joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55dad0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
cmp dword [0x8211ac], 0
je 0x55db54
mov dword [0x8211b0], 1
cmp dword [0x8211ac], 0
je 0x55db30
mov esi, esp
push 0x19
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00535fca
cmp dword [ebp + 8], 0
jne 0x55db52
cmp dword [0x8211ac], 0
je 0x55db4b
mov eax, 1
jmp 0x55dd23
xor eax, eax
jmp 0x55dd23
jmp 0x55db03
cmp dword [ebp + 8], 0
jne 0x55db61
xor eax, eax
jmp 0x55dd23
push 0x104
mov eax, dword [ebp + 8]
push eax
push 0x8211b8
call fcn.00535647
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.005340b7
add esp, 4
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0
jmp 0x55db9c
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movsx ecx, byte [eax + 0x8211b8]
test ecx, ecx
je 0x55dc08
cmp dword [ebp - 8], 0
je 0x55dbd2
mov eax, dword [ebp - 0x20]
movsx ecx, byte [eax + 0x8211b8]
cmp ecx, 0x29
jne 0x55dbc6
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x8212c0], 0x20
jmp 0x55db93
mov eax, dword [ebp - 0x20]
movsx ecx, byte [eax + 0x8211b8]
cmp ecx, 0x28
jne 0x55dbf4
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x8212c0], 0x20
jmp 0x55db93
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov dl, byte [ecx + 0x8211b8]
mov byte [eax + 0x8212c0], dl
jmp 0x55db93
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x8212c0], 0
push 0x8212c0
push 0x8211b8
call fcn.00533626
add esp, 8
test eax, eax
je 0x55dc31
call fcn.0053613c
test eax, eax
je 0x55dc74
mov esi, esp
push 0x8211b8
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp esi, esp
call fcn.00535fca
mov dword [0x8211ac], 0
mov dword [0x8211b0], 1
mov esi, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00535fca
xor eax, eax
jmp 0x55dd23
mov dword [ebp - 0x14], 0
mov dword [0x8211b0], 0
cmp dword [0x8211b0], 0
jne 0x55dd03
call fcn.00533c84
test eax, eax
jne 0x55dd03
mov dword [0x8211ac], 1
cmp dword [ebp - 0x14], 0
je 0x55dccf
mov esi, esp
push 0x8212c0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp esi, esp
call fcn.00535fca
push 0x8211b0
push 0x2ee
call fcn.00533b49
add esp, 8
jmp 0x55dcf5
mov esi, esp
push 0x8211b8
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp esi, esp
call fcn.00535fca
push 0x8211b0
push 0x5dc
call fcn.00533b49
add esp, 8
xor eax, eax
cmp dword [ebp - 0x14], 0
sete al
mov dword [ebp - 0x14], eax
jmp 0x55dc85
mov esi, esp
push 0x8211b8
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp esi, esp
call fcn.00535fca
mov dword [0x8211ac], 0
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret 4
Function at 0x58bcc0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push ebx
push esi
push edi
lea edi, [ebp - 0x43c]
mov ecx, 0x10f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x818f7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call fcn.00533469
add esp, 0xc
mov byte [ebp - 0x224], 0
push 0x103
push 0
lea eax, [ebp - 0x223]
push eax
call fcn.00533469
add esp, 0xc
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x378], 0
push 0x13c
push 0
lea eax, [ebp - 0x374]
push eax
call fcn.00533469
add esp, 0xc
cmp dword [ebp - 0xc], 0
je 0x58bd62
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x58bd69
xor eax, eax
jmp 0x58bed9
push 0x104
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.00535647
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.00533662
add esp, 8
lea eax, [ebp - 0x224]
push eax
call fcn.00535525
add esp, 4
mov eax, dword [0x824e90]
add eax, 0xf
cmp dword [0x824e8c], eax
jle 0x58bdc0
mov eax, dword [0x824e8c]
mov dword [0x824e90], eax
mov eax, dword [0x824e8c]
add eax, 1
mov dword [0x824e8c], eax
mov esi, esp
lea eax, [ebp - 0x378]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp esi, esp
call fcn.00535fca
mov dword [ebp - 0x230], eax
mov eax, dword [0x824e8c]
sub eax, 1
mov dword [0x824e8c], eax
cmp dword [ebp - 0x230], 0xffffffff
jne 0x58be0d
xor eax, eax
jmp 0x58bed9
cmp dword [0x7e62e0], 0
je 0x58bebe
movsx eax, byte [ebp - 0x34c]
cmp eax, 0x2e
je 0x58be7e
lea eax, [ebp - 0x34c]
push eax
call fcn.00532325
add esp, 4
test eax, eax
jne 0x58be7e
movsx eax, byte [ebp - 0x224]
cmp eax, 0x2a
jne 0x58be7c
movsx eax, byte [ebp - 0x222]
cmp eax, 0x2a
jne 0x58be7c
movsx eax, byte [ebp - 0x223]
cmp eax, 0x3f
je 0x58be7c
movsx eax, byte [ebp - 0x223]
push eax
lea ecx, [ebp - 0x34c]
push ecx
call fcn.00533644
add esp, 8
test eax, eax
je 0x58be7a
jmp 0x58bebe
jmp 0x58be7e
jmp 0x58bebe
mov esi, esp
lea eax, [ebp - 0x378]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp esi, esp
call fcn.00535fca
test eax, eax
jne 0x58beb9
mov esi, esp
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, esp
call fcn.00535fca
xor eax, eax
jmp 0x58bed9
jmp 0x58be0d
mov esi, esp
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, esp
call fcn.00535fca
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x58bf0c]
call fcn.0053491d
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00535561
add esp, 0x43c
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret 4
Function at 0x6197f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
push ebx
push esi
push edi
lea edi, [ebp - 0x298]
mov ecx, 0xa6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x818f7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10c], 0
push 0x103
push 0
lea eax, [ebp - 0x10b]
push eax
call fcn.00533469
add esp, 0xc
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x1b0], 0
push 0x8c
push 0
lea eax, [ebp - 0x1ac]
push eax
call fcn.00533469
add esp, 0xc
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1c8], 0
cmp dword [ebp + 8], 0
jne 0x619880
xor eax, eax
jmp 0x619a26
mov dword [ebp - 0x1c8], 1
push 0x90
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00533469
add esp, 0xc
push str.fTender.cfg
lea eax, [ebp - 0x10c]
push eax
call fcn.00535f3e
add esp, 8
push 0
push 0
push 0
push 0x20
push 3
push 0
push 7
push closesocket
lea eax, [ebp - 0x10c]
push eax
call fcn.00532dd4
add esp, 0x24
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
jne 0x619916
mov dword [ebp - 0x1d4], 0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00535fca
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
jmp 0x619a26
mov esi, esp
push 0
lea eax, [ebp - 0x1bc]
push eax
push 0x90
lea ecx, [ebp - 0x1b0]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, esp
call fcn.00535fca
test eax, eax
jne 0x619983
mov eax, dword [0x818818]
add eax, 0x30
push eax
push str.e:userskerrydocuments_visual_studio_2010projectspaula__butchered__network.c
push str.ReadTenderTypesFlagsLegacyTAMS
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.00533ee6
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
jmp 0x619a26
cmp dword [ebp - 0x1bc], 0x90
jae 0x6199af
push 0x90
push 0
lea eax, [ebp - 0x1b0]
push eax
call fcn.00533469
add esp, 0xc
mov dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x1b0], 0
jl 0x6199c1
cmp dword [ebp - 0x1b0], 7
jle 0x6199e1
push 0x90
push 0
lea eax, [ebp - 0x1b0]
push eax
call fcn.00533469
add esp, 0xc
mov dword [ebp - 0x1c8], 0
cmp dword [ebp + 8], 0
je 0x6199f7
mov ecx, 0x24
lea esi, [ebp - 0x1b0]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x818818]
add eax, 0x47
push eax
push str.e:userskerrydocuments_visual_studio_2010projectspaula__butchered__network.c
push str.ReadTenderTypesFlagsLegacyTAMS
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.00533ee6
mov dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x1c8]
push edx
mov ecx, ebp
push eax
lea edx, [0x619a58]
call fcn.0053491d
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00535561
add esp, 0x298
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret
Function at 0x67e1a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov eax, dword [0x818ac0]
add eax, 7
push eax
push str.e:userskerrydocuments_visual_studio_2010projectspaula__butchered__security.c
push 0x79de3c
call fcn.00534fa8
push eax
call fcn.00533fe0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x67e1f3
xor eax, eax
jmp 0x67e236
mov eax, dword [ebp - 8]
push eax
push 1
push 4
lea ecx, [ebp + 8]
push ecx
call fcn.00533400
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00535d27
add esp, 4
mov dword [ebp - 8], 0
mov esi, esp
push 2
call fcn.00534fa8
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp esi, esp
call fcn.00535fca
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret
Function at 0x6b6950
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 8], 0
xor eax, eax
mov word [ebp - 7], ax
mov al, byte [ebp + 0xc]
mov byte [ebp - 8], al
mov al, byte [ebp + 0x10]
mov byte [ebp - 7], al
mov al, byte [ebp + 0x14]
mov byte [ebp - 6], al
push 0
push 3
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005329b0
cmp eax, 3
jne 0x6b69a7
mov eax, 1
jmp 0x6b69a9
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x6b69d0]
call fcn.0053491d
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret

Function at 0x6b7780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov ecx, dword [ebp + 8]
push ecx
call fcn.00534fbc
cmp dword [ebp - 8], 0
ja 0x6b77c1
xor eax, eax
jmp 0x6b77d4
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005351b0
push edx
mov ecx, ebp
push eax
lea edx, [0x6b77fc]
call fcn.0053491d
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret

Function at 0x6ba640
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.006ba900
add esp, 8
test eax, eax
jne 0x6ba680
mov eax, 1
jmp 0x6ba6b5
mov esi, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
cmp esi, esp
call fcn.00535fca
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call fcn.006ba9a0
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret
Function at 0x6ba6f0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.006ba900
add esp, 8
test eax, eax
jne 0x6ba730
mov eax, 2
jmp 0x6ba765
mov esi, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
cmp esi, esp
call fcn.00535fca
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call fcn.006ba9a0
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret

Function at 0x6ba7a0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.006ba900
add esp, 8
test eax, eax
jne 0x6ba7e0
mov eax, 1
jmp 0x6ba815
mov esi, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
cmp esi, esp
call fcn.00535fca
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call fcn.006ba9a0
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret
Function at 0x70b750
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov esi, esp
push 0xd
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.00535fca
cwde
and eax, 0x8000
je 0x70b799
xor eax, eax
jmp 0x70b80b
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x1b
jmp 0x70b7b2
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x87
jge 0x70b808
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.00535fca
movsx ecx, ax
and ecx, 0x8000
je 0x70b7fc
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x955dc0]
test ecx, ecx
jne 0x70b7fa
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x955dc0], 1
mov dword [ebp - 8], 1
jmp 0x70b808
jmp 0x70b806
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x955dc0], 0
jmp 0x70b7a9
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret
Function at 0x70d300
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea edi, [ebp - 0x104]
mov ecx, 0x41
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x818f7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x40], 0
mov eax, dword [ebp + 8]
mov dword [0x955d58], eax
cmp dword [ebp + 8], 0
je 0x70d36e
call fcn.00533cd9
mov dword [0x955d5c], eax
jmp 0x70d387
call fcn.00533cd9
sub eax, dword [0x955d5c]
cmp eax, 0xde
jae 0x70d387
xor eax, eax
jmp 0x70d4b2
cmp dword [0x955d58], 0
jne 0x70d4b0
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.00535fca
cwde
and eax, 0x8000
je 0x70d493
mov esi, esp
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp esi, esp
call fcn.00535fca
cmp dword [ebp - 0x34], 0
jne 0x70d3d2
call fcn.00535bec
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x70d491
cmp dword [ebp - 0x40], 0
jne 0x70d491
mov esi, esp
lea eax, [ebp - 0x28]
push eax
call fcn.00535bec
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp esi, esp
call fcn.00535fca
mov esi, esp
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp esi, esp
call fcn.00535fca
mov esi, eax
mov edi, esp
push 6
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp edi, esp
call fcn.00535fca
add eax, dword [ebp - 0x24]
lea eax, [eax + esi + 3]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
cdq
mov ecx, 3
idiv ecx
mov edx, dword [ebp - 0x20]
sub edx, eax
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x28]
jle 0x70d48a
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jge 0x70d48a
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x24]
jle 0x70d48a
mov esi, esp
push 0xf
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp esi, esp
call fcn.00535fca
add eax, dword [ebp - 0x24]
cmp dword [ebp - 0xc], eax
jge 0x70d48a
mov dword [0x955d3c], 1
call fcn.00533cd9
mov dword [0x955d40], eax
jmp 0x70d491
mov dword [ebp - 0x40], 1
jmp 0x70d49a
mov dword [ebp - 0x40], 0
mov esi, esp
push 0x16
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00535fca
jmp 0x70d387
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x70d4e4]
call fcn.0053491d
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00535561
add esp, 0x104
cmp ebp, esp
call fcn.00535fca
mov esp, ebp
pop ebp
ret 4
Function at 0x72da30
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x818f7c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x72da69
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00535561
mov esp, ebp
pop ebp
ret
mov ecx, dword [str.odbccp32.dll]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0x7a97c4
lea eax, [ebp - 0x318]
push 0x20a
push eax
call fcn.00533793
add esp, 0x14
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00535561
mov esp, ebp
pop ebp
ret
Function at 0x40ca39
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x105
mov dword [ebp - 0x218], 0xffff
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40cae7
push ecx
lea eax, [ebp - 0x214]
mov edx, esi
push eax
lea ecx, [ebp - 0x210]
call fcn.0040c131
test eax, eax
js 0x40cae7
mov eax, dword [ebp - 0x214]
sub esi, eax
push ecx
push 0x401668
push ecx
lea ecx, [ebp - 0x210]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x40cae7
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40cae7
test al, 0x10
jne 0x40cae7
xor eax, eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x210]
mov word [ebp - 0x214], ax
call fcn.00422900
test eax, eax
mov ax, word [ebp - 0x214]
jne 0x40caee
mov ax, word [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x40d50e
Capabilities:
Delete registry value
Get common file path
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x218], ecx
push edi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], edi
push eax
push edi
push 2
push edi
push edi
push edi
mov esi, 0x4017c0
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d57f
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push edi
push 0x40180c
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x214]
push eax
push edi
push 2
push edi
push edi
push edi
push esi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d6fd
cmp dword [ebp - 0x218], 0xd2af9
je 0x40d5d0
cmp dword [ebp - 0x218], 0xc00d2afb
je 0x40d5d0
push 0x401828
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x40d6d4
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x21c], edi
call fcn.0040d45a
test eax, eax
jne 0x40d602
push 8
lea eax, [ebp - 0x228]
push eax
push 3
push edi
push 0x401828
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x21c]
push eax
push 2
push edi
push 0x401848
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d6d4
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40d6c8
push 0x40429c
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.0040c045
test eax, eax
js 0x40d6c8
push ecx
lea eax, [ebp - 0x220]
mov edx, esi
push eax
lea ecx, [ebp - 0x210]
call fcn.0040c131
test eax, eax
js 0x40d6c8
mov eax, dword [ebp - 0x220]
sub esi, eax
push ecx
push 0x4018ac
push ecx
lea ecx, [ebp - 0x210]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x40d6c8
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40d696
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push edi
push 0x4018c0
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push edi
push 0x40180c
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret