joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
cmp ecx, 0xa1
jl 0x44c124
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
cmp eax, 0xf9
jle 0x44c140
mov ecx, 0xa1
mov edx, dword [ebp + 8]
mov word [edx], cx
mov eax, 0xa1
mov ecx, dword [ebp + 8]
mov word [ecx + 2], ax
jmp 0x44c254
mov edx, dword [ebp + 0xc]
movzx eax, word [edx + 2]
cmp eax, 0x40
jl 0x44c167
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 2]
cmp edx, 0x7f
jle 0x44c183
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 2]
cmp ecx, 0xa0
jge 0x44c183
mov edx, 0xa1
mov eax, dword [ebp + 8]
mov word [eax], dx
mov ecx, 0xa1
mov edx, dword [ebp + 8]
mov word [edx + 2], cx
jmp 0x44c254
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
sub eax, 0xa1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 2]
sub edx, 0x40
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 2]
cmp ecx, 0xa0
jl 0x44c1c6
mov edx, dword [ebp - 0x14]
sub edx, 0x20
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
shr eax, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
shl ecx, 4
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x2b4
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x44
mov edx, dword [ebp - 8]
lea eax, [edx + ecx + 0xc]
mov ecx, dword [ebp - 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov ax, word [eax + ecx*2]
mov word [edx], ax
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x44
mov edx, dword [ebp - 8]
lea eax, [edx + ecx + 0xc]
mov ecx, dword [ebp - 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov ax, word [eax + ecx*2 + 2]
mov word [edx + 2], ax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call fcn.0044ce60
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x3f
jne 0x44c254
mov edx, 0xa1
mov eax, dword [ebp + 8]
mov word [eax], dx
mov ecx, 0xa1
mov edx, dword [ebp + 8]
mov word [edx + 2], cx
mov esp, ebp
pop ebp
ret 8
Function at 0x44c530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
cmp ecx, 0xa1
jl 0x44c554
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
cmp eax, 0xff
jne 0x44c570
mov ecx, 0xa1
mov edx, dword [ebp + 8]
mov word [edx], cx
mov eax, 0x40
mov ecx, dword [ebp + 8]
mov word [ecx + 2], ax
jmp 0x44c657
mov edx, dword [ebp + 0xc]
movzx eax, word [edx + 2]
cmp eax, 0xa0
jge 0x44c59a
mov ecx, 0xa1
mov edx, dword [ebp + 8]
mov word [edx], cx
mov eax, 0x40
mov ecx, dword [ebp + 8]
mov word [ecx + 2], ax
jmp 0x44c657
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx]
sub edx, 0xa1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 2]
sub ecx, 0xa0
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
shr edx, 4
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shl eax, 4
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
imul edx, edx, 0x1a4
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x44
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 0xc]
mov eax, dword [ebp - 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dx, word [edx + eax*2]
mov word [ecx], dx
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x44
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 0xc]
mov eax, dword [ebp - 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dx, word [edx + eax*2 + 2]
mov word [ecx + 2], dx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call fcn.0044ce60
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x3f
jne 0x44c657
mov ecx, 0xa2
mov edx, dword [ebp + 8]
mov word [edx], cx
mov eax, 0xa4
mov ecx, dword [ebp + 8]
mov word [ecx + 2], ax
mov esp, ebp
pop ebp
ret 8
Function at 0x44c960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x44c97d
mov eax, dword [0x57a1c0]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
jmp 0x44c98d
mov ecx, dword [0x57a1b8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0
jge 0x44c9a2
mov edx, dword [ebp + 8]
push edx
call fcn.00504c07
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
jmp 0x44c9bb
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jge 0x44ca99
mov edx, dword [ebp + 8]
movzx eax, word [edx]
test eax, eax
jne 0x44c9e2
cmp dword [ebp + 0x10], 0
je 0x44c9dd
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
jmp 0x44ca99
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x7f
jge 0x44ca1a
cmp dword [ebp + 0x10], 0
je 0x44ca06
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 2
mov dword [ebp + 8], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x44ca94
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
push ecx
call fcn.0044c8d0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x44ca4d
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x44ca8b
cmp dword [ebp + 0x10], 0
je 0x44ca82
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 2
mov dword [ebp + 8], eax
jmp 0x44c9b2
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x44caa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x44cabd
mov eax, dword [0x57a1bc]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
jmp 0x44cacd
mov ecx, dword [0x57a1b4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
jge 0x44cada
mov dword [ebp + 0xc], 0x10000
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jge 0x44cc4b
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x44cb0b
xor edx, edx
mov eax, dword [ebp + 0x10]
mov word [eax], dx
jmp 0x44cc4b
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp edx, 0x7f
jg 0x44cb31
mov eax, dword [ebp + 8]
movsx cx, byte [eax]
mov edx, dword [ebp + 0x10]
mov word [edx], cx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x44cc2b
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp edx, 0xa0
jl 0x44cb7b
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
cmp ecx, 0xdf
jg 0x44cb7b
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
sub eax, 0xa0
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov cx, word [eax + ecx*2]
mov word [edx], cx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x44cc2b
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
cmp ecx, 0x81
jl 0x44cbc4
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
cmp eax, 0x9f
jg 0x44cbc4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0044c7c0
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0xc], eax
jmp 0x44cc2b
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp edx, 0xe0
jl 0x44cc0e
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
cmp ecx, 0xfc
jg 0x44cc0e
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044c7c0
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov word [edx], ax
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0xc], ecx
jmp 0x44cc2b
mov edx, 0x3f
mov eax, dword [ebp + 0x10]
mov word [eax], dx
mov ecx, dword [ebp + 0x10]
add ecx, 2
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0xc]
add edx, 2
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
add ecx, 2
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x44cae8
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x44d650
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], ecx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x53f144
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0x20
ja 0x44d7a5
lea edx, [ebp - 0x418]
push edx
push 0x53f150
push Ordinal_3
mov ecx, dword [ebp - 0x424]
call fcn.0044d7c0
test eax, eax
jne 0x44d7a5
push str._shellopencommand
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x418]
push edx
push Ordinal_3
mov ecx, dword [ebp - 0x424]
call fcn.0044d7c0
test eax, eax
jne 0x44d7a5
push str.__1_
lea eax, [ebp - 0x418]
push eax
call fcn.0044da20
add esp, 8
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x44d760
push 0x53f190
lea ecx, [ebp - 0x418]
push ecx
call fcn.0044da20
add esp, 8
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x44d753
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x41a]
mov dword [ebp - 0x420], eax
jmp 0x44d75e
xor ecx, ecx
mov edx, dword [ebp - 0x420]
mov word [edx], cx
jmp 0x44d76b
xor eax, eax
mov ecx, dword [ebp - 0x420]
mov word [ecx], ax
push 0x53f198
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret 8

Function at 0x44d7c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x21c], ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44d831
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44fd40
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529b74
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 0x30], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x18], 0
je 0x44fda2
mov eax, dword [ebp + 0x18]
movzx ecx, word [eax]
test ecx, ecx
je 0x44fda2
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
push 0x53ff08
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x44ff26
lea ecx, [ebp - 0x244]
call fcn.00401b80
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 1
cmp dword [ebp + 8], 0
jne 0x44fdca
mov dword [ebp - 0x20], reloc.TranslateMemoryCJ.dll_Ordinal_1
jmp 0x44fdd1
mov dword [ebp - 0x20], reloc.TranslateMemoryCJ.dll_Ordinal_2
push 0x53ff28
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0x20019
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x23c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x44fe38
mov dword [ebp - 0x248], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.004d61e0
mov eax, dword [ebp - 0x248]
jmp 0x44ff26
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
add edx, 1
push edx
call fcn.004d7c35
add esp, 4
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x240], eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x240]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x44fea1
mov dword [ebp - 0x24], 0
push 0x53ff80
mov eax, dword [ebp + 0x10]
push eax
call fcn.00504ae3
add esp, 8
jmp 0x44fee0
mov ecx, dword [ebp - 0x240]
add ecx, dword [ebp - 0x2c]
mov byte [ecx], 0
mov edx, dword [ebp - 0x240]
push edx
push 0x53ff84
lea eax, [ebp - 0x244]
push eax
call fcn.004024e0
add esp, 0xc
lea ecx, [ebp - 0x244]
call fcn.004d6200
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00504ae3
add esp, 8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x250]
push ecx
call fcn.004d7c40
add esp, 4
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x254], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.004d61e0
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret
Function at 0x44ff40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x22c], ecx
cmp dword [ebp + 0x10], 0
je 0x44ff8a
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax]
test ecx, ecx
je 0x44ff8a
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x53ff8c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x450045
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], reloc.TranslateMemoryCJ.dll_Ordinal_1
push str.SoftwareKODENSHAjBeijing7TranslateMemory
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x450001
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x450001
xor eax, eax
jmp 0x450045
mov edx, dword [ebp + 0xc]
push edx
call fcn.00504c07
add esp, 4
lea eax, [eax + eax + 2]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x450038
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret 0xc
Function at 0x458640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005073f9
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x458670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005070d7
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x45aa70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.004f064b
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0x100
jne 0x45aabc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0xf0000000
je 0x45aabc
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 9
jne 0x45aabc
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
call fcn.00462b30
mov ecx, dword [ebp + 8]
push ecx
call fcn.004c76b0
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x463380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x11c], ecx
xor eax, eax
mov word [0x57a738], ax
xor ecx, ecx
mov word [0x57a940], cx
lea edx, [ebp - 0x114]
push edx
push 0x20019
push 0
push 0x544848
push reloc.TranslateMemoryCJ.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x463477
mov dword [ebp - 0x118], 0x104
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push str.DLLPATHCJ
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x463418
lea ecx, [ebp - 0x110]
push ecx
push 0x57a738
call fcn.00504ae3
add esp, 8
mov dword [ebp - 0x118], 0x104
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push str.DLLPATHJC
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x463460
lea eax, [ebp - 0x110]
push eax
push 0x57a940
call fcn.00504ae3
add esp, 8
mov dword [ebp - 0x118], 0x104
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx edx, word [0x57a738]
test edx, edx
jne 0x463494
push 0x5448d4
push 0x57a738
call fcn.00504ae3
add esp, 8
movzx eax, word [0x57a940]
test eax, eax
jne 0x4634b1
push 0x5448e8
push 0x57a940
call fcn.00504ae3
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret
Function at 0x4656d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x20019
push 0
push 0x546210
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x465742
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x465742
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x14]
jmp 0x46574f
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x465760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52ac85
mov eax, dword fs:[0]
push eax
mov eax, 0x2020
call fcn.00509530
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x202c], 0
lea ecx, [ebp - 0x201c]
call fcn.00401b80
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x2018], 0x2000
lea eax, [ebp - 0x2020]
push eax
lea ecx, [ebp - 0x2024]
push ecx
push 0
push 0x20019
push 0
push 0x546214
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x465876
lea ecx, [ebp - 0x2018]
push ecx
lea edx, [ebp - 0x2014]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x2024]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2028], eax
cmp dword [ebp - 0x2028], 0
je 0x465876
mov eax, dword [ebp - 0x2024]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x54275b
lea ecx, [ebp - 0x201c]
call fcn.00401c60
lea ecx, [ebp - 0x201c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00413800
mov edx, dword [ebp - 0x202c]
or edx, 1
mov dword [ebp - 0x202c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x201c]
call fcn.004d61e0
mov eax, dword [ebp + 8]
jmp 0x4658c8
mov eax, dword [ebp - 0x2024]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2014]
push ecx
lea ecx, [ebp - 0x201c]
call fcn.00402b30
lea edx, [ebp - 0x201c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00413800
mov eax, dword [ebp - 0x202c]
or eax, 1
mov dword [ebp - 0x202c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x201c]
call fcn.004d61e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret
Function at 0x4658f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0x546218
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x46593b
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x465950
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0x54621c
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4659a9
mov ecx, dword [ebp + 0x14]
call fcn.00401c40
shl eax, 1
push eax
mov ecx, dword [ebp + 0x14]
call fcn.004d6200
push eax
push 1
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret