joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ba04
Capabilities:
Find taskbar

Disassembly:
push ebx
xor ebx, ebx
push 0
push 0
push 0x10
push 0x5d1428
push 0
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_PostMessageA
push 0
push 0
push 0x10
push 0x5d1436
push 0
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_PostMessageA
push 0
push 0
push 0x12
push 0x5d1443
push 0
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_PostMessageA
push 0
push 0
push 2
push 0x5d1450
push 0
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_PostMessageA
push 0x5d145d
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_FreeLibrary
push 0x5d146a
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_FreeLibrary
jmp 0x43baca
inc ebx
cmp ebx, 0xa
jg 0x43bada
push 0
push 0
push 0x418
push 0
push 0x5d147b
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_PostMessageA
push 0
push 0
push 2
push 0
push 0x5d147f
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_PostMessageA
push 1
call fcn.004d9f54
pop ecx
push 0
push 0x5d1477
call sub.USER32.dll_FindWindowA
test eax, eax
jne 0x43ba89
push 1
call fcn.004d9f54
pop ecx
mov eax, 1
pop ebx
ret

Function at 0x43bc5c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push edx
push esi
call sub.USER32.dll_GetWindowThreadProcessId
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, dword [ebp - 4]
cmp eax, ecx
jne 0x43bc90
mov eax, 1
jmp 0x43bd50
mov eax, dword [0x50b938]
test eax, eax
je 0x43bcaa
mov edx, dword [ebp - 4]
cmp eax, edx
jne 0x43bcaa
mov eax, 1
jmp 0x43bd50
mov eax, dword [0x50b93c]
test eax, eax
je 0x43bcc4
mov edx, dword [ebp - 4]
cmp eax, edx
jne 0x43bcc4
mov eax, 1
jmp 0x43bd50
mov eax, ebx
and eax, 1
test eax, eax
jne 0x43bd2b
lea edx, [ebp - 8]
push edx
push 0x7d0
push 2
push 0x80000000
push 0
push 0x11
push esi
call sub.USER32.dll_SendMessageTimeoutA
test eax, eax
je 0x43bd27
lea ecx, [ebp - 8]
push ecx
push 0x7d0
push 2
push 0x80000000
push 1
push 0x16
push esi
call sub.USER32.dll_SendMessageTimeoutA
test eax, eax
je 0x43bd20
lea eax, [ebp - 8]
push eax
push 0x7d0
push 2
push 0
push 1
push 0x10
push esi
call sub.USER32.dll_SendMessageTimeoutA
mov eax, 1
jmp 0x43bd50
xor eax, eax
jmp 0x43bd50
test eax, eax
je 0x43bd4e
mov edx, dword [ebp - 4]
push edx
push 0
push 1
call sub.KERNEL32.dll_OpenProcess
test eax, eax
je 0x43bd4a
push 0
push eax
call sub.KERNEL32.dll_TerminateProcess
mov edi, eax
mov eax, edi
jmp 0x43bd50
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43bdac
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
call fcn.0043ba04
mov eax, dword [ebp + 8]
push eax
push 0x43bd58
call sub.USER32.dll_EnumWindows
push 0x1388
push 0x1f4
call fcn.0043bb04
add esp, 8
mov eax, 1
pop ebp
ret
Function at 0x43c5c4
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push 0x5d1568
push 0x5d155d
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x43c5e9
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
call ebx
push 0
call fcn.00401260
push eax
push 0
push 0
push 1
push 1
push 0xffff
push 0xffff
push 0x90800200
push 0x5d1588
push 0x5d1581
push 8
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
call sub.USER32.dll_GetForegroundWindow
mov esi, eax
push 0xa
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
push 0xa
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
push 1
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0
push esi
call sub.USER32.dll_GetWindowThreadProcessId
push eax
call sub.USER32.dll_AttachThreadInput
push 0xa
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
push 0xa
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
push ebx
call sub.USER32.dll_SetForegroundWindow
push ebx
call sub.USER32.dll_BringWindowToTop
push 0xa
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
push 0xa
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0
push esi
call sub.USER32.dll_GetWindowThreadProcessId
push eax
call sub.USER32.dll_AttachThreadInput
push 0xa
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
push 0xa
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x43d330
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xffffffff
push 0x5d1656
xor esi, esi
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [ebp - 0x14], eax
xor edi, edi
push 0
push 0
push 0x1f0fff
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_GetCurrentProcess
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_DuplicateHandle
mov ebx, eax
lea eax, [ebp - 8]
push eax
test ebx, ebx
je 0x43d387
mov edx, dword [ebp - 0x10]
jmp 0x43d38a
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_GetExitCodeProcess
test eax, eax
je 0x43d3dd
mov eax, dword [ebp - 8]
cmp eax, 0x103
jne 0x43d3dd
push 0x5d165f
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_GetProcAddress
lea edx, [ebp - 4]
push edx
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push eax
push 0
push 0
test ebx, ebx
je 0x43d3c4
mov eax, dword [ebp - 0x10]
jmp 0x43d3c7
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_CreateRemoteThread
mov esi, eax
test esi, esi
jne 0x43d3e4
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0xc], eax
jmp 0x43d3e4
mov dword [ebp - 0xc], 0x42b
test esi, esi
je 0x43d407
push 0xffffffffffffffff
test ebx, ebx
je 0x43d3f3
mov eax, dword [ebp - 0x10]
jmp 0x43d3f6
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push esi
call sub.KERNEL32.dll_CloseHandle
mov edi, 1
test ebx, ebx
je 0x43d414
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_CloseHandle
test edi, edi
jne 0x43d421
mov edx, dword [ebp - 0xc]
push edx
call sub.KERNEL32.dll_SetLastError
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43d4ac
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
mov eax, dword [0x50b940]
cmp eax, 1
je 0x43d4f3
mov edx, dword [0x5f837c]
test edx, edx
je 0x43d4f3
mov ecx, dword [0x50b940]
test ecx, ecx
je 0x43d4f3
mov eax, dword [0x50b940]
push eax
push 0
push 1
call sub.KERNEL32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x43d4f3
push 0
push esi
call sub.KERNEL32.dll_TerminateProcess
mov ebx, eax
push esi
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
xor edx, edx
mov dword [0x50b940], eax
mov eax, ebx
mov dword [0x5f837c], edx
pop esi
pop ebx
ret
Function at 0x43d89c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff340
mov ecx, 0x104
lea eax, [ebp - 0x820]
lea edx, [ebp - 0x410]
push ebx
push esi
push edi
lea edi, [ebp - 0x410]
mov ebx, dword [ebp + 0xc]
mov esi, 0x50d4f8
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x820]
mov ecx, 0x104
mov esi, 0x50d908
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc30]
mov ecx, 0x104
mov esi, 0x50dd18
rep movsd dword es:[edi], dword [esi]
push eax
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043d508
add esp, 0x14
mov al, byte [ebp - 0x820]
test al, al
je 0x43d911
lea esi, [ebp - 0x820]
jmp 0x43d913
xor esi, esi
test ebx, ebx
jne 0x43d91b
xor ebx, ebx
jmp 0x43d939
push ebx
lea eax, [ebp - 0xc30]
push eax
call fcn.0043c49c
add esp, 8
lea ebx, [ebp - 0xc30]
mov al, byte [ebx]
test al, al
jne 0x43d939
xor ebx, ebx
push 0x44
push 0
lea eax, [ebp - 0xc74]
push eax
call fcn.004cde6c
add esp, 0xc
lea edx, [ebp - 0xc84]
push 0x10
push 0
push edx
call fcn.004cde6c
add esp, 0xc
lea ecx, [ebp - 0xc74]
mov dword [ebp - 0xc74], 0x44
push ecx
call sub.KERNEL32.dll_GetStartupInfoA
push 0x8000
call sub.KERNEL32.dll_SetErrorMode
push 7
call sub.KERNEL32.dll_SetErrorMode
push 0x3c
push 0
lea eax, [ebp - 0xcc0]
push eax
call fcn.004cde6c
mov dword [ebp - 0xcc0], 0x3c
mov dword [ebp - 0xcbc], 0x800400
lea edx, [ebp - 0x410]
add esp, 0xc
mov dword [ebp - 0xcb0], edx
mov dword [ebp - 0xca8], ebx
mov dword [ebp - 0xcac], esi
mov dword [ebp - 0xca4], 5
test byte [ebp + 0x11], 2
je 0x43d9df
mov dword [ebp - 0xcb4], 0x5d1677
mov cl, byte [ebp - 0x410]
test cl, cl
je 0x43d9fd
lea eax, [ebp - 0xcc0]
push eax
call sub.SHELL32.dll_ShellExecuteExA
test eax, eax
jne 0x43d9fd
xor eax, eax
jmp 0x43da02
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43da4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff37c
mov ecx, 0x104
lea eax, [ebp - 0x820]
lea edx, [ebp - 0x410]
push ebx
push esi
push edi
lea edi, [ebp - 0x410]
mov ebx, dword [ebp + 0xc]
mov esi, 0x50e128
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x820]
mov ecx, 0x104
mov esi, 0x50e538
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc30]
mov ecx, 0x104
mov esi, 0x50e948
rep movsd dword es:[edi], dword [esi]
push eax
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043d508
add esp, 0x14
push 0x5d167d
lea eax, [ebp - 0x410]
push eax
call fcn.004cdf10
add esp, 8
lea edx, [ebp - 0x820]
push edx
lea ecx, [ebp - 0x410]
push ecx
call fcn.004cdf10
add esp, 8
test ebx, ebx
jne 0x43dae1
xor ebx, ebx
jmp 0x43daff
push ebx
lea eax, [ebp - 0xc30]
push eax
call fcn.0043c49c
add esp, 8
lea ebx, [ebp - 0xc30]
mov al, byte [ebx]
test al, al
jne 0x43daff
xor ebx, ebx
push 0x8000
call sub.KERNEL32.dll_SetErrorMode
push 7
call sub.KERNEL32.dll_SetErrorMode
push 0x44
push 0
lea eax, [ebp - 0xc74]
push eax
call fcn.004cde6c
add esp, 0xc
lea edx, [ebp - 0xc84]
push 0x10
push 0
push edx
call fcn.004cde6c
add esp, 0xc
lea ecx, [ebp - 0xc74]
mov dword [ebp - 0xc74], 0x44
push ecx
call sub.KERNEL32.dll_GetStartupInfoA
mov al, byte [ebp - 0x410]
test al, al
je 0x43db8c
lea edx, [ebp - 0xc84]
lea ecx, [ebp - 0xc74]
push edx
push ecx
push ebx
push 0
push 0x4000000
push 0
push 0
lea eax, [ebp - 0x410]
push 0
push eax
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
je 0x43db8c
mov eax, dword [ebp - 0xc7c]
jmp 0x43db8e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43dbd8
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x43dc08
mov al, byte [ebx]
test al, al
je 0x43dc08
lea edx, [ebp - 0x100]
push edx
push pe_nt_image_headers32
call sub.KERNEL32.dll_GetCurrentDirectoryA
push ebx
call fcn.004d41ec
pop ecx
call fcn.0043c5c4
mov esi, eax
push 5
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_WinExec
cmp eax, 0x21
jae 0x43dc21
xor eax, eax
mov dword [0x50b940], eax
mov dword [0x5f837c], 0x4000
push esi
call fcn.0043c6d0
pop ecx
test ebx, ebx
je 0x43dc4e
mov dl, byte [ebx]
test dl, dl
je 0x43dc4e
lea ecx, [ebp - 0x100]
push ecx
call fcn.004d41ec
pop ecx
mov eax, dword [0x50b940]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dcd8
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x43dd0e
cmp byte [esi], 0
je 0x43dd0e
lea eax, [ebp - 0x100]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push esi
call fcn.004d41ec
pop ecx
push edi
push 0x5d167f
lea edx, [ebp - 0x200]
push edx
call fcn.004d26c8
add esp, 0xc
test ebx, ebx
je 0x43dd43
mov cl, byte [ebx]
test cl, cl
je 0x43dd43
push edi
push ebx
push 0x5d168e
lea eax, [ebp - 0x200]
push eax
call fcn.004d26c8
add esp, 0x10
mov ebx, 1
push 5
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.dll_WinExec
cmp eax, 0x21
jae 0x43dd5d
xor ebx, ebx
test ebx, ebx
je 0x43dd81
push 1
call fcn.0043dc64
pop ecx
push 1
call fcn.0043dc64
pop ecx
push 1
call fcn.0043dc64
pop ecx
push 0
call fcn.0043dc64
pop ecx
test esi, esi
je 0x43dd98
mov al, byte [esi]
test al, al
je 0x43dd98
lea edx, [ebp - 0x100]
push edx
call fcn.004d41ec
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e694
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43e6df
mov byte [ebx], 0
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
push ebx
call sub.KERNEL32.dll_GetComputerNameA
test eax, eax
je 0x43e6bc
mov al, 1
jmp 0x43e6e1
push 1
push pe_nt_image_headers32
push ebx
push 0x5d18a4
push 0x5d1869
push 0x80000002
call fcn.00406a20
add esp, 0x18
mov al, 1
jmp 0x43e6e1
xor eax, eax
pop ebx
pop ecx
pop ebp
ret

Function at 0x43e9a4
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
mov ecx, 0x41
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x104]
push esi
push edi
lea edi, [ebp - 0x104]
mov esi, 0x50f12c
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x208]
mov ecx, 0x41
mov esi, 0x50f230
rep movsd dword es:[edi], dword [esi]
push eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043e860
add esp, 0xc
lea eax, [ebp - 0x104]
mov byte [ebp - 0x102], 0
push eax
call fcn.0043e90c
pop ecx
xor edx, edx
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 0x101]
mov dword [ebp - 0x214], eax
xor edx, edx
mov dword [ebp - 0x20c], edx
push 0
push 0
push 0
lea ecx, [ebp - 0x228]
push ecx
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
jne 0x43ea8a
mov al, byte [ebp - 0x208]
test al, al
je 0x43ea83
movsx edx, byte [ebp - 0x207]
cmp edx, 0x3a
jne 0x43ea83
push pe_nt_image_headers32
lea ecx, [ebp - 0x104]
push ecx
call fcn.004d1c0c
add esp, 8
lea eax, [ebp - 0x208]
push eax
call fcn.004d41ec
pop ecx
lea edx, [ebp - 0x104]
push edx
call fcn.004d41ec
pop ecx
mov eax, 1
jmp 0x43ea93
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x440274
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [ebp + 0xc], 1
mov ebx, dword [ebp + 8]
jne 0x44028b
push 5
push ebx
call sub.USER32.dll_ShowWindow
jmp 0x440293
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 1
push 0
push ebx
call sub.USER32.dll_InvalidateRect
push ebx
call sub.USER32.dll_UpdateWindow
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_Sleep
pop ebx
pop ebp
ret

Function at 0x4403d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x104
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x4403f6
mov esi, 0x5d1ccd
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push ebx
call fcn.004cdfec
pop ecx
test eax, eax
je 0x440420
push ebx
call fcn.004cdfec
pop ecx
movsx edx, byte [ebx + eax - 1]
cmp edx, 0x5c
je 0x440420
push 0x5d1cd8
push ebx
call fcn.004cdf10
add esp, 8
push 0x5d1cda
push ebx
call fcn.004cdf10
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x440c00
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 4
mov esi, ebx
push esi
push 0x5d1eab
push 0x5d1e75
push 0x80000002
call fcn.00406a5c
add esp, 0x14
push 4
push esi
push 0x5d1ef2
push 0x5d1ebc
push 0x80000001
call fcn.00406a5c
add esp, 0x14
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x440c9c
Capabilities:
Find taskbar

Disassembly:
push ebx
xor ebx, ebx
push 0
push 0x5d1f03
push ebx
push 0
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x440cc7
push 0x5d1f11
push 0
push 0
push ebx
call sub.USER32.dll_FindWindowExA
test eax, eax
jne 0x440c9f
mov eax, ebx
pop ebx
ret

Function at 0x440ccc
Capabilities:
Acquire debug privileges
Hide graphical window
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
push 0
call fcn.004417a4
pop ecx
call fcn.00440c9c
mov esi, eax
test esi, esi
jne 0x440cf3
call fcn.00440c70
mov eax, 1
jmp 0x440dd1
push 0
call fcn.00440c00
pop ecx
push esp
push esi
call sub.USER32.dll_GetWindowThreadProcessId
push 1
push 0x5d1f23
call fcn.004038c8
add esp, 8
mov edx, dword [esp]
push edx
push 0
push 0x401
call sub.KERNEL32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x440d55
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0x300
push 0x5d1f34
call fcn.0043d270
add esp, 8
push 0x300
push 0x5d1f41
call fcn.0043d270
add esp, 8
jmp 0x440d68
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.dll_GetExitCodeProcess
push 1
push ebx
call sub.KERNEL32.dll_TerminateProcess
xor edx, edx
mov dword [esp], edx
push 4
mov ecx, dword [esp + 4]
push ecx
push 0x5d1f8c
push 0x5d1f59
push 0x80000001
call fcn.00406a5c
add esp, 0x14
push 4
mov eax, dword [esp + 4]
push eax
push 0x5d1fc8
push 0x5d1f95
push 0x80000001
call fcn.00406a5c
add esp, 0x14
push 4
mov edx, dword [esp + 4]
push edx
push 0x5d2006
push 0x5d1fd3
push 0x80000001
call fcn.00406a5c
add esp, 0x14
call fcn.00440c70
mov eax, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44113c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
mov cl, byte [0x50f5f8]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov byte [ebp - 0x6f], cl
test eax, eax
jne 0x441159
xor eax, eax
jmp 0x44118d
mov cl, byte [eax]
test cl, cl
jne 0x441163
xor eax, eax
jmp 0x44118d
test edx, edx
jne 0x44116a
lea edx, [ebp - 0x6f]
push 1
push edx
push eax
push 0x5d201d
push 0x80000001
call fcn.00406a5c
add esp, 0x14
test eax, eax
je 0x44118b
mov eax, 1
jmp 0x44118d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x44127c
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x441260
xor eax, eax
mov dword [ebp - 0x24], eax
xor edx, edx
mov dword [ebp - 0x20], edx
call fcn.00401260
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.USER32.dll_LoadIconA
mov dword [ebp - 0x18], eax
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push 0
call sub.GDI32.dll_GetStockObject
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x30]
mov dword [ebp - 8], 0x5d20d9
push edx
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 8], 0x5d20e7
lea ecx, [ebp - 0x30]
push ecx
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 8], 0x5d20f5
lea eax, [ebp - 0x30]
push eax
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 8], 0x5d2105
lea edx, [ebp - 0x30]
push edx
call sub.USER32.dll_RegisterClassExA
push 0
push 0x5d210e
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x441336
mov eax, ebx
jmp 0x44149b
push 0
call fcn.00401260
push eax
push 0
push 0
push 0xc8
push 0xc8
push 0xa
push 0xa
push 0
push 0x5d212a
push 0x5d211c
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 0
call fcn.00401260
push eax
push 0
push ebx
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d2132
push 0x5d212b
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401260
push eax
push 0
push ebx
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d2140
push 0x5d2139
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401260
push eax
push 0
push ebx
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d2160
push 0x5d2152
push 0
call sub.USER32.dll_CreateWindowExA
mov esi, eax
push 0
call fcn.00401260
push eax
push 0
push esi
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d2171
push 0x5d2161
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401260
push eax
push 0
push esi
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d217b
push 0x5d2172
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401260
push eax
push 0
push esi
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5d2183
push 0x5d217c
push 0
call sub.USER32.dll_CreateWindowExA
mov eax, dword [ebp + 8]
dec eax
jne 0x441499
jmp 0x441481
push ebx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x441499
lea edx, [ebp - 0x4c]
push edx
call sub.USER32.dll_TranslateMessage
lea ecx, [ebp - 0x4c]
push ecx
call sub.USER32.dll_DispatchMessageA
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.USER32.dll_GetMessageA
mov esi, eax
test eax, eax
je 0x441499
inc esi
jne 0x441465
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4419b4
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
cmp word [0x4dda74], 0x6c
je 0x4419d0
xor eax, eax
jmp 0x441a5a
mov ebx, 5
push 0
push 0x5d237f
call sub.USER32.dll_FindWindowA
test eax, eax
jne 0x441a04
test esi, 0x10
jne 0x4419f1
xor eax, eax
jmp 0x441a5a
dec ebx
test ebx, ebx
jne 0x4419fa
xor eax, eax
jmp 0x441a5a
push 1
call fcn.004d9f54
pop ecx
jmp 0x4419d5
push 0
call fcn.004417a4
pop ecx
mov ebx, 5
push 0
push 0x5d238d
call sub.USER32.dll_FindWindowA
test eax, eax
je 0x441a3d
push esi
call fcn.004418e0
pop ecx
mov edi, eax
push 0
push 0
call fcn.004013d8
add esp, 8
push esi
call fcn.004418e0
pop ecx
test esi, 0x10
je 0x441a58
test edi, edi
jne 0x441a58
dec ebx
test ebx, ebx
je 0x441a58
push 1
call fcn.004d9f54
pop ecx
jmp 0x441a11
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x441a9c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, esi
and eax, 0x200
test eax, eax
jne 0x441abe
push 1
call fcn.00441b18
pop ecx
push 0
push edi
call sub.USER32.dll_MapVirtualKeyA
test esi, 1
mov byte [ebp - 1], al
je 0x441ae1
push 0
push 0
mov dl, byte [ebp - 1]
push edx
mov ecx, edi
push ecx
call sub.USER32.dll_keybd_event
test esi, 2
je 0x441af9
push 0
push 2
mov al, byte [ebp - 1]
push eax
mov edx, edi
push edx
call sub.USER32.dll_keybd_event
and esi, 0x200
test esi, esi
jne 0x441b0d
push 2
call fcn.00441b18
pop ecx
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret