joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a9c0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x41a9d8
mov esi, 8
push 2
call edi
test ax, ax
jge 0x41a9e4
or esi, 1
push 1
call edi
test ax, ax
jge 0x41a9f0
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x41a9fc
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x41aa08
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret

Function at 0x41b500
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, eax
lea edi, [esi + 0xd0]
mov eax, edi
xor ebp, ebp
call fcn.0041ec70
test eax, eax
jle 0x41b55d
mov edi, edi
mov edx, ebp
mov eax, edi
mov byte [esp + 0x17], 0
call fcn.00420430
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x17]
push ecx
mov ecx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push ebx
push ecx
mov ecx, eax
call edx
cmp byte [esp + 0x17], 0
jne 0x41b6b6
mov eax, edi
inc ebp
call fcn.0041ec70
cmp ebp, eax
jl 0x41b520
mov eax, dword [esp + 0x40]
sub eax, 0x100
je 0x41b64e
sub eax, 4
je 0x41b5db
sub eax, 2
jne 0x41b642
xor ecx, ecx
push ebx
mov word [esp + 0x44], ax
mov word [esp + 0x46], cx
call fcn.004595ea
mov ecx, dword [esi + 0x50]
add esp, 4
mov word [esp + 0x40], ax
mov edx, dword [ecx]
mov edx, dword [edx + 0xfc]
push 0x8000000a
lea eax, [esp + 0x44]
push eax
push 0x41e6e0
call edx
mov esi, eax
test esi, esi
je 0x41b642
mov eax, dword [esi]
mov edx, dword [eax + 0xf0]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
cmp dword [esi + 0x54], 0
je 0x41b642
mov ecx, dword [esi + 0x68]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x64]
mov dword [esp + 0x18], 6
mov word [esp + 0x2c], bx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call fcn.0041a9c0
mov word [esp + 0x2e], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esi + 0x54]
mov dword [esp + 0x20], eax
mov edx, dword [esi]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call edx
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
cmp ebx, 9
jne 0x41b642
cmp dword [esi + 0x54], 0
je 0x41b6a3
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc8]
call edx
test al, al
je 0x41b6a3
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd4]
call edx
test al, al
je 0x41b6a3
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push str.RichEditUI
call edx
push eax
call fcn.00456f49
add esp, 8
test eax, eax
je 0x41b6a3
mov eax, dword [esi + 0x54]
call fcn.004298e0
test al, al
jne 0x41b642
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge bl
call fcn.0041d680
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x2c
ret 8
Function at 0x41d1a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov edi, dword [ebp + 8]
cmp eax, ecx
je 0x41d1c9
cmp edi, dword [esi + 0x54]
je 0x41d1c9
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x54]
cmp edi, eax
je 0x41d2c8
test eax, eax
je 0x41d239
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 0x15
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 0x10]
push edx
call eax
mov edi, dword [esi + 0x54]
push 0
push 0
mov ebx, str.killfocus
call fcn.0041d8f0
mov edi, dword [ebp + 8]
mov dword [esi + 0x54], 0
test edi, edi
je 0x41d2c8
mov edx, dword [edi]
mov eax, dword [edx + 0x1c]
mov ecx, edi
call eax
cmp eax, esi
jne 0x41d2c8
mov edx, dword [edi]
mov eax, dword [edx + 0xc8]
mov ecx, edi
call eax
test al, al
je 0x41d2c8
mov edx, dword [edi]
mov eax, dword [edx + 0xd4]
mov ecx, edi
call eax
test al, al
je 0x41d2c8
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x54], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 0x16
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x18], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x10]
push eax
call edx
mov edi, dword [esi + 0x54]
push 0
push 0
mov ebx, str.setfocus
call fcn.0041d8f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x423d10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x423d17
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x423df4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x472520]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x472520]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x472520]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x472520]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x472520]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x472520]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x472520]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x472520]
inc ecx
sub edx, 8
sub esi, 1
jne 0x423d30
pop edi
test edx, edx
je 0x423e1b
jmp 0x423e00
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x472520]
inc ecx
sub edx, 1
jne 0x423e00
not eax
pop esi
ret

Function at 0x424710
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x424742
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x424738
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x424755
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
push esi
add eax, ecx
push eax
push edx
call fcn.0045aa90
add dword [edi + 0x18], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret

Function at 0x4255a0
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [esi], 0
push ebp
mov ebp, dword [esp + 0xc]
push edi
jne 0x425633
cmp dword [esi + 4], 0xffffffff
jne 0x425633
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4255d0
mov eax, dword [0x4729c8]
mov dword [edi], eax
cmp ebx, 1
jne 0x4255fe
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebx
je 0x4255fe
mov eax, 0x2000000
pop edi
pop ebp
pop ecx
ret 8
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push edx
push ebp
mov edi, ebx
call fcn.004244c0
add esp, 0xc
test eax, eax
jne 0x425621
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ecx
ret 8
call fcn.00424a30
mov dword [esi], eax
mov eax, dword [0x489ce4]
pop edi
pop ebp
pop ecx
ret 8
pop edi
mov eax, 0x1000000
pop ebp
pop ecx
ret 8
Function at 0x43e320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x43e341
cmp eax, edi
jge 0x43e339
call fcn.0043dc10
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor eax, eax
cmp dword [esi + 8], eax
jle 0x43e36a
lea ecx, [eax - 8]
jmp 0x43e350
mov dl, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], ecx
mov byte [esp + eax + 0xc], dl
inc eax
cmp dword [esi + 8], 0
jg 0x43e350
cmp eax, 4
jge 0x43e38a
mov edi, dword [esi + 4]
mov edx, dword [esi]
nop
cmp edx, edi
jb 0x43e378
xor ecx, ecx
jmp 0x43e37e
mov cl, byte [edx]
inc edx
movzx ecx, cl
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 4
jl 0x43e370
mov dword [esi], edx
mov eax, dword [esp + 0xc]
movzx ecx, byte [esp + 0xf]
movzx edx, byte [esp + 0xe]
movzx ebx, ah
movzx eax, al
shl ebx, 8
add ebx, eax
shl ecx, 8
mov eax, ebx
add ecx, edx
xor eax, 0xffff
cmp ecx, eax
je 0x43e3c3
pop edi
pop esi
mov eax, str.zlib_corrupt
pop ebx
add esp, 4
jmp fcn.0043b0d0
mov ecx, dword [esi]
add ecx, ebx
cmp ecx, dword [esi + 4]
jbe 0x43e3dc
pop edi
pop esi
mov eax, str.read_past_buffer
pop ebx
add esp, 4
jmp fcn.0043b0d0
mov edx, dword [esi + 0x10]
add edx, ebx
cmp edx, dword [esi + 0x18]
jbe 0x43e3f8
mov ecx, ebx
mov edi, esi
call fcn.0043dc50
test eax, eax
jne 0x43e3f8
pop edi
pop esi
pop ebx
pop ecx
ret
mov edi, dword [esi]
push ebp
mov ebp, dword [esi + 0x10]
push ebx
push edi
push ebp
call fcn.0045aa90
add esp, 0xc
add edi, ebx
add ebp, ebx
mov dword [esi + 0x10], ebp
pop ebp
mov dword [esi], edi
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4449b0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x98
push esi
lea eax, [esp + 4]
push eax
mov eax, edi
mov dword [edi + 0x10], ebx
call fcn.00444b70
mov ecx, dword [edi + 0x10]
mov eax, ecx
mov edx, 0x40000080
call fcn.00445460
test al, al
je 0x4449de
mov edx, 0x400000a0
mov esi, dword [esp + 4]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x18]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x1c]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x20]
push 0
push edx
mov edx, dword [ecx]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x1c]
call eax
call fcn.0041b310
push eax
push edi
call fcn.0041ec80
mov ecx, dword [edi + 0x10]
mov eax, ecx
call fcn.00435040
mov esi, eax
cmp esi, 0xffffffff
je 0x444a39
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov edx, esi
mov esi, eax
call fcn.0041e0b0
test eax, eax
jne 0x444a4a
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
call fcn.0041dc10
mov eax, dword [eax]
mov ecx, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push ecx
call esi
mov eax, dword [edi + 0x10]
push 0
call fcn.004453a0
mov edx, dword [edi + 4]
push eax
push 0xc5
push edx
call esi
mov ecx, dword [edi + 0x10]
mov eax, ecx
call fcn.00445460
test al, al
je 0x444a97
push 0
mov eax, ecx
call fcn.00445470
mov ecx, dword [edi + 4]
movzx eax, ax
push eax
push 0xcc
push ecx
call esi
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x14]
push eax
call edx
call fcn.0041b310
push eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [esp + 0x14]
call fcn.0040dad0
mov ecx, dword [edi + 4]
push 0
push 0
push 0xb9
push ecx
call esi
mov eax, 3
mov ecx, 0xd3
mov edx, edi
call fcn.0041f2e0
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd4]
call eax
mov edx, dword [edi + 4]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [edi + 0x10]
push 0
call fcn.004453f0
mov edx, dword [edi + 4]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push 0xcf
push edx
call esi
mov eax, dword [edi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
mov eax, ebx
call fcn.00445430
or eax, ecx
push eax
push 0xfffffffffffffff0
mov eax, edi
call fcn.0041ec70
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [edi + 4]
push 4
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
pop esi
add esp, 0x98
ret
Function at 0x444e30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4860f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
push edi
je 0x444ea4
cmp dword [esi + 0x10], 0
je 0x444ea4
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.0045af60
mov ebx, esp
test ebx, ebx
je 0x444ea4
mov ecx, dword [esi + 4]
push edi
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
add ecx, 0x1b8
mov eax, ebx
call fcn.00420720
mov esi, dword [esi + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
push 0
push 0
mov ecx, esi
call eax
mov edi, esi
mov ebx, 0x470910
mov esi, eax
call fcn.0041d8f0
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004567fb
mov esp, ebp
pop ebp
ret

Function at 0x444ec0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x46b082
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x4860f0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
mov eax, esi
call fcn.00434de0
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov eax, 0x25cf
lea ecx, [esi + 0x5b8]
mov dword [esi], vtable.DuiLib::CEditUI.0
mov dword [esi + 0x5a8], ebx
mov dword [esi + 0x5ac], 0xff
mov byte [esi + 0x5b0], bl
mov byte [esi + 0x5b1], bl
mov word [esi + 0x5b2], ax
mov dword [esi + 0x5b4], ebx
call fcn.00420440
lea ecx, [esi + 0x63c]
call fcn.00420440
lea ecx, [esi + 0x6c0]
call fcn.00420440
lea ecx, [esi + 0x744]
call fcn.00420440
mov ecx, 4
push 3
mov byte [esp + 0x30], cl
push ecx
lea edx, [ebx + 3]
lea eax, [esp + 0x18]
mov dword [esi + 0x7c8], 0xffffffff
mov dword [esi + 0x7cc], ebx
call fcn.00420100
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov eax, esi
call fcn.00435080
or eax, 0xffffffff
mov ecx, esi
call fcn.00426260
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 4
Function at 0x451ed0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x98
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x10], eax
mov dword [eax + 0x5b8], 0
cmp dword [edi + 4], 0
push esi
jne 0x451f63
lea esi, [esp + 0xc]
mov eax, edi
call fcn.00451fd0
mov edx, dword [esp + 0xc]
mov ecx, dword [edi + 0x10]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
push 0
push 0x40000000
call edx
call fcn.0041b310
push eax
push edi
call fcn.0041ec80
mov ecx, dword [edi + 0x10]
mov eax, ecx
call fcn.00435040
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
mov edx, esi
mov esi, eax
call fcn.0041e1e0
mov eax, dword [eax]
mov ecx, dword [edi + 4]
push 1
push eax
push 0x30
push ecx
call ebp
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x1c]
push eax
call edx
call fcn.004206b0
lea ecx, [esp + 0x1c]
mov bl, al
call fcn.0040dad0
test bl, bl
je 0x451f95
mov eax, dword [edi + 0x10]
add eax, 0x5a8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 4]
add ecx, 0x5a8
push ecx
push 0
push 0x1002
push edx
call ebp
mov eax, dword [edi + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
pop ebp
mov byte [edi + 0x18], 1
pop ebx
add esp, 0x98
ret
Function at 0x4567fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4860f0]
jne 0x456805
repz ret
jmp fcn.0045af8d

Function at 0x464f89
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045b295
and dword [ebp - 4], 0
cmp dword [0x489aa8], 0
mov ebx, eax
jne 0x46503a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4650eb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x470498
push edi
call esi
test eax, eax
je 0x4650eb
push eax
call fcn.0045b223
mov dword [esp], 0x470488
push edi
mov dword [0x489aa8], eax
call esi
push eax
call fcn.0045b223
mov dword [esp], 0x470474
push edi
mov dword [0x489aac], eax
call esi
push eax
call fcn.0045b223
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x489ab0], eax
call esi
push eax
call fcn.0045b223
pop ecx
mov dword [0x489ab8], eax
test eax, eax
je 0x46503a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045b223
pop ecx
mov dword [0x489ab4], eax
mov eax, dword [0x489ab4]
cmp eax, ebx
je 0x465092
cmp dword [0x489ab8], ebx
je 0x465092
push eax
call fcn.0045b29e
push dword [0x489ab8]
mov esi, eax
call fcn.0045b29e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x465092
test edi, edi
je 0x465092
call esi
test eax, eax
je 0x465089
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x465089
test byte [ebp - 0xc], 1
jne 0x465092
or dword [ebp + 0x10], 0x200000
jmp 0x4650cb
mov eax, dword [0x489aac]
cmp eax, ebx
je 0x4650cb
push eax
call fcn.0045b29e
pop ecx
test eax, eax
je 0x4650cb
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4650cb
mov eax, dword [0x489ab0]
cmp eax, ebx
je 0x4650cb
push eax
call fcn.0045b29e
pop ecx
test eax, eax
je 0x4650cb
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x489aa8]
call fcn.0045b29e
pop ecx
test eax, eax
je 0x4650eb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4650ed
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4059ec
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0043681c
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0043681c
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x405a68
mov eax, dword [0x4dbae8]
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 1
call fcn.0043682e
cmp dword [ebp - 0x18], esp
je 0x405a94
push 6
call fcn.00436828
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x1b
call fcn.0043682e
cmp dword [ebp - 0x18], esp
je 0x405ac2
push 6
call fcn.00436828
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push 0
mov eax, 0x1c
call fcn.0043682e
cmp dword [ebp - 0x18], esp
je 0x405aee
push 6
call fcn.00436828
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x1d
call fcn.0043682e
cmp dword [ebp - 0x18], esp
je 0x405b7d
push 6
call fcn.00436828
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 2
call fcn.0043682e
cmp dword [ebp - 0x18], esp
je 0x405ba2
push 6
call fcn.00436828
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x405baa
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00436822
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00436822
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x442110
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4aeb5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049f30f
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x442192
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049cd8d
mov eax, dword [eax]
push 0x4cd214
push eax
call fcn.0048fa44
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049f59a
test bl, bl
je 0x442192
push 0x4cd214
lea ecx, [esp + 0xc]
call fcn.0049f976
push 0x4d0d8c
lea ecx, [esp + 0xc]
call fcn.0049f976
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4421ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049f59a
jmp 0x442299
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x442252
lea edx, [esp + 0x7c]
push 0x4d0d88
push edx
call fcn.0048fa44
add esp, 8
test eax, eax
je 0x442252
lea eax, [esp + 0x7c]
push 0x4d0d84
push eax
call fcn.0048fa44
add esp, 8
test eax, eax
je 0x442252
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4421e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049f59a
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x442a90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x442af2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc