joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cb44
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x629ac4
call fcn.005d0532
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00403af0
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x42cba6
call fcn.0040f444
cmp eax, 1
jne 0x42cba6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0040d6c1
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00405d4b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00403c20
inc esi
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
push esi
test ecx, ecx
je 0x42cbb8
call fcn.0040dcee
jmp 0x42cbbe
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x10]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.00403c20
mov eax, esi
call fcn.005d04fb
ret 0xc

Function at 0x42cd09
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x629b45
call fcn.005d0532
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00403af0
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x42cd67
call fcn.0040f444
cmp eax, 1
jne 0x42cd67
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0040d6c1
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00405d4b
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00403c20
inc esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00403c20
mov eax, esi
call fcn.005d04fb
ret 0x10

Function at 0x42cd8e
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x629b70
call fcn.005d0532
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00403af0
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x42cdec
call fcn.0040f444
cmp eax, 1
jne 0x42cdec
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0040d6c1
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00405d4b
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00403c20
inc esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00403c20
mov eax, esi
call fcn.005d04fb
ret 0x14
Function at 0x42efc6
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x42f00d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x42f01c
push str.MoveFileTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42f01c
push dword [esi]
mov ecx, edi
push 2
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x644cac]
call edi
jmp 0x42f01e
cmp dword [esi + 4], ebx
je 0x42f01c
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileA]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42ff35
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6c3e44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x128
xor edi, edi
push edi
push esi
call fcn.005d3a20
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.005f0711
push eax
call fcn.00405f83
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x649fe4]
je 0x43009f
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4300b3
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4300b3
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
jne 0x42ffce
mov eax, edi
jmp 0x42fffd
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x42ffeb
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.0042fc17
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x28]
jmp 0x42fff4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
lea eax, [ecx + 1]
neg eax
sbb eax, eax
and eax, ecx
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00430261
test eax, eax
je 0x430022
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042f960
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x430026
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00430261
test eax, eax
je 0x43004d
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042f960
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x430051
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.00430261
test eax, eax
je 0x430079
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042f960
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x43007b
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x43008d
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x43009f
mov eax, edi
mov dword [esi + 0x10], eax
mov eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cfc46
leave
ret 4
xor eax, eax
jmp 0x4300a2
Function at 0x4302aa
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x4302eb
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4302fa
push str.SetFileAttributesTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4302fa
push dword [esi]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x644cac]
call edi
jmp 0x4302fc
cmp dword [esi + 4], 0
je 0x4302fa
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x45368c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x4536e2
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4536bb
call fcn.00411807
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4536d0
call fcn.00411807
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4536e2
call fcn.00411807
call fcn.0040f3f6
cmp dword [eax + 0x3c], 0
je 0x4536f7
push edi
mov ecx, ebx
call fcn.00452cb7
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004539b8
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x453720
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x45372c
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x459d45
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0041b64d
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x459d81
call fcn.0045a4aa
mov dword [esi + 0xc], 1
jmp 0x459d86
call fcn.0045a4aa
cmp dword [esi], 0
je 0x459dcf
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x459da9
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0040aa40
jmp 0x459dba
push 0xff
mov ecx, esi
call fcn.00403330
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00402c50
jmp 0x459df3
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x459df3
push dword [esi]
push dword [ebp - 4]
call fcn.004242bd
pop esi
leave
ret 0xc

Function at 0x45a32c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0045a4aa
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x45a374
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040aa40
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00402c50
jmp 0x45a37f
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004242bd
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x467cec
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x6c3e44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x467d1b
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x467d48
cmp dword [0x6cc864], 0
jne 0x467d48
lea eax, [esi - 0x41]
cmp eax, 0x19
jbe 0x467d44
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x467d44
push esi
call fcn.00605cdd
pop ecx
jmp 0x467db5
mov eax, esi
jmp 0x467db5
xor eax, eax
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
call fcn.0040c094
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov al, byte [ebp - 0x10c]
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 0x107], 0
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, byte [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005cfc46
leave
ret 4
Function at 0x49570b
Capabilities:
Get file system object information

Disassembly:
push 0x394
mov eax, 0x63024e
call fcn.005d0566
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3a0], edi
test ecx, ecx
je 0x4958a2
mov eax, dword [ebp + 0x10]
xor esi, esi
sub eax, esi
je 0x495874
sub eax, 1
je 0x49578a
sub eax, 1
je 0x495762
sub eax, 1
je 0x49578a
push 0x68c6d0
mov ecx, edi
call fcn.00403af0
mov eax, edi
call fcn.005d0510
ret 0x10
push 0x408
push 0x160
lea eax, [ebp - 0x39c]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x49574c
lea eax, [ebp - 0x28c]
push eax
jmp 0x495751
lea eax, [ebp - 0x114]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x49574c
push esi
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x238], esi
push eax
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
call fcn.004300b7
test eax, eax
je 0x49574c
call fcn.00408618
push eax
lea ecx, [ebp - 0x3a0]
call fcn.00403bd0
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], esi
jne 0x49582a
test byte [ebp - 0x21c], 0x18
jne 0x49584c
mov eax, dword [ebx]
lea ecx, [ebp - 0x3a0]
push ecx
push dword [ebp - 0x220]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
push dword [ebp - 0x224]
call dword [0x644cac]
mov ecx, ebx
call esi
jmp 0x49584c
mov eax, dword [ebx]
lea ecx, [ebp - 0x3a0]
push ecx
lea ecx, [ebp - 0x234]
push ecx
mov esi, dword [eax + 0x1a4]
mov ecx, esi
call dword [0x644cac]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x3a0]
add eax, 0xfffffff0
push eax
call fcn.0040632b
pop ecx
mov ecx, dword [ebp - 0x3a0]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.00403c20
jmp 0x495758
push 0x208
push 0x160
lea eax, [ebp - 0x39c]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x49574c
lea eax, [ebp - 0x390]
jmp 0x495787
call fcn.0040a6aa
int3

Function at 0x495a74
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00572061
call fcn.0040f44a
cmp dword [eax + 0x14], 0
jne 0x495a8f
mov ecx, esi
pop esi
jmp fcn.00494d3b
pop esi
ret

Function at 0x4a2366
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x4a237f
call fcn.0040f3f6
mov esi, dword [eax + 0xc]
push 0x6540a0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4a23c1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a23c1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4a23c1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004a23ca
jmp 0x4a23c3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ce947
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, 0x104
mov eax, dword [esi + 4]
cmp eax, ecx
ja 0x4ceada
je 0x4ceb00
cmp eax, 0xa1
jb 0x4ceb3e
cmp eax, 0xa2
jbe 0x4ceb00
cmp eax, 0xa3
jbe 0x4ceb3e
cmp eax, 0xa5
jbe 0x4ceb00
cmp eax, 0xa6
jbe 0x4ceb3e
cmp eax, 0xa8
jbe 0x4ceb00
cmp eax, 0x100
jne 0x4ceb3e
cmp dword [edi + 0xc0], 0xffffffff
je 0x4ceb00
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x4ceb00
mov eax, dword [esi + 8]
sub eax, 0x21
je 0x4cea2f
sub eax, 1
jne 0x4ceb00
mov eax, dword [edi + 0xc0]
lea ebx, [eax + 1]
jmp 0x4cea1e
mov eax, ebx
cdq
idiv ecx
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x644cac]
mov ecx, edi
call esi
test eax, eax
jne 0x4cea7b
mov eax, dword [edi + 0xc0]
inc ebx
mov ecx, dword [edi + 0xbc]
add eax, ecx
cmp ebx, eax
jl 0x4ce9f4
jmp 0x4ceb58
mov ecx, dword [edi + 0xc0]
lea ebx, [ecx - 1]
add ebx, dword [edi + 0xbc]
cmp ebx, ecx
jle 0x4ceb58
mov eax, ebx
cdq
idiv dword [edi + 0xbc]
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x644cac]
mov ecx, edi
call esi
test eax, eax
jne 0x4cea7b
dec ebx
cmp ebx, dword [edi + 0xc0]
jg 0x4cea46
jmp 0x4ceb58
mov eax, dword [edi]
push dword [ebp - 4]
mov dword [edi + 0x24c], 1
mov esi, dword [eax + 0x214]
mov ecx, esi
call dword [0x644cac]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 0x210]
mov ecx, esi
call dword [0x644cac]
mov ecx, edi
call esi
mov ecx, eax
call fcn.0041c1fd
mov eax, dword [edi]
push dword [edi + 0xc0]
mov esi, dword [eax + 0x270]
mov ecx, esi
call dword [0x644cac]
mov ecx, edi
call esi
and dword [edi + 0x24c], 0
jmp 0x4ceb58
cmp eax, 0x200
jb 0x4ceb3e
cmp eax, 0x202
jbe 0x4ceb00
cmp eax, 0x203
jbe 0x4ceb3e
cmp eax, 0x205
jbe 0x4ceb00
add eax, 0xfffffdf9
cmp eax, 1
ja 0x4ceb3e
mov eax, dword [edi + 0xfc]
test eax, eax
je 0x4ceb1f
cmp dword [eax + 0x20], ebx
je 0x4ceb1f
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [edi + 0xf8]
test eax, eax
je 0x4ceb3e
cmp dword [eax + 0x20], ebx
je 0x4ceb3e
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esi + 4], 0x203
jne 0x4ceb5d
lea eax, [edi + 0x2250]
test eax, eax
je 0x4ceb54
mov ebx, dword [eax + 0x20]
cmp dword [esi], ebx
jne 0x4ceb5d
xor eax, eax
inc eax
jmp 0x4ceb65
push esi
mov ecx, edi
call fcn.004c8779
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x5039b5
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.006060fe
pop ecx
test eax, eax
jne 0x5039f7
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0040d631
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5039bd
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret
Function at 0x53a2f2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x53a3a6
mov eax, dword [esi + 0x34c]
test eax, eax
je 0x53a3a2
mov eax, dword [eax + 0x20]
test eax, eax
je 0x53a3a2
cmp dword [ebx], eax
jne 0x53a3a2
mov eax, dword [ebx + 4]
sub eax, 1
je 0x53a371
sub eax, 1
je 0x53a33f
sub eax, 1
jne 0x53a3a2
mov edi, 0x428e
jmp 0x53a376
push 0x11
mov edi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x53a376
mov eax, dword [esi]
mov esi, dword [eax + 0x340]
mov ecx, esi
call dword [0x644cac]
mov ecx, dword [ebp - 4]
call esi
test eax, eax
je 0x53a376
add edi, 3
jmp 0x53a376
mov edi, 0x3ea0
push edi
call fcn.0040a974
test eax, eax
je 0x53a3a6
push edi
push eax
mov ecx, 0x6cddc8
call fcn.00402e00
test eax, eax
je 0x53a3a6
mov eax, dword [0x6cddc8]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x53a39b
call fcn.0040a6aa
int3

Function at 0x56e92a
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004183e5
call fcn.0040f44a
cmp dword [eax + 0x14], 0
jne 0x56e945
mov ecx, esi
pop esi
jmp fcn.0056e127
pop esi
ret

Function at 0x592355
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 8
mov eax, 0x63e696
call fcn.005d0532
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x100
jne 0x592435
mov edi, dword [ebx + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x592435
cmp edi, 0x43
je 0x59239a
cmp edi, 0x2d
jne 0x592435
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x592435
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.00408618
push eax
lea ecx, [ebp - 0x10]
call fcn.00403bd0
movzx eax, byte [esi + 0xe6]
and dword [ebp - 4], 0
push eax
movzx eax, byte [esi + 0xe5]
push eax
movzx eax, byte [esi + 0xe4]
push eax
lea eax, [ebp - 0x10]
push str.RGB__d___d___d_
push eax
call fcn.00404250
mov esi, dword [ebp - 0x10]
add esp, 0x14
mov eax, dword [esi - 0xc]
inc eax
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00403c20
mov esi, dword [ebp - 0x14]
push ebx
mov ecx, esi
call fcn.0040ece6
call fcn.005d04fb
ret 4
Function at 0x5ab22d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x5ab2a3
cmp dword [ebp + 0xc], 0
je 0x5ab2a3
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x5ab254
call fcn.0040f3f6
mov eax, dword [eax + 0xc]
test eax, eax
je 0x5ab2a3
push dword [ebp + 0xc]
mov dword [edi + 8], eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x5ab2a3
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x5ab2a3
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5ab2a3
mov esi, dword [edi]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esi + 4]
push eax
call dword [0x644cac]
mov ecx, edi
call dword [esi + 4]
jmp 0x5ab2a5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x5c6cf1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.005d3a20
mov eax, dword [ebp + 8]
add esp, 0xc
and dword [ebp - 0x34], 0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
leave
ret 0x14
Function at 0x613124
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00612d17

Function at 0x61312f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00612ea1

Function at 0x61a249
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00619c07

Function at 0x61ad09
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0061abdd