joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c8a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
dec esi
cmp dh, byte [esi]
xor eax, dword ss:[ebx + 0x7eb04c4]
cmp eax, dword [eax + 0x4a]
cmp bh, byte [ecx]
cmp bh, byte [esi]
pop edi
cmp dword [ebp - 0xcb4], 0
jne 0x42c8cb
mov dword [ebp - 0x31c], 0
jmp 0x42cb16
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx

Function at 0x42c9ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [eax]
add byte [ecx + 0x52], bl
push edx
add esp, 4
jmp 0x42c9de
call 0x42c9ea
add byte [0x41434f36], dh
aaa
add esp, 4
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x42ca0b
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x42ca65
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x42c933
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x42c933
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x42ca4f
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x42ca59
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x42caae
push eax
push ecx
add esp, 4
or eax, 0x5feb
or eax, 0xfb37
and eax, 0xd320
pop eax
push ecx
push edi
add esp, 4
add ecx, 0x17293
pop ecx
push ebx
and ebx, 0x2edc
xor ebx, 0x13b3f
pop ebx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x42cb16
push ebx
push ebx
add esp, 4
jmp 0x42cab8
pop ebx
push edx
or edx, 0x40d2
call 0x42cace
add byte [ebx], dh
dec ebx
inc edi
inc ecx
inc edi
cmp eax, 0xc483334f
add al, 0x81
xchg edi, eax
push edx
add dword [eax], eax
pop edx
push ebx
xor ebx, 0x5493
pop ebx
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x42cb0c
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x42c8d7
mov dword [ebp - 0x31c], 0
Function at 0x42cace
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [eax]
add byte [ecx + 0x52], bl
push edx
add esp, 4
jmp 0x42c9de
call 0x42c9ea
add byte [0x41434f36], dh
aaa
add esp, 4
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x42ca0b
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x42ca65
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x42c933
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x42c933
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x42ca4f
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x42ca59
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x42caae
push eax
push ecx
add esp, 4
or eax, 0x5feb
or eax, 0xfb37
and eax, 0xd320
pop eax
push ecx
push edi
add esp, 4
add ecx, 0x17293
pop ecx
push ebx
and ebx, 0x2edc
xor ebx, 0x13b3f
pop ebx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x42cb16
push ebx
push ebx
add esp, 4
jmp 0x42cab8
pop ebx
push edx
or edx, 0x40d2
call 0x42cace
add byte [ebx], dh
dec ebx
inc edi
inc ecx
inc edi
cmp eax, 0xc483334f
add al, 0x81
xchg edi, eax
push edx
add dword [eax], eax
pop edx
push ebx
xor ebx, 0x5493
pop ebx
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x42cb0c
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x42c8d7
mov dword [ebp - 0x31c], 0
Function at 0x42cf9b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1968], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x196c], ecx
mov dword [ebp - 0x758], 0
jmp 0x42c4d9
push esi
push ecx
add esp, 4
sub esi, 0xfa83
pop esi
push ebx
and ebx, 0x81f2
sub ebx, 0x12bf9
pop ebx
push edx
push edx
add esp, 4
xor edx, 0x179e5
sub edx, 0x16111
sub edx, 0x2446
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push edi
or edi, 0x2829
and edi, 0x1166c
call 0x42cf13
add byte [eax + 0x35], dl
dec edi
dec esp
dec ecx
inc esi
cmp al, 0x4e
xor eax, 0xe804c483
or al, byte [eax]
add byte [eax], al
add byte [ebx + eax*2 + 0x34], cl
cmp dword [ebp + 0x45], ecx
inc eax
inc edx
dec ebx
add esp, 4
pop edi
cmp dword [ebp - 0x3e8], 0
je 0x42cf3b
cmp dword [ebp - 0xab8], 0
jne 0x42cf81
push ebx
push eax
add esp, 4
call 0x42cf50
add byte [esi + 0x4b], cl
cmp al, 0x32
aaa
cmp byte [ebx + ecx*2], dh
dec edx
add esp, 4
pop ebx
push ebx
sub ebx, 0x5413
call 0x42cf69
add byte [esi], dh
cmp dword [0x493d464f], esi
cmp eax, dword [ebx - 0x74a4fb3c]
xchg ebp, eax
clc
clc
invalid
mov dword [ebp - 0x20a8], 0xa
push edx
call 0x42cf9b
add byte [edi + 0x39], al
inc ebp
dec esi
inc ecx
inc ebx
dec edx
xor al, byte [ebx - 0x3d7efb3c]
and esp, dword [edi]
add byte [eax], al
xor edx, 0x1e02
pop edx
push eax
push esi
add esp, 4
xor eax, 0x17d16
add eax, 0x989d
pop eax
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
xor ecx, 0x2099
jmp 0x42cff8
jmp 0x42cfff
xor ecx, 0x5eef
pop ecx
push edi
add edi, 0x36ed
or edi, 0xacac
sub edi, 0x3055
pop edi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
test dword [edi], ebp
idiv bh
push dword [esi + eax*8 - 0x7b]
xor dh, dh
invalid
push dword [ebp - 0x3a]
test dword [ecx], esi
idiv bh
jmp dword [ecx - 0x3a]
test dword [edx], esi
idiv bh
jmp [esi + eax*8 - 0x7b]
xor esi, esi
invalid
call dword [eax - 0x3a]
test dword [esi + esi*8], esi
invalid
push dword [edx - 0x3a]
test dword [0x6ffffff6], esi
Function at 0x42d3ef
Capabilities:
Get number of processors

Disassembly:
or byte [eax], al
add byte [eax], al
pop eax
push edi
push eax
add esp, 4
jmp 0x42d2a4
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x42d2c2
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x42d31c
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42d1ea
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42d1ea
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42d306
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x42d310
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x42d365
push esi
push esi
add esp, 4
call 0x42d336
add byte [eax + 0x4c], al
cmp edi, dword [edx]
inc esp
inc ebx
add esp, 4
pop esi
push edi
push edx
add esp, 4
add edi, 0x14bb0
pop edi
push eax
push esi
add esp, 4
jmp 0x42d350
add eax, 0x1151
pop eax
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x42d3cd
push edi
push eax
add esp, 4
or edi, 0xc73a
sub edi, 0x131f8
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x2e4e
sub ecx, 0x71c7
xor ecx, 0xa2ed
pop ecx
push esi
or esi, 0xe41f
pop esi
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x42d3c3
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x42d18e
mov dword [ebp - 0x2fc], 0
push ecx
push edi
add esp, 4
add ecx, 0x1111b
jmp 0x42d3df
pop ecx
push eax
call 0x42d3ef
add byte [esi], dh
dec edi
cmp eax, 0x3d3a4441
xor eax, 0x8104c483
les eax, [ecx + eax*4]
call fcn.00439af7
sub eax, 0x122c2
pop eax
cmp dword [ebp - 0x2fc], 0
jne 0x42dd04
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
add byte [esi - 0x77], ah
lea edi, [eax - 0x18]
invalid
invalid
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
Function at 0x42d6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
add esp, 4
and ecx, 0x74c2
sub ecx, 0xb5c0
jmp 0x42d67e
and ecx, 0x10607
pop ecx
push ebx
push edi
add esp, 4
call fcn.0042d696
add byte [0x3a3e343b], bh
cmp eax, 0x3a3e343b
add esp, 4
pop ebx
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push esi
and esi, 0xab19
and esi, 0xd094
and esi, 0x1748d
pop esi
push esi
push ecx
add esp, 4
sub esi, 0xa570
add esi, 0x10393
pop esi
push eax
push esi
add esp, 4
or eax, 0x72f8
pop eax
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42d740
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x42d79a
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x42d668
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x42d668
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x42d784
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x42d78e
mov dword [ebp - 0x1624], 1
invalid
invalid
Function at 0x42f7e0
Capabilities:
Encode data using xor

Disassembly:
add dh, byte [edi + 0x10]
lea edx, [edi + 0x101e7fe]
mov edx, dword [edi + 0x101fe06]
in eax, dx
adc ebp, ebx
out 0xff, eax
add dword [ecx], eax
lea eax, [edi + 0x101fa52]
mov eax, dword [edi + 0x101fe06]
test dword [edi + 0x101fe06], edi
add dl, byte [ecx]
xchg al, dl
add al, byte [edx]
add dl, byte [ebx - 0x7d]
mov edx, dword [edi]
inc byte [ecx]
add dword [edx], eax
adc dword [esi + 0x20202d0], eax
push ebx
xor ebx, 0xffffff8b
pop ss
add al, byte [edx]
in eax, dx
add eax, 0x833a4336
jecxz 0x42f805
or eax, 0x525b0202
sub edx, 0x2b
and dword [edx], eax
add ch, dl
or eax, dword [edx]
add al, byte [edx]
add bh, byte [ecx]
dec ecx
inc esi
inc ecx
inc esp
dec ebx
cmp cl, byte [edx - 0x7b]
mov byte [esi], 0x83
retf 0x6a57
Function at 0x450ee0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.0041d6a0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041d700
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x450f4b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.0041d6b0
mov eax, dword [ebp - 0x224]
jmp 0x450fdc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x450fb1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00450ee0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x450fa8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.0041d6b0
mov eax, dword [ebp - 0x228]
jmp 0x450fdc
mov dword [ebp - 4], 0x100
jmp 0x450f52
lea ecx, [ebp - 0x14]
call fcn.0041d6d0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00450e80
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.0041d6b0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret 4

Function at 0x451540
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x451549
xor ecx, ecx
jne 0x451549
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x45156a
mov eax, 0xd
jmp 0x4515c5
xor eax, eax
jne 0x451551
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x45157b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x456260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4effcb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], ecx
xor eax, eax
mov word [ebp - 0x234], ax
push 0x206
push 0
lea ecx, [ebp - 0x232]
push ecx
call fcn.004ccbe0
add esp, 0xc
lea edx, [ebp - 0x234]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x2c]
call fcn.0041bcf0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041bd60
lea ecx, [ebp - 0x2c]
call fcn.0041be10
movzx ecx, al
test ecx, ecx
je 0x456310
mov byte [ebp - 0x235], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041ab00
mov al, byte [ebp - 0x235]
jmp 0x45647b
push 0x208
push 0
lea edx, [ebp - 0x234]
push edx
call fcn.004ccbe0
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
push 0
push 0x501894
lea ecx, [ebp - 0x2c]
call fcn.0041ab30
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x456368
mov byte [ebp - 0x236], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041ab00
mov al, byte [ebp - 0x236]
jmp 0x45647b
lea ecx, [ebp - 0x234]
push ecx
mov ecx, dword [ebp - 0x23c]
add ecx, 0xb0
call fcn.0041bd60
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x23c]
mov dword [ecx + 0xcc], eax
mov edx, dword [ebp - 0x23c]
cmp dword [edx + 0xcc], 0xffffffff
jne 0x4563db
mov byte [ebp - 0x237], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041ab00
mov al, byte [ebp - 0x237]
jmp 0x45647b
push 0x3c
push 0x4e
mov eax, dword [ebp + 8]
push eax
call fcn.0045e2a0
add esp, 0xc
push 0
push 0x40
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045e2a0
add esp, 0xc
mov ecx, dword [ebp - 0x23c]
add ecx, 4
call fcn.00403570
push eax
push 0x2712
mov edx, dword [ebp + 8]
push edx
call fcn.0045e2a0
add esp, 0xc
push 1
push 0x34
mov eax, dword [ebp + 8]
push eax
call fcn.0045e2a0
add esp, 0xc
push 0x456210
push 0x4e2b
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045e2a0
add esp, 0xc
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx + 0xcc]
push eax
push 0x2711
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045e2a0
add esp, 0xc
mov byte [ebp - 0x238], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041ab00
mov al, byte [ebp - 0x238]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret 4
Function at 0x461400
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x461413
xor eax, eax
jmp 0x4614f3
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4614a1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx]
je 0x461449
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00461200
add esp, 8
movzx edx, al
test edx, edx
je 0x4614a1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
movzx edx, byte [ebp + 0x20]
test edx, edx
je 0x46149a
mov byte [ebp - 9], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x1f4
push 0
push 0
push 0
push 0x482
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor edx, edx
cmp dword [ebp - 0x10], 1
sete dl
mov byte [ebp - 9], dl
movzx eax, byte [ebp - 9]
test eax, eax
jne 0x46149a
xor eax, eax
jmp 0x4614f3
mov eax, 1
jmp 0x4614f3
movzx ecx, byte [ebp + 0x14]
test ecx, ecx
je 0x4614af
cmp dword [ebp + 0x10], 0
jne 0x4614b3
xor eax, eax
jmp 0x4614f3
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.004c94b0
add esp, 4
movzx eax, al
cmp eax, 1
jne 0x4614f0
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 0x1c]
push ecx
push 0
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0x50256c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x467850
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
test eax, eax
jne 0x46786e
xor eax, eax
jmp 0x467954
mov dword [ebp - 0x14], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jne 0x467890
mov eax, 1
jmp 0x467954
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
je 0x467947
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x4678e7
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x467935
mov edx, dword [ebp - 0x10]
push edx
call fcn.004677a0
add esp, 4
test eax, eax
je 0x46792e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x46791f
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
test eax, eax
je 0x46791d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x467926
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_FreeConsole]
jmp 0x467935
mov dword [ebp - 0x14], 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x467951
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x467960
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.004ccbe0
add esp, 0xc
mov dword [ebp - 0x10c], 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4679d2
movzx edx, byte [ebp - 0xf6]
and edx, 0x80
jne 0x4679d2
push 0
push 1
push 0
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov dword [ebp - 0x10c], 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x10c], 0
je 0x4679f9
push 0
push 3
push 0
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret
Function at 0x468ad0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x468b2d
cmp dword [ebp - 0x11c], 6
jae 0x468b0d
xor eax, eax
jmp 0x468b2f
cmp dword [ebp - 0x11c], 6
jne 0x468b26
cmp dword [ebp - 0x118], 0
sbb eax, eax
add eax, 1
jmp 0x468b2f
mov eax, 1
jmp 0x468b2f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret

Function at 0x469030
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.004cf4e0
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
jne 0x469054
xor al, al
jmp 0x469113
mov byte [ebp - 0x2010], 0
push 0x1fff
push 0
lea eax, [ebp - 0x200f]
push eax
call fcn.004ccbe0
add esp, 0xc
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x469097
cmp dword [ebp - 0xc], 0x1fff
jbe 0x46909b
xor al, al
jmp 0x469113
mov byte [ebp - 1], 0
lea eax, [ebp - 0x2010]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x469110
mov dword [ebp - 0x2014], 0
mov dword [ebp - 0x2018], 0
lea eax, [ebp - 0x2018]
push eax
lea ecx, [ebp - 0x2014]
push ecx
push 0x502fc8
lea edx, [ebp - 0x2010]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x469110
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2014]
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2014]
mov edx, dword [ecx + 0xc]
mov dword [eax], edx
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret