joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43901b
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push 0x14c
mov eax, 0x4d44a8
call fcn.004a9c62
xor edi, edi
push edi
push edi
push edi
push 0x438c61
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x514980
call fcn.0040973d
mov byte [0x514823], al
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43922e
cmp dword [ebp - 0x114], 2
jne 0x43922e
call fcn.0043e17a
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.00438abf
cmp eax, 0x40047
mov dword [0x51497c], eax
push str.IsWow64Process
sbb al, al
inc al
push str.kernel32.dll
mov byte [0x50fde0], al
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4390ce
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ecx, 0xc8
call fcn.00404413
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [ebp - 0x148]
call fcn.00402b1a
lea ecx, [ebp - 0x158]
mov dword [ebp - 4], edi
call fcn.00402b1a
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x130]
call fcn.00402b61
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x158]
lea ecx, [ebp - 0x130]
call fcn.0045e41a
mov byte [ebp - 4], 1
push dword [ebp - 0x130]
call fcn.004a8d17
pop ecx
pop ecx
lea ecx, [ebp - 0x148]
call fcn.00401b46
lea ecx, [ebp - 0x13c]
call fcn.00402b1a
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 3
call fcn.00402b1a
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x13c]
lea ecx, [ebp - 0x148]
call fcn.0045e41a
pop ecx
lea ecx, [ebp - 0x13c]
call fcn.00401b46
lea ecx, [ebp - 0x130]
call fcn.00401b46
mov esi, dword [ebp - 0x130]
mov edx, 0x4f3b24
mov ecx, esi
call fcn.00402506
test al, al
je 0x4391b7
lea eax, [esi + 4]
mov ecx, 0x514a40
push eax
call fcn.00402c5d
cmp dword [ebp - 0x138], 0
je 0x4391d1
lea eax, [ebp - 0x13c]
mov ecx, 0x514a34
push eax
call fcn.00402ccc
call fcn.00438eba
call fcn.00438f2e
mov edx, 0x514e74
mov ecx, 0xbba
call fcn.0043e33e
call fcn.00438d61
call fcn.0040cb46
mov dword [0x514978], edi
call dword [sym.imp.ole32.dll_OleUninitialize]
push esi
call fcn.004a8d17
push dword [ebp - 0x13c]
call fcn.004a8d17
push dword [ebp - 0x158]
call fcn.004a8d17
push dword [ebp - 0x148]
call fcn.004a8d17
add esp, 0x10
xor eax, eax
jmp 0x43923b
mov ecx, str.Unsupported_Windows_version
call fcn.00438fe8
xor eax, eax
inc eax
call fcn.004a9c0c
ret
Function at 0x43e484
Capabilities:
Identify system language via api

Disassembly:
push 0x2c
mov eax, 0x4d4b68
call fcn.004a9c2e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
cmp si, cx
jne 0x43e5bd
mov eax, ecx
xor ebx, ebx
shr cx, 0xa
and eax, 0x3ff
movzx esi, cx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov ecx, eax
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x20]
call fcn.0043e38c
lea ecx, [ebp - 0x38]
call fcn.0043e13d
mov ecx, esi
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
xor eax, eax
test ebx, ebx
cmove eax, ecx
cmp eax, esi
jae 0x43e546
mov eax, dword [edi + eax*4]
mov dword [ebp - 0x10], eax
cmp dword [eax + 4], 0
je 0x43e546
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402be8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
push dword [eax]
call fcn.00402f18
push str..txt
lea ecx, [ebp - 0x2c]
call fcn.00402f18
push ecx
push dword [ebp - 0x2c]
call fcn.0040210c
test al, al
jne 0x43e556
mov byte [ebp - 4], 1
push dword [ebp - 0x2c]
call fcn.004a8d17
pop ecx
mov ecx, dword [ebp - 0x14]
inc ebx
cmp ebx, 2
jb 0x43e4e8
push dword [ebp - 0x38]
call fcn.004a8d17
jmp 0x43e5b1
mov eax, dword [ebp - 0x10]
mov ecx, 0x514a4c
push dword [eax]
call fcn.00402df2
push dword [ebp - 0x2c]
call fcn.004a8d17
pop ecx
push dword [ebp - 0x38]
call fcn.004a8d17
jmp 0x43e591
dec esi
mov ebx, dword [edi + esi*4]
test ebx, ebx
je 0x43e592
push dword [ebx]
call fcn.004a8d17
pop ecx
push 0xc
push ebx
call fcn.004a8e28
pop ecx
pop ecx
test esi, esi
jne 0x43e578
jmp 0x43e5b6
dec esi
mov ebx, dword [edi + esi*4]
test ebx, ebx
je 0x43e5b2
push dword [ebx]
call fcn.004a8d17
pop ecx
push 0xc
push ebx
call fcn.004a8e28
pop ecx
pop ecx
test esi, esi
jne 0x43e598
push edi
call fcn.004a8d17
pop ecx
call fcn.004a9bf7
ret
Function at 0x43f5fa
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x4c
mov eax, 0x4d43f0
call fcn.004a9c2e
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
call fcn.00423843
push eax
lea ecx, [ebp - 0x10]
call fcn.00423599
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.004264a6
pop ecx
mov byte [ebp - 4], 1
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43f6d2
mov byte [ebp - 4], 2
call fcn.00423843
push eax
lea ecx, [ebp - 0x18]
call fcn.00423599
xor eax, eax
inc eax
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push str._startby_d
push eax
call fcn.004287c5
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push esi
push str._update
push str._s__s
push eax
call fcn.004287c5
add esp, 0x1c
mov byte [ebp - 4], 1
lea ecx, [esi - 0x10]
call fcn.004238e7
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.004ab9a0
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], esi
mov esi, dword [ebp - 0x10]
push eax
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x4c], str.open
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x43f6d5
push dword [ebp - 0x20]
inc edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43f6d5
mov esi, dword [ebp - 0x10]
push ebx
push ebx
push edi
push 2
push 1
call fcn.00466021
mov ecx, eax
call fcn.004666ee
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004238e7
lea ecx, [esi - 0x10]
call fcn.004238e7
mov eax, edi
call fcn.004a9bf7
ret
Function at 0x43faf8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.windowinit
mov ecx, edi
call fcn.00474b79
test al, al
jne 0x43fd76
push str.click
mov ecx, edi
call fcn.00474b79
test al, al
je 0x43fd40
mov eax, dword [edi + 0x108]
cmp eax, dword [esi + 0x344]
jne 0x43fb54
xor ecx, ecx
cmp dword [esi + 0x3a0], ecx
je 0x43fd76
push ecx
push ecx
push 2
jmp 0x43fd2c
cmp eax, dword [esi + 0x350]
jne 0x43fb75
push 0
push 0xf020
push 0x112
lea ecx, [esi - 0x10]
call fcn.0046cc69
jmp 0x43fd76
cmp eax, dword [esi + 0x348]
jne 0x43fb86
push 0
push 0xf030
jmp 0x43fb63
cmp eax, dword [esi + 0x34c]
jne 0x43fb97
push 0
push 0xf120
jmp 0x43fb63
cmp eax, dword [esi + 0x354]
jne 0x43fbba
sub esp, 0x120
mov ecx, esp
push edi
call fcn.0043fd7e
lea ecx, [esi - 0x10]
call fcn.00440482
jmp 0x43fd76
cmp eax, dword [esi + 0x378]
jne 0x43fbcf
lea ecx, [esi - 0x10]
call fcn.00440591
jmp 0x43fd76
cmp eax, dword [esi + 0x37c]
jne 0x43fbe4
lea ecx, [esi - 0x10]
call fcn.004405f7
jmp 0x43fd76
cmp eax, dword [esi + 0x384]
jne 0x43fbf9
lea ecx, [esi - 0x10]
call fcn.00440745
jmp 0x43fd76
cmp eax, dword [esi + 0x380]
jne 0x43fc0e
lea ecx, [esi - 0x10]
call fcn.0044065f
jmp 0x43fd76
cmp eax, dword [esi + 0x388]
je 0x43fd6e
cmp eax, dword [esi + 0x390]
jne 0x43fc3d
sub esp, 0x120
mov ecx, esp
push edi
call fcn.0043fd7e
lea ecx, [esi - 0x10]
call fcn.004412df
jmp 0x43fd76
cmp eax, dword [esi + 0x394]
jne 0x43fc52
lea ecx, [esi - 0x10]
call fcn.004413d6
jmp 0x43fd76
cmp eax, dword [esi + 0x398]
jne 0x43fc67
lea ecx, [esi - 0x10]
call fcn.00441493
jmp 0x43fd76
xor ecx, ecx
cmp dword [esi + 0x3a0], ecx
je 0x43fd76
cmp eax, dword [esi + 0x358]
jne 0x43fc85
push ecx
push 0x5dc05dc
jmp 0x43fcdc
cmp eax, dword [esi + 0x360]
jne 0x43fc95
push ecx
push 0x5dd05dd
jmp 0x43fcdc
cmp eax, dword [esi + 0x35c]
jne 0x43fcce
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
imul ecx, dword [0x514a64], 0x3a0
shr eax, 0xf
not al
and al, 1
mov byte [esp + 0xc], al
push dword [esp + 0xc]
add ecx, 0x514ac0
call fcn.00454fa6
jmp 0x43fd76
cmp eax, dword [esi + 0x364]
jne 0x43fcf2
push ecx
push 0x5de05de
push 0x111
lea ecx, [esi - 0x10]
call fcn.0046c92b
push eax
call dword [esi + 0x3a0]
jmp 0x43fd3b
cmp eax, dword [esi + 0x368]
jne 0x43fd11
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.00453507
jmp 0x43fd76
cmp eax, dword [esi + 0x36c]
je 0x43fd76
cmp eax, dword [esi + 0x370]
jne 0x43fd76
push ecx
push 0x640064
push 0x111
lea ecx, [esi - 0x10]
call fcn.0046c92b
push eax
call dword [esi + 0x3a0]
add esp, 0x10
jmp 0x43fd76
push str.itemclick
mov ecx, edi
call fcn.00474b79
test al, al
jne 0x43fd76
push str.return
mov ecx, edi
call fcn.00474b79
test al, al
je 0x43fd76
mov eax, dword [edi + 0x108]
cmp eax, dword [esi + 0x38c]
jne 0x43fd76
lea ecx, [esi - 0x10]
call fcn.00441212
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4428a6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push esi
cmp eax, 0x3e8
jl 0x44291f
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
push dword [ecx + 0x16c]
push dword [ecx + 0x168]
push eax
call fcn.0045492a
mov eax, dword [0x514a64]
imul esi, eax, 0x3a0
add esi, 0x514c28
mov ecx, dword [esi]
test ecx, ecx
je 0x4428fb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi], 0
mov eax, dword [0x514a64]
imul esi, eax, 0x3a0
add esi, 0x514c2c
mov ecx, dword [esi]
test ecx, ecx
je 0x442b4e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi], 0
jmp 0x442b4e
mov ecx, 0x223
cmp eax, ecx
jg 0x442a30
je 0x442a24
add ecx, 0xfffffffa
cmp eax, ecx
jg 0x4429ad
je 0x4429a6
sub eax, 0x65
je 0x442997
sub eax, 1
je 0x442990
sub eax, 1
je 0x442989
sub eax, 1
je 0x442982
sub eax, 1
je 0x44297b
sub eax, 0x1b3
jne case.0x442a51.553
push 1
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.00450d5b
jmp 0x442b4e
push str.SHA256
jmp 0x44299c
push str.SHA1
jmp 0x44299c
push str.CRC64
jmp 0x44299c
push str.CRC32
jmp 0x44299c
push 0x4effa8
call fcn.00447c22
jmp 0x442b4e
push 0
jmp 0x442b39
sub eax, 0x21e
je 0x442a1d
sub eax, 1
je 0x442a01
sub eax, 1
je 0x4429fd
sub eax, 1
je 0x4429e3
sub eax, 1
jne case.0x442a51.553
push dword [0x514a64]
push eax
push eax
mov ecx, 0x514a58
call fcn.0042dc54
jmp 0x442b4e
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.00455d03
jmp 0x442b4e
push 1
jmp 0x442a03
push 0
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.00450be4
jmp 0x442b4e
push 0
jmp 0x442961
push dword [0x514a64]
push 0
push 1
jmp 0x4429d4
mov ecx, 0x24e
cmp eax, ecx
jg 0x442b29
je 0x442b22
add eax, 0xfffffddc
cmp eax, 0xb
ja case.0x442a51.553
jmp dword [eax*4 + 0x442b56]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
imul ecx, dword [0x514a64], 0x3a0
shr eax, 0xf
not al
and al, 1
mov byte [ebp - 4], al
push dword [ebp - 4]
add ecx, 0x514ac0
call fcn.00454fa6
jmp 0x442b4e
call fcn.0044d0cb
jmp 0x442b4e
call fcn.0045713f
jmp 0x442b4e
call fcn.00457a92
jmp 0x442b4e
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.00453507
jmp 0x442b4e
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.00455d3d
jmp 0x442b4e
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.004557d6
jmp 0x442b4e
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.00455a61
jmp 0x442b4e
call fcn.0043ee5d
jmp 0x442b4e
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.0044aa0d
jmp 0x442b4e
push 0x4eff84
jmp 0x442b39
cmp eax, 0x24f
je 0x442b34
xor al, al
jmp 0x442b50
push 0x4f0278
imul ecx, dword [0x514a64], 0x3a0
add ecx, 0x514ac0
call fcn.00450d09
mov al, 1
pop esi
leave
ret
Function at 0x44331c
Capabilities:
Connect network resource
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea ecx, [ebx + 0x54]
mov esi, dword [ecx + 4]
mov dword [esp + 0x10], ecx
jmp 0x443361
mov eax, dword [ecx]
dec esi
mov edi, dword [eax + esi*4]
test edi, edi
je 0x443361
push dword [edi + 0x44]
call fcn.004a8d17
pop ecx
mov ecx, edi
call fcn.00443169
push 0x50
push edi
call fcn.004a8e28
pop ecx
pop ecx
lea ecx, [ebx + 0x54]
test esi, esi
jne 0x44333a
and dword [ecx + 4], esi
mov byte [esp + 0x1c], 0
mov ecx, dword [ebx + 0x50]
test ecx, ecx
jne 0x443378
xor esi, esi
jmp 0x443383
lea edx, [esp + 0x20]
call fcn.0040823b
mov esi, edx
lea ecx, [esp + 0x18]
call fcn.0040828e
lea eax, [esp + 0x18]
push eax
push esi
xor esi, esi
push esi
push 1
push 2
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
mov edi, eax
test edi, edi
sete byte [esp + 0x1c]
test edi, edi
je 0x4433e2
cmp edi, 5
jne 0x4434ed
cmp dword [ebx + 0x50], esi
je 0x4434ed
lea ecx, [ebx + 0xc]
lea edx, [esp + 0x20]
call fcn.0040823b
push 8
push esi
push esi
mov eax, edx
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov edi, eax
test edi, edi
je 0x44336d
jmp 0x4434ed
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x40]
mov edi, 0x4000
call fcn.00443124
lea ecx, [esp + 0x84]
call fcn.00402b1a
push edi
call fcn.004a8e36
pop ecx
push edi
mov esi, eax
push 0
push esi
call fcn.004ab9a0
add esp, 0xc
mov dword [esp + 0x14], edi
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 1
push eax
push esi
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
mov edi, eax
test edi, edi
jne 0x443457
cmp dword [esp + 0x10], 1
je 0x44344a
mov edi, 0x80004005
jmp 0x443457
lea edx, [esp + 0x40]
mov ecx, esi
call fcn.004081e1
xor edi, edi
push esi
call fcn.004a8d17
pop ecx
test edi, edi
jne 0x4434cd
cmp byte [esp + 0x51], 0
jne 0x443477
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x64]
call fcn.00402ccc
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x88]
call fcn.00402ccc
lea ecx, [esp + 0x84]
call fcn.00402fce
test eax, eax
js 0x4434a6
inc eax
lea ecx, [esp + 0x84]
push eax
call fcn.00403269
lea eax, [esp + 0x40]
mov ecx, ebx
push eax
call fcn.0044385e
push dword [esp + 0x84]
call fcn.004a8d17
pop ecx
lea ecx, [esp + 0x40]
call fcn.00443169
jmp 0x4433e6
push dword [esp + 0x84]
call fcn.004a8d17
pop ecx
lea ecx, [esp + 0x40]
call fcn.00443169
cmp edi, 0x103
jne 0x4434ed
xor edi, edi
lea ecx, [esp + 0x18]
call fcn.0040828e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x443d7e
Capabilities:
Get file system object information

Disassembly:
push 0x310
mov eax, 0x4d537c
call fcn.004a9c62
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x31c]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x2f8], eax
call fcn.00402b1a
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x443e04
push dword [edi + 0xc]
lea ecx, [ebp - 0x304]
push dword [edi + 8]
call fcn.00439f29
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x310]
call fcn.00439fc1
add esp, 0xc
push eax
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 2
call fcn.00402ccc
push dword [ebp - 0x310]
call fcn.004a8d17
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x304]
call fcn.004a8d17
pop ecx
lea ecx, [edi + 0x18]
call fcn.00402fce
mov esi, eax
lea eax, [ebp - 0x310]
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [edi + 0x18]
call fcn.00414bdc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x304]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.00402b61
lea eax, [ebp - 0x310]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.00443d1d
lea eax, [ebp - 0x304]
mov ecx, ebx
push eax
call fcn.00443d1d
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x2f4]
call fcn.00402be8
lea ecx, [ebp - 0x2f4]
mov byte [ebp - 4], 5
call fcn.00402e6b
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x2f4]
call fcn.00402eda
lea ecx, [ebp - 0x2f4]
call fcn.00402e6b
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x2f4]
call fcn.00402eda
lea ecx, [ebp - 0x2f4]
call fcn.00402e6b
cmp byte [edi + 1], 0
je 0x443ef8
mov edx, 0x3f4
lea ecx, [ebp - 0x2f4]
call fcn.0043e30d
push 0x4f0670
lea ecx, [ebp - 0x2f4]
call fcn.00402f18
push 0
lea ecx, [edi + 0x10]
lea edx, [ebp - 0x30]
call fcn.004089a1
pop ecx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x2f4]
call fcn.00402f18
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call esi
push dword [ebp - 0x2f4]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x110
push 0x2b4
lea eax, [ebp - 0x2e8]
push eax
push 0x80
push dword [edi + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x443f55
push dword [ebp - 0x2f8]
push dword [ebx + 4]
call esi
push 0
push dword [ebp - 0x2e8]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x2f4]
call fcn.004a8d17
pop ecx
push dword [ebp - 0x304]
call fcn.004a8d17
pop ecx
push dword [ebp - 0x310]
call fcn.004a8d17
pop ecx
push dword [ebp - 0x31c]
call fcn.004a8d17
pop ecx
call fcn.004a9c0c
ret 0xc
Function at 0x44449f
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0x102
jne 0x444502
mov eax, dword [ebp + 0x10]
sar eax, 0x10
push 1
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp eax, 0x6a
je 0x4444fb
cmp eax, 0x6b
je 0x4444fb
cmp eax, 0x6d
je 0x4444fb
cmp dword [ebp + 0xc], 0x2f
jne 0x4444e3
mov eax, dword [ebp + 0x10]
shr eax, 0x18
test al, 1
jne 0x4444f3
cmp dword [ebp + 0xc], 0x5c
je 0x4444f3
cmp dword [ebp + 0xc], 0x2f
jne 0x4445cd
mov ecx, dword [edi + 0xc]
call fcn.0044a92b
xor eax, eax
jmp 0x4445db
cmp ebx, 0x106
jne 0x444536
mov eax, dword [ebp + 0x10]
sar eax, 0x10
push 1
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp eax, 0xd
je 0x4444fb
cmp eax, 0x6a
je 0x4444fb
cmp eax, 0x6b
je 0x4444fb
cmp eax, 0x6d
jne 0x4445cd
jmp 0x4444fb
cmp ebx, 0x100
jne 0x4445b3
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x11
mov dword [ebp - 4], eax
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x10
mov dword [ebp + 8], eax
call esi
mov ecx, dword [ebp + 0xc]
shr eax, 0xf
and al, 1
pop esi
sub ecx, 0x21
je 0x444596
sub ecx, 1
jne 0x4445cd
cmp byte [ebp + 8], cl
je 0x4445cd
cmp byte [ebp - 4], cl
jne 0x4445cd
test al, al
jne 0x4445cd
push ecx
mov ecx, dword [edi + 0xc]
call fcn.00450d09
jmp 0x4444fb
cmp byte [ebp + 8], 0
je 0x4445cd
cmp byte [ebp - 4], 0
jne 0x4445cd
test al, al
jne 0x4445cd
mov ecx, dword [edi + 0xc]
call fcn.0044a64f
jmp 0x4444fb
cmp ebx, 7
jne 0x4445cd
mov eax, dword [edi + 0xc]
mov byte [eax + 0x94], 1
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 0x40]
mov eax, dword [ecx]
call dword [eax + 0x14]
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push ebx
call fcn.00404879
pop edi
pop ebx
leave
ret 0xc
Function at 0x44b316
Capabilities:
Get file system object information

Disassembly:
push 0x348
mov eax, 0x4d6037
call fcn.004a9c62
mov dword [ebp - 0x2d8], ecx
mov eax, dword [ebp + 0xc]
mov edi, 0x2b4
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x2d4], eax
lea eax, [ebp - 0x2cc]
push ebx
push eax
call fcn.004ab9a0
add esp, 0xc
test esi, esi
jne 0x44b35a
xor eax, eax
jmp 0x44b51d
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x44b35f
sub ecx, edx
sar ecx, 1
je 0x44b353
push 0x4200
push edi
lea eax, [ebp - 0x2cc]
push eax
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
js 0x44b3ac
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2f8], eax
jmp 0x44b431
lea ecx, [ebp - 0x354]
call fcn.00405bdd
lea ecx, [ebp - 0x32c]
call fcn.00402b1a
push 0x10
pop edi
push esi
lea ecx, [ebp - 0x354]
mov dword [ebp - 4], ebx
call fcn.00405c74
test al, al
mov eax, dword [ebp - 0x328]
cmovne edi, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x324]
jbe 0x44b3f7
push eax
lea ecx, [ebp - 0x32c]
call fcn.004029aa
mov eax, dword [ebp - 0x32c]
mov edx, edi
mov ecx, esi
mov dword [ebp - 0x304], eax
call fcn.00449f54
mov edx, edi
mov dword [ebp - 0x2fc], eax
mov ecx, esi
call fcn.00449f54
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x32c]
mov dword [ebp - 0x2f8], eax
call fcn.004a8d17
pop ecx
push 0x210
call fcn.004a8eb3
mov ebx, eax
mov dword [esp], 0x208
push 0
mov dword [ebp - 0x2d0], ebx
lea edi, [ebx + 8]
push edi
call fcn.004ab9a0
xor eax, eax
mov ecx, edi
add esp, 0xc
mov byte [ebx], al
sub ecx, esi
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x44b460
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44b476
sub ecx, edx
sar ecx, 1
je 0x44b4bb
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44b48c
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
cmp ax, word [ebx + ecx*2 + 6]
je 0x44b4bb
sub edi, 2
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, si
jne 0x44b4a8
mov eax, dword [0x4f1ffc]
mov dword [edi], eax
mov eax, dword [ebp - 0x2d4]
or dword [ebp - 0x2f4], 0xffffffff
mov dword [ebp - 0x31c], eax
lea eax, [ebp - 0x31c]
push eax
xor eax, eax
mov dword [ebp - 0x318], 0xffff0002
push eax
mov eax, dword [ebp - 0x2d8]
push 0x1132
mov dword [ebp - 0x314], 0x67
mov dword [ebp - 0x30c], 0x1000
push dword [eax + 0x84]
mov dword [ebp - 0x308], 0xf000
mov dword [ebp - 0x2f0], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.004a9c0c
ret 0xc