joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d3f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff340
mov ecx, 0x104
lea eax, [ebp - 0x820]
lea edx, [ebp - 0x410]
push ebx
push esi
push edi
lea edi, [ebp - 0x410]
mov ebx, dword [ebp + 0xc]
mov esi, 0x50c0b4
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x820]
mov ecx, 0x104
mov esi, 0x50c4c4
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc30]
mov ecx, 0x104
mov esi, 0x50c8d4
rep movsd dword es:[edi], dword [esi]
push eax
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043d05c
add esp, 0x14
mov al, byte [ebp - 0x820]
test al, al
je 0x43d465
lea esi, [ebp - 0x820]
jmp 0x43d467
xor esi, esi
test ebx, ebx
jne 0x43d46f
xor ebx, ebx
jmp 0x43d48d
push ebx
lea eax, [ebp - 0xc30]
push eax
call fcn.0043bff0
add esp, 8
lea ebx, [ebp - 0xc30]
mov al, byte [ebx]
test al, al
jne 0x43d48d
xor ebx, ebx
push 0x44
push 0
lea eax, [ebp - 0xc74]
push eax
call fcn.004cd264
add esp, 0xc
lea edx, [ebp - 0xc84]
push 0x10
push 0
push edx
call fcn.004cd264
add esp, 0xc
lea ecx, [ebp - 0xc74]
mov dword [ebp - 0xc74], 0x44
push ecx
call sub.KERNEL32.dll_GetStartupInfoA
push 0x8000
call sub.KERNEL32.dll_SetErrorMode
push 7
call sub.KERNEL32.dll_SetErrorMode
push 0x3c
push 0
lea eax, [ebp - 0xcc0]
push eax
call fcn.004cd264
mov dword [ebp - 0xcc0], 0x3c
mov dword [ebp - 0xcbc], 0x800400
lea edx, [ebp - 0x410]
add esp, 0xc
mov dword [ebp - 0xcb0], edx
mov dword [ebp - 0xca8], ebx
mov dword [ebp - 0xcac], esi
mov dword [ebp - 0xca4], 5
test byte [ebp + 0x11], 2
je 0x43d533
mov dword [ebp - 0xcb4], 0x5d006e
lea ecx, [ebp - 0xcc0]
push ecx
call sub.SHELL32.dll_ShellExecuteExA
test eax, eax
jne 0x43d547
xor eax, eax
jmp 0x43d54c
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d594
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff37c
mov ecx, 0x104
lea eax, [ebp - 0x820]
lea edx, [ebp - 0x410]
push ebx
push esi
push edi
lea edi, [ebp - 0x410]
mov ebx, dword [ebp + 0xc]
mov esi, 0x50cce4
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x820]
mov ecx, 0x104
mov esi, 0x50d0f4
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc30]
mov ecx, 0x104
mov esi, 0x50d504
rep movsd dword es:[edi], dword [esi]
push eax
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043d05c
add esp, 0x14
push 0x5d0074
lea eax, [ebp - 0x410]
push eax
call fcn.004cd308
add esp, 8
lea edx, [ebp - 0x820]
push edx
lea ecx, [ebp - 0x410]
push ecx
call fcn.004cd308
add esp, 8
test ebx, ebx
jne 0x43d629
xor ebx, ebx
jmp 0x43d647
push ebx
lea eax, [ebp - 0xc30]
push eax
call fcn.0043bff0
add esp, 8
lea ebx, [ebp - 0xc30]
mov al, byte [ebx]
test al, al
jne 0x43d647
xor ebx, ebx
push 0x8000
call sub.KERNEL32.dll_SetErrorMode
push 7
call sub.KERNEL32.dll_SetErrorMode
push 0x44
push 0
lea eax, [ebp - 0xc74]
push eax
call fcn.004cd264
add esp, 0xc
lea edx, [ebp - 0xc84]
push 0x10
push 0
push edx
call fcn.004cd264
add esp, 0xc
lea ecx, [ebp - 0xc74]
mov dword [ebp - 0xc74], 0x44
push ecx
call sub.KERNEL32.dll_GetStartupInfoA
lea eax, [ebp - 0xc84]
lea edx, [ebp - 0xc74]
push eax
push edx
push ebx
push 0
push 0x4000000
push 0
push 0
lea ecx, [ebp - 0x410]
push 0
push ecx
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
je 0x43d6ca
mov eax, dword [ebp - 0xc7c]
jmp 0x43d6cc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43d714
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x43d744
mov al, byte [ebx]
test al, al
je 0x43d744
lea edx, [ebp - 0x100]
push edx
push pe_nt_image_headers32
call sub.KERNEL32.dll_GetCurrentDirectoryA
push ebx
call fcn.004d35e4
pop ecx
call fcn.0043c118
mov esi, eax
push 5
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_WinExec
cmp eax, 0x21
jae 0x43d75d
xor eax, eax
mov dword [0x50a4fc], eax
mov dword [0x5f6d60], 0x4000
push esi
call fcn.0043c224
pop ecx
test ebx, ebx
je 0x43d78a
mov dl, byte [ebx]
test dl, dl
je 0x43d78a
lea ecx, [ebp - 0x100]
push ecx
call fcn.004d35e4
pop ecx
mov eax, dword [0x50a4fc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d814
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x43d84a
cmp byte [esi], 0
je 0x43d84a
lea eax, [ebp - 0x100]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push esi
call fcn.004d35e4
pop ecx
push edi
push 0x5d0076
lea edx, [ebp - 0x200]
push edx
call fcn.004d1ac0
add esp, 0xc
test ebx, ebx
je 0x43d87f
mov cl, byte [ebx]
test cl, cl
je 0x43d87f
push edi
push ebx
push 0x5d0085
lea eax, [ebp - 0x200]
push eax
call fcn.004d1ac0
add esp, 0x10
mov ebx, 1
push 5
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.dll_WinExec
cmp eax, 0x21
jae 0x43d899
xor ebx, ebx
test ebx, ebx
je 0x43d8bd
push 1
call fcn.0043d7a0
pop ecx
push 1
call fcn.0043d7a0
pop ecx
push 1
call fcn.0043d7a0
pop ecx
push 0
call fcn.0043d7a0
pop ecx
test esi, esi
je 0x43d8d4
mov al, byte [esi]
test al, al
je 0x43d8d4
lea edx, [ebp - 0x100]
push edx
call fcn.004d35e4
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e160
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e1ab
mov byte [ebx], 0
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
push ebx
call sub.KERNEL32.dll_GetComputerNameA
test eax, eax
je 0x43e188
mov al, 1
jmp 0x43e1ad
push 1
push pe_nt_image_headers32
push ebx
push 0x5d0282
push 0x5d0247
push 0x80000002
call fcn.00406a20
add esp, 0x18
mov al, 1
jmp 0x43e1ad
xor eax, eax
pop ebx
pop ecx
pop ebp
ret

Function at 0x43e470
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
mov ecx, 0x41
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x104]
push esi
push edi
lea edi, [ebp - 0x104]
mov esi, 0x50dce8
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x208]
mov ecx, 0x41
mov esi, 0x50ddec
rep movsd dword es:[edi], dword [esi]
push eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043e32c
add esp, 0xc
lea eax, [ebp - 0x104]
mov byte [ebp - 0x102], 0
push eax
call fcn.0043e3d8
pop ecx
xor edx, edx
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 0x101]
mov dword [ebp - 0x214], eax
xor edx, edx
mov dword [ebp - 0x20c], edx
push 0
push 0
push 0
lea ecx, [ebp - 0x228]
push ecx
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
jne 0x43e556
mov al, byte [ebp - 0x208]
test al, al
je 0x43e54f
movsx edx, byte [ebp - 0x207]
cmp edx, 0x3a
jne 0x43e54f
push pe_nt_image_headers32
lea ecx, [ebp - 0x104]
push ecx
call fcn.004d1004
add esp, 8
lea eax, [ebp - 0x208]
push eax
call fcn.004d35e4
pop ecx
lea edx, [ebp - 0x104]
push edx
call fcn.004d35e4
pop ecx
mov eax, 1
jmp 0x43e55f
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43fd40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [ebp + 0xc], 1
mov ebx, dword [ebp + 8]
jne 0x43fd57
push 5
push ebx
call sub.USER32.dll_ShowWindow
jmp 0x43fd5f
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 1
push 0
push ebx
call sub.USER32.dll_InvalidateRect
push ebx
call sub.USER32.dll_UpdateWindow
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_Sleep
pop ebx
pop ebp
ret

Function at 0x43fe9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x104
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x43fec2
mov esi, 0x5d06ab
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push ebx
call fcn.004cd3e4
pop ecx
test eax, eax
je 0x43feec
push ebx
call fcn.004cd3e4
pop ecx
movsx edx, byte [ebx + eax - 1]
cmp edx, 0x5c
je 0x43feec
push 0x5d06b6
push ebx
call fcn.004cd308
add esp, 8
push 0x5d06b8
push ebx
call fcn.004cd308
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4406cc
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 4
mov esi, ebx
push esi
push 0x5d0889
push 0x5d0853
push 0x80000002
call fcn.00406a5c
add esp, 0x14
push 4
push esi
push 0x5d08d0
push 0x5d089a
push 0x80000001
call fcn.00406a5c
add esp, 0x14
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x44076c
Capabilities:
Find taskbar

Disassembly:
push ebx
xor ebx, ebx
push 0
push 0x5d08e1
push ebx
push 0
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x440797
push 0x5d08ef
push 0
push 0
push ebx
call sub.USER32.dll_FindWindowExA
test eax, eax
jne 0x44076f
mov eax, ebx
pop ebx
ret

Function at 0x44079c
Capabilities:
Acquire debug privileges
Hide graphical window
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
push 0
call fcn.00441274
pop ecx
call fcn.0044076c
mov esi, eax
test esi, esi
jne 0x4407c3
call fcn.0044073c
mov eax, 1
jmp 0x4408a1
push 0
call fcn.004406cc
pop ecx
push esp
push esi
call sub.USER32.dll_GetWindowThreadProcessId
push 1
push 0x5d0901
call fcn.004038c8
add esp, 8
mov edx, dword [esp]
push edx
push 0
push 0x401
call sub.KERNEL32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x440825
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0x300
push 0x5d0912
call fcn.0043cdc4
add esp, 8
push 0x300
push 0x5d091f
call fcn.0043cdc4
add esp, 8
jmp 0x440838
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.dll_GetExitCodeProcess
push 1
push ebx
call sub.KERNEL32.dll_TerminateProcess
xor edx, edx
mov dword [esp], edx
push 4
mov ecx, dword [esp + 4]
push ecx
push 0x5d096a
push 0x5d0937
push 0x80000001
call fcn.00406a5c
add esp, 0x14
push 4
mov eax, dword [esp + 4]
push eax
push 0x5d09a6
push 0x5d0973
push 0x80000001
call fcn.00406a5c
add esp, 0x14
push 4
mov edx, dword [esp + 4]
push edx
push 0x5d09e4
push 0x5d09b1
push 0x80000001
call fcn.00406a5c
add esp, 0x14
call fcn.0044073c
mov eax, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x440c0c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov cl, byte [0x50e1b4]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov byte [ebp - 0x21], cl
test eax, eax
jne 0x440c29
xor eax, eax
jmp 0x440c5d
mov cl, byte [eax]
test cl, cl
jne 0x440c33
xor eax, eax
jmp 0x440c5d
test edx, edx
jne 0x440c3a
lea edx, [ebp - 0x21]
push 1
push edx
push eax
push 0x5d09fb
push 0x80000001
call fcn.00406a5c
add esp, 0x14
test eax, eax
je 0x440c5b
mov eax, 1
jmp 0x440c5d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x440d4c
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x440d30
xor eax, eax
mov dword [ebp - 0x24], eax
xor edx, edx
mov dword [ebp - 0x20], edx
call fcn.00401260
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.USER32.dll_LoadIconA
mov dword [ebp - 0x18], eax
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push 0
call sub.GDI32.dll_GetStockObject
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x30]
mov dword [ebp - 8], 0x5d0ab7
push edx
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 8], 0x5d0ac5
lea ecx, [ebp - 0x30]
push ecx
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 8], 0x5d0ad3
lea eax, [ebp - 0x30]
push eax
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 8], 0x5d0ae3
lea edx, [ebp - 0x30]
push edx
call sub.USER32.dll_RegisterClassExA
push 0
push 0x5d0aec
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x440e06
mov eax, ebx
jmp 0x440f6b
push 0
call fcn.00401260
push eax
push 0
push 0
push 0xc8
push 0xc8
push 0xa
push 0xa
push 0
push 0x5d0b08
push 0x5d0afa
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 0
call fcn.00401260
push eax
push 0
push ebx
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d0b10
push 0x5d0b09
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401260
push eax
push 0
push ebx
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d0b1e
push 0x5d0b17
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401260
push eax
push 0
push ebx
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d0b3e
push 0x5d0b30
push 0
call sub.USER32.dll_CreateWindowExA
mov esi, eax
push 0
call fcn.00401260
push eax
push 0
push esi
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d0b4f
push 0x5d0b3f
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401260
push eax
push 0
push esi
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d0b59
push 0x5d0b50
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401260
push eax
push 0
push esi
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d0b61
push 0x5d0b5a
push 0
call sub.USER32.dll_CreateWindowExA
mov eax, dword [ebp + 8]
dec eax
jne 0x440f69
jmp 0x440f51
push ebx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x440f69
lea edx, [ebp - 0x4c]
push edx
call sub.USER32.dll_TranslateMessage
lea ecx, [ebp - 0x4c]
push ecx
call sub.USER32.dll_DispatchMessageA
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.USER32.dll_GetMessageA
mov esi, eax
test eax, eax
je 0x440f69
inc esi
jne 0x440f35
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441484
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
cmp word [0x4dca5c], 0x6c
je 0x4414a0
xor eax, eax
jmp 0x44152a
mov ebx, 5
push 0
push 0x5d0d5d
call sub.USER32.dll_FindWindowA
test eax, eax
jne 0x4414d4
test esi, 0x10
jne 0x4414c1
xor eax, eax
jmp 0x44152a
dec ebx
test ebx, ebx
jne 0x4414ca
xor eax, eax
jmp 0x44152a
push 1
call fcn.004d934c
pop ecx
jmp 0x4414a5
push 0
call fcn.00441274
pop ecx
mov ebx, 5
push 0
push 0x5d0d6b
call sub.USER32.dll_FindWindowA
test eax, eax
je 0x44150d
push esi
call fcn.004413b0
pop ecx
mov edi, eax
push 0
push 0
call fcn.004013d8
add esp, 8
push esi
call fcn.004413b0
pop ecx
test esi, 0x10
je 0x441528
test edi, edi
jne 0x441528
dec ebx
test ebx, ebx
je 0x441528
push 1
call fcn.004d934c
pop ecx
jmp 0x4414e1
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44156c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, esi
and eax, 0x200
test eax, eax
jne 0x44158e
push 1
call fcn.004415e8
pop ecx
push 0
push edi
call sub.USER32.dll_MapVirtualKeyA
test esi, 1
mov byte [ebp - 1], al
je 0x4415b1
push 0
push 0
mov dl, byte [ebp - 1]
push edx
mov ecx, edi
push ecx
call sub.USER32.dll_keybd_event
test esi, 2
je 0x4415c9
push 0
push 2
mov al, byte [ebp - 1]
push eax
mov edx, edi
push edx
call sub.USER32.dll_keybd_event
and esi, 0x200
test esi, esi
jne 0x4415dd
push 2
call fcn.004415e8
pop ecx
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4415e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, 1
je 0x44172c
test byte [0x50e2bd], 1
je 0x441618
mov bl, 1
push 0x201
push 0x10
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 8
je 0x441635
mov bl, 1
push 0x201
push 0xa3
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 4
je 0x441652
mov bl, 1
push 0x201
push 0xa2
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 0x40
je 0x44166c
mov bl, 1
push 0x201
push 0x5b
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 0x10
je 0x441689
mov bl, 1
push 0x201
push 0xa4
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 0x20
je 0x4416a6
mov bl, 1
push 0x201
push 0xa5
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 0x80
je 0x4416dd
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
jne 0x441709
push 0x201
push 0x14
call fcn.0044156c
add esp, 8
push 0x202
push 0x14
call fcn.0044156c
add esp, 8
mov bl, 1
jmp 0x441709
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
je 0x441709
push 0x201
push 0x14
call fcn.0044156c
add esp, 8
push 0x202
push 0x14
call fcn.0044156c
add esp, 8
mov bl, 1
test bl, bl
je 0x44172c
push 0
push 0
call fcn.004013d8
add esp, 8
push 0x64
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.004013d8
add esp, 8
test esi, 2
je 0x441867
test byte [0x50e2bd], 1
je 0x441750
push 0x202
push 0x10
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 8
je 0x44176b
push 0x202
push 0xa3
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 4
je 0x441786
push 0x202
push 0xa2
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 0x40
je 0x44179e
push 0x202
push 0x5b
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 0x10
je 0x4417b9
push 0x202
push 0xa4
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 0x20
je 0x4417d4
push 0x202
push 0xa5
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 0x80
je 0x441809
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
jne 0x441833
push 0x201
push 0x14
call fcn.0044156c
add esp, 8
push 0x202
push 0x14
call fcn.0044156c
add esp, 8
jmp 0x441833
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
je 0x441833
push 0x201
push 0x14
call fcn.0044156c
add esp, 8
push 0x202
push 0x14
call fcn.0044156c
add esp, 8
test byte [0x50e2bd], 0x7d
je 0x441867
and dword [0x50e2bc], 0xffff82ff
push 0
push 0
call fcn.004013d8
add esp, 8
push 0x64
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.004013d8
add esp, 8
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x441870
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0
call fcn.00401260
push eax
push 0
push 0
push 6
push 0
push ebx
call fcn.0040151c
add esp, 0xc
push eax
push 5
push 0
push ebx
call fcn.0040151c
add esp, 0xc
push eax
push 7
push 0
push ebx
call fcn.0040151c
add esp, 0xc
push eax
push 8
push 0
push ebx
call fcn.0040151c
add esp, 0xc
push eax
push 0x90800000
push 0x5d0d79
push 0x50e2e1
push 0x8000008
call sub.USER32.dll_CreateWindowExA
mov esi, eax
push 0xda0000
push 0xffffffffffffffeb
push esi
call sub.USER32.dll_SetWindowLongA
push 0
mov eax, dword [0x50e2cc]
test eax, eax
jns 0x4418f2
add eax, 3
sar eax, 2
mov ecx, dword [0x50e2c8]
test ecx, ecx
lea edx, [eax + eax*2]
push edx
jns 0x441906
add ecx, 3
sar ecx, 2
shl ecx, 2
push ecx
push 3
push 0x64
push esi
call fcn.00443ec8
add esp, 0x18
push 0
push ebx
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
pop ebp
ret

Function at 0x444a64
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ecx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edx
test eax, eax
je 0x444a7c
mov cl, byte [eax]
test cl, cl
jne 0x444a7c
xor eax, eax
lea edx, [ebp - 4]
push edx
push 0
push 2
mov ecx, dword [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call sub.ADVAPI32.dll_LogonUserA
dec eax
jne 0x444aa9
mov eax, dword [ebp - 4]
test eax, eax
je 0x444aa5
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
jmp 0x444aae
call sub.KERNEL32.dll_GetLastError
pop ecx
pop ebp
ret

Function at 0x444e0c
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0x200
mov eax, dword [ebp + 0x10]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x444e53
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x20c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x444e68
lea eax, [ebp - 0x20c]
push eax
call fcn.00444ca0
pop ecx
test al, al
jne 0x444e68
xor eax, eax
jmp 0x444e97
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
push edx
push ecx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 4]
push eax
push edx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push ecx
push eax
push 0
call sub.ADVAPI32.dll_LookupAccountNameA
test eax, eax
jne 0x444e95
xor eax, eax
jmp 0x444e97
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445b38
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9c4
mov ecx, 0x80
lea eax, [ebp - 0x23c]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x23c]
mov byte [ebp - 1], 0
push esi
xor ebx, ebx
mov esi, 0x50e617
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x43c]
push esi
mov esi, 0x50e817
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x63c]
push esi
mov esi, 0x50ea17
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x3c]
push esi
mov esi, 0x50ec17
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00444ea0
add esp, 8
test al, al
jne 0x445bbd
mov ebx, 0xfffffd9d
jmp 0x445db9
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x3c]
push eax
push edx
lea ecx, [ebp - 0x63c]
push 0x5d153e
push ecx
call fcn.004d1ac0
add esp, 0x10
test esi, esi
jne 0x445d55
push 1
lea eax, [ebp - 0x43c]
push 0x200
push eax
lea edx, [ebp - 0x63c]
push 0x5d1543
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
jne 0x445c19
mov ebx, 0xfffffd9a
jmp 0x445db9
lea eax, [ebp - 0x43c]
push eax
call fcn.004d4cd8
pop ecx
push 0x5d1554
lea edx, [ebp - 0x43c]
push edx
call fcn.004cd4f5
add esp, 8
test eax, eax
je 0x445c40
mov bl, 1
lea eax, [ebp - 0x63c]
lea edx, [ebp - 0x43c]
push eax
push 0x5d1559
push edx
call fcn.004d1ac0
add esp, 0xc
lea ecx, [ebp - 0x43c]
lea eax, [ebp - 0x43c]
push 1
push 0x200
push ecx
push 0x5d1560
push eax
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x445c8a
mov byte [ebp - 1], 1
test bl, bl
je 0x445d55
mov dl, byte [ebp - 1]
test dl, dl
je 0x445d55
lea ecx, [ebp - 0x63c]
lea eax, [ebp - 0x43c]
push ecx
push 0x5d1571
push eax
call fcn.004d1ac0
add esp, 0xc
lea edx, [ebp - 0x43c]
push edx
push 0x80000002
call fcn.004069a0
add esp, 8
lea ecx, [ebp - 0x23c]
push ecx
push 0x5d1578
lea eax, [ebp - 0x43c]
push eax
call fcn.004d1ac0
add esp, 0xc
lea edx, [ebp - 0x43c]
lea ecx, [ebp - 0x63c]
push edx
push 0
push ecx
push 0x80000002
call fcn.00407420
add esp, 0x10
test al, al
jne 0x445d12
mov ebx, 0xfffffd97
jmp 0x445db9
lea eax, [ebp - 0x63c]
lea edx, [ebp - 0x43c]
push eax
push 0x5d157f
push edx
call fcn.004d1ac0
add esp, 0xc
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x43c]
push ecx
push 0
push eax
push 0x80000002
call fcn.00407420
add esp, 0x10
test al, al
jne 0x445d55
mov ebx, 0xfffffd93
jmp 0x445db9
push 1
lea eax, [ebp - 0x43c]
push 0x200
push eax
lea edx, [ebp - 0x63c]
push 0x5d1586
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
jne 0x445d87
mov ebx, 0xfffffd90
jmp 0x445db9
mov al, byte [ebp - 0x43c]
test al, al
jne 0x445d98
mov ebx, 0xfffffd8d
jmp 0x445db9
xor ebx, ebx
test esi, esi
je 0x445db9
push 0x200
push esi
lea eax, [ebp - 0x43c]
push eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
test eax, eax
jne 0x445db9
mov ebx, 0xfffffd89
test ebx, ebx
je 0x445dc4
test esi, esi
je 0x445dc4
mov byte [esi], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret