joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b260
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44b293
push esi
call fcn.0044e350
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44b28c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44b319
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44b302
mov eax, dword [esi + 8]
test eax, eax
je 0x44b2b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44b2fe
cmp eax, 2
je 0x44b302
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44b2aa
cmp eax, 3
je 0x44b2dd
cmp eax, 1
jne 0x44b2aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44b2aa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44b2aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044b340
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44b328
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044b340
add esp, 4
pop esi
ret

Function at 0x456600
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x456666
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x456666
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x456647
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4569f0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x456a28
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4576a0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4576e9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x457b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47d310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00457710
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00457790
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00457790
lea ecx, [esi + 0xc]
call fcn.0046ea36
lea ecx, [esi + 0x10]
call fcn.0046ea36
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00458d20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00458d20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00458d20
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046eaab
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046eaab
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x45adb0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x98d63c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x45adc3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x45ae04
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x98d6e4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x45ae36
mov bl, byte [esp + ecx + 0x4c]
jmp 0x45ae3a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x45ae2b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x45ae58
mov bl, byte [esp + ecx + 0x4c]
jmp 0x45ae5c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x45ae4d
xor ecx, ecx
mov eax, 0x98d64c
xor ebx, ebx
mov bl, byte [ecx + 0x98d6f4]
cmp byte [esp + ebx + 0x14], 0
je 0x45ae87
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x98d70c]
cmp byte [esp + ebx + 0x14], 0
je 0x45ae9e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x45ae6e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x45adf7
lea edx, [esp + 0x84]
push edx
call fcn.0045aee0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x470e52
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x470e8a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046ef06
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046eede
jmp 0x470e96
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x472540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x472582
call fcn.004782f8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x472582
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x472579
xor eax, eax
jmp 0x47258a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00472590
pop edi
pop esi
pop ebx
ret 4

Function at 0x478828
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x478856
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x478874
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047878e
jmp 0x478874
mov eax, dword [esi + 0x14]
test eax, eax
je 0x478874
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047878e
test edi, edi
mov eax, edi
jne 0x47885e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 8], 0
je 0x403d2f
push edi
xor edi, edi
test ebx, ebx
je 0x403cf0
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x403d00
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov al, byte [ecx + edx]
mov ecx, dword [ebp + 8]
mov byte [edi + ecx], al
inc dword [esi + 0xc]
inc edi
cmp edi, ebx
jb 0x403cd1
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0
lea ecx, [ebp - 4]
push ecx
push 0x10000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403cf0
mov eax, dword [ebp - 4]
test eax, eax
je 0x403cf0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x403cd9
push esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040e810
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
jmp 0x403cca
Function at 0x40dc10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
call fcn.00403700
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42b48e
mov edx, dword [ebp - 8]
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push str.Include
push edx
xor bl, bl
call edi
test eax, eax
jne 0x40dcc4
mov eax, dword [ebp - 4]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412999
add esp, 4
lea esi, [ebp - 0x10]
call fcn.004108b0
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push str.Include
push ecx
call edi
test eax, eax
jne 0x40dcbc
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
xor edx, edx
mov word [esi + eax*2], dx
mov eax, dword [ebp + 8]
mov ebx, esi
call fcn.00402250
mov bl, 1
lea esi, [ebp - 0x10]
call fcn.0040f4c0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40de60
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push ebx
push esi
push edi
mov edi, eax
lea eax, [ebp - 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00402050
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x43240a
mov ebx, 1
mov byte [ebp - 1], al
mov esi, 0x4ba1d8
cmp dword [0x4b903c], ebx
je 0x432423
push 0x4b903c
lea ecx, [ebp - 1]
mov eax, 0x4b9054
call fcn.0040f810
test al, al
je 0x432449
mov al, byte [0x4ba1d8]
mov bl, byte [0x4ba1d9]
push 0x4b9038
lea ecx, [ebp - 0x438]
push ecx
push 0x104
push 0x4b9054
mov byte [0x4b9040], al
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edx, dword [0x4b903c]
push edx
push 0x4b9054
call fcn.00401560
test eax, eax
jne 0x43245b
cmp bl, 1
je 0x432481
call fcn.00410600
call fcn.004107e0
cmp byte [0x4b9040], 0
jne 0x40df32
mov esi, 0x4b9800
call fcn.0040e460
push 1
mov ecx, 0x4b9260
call fcn.004095c0
cmp byte [0x4b9040], 0
jne 0x40df51
mov ecx, 0x4b9800
call fcn.0040e560
mov ebx, 0x4ba1d8
call fcn.00401200
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
push 0x495834
push 0x495840
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40df68
push 0xffffffffffffffff
push ebx
mov ebx, dword [0x4b9044]
mov byte [ebp - 2], 0
call fcn.00403e00
mov cl, byte [0x4a85d0]
mov bl, byte [ebp - 2]
mov byte [0x4ba1db], cl
jmp 0x40def3
lea edx, [ebp - 0x228]
mov dword [0x4a85dc], ebx
push edx
jmp 0x40df62
mov ebx, 0x4ba1d8
call fcn.00401200
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4a85dc], 1
jmp 0x40df68
call fcn.004371d2
test al, al
jne 0x40df15
push 0x104
lea ecx, [ebp - 0x438]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [ebp - 1], 0
je 0x4324ff
mov edi, 0x495894
lea esi, [ebp - 0x14]
call fcn.00401bb0
mov edi, 0x4b9054
mov eax, esi
call fcn.00401c80
mov edi, 0x495894
mov eax, esi
call fcn.00401c80
mov eax, dword [ebp - 0x14]
push 1
lea edx, [ebp - 0x228]
push edx
push eax
lea ecx, [ebp - 0x438]
push ecx
push 0x495898
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.00402340
jmp 0x40df51
push 1
lea edx, [ebp - 0x228]
push edx
push edi
lea eax, [ebp - 0x438]
push eax
push 0x495898
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40df51
Function at 0x40f580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea ecx, [ebp - 8]
push ecx
xor eax, eax
push 1
push eax
mov word [esi], ax
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42a177
mov edx, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push eax
mov eax, dword [ebp - 8]
push edx
add edi, edi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f5f3
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0x10]
jae 0x42a17d
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp - 8]
push eax
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push eax
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
xor edx, edx
mov word [edi + esi - 2], dx
jmp 0x40f5df

Function at 0x40f8b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
or ecx, 0xffffffff
mov ebx, 0x4956ec
call fcn.00410240
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413790
push esi
call fcn.00410f86
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040fb20
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f960
xor ebx, ebx
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 0x18]
inc eax
add ecx, edx
cmp eax, 0x10
jl 0x40f904
mov eax, dword [ebp + 8]
push 0x498d0c
push eax
mov dword [edi + 8], ecx
call fcn.00414e59
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42bca6
push edi
call fcn.004102b0
cmp eax, ebx
je 0x42bcb0
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414edd
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x40f94c
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0041519b
add esp, 0x10
push 0x99f2
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044f514
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42bcdc
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00415472
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x40f94c

Function at 0x40fb20
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004128d0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret
Function at 0x4102b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10020
call fcn.00426550
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
jmp 0x4102d0
mov cl, byte [eax + 0x4a3248]
mov dl, byte [eax + 0x4a3240]
mov byte [ebp + eax - 0x20], cl
mov byte [ebp + eax - 0x18], dl
inc eax
cmp eax, 8
jl 0x4102d0
lea eax, [ebp - 8]
push str.AU3_
push eax
call fcn.00413790
push 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004124f0
add esp, 0x14
mov dword [ebp - 0xc], 0
mov eax, dword [ebx]
push eax
push 0x10000
lea ecx, [ebp - 0x10020]
push 1
push ecx
call fcn.0041519b
add esp, 0x10
cmp eax, 0x18
jl 0x410382
mov edi, eax
lea esi, [edi - 0x14]
test esi, esi
jle 0x410367
xor edx, edx
lea ebx, [ebx]
xor ecx, ecx
mov bl, byte [ebp + ecx - 0x20]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x10020]
je 0x42a00f
cmp ecx, 0x14
je 0x42a07e
inc edx
cmp edx, esi
jl 0x410340
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx]
push 1
lea edx, [ecx + edi - 0x14]
push 0xffffffffffffffec
push eax
mov dword [ebp - 0xc], edx
call fcn.00415561
add esp, 0xc
jmp 0x410311
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov bl, byte [ebp + ecx - 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001f]
jne 0x42a060
mov bl, byte [ebp + ecx - 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001e]
jne 0x42a066
mov bl, byte [ebp + ecx - 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001d]
jne 0x42a06e
mov bl, byte [ebp + ecx - 0x1c]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001c]
jne 0x42a076
add ecx, 5
cmp ecx, 0x14
jl 0x410342
jmp 0x410356
inc ecx
jmp 0x410356
add ecx, 2
jmp 0x410356
add ecx, 3
jmp 0x410356
add ecx, 4
jmp 0x410356
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 0
lea edx, [ecx + edx + 0x14]
push edx
push eax
call fcn.00415561
mov ecx, dword [esi]
push ecx
push 4
lea edx, [ebp - 8]
push 1
push edx
call fcn.0041519b
lea eax, [ebp - 8]
push str.EA06
push eax
mov byte [ebp - 4], 0
call fcn.004151c0
add esp, 0x24
neg eax
sbb eax, eax
and eax, 4
jmp 0x410387

Function at 0x4107e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4a8608]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4a8608]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4a8600], eax
call esi
mov edx, dword [0x4a8600]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4a85fc], eax
call esi
mov eax, dword [0x4a8600]
push 0
push eax
call esi
pop esi
ret
Function at 0x410920
Capabilities:
Log keystrokes

Disassembly:
push ebx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [esi], 5
mov dword [esi + 4], 5
mov word [esi + 8], 1
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov word [esi + 0x18], bx
push ebx
mov dword [esi + 0x1a], ebx
mov word [esi + 0x1e], bx
push 0x5b
mov dword [esi + 0xc], 4
call edi
push ebx
push 0x10
mov byte [esi + 0x29], al
call edi
push ebx
push 0xa0
mov byte [esi + 0x26], al
call edi
push ebx
push 0xa1
mov byte [esi + 0x27], al
call edi
push ebx
push 0x11
mov byte [esi + 0x28], al
call edi
push ebx
push 0x12
mov byte [esi + 0x24], al
call edi
pop edi
mov byte [esi + 0x25], al
pop ebx
ret

Function at 0x41b238
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a1de0]
jne 0x41b242
repz ret
jmp fcn.00426216

Function at 0x4243ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a1de0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00418afc
and dword [ebp - 0x14], 0
cmp dword [0x4a823c], 0
mov dword [ebp - 0x18], eax
jne 0x42445f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x424507
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4936e8
push ebx
call edi
test eax, eax
je 0x424507
mov esi, dword [section..data]
push eax
call esi
push 0x4936d8
push ebx
mov dword [0x4a823c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a8240], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a8244], eax
call edi
push eax
call esi
mov dword [0x4a824c], eax
test eax, eax
je 0x42445f
push 0x493690
push ebx
call edi
push eax
call esi
mov dword [0x4a8248], eax
mov eax, dword [0x4a8248]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x4a1004]
cmp eax, ecx
je 0x4244b8
cmp dword [0x4a824c], ecx
je 0x4244b8
push eax
call esi
push dword [0x4a824c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4244b8
test ebx, ebx
je 0x4244b8
call edi
test eax, eax
je 0x4244af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4244af
test byte [ebp - 8], 1
jne 0x4244b8
or dword [ebp + 0x10], 0x200000
jmp 0x4244eb
mov eax, dword [0x4a8240]
cmp eax, dword [ebp - 0x18]
je 0x4244eb
push eax
call esi
test eax, eax
je 0x4244eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4244eb
mov eax, dword [0x4a8244]
cmp eax, dword [ebp - 0x18]
je 0x4244eb
push eax
call esi
test eax, eax
je 0x4244eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a823c]
call esi
test eax, eax
je 0x424507
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x424509
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b238
leave
ret
Function at 0x43458e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
cmp word [eax], 0
push ebx
push esi
push edi
je 0x4346af
push 0
push 0
push 3
push 0
push 0
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4345cc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4345c1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 8]
push edx
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x487960
push 0
push 0
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4345c1
mov ecx, dword [eax]
lea edx, [ebp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
mov eax, dword [ebp + 0x14]
jne 0x434688
cmp dword [eax], 0
jne 0x434688
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [eax]
mov ecx, dword [ecx]
mov edx, dword [ebp + 0xc]
push 0x2000
push eax
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x4346b6
mov dword [ebp + 0xc], 0
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
test eax, eax
je 0x4346c7
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 0xc]
push eax
push 0
mov dword [esi + 0x60], eax
mov esi, dword [esi]
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4346e9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
push esi
or ecx, 0x50000000
push edi
mov edi, dword [ebp + 8]
test eax, 0x80000
je 0x434709
and eax, 0xfff7ffff
mov edx, dword [0x4b9774]
push 0
push edx
mov edx, dword [ebp + 0x2c]
push edx
mov edx, dword [edi]
push edx
mov edx, dword [ebp + 0x28]
push edx
mov edx, dword [ebp + 0x24]
push edx
mov edx, dword [ebp + 0x20]
push edx
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x434774
cmp byte [ebp + 0x30], 0
je 0x434759
push 0
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [edi + 0x190], 0
jl 0x434774
cmp byte [edi + 0x19c], 0
je 0x434774
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x2c