joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4944a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x49448a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49ae60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c8fee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0049b780
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x526a24
call fcn.004ba28b
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x49aef3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ba28b
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x49aeec
push 0
mov ecx, eax
call fcn.00491f60
mov dword [esi + 0xc], eax
jmp 0x49aef5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x49aef5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4bc918
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4bc950
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ba9a5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ba97d
jmp 0x4bc95c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4be00d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4be04f
call fcn.004c3ac2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4be04f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4be046
xor eax, eax
jmp 0x4be057
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004be05d
pop edi
pop esi
pop ebx
ret 4
Function at 0x4c3ff2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c4020
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c403e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c3f58
jmp 0x4c403e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c403e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c3f58
test edi, edi
mov eax, edi
jne 0x4c4028
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4020de
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00450a20
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402123
push ebx
call fcn.00450022
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40214e
push 6
call fcn.00450028
add esp, 4
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.00450830
add esp, 0x10
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
mov ecx, 2
call fcn.00401852
add esp, 8
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402195
push ebx
call fcn.00450022
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x40219d
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4021ae
push ebx
call fcn.00450022
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4021b3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4021e0
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4021f7
mov eax, 1
jmp 0x402201
mov eax, 0
jmp 0x402201
mov esp, ebp
pop ebp
ret 4

Function at 0x4022be
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4022eb
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402302
mov eax, 1
jmp 0x40230c
mov eax, 0
jmp 0x40230c
mov esp, ebp
pop ebp
ret 4

Function at 0x402312
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40234e
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402365
mov eax, 1
jmp 0x40236f
mov eax, 0
jmp 0x40236f
mov esp, ebp
pop ebp
ret 8

Function at 0x402679
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4026a6
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4026bd
mov eax, 1
jmp 0x4026c7
mov eax, 0
jmp 0x4026c7
mov esp, ebp
pop ebp
ret 4
Function at 0x4026cd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00450a20
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402712
push ebx
call fcn.00450022
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40273d
push 6
call fcn.00450028
add esp, 4
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.00450830
add esp, 0x10
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_bind
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402783
mov eax, 0x47b315
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402797
mov eax, 0x47b315
push eax
push 4
mov ebx, 0x14c
call fcn.00450cc0
add esp, 0x34
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4027bd
push ebx
call fcn.00450022
add esp, 4
push 0x80000301
push 0
push dword [ebp - 0xc]
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4027da
mov eax, 0x47b315
push eax
push 2
mov ebx, 0x134
call fcn.00450d70
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x4027f8
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402809
push ebx
call fcn.00450022
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4059fa
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
call fcn.00405b85
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x405a49
push ebx
call fcn.00450022
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x405b7f
call fcn.00405dff
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405b7f
mov eax, str.B4DBA4C1DCC07018456EBDD0D2F72132E7B6A364CC8BE892D2CB4530126DF581B9F3B7C570CE3E00DAE3ACD0BAB37B553B19C8CCB58FB99566484C79DCEFD1DEDFD2643C481EBBFBC6D1CAD17C054111B885DE88A190081C2742DE8ED1C8DC9E60282047AB96
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040528e
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x405a89
push ebx
call fcn.00450022
add esp, 4
push 0x30
mov eax, 0x47b942
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.004035c4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x405ab6
push ebx
call fcn.00450022
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x405ac6
push ebx
call fcn.00450022
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405af2
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405b17
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jl 0x405b5d
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc ecx
push ecx
push eax
cmp ecx, eax
jg 0x405b5a
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405b56
push 6
call fcn.00450028
add esp, 4
pop eax
pop ecx
jmp 0x405b29
add esp, 8
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405b7f
push 6
call fcn.00450028
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x407e77
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00450a20
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407ebc
push ebx
call fcn.00450022
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x200
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x407efb
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x407f29
mov eax, dword [ebp - 4]
test eax, eax
je 0x407f24
push eax
mov ebx, eax
call fcn.004015f3
inc eax
push eax
call fcn.0045001c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x407f4c
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
test eax, eax
je 0x407f47
push eax
mov ebx, eax
call fcn.004015f3
inc eax
push eax
call fcn.0045001c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x407f4c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407f5d
push ebx
call fcn.00450022
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x408985
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4089b7
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4089ce
mov eax, 0
jmp 0x4089d8
mov eax, 1
jmp 0x4089d8
mov esp, ebp
pop ebp
ret 8

Function at 0x40b769
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x716531]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40b7b6
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b7cd
mov eax, 0x47b34a
jmp 0x40b8cb
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x716531]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40b7f5
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40b80c
mov eax, 0x47b34a
jmp 0x40b8cb
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40b82e
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40b845
mov eax, 0x47b34a
jmp 0x40b8cb
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.004528e0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40b878
push ebx
call fcn.00450022
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40b88f
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40b8ac
push 6
call fcn.00450028
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40b8c6
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0045001c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40b8cb
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40b8dc
push ebx
call fcn.00450022
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40e386
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00450a20
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40e3cb
push ebx
call fcn.00450022
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40e3f9
push 6
call fcn.00450028
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x40e415
push eax
mov ebx, eax
call fcn.004015f3
inc eax
push eax
call fcn.0045001c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40e41a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40e42b
push ebx
call fcn.00450022
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x418b5f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ebx, dword [0x716599]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esp
push 1
push 0x47b315
push 0x47b315
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x418bae
push 6
call fcn.00450028
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x41a302
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x48
call fcn.0045001c
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x12
rep stosd dword es:[edi], eax
push 0x10
call fcn.0045001c
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push dword [ebp + 8]
call fcn.004025ab
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41a37b
push ebx
call fcn.00450022
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push 0x10
push 2
mov ebx, 0xc8
call fcn.00450480
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push dword [ebp - 0x10]
push 0
push 0
push 0
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41a3f5
push 6
call fcn.00450028
add esp, 4
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx]
jmp 0x41a408
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41a419
push ebx
call fcn.00450022
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.00450022
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00450022
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x41a519
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x41a56c
mov eax, str.6043625353529B9587DD265A6F47050C9A819FC727
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040528e
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41a550
push ebx
call fcn.00450022
add esp, 4
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41a566
push ebx
call fcn.00450022
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 1
push 0x47b315
push 0x47b315
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41a5a9
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
jle 0x41a5c0
mov eax, 1
jmp 0x41a5ca
mov eax, 0
jmp 0x41a5ca
mov esp, ebp
pop ebp
ret 8

Function at 0x4206ea
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x420725
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004528c0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x420788
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00450480
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4207ac
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004528c0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42080f
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00450480
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x420833
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004528c0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x420896
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00450480
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x42089e
mov esp, ebp
pop ebp
ret
Function at 0x424c7a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x424cc0
push 6
call fcn.00450028
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x47b6ad]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.004036bc
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00450a20
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x424d13
push ebx
call fcn.00450022
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x424d4c
push 6
call fcn.00450028
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x424d68
push eax
mov ebx, eax
call fcn.004015f3
inc eax
push eax
call fcn.0045001c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x424d6d
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x424d7e
push ebx
call fcn.00450022
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x450620
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.004556e0
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x450770
test ecx, ecx
je 0x450770
inc ecx
push ecx
call fcn.0046ac5f
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045e020
mov edi, eax
add esp, 0xc
test edi, edi
je 0x450699
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45075d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.0046ac5f
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x450721
cmp eax, 0xea
jne 0x450749
push esi
call fcn.0046ac88
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0046ac5f
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x4506ec
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x45072f
cmp eax, 2
jne 0x450749
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00455650
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.0046ac88
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0046ac88
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x45079e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4507aa
mov edx, dword [esp + 0x40]
test edx, edx
je 0x4507aa
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00455650
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret