joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1807fd23
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov ebx, dword [edi]
test bl, bl
je 0x1807fd98
test bl, 1
je 0x1807fd3e
lea ecx, [esi + 0x14]
call fcn.1804f11e
test bl, 2
je 0x1807fd4b
mov ecx, dword [esi + 0x18]
call fcn.18054ab6
test bl, 4
je 0x1807fd58
mov ecx, dword [esi + 0x1c]
call fcn.180550d8
test bl, 8
je 0x1807fd65
mov ecx, dword [esi + 0x20]
call fcn.180793ab
test bl, 0x10
je 0x1807fd72
mov ecx, dword [esi + 0x24]
call fcn.1805b3c3
test bl, 0x20
je 0x1807fd7f
mov ecx, dword [esi + 0x28]
call fcn.1805b3c3
test bl, 0x40
je 0x1807fd8c
mov ecx, dword [esi + 0x2c]
call fcn.180712a9
test bl, bl
jns 0x1807fd98
mov ecx, dword [esi + 0x30]
call fcn.180550d8
test ebx, 0xff00
je 0x1807fe24
test ebx, 0x100
je 0x1807fdb4
mov ecx, dword [esi + 0x34]
call fcn.18053630
test ebx, 0x200
je 0x1807fdc4
mov ecx, dword [esi + 0x38]
call fcn.180719f8
test ebx, 0x400
je 0x1807fdd4
mov ecx, dword [esi + 0x3c]
call fcn.180725e6
test ebx, 0x800
je 0x1807fde4
mov ecx, dword [esi + 0x40]
call fcn.180725e6
test ebx, 0x1000
je 0x1807fdf4
mov ecx, dword [esi + 0x44]
call fcn.180793ab
test ebx, 0x2000
je 0x1807fe04
mov ecx, dword [esi + 0x48]
call fcn.18052fd5
test ebx, 0x4000
je 0x1807fe14
mov ecx, dword [esi + 0x4c]
call fcn.18052fd5
test ebx, 0x8000
je 0x1807fe24
mov ecx, dword [esi + 0x50]
call fcn.180550d8
test ebx, 0xff0000
je 0x1807feb0
test ebx, 0x10000
je 0x1807fe40
mov ecx, dword [esi + 0x54]
call fcn.180550d8
test ebx, 0x20000
je 0x1807fe50
mov ecx, dword [esi + 0x58]
call fcn.18075505
test ebx, 0x40000
je 0x1807fe60
mov ecx, dword [esi + 0x5c]
call fcn.180550d8
test ebx, 0x80000
je 0x1807fe70
mov ecx, dword [esi + 0x60]
call fcn.180793ab
test ebx, 0x100000
je 0x1807fe80
mov ecx, dword [esi + 0x64]
call fcn.18053630
test ebx, 0x200000
je 0x1807fe90
mov ecx, dword [esi + 0x68]
call fcn.180550d8
test ebx, 0x400000
je 0x1807fea0
mov ecx, dword [esi + 0x6c]
call fcn.180550d8
test ebx, 0x800000
je 0x1807feb0
mov ecx, dword [esi + 0x70]
call fcn.180550d8
test ebx, 0xff000000
je 0x1807ff47
test ebx, 0x1000000
je 0x1807fecc
mov ecx, dword [esi + 0x74]
call fcn.18072005
test ebx, 0x2000000
je 0x1807fedc
mov ecx, dword [esi + 0x78]
call fcn.180550d8
test ebx, 0x4000000
je 0x1807feec
mov ecx, dword [esi + 0x7c]
call fcn.1805b3c3
test ebx, 0x8000000
je 0x1807feff
mov ecx, dword [esi + 0x80]
call fcn.18058c43
test ebx, 0x10000000
je 0x1807ff12
mov ecx, dword [esi + 0x84]
call fcn.18075ae1
test ebx, 0x20000000
je 0x1807ff25
mov ecx, dword [esi + 0x88]
call fcn.180550d8
test ebx, 0x40000000
je 0x1807ff38
mov ecx, dword [esi + 0x8c]
call fcn.1807ccea
test ebx, ebx
jns 0x1807ff47
mov ecx, dword [esi + 0x90]
call fcn.18054756
test byte [esi + 0xc], 1
je 0x1807ff58
mov ecx, dword [esi + 0x94]
call fcn.1807024c
push 8
push 0
push edi
call fcn.1813c650
add esp, 0xc
lea ecx, [esi + 4]
test byte [ecx], 1
pop edi
pop esi
pop ebx
jne fcn.1808603e
ret
Function at 0x180a0f06
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push dword [edi + 4]
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [edi + 8]
cmp eax, esi
je 0x180a0f31
test eax, eax
je 0x180a0f2c
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], esi
mov eax, esi
test eax, eax
je 0x180a0f43
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
setne bl
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x180b2e5f
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x181b3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.1813c650
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 3
call dword [sym.imp.kernel32.dll_GetComputerNameExW]
xor ebx, ebx
inc ebx
test eax, eax
je 0x180b2ec6
push ebx
mov edx, str..google.com
lea ecx, [ebp - 0x204]
call fcn.180793ab
pop ecx
test al, al
jne 0x180b2f0b
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x208]
push esi
push eax
push 0x64
push 0
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
mov esi, dword [ebp - 0x208]
test eax, eax
jne 0x180b2f01
cmp dword [esi + 8], eax
je 0x180b2f01
push str.google
push dword [esi + 8]
call fcn.180793ab
pop ecx
pop ecx
test eax, eax
je 0x180b2f03
xor bl, bl
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.18139b3f
leave
ret

Function at 0x180b7880
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x180b7890
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x180b7896
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x180b78be
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x18187550]
test ax, ax
jne 0x180b78a5
mov esi, ecx
jmp 0x180b78c1
movzx esi, si
pop edi
cmp cx, si
je 0x180b78de
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x18187550]
test cx, cx
jne 0x180b78c2
mov eax, 0x18171bbc
jmp 0x180b78e6
imul eax, edx, 0x1a
add eax, 0x18187552
push eax
mov ecx, ebx
call fcn.180793ab
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x180c4536
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jg 0x180c43f2
movzx ecx, byte [0x181baf06]
neg ecx
sbb ecx, ecx
and ecx, 0x181ba200
je 0x180c43cd
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x10], ecx
inc eax
mov dword [ebp - 0xc], edx
push eax
push edx
mov dword [ebp - 8], eax
call fcn.180793ab
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push str._Google_Update_core_is_shutting_down..._
push eax
call fcn.180793ab
pop ecx
pop ecx
push 0
push 0
push 0x12
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x180c43f2
push 0x80004004
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
xor eax, eax
pop esi
leave
ret
push esi
mov esi, ecx
call fcn.180793ab
mov ecx, esi
pop esi
test al, al
je 0x180c437c
jmp fcn.180c454e
Function at 0x180c6197
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x181b3008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0xd4], ecx
mov ecx, dword [ebx + 0x10]
push esi
mov dword [ebp - 0xd8], ecx
xor ecx, ecx
push edi
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x34], cl
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
lea ecx, [ebp - 0xfc]
push eax
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x20], 0xf
call fcn.180793ab
push 0xc
call fcn.180793ab
mov esi, eax
lea edi, [ebp - 0xfc]
pop ecx
mov dword [ebp - 0xe4], esi
lea ecx, [esi + 0xc]
mov dword [ebp - 0xdc], ecx
push edi
mov ecx, esi
call fcn.180793ab
add edi, 0xc
lea eax, [ebp - 0xf0]
add esi, 0xc
cmp edi, eax
jne 0x180c6231
mov edi, dword [ebp - 0xc8]
lea eax, [ebp - 0xbc]
push 3
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xc0], eax
push dword [edi]
call fcn.180793ab
mov ecx, dword [ebp - 0xc0]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], al
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x180c6288
sub ecx, edx
push ecx
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x1c]
call fcn.180793ab
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0x34]
push ecx
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.180793ab
add esp, 0x10
lea ecx, [ebp - 0x1c]
test eax, eax
setne byte [ebp - 0xc1]
call fcn.1800de13
lea eax, [ebp - 0xbc]
cmp dword [ebp - 0xc0], eax
je 0x180c62ef
push dword [ebp - 0xc0]
call fcn.18140476
pop ecx
lea ecx, [ebp - 0xe4]
call fcn.180793ab
lea ecx, [ebp - 0xfc]
call fcn.1800ae74
lea ecx, [ebp - 0xf0]
call fcn.1800ae74
cmp byte [ebp - 0xc1], 0
je 0x180c6325
mov dword [ebp - 0xcc], 0x80092009
jmp 0x180c639e
mov esi, dword [ebp - 0xd4]
mov ecx, edi
mov edx, esi
call fcn.180793ab
test al, al
jne 0x180c6344
mov dword [ebp - 0xcc], 0x8000ffff
jmp 0x180c639e
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.1800690f
add eax, 0x10
lea ecx, [ebp - 0xc8]
push str.GoogleUpdateSetup.exe
mov dword [ebp - 0xc8], eax
call fcn.180793ab
mov esi, dword [ebp - 0xc8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180c6384
mov dword [ebp - 0xcc], 0x80070002
jmp 0x180c6396
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xc8]
push eax
call fcn.180793ab
lea ecx, [esi - 0x10]
call fcn.18004135
lea ecx, [ebp - 0x34]
call fcn.1800de13
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xcc]
xor ecx, ebp
pop edi
pop esi
call fcn.18139b3f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x43ee7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x43ee8b
pop dword [ebp - 0x3c]
mov eax, 0x70ac2134
add eax, 0x8f97cd57
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x58224
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x68aa
mov edi, eax
mov edx, 0x487e00
add edx, dword [ebp - 0x3c]
mov esi, 0xd9ac8ade
add esi, 0x45d73d40
add dword [ebp - 0x38], esi
mov ebx, dword [edx]
xor dword [ebp - 0x1c], esi
sub ebx, esi
xor dword [ebp - 0x1c], esi
mov dword [edi], ebx
add edi, 4
add edx, 0x8c3a79c7
add edx, 0x73c5863d
loop 0x43eed9
add eax, 0x32fb3edb
sub eax, 0x32f9a960
xor ebx, ebx
add ebx, eax
add eax, 0xcf356acc
sub eax, 0xcf356ac7
mov ecx, 0x509f8ae8
sub ecx, 0x505f8ae8
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x407e44
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c080]
jne 0x407e4e
repz ret
jmp fcn.00409dc4

Function at 0x413479
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a944
and dword [ebp - 4], 0
cmp dword [0x42e118], 0
mov ebx, eax
jne 0x41352a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4135db
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4135db
push eax
call fcn.0040a8d2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42e118], eax
call esi
push eax
call fcn.0040a8d2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42e11c], eax
call esi
push eax
call fcn.0040a8d2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42e120], eax
call esi
push eax
call fcn.0040a8d2
pop ecx
mov dword [0x42e128], eax
test eax, eax
je 0x41352a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a8d2
pop ecx
mov dword [0x42e124], eax
mov eax, dword [0x42e124]
cmp eax, ebx
je 0x413582
cmp dword [0x42e128], ebx
je 0x413582
push eax
call fcn.0040a94d
push dword [0x42e128]
mov esi, eax
call fcn.0040a94d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413582
test edi, edi
je 0x413582
call esi
test eax, eax
je 0x413579
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413579
test byte [ebp - 0xc], 1
jne 0x413582
or dword [ebp + 0x10], 0x200000
jmp 0x4135bb
mov eax, dword [0x42e11c]
cmp eax, ebx
je 0x4135bb
push eax
call fcn.0040a94d
pop ecx
test eax, eax
je 0x4135bb
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4135bb
mov eax, dword [0x42e120]
cmp eax, ebx
je 0x4135bb
push eax
call fcn.0040a94d
pop ecx
test eax, eax
je 0x4135bb
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42e118]
call fcn.0040a94d
pop ecx
test eax, eax
je 0x4135db
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4135dd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414915
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4148cb
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4148e9
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x414947
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
adc byte [ecx + 0xe2], al
and byte [ecx + 0x1065], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x41492e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x414937
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x414941
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x414923
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4148ad
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x414942
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4148cb
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4148e9
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x414947
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
adc byte [ecx + 0xe2], al
and byte [ecx + 0x1065], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x41492e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x414937
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x414941
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x414923
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4148ad
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x414a59
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax - 0x3a]
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00414204
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004141b9
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
cld
invalid
dec dword [ecx]
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00414204
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004141b9
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00414204
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004141b9
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004141f4
and al, 6
int3
Function at 0x417a10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 4], ax
movsx eax, word [ebp - 4]
and eax, 0x8000
je 0x417b51
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x6d0], 0
jne 0x417a52
mov edx, dword [ebp - 8]
mov dword [edx + 0x6cc], 0
jmp 0x417b4f
mov eax, dword [ebp - 8]
cmp dword [eax + 0x6d0], 1
jne 0x417a70
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x6cc], 1
jmp 0x417b4f
mov edx, dword [ebp - 8]
cmp dword [edx + 0x6d0], 2
jne 0x417a8e
mov eax, dword [ebp - 8]
mov dword [eax + 0x6cc], 2
jmp 0x417b4f
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x6d0], 3
jne 0x417aac
mov edx, dword [ebp - 8]
mov dword [edx + 0x6cc], 3
jmp 0x417b4f
mov eax, dword [ebp - 8]
cmp dword [eax + 0x6d0], 4
jne 0x417aca
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x6cc], 4
jmp 0x417b4f
mov edx, dword [ebp - 8]
cmp dword [edx + 0x6d0], 5
jne 0x417ae5
mov eax, dword [ebp - 8]
mov dword [eax + 0x6cc], 5
jmp 0x417b4f
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x6d0], 6
jne 0x417b00
mov edx, dword [ebp - 8]
mov dword [edx + 0x6cc], 6
jmp 0x417b4f
mov eax, dword [ebp - 8]
cmp dword [eax + 0x6d0], 8
jne 0x417b1b
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x6cc], 8
jmp 0x417b4f
mov edx, dword [ebp - 8]
cmp dword [edx + 0x6d0], 7
jne 0x417b36
mov eax, dword [ebp - 8]
mov dword [eax + 0x6cc], 7
jmp 0x417b4f
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x6d0], 9
jne 0x417b4f
mov edx, dword [ebp - 8]
mov dword [edx + 0x6cc], 9
jmp 0x417b5e
mov eax, dword [ebp - 8]
mov dword [eax + 0x6cc], 0
mov esp, ebp
pop ebp
ret
Function at 0x4181e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42c080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
push str.SoftwareScreenshotX2Y7Z8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x418228
jmp 0x418326
mov dword [ebp - 0xc], 0
jmp 0x41823a
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 5
jge 0x4182d4
mov byte [ebp - 0x1c], 0
xor edx, edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov word [ebp - 0x13], dx
mov byte [ebp - 0x11], dl
push 4
mov eax, dword [ebp - 0xc]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x20]
lea edx, [ecx + eax + 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00408080
add esp, 0xc
push 4
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 0x20]
lea eax, [edx + ecx + 0x18]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00408080
add esp, 0xc
push 4
mov edx, dword [ebp - 0xc]
imul edx, edx, 0xc
mov eax, dword [ebp - 0x20]
lea ecx, [eax + edx + 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.00408080
add esp, 0xc
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 3
push 0
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x22
add ecx, str.Rectangle
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
jmp 0x418231
push 4
push 0x42e294
push 4
push 0
push str.LastSavedFormat
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
push 0x42e298
call fcn.00408d1c
add esp, 4
shl eax, 1
push eax
push 0x42e298
push 1
push 0
push str.LastSavedDir
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407e44
mov esp, ebp
pop ebp
ret