joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444841
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
cmp dword [ebp + 0x10], 2
mov esi, dword [0x478968]
je 0x444869
mov esi, dword [0x478960]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push esi
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, 0xcc0020
mov esi, dword [sym.imp.GDI32.dll_BitBlt]
push edi
push 0
push 0
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
push dword [0x47896c]
push dword [0x478970]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call esi
mov ecx, dword [0x478970]
push 1
lea eax, [ecx + ecx]
mov edx, eax
mov eax, dword [ebp - 0xc]
sub eax, edx
xor edx, edx
sub eax, dword [ebp - 0x14]
div ecx
mov ebx, eax
pop eax
inc ebx
mov dword [ebp + 0x10], eax
cmp ebx, eax
jl 0x4448fa
push edi
push 0
push ecx
push dword [ebp + 0xc]
push dword [0x47896c]
push ecx
imul ecx, dword [ebp + 0x10]
push dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
push ecx
push dword [ebp + 8]
call esi
inc dword [ebp + 0x10]
mov ecx, dword [0x478970]
cmp dword [ebp + 0x10], ebx
jle 0x4448ce
push edi
lea eax, [ecx + ecx]
push 0
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
sub eax, ecx
push dword [0x47896c]
push ecx
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4460bd
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x302c
call fcn.0045e9a0
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x10]
mov esi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
cmp dword [esi + 0x9ac64], 0
jle 0x44621f
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00444f49
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44621f
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x44615e
cmp dword [esi + 0x9ac64], 1
jle 0x44615e
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x44615e
cmp eax, dword [ebp - 0x18]
je 0x44615e
mov eax, dword [esi + 0x1c]
cmp eax, dword [ebp - 0x14]
je 0x44615e
push dword [esi + 0x24]
mov ecx, esi
call fcn.00446224
mov eax, ebx
push 0x800
imul eax, eax, 0x9a8
lea edi, [eax + esi]
lea eax, [ebp - 0x102c]
push eax
lea eax, [edi + 0x1cc]
push eax
call fcn.00425283
add edi, 0xcc
lea eax, [ebp - 0x302c]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [sym.imp.MSVCRT.dll_wcscat]
lea eax, [ebp - 0x302c]
push 0x40f2e8
push eax
call edi
lea eax, [ebp - 0x102c]
push eax
lea eax, [ebp - 0x302c]
push eax
call edi
lea eax, [ebp - 0x302c]
push 0x40f2e4
push eax
call edi
add esp, 0x2c
lea eax, [ebp - 0x302c]
mov ecx, 0x4994a0
push 0
push 1
push eax
call fcn.0044254e
cmp dword [esi + 0x9ac78], ebx
lea eax, [esi + 0x9ac78]
je 0x44621f
push dword [esi + 4]
mov dword [eax], ebx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x2c]
push 0xffffffffffffffff
push eax
push edi
mov ecx, esi
call fcn.00444537
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x446f89
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x27
pop ecx
xor eax, eax
lea edi, [ebp - 0xa0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x9c
push eax
call esi
test eax, eax
jne 0x446fdd
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x94
push eax
call esi
test eax, eax
jne 0x446fdd
xor ax, ax
jmp 0x447066
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub eax, ecx
je 0x44705b
dec eax
je 0x44702a
dec eax
je 0x446ff4
mov dword [ebp - 4], ecx
jmp 0x447062
push 4
pop eax
cmp dword [ebp - 0x9c], eax
ja 0x447002
mov dword [ebp - 4], eax
push 5
pop eax
cmp dword [ebp - 0x9c], eax
jne 0x447062
cmp dword [ebp - 0x98], ecx
jne 0x447018
mov dword [ebp - 4], eax
cmp dword [ebp - 0x98], 1
jne 0x447062
mov dword [ebp - 4], 6
jmp 0x447062
cmp dword [ebp - 0x9c], 4
jne 0x447062
cmp dword [ebp - 0x98], ecx
push 2
pop eax
jne 0x447041
mov dword [ebp - 4], eax
cmp dword [ebp - 0x98], 0xa
jne 0x44704d
mov dword [ebp - 4], eax
cmp dword [ebp - 0x98], 0x5a
jne 0x447062
mov dword [ebp - 4], eax
jmp 0x447062
mov dword [ebp - 4], 1
mov ax, word [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x44736f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0xc], edi
mov dword [ebp - 4], edi
je 0x447476
lea eax, [ebp - 4]
push esi
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x40000
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x447467
push dword [ebp + 0x10]
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x447467
cmp dword [ebp + 0x14], edi
je 0x447464
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x447467
push edi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x447467
mov esi, 0x105
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [ebp - 8], edi
pop ecx
mov ebx, eax
mov dword [ebp + 0xc], edi
jbe 0x44745d
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, edi
jne 0x44744b
push 1
push dword [ebp + 0x10]
push ebx
push dword [ebp - 4]
call fcn.0044736f
add esp, 0x10
jmp 0x447452
cmp eax, 0x103
je 0x44745d
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jb 0x447426
push ebx
call fcn.0045e98b
pop ecx
push 1
pop ebx
cmp dword [ebp - 4], edi
pop esi
je 0x447476
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop ebx
leave
ret
Function at 0x447544
Capabilities:
Enumerate browser history

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x403900
push 3
push 0
push 0x403580
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], 0x28
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x34]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x4475aa
mov eax, dword [ebp - 4]
push 0
push dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
jmp 0x447583
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 1
pop eax
leave
ret

Function at 0x4475ca
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
mov ebx, 0x1000
push esi
push ebx
mov dword [ebp - 4], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push 0x40f32c
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
test eax, eax
mov dword [ebp - 8], eax
jne 0x44760e
push esi
call fcn.0045e98b
pop ecx
jmp 0x4476db
push edi
xor eax, eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x447638
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov al, byte [0x460a68]
mov ecx, 0x1ff
mov byte [ebp - 0x824], al
xor eax, eax
lea edi, [ebp - 0x823]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push dword [esi + 4]
lea eax, [ebp - 0x824]
push 0x40a158
push 0x800
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
mov edi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
add esp, 0x10
push dword [esi + 4]
call edi
test eax, eax
jne 0x44769c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x44769c
push 0
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFile]
push dword [esi + 4]
call edi
push esi
call fcn.0045e98b
push ebx
mov dword [ebp - 4], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [esi], eax
pop ecx
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x44760f
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.0045e98b
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4476df
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
sub esp, 0x20
push ebp
push esi
push edi
mov edi, 0x1000
push edi
mov dword [esp + 0x10], edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x10]
pop ecx
mov dword [esi], eax
lea eax, [esp + 0xc]
push eax
push esi
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov ebp, eax
test ebp, ebp
je 0x4477b8
push ebx
mov ebx, dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
xor eax, eax
push 1
push eax
push eax
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x447748
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, dword [esi + 0xc]
mov eax, 0x100000
and ecx, eax
cmp ecx, eax
je 0x44777a
push dword [esi + 4]
call ebx
test eax, eax
jne 0x44777a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x44777a
push 0
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFile]
push dword [esi + 4]
call ebx
push esi
call fcn.0045e98b
push edi
mov dword [esp + 0x18], edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x18]
pop ecx
mov dword [esi], eax
pop ecx
lea eax, [esp + 0x10]
push eax
push esi
push ebp
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x44771c
push ebp
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.0045e98b
pop ecx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x4487c9
Capabilities:
Allocate thread local storage
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x40f4b8
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
xor esi, esi
test eax, eax
pop ecx
jne 0x4487e9
xor edi, edi
call fcn.00427f67
mov dword [0x4647a4], eax
call fcn.0042675f
mov dword [0x5361d8], eax
call fcn.0042666d
mov dword [0x5361dc], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, 0x461578
mov dword [0x5361e4], eax
call fcn.00421c95
mov ecx, 0x4645a8
call fcn.00434c61
call fcn.004491f6
push dword [0x4768fc]
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
cmp dword [0x474d58], esi
je 0x448878
push 0x40f4f4
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
mov dword [0x53618c], eax
je 0x448898
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x448898
push dword [0x53618c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00448746
pop ecx
jmp 0x4488c4
push esi
push 0x40a37c
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, esi
mov dword [0x5361e0], eax
je 0x448898
push edi
call fcn.00448746
test eax, eax
pop ecx
jne 0x4488c4
lea eax, [ebp - 8]
mov dword [ebp - 8], 8
push eax
mov dword [ebp - 4], 0x604
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push dword [ebp + 8]
call fcn.004484e9
test eax, eax
pop ecx
jne 0x4488cb
xor eax, eax
jmp 0x448971
call fcn.00427384
test eax, eax
je 0x4488e0
cmp dword [0x4768ec], esi
je 0x4488e0
push 5
jmp 0x4488e2
push 4
pop eax
mov edi, dword [sym.imp.GDI32.dll_CreateFontA]
push ebx
push 0x40a940
push esi
push eax
push esi
push esi
push 1
push esi
push esi
mov ebx, 0x190
push esi
push ebx
push esi
push esi
push esi
push 0xe
call edi
push 0x40a940
push esi
mov dword [0x477d24], eax
call fcn.00427384
neg eax
sbb eax, eax
neg eax
add eax, 4
push eax
push esi
push esi
push 1
push esi
push esi
push esi
push ebx
push esi
push esi
push esi
push 0xb
call edi
push 1
mov dword [0x477d20], eax
call fcn.0041ce05
pop ecx
mov ecx, 0x4789c0
call fcn.0043b59e
mov ecx, 0x478958
call fcn.00440de9
call fcn.0041ecea
mov ecx, 0x498a58
call fcn.00437849
call fcn.00415439
mov ecx, 0x477d30
call fcn.0045dc3c
push 1
pop eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x448975
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402fe0
push 0x45ea34
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push 1
call fcn.0044058f
pop ecx
push dword [0x5361e4]
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, 0x478958
call fcn.00440ca8
mov ecx, 0x462840
call fcn.0042969e
mov ecx, 0x53aa60
call fcn.0042969e
push ebx
call fcn.0041ce05
pop ecx
call fcn.0041ed28
mov eax, dword [0x477d24]
cmp eax, ebx
je 0x4489f1
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x477d20]
cmp eax, ebx
je 0x448a01
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.00448a75
call fcn.0042c3f7
call dword [sym.imp.ole32.dll_OleUninitialize]
mov byte [ebp - 0x11c], bl
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x103
lea eax, [ebp - 0x11c]
push eax
push 0x40a244
call fcn.0041367b
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x448a56
or dword [ebp - 4], 0xffffffff
push dword [0x53618c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448ee6
Capabilities:
Delete file
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x40a37c
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x448f0f
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push ebx
push ebx
call fcn.0043f103
add esp, 0xc
call fcn.0043f3df
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov edi, 0x40ad6c
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push edi
push SysReAllocStringLen
call esi
push 0x40f5a0
push SysReAllocStringLen
call esi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
push 0x40b474
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x103
push eax
push dword [0x536190]
call fcn.00426857
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.0042692e
add esp, 0x18
test eax, eax
pop edi
pop esi
pop ebx
je 0x448f9c
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
leave
ret

Function at 0x44906a
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4766c4], 0
push esi
je 0x4490cd
mov esi, 0x4766d8
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x4490cd
push esi
call fcn.0042833a
pop ecx
test eax, eax
push esi
je 0x4490ac
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x536190]
call fcn.00426857
jmp 0x4490bd
push 0x40a158
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add esp, 0x10
and byte [eax + ecx - 1], 0
jmp 0x4490f3
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push dword [ebp + 8]
push eax
push 0x40f600
push 0x40f5bc
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
push dword [ebp + 8]
call fcn.00425631
pop ecx
pop esi
leave
ret
Function at 0x449521
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0045e9a0
and byte [ebp - 0x814], 0
push ebx
push esi
mov dword [ebp - 8], ecx
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x813]
rep stosd dword es:[edi], eax
cmp dword [0x4647a4], 0
mov ebx, dword [ebp + 0x10]
stosw word es:[edi], ax
mov dword [ebp - 4], 3
mov esi, SysReAllocStringLen
stosb byte es:[edi], al
je 0x4495a9
cmp dword [ebp + 8], 0
jne 0x4495a9
lea eax, [ebp + 0x10]
push esi
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
push 0x40b930
mov dword [ebp + 0x10], 0x800
call fcn.00424611
add esp, 0x14
cmp eax, 1
jne 0x4495a9
push dword [ebp + 0x10]
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
push 0x41a
call fcn.0045dab7
cmp dword [0x4647a4], 0
je 0x449643
cmp dword [ebp + 8], 0
je 0x449626
lea eax, [ebp - 0x1014]
mov dword [ebp + 8], 0x800
test eax, eax
je 0x449626
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x449626
push esi
lea eax, [ebp - 0x1014]
push dword [ebp + 8]
push eax
push ebx
push 0x40b930
call fcn.004247e7
add esp, 0x14
cmp dword [0x4647a4], 0
je 0x449643
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x40ad6c
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44d060
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push esi
push edi
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 2
mov edi, eax
lea ecx, [ebp - 0x10]
pop eax
test ecx, ecx
mov dword [ebp - 0x58], eax
je 0x44d090
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
jmp 0x44d092
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push dword [ebp + 0x10]
push 0x100e
push edi
call esi
lea eax, [ebp - 0x58]
push eax
push 1
push 0x1019
push edi
call esi
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x10], eax
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], 0x104
mov dword [ebp - 8], eax
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
push 0x102d
push edi
call esi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x15c]
push eax
push 0
push 0x14d
push edi
call esi
mov eax, dword [ebp - 8]
push 0x40
sub eax, dword [ebp - 0x10]
push 0x12c
push eax
mov eax, dword [ebp - 0xc]
dec eax
push eax
push dword [ebp - 0x10]
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push 1
push 0x14f
push edi
call esi
pop edi
pop esi
leave
ret
Function at 0x44d137
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x44]
shr ebx, 8
and byte [ebp], 0
push esi
test bl, 2
push edi
je 0x44d1b1
lea eax, [esp + 0x10]
push eax
push 0x11
call fcn.0044d137
pop ecx
lea edi, [esp + 0x14]
pop ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x410f4c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test bl, 1
je 0x44d215
lea eax, [esp + 0x10]
push eax
push 0x10
call fcn.0044d137
pop ecx
lea edi, [esp + 0x14]
pop ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x410f4c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test bl, 4
je 0x44d278
lea eax, [esp + 0x10]
push eax
push 0x12
call fcn.0044d137
pop ecx
or edx, 0xffffffff
pop ecx
lea edi, [esp + 0x10]
mov ecx, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, ebp
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x410f4c
mov ecx, edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, ebp
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx eax, byte [esp + 0x48]
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
lea ecx, [esp + 0x10]
push 0x32
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret