joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477700
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63938c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x721970]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.004af7f0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp + 8]
push eax
call fcn.0044bca0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + 0x30]
call edx
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0xe], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00468ec0
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x47e690
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x47e6bf
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
je 0x47e6bd
mov byte [ebp - 1], 1
jmp 0x47e6d6
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x80
je 0x47e6d6
mov byte [ebp - 1], 1
movzx edx, byte [ebp - 1]
test edx, edx
je 0x47e6fc
push 0
push 0xf012
push 0x112
mov ecx, dword [ebp - 8]
call fcn.0040c910
push 0
mov ecx, dword [ebp - 8]
call fcn.0047f690
mov esp, ebp
pop ebp
ret
Function at 0x49b650
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ceb0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x721970]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x49b6a5
xor eax, eax
jmp 0x49b77f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
cmp dword [edx], 0x4550
je 0x49b6c3
xor eax, eax
jmp 0x49b77f
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], 0
jmp 0x49b702
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax + 0x18]
jae 0x49b764
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00616b13
add esp, 8
test eax, eax
jne 0x49b762
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x30]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x24], ecx
jmp 0x49b764
jmp 0x49b6f9
jmp 0x49b76c
mov dword [ebp - 4], 0xffffffff
jmp 0x49b77c
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49bae0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63cf33
mov eax, dword fs:[0]
push eax
mov eax, 0x6814
call fcn.00610bb0
mov eax, dword [0x721970]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x681c], ecx
mov dword [ebp - 0x6820], 0
lea ecx, [ebp - 0x6818]
call fcn.00406700
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x6814]
call fcn.004db900
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x681c]
add ecx, 4
call fcn.00407940
movzx eax, al
test eax, eax
jne 0x49bbab
xor ecx, ecx
mov word [ebp - 0x420], cx
push 0x206
push 0
lea edx, [ebp - 0x41e]
push edx
call fcn.0060f700
add esp, 0xc
mov ecx, dword [ebp - 0x681c]
add ecx, 4
call fcn.004a7500
push eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x6818]
call fcn.00406ba0
jmp 0x49bc7c
lea eax, [ebp - 0x6814]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x681c]
call fcn.004a7500
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x49bc1e
xor ecx, ecx
mov word [ebp - 0x628], cx
push 0x206
push 0
lea edx, [ebp - 0x626]
push edx
call fcn.0060f700
add esp, 0xc
lea eax, [ebp - 0x26b8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x6818]
call fcn.00406ba0
jmp 0x49bc7c
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.0060f700
add esp, 0xc
mov ecx, dword [ebp - 0x681c]
call fcn.004a7500
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.00611e74
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x6818]
call fcn.00406ba0
lea eax, [ebp - 0x6818]
push eax
mov ecx, dword [ebp + 8]
call fcn.004064e0
mov ecx, dword [ebp - 0x6820]
or ecx, 1
mov dword [ebp - 0x6820], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6814]
call fcn.004dba30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6818]
call fcn.004068c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060f7c8
mov esp, ebp
pop ebp
ret 8
Function at 0x49c950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63d0bb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x721970]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0049cba0
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jne 0x49c994
jmp 0x49cb41
movzx eax, byte [0x72ae78]
test eax, eax
jne 0x49c9b1
mov ecx, dword [ebp - 0x228]
call fcn.0049cc30
mov byte [0x72ae78], 1
push 0x100
lea ecx, [ebp - 0x210]
push ecx
call fcn.0049cc60
add esp, 8
lea ecx, [ebp - 0x240]
call fcn.00418c90
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
push str._s____s_r_n
lea ecx, [ebp - 0x240]
push ecx
call fcn.00419510
add esp, 0x10
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x72ac70
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x49cb2f
call fcn.00408620
mov dword [ebp - 0x230], eax
push 2
push 0
push 0
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x234], 0
lea ecx, [ebp - 0x240]
call fcn.00419160
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x49ca74
mov dword [ebp - 0x220], 0
jmp 0x49caec
mov eax, dword [ebp - 0x21c]
push eax
call fcn.00610037
add esp, 4
add eax, 1
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x3fffffff
jle 0x49caa4
mov dword [ebp - 0x224], 0
jmp 0x49cae0
mov eax, dword [ebp - 0x218]
shl eax, 1
call fcn.00610b80
mov dword [ebp - 0x22c], esp
mov ecx, dword [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x218]
shl edx, 1
push edx
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.00407150
mov dword [ebp - 0x224], eax
mov edx, dword [ebp - 0x224]
mov dword [ebp - 0x220], edx
push 0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x240]
call fcn.00419180
push eax
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00418cc0
lea esp, [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060f7c8
mov esp, ebp
pop ebp
ret
Function at 0x4a39f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63dfc7
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x721970]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
mov byte [ebp - 0x21d], 0
mov ecx, dword [ebp - 0x224]
call fcn.004a4430
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0x224]
call fcn.004a38b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0x230]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x260]
call fcn.00419160
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a3c54
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x22c], 0x104
mov edx, dword [ebp - 0x22c]
shl edx, 1
push edx
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.0060f700
add esp, 0xc
mov ecx, dword [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4a3c40
push 0x2c
call fcn.004e69c7
add esp, 4
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x238], 0
je 0x4a3b15
mov ecx, dword [ebp - 0x238]
call fcn.004a66d0
mov dword [ebp - 0x23c], eax
jmp 0x4a3b1f
mov dword [ebp - 0x23c], 0
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x248], edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x26c]
push edx
mov ecx, dword [ebp - 0x224]
call fcn.004a3920
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x244]
push ecx
mov ecx, dword [ebp - 0x228]
add ecx, 4
call fcn.00418f90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x26c]
call fcn.00418cc0
mov edx, dword [ebp - 0x228]
add edx, 0x1c
push edx
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x224]
call fcn.004a3ca0
mov ecx, dword [ebp - 0x228]
add ecx, 0x24
push ecx
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp - 0x224]
call fcn.004a3f40
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x254]
call fcn.00418d40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x254]
push ecx
mov ecx, dword [ebp - 0x224]
add ecx, 0x10
call fcn.004a6a20
mov edx, dword [ebp - 0x228]
mov dword [eax], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.00418cc0
mov dword [ebp - 0x22c], 0x104
mov eax, dword [ebp - 0x22c]
shl eax, 1
push eax
push 0
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0060f700
add esp, 0xc
mov edx, dword [ebp - 0x234]
add edx, 1
mov dword [ebp - 0x234], edx
jmp 0x4a3abb
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x21d], 1
mov cl, byte [ebp - 0x21d]
mov byte [ebp - 0x21e], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.00418cc0
mov al, byte [ebp - 0x21e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060f7c8
mov esp, ebp
pop ebp
ret
Function at 0x4a3ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63e01b
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x721970]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x43c], ecx
mov byte [ebp - 0x421], 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x450]
push ecx
mov ecx, dword [ebp - 0x43c]
call fcn.004a3730
mov dword [ebp - 4], 0
push str.CustomData
push 0x68dc30
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x474]
push eax
call fcn.0041be70
add esp, 0xc
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x444]
mov dword [ebp - 0x440], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x440]
push edx
lea eax, [ebp - 0x45c]
push eax
call fcn.0041be70
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x474]
call fcn.00418cc0
mov dword [ebp - 0x434], 0
lea ecx, [ebp - 0x434]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x45c]
call fcn.00419160
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a3ee4
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x42c], 0x104
mov dword [ebp - 0x428], 0x104
mov edx, dword [ebp - 0x428]
shl edx, 1
push edx
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.0060f700
add esp, 0xc
mov ecx, dword [ebp - 0x42c]
shl ecx, 1
push ecx
push 0
lea edx, [ebp - 0x420]
push edx
call fcn.0060f700
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x438]
push edx
push 0
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x430]
push edx
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4a3ed0
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x468]
call fcn.00418d40
mov byte [ebp - 4], 4
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0043c660
mov ecx, eax
call fcn.00418f40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x468]
call fcn.00418cc0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x428], 0x104
mov dword [ebp - 0x42c], 0x104
mov ecx, dword [ebp - 0x428]
shl ecx, 1
push ecx
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.0060f700
add esp, 0xc
mov eax, dword [ebp - 0x42c]
shl eax, 1
push eax
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.0060f700
add esp, 0xc
mov edx, dword [ebp - 0x430]
add edx, 1
mov dword [ebp - 0x430], edx
jmp 0x4a3de7
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x421], 1
mov cl, byte [ebp - 0x421]
mov byte [ebp - 0x422], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x45c]
call fcn.00418cc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.00418cc0
mov al, byte [ebp - 0x422]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060f7c8
mov esp, ebp
pop ebp
ret 8
Function at 0x4a3f40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63e05c
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x721970]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov byte [ebp - 0x219], 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
mov ecx, dword [ebp - 0x230]
call fcn.004a3730
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
lea edx, [ebp - 0x224]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x248]
call fcn.00419160
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a412a
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0x104
mov eax, dword [ebp - 0x220]
shl eax, 1
push eax
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.0060f700
add esp, 0xc
mov edx, dword [ebp - 0x220]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4a4116
push str.CustomData
lea eax, [ebp - 0x218]
push eax
call fcn.0060fc3f
add esp, 8
test eax, eax
je 0x4a40de
push 0x18
call fcn.004e69c7
add esp, 4
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x238], 0
je 0x4a4074
mov ecx, dword [ebp - 0x238]
call fcn.004a6760
mov dword [ebp - 0x234], eax
jmp 0x4a407e
mov dword [ebp - 0x234], 0
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x23c], ecx
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x22c], edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x22c]
add ecx, 4
call fcn.00418f40
mov ecx, dword [ebp - 0x22c]
add ecx, 0x10
push ecx
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.004a4170
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004a7f70
mov dword [ebp - 0x220], 0x104
mov edx, dword [ebp - 0x220]
shl edx, 1
push edx
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.0060f700
add esp, 0xc
mov ecx, dword [ebp - 0x228]
add ecx, 1
mov dword [ebp - 0x228], ecx
jmp 0x4a3ffe
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x219], 1
mov al, byte [ebp - 0x219]
mov byte [ebp - 0x21a], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00418cc0
mov al, byte [ebp - 0x21a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060f7c8
mov esp, ebp
pop ebp
ret 8
Function at 0x4ae180
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63f373
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x721970]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CRLPCU::CMsgUtil.0
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x74], 0
je 0x4ae238
push 0xbb8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x74]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x102
jne 0x4ae1fe
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x74]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x74]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x4ae227
push 1
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x20], eax
jmp 0x4ae22e
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], 0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0xa0
call fcn.004068c0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
call fcn.0044a130
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.00418cc0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
call fcn.004b24e0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004a8020
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004068c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.004068c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4b0df0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63fbfc
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x721970]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
push str.MU:CTT
lea ecx, [ebp - 0x38]
call fcn.00449f50
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x64]
cmp dword [eax + 0x78], 0
je 0x4b0ed6
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xbb8
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax + 0x78]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x102
jne 0x4b0e9c
push str.MU:CTT:TT
lea ecx, [ebp - 0x60]
call fcn.00449f50
mov byte [ebp - 4], 1
push 0
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax + 0x78]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.0044a010
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax + 0x78]
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x68], 0
je 0x4b0ec5
push 1
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x74], eax
jmp 0x4b0ecc
mov dword [ebp - 0x74], 0
mov ecx, dword [ebp - 0x64]
mov dword [ecx + 0x78], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0044a010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060f7c8
mov esp, ebp
pop ebp
ret
Function at 0x4b4bb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6403a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x721970]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.004ec4dd
test eax, eax
je 0x4b4bf2
mov eax, 1
jmp 0x4b4d0c
mov dword [ebp - 0x14], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 0x10], ax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0x100
jne 0x4b4c26
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x74
jne 0x4b4c26
mov dword [ebp - 0x14], 1
jmp 0x4b4cfc
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x4b4c75
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x4f
je 0x4b4c56
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0x50
je 0x4b4c56
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x4e
je 0x4b4c56
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x4c
jne 0x4b4c75
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x4b4c75
mov dword [ebp - 0x14], 1
jmp 0x4b4cfc
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x134
call fcn.004b4f00
movzx eax, al
test eax, eax
je 0x4b4cfc
mov ecx, dword [ebp - 0x18]
add ecx, 0x134
call fcn.004a7500
push eax
lea ecx, [ebp - 0x1c]
call fcn.004b4db0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004a7500
test eax, eax
je 0x4b4ced
lea ecx, [ebp - 0x1c]
call fcn.004a7500
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
test eax, eax
jne 0x4b4ce0
mov dword [ebp - 0x24], 1
jmp 0x4b4ce7
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004b4e80
cmp dword [ebp - 0x14], 0
je 0x4b4d09
mov eax, 1
jmp 0x4b4d0c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4