joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a4eb
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x42a53a
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push 0x2243
push 1
push dword [ebp - 0xc]
push 0x26e4
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x18]
call fcn.0042a65c
add esp, 0x1c
jmp 0x42a658
lea eax, [ebp + 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42a5f2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x42a5a4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x42a5a2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x42a5f0
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 1
push 0x1ea1
push 1
push 0x3264
push 0x95a
push 0x5ea
push 1
push 0x4c96
push 0x69b6
push 0
push 0x1a2b
push 0x4e0c
push 0x6ca4
push 0x31a
push 1
call fcn.00408f06
add esp, 0x40
jmp 0x42a658
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x42a641
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x42a63f
push 0x50df
push 0x52a5
push 0
push 0x6b69
push 0
call fcn.0042cb8a
add esp, 0x14
jmp 0x42a658
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x42e663
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x42e770
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x42e72a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42e6f0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x42e6ee
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
jmp 0x42e728
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.0045232c
mov esi, eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.0045232c
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x42e76e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x42e754
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42e752
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x42e76e
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x42e76e
push 0x1f4e
push 0
call fcn.0044f6b7
pop ecx
pop ecx
jmp 0x42e784
push 0xba9
push 0
push 0x5404
call fcn.00409dd3
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42f0ac
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x42f0ed
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
push 0x3910
push 1
call fcn.0042f1a0
add esp, 0x14
jmp 0x42f19c
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42f13e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push 0x6bc2
push 1
push dword [ebp - 0x24]
call fcn.0042c2d5
add esp, 0x10
jmp 0x42f19c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x42f17e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x42f19c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42f19c
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esp, ebp
pop ebp
ret
Function at 0x431fe3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c68e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43202d
push 0x6b8f
push 0x4ffb
push 1
push 1
push 0x2c52
call fcn.00432180
add esp, 0x14
jmp 0x43216f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x4d8d
mov dword [ebp - 0x24], str.aqrxqbtk_quigdkhm_weegfh_mgxkukaq_gbllqoi_lxaop_evfzrq_wuvrc
cmp dword [ebp - 0x20], 0x5052
jle 0x4320dd
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 0x14], 0
jmp 0x432067
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x56e
jge 0x4320dd
and dword [ebp - 0x18], 0
jmp 0x43207d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x31d9
jge 0x4320db
and dword [ebp - 0x1c], 0
jmp 0x432093
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2dde
jge 0x4320d9
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.00401993
pop ecx
pop ecx
mov ecx, eax
call fcn.0045211e
push eax
call fcn.004b0bf7
pop ecx
lea ecx, [ebp - 0x50]
call fcn.00452114
jmp 0x43208c
jmp 0x432076
jmp 0x432060
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4bd3
jge 0x4320f9
push dword [ebp - 0x24]
call fcn.004b0bf7
pop ecx
jmp 0x432115
or dword [ebp - 4], 0xffffffff
jmp 0x43211f
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
push eax
push 0x69cd
push 0x908
push 0x3ee5
push 0x1132
push 0x4e2a
push 0x2b1
push 0x6d1b
push 0x57c3
push 0x313
push 1
push 1
push dword [ebp - 0x2c]
push 0x3d8c
push 0x5c04
push dword [ebp - 0x30]
call fcn.0042fc03
add esp, 0x40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440bc8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x440c0a
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push 0x4722
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
push 0x70e4
call fcn.00440c98
add esp, 0x18
jmp 0x440c94
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x440c46
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push dword [ebp - 0x1c]
push 0x7df5
call fcn.00408e80
add esp, 0xc
jmp 0x440c94
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x440c7c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x440c7a
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x440c94
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x440c94
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esp, ebp
pop ebp
ret
Function at 0x44268c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c69db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x3e3a
mov dword [ebp - 0x3c], str.kdhzsdcl_qztv_ejnodzn_pvxpqh_vmnkaymq_cbnpgw_ngmutnh_zlo_lpo_axkoxiovh_reac
cmp dword [ebp - 0x20], 0x41c7
jle 0x442738
push 0x1e55
call dword [sym.imp.USER32.dll_GetKeyState]
and dword [ebp - 0x1c], 0
jmp 0x4426dd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x238f
jge 0x442738
and dword [ebp - 0x14], 0
jmp 0x4426f3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x40e0
jge 0x442736
and dword [ebp - 0x18], 0
jmp 0x442709
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2ddb
jge 0x442734
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0xab95b8
call fcn.00452129
jmp 0x442702
jmp 0x4426ec
jmp 0x4426d6
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x442791
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x44276b
push 0x197a
push 0x1fce
push 0x452a
push 1
call fcn.00442829
add esp, 0x10
jmp 0x44278f
push 0x6ba3
push 0x517a
push 1
push 0x4a42
push 1
push 0x2c36
push 1
push 1
call fcn.00437866
add esp, 0x20
jmp 0x4427d8
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4427b7
push 1
call fcn.004093f9
pop ecx
jmp 0x4427d8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
push 0
push 0x2017
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.0041107f
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3de6
jge 0x4427f2
mov edx, dword [ebp - 0x3c]
mov ecx, 0xab95b8
call fcn.00453acf
jmp 0x44280e
or dword [ebp - 4], 0xffffffff
jmp 0x442818
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4478fb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6a5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x447952
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
push 0x3f30
push 0x7ad6
push 0x315
push 1
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
push eax
push 1
call fcn.00447ad4
add esp, 0x18
jmp 0x447ac3
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44798b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 1
call fcn.0042f57e
pop ecx
pop ecx
jmp 0x447ac3
mov dword [ebp - 0x20], 0x2364
mov dword [ebp - 0x38], str.yxcubk_ajydxc_nxaw_imiruqc
cmp dword [ebp - 0x20], 0x23e0
jle 0x447a10
and dword [ebp - 0x14], 0
jmp 0x4479af
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6420
jge 0x447a10
and dword [ebp - 0x18], 0
jmp 0x4479c5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x804a
jge 0x447a0e
and dword [ebp - 0x1c], 0
jmp 0x4479db
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x326b
jge 0x447a0c
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, edx
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0xab95b8
call fcn.00452129
jmp 0x4479d4
jmp 0x4479be
jmp 0x4479a8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2035
jge 0x447a30
mov edx, dword [ebp - 0x38]
mov ecx, 0xab95b8
call fcn.00453acf
jmp 0x447a4c
or dword [ebp - 4], 0xffffffff
jmp 0x447a56
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x447a7a
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x447ac3
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x447ac3
push 0x4f22
push 0x22b8
push 0x4ea4
push 0x2e39
push 0x4e15
push 0x1c92
push 0
push 0
push 0
push 0x3a55
push 1
call fcn.0040fbbf
add esp, 0x2c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d3ee
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x44d443
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x5f40
push 1
push 0x5613
call fcn.0044d4c2
add esp, 0x20
jmp 0x44d4be
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44d483
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0
call fcn.00409515
add esp, 0xc
jmp 0x44d4be
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x44d4a0
push 0x1e74
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x44d4be
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44d4be
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esp, ebp
pop ebp
ret
Function at 0x44f580
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44f66d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44f5cb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 1
call fcn.0044f6b7
pop ecx
pop ecx
jmp 0x44f66b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x44f5ed
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x44f66b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x44f60f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x2d
jne 0x44f66b
mov dword [ebp - 0x2c], 4
push 1
push 0x3102
push 0x1aba
push 0
push 0x901
push 1
lea eax, [ebp - 0x2c]
push eax
push 0x2c6a
call fcn.00406032
add esp, 0x20
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
push 0x698e
push 0x6640
push 0
push 0
push 0x3baa
call fcn.0042f49d
add esp, 0x1c
jmp 0x44f604
jmp 0x44f6b3
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x44f693
push 0x1791
push 0x2d3
push 1
call fcn.00425bfe
add esp, 0xc
jmp 0x44f6b3
push 0
push 0x7cf
push 0x16b1
push 0x75d6
push 0x4d35
push 1
call fcn.00406175
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x4542cd
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push 2
lea ecx, [ebp - 0x1c]
call fcn.0045223e
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x4542fb
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov dword [eax + ecx*4], 5
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4542eb
xor ecx, ecx
mov dword [ebp - 8], ebx
inc ecx
jmp 0x454317
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xc], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x454309
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], ebx
jl 0x454345
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
cmp dword [eax + ecx*4], ebx
jne 0x454345
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x454340
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
dec dword [ebp - 0xc]
jns 0x454324
lea ecx, [ebp - 0x1c]
call fcn.00452310
push 4
lea ecx, [ebp - 0x28]
call fcn.0045223e
mov dword [ebp - 8], 0x66fe7d8a
mov dword [ebp - 0x10], 0xb3b9
mov dword [ebp - 8], ebx
jmp 0x45437a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x45436a
mov dword [ebp - 8], 3
cmp dword [ebp - 8], ebx
jl 0x4543b2
dec dword [ebp - 0x10]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x4543ad
push ebx
push 0x2580
push 0x254
push 0x65f
call dword [sym.imp.GDI32.dll_SetPixel]
dec dword [ebp - 8]
jns 0x45438c
lea ecx, [ebp - 0x28]
call fcn.00452310
mov dword [esi], ebx
jmp 0x4543cb
mov ecx, dword [esi]
mov eax, dword [edi]
mov dword [eax + ecx*4], 5
inc dword [esi]
cmp dword [esi], 2
jl 0x4543be
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4543d7
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [ecx], 0
push ebx
push esi
push 0
pop ebx
push 1
pop esi
je 0x45442c
mov dword [ebp - 0xc], 0x71c7bf0b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 0xd133f29
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x454417
push 0x1a5a
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0xc], 0x99cf
lea ecx, [ebp - 0x24]
mov dword [ebp - 8], 0x229edca8
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 0x270f9e3
mov dword [ebp - 0x10], 0xa05d7627
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], 0x5fba2522
push 2
call fcn.0045223e
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
jmp 0x45447c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18], 0xd96711db
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x45446e
pop esi
mov dword [ebp - 8], ebx
pop ebx
jmp 0x454498
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x454488
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
cmp eax, 0x927213ec
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x7d50f82b
setne cl
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
inc dword [ebp - 0x10]
call fcn.00452310
mov esp, ebp
pop ebp
ret
Function at 0x4632bd
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
mov ebx, ecx
inc esi
xor edx, edx
mov dword [ebp - 0xc], esi
push edi
mov dword [ebp - 0xc], edx
jmp 0x4632e3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x18], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4632d5
mov dword [ebp - 0xc], edx
jmp 0x463368
mov dword [ebp - 8], 0x816210b9
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x463309
push edx
push edx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x463360
mov dword [ebp - 0x10], esi
mov byte [ebp - 2], dl
cmp byte [ebp - 2], 0
je 0x463325
push edx
push edx
push edx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x463358
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x18]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x18], ecx
mov byte [ebp - 3], dl
cmp byte [ebp - 3], 0
je 0x463355
push 0x12b9
push edx
push 0x24a7
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x46332a
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x46330e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x4632ee
lea eax, [ebp - 0x28]
push eax
call fcn.0045d8ba
mov esi, eax
lea edi, [ebp - 0x1c]
pop ecx
lea eax, [ebx - 0xc]
mov ecx, 0x737
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov ecx, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov eax, dword [eax + ecx*8 - 0x5c]
mov esp, ebp
pop ebp
ret