
call fcn.004e96d0
test eax, eax
jne 0x48ad79
mov ecx, esi
call fcn.0048a0b0
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x48ad29
mov eax, dword [eax + 0x20]
push eax
call fcn.004e96c0
add esp, 4
test eax, eax
je 0x48ad79
cmp dword [edi + 8], 0x12
jne 0x48ad4d
push 1
mov ecx, esi
call fcn.0048b8b0
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
cmp dword [esi + 0x24], 0
je 0x48ad62
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x48ad79
mov eax, dword [edi + 8]
test eax, eax
je 0x48ad79
push eax
mov ecx, esi
call fcn.0048a5d0
test eax, eax
jne 0x48ae01
mov eax, dword [edi + 4]
cmp eax, 0x105
je 0x48ad8a
cmp eax, 0x101
jne 0x48adb8
cmp dword [esi + 0xc8], 0
je 0x48adb8
cmp dword [esi + 0xb0], 0
je 0x48adb8
push 0
mov ecx, esi
call fcn.0048a0b0
mov ecx, eax
call fcn.004e96d0
test eax, eax
jne 0x48adb8
push eax
mov ecx, esi
call fcn.0048b8b0
mov eax, dword [edi + 4]
cmp eax, 0x7b
je 0x48adc7
cmp eax, 0x105
jne 0x48ae0c
push 0
mov ecx, esi
call fcn.0048a0b0
mov ecx, eax
call fcn.004e96d0
test eax, eax
je 0x48ae0c
push 0x489300
mov ecx, 0x63da64
call fcn.0055d9ce
test eax, eax
je 0x48aeb9
push dword [edi + 0xc]
mov ecx, eax
push dword [edi + 8]
push 0x7b
call fcn.004e91b0
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
cmp dword [edi + 4], 0x20a
jne 0x48ae8d
push 0x489300
mov ecx, 0x63da64
call fcn.0055d9ce
test eax, eax
je 0x48aeb9
cmp dword [eax + 0x1c], 0
jle 0x48ae5d
push 0x489300
mov ecx, 0x63da64
call fcn.0055d9ce
test eax, eax
je 0x48aeb9
push dword [edi + 0xc]
mov ecx, eax
push dword [edi + 8]
push 0x20a
call fcn.004e91b0
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
test eax, eax
je 0x48ae8d
cmp dword [eax + 0xe0], 3
jne 0x48ae8d
mov edx, dword [eax]
xor ecx, ecx
cmp word [edi + 0xa], cx
setle cl
push ecx
mov ecx, eax
call dword [edx + 0x254]
test eax, eax
jne 0x48ae01
mov eax, dword [edi + 4]
sub eax, 0x100
cmp eax, 9
ja 0x48aeb1
push edi
mov ecx, esi
call fcn.0048a1d0
mov ecx, eax
call fcn.0049d6d0
test eax, eax
jne 0x48ae01
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
call fcn.005461a6
int3