joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43df53
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x43e019
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43dfd1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43dfc3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43dfc1
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x43dfcf
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x43e017
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x1fe0
push 0x6f8
push dword [ebp - 0x28]
push 0x2e6e
push 0x678a
push 0x4db0
push dword [ebp - 0x2c]
push 0x76db
push 0
push 0x60c0
push 1
push 0x51d9
call fcn.0042d0e2
add esp, 0x30
jmp 0x43e05e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x44], eax
push 0x4ebc
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 1
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.0043afba
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x4402eb
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 8]
test eax, eax
je 0x44041d
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44037e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x440353
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x440379
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x440379
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x44041b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4403d3
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4403d1
push 0x7a20
push 0
push 0x1e1b
push 0x64db
push 1
call fcn.004355d4
add esp, 0x14
jmp 0x44041b
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x440401
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x44041b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.0040b367
or dword [eax], 0xffffffff
jmp 0x4403f6
jmp 0x44043a
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
push 0x3be4
push 1
push 0x7cd1
call fcn.0041c78f
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4431a4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c56e5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44337b
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44334a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x443231
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov dword [eax + 0x10], 1
jmp 0x443348
mov dword [ebp - 0x24], 0x4508
mov dword [ebp - 0x44], str.wpyzfcycb_wkgnf_esrmrzfq_tpoamo_mvgjemiab_lrhgywzwx_alxte_xzs_ofgvuvke_ppvg_uwo_ylapxmd_uekv_ofn
cmp dword [ebp - 0x24], 0x46ca
jle 0x443304
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
and dword [ebp - 0x1c], 0
jmp 0x443265
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x41c4
jge 0x4432f8
and dword [ebp - 0x14], 0
jmp 0x44327f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5a1d
jge 0x4432f3
and dword [ebp - 0x18], 0
jmp 0x443295
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3285
jge 0x4432f1
and dword [ebp - 0x20], 0
jmp 0x4432ab
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7e2
jge 0x4432ef
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.00401a48
pop ecx
pop ecx
mov ecx, eax
call fcn.0040b047
push eax
call fcn.004af8e7
pop ecx
lea ecx, [ebp - 0x78]
call fcn.0040b03d
jmp 0x4432a4
jmp 0x44328e
jmp 0x443278
jmp 0x44325e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
jmp 0x443379
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x50]
push 1
push 0x8ab
push 0
push 0x7320
push dword [ebp - 0x54]
push 0x477e
push 0
call fcn.0043a42e
add esp, 0x20
jmp 0x4433ab
lea eax, [ebp + 0x20]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x4433a3
push 0x4a82
push 0
push 0x6058
push 0x70
call fcn.00413b73
add esp, 0x10
jmp 0x4433ab
push 0
call fcn.0040ec71
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453d24
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x453e0a
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x453dd5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x453dc1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x453da2
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x453dbf
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.0040b367
mov dword [eax], 0x1b6eab3c
jmp 0x453d97
jmp 0x453dd3
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x453dd3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x453e08
push 1
push 0x2ee2
push 0x7592
push 0x74b3
push 0
push 0x21af
push 0
push 1
push 0x1691
push 0x4b17
push 0xd00
call fcn.004137b7
add esp, 0x2c
jmp 0x453e33
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
call fcn.0042e364
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x455578
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4556e7
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x455607
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4555e2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x455602
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x455602
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x4556e5
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x45569a
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x45565d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x12
jle 0x455698
push dword [ebp - 0x50]
push 0x4b20
push 1
push 0x56a2
push 0
push 0x29af
push 0x4c08
push 1
push 0x7e13
push 1
push 0x7d36
call fcn.0044122f
add esp, 0x2c
jmp 0x455652
jmp 0x4556e5
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4556c8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x4556e5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x64]
call fcn.0040b367
mov dword [eax], 0x1928c176
jmp 0x4556bd
jmp 0x455708
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x68], eax
push 0x48ac
push dword [ebp - 0x68]
push 0
push dword [ebp - 0x6c]
call fcn.0041c78f
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x462339
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c591f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x771c
mov dword [ebp - 0x28], str.uvaungzzu_iycnagbq_lyuhvgueu_depaqku_vweiz_iidqle
cmp dword [ebp - 0x20], 0x787e
jle 0x4623e9
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 0x18], 0
jmp 0x462393
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2e6e
jge 0x4623e9
and dword [ebp - 0x1c], 0
jmp 0x4623a9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2ba8
jge 0x4623e7
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.00401a48
pop ecx
pop ecx
mov ecx, eax
call fcn.0040b047
push eax
call fcn.004af8e7
pop ecx
lea ecx, [ebp - 0x48]
call fcn.0040b03d
jmp 0x4623a2
jmp 0x46238c
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x4623ff
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x462419
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.0040b367
or dword [eax], 0xffffffff
jmp 0x4623f4
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x741c
jge 0x46242f
push dword [ebp - 0x28]
call fcn.004af8e7
pop ecx
jmp 0x46244b
or dword [ebp - 4], 0xffffffff
jmp 0x462455
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x462e30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x462e52
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x472a72
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5a05
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x472c26
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x1e42
mov dword [ebp - 0x24], str.rwy_rrdwch_retv_iptodu_eon_tjutfrm_uczzfpq_qxeye_gul
cmp dword [ebp - 0x20], 0x20e5
jle 0x472b4e
and dword [ebp - 0x1c], 0
jmp 0x472ad4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x56e8
jge 0x472b34
and dword [ebp - 0x14], 0
jmp 0x472aea
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4d0d
jge 0x472b32
and dword [ebp - 0x18], 0
jmp 0x472b00
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2d8b
jge 0x472b30
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
sar eax, cl
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0xade298
call fcn.0040b052
jmp 0x472af9
jmp 0x472ae3
jmp 0x472acd
push 0
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1d31
jge 0x472b6e
mov edx, dword [ebp - 0x24]
mov ecx, 0xade298
call fcn.0040d8d7
jmp 0x472b8a
or dword [ebp - 4], 0xffffffff
jmp 0x472b94
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x472bba
push 0
call fcn.00484aa7
pop ecx
jmp 0x472c24
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
push 0x1e90
push 0x6caa
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x3276
push 0
push dword [ebp - 0x48]
push 0x32c0
push 0x6683
push dword [ebp - 0x4c]
push 1
push 0x5833
push 1
push 0x71eb
push 1
push 0x6e7e
push dword [ebp - 0x50]
push 0x13c0
call fcn.004753e8
add esp, 0x48
jmp 0x472c46
push 0x2345
push 0xb70
push 1
push 0
push 0x14a
push 0x244c
call fcn.004810a5
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472c57
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5a0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x7ec9
mov dword [ebp - 0x28], str.skxq_dorxhkfq_nev_bnw_iqkzsq_stri_dleryhpjx_vplymzpwh
cmp dword [ebp - 0x24], 0x8265
jle 0x472d21
and dword [ebp - 0x20], 0
jmp 0x472ca1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x685
jge 0x472d19
and dword [ebp - 0x14], 0
jmp 0x472cb7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1caf
jge 0x472d17
and dword [ebp - 0x18], 0
jmp 0x472ccd
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x56c2
jge 0x472d15
and dword [ebp - 0x1c], 0
jmp 0x472ce3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3c08
jge 0x472d13
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov ecx, 0xade298
call fcn.0040b052
jmp 0x472cdc
jmp 0x472cc6
jmp 0x472cb0
jmp 0x472c9a
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
push 0x2151
push 0x3104
call fcn.00472d8c
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7c91
jge 0x472d55
mov edx, dword [ebp - 0x28]
mov ecx, 0xade298
call fcn.0040d8d7
jmp 0x472d71
or dword [ebp - 4], 0xffffffff
jmp 0x472d7b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47506d
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4750ea
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4750d0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4750c4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x7af2c9a1
jmp 0x4750ce
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4750e8
push 1
push 0
push 0xe9
push 0x63a8
push 0
call fcn.004905b3
add esp, 0x14
jmp 0x475105
push 0x56e8
push 0
push 0x3930
push 1
push 0x3719
call fcn.0048f37f
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x47c615
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5b77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x47c66e
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
push 0x6320
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
push eax
push 0x188
push dword [ebp - 0x38]
push 1
call fcn.0047c82f
add esp, 0x14
jmp 0x47c81e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0x2afa
mov dword [ebp - 0x48], str.paflqwme_kyou_fzyqaq_rnhwr_oprldncc_rltwhevbt_kkvbuutz_tbp_atvbhaim
cmp dword [ebp - 0x30], 0x2d51
jle 0x47c704
and dword [ebp - 0x14], 0
jmp 0x47c69e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x275b
jge 0x47c6f9
and dword [ebp - 0x18], 0
jmp 0x47c6b4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3750
jge 0x47c6f7
and dword [ebp - 0x1c], 0
jmp 0x47c6ca
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x53b2
jge 0x47c6f5
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0xade298
call fcn.0040b052
jmp 0x47c6c3
jmp 0x47c6ad
jmp 0x47c697
push 0x22b2
call dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp - 0x2c], 0x2d90
mov dword [ebp - 0x44], str.iicinjgxh_tzadz_mvk_hpqrjfyx_amesvo_ddnnnrl_mjb_swznwrp_mkboxh_mhmtoblq_gudgkeg_nmzi_lcqwt
cmp dword [ebp - 0x2c], 0x3164
jle 0x47c786
and dword [ebp - 0x20], 0
jmp 0x47c728
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1fba
jge 0x47c786
and dword [ebp - 0x24], 0
jmp 0x47c73e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x73e4
jge 0x47c784
and dword [ebp - 0x28], 0
jmp 0x47c754
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x2e29
jge 0x47c782
mov eax, dword [ebp - 0x20]
cdq
idiv dword [ebp - 0x24]
sub edx, dword [ebp - 0x28]
mov eax, edx
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0xade298
call fcn.0040b052
jmp 0x47c74d
jmp 0x47c737
jmp 0x47c721
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 1
push 0x54ff
call fcn.00473538
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x2bbf
jge 0x47c7b5
mov edx, dword [ebp - 0x44]
mov ecx, 0xade298
call fcn.0040d8d7
jmp 0x47c7d1
or dword [ebp - 4], 0xffffffff
jmp 0x47c7db
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30], 0x2955
jge 0x47c7f8
mov edx, dword [ebp - 0x48]
mov ecx, 0xade298
call fcn.0040d8d7
jmp 0x47c814
or dword [ebp - 4], 0xffffffff
jmp 0x47c81e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret