joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f0a8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46f253
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46f234
mov dl, 1
mov eax, dword [0x416688]
call fcn.00403270
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404030
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x46f223
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045cb30
test al, al
je 0x46f216
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x46f264
lea eax, [ebp - 0x254]
call fcn.00408ef0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46f216
xor eax, eax
push ebp
push 0x46f20f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x46f29c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46f1f8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004042a0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46f1f8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004042a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f216
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x46f119
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041ac64
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f25a
lea eax, [ebp - 0x260]
call fcn.00404030
ret

Function at 0x46fb88
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x48ebc0]
cmp byte [eax + 0xa5], 0
jne 0x46fbf9
cmp dword [0x48ebd8], 0
jne 0x46fbba
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x46fb44
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x48ebd8], eax
cmp dword [0x48ebd4], 0
jne 0x46fbd5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x48ebd4], eax
cmp dword [0x48ebdc], 0
jne 0x46fbf9
push esp
push 0
push 0
push 0x46fae8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x48ebdc], eax
pop edx
ret
Function at 0x46fcf0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46fd07
add esp, 0xfffffff0
call fcn.00403604
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420c64
mov eax, dword [0x48dc00]
cmp word [eax + 2], 0
jne 0x46fd2f
mov eax, dword [0x48dc00]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00471470
mov eax, dword [0x48dcd0]
cmp word [eax + 2], 0
jne 0x46fd49
mov eax, dword [0x48dcd0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00471668
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416024]
call fcn.00403270
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416024]
call fcn.00403270
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4230f0]
call fcn.0042a72c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x46fed0
mov eax, dword [0x48db08]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042aafc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x471c18
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48db08]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c918
test eax, eax
je 0x46fe3e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004088d0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c940
test eax, eax
je 0x46fe52
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004042a0
mov eax, dword [0x48d9cc]
cmp byte [eax], 0
jne 0x46fe86
mov eax, ebx
call fcn.0046fff8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00471df4
mov eax, ebx
call fcn.004727b8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46fec6
call fcn.0040365c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470278
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48ebc0]
cmp dword [eax + 0x30], 0
je 0x470322
cmp dword [ebx + 0x94], 0
jne 0x47031c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x470208
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x47031c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4702e2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x47031c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418874
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4702f1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x470e84
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x470eb9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404120
jmp 0x470ec6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404084
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x471fd0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x472011
mov eax, esi
call fcn.004580b4
test al, al
je 0x472011
mov eax, dword [ebx + 0x84]
call fcn.00457db0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x472011
push 0
mov eax, dword [ebx + 0x84]
call fcn.00457db0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4757c8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4757f6
mov eax, ebx
call fcn.0047627c
cmp dword [ebx + 0x40], 0
je 0x4757ef
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x475867
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x475859
cmp dword [ebx + 8], 0
je 0x475818
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47582a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x475859
cmp dword [ebx + 8], 0
je 0x47580b
cmp eax, 3
je 0x47583d
dec eax
jne 0x47580b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47580b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47580b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x475885
cmp dword [ebx + 0x14], 0xcc
je 0x475885
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00475890
pop ebx
ret
Function at 0x488704
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044e0
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x488872
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00486030
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00486050
jmp 0x48883e
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004042a0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408764
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00407ef4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00407ef4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040443c
je 0x48881e
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004042a0
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00407ef4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00407ef4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040443c
jne 0x488835
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.00486070
test eax, eax
jne 0x48877f
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488879
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404054
lea eax, [ebp - 4]
call fcn.00404030
ret

Function at 0x48a668
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push 0x48a680
push 0x48a6a8
push 0
call sub.shell32.dll_ShellExecuteA
ret
Function at 0x438ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov eax, dword [esp + 0x5c]
mov dword [esp], 0x4298cc
test eax, eax
mov ecx, 0x42fa7c
mov dword [esp + 4], eax
jne 0x438ad0
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x60]
mov dword [esp + 8], 0x4298c8
test eax, eax
mov dword [esp + 0xc], eax
jne 0x438ae8
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], 0x4298c4
test eax, eax
mov dword [esp + 0x14], eax
jne 0x438b00
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], 0x4298c0
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x438b18
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x20], 0x4298bc
test eax, eax
mov dword [esp + 0x24], eax
jne 0x438b30
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], 0x4298b8
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x438b48
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], 0x4298b0
test eax, eax
mov dword [esp + 0x34], eax
jne 0x438b60
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x78]
mov dword [esp + 0x38], 0x4298a8
test eax, eax
mov dword [esp + 0x3c], eax
jne 0x438b78
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x40], 0x4298a0
test eax, eax
mov dword [esp + 0x44], eax
jne 0x438b90
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x48], 0x429898
test eax, eax
mov dword [esp + 0x4c], eax
jne 0x438bab
mov dword [esp + 0x4c], ecx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x50], 0x429890
test eax, eax
mov dword [esp + 0x54], eax
jne 0x438bc6
mov dword [esp + 0x54], ecx
push ebx
mov ebx, dword [0x4261d8]
push ebp
push esi
push edi
xor edi, edi
lea esi, [esp + 0x14]
mov ebp, 0xb
mov eax, dword [esi - 4]
push eax
call ebx
mov ecx, dword [esi]
lea edi, [edi + eax + 1]
push ecx
call ebx
add esi, 8
dec ebp
lea edi, [edi + eax + 1]
jne 0x438bdb
lea edi, [edi + edi*2 + 0x64]
push edi
call 0x450345
mov esi, eax
add esp, 4
test esi, esi
je 0x438c65
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ebp, dword [0x4261cc]
mov ecx, edx
and ecx, 3
mov dword [esp + 0x6c], 0
rep stosb byte es:[edi], al
lea edi, [esp + 0x10]
mov ebx, 0xb
mov ecx, dword [edi + 4]
mov edx, dword [edi]
lea eax, [esp + 0x6c]
push eax
push ecx
push edx
call 0x445290
add esp, 0xc
test eax, eax
je 0x438c52
mov eax, dword [esp + 0x6c]
push eax
push esi
call ebp
lea ecx, [esp + 0x6c]
push ecx
call fcn.0043fd50
add esp, 4
add edi, 8
dec ebx
jne 0x438c32
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x4429f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [0x4261d8]
push esi
xor esi, esi
mov eax, 1
push edi
mov dword [esp + 0x14], 0x42b4fc
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0x42b4f0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x42b4e8
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x42b4dc
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x429958
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 0x42b4d0
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x42a2e8
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x42b4cc
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 0x42b4c4
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0x42b4b4
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], 0x42b4a4
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x42b498
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x42b494
mov dword [esp + 0x78], eax
lea edi, [esp + 0x14]
mov ebx, 0xd
mov eax, dword [edi]
push eax
call ebp
add edi, 8
dec ebx
lea esi, [esi + eax + 2]
jne 0x442aa9
add esi, 0xa
push esi
call 0x450345
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x442b25
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, ebx
and ecx, 3
mov dword [esp + 0x10], 0xd
rep stosb byte es:[edi], al
lea edi, [esp + 0x14]
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x442afe
mov eax, dword [edi + 4]
test eax, eax
je 0x442b17
mov eax, dword [edi]
push eax
push esi
call dword [0x4261e0]
push esi
call ebp
mov cl, byte [esp + 0x80]
add esi, eax
mov byte [esi], cl
inc esi
mov eax, dword [esp + 0x10]
add edi, 8
dec eax
mov dword [esp + 0x10], eax
jne 0x442aec
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x4045e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x438010]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x435780]
push ebx
push esi
movups xmmword [ebp - 0x2c], xmm0
lea esi, [ebp - 0x2c]
mov dword [ebp - 0xc], 0
movaps xmm0, xmmword [0x435790]
push edi
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 8], 3
nop word [eax + eax]
push dword [esi]
call fcn.00404700
add esi, 4
lea eax, [ebp - 4]
cmp esi, eax
jne 0x404620
mov eax, 0x21
cmp eax, 0x1c5
jl 0x40463f
call 0x7444bbc9
add ch, al
xchg edx, eax
jne 0x404645
je 0x404645
call 0xf6f72eda
invalid
call fcn.00403d00
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
add eax, 0x13
jne 0x404660
jmp 0xdc2c2e63
call 0x402250
mov eax, 0x13
cmp eax, 0x1a5
jl 0x404673
call 0x7444bc21
add ch, cl
retf
jne 0x404679
je 0x404679
jmp 0x6a40b147
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAnyAccessesGranted]
call fcn.00406770
mov edi, eax
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + edi + 0x30]
mov esi, dword [ecx + 4]
mov ecx, esi
mov dword [ebp - 0x30], esi
mov edx, dword [esi]
call dword [edx + 4]
lea eax, [ebp - 0x34]
push eax
call fcn.00406f50
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
call dword [edx + 0x30]
movzx ebx, ax
test esi, esi
je 0x4046cf
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x4046cf
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push ebx
mov ecx, edi
call fcn.004077e0
mov ecx, edi
call fcn.00405fb0
call fcn.00404310
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b18c
mov esp, ebp
pop ebp
ret
Function at 0x401424
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esp
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ax, word [esp + 2]
mov dword [0x4045a0], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 3
mov dword [0x404590], eax
mov eax, edi
mov dword [ebp - 0x44], 0x401358
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Hall
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x401501
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.moossi
push str.Hall
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x404598], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x404598]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401501
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x4014e6
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401f97
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401fc0
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401fb8
cmp al, 0x22
jne 0x401fac
cmp byte [esi], 0x22
jne 0x401fca
inc esi
jmp 0x401fca
cmp al, 0x20
jle 0x401fca
inc esi
cmp byte [esi], 0x20
jg 0x401fc4
mov al, byte [esi]
test al, al
je 0x401fd4
cmp al, 0x20
jle 0x401fbd
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00402044
push 0x404004
push section..data
call fcn.0040202a
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x402004
movzx eax, word [ebp - 0x14]
jmp 0x402007
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.0040205c
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40213f
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 0x10], 0xc
je 0x4021e0
cmp dword [ebp + 0x10], 0x10
je 0x4021ba
cmp dword [ebp + 0x10], 0x26
jne 0x402216
cmp dword [0x41d44c], ebx
mov byte [ebp - 0x204], bl
mov esi, 0x201
je 0x40219c
lea eax, [ebp - 0x204]
push esi
push eax
push 0x41cf00
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00402054
cmp byte [ebp - 0x204], bl
jne 0x402213
lea eax, [ebp - 0x204]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp - 0x202], bl
jmp 0x402213
cmp dword [0x41d44c], ebx
mov byte [ebp - 0x204], bl
je 0x402213
lea eax, [ebp - 0x204]
push 0x201
push eax
push 0x41cf00
push str.Desktop
jmp 0x402204
cmp dword [0x41d44c], ebx
mov byte [ebp - 0x204], bl
je 0x402213
lea eax, [ebp - 0x204]
push 0x201
push eax
push 0x41cf00
push str.Personal
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_folders
push 0x80000001
call fcn.00402054
push 1
pop esi
cmp esi, ebx
je 0x402237
cmp dword [ebp + 0xc], ebx
je 0x402235
lea eax, [ebp - 0x204]
push 0x104
push eax
push dword [ebp + 0xc]
call fcn.00403331
jmp 0x402237
xor esi, esi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4035ab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], 1
jbe 0x403606
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x32]
mov eax, dword [eax + 2]
mov dword [ebp + 8], eax
mov ebx, 0x10000
cmp dword [ebp + 0xc], ebx
ja 0x4035da
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push 0
push eax
lea eax, [esi + edi]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403602
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x403602
add esi, eax
sub dword [ebp + 0xc], eax
jne 0x4035cd
jmp 0x403606
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x40363c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], 1
jbe 0x403697
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x32]
mov eax, dword [eax + 2]
mov dword [ebp + 8], eax
mov ebx, 0x10000
cmp dword [ebp + 0xc], ebx
ja 0x40366b
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push 0
push eax
lea eax, [esi + edi]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403693
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x403693
add esi, eax
sub dword [ebp + 0xc], eax
jne 0x40365e
jmp 0x403697
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc