joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da9c4
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
push edi
mov eax, dword [0x51f164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov dword [ebp - 0x54], vtable.std::exception.0
lea eax, [esi + 4]
movq qword [ebp - 0x50], xmm0
push eax
call fcn.004a7afd
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
mov eax, dword [esi + 0x14]
movq xmm0, qword [esi + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [esi + 0x18]
push eax
mov dword [ebp - 0x54], vtable.boost::system::system_error.0
movq qword [ebp - 0x48], xmm0
call fcn.00431c10
movaps xmm0, xmmword [0x505610]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x54], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [ebp - 0x24], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [ebp - 4], 1
mov edi, dword [ebp + 8]
mov dword [edi + 0x44], 0x504ef0
mov dword [edi + 0x4c], vtable.boost::exception_detail::clone_base.0
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
mov dword [ebp - 0x10], 6
call fcn.0043c7f0
mov dword [ebp - 4], 4
lea esi, [edi + 0x30]
mov eax, dword [edi + 0x44]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::thread_resource_error__.0
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::thread_resource_error__.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::thread_resource_error__.2.0
mov eax, dword [edi + 0x44]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x40], eax
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00404a90
mov eax, dword [edi + 0x44]
add esp, 8
mov dword [edi], vtable.boost::wrapexcept_class_boost::thread_resource_error_.0
mov dword [esi], vtable.boost::wrapexcept_class_boost::thread_resource_error_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x44], vtable.boost::wrapexcept_class_boost::thread_resource_error_.2.0
mov eax, dword [edi + 0x44]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x40], eax
mov dword [ebp - 0x54], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [ebp - 0x24], vtable.boost::exception.0
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x43e686
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], vtable.boost::thread_exception.0
call fcn.00404760
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43e810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4daa64
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
push edi
mov eax, dword [0x51f164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov dword [ebp - 0x54], vtable.std::exception.0
lea eax, [esi + 4]
movq qword [ebp - 0x50], xmm0
push eax
call fcn.004a7afd
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
mov eax, dword [esi + 0x14]
movq xmm0, qword [esi + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [esi + 0x18]
push eax
mov dword [ebp - 0x54], vtable.boost::system::system_error.0
movq qword [ebp - 0x48], xmm0
call fcn.00431c10
movaps xmm0, xmmword [0x505610]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x54], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [ebp - 0x24], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov dword [ebp - 4], 1
mov edi, dword [ebp + 8]
mov dword [edi + 0x44], 0x504ef0
mov dword [edi + 0x4c], vtable.boost::exception_detail::clone_base.0
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
mov dword [ebp - 0x10], 6
call fcn.0043cec0
mov dword [ebp - 4], 4
lea esi, [edi + 0x30]
mov eax, dword [edi + 0x44]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::lock_error__.0
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::lock_error__.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::lock_error__.2.0
mov eax, dword [edi + 0x44]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x40], eax
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00404a90
mov eax, dword [edi + 0x44]
add esp, 8
mov dword [edi], vtable.boost::wrapexcept_class_boost::lock_error_.0
mov dword [esi], vtable.boost::wrapexcept_class_boost::lock_error_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x44], vtable.boost::wrapexcept_class_boost::lock_error_.2.0
mov eax, dword [edi + 0x44]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x40], eax
mov dword [ebp - 0x54], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [ebp - 0x24], vtable.boost::exception.0
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x43e966
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], vtable.boost::thread_exception.0
call fcn.00404760
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x440620
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dad58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x51f164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0x70
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x440706
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00404f20
mov dword [esi], 0x504e54
mov eax, dword [edi]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
movups xmm0, xmmword [edi + 4]
movups xmmword [esi + 0x40], xmm0
movq xmm0, qword [edi + 0x14]
movq qword [esi + 0x50], xmm0
mov word [edi + 4], ax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 7
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
movups xmm0, xmmword [edi + 0x1c]
movups xmmword [esi + 0x58], xmm0
movq xmm0, qword [edi + 0x2c]
movq qword [esi + 0x68], xmm0
mov dword [edi + 0x2c], eax
mov word [edi + 0x1c], ax
mov eax, esi
mov dword [edi + 0x30], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.00401fd0
push eax
mov dword [ebp - 4], 0
call fcn.00439410
int3

Function at 0x464230
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc5d8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x4642a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x4642a6
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x4642c4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004905bb
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.00431bd0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.00464390
push 0x518954
lea eax, [ebp - 0x50]
push eax
call fcn.004a7e0c
int3
Function at 0x48cb70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfcd0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x48cbb1
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, 0xffffffff
jne 0x48cbd4
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.0048ca40
add esp, 0xc
jmp 0x48ccf0
push esi
push ebx
call fcn.0048c940
add esp, 8
mov ecx, eax
mov dword [ebp - 0x30], ecx
test esi, 0x400
je 0x48ccb5
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x48cbf9
mov edx, dword [ebx]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48cc12
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00436c20
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004049c0
cmp esi, 0xffffffff
jne 0x48cc78
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.0048ca40
add esp, 0xc
jmp 0x48ccf0
push ebx
call fcn.0048c860
add esp, 4
test al, al
jne 0x48cca1
mov eax, dword [ebp - 0x30]
mov dword [edi], 9
mov dword [edi + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48ccf0
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x48cccd
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x505548
and esi, 0x10
je 0x48ccd7
mov edx, dword [ebp - 0x34]
jmp 0x48ccdc
mov edx, ecx
mov ecx, dword [ebp - 0x34]
xor eax, eax
test esi, esi
setne al
add eax, 2
test esi, esi
mov dword [edi], eax
cmove ecx, edx
mov dword [edi + 4], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004905bb
mov esp, ebp
pop ebp
ret
Function at 0x406ed0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
push esi
push edi
mov esi, ecx
call fcn.004e7820
xor edi, edi
lea eax, [esp + 0xc]
mov ebx, 1
mov dword [esi + 0x5c], edi
push eax
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], pe_nt_image_headers32
mov dword [esi + 0x68], 0xf0
mov dword [esi + 0x78], edi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], 0x1f4
mov dword [esi + 0x28], 0x14
mov dword [esi + 0x38], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], 0xffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x6c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x3c], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x70], edi
cmp eax, 4
jbe 0x406f81
mov dword [esi + 0x70], 0x40000000
cmp eax, 5
ja 0x406f9c
jne 0x406f8e
cmp dword [esp + 0x14], ebx
jae 0x406f9c
mov dword [esi], edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x94
ret
mov dword [esi], ebx
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x408f80
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
sub esp, 0x100
push ebp
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetTopWindow]
mov edi, eax
test edi, edi
je 0x409184
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x408fbd
push 2
push edi
call ebp
mov edi, eax
test edi, edi
je 0x409184
jmp 0x408fa1
test edi, edi
je 0x409184
lea eax, [esp + 0xc]
push 0xff
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov byte [esp + 0x10b], 0
mov esi, str.tooltips_class32
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40900b
test cl, cl
je 0x409007
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40900b
add eax, 2
add esi, 2
test cl, cl
jne 0x408fe7
xor eax, eax
jmp 0x409010
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409166
mov esi, str.OfficeTooltip
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x409045
test cl, cl
je 0x409041
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x409045
add eax, 2
add esi, 2
test cl, cl
jne 0x409021
xor eax, eax
jmp 0x40904a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409166
mov esi, str.FlyHelp
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40907f
test cl, cl
je 0x40907b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40907f
add eax, 2
add esi, 2
test cl, cl
jne 0x40905b
xor eax, eax
jmp 0x409084
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409166
mov esi, str.SysShadow
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4090b9
test cl, cl
je 0x4090b5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4090b9
add eax, 2
add esi, 2
test cl, cl
jne 0x409095
xor eax, eax
jmp 0x4090be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409166
mov esi, str.MozillaWindowClass
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4090f3
test cl, cl
je 0x4090ef
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4090f3
add eax, 2
add esi, 2
test cl, cl
jne 0x4090cf
xor eax, eax
jmp 0x4090f8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409132
mov esi, str.32774
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x409129
test cl, cl
je 0x409125
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x409129
add eax, 2
add esi, 2
test cl, cl
jne 0x409105
xor eax, eax
jmp 0x40912e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40916f
lea eax, [esp + 0xc]
push 0xff
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 0xc]
test al, al
jne 0x40916f
mov esi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xffffffffffffffec
push edi
call esi
test al, 8
je 0x40916f
push 0xfffffffffffffff0
push edi
call esi
test eax, 0x80000000
je 0x40916f
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push edi
mov esi, edi
call ebp
mov edi, eax
test edi, edi
je 0x409184
cmp esi, edi
jne 0x408fa1
pop edi
pop esi
pop ebp
add esp, 0x100
ret
Function at 0x40a970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x74]
test eax, eax
je 0x40a986
push eax
call fcn.004f5907
add esp, 4
mov esi, dword [esp + 0x18]
mov dword [ebp + 0x74], 0
test esi, esi
jne 0x40a99d
call fcn.005b2355
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x14]
push str.WAVE
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x40a9ff
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a9ff
lea ecx, [ebx + 8]
push 1
push ecx
call fcn.004f5c63
add esp, 8
mov dword [ebp + 0x74], eax
test eax, eax
je 0x40a9f3
push ebx
push esi
push eax
call fcn.004f5580
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x417cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5c92c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push eax
push 0x7f5
mov dword [esp + 0x1c], ebx
call fcn.00597905
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ebp, [ebx + 0x5c]
push ebp
push 0xf003f
lea edi, [ebx + 0x60]
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push SysReAllocStringLen
mov dword [esp + 0x34], 0
mov dword [ebx], method.CDialog.virtual_0
mov dword [edi], 0
mov dword [ebp], 0
mov dword [ebx + 0x64], 1
call esi
test eax, eax
je 0x417d4d
push ebp
push 0xf003f
push 0
push 0
push SysReAllocStringLen
mov dword [0x61debc], 0
call esi
test eax, eax
je 0x417d4d
mov dword [ebp], 0
cmp dword [ebp], 0
je 0x417e3e
mov dword [esp + 0x28], 0x63e0c0
mov ebp, 0x61de28
mov ecx, dword [esp + 0x28]
push 0x63df70
call fcn.005981bb
mov dword [ebp], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x5c]
push edi
push 0xf003f
push 0
push ecx
push edx
call esi
test eax, eax
jne 0x417e24
lea esi, [ebx + 0x68]
mov edx, dword [edi]
mov dword [esp + 0x10], 0x200
mov byte [esi], al
mov ecx, dword [0x61debc]
lea eax, [esp + 0x10]
neg ecx
push eax
push esi
sbb ecx, ecx
push 0
and ecx, str.Application
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417e15
cmp byte [esi], 0
je 0x417e15
mov eax, dword [0x63e28c]
push eax
push esi
call fcn.004f6130
add esp, 8
test eax, eax
je 0x417e0b
lea ecx, [esp + 0x10]
mov dword [ebp], 1
mov edx, dword [edi]
push ecx
push esi
push 0
push 0
push str.HprSnapOld
push edx
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417e15
mov ecx, dword [esp + 0x28]
push esi
call fcn.005981bb
mov eax, dword [edi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x28]
add ebp, 0xc
add ecx, 4
cmp ebp, 0x61dec4
mov dword [esp + 0x28], ecx
jl 0x417d64
push 0x63e28c
lea ecx, [esp + 0x14]
push str.Applications_
push ecx
call fcn.0059833b
push str._shellopencommand
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x2c], 1
call fcn.005982c7
mov eax, dword [eax]
push edi
push 0xf003f
push 0
push eax
push SysReAllocStringLen
call esi
lea ecx, [esp + 0x28]
mov esi, eax
call fcn.00598032
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.00598032
test esi, esi
jne 0x417ed6
mov ecx, dword [edi]
lea eax, [esp + 0x28]
lea esi, [ebx + 0x68]
push eax
push esi
push 0
push 0
push 0
push ecx
mov dword [esp + 0x40], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [edi]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.__onewin
push esi
call fcn.004f6130
add esp, 8
neg eax
sbb eax, eax
neg eax
mov dword [ebx + 0x64], eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x4183d0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov edi, 0x61de24
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x63e0c0
lea ebx, [ebp + 0x60]
mov dword [esp + 0x14], edi
mov eax, dword [edi]
mov ecx, dword [ebp + 0x5c]
push ebx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4184d4
lea edx, [esp + 0x1c]
lea esi, [ebp + 0x68]
push edx
push esi
push eax
mov byte [esi], al
push eax
mov eax, dword [0x61debc]
mov ecx, dword [ebx]
mov dword [esp + 0x2c], 0x200
neg eax
sbb eax, eax
and eax, str.Application
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4184cb
mov edx, dword [0x63e28c]
push edx
push esi
call fcn.004f6130
add esp, 8
test eax, eax
je 0x4184cb
mov eax, dword [esp + 0x10]
or ecx, 0xffffffff
mov dword [esp + 0x18], 1
mov edx, dword [eax]
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4184a1
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [0x61debc]
neg ecx
sbb ecx, ecx
push edx
mov edx, dword [ebx]
push 1
and ecx, str.Application
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4184b9
mov eax, dword [0x61debc]
mov ecx, dword [ebx]
neg eax
sbb eax, eax
and eax, str.Application
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebx]
push str.HprSnapOld
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, dword [esp + 0x14]
mov eax, dword [ebx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
add edi, 0xc
add ecx, 4
cmp edi, str..j2k
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ecx
jl 0x4183f5
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x41850f
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
add esp, 0x10
ret
Function at 0x41c770
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x5c97ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x63094c]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
mov eax, dword [esi + 8]
mov ebx, 1
test eax, eax
mov dword [esp + 0x34], ebx
jne 0x41c7c0
push 0x85
lea ecx, [esp + 0xc]
call fcn.005985fc
jmp 0x41c8ef
test byte [esi + 4], 2
je 0x41c817
lea ecx, [esp + 0x10]
push 0x7177
push ecx
call fcn.004b9db0
add esp, 8
push 0x61e150
lea edx, [esp + 0x10]
push eax
push edx
mov byte [esp + 0x40], 2
call fcn.005982c7
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 3
call fcn.0059816b
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 2
call fcn.00598032
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], bl
call fcn.00598032
test byte [esi + 4], 4
je 0x41c86e
lea eax, [esp + 0xc]
push 0x7178
push eax
call fcn.004b9db0
add esp, 8
push 0x61e150
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x40], 4
call fcn.005982c7
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 5
call fcn.0059844a
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 4
call fcn.00598032
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], bl
call fcn.00598032
test byte [esi + 4], bl
je 0x41c8c4
lea edx, [esp + 0xc]
push 0x7176
push edx
call fcn.004b9db0
add esp, 8
push 0x61e150
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x3c], 6
push eax
call fcn.005982c7
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 7
call fcn.0059844a
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 6
call fcn.00598032
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], bl
call fcn.00598032
mov edx, dword [esi + 8]
lea ecx, [esp + 0x18]
push 0x14
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [esp + 0x18]
lea ecx, [esp + 8]
push eax
call fcn.0059840e
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00597da7
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x34], 0
call fcn.00598032
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4