joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x410e83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x413718
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.004103d6
mov dword [ebx], 0x413704
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.004103d6
or eax, 0xffffffff
push 0x418a00
mov dword [ebx], 0x4136c8
push edi
mov dword [esi], 0x4136dc
mov dword [esi + 0x4c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0xc0c0c0
mov dword [esi + 0x34], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x50], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4037b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4110eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4137b0
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x403840
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x403807
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x403831
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x403846
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x403846
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x413748
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x413734
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CDC::CDC
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x404d50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x411350
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], 0x413770
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x44]
mov dword [esp + 0x30], edi
push eax
push edi
push edi
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_2
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
cmp eax, edi
je 0x404dbd
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
lea edx, [esp + 0x20]
mov ecx, esi
lea eax, [ebp + 2]
push eax
push edi
push edx
call sub.MFC42.DLL_CDC::MoveTo
mov edx, dword [esp + 0x10]
mov ebx, ebp
sub ebx, edx
mov ecx, esi
lea eax, [ebx + 5]
push eax
push edi
mov dword [esp + 0x40], eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebp + 3]
lea ecx, [edi + 1]
push eax
lea eax, [esp + 0x24]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [ebx + 6]
mov ecx, esi
mov dword [esp + 0x44], eax
push eax
lea eax, [edi + 1]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea ecx, [ebp + 4]
lea eax, [edi + 2]
push ecx
lea edx, [esp + 0x24]
push eax
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [ebx + 7]
mov ecx, esi
push eax
lea eax, [edi + 2]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebp + 3]
lea ecx, [edi + 3]
push eax
push ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
mov edx, dword [esp + 0x44]
lea eax, [edi + 3]
push edx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebp + 2]
lea ecx, [edi + 4]
push eax
lea eax, [esp + 0x24]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
mov ecx, dword [esp + 0x38]
lea eax, [edi + 4]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
lea edx, [ebp + 1]
lea eax, [edi + 5]
push edx
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea ecx, [ebx + 4]
lea eax, [edi + 5]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
add edi, 6
push ebp
lea edx, [esp + 0x24]
push edi
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
add ebx, 3
mov ecx, esi
push ebx
push edi
call sub.MFC42.DLL_CDC::LineTo
mov eax, dword [esp + 0x14]
mov ecx, esi
push eax
call sub.MFC42.DLL_CDC::SelectObject_2
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x18], 0x413748
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x14
Function at 0x405f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4114f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, esi
mov ebp, ecx
push edi
xor edi, edi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0x413784
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], edi
call fcn.00401500
test eax, eax
je 0x405fde
push 0xf
jmp 0x405fe0
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x40], edi
jne 0x406001
push 0x3fe33333
push 0x33333333
push eax
call fcn.00402400
add esp, 0xc
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::Attach
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
call fcn.004014f0
test eax, eax
je 0x406059
mov eax, dword [edi + 4]
push 0xf
lea edx, [esp + 0x1c]
push 2
push edx
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x40607f
push 0
push 7
call ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, 4
push eax
add edx, 4
push ecx
push edx
push edi
mov ecx, ebp
call fcn.00404d50
jmp 0x406099
push 7
call ebx
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
add ecx, 5
add eax, 4
push eax
push ecx
push edi
mov ecx, ebp
call fcn.00404c30
mov dword [esp + 0x10], 0x413748
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x4066f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
and esi, 0xffff
push 2
push esi
call sub.MFC42.DLL_AfxFindResourceHandle
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
push 2
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x40672d
xor ebx, ebx
push 2
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x40672d
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40673e
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x40674e
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call fcn.004066b0
add esp, 4
cmp ax, 0x10
je 0x406764
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push edi
push ebx
call sub.MFC42.DLL_AfxLoadSysColorBitmap
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x406960
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x418a38]
sub esp, 0x134
test eax, eax
jne 0x406a35
lea eax, [esp]
mov dword [0x418a38], 1
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406a35
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406a28
mov ecx, 5
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x406a28
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406a28
mov dword [0x418a34], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [0x418a34]
add esp, 0x134
ret

Function at 0x4077f0
Capabilities:
Create thread

Disassembly:
sub esp, 0x6c
push esi
push edi
mov edi, 0x407720
cmp byte [edi], 0xe9
jne 0x407810
mov eax, 0x407720
mov edi, dword [eax + 1]
add edi, 0x407720
add edi, 5
mov esi, 0x4095a0
cmp byte [esi], 0xe9
jne 0x40782b
mov ecx, 0x4095a0
mov esi, dword [ecx + 1]
add esi, 0x4095a0
add esi, 5
lea edx, [esp + 0x1c]
push edx
call fcn.0040f400
sub esi, edi
add edi, 8
sub esi, 8
lea eax, [esp + 0x20]
push esi
push edi
push eax
call fcn.0040f430
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.0040f520
add esp, 0x18
mov ecx, 4
mov edi, 0x418ab4
lea esi, [esp + 0xc]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
pop edi
pop esi
je 0x407885
lea ecx, [esp]
push ecx
push eax
push eax
push 0x407770
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x6c
ret
Function at 0x407990
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
sub esp, 0x184
add eax, 1
adc ecx, 0
push esi
mov esi, dword [0x418ac8]
push edi
push ecx
push eax
push 0x10000
push esi
call fcn.00407940
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4079cb
pop edi
pop esi
add esp, 0x184
ret
lea edx, [esp + 0x1c]
sub edi, 5
push edx
call fcn.0040f400
mov eax, dword [esp + 0x194]
add esp, 4
test eax, eax
je 0x4079fe
mov eax, dword [0x418b68]
push 8
add eax, 0xc
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.0040f430
add esp, 0xc
lea edx, [esi + 8]
push 8
lea eax, [esp + 0x20]
push edx
push eax
call fcn.0040f430
lea ecx, [esp + 0x28]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0040f520
lea eax, [esp + 0x88]
lea ecx, [esp + 0x20]
push eax
push 0x10
push ecx
call fcn.0040fe80
add esp, 0x20
add esi, 0x10
lea edx, [esp + 8]
sub edi, esi
push edx
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x74]
push eax
push edi
push esi
call fcn.0040fecd
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x184
ret

Function at 0x407c80
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push str.VJCQRDW_YHlfwjvjcqYRlkajrvYFpww_kqS_wvljkYLkq_wk_q_V_qqlkbvYPv_w_Db_kqYUjvq_Uidqcjwh
push eax
mov dword [esp + 8], 0
call fcn.00407cf0
mov edx, dword [eax]
add esp, 8
lea ecx, [esp]
push ecx
push edx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp]
push 1
push 0x418a3c
push 1
push 0
push str.X2X19
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x407cf0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4116df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_2
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], 1
mov al, byte [esi]
test al, al
je 0x407d48
xor al, 5
lea ecx, [esp + 4]
mov byte [esp + 0x20], al
mov eax, dword [esp + 0x20]
push eax
call fcn.00410586
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x407d2c
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x408010
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x34c
lea eax, [esp + 4]
push ebx
push ebp
mov ebp, ecx
push esi
push eax
push 0x10
lea ebx, [ebp + 4]
push ebx
call fcn.0040fe80
mov edx, dword [esp + 0x36c]
mov esi, dword [esp + 0x368]
lea ecx, [esp + 0x1c]
sub edx, esi
push ecx
push edx
push esi
call fcn.0040fecd
mov eax, dword [esi]
add esp, 0x18
cmp eax, 0x487a5a1e
jne 0x40805c
cmp dword [esi + 4], 0xdf1e2c2c
je 0x40806a
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34c
ret 8
lea eax, [esp + 0x128]
push eax
push 0x10
push ebx
call fcn.0040fe80
mov esi, 0x40ec80
add esp, 0xc
cmp byte [esi], 0xe9
jne 0x408098
mov ecx, 0x40ec80
mov esi, dword [ecx + 1]
add esi, 0x40ec80
add esi, 5
push edi
mov edi, 0x40ec90
cmp byte [edi], 0xe9
jne 0x4080b4
mov edx, 0x40ec90
mov edi, dword [edx + 1]
add edi, 0x40ec90
add edi, 5
lea eax, [esp + 0x10]
sub edi, esi
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x12c]
push ecx
push edi
push esi
call fcn.0040fecd
lea edx, [esp + 0x250]
push edx
push 0x10
push ebx
call fcn.0040fe80
mov ecx, dword [0x4170d8]
lea eax, [esp + 0x25c]
push eax
mov eax, dword [0x4170d4]
sub ecx, eax
push ecx
push eax
call fcn.0040fecd
mov ecx, dword [0x4170d8]
mov esi, dword [0x4170d4]
mov edi, dword [ebp]
sub ecx, esi
mov edx, ecx
add esp, 0x24
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret 8

Function at 0x408140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411768
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
call sub.MFC42.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x130]
push 0x104
push eax
mov dword [ebp - 4], 0
push ecx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x130]
push edx
push eax
mov ecx, esi
call fcn.00407f10
lea edi, [esi + 4]
push 0x418ab4
lea ecx, [ebp - 0x130]
push edi
push ecx
mov ecx, esi
call fcn.00407e70
lea edx, [ebp - 0x248]
lea eax, [ebp - 0x2c]
push edx
push 0x10
push eax
call fcn.0040fe80
lea ecx, [ebp - 0x248]
push ecx
push 0x10
push edi
call fcn.0040fecd
add esp, 0x18
lea edx, [ebp + 0x10]
push edx
push 0
push 0
push 0x407890
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, esi
call fcn.00408010
mov esi, eax
mov ecx, 0x46
xor eax, eax
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_AfxTryCleanup
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408270
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
lea edx, [esp + 4]
push eax
push edx
call fcn.00407d80
mov eax, dword [eax]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
lea ecx, [esp + 4]
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
pop ebx
je 0x4082ad
xor eax, eax
pop ecx
ret 0xc
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
push 0x40
push eax
push 3
push 0
push 0x417eec
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4082dd
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0xc
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
inc eax
pop ecx
ret 0xc

Function at 0x408340
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
lea edx, [esp]
push ebx
push eax
push edx
call fcn.00407d80
mov eax, dword [eax]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
lea ecx, [esp + 4]
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
pop ebx
je 0x408381
xor eax, eax
add esp, 8
ret 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
lea eax, [esp + 4]
mov dword [esp + 4], 0x40
push eax
push ecx
push 0
push 0
push 0x417eec
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4083be
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 8
ret 0xc
Function at 0x408450
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x2a0
push ebx
push esi
push edi
mov ebx, ecx
push 0x418ad4
call fcn.004083e0
lea edi, [ebx + 0x14]
mov ecx, 0x10
mov esi, 0x418ad4
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.00408c00
push 0x417c88
call fcn.0040ff6e
add esp, 4
lea ecx, [esp + 0x10]
push 0x417c48
push 0x418ad4
call fcn.0040ff20
lea eax, [esp + 0x24]
push eax
call fcn.0040f400
mov ecx, dword [str.MSNP]
push 4
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.0040f430
lea eax, [esp + 0x34]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0040f520
lea edx, [esp + 0x94]
lea eax, [esp + 0x2c]
push edx
push 0x10
push eax
call fcn.0040fe80
lea ecx, [esp + 0xa0]
push ecx
push 0x3f
push 0x418ad4
call fcn.0040fecd
mov eax, dword [0x418ad4]
add esp, 0x30
cmp eax, 0x1895816a
je 0x40850a
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov eax, dword [0x4170f8]
mov edx, dword [0x418ad8]
cmp eax, 0xffffffff
mov ecx, 0x4170f8
je 0x408532
cmp eax, edx
je 0x408622
mov eax, dword [ecx + 4]
add ecx, 4
cmp eax, 0xffffffff
jne 0x40851f
cmp edx, 0x12eb34
mov dword [0x418b68], 0x418ad4
jne 0x40854e
mov dword [0x418ad8], 0x3fc9cdb0
lea eax, [esp + 0x194]
push eax
push 8
push 0x418ae0
call fcn.0040fe80
mov edx, dword [0x4170d8]
mov eax, dword [0x4170d4]
lea ecx, [esp + 0x1a0]
sub edx, eax
push ecx
push edx
push eax
call fcn.0040fecd
mov ecx, dword [0x418b68]
lea eax, [esp + 0x94]
push eax
add ecx, 0xc
push 8
push ecx
call fcn.0040fe80
mov esi, 0x40ec60
add esp, 0x24
cmp byte [esi], 0xe9
jne 0x4085b5
mov edx, 0x40ec60
mov esi, dword [edx + 1]
add esi, 0x40ec60
add esi, 5
mov eax, 0x40ec70
cmp byte [eax], 0xe9
jne 0x4085cf
mov eax, 0x40ec70
mov eax, dword [eax + 1]
add eax, 0x40ec70
add eax, 5
mov edi, eax
lea ecx, [esp + 0xc]
sub edi, esi
push ecx
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 0x7c]
push edx
push edi
push esi
call fcn.0040fecd
mov eax, dword [0x418b68]
add esp, 0xc
mov ecx, dword [eax + 0x14]
pop edi
mov dword [0x418aa8], ecx
mov edx, dword [eax + 0x18]
mov eax, dword [0x4170dc]
mov dword [0x418aac], edx
pop esi
pop ebx
mov dword [eax], 1
mov eax, 1
add esp, 0x2a0
ret
call fcn.00407b70
lea edx, [esp + 0xc]
push 0x4149f8
push edx
mov dword [esp + 0x14], 1
call sub.MSVCRT.dll__CxxThrowException
nop
nop
Function at 0x408ec0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4117f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4170d4]
push ebx
push esi
mov esi, dword [0x4170d8]
push edi
sub esi, eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
mov edi, eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, esi
mov esi, edi
mov dword [ebx], eax
mov edi, eax
mov eax, ecx
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [str._rIi7ee_r]
mov edx, dword [0x4170ec]
push ecx
push edx
mov ecx, ebx
call fcn.00408140
test eax, eax
je 0x408fb0
mov eax, dword [0x4170e8]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x14
mov dword [eax], 1
call esi
test ax, ax
jge 0x408f5a
push 0x10
call esi
test ax, ax
jl 0x408fb0
mov ecx, ebx
call fcn.004088a0
test eax, eax
jne 0x408fb0
call fcn.00408d20
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4095b0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4118af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov dword [esp + 0xc], 0
mov esi, dword [esp + 0x24]
mov ebx, 1
mov dword [esp + 0x18], 1
mov ecx, dword [esi - 8]
cmp ecx, ebx
jle 0x409631
mov al, byte [ebx + esi - 1]
add cl, bl
mov byte [esp + 0xa], al
mov al, byte [ebx + esi]
and cl, 0x1f
mov byte [esp + 0xb], cl
xor al, cl
lea ecx, [ebx - 1]
push eax
push ecx
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::SetAt
mov al, byte [esp + 0xa]
mov cl, byte [esp + 0xb]
xor al, cl
lea ecx, [esp + 0x24]
push eax
push ebx
call sub.MFC42.DLL_CString::SetAt
mov esi, dword [esp + 0x24]
add ebx, 2
mov ecx, dword [esi - 8]
cmp ebx, ecx
jl 0x4095ea
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x409f10
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x114]
push ebp
push esi
push edi
push eax
push ebx
call fcn.0040a030
mov cl, byte [0x418a3c]
mov esi, eax
mov byte [esp + 0x20], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
add esp, 8
lea edx, [esp + 0x18]
xor ebp, ebp
stosw word es:[edi], ax
push 0x104
push edx
push ebp
push ebx
stosb byte es:[edi], al
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x40a01a
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x409f83
xor esi, esi
jmp 0x409fe5
mov ecx, dword [esp + 0x124]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x409fae
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
jmp 0x409fe5
test esi, esi
je 0x409fcf
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.00409f10
add esp, 8
test eax, eax
je 0x409fcf
mov esi, 1
jmp 0x409fd1
xor esi, esi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
mov cl, byte [0x418a3c]
xor eax, eax
mov byte [esp + 0x18], cl
mov ecx, 0x40
lea edi, [esp + 0x19]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
inc ebp
push 0x104
stosw word es:[edi], ax
push edx
push ebp
push ebx
stosb byte es:[edi], al
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x409f6a
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret