joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x20]
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x24]
mov eax, 0xc3ee
and word [esi + 0x42c0], ax
mov eax, dword [ebp + 0x1c]
push edx
push eax
mov byte [esi + 0x42c3], 0
mov dword [esi + 0x42ca], ecx
call fcn.0041f4f0
mov ebx, dword [ebp + 8]
add esp, 8
mov ecx, ebx
mov dword [esi + 0x42c6], eax
call fcn.004a4a70
test eax, eax
jne 0x40d572
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov ecx, dword [ebp + 0x24]
push edi
push ecx
mov ecx, esi
call fcn.00408dd0
mov edi, eax
test edi, edi
je 0x40d644
cmp edi, 1
jne 0x40d59b
mov edx, 0x400
or word [esi + 0x42c0], dx
jmp 0x40d5bf
cmp edi, 2
jne 0x40d5ae
mov eax, 0x800
or word [esi + 0x42c0], ax
jmp 0x40d5bf
cmp edi, 3
jne 0x40d5bf
mov ecx, 0x1000
or word [esi + 0x42c0], cx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
jne 0x40d5ff
mov edx, 0x2000
or word [esi + 0x42c0], dx
cmp edi, 2
jne 0x40d5ee
push str.__If___APanel.Left__Tab__End
jmp 0x40d5f8
cmp edi, 3
jne 0x40d5ff
push str.__If__APanel.Left__Tab__End
mov ecx, esi
call fcn.0040b950
mov ecx, dword [esi + 0x42ca]
mov eax, 2
mov word [ebp - 0x1c], ax
xor eax, eax
mov dword [ebp - 0x18], eax
push eax
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], eax
push edx
mov ecx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
call fcn.004a4a70
mov ecx, eax
call fcn.0047cc40
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x20
call fcn.0049fcb0
test al, al
jne 0x40d728
push 0
call fcn.0049fe30
add esp, 4
test al, al
je 0x40d728
test ebx, ebx
je 0x40d728
mov eax, dword [esi + 0x42ca]
push 0
push eax
mov ecx, ebx
call fcn.004a4a70
mov ecx, eax
call fcn.0047c080
test eax, eax
je 0x40d728
mov edi, dword [ebp + 0x18]
movsx ecx, di
mov edx, edi
mov dword [esi + 0x435c], ecx
shr edx, 0x10
movsx eax, dx
push 0
lea ecx, [ebp - 8]
push ecx
mov ecx, ebx
mov dword [esi + 0x4360], eax
call fcn.004a4a70
mov ecx, eax
call fcn.00478fb0
cmp dword [ebp - 4], 0
je 0x40d6ef
cmp dword [ebp - 8], 0
jbe 0x40d6ef
mov ecx, dword [0x50b3a0]
test byte [ecx + 0x1127d], 1
je 0x40d6ef
push 1
push 0x7db
call fcn.004451d0
test al, al
je 0x40d6ef
mov edx, 1
mov word [esi + 0x42c0], dx
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x14]
push 0
push 0
push ecx
push edx
push eax
mov dword [esi + 0x42ec], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, ebx
mov dword [esi + 0x42f0], edi
call fcn.004a4a70
mov ecx, eax
call fcn.004809b0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x20
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40e1c0
Capabilities:
Create process on windows

Disassembly:
push 0
push 0
push 0x44
push str.You_can_show_your_appreciation_and_support_future_development_by_donating._r_n_r_nDonate__PayPal__button_located_on_project_website_r_nunder_ConEmu_sketch__upper_right_of_page_._r_n_r_nOpen_project_website_
call fcn.00420020
add esp, 0x10
cmp eax, 6
jne 0x40e20f
mov eax, dword [section..data]
mov ecx, dword [0x50b384]
push 1
push 0
push 0
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x40e20f
push 0
push 0
push 0
push eax
push str.ShellExecute_failed
call fcn.004200b0
add esp, 0x14
ret

Function at 0x40f190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
je 0x40f1b8
cmp word [eax], 0
je 0x40f202
push eax
add esi, 0x7d2
push esi
call fcn.0040eef0
add esp, 8
pop esi
pop ebp
ret 4
push edi
lea edi, [esi + 0x7d2]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40f1f1
cmp eax, 0x104
ja 0x40f1f1
cmp word [esi + eax*2 + 0x7d0], 0x5c
jne 0x40f201
xor ecx, ecx
pop edi
mov word [esi + eax*2 + 0x7d0], cx
pop esi
pop ebp
ret 4
add esi, 0x3be
push esi
push edi
call fcn.0040eef0
add esp, 8
pop edi
pop esi
pop ebp
ret 4
Function at 0x411530
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x740c], eax
je 0x4115a7
mov eax, dword [0x50b3a4]
cmp byte [eax + 0x127d2], 0
je 0x411574
mov ecx, dword [esi + 0x4244]
test ecx, ecx
je 0x411574
push 0
push 1
push 0
push 1
push str.OnConsoleResize_abPostedfalse_
call fcn.004ae810
cmp byte [0x50b36c], 0
jne 0x4116f0
mov ecx, dword [esi + 0x7460]
mov edx, dword [0x50b384]
push 0
push 0
push ecx
push edx
mov byte [0x50b36c], 1
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x50b384]
push eax
mov byte [0x50b36c], 0
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
setne al
test al, al
jne 0x4115f3
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0x1220], al
je 0x4115d9
cmp byte [esi + 0x426a], al
jne 0x4115f3
cmp byte [esi + 0x4224], 0
jne 0x41162e
mov edx, dword [0x50b384]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x41162e
mov eax, dword [0x50b3a4]
cmp byte [eax + 0x127d2], 0
je 0x4116f0
mov esi, dword [esi + 0x4244]
test esi, esi
je 0x4116f0
push 0
push 1
push 0
push 1
push str.OnConsoleResize_ignored__because_of_iconic
mov ecx, esi
call fcn.004ae810
pop esi
mov esp, ebp
pop ebp
ret 4
mov cx, word [esi + 0x42c0]
mov edx, 0x100
and cx, dx
mov eax, edx
xor edx, edx
cmp cx, ax
sete dl
push ebx
push edi
mov ecx, esi
mov edi, edx
call fcn.0040cc80
push 1
mov bl, al
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
sete al
test bl, bl
je 0x411680
test al, al
jne 0x411680
mov ecx, 0xfe7f
and word [esi + 0x42c0], cx
mov edx, dword [0x50b3a4]
cmp byte [edx + 0x127d2], 0
je 0x4116dd
movzx ecx, byte [esi + 0x4331]
push ecx
movzx ecx, word [esi + 0x42c0]
movzx edx, al
push edx
movzx eax, bl
push eax
push edi
push ecx
lea edx, [ebp - 0xa0]
push str.OnConsoleResize:_mouse.state0x_08X__SizingToDo_i__IsSizing_i__LBtnPressed_i__gbPostUpdateWindowSize_i
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [esi + 0x4244]
add esp, 0x1c
test esi, esi
je 0x4116dd
push 0
push 1
push 0
push 1
lea eax, [ebp - 0xa0]
push eax
mov ecx, esi
call fcn.004ae810
test edi, edi
setne cl
movzx edx, cl
push edx
call fcn.004a2c50
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x411a80
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x50b384]
push esi
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
setne al
test al, al
jne 0x411ac8
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0x1220], al
je 0x411aae
cmp byte [esi + 0x426a], al
jne 0x411ac8
cmp byte [esi + 0x4224], 0
jne 0x411b18
mov edx, dword [0x50b384]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x411b18
push 0
mov ecx, esi
call fcn.00405b40
mov eax, dword [esi + 0x73d8]
test eax, eax
je 0x411b16
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x73d8], 0
mov eax, dword [0x50b3a4]
cmp byte [eax + 0x127d2], 0
je 0x411b16
mov ecx, dword [esi + 0x4244]
test ecx, ecx
je 0x411b16
push 0
push 1
push 0
push 1
push str.CConEmuMain::UnRegisterHooks___done
call fcn.004ae810
pop esi
ret
push 1
mov ecx, esi
call fcn.00405b40
cmp dword [esi + 0x73d8], 0
jne 0x411b16
mov ecx, esi
pop esi
jmp fcn.0040bac0

Function at 0x412050
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [edi + 0x740c]
je 0x4120a1
mov eax, dword [edi + 0x7434]
mov ecx, dword [0x50b384]
push 0
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
cmp word [edi + 0x4f48], si
lea eax, [edi + 0x4f48]
je 0x4120db
push 0x4c0
lea esi, [edi + 0x45c8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4120d1
cmp eax, 0x4c0
jb 0x4120d7
lea esi, [edi + 0x154]
test esi, esi
jne 0x412146
lea ecx, [ebp - 0x10]
call fcn.004a4720
lea edx, [ebp - 0x10]
push 0
push edx
mov dword [ebp - 4], 0
call fcn.0049f8f0
add esp, 8
test eax, eax
jl 0x412129
lea ecx, [ebp - 0x10]
call fcn.004a4800
mov ecx, eax
call fcn.004a4a70
test eax, eax
je 0x412129
push 0
lea ecx, [ebp - 0x10]
call fcn.004a4800
mov ecx, eax
call fcn.004a4a70
mov ecx, eax
call fcn.0047d8a0
mov esi, eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
test esi, esi
jne 0x412146
lea esi, [edi + 0x154]
test esi, esi
je 0x41216b
push ebx
lea ebx, [edi + 0x45c8]
cmp esi, ebx
je 0x41216a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41216a
push 0x4c0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
pop ebx
mov ecx, edi
call fcn.0040c600
mov ecx, 0x50dcf0
call fcn.004973f0
call fcn.004a1180
mov ecx, dword [ebp - 0xc]
pop esi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x412fa0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
push ebx
push esi
xor eax, eax
push edi
mov edi, ecx
lea ecx, [ebp - 0x1c]
push ecx
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x50
lea edx, [ebp - 0x6c]
push 0
push edx
mov dword [ebp - 4], eax
call fcn.004b03e0
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push 0x14
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0x10
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov esi, eax
call fcn.004b0706
push esi
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x1fc]
push str.Layout_s__HKL0x_08X__Count_u_n
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
push esi
lea eax, [ebp - 0x6c]
push eax
push 0xc8
lea ecx, [ebp - 0x1fc]
push ecx
mov ecx, edi
call fcn.00407ac0
or esi, 0xffffffff
test ebx, ebx
je 0x4130e9
xor eax, eax
lea ecx, [edi + 0x50c0]
cmp dword [ecx - 4], 0
jne 0x41305f
cmp esi, 0xffffffff
jne 0x413067
mov esi, eax
jmp 0x413067
cmp dword [ecx], ebx
je 0x41311a
inc eax
add ecx, 0xc
cmp eax, 0x14
jl 0x413050
test esi, esi
jl 0x4130e4
mov dl, bl
xor dl, byte [ebp - 4]
je 0x4130d0
push str._nLOWORD_hkl_LOWORD_dwLayout_____Warning__strange_layout_ID
push 0xc8
lea eax, [ebp - 0x1fc]
push eax
call fcn.00401880
lea eax, [ebp - 0x1fc]
push 0xa
push eax
call fcn.004b03ac
add esp, 8
test eax, eax
je 0x4130b0
mov ecx, 0x20
mov word [eax], cx
jmp 0x413097
test edi, edi
je 0x4130d0
mov ecx, dword [edi + 0x4244]
test ecx, ecx
je 0x4130d0
push 1
push 0
push 1
lea edx, [ebp - 0x1fc]
push edx
call fcn.004adc30
mov eax, dword [ebp - 4]
push eax
push ebx
push esi
mov ecx, edi
call fcn.00407bd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
jne 0x41311a
push str._niUnused_1
push 0xc8
lea ecx, [ebp - 0x1fc]
push ecx
call fcn.00401880
push 0
push 0x3569
lea edx, [ebp - 0x1fc]
push str.ConEmu.cpp
push edx
call fcn.004223a0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413160
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
cmp byte [ebp + 8], 0
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
je 0x4131d7
add ecx, 0x5c8
push ecx
lea eax, [ebp - 0x2a8]
push eax
call fcn.0040f130
add esp, 8
push str.WhatsNew_ConEmu.txt
push 0x154
lea ecx, [ebp - 0x2a8]
push ecx
call fcn.00401880
lea edx, [ebp - 0x2a8]
push 0
push edx
call fcn.004acca0
add esp, 8
test eax, eax
je 0x4131d7
mov ecx, dword [0x50b384]
push 1
push 0
push 0
lea eax, [ebp - 0x2a8]
push eax
push str.open
push ecx
call esi
cmp eax, 0x20
jge 0x413221
mov edx, dword [str.http:__code.google.com_p_conemu_maximus5_wiki_Whats_New]
push edx
lea eax, [ebp - 0x2a8]
push eax
call fcn.0040f130
mov edx, dword [0x50b384]
add esp, 8
push 1
push 0
push 0
lea ecx, [ebp - 0x2a8]
push ecx
push str.open
push edx
call esi
cmp eax, 0x20
jge 0x413221
push 0
push 0
push 0
push eax
push str.File_WhatsNew_ConEmu.txt_not_found__go_to_web_page_failed
call fcn.004200b0
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x413610
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x413653
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x41362f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x41363e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x413683
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.0040f030
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x41368f
mov eax, 0x1746
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x4136a2
cmp dword [ebp + 0xc], ebx
jne 0x4136a2
xor ecx, ecx
jmp 0x4136a7
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x4136c3
push eax
push ebx
push 4
call fcn.00441aa0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x4136cc
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x4136f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x4136ef
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x41373d
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x413751
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x413735
mov ecx, str.Read
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.00441b50
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x416190
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
mov ecx, dword [esi + 0x423c]
call fcn.0048e7d0
test al, al
je 0x4161b1
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x5070], 0
je 0x4161e3
mov ecx, esi
call fcn.0040cc80
test al, al
je 0x4161e3
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x41622c
mov ecx, esi
call fcn.00406ac0
push ebx
xor bl, bl
push edi
cmp byte [ebp + 8], bl
je 0x4162b8
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x50b384]
lea ecx, [ebp - 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [0x50b3a0]
mov eax, 2
sub dword [ebp - 0x18], eax
add dword [ebp - 0x10], eax
add dword [ebp - 0xc], eax
cmp byte [ecx + 0x1220], bl
je 0x416235
inc dword [ebp - 0x14]
jmp 0x416238
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
sub dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov edi, dword [sym.imp.USER32.dll_PtInRect]
push edx
push eax
lea ecx, [ebp - 0x18]
push ecx
call edi
test eax, eax
je 0x4162c2
push 0
push 1
lea edx, [ebp - 0x28]
push edx
mov ecx, esi
call fcn.00410ea0
mov ecx, dword [0x50b3a0]
mov eax, 1
add dword [ebp - 0x28], eax
sub dword [ebp - 0x20], eax
sub dword [ebp - 0x1c], eax
cmp byte [ecx + 0x1220], 0
je 0x416282
sub dword [ebp - 0x14], 2
jmp 0x416285
add dword [ebp - 0x24], eax
mov eax, dword [0x50b384]
push 2
lea edx, [ebp - 0x28]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
push ecx
push edx
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x4162c2
mov bl, 1
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x5070], 2
sete bl
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41f5e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
test ax, ax
je 0x41f5ff
mov ecx, dword [ebp + 8]
movzx eax, ax
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp + 0xc], eax
jmp 0x41f607
mov edx, dword [ebp + 8]
mov dword [ebp + 0xc], edx
mov eax, edx
test eax, eax
jne 0x41f60d
pop ebp
ret
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jle 0x41f671
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
push ebx
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x41f63c
cmp edi, dword [ebx]
jb 0x41f64e
push eax
call fcn.00441300
add esp, 4
mov dword [esi], 0
lea eax, [edi + 0x20]
push 2
push eax
mov dword [ebx], eax
call fcn.004412c0
add esp, 8
mov dword [esi], eax
mov eax, dword [esi]
pop ebx
test eax, eax
je 0x41f681
xor ecx, ecx
mov word [eax], cx
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
lea edx, [edi + 1]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
xor edi, edi
test eax, eax
je 0x41f681
xor ecx, ecx
mov word [eax], cx
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x41fac0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
xor ebx, ebx
push 0x2000b
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41fbd5
push 1
push 0x14
call fcn.004412c0
add esp, 8
lea ecx, [ebp - 4]
push ecx
push edi
push edi
push edi
mov esi, eax
push edi
lea edx, [ebp - 0x14]
push edx
mov byte [esi], 1
mov byte [esi + 1], 2
mov byte [esi + 7], 5
mov dword [esi + 8], 0x20
mov dword [esi + 0xc], 0x220
mov eax, dword [ebp - 8]
push 1
push 1
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_CreateRestrictedToken]
test eax, eax
je 0x41fba9
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0x20]
push edx
mov edx, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebp - 4]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x41fb8b
mov eax, dword [ebp - 4]
push eax
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], edi
jmp 0x41fbb8
mov ebx, dword [ebp + 0x30]
cmp ebx, edi
je 0x41fb9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], edi
jmp 0x41fbb8
mov ebx, dword [ebp + 0x30]
cmp ebx, edi
je 0x41fbb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
push esi
call fcn.00441300
mov ecx, dword [ebp - 8]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x30]
cmp esi, edi
je 0x41fbe4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [edi], 0
cmp word [eax], 0x20
mov edx, eax
jne 0x420329
lea esp, [esp]
add eax, 2
cmp word [eax], 0x20
je 0x420320
movzx ecx, word [eax]
mov esi, 0x20
test cx, cx
je 0x42039b
cmp cx, 0x22
jne 0x420342
xor esi, 2
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x42036c
lea ebx, [ebx]
cmp cx, 0x22
je 0x420393
cmp cx, si
je 0x42036c
add eax, 2
mov word [edx], cx
movzx ecx, word [eax]
add edx, 2
test cx, cx
jne 0x420350
movzx ecx, word [eax]
cmp cx, 0x22
je 0x420393
cmp cx, 0x20
jne 0x420389
jmp 0x420380
add eax, 2
cmp word [eax], 0x20
je 0x420380
xor ecx, ecx
mov word [edx], cx
add edx, 2
inc dword [edi]
movzx ecx, word [eax]
test cx, cx
jne 0x420336
pop edi
pop esi
pop ebp
ret
Function at 0x420670
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareHoopoePG_2x
push SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4206c8
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push str.CreateInNewEnvironment
push edx
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x420f50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x420f60
xor al, al
pop ebx
pop ebp
ret
push 0
mov byte [ebp + 0xb], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x420fc6
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [edi + edi + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x420fbe
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x420fbe
push ebx
inc edi
push edi
push eax
call fcn.00401800
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne byte [ebp + 0xb]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov al, byte [ebp + 0xb]
pop ebx
pop ebp
ret