joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e320
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x53b508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor esi, esi
push eax
mov dword [esp + 0x20], esi
call edi
cmp eax, 0xffffffff
je 0x43e35b
test al, 0x10
jne 0x43e447
mov ecx, dword [esp + 0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
push ecx
call ebp
test eax, eax
jne 0x43e447
push 0x3a
lea ecx, [esp + 0x28]
call fcn.0050d91e
test eax, eax
jge 0x43e391
push 2
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.0050d92c
test eax, eax
jle 0x43e394
lea esi, [eax + 1]
push esi
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.0050d92c
test eax, eax
jle 0x43e447
mov edx, dword [0x591288]
mov dword [esp + 0xc], edx
inc eax
lea ecx, [esp + 0x24]
push eax
push 0x5c
mov byte [esp + 0x24], 1
call fcn.0050d92c
test eax, eax
jle 0x43e420
lea esi, [eax + 1]
push eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
call fcn.00505c45
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.0050d536
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 1
call fcn.0050d3fd
mov ecx, dword [esp + 0xc]
push ecx
call edi
cmp eax, 0xffffffff
je 0x43e407
test al, 0x10
jne 0x43e410
mov edx, dword [esp + 0xc]
push 0
push edx
call ebp
push esi
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.0050d92c
test eax, eax
jg 0x43e3c8
mov eax, dword [esp + 0x24]
push eax
call edi
cmp eax, 0xffffffff
je 0x43e430
test al, 0x10
jne 0x43e439
mov ecx, dword [esp + 0x24]
push 0
push ecx
call ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.0050d3fd
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0050d3fd
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x43e470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53b55f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov dword [esp + 0x14], 0
mov eax, dword [0x591288]
mov dword [esp + 0x24], 1
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 0
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x28]
push eax
push ecx
push edx
mov byte [esp + 0x40], 5
call fcn.0043ed30
add esp, 0x1c
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
call fcn.0050d815
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.0050d172
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call fcn.0050d3fd
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call fcn.0050d3fd
lea ecx, [esp + 8]
mov byte [esp + 0x24], 2
call fcn.0050d3fd
lea ecx, [esp + 4]
mov byte [esp + 0x24], 1
call fcn.0050d3fd
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.0050d3fd
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x43e560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53b5b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov dword [esp + 0x14], 0
mov eax, dword [0x591288]
mov dword [esp + 0x28], 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 8]
neg eax
sbb eax, eax
lea edx, [esp + 0xc]
and eax, 0x20000000
mov byte [esp + 0x28], 6
push eax
push ecx
lea eax, [esp + 0x40]
push edx
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x30]
push edx
push eax
push ecx
call fcn.0043e9c0
mov esi, dword [esp + 0x50]
add esp, 0x20
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.0050d172
mov dword [esp + 0x14], 1
lea ecx, [esp + 8]
mov byte [esp + 0x28], 5
call fcn.0050d3fd
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.0050d3fd
lea ecx, [esp + 4]
mov byte [esp + 0x28], 3
call fcn.0050d3fd
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.0050d3fd
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call fcn.0050d3fd
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 0
call fcn.0050d3fd
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x43ed30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53b740
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x591288]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x48]
push edx
push eax
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x20]
push ecx
push edx
mov bl, 3
push esi
push eax
mov byte [esp + 0x44], bl
call fcn.0043e9c0
mov edi, eax
add esp, 0x20
test edi, edi
je 0x43eec3
mov ecx, dword [esi]
push ecx
call fcn.0043eff0
add esp, 4
test eax, eax
je 0x43eec3
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x43eec3
mov eax, dword [esi]
lea ecx, [esp + 0x44]
push eax
push ecx
call fcn.0043ef20
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.0050d536
lea ecx, [esp + 0x44]
mov byte [esp + 0x24], bl
call fcn.0050d3fd
lea ecx, [esp + 0x10]
call fcn.0050d98b
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x48]
push eax
push ecx
call fcn.0050d62c
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 5
call fcn.0050d536
lea ecx, [esp + 0x44]
mov byte [esp + 0x24], bl
call fcn.0050d3fd
mov edx, dword [esp + 0x40]
mov eax, dword [esi]
and edx, 0xffff
push edx
push eax
call fcn.0043f2f0
add esp, 8
test eax, eax
jne 0x43eeb3
mov ecx, dword [0x591288]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x44]
and edx, 0xffff
mov byte [esp + 0x24], 6
push edx
push 0x5881c0
push eax
call fcn.005060bb
add esp, 0xc
lea ecx, [esp + 0x44]
lea edx, [esp + 0xc]
lea eax, [esp + 0x3c]
push ecx
push edx
push eax
call fcn.0050d62c
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 7
call fcn.0050d536
lea ecx, [esp + 0x3c]
mov byte [esp + 0x24], 6
call fcn.0050d3fd
lea ecx, [esp + 0x44]
mov byte [esp + 0x24], bl
call fcn.0050d3fd
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
call fcn.0050d536
jmp 0x43eec5
xor edi, edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 2
call fcn.0050d3fd
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 1
call fcn.0050d3fd
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call fcn.0050d3fd
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0050d3fd
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x43fae0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
push edi
push eax
push str..htm
push SysReAllocStringLen
xor ebx, ebx
call fcn.0043c210
add esp, 0xc
test eax, eax
jne 0x43fba6
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 8]
push str._shellopencommand
push ecx
call edi
lea edx, [esp + 8]
lea eax, [esp + 8]
push edx
push eax
push SysReAllocStringLen
call fcn.0043c210
add esp, 0xc
test eax, eax
jne 0x43fba6
push esi
lea ecx, [esp + 0xc]
push str.__1_
push ecx
call fcn.004efcb4
mov esi, eax
add esp, 8
test esi, esi
jne 0x43fb78
lea edx, [esp + 0xc]
push 0x58b71c
push edx
call fcn.004ee070
mov esi, eax
add esp, 8
test esi, esi
jne 0x43fb78
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xb]
jmp 0x43fb7b
mov byte [esi], 0
push 0x588490
push esi
call edi
mov ecx, dword [esp + 0x218]
push ecx
push esi
call edi
lea edx, [esp + 0xc]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
pop esi
jbe 0x43fba6
mov ebx, 1
lea ecx, [esp + 0x214]
call fcn.0050d3fd
mov eax, ebx
pop edi
pop ebx
add esp, 0x208
ret
Function at 0x440d60
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x104
mov ecx, 9
xor eax, eax
push esi
push edi
mov esi, str.ACBCF095_E8C0_420F_8769_2845D9B92E8C
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x37
lea edi, [esp + 0x2f]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x110]
not ecx
dec ecx
test eax, eax
mov esi, ecx
je 0x440de7
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea eax, [esp + 8]
push esi
push eax
push 2
push str.DownloadUI
push str.SoftwareMicrosoftInternet_Explorer
push reloc.FGBTCORE.dll_Ordinal_1
call edi
lea ecx, [esp + 8]
push esi
push ecx
push 2
push str.DownloadUI
push str.SoftwareMicrosoftInternet_Explorer
push reloc.FGBTCORE.dll_Ordinal_2
call edi
pop edi
pop esi
add esp, 0x104
ret 4
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push str.DownloadUI
push str.SoftwareMicrosoftInternet_Explorer
push reloc.FGBTCORE.dll_Ordinal_1
call esi
push str.DownloadUI
push str.SoftwareMicrosoftInternet_Explorer
push reloc.FGBTCORE.dll_Ordinal_2
call esi
pop edi
pop esi
add esp, 0x104
ret 4

Function at 0x440ea0
Capabilities:
Resume thread

Disassembly:
push 0
push 4
push 0
push 0
push 0
push 0x440ed0
call fcn.0050ec77
test eax, eax
je 0x440ec2
mov eax, dword [eax + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x441810
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x114], 2
jne 0x441826
mov edi, dword [esi + 0xfc]
jmp 0x44182c
mov edi, dword [esi + 0xec]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x268]
mov ebp, eax
sub ebp, ecx
xor edx, edx
cmp ebp, 0x3e8
jge 0x441873
mov eax, dword [esi + 0x114]
mov ecx, dword [esi + 0x25c]
cmp eax, 2
jne 0x44186b
mov eax, dword [esi + 0xfc]
cmp ecx, eax
jb 0x441865
xor edi, edi
jmp 0x44189d
sub eax, ecx
mov edi, eax
jmp 0x44189d
mov eax, dword [esi + 0xec]
jmp 0x44185d
add ecx, 0x3e8
mov ebp, eax
sub ebp, ecx
mov dword [esi + 0x268], ecx
cmp ebp, 0x3e8
jle 0x4418b3
mov dword [esi + 0x268], eax
mov dword [esi + 0x10c], edx
mov dword [esi + 0x25c], edx
cmp dword [esi + 0x114], edx
je 0x44190a
xor eax, eax
cmp edi, edx
setl al
dec eax
and eax, edi
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi + 0x10c]
add ecx, 0xfffffc18
mov dword [esi + 0x108], eax
mov eax, dword [esi + 0x114]
cmp eax, 2
mov eax, dword [esi + 0x25c]
mov dword [esi + 0x10c], edx
mov dword [esi + 0x110], ecx
jne 0x4418f6
mov ecx, dword [esi + 0xfc]
cmp eax, ecx
jbe 0x441897
sub eax, ecx
mov dword [esi + 0x25c], eax
jmp 0x44189d
mov ecx, dword [esi + 0xec]
cmp eax, ecx
jbe 0x441897
sub eax, ecx
mov dword [esi + 0x25c], eax
jmp 0x44189d
pop edi
pop esi
mov eax, 0x1000
pop ebp
ret
Function at 0x4422b0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x53bcd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x100
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 8]
mov edx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x120]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x11c]
push 0xff
push ecx
push 0x596660
push edx
push eax
mov dword [esp + 0x128], 2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x44248a
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x120]
call fcn.0050d586
push 0x2c
lea ecx, [esp + 0x120]
call fcn.0050d91e
test eax, eax
jge 0x442395
lea edx, [esp + 8]
push edx
call fcn.004ee21e
add esp, 4
lea ecx, [esp + 0x118]
mov esi, eax
mov byte [esp + 0x110], 1
call fcn.0050d3fd
lea ecx, [esp + 0x11c]
mov byte [esp + 0x110], 0
call fcn.0050d3fd
lea ecx, [esp + 0x120]
mov dword [esp + 0x110], 0xffffffff
call fcn.0050d3fd
mov eax, esi
jmp 0x4424cc
mov eax, dword [esp + 0x11c]
push ebx
push 0x2c
push 0
lea ecx, [esp + 0x124]
push eax
push ecx
call fcn.0051418c
mov edx, dword [esp + 0x11c]
push edx
call fcn.004ee2a9
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x11c]
push 0x2c
push 1
push eax
push ecx
call fcn.0051418c
mov edx, dword [esp + 0x11c]
push edx
call fcn.004ee2a9
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x11c]
push 0x2c
push 2
push eax
push ecx
call fcn.0051418c
mov edx, dword [esp + 0x11c]
push edx
call fcn.004ee2a9
mov ecx, dword [esp + 0x12c]
add esp, 4
test ecx, ecx
je 0x442435
cmp esi, 0xff
jne 0x442435
test ebx, ebx
jne 0x442435
cmp eax, esi
jne 0x442435
mov ebx, 0xa
xor ecx, ecx
and esi, 0xff
mov ch, al
mov byte [esp + 0x114], 1
mov cl, bl
shl ecx, 8
or esi, ecx
lea ecx, [esp + 0x11c]
call fcn.0050d3fd
lea ecx, [esp + 0x120]
mov byte [esp + 0x114], 0
call fcn.0050d3fd
lea ecx, [esp + 0x124]
mov dword [esp + 0x114], 0xffffffff
call fcn.0050d3fd
mov eax, esi
pop ebx
jmp 0x4424cc
lea ecx, [esp + 0x118]
mov byte [esp + 0x110], 1
call fcn.0050d3fd
lea ecx, [esp + 0x11c]
mov byte [esp + 0x110], 0
call fcn.0050d3fd
lea ecx, [esp + 0x120]
mov dword [esp + 0x110], 0xffffffff
call fcn.0050d3fd
or eax, 0xffffffff
mov ecx, dword [esp + 0x108]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10c
ret 0x10
Function at 0x4424f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
mov ecx, dword [esp + 0x14]
test ax, ax
setl bl
xor eax, eax
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
test ebx, ebx
setne al
add eax, 2
mov edi, eax
push edi
push ecx
call ebp
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x442553
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x442542
test eax, 0x10000
jne 0x4425a2
push edi
push esi
call ebp
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x44252b
mov eax, dword [esp + 0x14]
xor edx, edx
test ebx, ebx
setne dl
push edx
push eax
call ebp
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov esi, eax
push esi
call ebx
test eax, eax
je 0x44259b
cmp esi, dword [esp + 0x14]
je 0x44259b
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x44258e
test eax, 0x10000
jne 0x4425a2
push edi
push esi
call ebp
mov esi, eax
push esi
call ebx
test eax, eax
jne 0x442571
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x444040
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x53c118
push eax
mov eax, dword [0x59cb2c]
mov dword fs:[0], esp
sub esp, 8
push esi
xor esi, esi
cmp eax, 1
jle 0x44410b
mov eax, dword [0x59cb30]
mov eax, dword [eax + 4]
mov cl, byte [eax]
cmp cl, 0x2d
je 0x444081
cmp cl, 0x2f
jne 0x44410b
inc eax
lea ecx, [esp + 8]
push eax
call fcn.0050d46b
mov ecx, dword [esp + 8]
push 0x58aa3c
push ecx
call fcn.004eea90
add esp, 8
test eax, eax
jne 0x4440a9
mov esi, 1
jmp 0x4440fe
mov edx, dword [esp + 8]
push 0x58ba84
push edx
call fcn.004eea90
add esp, 8
test eax, eax
jne 0x4440c6
mov esi, 2
jmp 0x4440fe
mov eax, dword [esp + 8]
push 0x5889bc
push eax
call fcn.004eea90
add esp, 8
test eax, eax
jne 0x4440e3
mov esi, 3
jmp 0x4440fe
mov ecx, dword [esp + 8]
push 0x58ba80
push ecx
call fcn.004eea90
add esp, 8
test eax, eax
jne 0x4440fe
mov esi, 4
lea ecx, [esp + 8]
call fcn.0050d3fd
test esi, esi
jne 0x44411d
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x591288]
mov dword [esp + 4], edx
dec esi
mov dword [esp + 0x14], 0
je 0x44414d
dec esi
je 0x444146
dec esi
je 0x44413f
push str.http:__www.google.com_support_toolbar__quickprivacyv2.0hlzh_CN
jmp 0x444152
push str.http:__toolbar.google.com_partners_terms_zh_cn
jmp 0x444152
push str.http:__www.google.com_support_toolbar__quickprivacyv2.0hlen
jmp 0x444152
push str.http:__toolbar.google.com_partners_terms
lea ecx, [esp + 8]
call fcn.0050d586
mov eax, dword [esp + 4]
push 0
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0050d3fd
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4447b0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x53c1f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x591288]
push ebx
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
lea ecx, [esp + 0x14]
mov ebx, 1
push ecx
push 0x20019
push 0
push str.SoftwareOpera_Software
push reloc.FGBTCORE.dll_Ordinal_1
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44481d
mov esi, dword [esp + 0x30]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0050d172
mov dword [esp + 0x10], ebx
jmp 0x4448c5
push 0x104
call fcn.0050d138
mov edx, dword [esp + 0x18]
add esp, 4
mov esi, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push esi
push ecx
push 0
push str.Last_Directory3
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x444869
push esi
call fcn.0050d161
add esp, 4
lea eax, [esp + 8]
push eax
jmp 0x4448b6
mov ecx, dword [0x591288]
push esi
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.0050d586
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
mov byte [esp + 0x2c], 2
call fcn.0050d536
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.0050d3fd
push esi
call fcn.0050d161
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
push ecx
mov esi, dword [esp + 0x34]
mov ecx, esi
call fcn.0050d172
mov dword [esp + 0x10], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.0050d3fd
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x4450a0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x53c3e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x34]
lea ecx, [esp + 0x1c]
push eax
push str.Item___
push ecx
mov dword [esp + 0x38], 2
call fcn.0050d706
push 0x58bae8
lea edx, [esp + 0x18]
push eax
push edx
mov byte [esp + 0x38], 3
call fcn.0050d692
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 5
call fcn.0050d3fd
lea eax, [esp + 0x38]
lea ecx, [esp + 0x20]
push eax
push str.Item___
push ecx
call fcn.0050d706
push 0x58bae8
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x38], 6
call fcn.0050d692
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 8
call fcn.0050d3fd
mov eax, dword [esp + 0x14]
mov eax, dword [eax - 8]
lea ecx, [eax + eax]
push ecx
call fcn.004ee7cf
mov edx, dword [esp + 0x18]
push 0
mov ebp, eax
push edx
push 0x400
push ebp
call fcn.0041a330
mov eax, dword [esp + 0x24]
mov eax, dword [eax - 8]
lea ecx, [eax + eax]
push ecx
call fcn.004ee7cf
mov edx, dword [esp + 0x28]
push 0
mov ebx, eax
push edx
push 0x400
push ebx
call fcn.0041a330
push 0x400
call fcn.004ee7cf
mov esi, eax
add esp, 0x2c
mov ecx, 0x100
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x3c]
push eax
push 0x400
push esi
push 0x596660
push ebp
push str.Document_Popup_Menu
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
lea ecx, [esp + 0x1c]
call fcn.0050d46b
push esi
call fcn.004ee909
mov ecx, dword [esp + 0x1c]
add esp, 4
mov eax, dword [ecx - 8]
test eax, eax
je 0x445201
mov edx, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push edx
push 0
push ebp
push str.Document_Popup_Menu
call esi
mov eax, dword [esp + 0x3c]
push eax
push 0
push ebp
push str.Link_Popup_Menu
call esi
mov ecx, dword [esp + 0x3c]
push ecx
push 0
push ebx
push str.Document_Popup_Menu
call esi
push ebp
call fcn.004ee909
push ebx
call fcn.004ee909
add esp, 8
lea ecx, [esp + 0x18]
call fcn.0050d3fd
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 5
call fcn.0050d3fd
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call fcn.0050d3fd
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 1
call fcn.0050d3fd
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 0
call fcn.0050d3fd
lea ecx, [esp + 0x3c]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0050d3fd
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x449f33
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
call fcn.0042eff0
mov ecx, eax
call fcn.00434250
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov dword [esp + 0xc], ecx
call fcn.0042eff0
mov ecx, eax
call fcn.00434cf0
lea ecx, [esi + 0x74]
call fcn.0047bf10
mov edx, dword [esi + 0x90]
push 2
push 0xffffffffffffffff
push 0x100c
push edx
mov ebp, eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
test ebx, ebx
jl 0x44a001
push edi
push ebx
lea ecx, [esi + 0x74]
call fcn.00508142
mov edi, eax
test edi, edi
je 0x449fe5
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x449fba
mov ecx, edi
call fcn.0046db50
test eax, eax
jne 0x449fe5
push eax
push edi
mov ecx, esi
call fcn.0044f3d0
cmp ebp, edi
jne 0x449fe5
jmp 0x449fd8
push 1
mov ecx, edi
call fcn.0046db80
test eax, eax
jne 0x449fe5
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
push edi
call fcn.0044f3d0
cmp ebp, edi
jne 0x449fe5
push 0
lea ecx, [esi + 0x6c8a8]
call fcn.00417ff0
mov ecx, dword [esi + 0x90]
push 2
push ebx
push 0x100c
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
test ebx, ebx
jge 0x449f89
pop edi
call fcn.0042eff0
mov ecx, eax
call fcn.00434260
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x451ba0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x10
mov ebp, 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x451bbd
xor ebp, ebp
call fcn.0042eff0
mov ecx, eax
call fcn.00434250
mov eax, dword [esi + 0x727dc]
push ebp
push eax
push ecx
lea ebx, [esi + 0x727d8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0050d172
lea ecx, [esi + 0x74]
mov dword [esp + 0x1c], ecx
call fcn.0047d1c0
mov edi, eax
test edi, edi
jne 0x451c87
mov ecx, esi
call fcn.0044aba0
mov edi, eax
test edi, edi
je 0x451cb0
mov ecx, dword [esi + 0x727dc]
push ebp
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.0050d172
push edi
mov ecx, esi
call fcn.0044ba50
mov ecx, eax
call fcn.004751d0
mov edi, eax
test edi, edi
je 0x451c87
mov eax, dword [edi + 4]
mov ecx, esi
push eax
push 0
call fcn.00451d00
test eax, eax
je 0x451c87
push eax
lea ecx, [esi + 0x486b0]
call fcn.0040df20
mov edx, dword [esi + 0x727dc]
push ebp
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ebx
call fcn.0050d172
mov ebx, dword [esp + 0x1c]
mov ecx, ebx
call fcn.0047d1c0
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x90]
je 0x451c87
mov ecx, ebx
call fcn.00513a2a
call fcn.0042eff0
mov ecx, eax
call fcn.00434260
test edi, edi
jne 0x451cb4
push 0xffffffffffffffff
push 0x30
push 0xef74
call fcn.0043c9e0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x451c87
mov ecx, dword [esp + 0x10]
call fcn.00513a2a
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret