joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51877c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov edi, dword [ebp + 8]
add edi, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov word [eax], 0
test dl, dl
je 0x5187b6
test bl, bl
je 0x5187a7
mov eax, dword [edi]
mov esi, dword [eax + 0x21c]
jmp 0x5187b1
mov eax, dword [edi]
movzx esi, byte [eax + 0x3ad]
dec esi
xor bl, 1
jmp 0x5187c7
mov eax, dword [edi]
mov edx, dword [eax + 0x3c8]
mov eax, dword [edi]
call fcn.00508e4c
mov esi, eax
mov eax, esi
test bl, bl
je 0x5187d0
inc esi
jmp 0x5187d1
dec esi
mov edx, dword [edi]
cmp esi, dword [edx + 0x21c]
jl 0x5187e6
mov edx, dword [edi]
movzx esi, byte [edx + 0x3ad]
jmp 0x518806
mov edx, dword [edi]
movzx edx, byte [edx + 0x3ad]
cmp esi, edx
jge 0x518806
mov edx, dword [edi]
mov esi, dword [edx + 0x21c]
mov edx, dword [edi]
movzx edx, byte [edx + 0x3ad]
sub esi, edx
cmp eax, esi
je 0x51884a
jmp 0x518822
test bl, bl
je 0x518813
inc esi
jmp 0x518814
dec esi
test esi, esi
jl 0x51884a
mov eax, dword [edi]
cmp esi, dword [eax + 0x21c]
jge 0x51884a
mov eax, dword [edi]
mov edx, esi
call fcn.00508e40
mov edx, eax
mov eax, dword [edi]
call fcn.00517860
test al, al
je 0x51880c
mov eax, dword [edi]
mov edx, esi
call fcn.00508e40
mov edx, eax
mov eax, dword [edi]
call fcn.00517934
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x519728
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x519753
cmp byte [0x561da0], 0
jne 0x519753
mov byte [ebx + 0x3e4], 1
cmp byte [ebx + 0x3e4], 0
je 0x519762
cmp dword [esi + 4], 0
je 0x51978f
test byte [ebx + 0x55], 1
jne 0x519781
mov eax, ebx
call fcn.0047a75c
test eax, eax
jne 0x519781
mov edx, esi
mov eax, ebx
call fcn.0047f804
jmp 0x5198c1
mov edx, esi
mov eax, ebx
call fcn.0047b6e0
jmp 0x5198c1
push 0
call sub.user32.dll_GetDC
mov edi, eax
mov eax, ebx
call fcn.00476b60
push eax
mov eax, ebx
call fcn.00476b1c
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5198ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
push eax
mov eax, ebx
call fcn.0047dab0
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.gdi32.dll_CreateRectRgn
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004782e4
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectClipRgn
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00519728
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x60]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x54]
push eax
lea edx, [ebp - 0x70]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x68]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x50]
push eax
mov eax, ebx
call fcn.0047dab0
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5198c1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52309c
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x5230b6
add esp, 0xfffffff0
call fcn.00403854
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x523144
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.004034c0
mov dword [edi + 4], esi
lea eax, [edi + 0x40]
call fcn.004df698
mov byte [edi + 0x34], 1
mov dl, 1
mov eax, dword [0x41bc98]
call fcn.004034c0
mov dword [edi + 0x28], eax
mov dl, 1
mov eax, dword [0x41bc98]
call fcn.004034c0
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x4be870]
call fcn.004bea10
mov esi, eax
mov dword [edi + 0x30], esi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], 0x523a44
lea eax, [ebp - 0x10]
call fcn.004190d4
lea edx, [ebp - 0x10]
lea eax, [edi + 0x18]
call fcn.004111d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52314b
lea eax, [ebp - 0x10]
call fcn.00410dc0
ret

Function at 0x529af4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a0], edx
mov esi, eax
xor eax, eax
push ebp
push 0x529c45
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x529b40
cmp dword [ebp - 0x8c], 1
je 0x529b44
xor ebx, ebx
jmp 0x529b46
mov bl, 1
mov dl, 1
mov eax, dword [0x440418]
call fcn.004404e8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x529c20
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00440588
test bl, bl
je 0x529b83
mov edx, 0x529c5c
mov eax, dword [ebp - 4]
call fcn.004405ec
jmp 0x529b90
mov edx, 0x529c90
mov eax, dword [ebp - 4]
call fcn.004405ec
lea ecx, [ebp - 0x1a0]
mov edx, 0x529cc8
mov eax, dword [ebp - 4]
call fcn.0044081c
mov edx, dword [ebp - 0x1a0]
lea eax, [esi + 0x1c]
call fcn.004043d4
lea ecx, [ebp - 0x1a4]
mov edx, 0x529ce0
mov eax, dword [ebp - 4]
call fcn.0044081c
mov edx, dword [ebp - 0x1a4]
lea eax, [esi + 0x20]
call fcn.004043d4
mov eax, dword [ebp - 4]
call fcn.00440558
cmp dword [esi + 0x1c], 0
jne 0x529c0a
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19c]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [esi + 0x1c]
lea edx, [ebp - 0x19c]
mov ecx, pe_nt_image_headers32
call fcn.004045f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529c27
mov eax, dword [ebp - 4]
call fcn.004034f0
ret
Function at 0x52e9bc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x52e9e1
cmp dword [esp + 4], 5
jb 0x52e9e1
mov al, 1
jmp 0x52e9e3
xor eax, eax
add esp, 0x94
ret
Function at 0x4010b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareWildTangent
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push str.InstallSemaphore_1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
leave
ret

Function at 0x4010df
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareWildTangent
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401161
push edi
movzx edx, ax
push 7
pop ecx
mov eax, edx
shl edx, 0x10
or eax, edx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.InstallSemaphore_1
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x1e
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
test eax, eax
jne 0x401161
lea eax, [ebp - 0x2c]
push eax
push str.Success
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x401161
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x40116f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401194
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x32
cmp esi, 0xfa
jb 0x401175
pop esi
pop ebp
ret

Function at 0x401197
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x664
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push edi
push dword [ebp + 8]
lea eax, [esp + 0x46c]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x407880
lea eax, [esp + 0x46c]
push eax
call edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401238
cmp word [esp + 0x3c], 0x2e
je 0x401228
push dword [ebp + 8]
lea eax, [esp + 0x264]
push eax
call esi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x264]
push eax
call edi
test byte [esp + 0x10], 0x10
lea eax, [esp + 0x260]
push eax
je 0x401222
call fcn.00401197
jmp 0x401227
call fcn.0040116f
pop ecx
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4011e8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40124f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401271
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
pop ebp
ret
mov al, 1
pop ebp
ret
Function at 0x401275
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
push 0x44
pop edx
push 0x10
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x150]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x150], edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp byte [ebp + 0x10], bl
je 0x4012dc
push 0xffffffffffffffff
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x40]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012e6
Capabilities:
Accept command line arguments
Get common file path
Get program files directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push 1
push 0x26
lea eax, [ebp - 0x25c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40130e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x407884
lea eax, [ebp - 0x25c]
push eax
call edi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040124f
pop ecx
test al, al
jne 0x401339
push 2
jmp 0x401308
push str.App_Update_
lea eax, [ebp - 0x25c]
push eax
call edi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040124f
lea eax, [ebp - 0x25c]
push eax
call fcn.0040124f
pop ecx
pop ecx
test al, al
jne 0x401369
push 3
jmp 0x401308
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4078c4
lea eax, [ebp - 0x54]
push 0x28
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 0x10
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x464]
push eax
call ebx
push str.patch_
lea eax, [ebp - 0x464]
push eax
call edi
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x464]
push eax
call edi
push str..exe
lea eax, [ebp - 0x464]
push eax
call edi
lea eax, [ebp - 0x464]
push eax
call fcn.0040103d
pop ecx
test al, al
je 0x4014a4
push esi
push 0x4078f4
mov esi, 0x40a780
push esi
call ebx
lea eax, [ebp - 0x464]
push eax
push esi
call edi
push 0x4078f8
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ebx, [eax + 2]
jmp 0x40140c
add ebx, 2
cmp ax, 0x22
je 0x401414
movzx eax, word [ebx]
test ax, ax
jne 0x401403
call fcn.004010b0
push ebx
push esi
call edi
push 1
lea eax, [ebp - 0x25c]
push eax
push esi
call fcn.00401275
add esp, 0xc
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrW]
push str._park_
push esi
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x4014a3
push str._nolaunchapp
push esi
call ebx
test eax, eax
jne 0x4014a3
add dword [ebp - 4], 0xe
push 0x4078f4
push dword [ebp - 4]
call ebx
xor ebx, ebx
cmp eax, ebx
je 0x4014a3
push dword [ebp - 4]
xor ecx, ecx
mov esi, 0x40c6c0
push esi
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
call fcn.004010df
test al, al
je 0x401490
push str.__EventExecute__GlobalWTPARKEXEC___SignalExecute
jmp 0x401495
push str.__EventTerminate__GlobalWTPARKTERM___SignalTerminate
push esi
call edi
push ebx
push ebx
push esi
call fcn.00401275
add esp, 0xc
pop esi
lea eax, [ebp - 0x25c]
push eax
call fcn.00401197
pop ecx
pop edi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x40344b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x409310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004023a4
and dword [ebp - 0x14], 0
cmp dword [0x40a41c], 0
mov dword [ebp - 0x18], eax
jne 0x4034fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4035a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4035a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40a41c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40a420], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40a424], eax
call edi
push eax
call esi
mov dword [0x40a42c], eax
test eax, eax
je 0x4034fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40a428], eax
mov eax, dword [0x40a428]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403557
cmp dword [0x40a42c], ecx
je 0x403557
push eax
call esi
push dword [0x40a42c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403557
test ebx, ebx
je 0x403557
call edi
test eax, eax
je 0x40354e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40354e
test byte [ebp - 8], 1
jne 0x403557
or dword [ebp + 0x10], 0x200000
jmp 0x40358a
mov eax, dword [0x40a420]
cmp eax, dword [ebp - 0x18]
je 0x40358a
push eax
call esi
test eax, eax
je 0x40358a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40358a
mov eax, dword [0x40a424]
cmp eax, dword [ebp - 0x18]
je 0x40358a
push eax
call esi
test eax, eax
je 0x40358a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40a41c]
call esi
test eax, eax
je 0x4035a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4035a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004037b6
leave
ret

Function at 0x4037b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409310]
jne 0x4037c0
repz ret
jmp fcn.00404a26
Function at 0x4104dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4104eb
pop dword [ebp - 0x20]
mov eax, 0x68e2aea3
add eax, 0x975e5648
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x40bc6
push 0
mov eax, 0xb4846e55
add eax, 0x4bbde3c3
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x431a01f7
add ecx, 0xbce651ee
xor edx, edx
add edx, eax
mov ebx, 0x4f4db6ee
add ebx, 0xb0f59d12
add ebx, dword [ebp - 0x20]
mov esi, 0x2fb75216
xor dword [ebp - 8], 0x7b649a55
mov edi, dword [ebx]
sub dword [ebp - 0xc], eax
sub edi, esi
xor dword [ebp - 4], esi
mov dword [edx], edi
add dword [ebp - 4], 0x83d11f01
add edx, 0x2ce34914
add edx, 0xd31cb6f0
add ebx, 4
loop 0x410546
add eax, 0xbed06c5
sub eax, 0xbebc45e
xor ebx, ebx
add ebx, eax
add eax, 0xf63c2fc7
sub eax, 0xf63c2fc2
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x41d2d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e95e
and dword [ebp - 4], 0
cmp dword [0x4310f8], 0
mov ebx, eax
jne 0x41d386
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d437
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x42d324
push edi
call esi
test eax, eax
je 0x41d437
push eax
call fcn.004104dc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4310f8], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4310fc], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431100], eax
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431108], eax
test eax, eax
je 0x41d386
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431104], eax
mov eax, dword [0x431104]
cmp eax, ebx
je 0x41d3de
cmp dword [0x431108], ebx
je 0x41d3de
push eax
call fcn.004104dc
push dword [0x431108]
mov esi, eax
call fcn.004104dc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d3de
test edi, edi
je 0x41d3de
call esi
test eax, eax
je 0x41d3d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d3d5
test byte [ebp - 0xc], 1
jne 0x41d3de
or dword [ebp + 0x10], 0x200000
jmp 0x41d417
mov eax, dword [0x4310fc]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d417
mov eax, dword [0x431100]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4310f8]
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d437
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d439
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5709d0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x4022e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5973cc]
xor eax, esp
mov dword [esp + 0x114], eax
push pe_nt_image_headers32
lea eax, [esp + 8]
push 0
push eax
call fcn.00506190
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 5
jne 0x40232c
mov eax, 1
cmp dword [esp + 8], eax
je 0x40232e
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.005060ef
add esp, 0x118
ret

Function at 0x402350
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x5973cc]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x118
lea eax, [esp + 8]
push 0
push eax
call fcn.00506190
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4023a5
mov al, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.005060ef
add esp, 0x120
ret
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x40238e
jne 0x4023bb
mov eax, 1
cmp dword [esp + 8], eax
jae 0x4023bd
xor al, al
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.005060ef
add esp, 0x120
ret

Function at 0x4044f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x553eeb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5973cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.005046e6
push 4
mov dword [esp + 0x24], 0
call fcn.00506654
mov edi, eax
add esp, 4
test edi, edi
je 0x404572
call fcn.00504a31
mov dword [edi], eax
call fcn.0050485f
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00504783
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404567
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.005047ab
jmp 0x404574
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret