joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4168c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x42106f
call fcn.0041ef90
sub esp, 0xd0
and dword [ebp - 0x30], 0
push ebx
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::CString_3
and byte [ebp - 0x16], 0
push 1
pop ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x70
mov byte [ebp - 0x28], 0x3a
mov byte [ebp - 0x27], 0x2f
mov byte [ebp - 0x26], 0x2f
mov byte [ebp - 0x25], 0x77
mov byte [ebp - 0x24], 0x77
mov byte [ebp - 0x23], 0x77
mov byte [ebp - 0x22], 0x2e
mov byte [ebp - 0x21], 0x73
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x77
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x6b
mov byte [ebp - 0x17], 0x2e
call fcn.0041ec12
cmp dword [0x454208], 0
jne 0x41697f
push 0x43e268
lea ecx, [ebp - 0x10]
call fcn.0041eb9a
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::operator_1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x416a15
lea eax, [ebp - 0xdc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
test eax, eax
je 0x4169f2
cmp dword [ebp - 0xdc], 0xffffff10
jl 0x4169cd
cmp dword [ebp - 0xdc], 0xf0
jg 0x4169cd
push 0x43e264
lea ecx, [ebp - 0x10]
call fcn.0041eb9a
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::operator_1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x416a15
push 0x43e260
lea ecx, [ebp - 0x10]
call fcn.0041eb9a
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::operator_1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x416a15
push 0x43e260
lea ecx, [ebp - 0x10]
call fcn.0041eb9a
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 5
call sub.MFC42u.DLL_CString::operator_1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call sub.MFC42u.DLL_CString::CString_2
mov dword [ebp - 0x30], ebx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x416a45
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x421084
call fcn.0041ef90
push ecx
push esi
push edi
push 0x42a5e8
xor esi, esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 0xfeff
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
pop ecx
cmp edi, esi
pop ecx
je 0x416aae
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
lea eax, [ebp - 0x10]
push 2
push eax
call esi
mov ecx, dword [ebp + 0xc]
add esp, 0x10
mov eax, dword [ecx]
push edi
mov eax, dword [eax - 8]
push eax
push 2
lea eax, [eax + eax + 1]
push eax
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call esi
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x417573
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4211a8
call fcn.0041ef90
sub esp, 0x410
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll__wfopen]
and dword [ebp - 4], 0
mov ebx, 0x43e2f0
push ebx
push dword [ebp + 8]
call esi
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
pop ecx
jne 0x4175aa
xor esi, esi
jmp 0x417682
and dword [ebp - 0x14], 0
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push eax
push 1
lea eax, [ebp - 0x14]
push 2
push eax
call edi
push dword [ebp - 0x10]
call dword [sym.imp.MSVCRT.dll_fclose]
and dword [0x454628], 0
add esp, 0x14
cmp word [ebp - 0x14], 0xfeff
jne 0x4175e5
mov dword [0x454628], 1
push ebx
push dword [ebp + 8]
call esi
pop ecx
mov esi, 0x400
pop ecx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::GetBuffer
and byte [ebp - 0x41c], 0
push ebx
push esi
lea eax, [ebp - 0x41c]
push 1
push eax
call edi
add esp, 0x10
test eax, eax
je 0x417676
cmp word [ebp - 0x14], 0xfeff
jne 0x417641
and byte [ebp + eax - 0x41c], 0
and byte [ebp + eax - 0x41b], 0
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push eax
call fcn.0041ed20
jmp 0x4175fd
and byte [ebp + eax - 0x41c], 0
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041eb9a
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::operator_1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::CString
jmp 0x4175fd
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop esi
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x417c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x417d37
push ecx
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x417e1c
push ebx
push ebp
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 1
push dword [esi + 0x10]
push 0x30
push eax
call ebx
movzx eax, word [esi]
push 5
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov dword [esp + 0x18], eax
call fcn.00417c45
and dword [esp + 0x14], 0
mov edi, dword [esp + 0x18]
pop ecx
mov ebp, eax
mov eax, dword [esp + 0x14]
cmp word [eax + 2], 0xffff
jne 0x417da1
add eax, 0x10
jmp 0x417da4
add eax, 8
movzx eax, word [eax]
cmp dword [esp + 0x10], eax
jge 0x417e05
cmp dword [esp + 0x10], 0
jne 0x417dbb
push 5
push dword [esi + 8]
jmp 0x417dbe
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
je 0x417e05
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp eax, dword [ebp + 0x14]
je 0x417de5
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x417dca
test edi, edi
je 0x417e05
push 1
push dword [esi + 0x10]
push 0x30
push edi
call ebx
push 1
push ebp
call fcn.00417ccc
inc dword [esp + 0x18]
pop ecx
pop ecx
mov ebp, eax
jmp 0x417d90
push dword [esi + 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
pop edi
pop ebp
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
pop ebx
pop esi
pop ecx
pop ecx
ret

Function at 0x417e58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x417e85
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x417e81
call esi
cmp eax, 3
je 0x417e81
or eax, 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret
push 0
test al, 0x10
pop eax
pop esi
setne al
inc eax
ret
Function at 0x417e90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1218
call fcn.0041efe0
and dword [ebp - 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call ebx
lea edx, [esi + eax*2]
mov eax, dword [0x44030c]
mov dword [ebp - 0x1218], eax
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1214]
cmp esi, edx
mov dword [ebp - 4], edx
rep stosd dword es:[edi], eax
jae 0x417fa9
cmp word [esi], 0x25
jne 0x417f67
mov dword [ebp - 0x10], esi
inc esi
inc esi
cmp esi, edx
mov dword [ebp - 0xc], esi
jae 0x417f86
cmp word [esi], 0x25
jne 0x417f34
and word [esi], 0
mov eax, dword [0x44030c]
mov dword [ebp - 0x218], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x214]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
push 0x208
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x417f3d
mov word [esi], 0x25
inc esi
inc esi
cmp esi, dword [ebp - 4]
jb 0x417ef2
jmp 0x417f86
mov eax, dword [ebp - 0x10]
mov word [eax], 0x25
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x1218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 8], 1
mov word [esi], 0x25
jmp 0x417f86
lea eax, [ebp - 0x1218]
push eax
call ebx
mov cx, word [esi]
add eax, eax
mov word [ebp + eax - 0x1218], cx
and word [ebp + eax - 0x1216], 0
mov edx, dword [ebp - 4]
inc esi
inc esi
cmp esi, edx
jb 0x417ed8
cmp dword [ebp - 8], 0
je 0x417fa9
lea eax, [ebp - 0x1218]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x418093
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
push edi
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
or ah, 2
mov ecx, 0x1ff
mov dword [ebp - 0x38], eax
mov eax, dword [0x44030c]
mov dword [ebp - 0x83c], eax
xor eax, eax
lea edi, [ebp - 0x838]
add esp, 0xc
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x83c]
push edx
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], str._UserProfile_
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x83c]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
pop ecx
pop ecx
pop edi
test eax, eax
je 0x418111
lea eax, [ebp - 0x83c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x14], 0
and dword [ebp - 0x34], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
leave
ret
Function at 0x4185d8
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + 0x10]
push 0x419
push dword [ebp + 0xc]
call esi
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x41d
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret

Function at 0x41a8e6
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 8], 0xffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
xor edi, edi
call ebx
test eax, eax
jle 0x41a927
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax], 9
je 0x41a924
push dword [ebp + 0x10]
add dword [ebp - 4], 2
inc edi
call ebx
cmp edi, eax
jl 0x41a90b
jmp 0x41a927
mov dword [ebp - 8], edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x48], 0
jne 0x41a96a
push str.NULL_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 6
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetCurrentObject]
test eax, eax
je 0x41a96a
lea ebx, [esi + 0x50]
push ebx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x4cc]
mov ebx, 0x100000
neg eax
sbb eax, eax
mov edi, dword [sym.imp.USER32.dll_DrawTextW]
and eax, 0xfff00000
add eax, ebx
or al, 0x24
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x41a9c7
mov ecx, dword [esi + 0x4cc]
neg ecx
sbb ecx, ecx
and ecx, 0xfff00000
add ecx, ebx
or ecx, 0x26
push ecx
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ecx + eax*2 + 2]
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x41acbf
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x814]
mov dword [esi], fcn.0040e2fc
push 7
push 2
push dword [esi + 0x820]
call fcn.0041ad59
mov esi, dword [esi + 0xc]
test esi, esi
je 0x41acf4
push 0x444
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret

Function at 0x41acf6
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x814]
push 7
push 2
push dword [esi + 0x820]
call fcn.0041ad59
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41ad29
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 0xc], 0
pop esi
ret
Function at 0x41ade6
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
mov ebx, str.Shell_TrayWnd
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x41ae23
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
cmp eax, edi
je 0x41ae23
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x41aee7
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x41ae89
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x41ae6d
dec eax
je 0x41ae4e
dec eax
je 0x41ae6d
dec eax
jne 0x41aee7
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
jmp 0x41aee7
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
jmp 0x41ae68
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x41aec6
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x41aeb4
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x41aee7
add eax, 0xffffffe2
jmp 0x41aee4
mov esi, dword [ebp + 8]
push edi
push esi
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41af1e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0
je 0x41af5d
call fcn.0041aeec
test eax, eax
je 0x41af5d
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
call fcn.0041ade6
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret 8
Function at 0x41b007
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [esi + 0x814], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, esi
call fcn.0041af88
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x41b03d
mov dword [esi + 0x818], eax
cmp dword [ebp + 0x18], 0
je 0x41b06f
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41b056
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x41b077
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
push 1
pop eax
pop esi
pop ebp
ret 0x14

Function at 0x41bcdd
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, ecx
push edi
push dword [ebx + 0x38]
call fcn.0041bbff
pop ecx
push dword [ebx + 0x30]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41be1e
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 0x30]
jne 0x41be1e
push dword [ebx + 0x24]
push dword [ebx + 0x38]
call dword [sym.imp.USER32.dll_GetSubMenu]
xor edi, edi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x41be1e
push esi
push 1
pop esi
mov ecx, ebx
push esi
mov dword [ebx + 0x14], esi
push dword [ebx + 0x24]
call fcn.0041b901
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
mov dword [ebp - 0x1c], edi
push dword [ebx + 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.0041b8d1
mov eax, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebx + 0x2c]
call esi
lea eax, [ebp - 0x1c]
push 2
push eax
push edi
push dword [ebx + 0x2c]
call esi
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], 0x14
mov dword [0x4547ec], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, esi
push eax
push esi
push 0x41be22
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4547f0], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 0x2c]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x140
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
cmp eax, esi
je 0x41bdf3
push 0xaffe0000
push eax
push 0x111
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
or dword [ebx + 0x10], 0xffffffff
push esi
push dword [ebx + 0x24]
mov ecx, ebx
call fcn.0041b901
push dword [0x4547f0]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x4547f0], esi
mov dword [0x4547ec], esi
mov dword [ebx + 0x18], esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x41cda4
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0x10]
cmp dword [ebp + 0x10], eax
push esi
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
setne al
and dword [ebp + 0x10], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x41cdf8
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x41ce02
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0xc]
cmp dword [ebp + 0xc], eax
push esi
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
setne al
and dword [ebp + 0xc], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x41ce44
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x41ce65
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc1c
push ebx
push esi
xor ebx, ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x41c]
push 0x208
push ecx
push eax
call fcn.0041ce4e
mov eax, dword [0x44030c]
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
mov dword [ebp - 0x214], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push 0x43e8a0
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call esi
lea eax, [ebp - 0x214]
push str.___bg
push eax
call esi
mov eax, dword [0x44030c]
add esp, 0x24
mov dword [ebp - 0xc1c], eax
mov ecx, 0x1ff
xor eax, eax
cmp dword [ebp + 0xc], ebx
lea edi, [ebp - 0xc18]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
setne al
lea ecx, [ebp - 4]
add eax, 0x80000001
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push 1
lea eax, [ebp - 0xc]
pop esi
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41cf83
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
je 0x41cf7f
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, esi
jmp 0x41cf85
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41db85
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [0x454838]
push edi
cmp ecx, ebx
je 0x41dbae
mov ecx, dword [ecx]
lea eax, [esi + 0x214]
mov dword [eax], ecx
add dword [0x45483c], 4
cmp dword [eax], ebx
jmp 0x41dbdb
push dword [esi + 0x20c]
lea edi, [esi + 0x214]
push 1
push 4
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jae 0x41dbd9
push 0x43e8ac
mov ecx, esi
call fcn.0041d6a6
cmp dword [edi], ebx
je 0x41dd15
mov ecx, esi
call fcn.0041d8f0
mov ecx, esi
call fcn.0041d717
lea edi, [esi + 0x220]
mov ecx, 0x3f1
mov eax, 0x20202020
mov dword [esp + 0xc], ebx
rep stosd dword es:[edi], eax
cmp dword [esi + 0x214], ebx
mov edi, 0xfc4
jbe 0x41dd15
push ebp
mov ebp, 0xfff
mov ecx, esi
call fcn.0041d916
mov ebx, eax
cmp bx, 0x100
jge 0x41dc79
mov eax, dword [0x454848]
test eax, eax
je 0x41dc51
mov ecx, dword [0x45484c]
lea edx, [ecx + 1]
cmp edx, dword [0x454844]
jge 0x41dc63
mov byte [ecx + eax], bl
inc dword [0x45484c]
jmp 0x41dc63
push dword [esi + 0x210]
movsx eax, bx
push eax
call dword [sym.imp.MSVCRT.dll_putc]
pop ecx
pop ecx
movsx eax, di
inc edi
and edi, ebp
inc dword [esp + 0x10]
mov byte [eax + esi + 0x220], bl
jmp 0x41dd04
mov ecx, esi
call fcn.0041da56
mov cx, ax
mov eax, edi
sub eax, ecx
lea ecx, [ebx - 0xfd]
dec eax
and eax, ebp
test cx, cx
jle 0x41dd04
movsx eax, ax
mov dword [esp + 0x14], eax
movsx eax, cx
add dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
and eax, ebp
movzx bx, byte [eax + esi + 0x220]
mov eax, dword [0x454848]
test eax, eax
je 0x41dcdb
mov ecx, dword [0x45484c]
lea edx, [ecx + 1]
cmp edx, dword [0x454844]
jge 0x41dced
mov byte [ecx + eax], bl
inc dword [0x45484c]
jmp 0x41dced
push dword [esi + 0x210]
movsx eax, bx
push eax
call dword [sym.imp.MSVCRT.dll_putc]
pop ecx
pop ecx
movsx eax, di
inc edi
and edi, ebp
inc dword [esp + 0x14]
dec dword [esp + 0x18]
mov byte [eax + esi + 0x220], bl
jne 0x41dca7
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x214]
jb 0x41dc1c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret