joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4341f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x88
push ebx
push ebp
mov ebp, dword [esp + 0xa0]
push esi
push 0x44
mov ebx, eax
lea eax, [esp + 0x4c]
push 0
push eax
mov esi, ecx
call fcn.00472ca0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
lea edx, [esp + 0x1b]
mov dword [esp + 0x50], 0x44
mov word [esp + 0x80], 5
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov byte [esp + 0x1b], al
mov dword [esp + 0x1c], 0x12
call fcn.00437c60
mov eax, dword [esp + 0x40]
sub eax, 0x12
neg eax
sbb eax, eax
lea ecx, [esp + 0x2c]
and eax, ecx
cmp dword [esi + 0x18], 0x12
jne 0x434273
xor edx, edx
jmp 0x434276
lea edx, [esi + 4]
cmp dword [ebx + 0x18], 8
jb 0x434281
mov ecx, dword [ebx + 4]
jmp 0x434284
lea ecx, [ebx + 4]
lea esi, [esp + 0x18]
push esi
lea esi, [esp + 0x4c]
push esi
push 0
push 0
push 0x200
push 0
push eax
push edx
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4342da
test ebp, ebp
je 0x4342b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], vtable.TmCommon::AccessControl::SecurityAttributes.0
mov dword [esp + 0x38], vtable.ATL::CSecurityDesc.0
call fcn.004378a0
xor al, al
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
mov edx, dword [esp + 0x98]
cmp byte [edx], 0
jne 0x43432a
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
test ebp, ebp
je 0x434305
mov dword [ebp], 0
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], vtable.TmCommon::AccessControl::SecurityAttributes.0
mov dword [esp + 0x38], vtable.ATL::CSecurityDesc.0
call fcn.004378a0
mov al, 1
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
mov ecx, dword [eax]
xor bl, bl
cmp byte [edx], 1
mov edx, dword [esp + 0x18]
push ecx
push edx
jne 0x434351
call fcn.004343d0
add esp, 8
jmp 0x434357
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43437e
cmp eax, 0x102
je 0x434371
test ebp, ebp
je 0x434380
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
jmp 0x434380
test ebp, ebp
je 0x434380
mov dword [ebp], 0x102
jmp 0x434380
mov bl, 1
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
test ebp, ebp
je 0x43439f
mov dword [ebp], 0
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], vtable.TmCommon::AccessControl::SecurityAttributes.0
mov dword [esp + 0x38], vtable.ATL::CSecurityDesc.0
call fcn.004378a0
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x88
ret
Function at 0x435060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48af36
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.00436390
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
mov edi, 4
mov dword [ebp - 0x14], edi
jb 0x4350ae
mov ecx, dword [eax + 4]
jmp 0x4350b1
lea ecx, [eax + 4]
mov eax, dword [esi + 8]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, ebx
jne 0x43512f
cmp dword [ebp - 0x18], edi
jne 0x4350f0
cmp dword [ebp - 0x14], edi
jne 0x4350f0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x28
call fcn.0043db0e
add esp, 4
mov dword [ebp + 8], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x435119
push 0xd
push eax
mov edx, 0x116
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x43511b
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x20], eax
push 0x4c3e0c
lea eax, [ebp - 0x20]
push eax
call fcn.00473858
push 0x28
call fcn.0043db0e
add esp, 4
mov dword [ebp + 8], eax
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x435157
push esi
push eax
mov edx, 0x119
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x435159
xor eax, eax
push 0x4c3e0c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
push ecx
mov dword [ebp - 0x24], eax
call fcn.00473858
xor ebx, ebx
push ebx
push ebx
call fcn.00473858
int3
Function at 0x435940
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ae1b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push esi
mov dword [ebp - 4], 0
call fcn.00436390
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x14], ecx
jb 0x435990
mov ecx, dword [eax + 4]
jmp 0x435993
lea ecx, [eax + 4]
mov eax, dword [esi + 8]
push 4
lea edx, [ebp - 0x14]
push edx
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x4359ed
push 0x28
call fcn.0043db0e
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x4359d6
push esi
push eax
mov edx, 0x1de
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x4359d8
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x18], eax
push 0x4c3e0c
lea eax, [ebp - 0x18]
push eax
call fcn.00473858
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x435a10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48adeb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push esi
mov dword [ebp - 4], 0
call fcn.00436390
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
jb 0x435a66
mov ecx, dword [eax + 4]
jmp 0x435a69
lea ecx, [eax + 4]
mov eax, dword [esi + 8]
push 8
lea edx, [ebp - 0x1c]
push edx
push 0xb
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x435ac3
push 0x28
call fcn.0043db0e
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x435aac
push esi
push eax
mov edx, 0x1f7
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x435aae
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], eax
push 0x4c3e0c
lea eax, [ebp - 0x14]
push eax
call fcn.00473858
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x435b50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ada1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00436390
mov eax, dword [ebx + 0x14]
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043db39
mov esi, eax
add esp, 4
test esi, esi
jne 0x435bf4
push 0x28
call fcn.0043db0e
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x435bdd
push 6
push eax
mov edx, 0x225
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x435bdf
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], eax
push 0x4c3e0c
lea eax, [ebp - 0x14]
push eax
call fcn.00473858
lea eax, [edi + edi]
push eax
push 0
push esi
mov dword [ebp - 0x1c], eax
call fcn.00472ca0
add esp, 0xc
cmp dword [ebx + 0x18], 8
jb 0x435c11
mov ebx, dword [ebx + 4]
jmp 0x435c14
add ebx, 4
push 0xffffffffffffffff
push ebx
push edi
push esi
call fcn.00470ec4
mov edi, eax
add esp, 0x10
test edi, edi
je 0x435c6c
push esi
call fcn.0043db3e
push 0x28
call fcn.0043db0e
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
mov byte [ebp - 4], 2
je 0x435c55
push edi
push eax
mov edx, 0x22b
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x435c57
xor eax, eax
push 0x4c3e0c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
push ecx
mov dword [ebp - 0x18], eax
call fcn.00473858
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
jb 0x435c7a
mov ecx, dword [eax + 4]
jmp 0x435c7d
lea ecx, [eax + 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov edx, dword [ebp - 0x1c]
push edx
push esi
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call fcn.0043db3e
test edi, edi
je 0x435cdf
push 0x28
call fcn.0043db0e
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
mov byte [ebp - 4], 3
je 0x435cc8
push edi
push eax
mov edx, 0x230
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x435cca
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x20], eax
push 0x4c3e0c
lea eax, [ebp - 0x20]
push eax
call fcn.00473858
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x435d10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ad5b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push edi
mov dword [ebp - 4], 0
call fcn.00436390
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x435d61
mov ecx, dword [eax + 4]
jmp 0x435d64
lea ecx, [eax + 4]
mov eax, dword [edi + 8]
push edx
push esi
push 3
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x435dba
push 0x28
call fcn.0043db0e
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x435da3
push esi
push eax
mov edx, 0x24b
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x435da5
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], eax
push 0x4c3e0c
lea eax, [ebp - 0x14]
push eax
call fcn.00473858
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x435de0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ad2b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push esi
mov dword [ebp - 4], 0
call fcn.00436390
mov eax, dword [esi + 8]
push 0x49bbbc
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
je 0x435e6e
push 0x28
call fcn.0043db0e
add esp, 4
mov dword [ebp - 0x18], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x435e57
push esi
push eax
mov edx, 0x261
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x435e59
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], eax
push 0x4c3e0c
lea eax, [ebp - 0x14]
push eax
call fcn.00473858
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435e90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48acfb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push esi
mov dword [ebp - 4], 0
call fcn.00436390
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x435ed8
mov ecx, dword [eax + 4]
jmp 0x435edb
lea ecx, [eax + 4]
mov eax, dword [esi + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x435f2b
push 0x28
call fcn.0043db0e
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x435f14
push esi
push eax
mov edx, 0x279
mov edi, str.....CommonTmCommonTmComn_Registry.cpp
call fcn.00431980
jmp 0x435f16
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], eax
push 0x4c3e0c
lea eax, [ebp - 0x14]
push eax
call fcn.00473858
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x438e70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48abab
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, edx
mov edi, dword [ebp + 8]
test esi, esi
mov dword [ebp - 4], 0
jne 0x438eb2
call fcn.00439430
cmp dword [ebx + 0x18], 0x12
jne 0x438ebc
xor eax, eax
jmp 0x438ebf
lea eax, [ebx + 4]
mov edx, dword [ebp + 0xc]
lea ecx, [edi + 8]
push ecx
push 4
push edx
push esi
push 0
push eax
call fcn.00472afa
add esp, 0x18
test eax, eax
jne 0x438f25
push 0x28
call fcn.0043db0e
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x438f05
push 0x41e
push eax
mov edx, 0x19
mov edi, str.....CommonTmCommonTmComn_ThreadBase.cpp
call fcn.00438d60
jmp 0x438f07
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], eax
push 0x4c3ec0
lea eax, [ebp - 0x14]
push eax
call fcn.00473858
push 0
push 0
call fcn.00473858
mov dword [edi + 4], eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4390e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b996
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
lea eax, [ebp - 0x11]
mov dword [ebp - 4], 0
mov bl, 1
push eax
mov byte [ebp - 0x11], bl
call fcn.004392f0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x43917c
push 0x28
call fcn.0043db0e
mov esi, eax
add esp, 4
mov dword [ebp + 0x10], esi
test esi, esi
mov byte [ebp - 4], bl
je 0x439165
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
mov edx, 0x42
mov edi, str.....CommonTmCommonTmComn_ThreadBase.cpp
call fcn.00438d60
jmp 0x439167
xor eax, eax
push 0x4c3ec0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
push ecx
mov dword [ebp - 0x18], eax
call fcn.00473858
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x4391d2
push 0x28
call fcn.0043db0e
mov esi, eax
add esp, 4
mov dword [ebp + 0x10], esi
test esi, esi
mov byte [ebp - 4], 2
je 0x4391bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
mov edx, 0x45
mov edi, str.....CommonTmCommonTmComn_ThreadBase.cpp
call fcn.00438d60
jmp 0x4391bd
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x1c], eax
push 0x4c3ec0
lea eax, [ebp - 0x1c]
push eax
call fcn.00473858
mov ecx, dword [ebp + 8]
cmp byte [ecx], bl
jne 0x4391e3
mov ecx, dword [ebp + 0xc]
mov edx, esi
call fcn.004394a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x439390
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x48ab1b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ceb00]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 4]
push 0x3e3
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x439416
push 0x28
call fcn.0043db0e
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
xor eax, eax
cmp esi, eax
mov dword [esp + 0x18], eax
je 0x4393fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
mov edx, 0x8f
mov edi, str.....CommonTmCommonTmComn_ThreadBase.cpp
call fcn.00438d60
push 0x4c3ec0
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
push ecx
mov dword [esp + 0x28], eax
call fcn.00473858
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x43bd40
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x1f4
push 2
xor ebp, ebp
push ebp
push ebp
push ebp
push esi
xor edi, edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x43bd91
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
mov edi, eax
call esi
mov ebp, eax
cmp edi, ebp
je 0x43bd91
push 1
push edi
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x2000
mov dword [esp + 0x20], 0
call esi
test eax, eax
je 0x43bdc0
push 0
push 0
push 0
push 0x2001
call esi
mov esi, dword [esp + 0x1c]
push esi
xor bl, bl
call dword [sym.imp.USER32.dll_BringWindowToTop]
cmp eax, 1
jne 0x43bdd4
mov bl, al
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp eax, 1
jne 0x43bde2
and bl, al
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43be01
push 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp edi, ebp
je 0x43be0f
push 0
push edi
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x43c937
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4ceb00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43c98b
push 3
lea eax, [ebp - 0x44]
push 0x48fe90
push eax
call fcn.0047119d
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.0046fe44
leave
ret
Function at 0x43c9a7
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4ceb00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00472ca0
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x43ca00
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x11c]
xor eax, eax
dec ecx
pop esi
je 0x43ca54
dec ecx
jne 0x43ca77
cmp edx, 5
jne 0x43ca4c
mov ecx, dword [ebp - 0x118]
sub ecx, eax
je 0x43ca48
dec ecx
je 0x43ca3d
dec ecx
je 0x43ca2e
push 0x14
jmp 0x43ca9f
cmp word [ebp - 0xc], 1
jb 0x43ca38
push 0x10
pop eax
or eax, 4
jmp 0x43ca77
cmp word [ebp - 0xc], 2
jb 0x43ca38
push 8
jmp 0x43ca37
push 4
jmp 0x43ca9f
cmp edx, 4
ja 0x43ca83
push 2
pop eax
cmp edx, 4
jne 0x43ca77
cmp dword [ebp - 0x118], 0
je 0x43ca74
cmp dword [ebp - 0x118], 0xa
je 0x43ca74
cmp dword [ebp - 0x118], 0x5a
jne 0x43ca77
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046fe44
leave
ret
cmp edx, 6
jne 0x43caa2
cmp dword [ebp - 0x118], 0
jne 0x43caa2
cmp dword [ebp - 0x114], 0x1554
jae 0x43caa2
push 0x40
pop eax
jmp 0x43ca77
push 0x20
jmp 0x43ca9f

Function at 0x43cbc3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4ceb00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp word [0x4d7ac0], si
jne 0x43cc5b
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push 0x48fdc0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43cc5b
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push str.Locale
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x43cc5b
push 3
push dword [esi*8 + 0x48fc10]
lea eax, [ebp - 0xc]
push eax
call fcn.00472567
add esp, 0xc
test eax, eax
je 0x43cc4d
inc esi
cmp esi, 0x1c
jb 0x43cc2c
jmp 0x43cc5b
mov ax, word [esi*8 + 0x48fc14]
mov word [0x4d7ac0], ax
mov ecx, dword [ebp - 4]
mov ax, word [0x4d7ac0]
xor ecx, ebp
pop esi
call fcn.0046fe44
leave
ret
Function at 0x43d95c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4ceb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43da31
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43da20
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x43da0a
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x43da20
push eax
push edi
push dword [ebp - 0x110]
call fcn.0043d8f9
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x43da33
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046fe44
leave
ret 4

Function at 0x441bcb
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x441c04
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00441b64
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0044061f
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x443870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4438b3
call fcn.00448dc9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4438b3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4438ce
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0044342a
test ebx, ebx
mov esi, eax
je 0x4438cc
test edi, edi
je 0x4438cc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4