joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100481d0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x1004833c
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x1004833c
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x1004833c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x1004833c
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10048320
cmp dword [esp + 0x10], 0x378
jne 0x10048320
cmp dword [esp + 0x158], 1
jne 0x10048349
cmp dword [esp + 0x17c], 2
jne 0x10048349
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x100ae0e4
push ecx
call fcn.1004fcd2
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push getpeername
call esi
test eax, eax
jne 0x10048320
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.10048380
test eax, eax
je 0x10048320
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push getpeername
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.10047e80
test eax, eax
je 0x10048320
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10048349
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10048331
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x1004833c
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1004835a
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x10048365
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x10048380
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x10048441
mov eax, dword [esp + 0x488]
test eax, eax
je 0x10048441
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10048441
cmp dword [esp], 0x378
jne 0x10048441
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10048441
lea edx, [esp + 4]
push edx
call fcn.10047e10
add esp, 4
test eax, eax
je 0x10048441
cmp dword [esp + 0x234], 1
jne 0x10048433
cmp dword [esp + 0x258], 2
jne 0x10048433
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10048441
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10048441
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x10048450
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x100484af
push esi
call fcn.10047e10
add esp, 4
test eax, eax
je 0x100484af
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x100484af
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100484af
push str.SetPara
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x10048540
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x10048574
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.10048450
test eax, eax
jne 0x1004858d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.100484c0
cmp eax, 1
je 0x1004871a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100485c6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x10048642
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100486c2
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.10048380
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x100486d9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x100485e2
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x10048690
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.10048030
test eax, eax
je 0x100486c2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x1004865e
cmp dword [esp + 0x18], 1
jb 0x100486c2
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push getpeername
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.10047f10
cmp eax, 1
je 0x1004870b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x100486e9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x100486c2
push ebp
mov ecx, ebx
call fcn.10048730
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1004871a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x10048730
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x10048762
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.100484c0
test eax, eax
jne 0x1004877f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100487a6
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x100487f4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.100481d0
test eax, eax
jne 0x100487dd
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x100487c3
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push getpeername
mov ecx, edi
call fcn.10047fa0
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x10048817
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x10060737
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1006076f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1005e7ee
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1005e7c6
jmp 0x1006077b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10061e25
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10061e67
call fcn.100678f6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10061e67
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10061e5e
xor eax, eax
jmp 0x10061e6f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10061e75
pop edi
pop esi
pop ebx
ret 4
Function at 0x404090
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
xor eax, eax
push esi
mov esi, dword [esp + 0x18]
cmp esi, ebx
sete al
mov edx, ecx
push edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov eax, ebp
and eax, 7
je 0x4040c8
mov ecx, ebp
sub ecx, eax
add ecx, 8
mov dword [esp + 0x1c], ecx
jmp 0x4040ce
mov dword [esp + 0x1c], ebp
mov ecx, ebp
xor edi, edi
test ecx, ecx
mov dword [esp + 0x20], edi
ja 0x4040f0
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
lea esp, [esp]
mov eax, dword [esp + 0x14]
test eax, eax
lea eax, [ebp - 7]
je 0x404148
cmp edi, eax
jae 0x404113
lea ecx, [esi + 4]
push ecx
mov ecx, edx
push esi
call fcn.004034e0
add esi, 8
jmp 0x4041d8
sub ecx, ebp
test ecx, ecx
lea edx, [esi + ebp]
jle 0x404132
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
lea eax, [esi + 4]
push eax
push esi
call fcn.004034e0
add esi, 8
jmp 0x4041d8
cmp edi, eax
jae 0x404187
mov cl, byte [esi]
mov byte [ebx], cl
mov al, byte [esi + 1]
mov byte [ebx + 1], al
mov cl, byte [esi + 2]
mov byte [ebx + 2], cl
mov al, byte [esi + 3]
mov byte [ebx + 3], al
mov cl, byte [esi + 4]
lea eax, [ebx + 4]
mov byte [eax], cl
mov cl, byte [esi + 5]
mov byte [ebx + 5], cl
mov cl, byte [esi + 6]
mov byte [ebx + 6], cl
mov cl, byte [esi + 7]
push eax
mov byte [ebx + 7], cl
push ebx
mov ecx, edx
call fcn.004034e0
jmp 0x4041d2
mov eax, ebp
sub eax, edi
xor ebp, ebp
test eax, eax
mov edi, ebx
jle 0x4041a5
mov ecx, eax
mov ebp, eax
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
dec ecx
jne 0x404197
cmp eax, 8
jge 0x4041bc
mov ecx, 8
sub ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
lea eax, [ebx + 4]
push eax
push ebx
call fcn.004034e0
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
add esi, 8
add ebx, 8
mov eax, dword [esp + 0x1c]
add edi, 8
cmp edi, eax
mov dword [esp + 0x20], edi
jb 0x4040e4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x404200
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
push edi
mov edi, dword [esp + 0x14]
cmp esi, edi
sete al
mov ebx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x404284
push ebp
lea ebp, [eax - 1]
shr ebp, 3
inc ebp
mov eax, dword [esp + 0x14]
test eax, eax
je 0x404241
lea ecx, [esi + 4]
push ecx
push esi
mov ecx, ebx
call fcn.004038a0
add esi, 8
jmp 0x404280
mov dl, byte [esi]
mov byte [edi], dl
mov al, byte [esi + 1]
mov byte [edi + 1], al
mov cl, byte [esi + 2]
mov byte [edi + 2], cl
mov dl, byte [esi + 3]
mov byte [edi + 3], dl
mov cl, byte [esi + 4]
lea eax, [edi + 4]
mov byte [eax], cl
mov dl, byte [esi + 5]
mov byte [edi + 5], dl
mov cl, byte [esi + 6]
mov byte [edi + 6], cl
mov dl, byte [esi + 7]
push eax
push edi
mov ecx, ebx
mov byte [edi + 7], dl
call fcn.004038a0
add esi, 8
add edi, 8
dec ebp
jne 0x404228
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x404310
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x404331
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x404335
mov dword [ebx + 0x10], 1
jmp 0x404335
inc eax
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x10]
test eax, eax
jle 0x4043a9
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov word [esi], 0
xor edi, edi
lea ebp, [ebx + 0x14]
lea ecx, [ecx]
mov eax, dword [ebp]
cmp eax, 0xffffffff
je 0x404377
push eax
call dword [0x462cd4]
test eax, eax
je 0x404377
movzx ecx, word [esi]
mov edx, dword [esp + 0x18]
mov word [edx + ecx*2], di
inc word [esi]
cmp word [esi], 0x20
jae 0x404380
inc edi
add ebp, 0xc
cmp edi, 0x20
jl 0x404350
mov eax, dword [ebx + 0x10]
pop edi
dec eax
pop esi
mov dword [ebx + 0x10], eax
pop ebp
jne 0x404398
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, 1
pop ebx
ret 8
test eax, eax
jge 0x4043a3
mov dword [ebx + 0x10], 0
mov al, 1
pop ebx
ret 8
xor al, al
pop ebx
ret 8

Function at 0x404410
Capabilities:
Write clipboard data

Disassembly:
mov ax, word [esp + 8]
cmp ax, 0x20
push esi
push edi
mov esi, ecx
jae 0x404494
movzx eax, ax
lea eax, [eax + eax*2]
mov edi, dword [esi + eax*4 + 0x14]
cmp edi, 0xffffffff
je 0x404494
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00404290
test al, al
je 0x404494
mov edx, dword [esp + 0xc]
push edx
push edi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
mov eax, dword [esi + 0x10]
je 0x404476
dec eax
mov dword [esi + 0x10], eax
jne 0x404464
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov al, 1
pop esi
ret 0xc
test eax, eax
jge 0x40446f
mov dword [esi + 0x10], 0
pop edi
mov al, 1
pop esi
ret 0xc
dec eax
mov dword [esi + 0x10], eax
jne 0x404489
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
xor al, al
pop esi
ret 0xc
test eax, eax
jge 0x404494
mov dword [esi + 0x10], 0
pop edi
xor al, al
pop esi
ret 0xc
Function at 0x4048f0
Capabilities:
Open clipboard

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ax, word [ebp]
cmp ax, 0x20
push esi
push edi
mov esi, ecx
jae 0x404910
movzx eax, ax
lea eax, [eax + eax*2]
mov edi, dword [esi + eax*4 + 0x14]
jmp 0x404913
or edi, 0xffffffff
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x404931
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x404935
mov dword [esi + 0x10], 1
jmp 0x404935
inc eax
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test eax, eax
jle 0x4049c4
cmp edi, 0xffffffff
je 0x4049c4
push edi
mov dword [esi + 0xc], 0
call dword [0x462cc8]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
mov dword [esi + 8], edi
je 0x4049a3
mov ax, word [ebp]
cmp ax, 0x20
jae 0x404980
movzx ecx, ax
lea edx, [ecx + ecx*2]
xor ecx, ecx
mov cx, word [esi + edx*4 + 0x1c]
cmp cx, 0xffff
jne 0x404982
mov ecx, eax
cmp cx, ax
je 0x4049a3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
test eax, eax
je 0x40499c
push edi
call ebx
mov dword [esi + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi + 8]
test eax, eax
je 0x4049c4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
mov edx, dword [esi + 8]
push edx
call ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x404d20
Capabilities:
Open clipboard

Disassembly:
sub esp, 0x228
mov eax, dword [0x461d34]
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
cmp word [eax], 4
push esi
mov esi, ecx
mov dword [esp + 8], esi
jne 0x404e76
mov eax, dword [esi + 0x10]
test eax, eax
mov dword [esp + 4], 0
jne 0x404d70
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x404d74
mov dword [esi + 0x10], 1
jmp 0x404d74
inc eax
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test eax, eax
jle 0x404e28
push ebx
push 0xf
call dword [0x462cc8]
mov ebx, eax
test ebx, ebx
je 0x404e27
push ebp
mov ebp, dword [0x462c98]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
test edi, edi
je 0x404e25
push 0
lea ecx, [esp + 0x1c]
call fcn.004046c0
xor esi, esi
test edi, edi
jbe 0x404dea
lea ebx, [ebx]
push 0x104
lea edx, [esp + 0x30]
push edx
push esi
push ebx
mov word [esp + 0x3c], 0
call ebp
push 0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
call fcn.00404bb0
inc esi
cmp esi, edi
jb 0x404dc0
push 0
push 0
call fcn.00434860
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
add esp, 8
push 0
push ecx
lea ecx, [edx + edx]
mov edx, dword [esp + 0x20]
push ecx
push edx
mov ecx, eax
mov dword [esp + 0x20], eax
call fcn.004045c0
mov eax, dword [esp + 0x23c]
mov esi, dword [esp + 0x14]
mov word [eax], 0x1a
pop edi
pop ebp
pop ebx
mov eax, dword [esi + 0x10]
dec eax
mov dword [esi + 0x10], eax
jne 0x404e51
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 4]
pop esi
mov ecx, dword [esp + 0x224]
call fcn.00447d46
add esp, 0x228
ret 4
test eax, eax
jge 0x404e5c
mov dword [esi + 0x10], 0
mov eax, dword [esp + 4]
pop esi
mov ecx, dword [esp + 0x224]
call fcn.00447d46
add esp, 0x228
ret 4
mov ecx, dword [esp + 0x228]
xor eax, eax
pop esi
call fcn.00447d46
add esp, 0x228
ret 4
Function at 0x406130
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x48
mov dx, word [0x475078]
push esi
mov esi, ecx
mov cl, byte [0x475088]
mov byte [esp + 4], cl
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
xor eax, eax
mov dword [esp + 5], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 9], eax
mov dword [esp + 0x3c], ecx
mov word [esp + 6], dx
mov dword [esp + 0x40], ecx
mov byte [esp + 0xd], al
mov ax, word [0x47507c]
lea edx, [esp + 0x2c]
mov dword [esp + 0x44], ecx
push edx
mov word [esp + 0xc], ax
mov dword [esp + 0x30], 0
mov dword [esp + 0x4c], ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x48]
shr ecx, 0xa
mov eax, 0xcccccccd
mul ecx
mov al, byte [esi + 0x16]
movzx cx, byte [esi + 0x17]
shr edx, 2
mov dword [esp + 0xa], edx
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov byte [esp + 0x10], al
mov eax, dword [esi + 0x10]
mov dword [esp + 0x28], edx
mov dx, word [esi + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [0x475090]
test eax, eax
mov word [esp + 0x14], cx
lea ecx, [esp + 4]
mov byte [esp + 0x11], 1
mov word [esp + 0x12], dx
mov dword [esp + 0x1c], ecx
mov word [esp + 0x16], 0xa
je 0x40621d
mov edx, dword [0x47508c]
mov dword [esp + 0x20], eax
lea eax, [edx*4]
mov word [esp + 0x18], ax
mov esi, dword [esi + 8]
mov ecx, dword [esi]
test ecx, ecx
pop esi
je 0x40623f
mov eax, dword [ecx + 0x88]
test eax, eax
je 0x40623f
lea edx, [esp + 0xc]
push edx
call fcn.00413040
add esp, 0x48
ret
xor al, al
add esp, 0x48
ret

Function at 0x409c00
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x468808]
cmp eax, 1
je 0x409c55
cmp eax, 2
jne 0x409c18
cmp dword [0x4687fc], 4
je 0x409c55
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
cmp word [esp + 0xc], 0
je 0x409c3e
test ah, ah
js 0x409c42
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
pop esi
ret
test ah, ah
jns 0x409c53
push 0
mov eax, 2
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_keybd_event]
pop esi
ret
mov ax, word [esp + 8]
cmp ax, word [esp + 0xc]
je 0x409c54
mov edx, dword [esp + 4]
xor ecx, ecx
test ax, ax
setne cl
push 0
dec ecx
and ecx, 2
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_keybd_event]
ret
Function at 0x4118f0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
lea edi, [esi + 0xd0]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x3c]
test eax, eax
lea ebx, [esi + 0x3c]
je 0x411945
mov eax, dword [esi + 0x2c]
test eax, eax
lea ebp, [esi + 0x2c]
push edi
jne 0x411927
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4e20
push 1
push ebp
push ebx
call fcn.00425ff0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x411400
push 0
mov dword [esi + 0x2c], 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx], eax
cmp dword [ebx], 0
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret

Function at 0x411dc0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
lea edi, [esi + 0xd0]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x38]
test eax, eax
je 0x411de6
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov al, 1
pop esi
pop ecx
ret
push ebx
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x411a90
push 0
mov dword [esi + 0x24], 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x38]
test ecx, ecx
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x411ed0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
lea edi, [esi + 0xd0]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x40]
test eax, eax
lea ebx, [esi + 0x40]
je 0x411f25
mov eax, dword [esi + 0x30]
test eax, eax
lea ebp, [esi + 0x30]
push edi
jne 0x411f07
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x2710
push 1
push ebp
push ebx
call fcn.00425ff0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x411e20
push 0
mov dword [esi + 0x30], 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx], eax
cmp dword [ebx], 0
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret