joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44defc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x46c60c], 0
je 0x44e04b
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x46b80c]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x44e04b
mov eax, dword [0x46c610]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x46c60c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44e01a
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x46c60c]
call fcn.00407024
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x44e012
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x44e012
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x44e012
mov eax, dword [ebp - 0x14]
call fcn.00456a08
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x44e012
push ebp
call fcn.0044deb8
pop ecx
test al, al
jne 0x44e012
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x44dfce
mov eax, dword [ebp - 0x14]
call fcn.0045559c
dec eax
jle 0x44e012
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00424610
cmp byte [ebp - 1], 0
je 0x44e012
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x44e012
mov edx, dword [ebp - 0x14]
mov eax, dword [0x46c610]
call fcn.0044d680
inc edi
dec ebx
jne 0x44df61
mov eax, dword [0x46c610]
cmp dword [eax + 8], 0
jle 0x44e032
mov eax, dword [0x46c610]
call fcn.0044d710
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44e04b
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044dd20
pop ecx
test al, al
jne 0x44e04b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4515f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x451644
mov eax, esi
call fcn.0043ec40
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x451644
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x451644
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x451783
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x451684
cmp eax, 0x108
ja 0x451684
mov eax, esi
call fcn.0043ec40
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45177a
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x451783
jmp 0x45177a
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x451763
cmp eax, 0x20a
ja 0x451763
test byte [esi + 0x50], 0x80
jne 0x4516b6
sub eax, 0x203
je 0x4516b3
sub eax, 3
je 0x4516b3
sub eax, 3
jne 0x4516b6
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x4516ca
dec eax
je 0x4516df
dec eax
je 0x4516fc
dec eax
je 0x4516df
jmp 0x451703
mov ecx, ebx
mov eax, dword [0x46b80c]
mov eax, dword [eax]
mov edx, esi
call fcn.0044863c
jmp 0x45177a
cmp byte [esi + 0x5d], 1
jne 0x4516f5
mov eax, esi
mov si, 0xffed
call fcn.00424610
jmp 0x451783
or word [esi + 0x54], 1
jmp 0x45177a
and word [esi + 0x54], 0xfffe
jmp 0x45177a
mov eax, dword [0x46c5c8]
cmp byte [eax + 0x20], 0
je 0x45177a
mov eax, dword [0x46c5c8]
cmp dword [eax + 0x1c], 0
je 0x45177a
mov eax, dword [ebx]
mov edx, dword [0x46c5c8]
cmp eax, dword [edx + 0x1c]
jne 0x45177a
lea eax, [ebp - 0x114]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0043eb84
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00424610
jmp 0x451783
cmp eax, 0xb00b
jne 0x45177a
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0044ff34
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454c38
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x454c54
cmp dword [esi + 4], 0
je 0x454c81
test byte [ebx + 0x55], 1
jne 0x454c73
mov eax, ebx
call fcn.00453890
test eax, eax
jne 0x454c73
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x454d91
mov edx, esi
mov eax, ebx
call fcn.00454758
jmp 0x454d91
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x454d8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00456a08
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0045152c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00454c38
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00456a08
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454d91
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b22c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x46b650]
cmp byte [eax + 0xc], 0
je 0x45b399
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b392
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46c61c], 0
jne 0x45b280
push 0x45b3a0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x45b3a8
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c61c], eax
cmp dword [0x468310], 0
jne 0x45b37b
push 0x45b3b8
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x468310], eax
cmp dword [0x468310], 0
je 0x45b37b
push 0x45b3c4
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c620], eax
push 0x45b3d4
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c624], eax
push 0x45b3e8
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c628], eax
push 0x45b400
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c62c], eax
push 0x45b418
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c630], eax
push 0x45b42c
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c634], eax
push 0x45b444
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c638], eax
push 0x45b45c
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c63c], eax
push 0x45b478
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c640], eax
push 0x45b484
mov eax, dword [0x468310]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x46c644], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b399
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x460500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x460562
call fcn.004604b0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0045c814
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0045c814
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4605e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x469ef8], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4606ba
cmp dword [0x469ef4], 0
jne 0x4606ba
cmp dword [0x46a0d8], 0
je 0x460674
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004603b0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x46065a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004603b0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x46065a
lea ebx, [ebp - 0x84]
jmp 0x46065b
inc ebx
call fcn.0046059c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4606f5
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x469efc
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0045c814
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x469eff
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4606f5
cmp dword [0x469ef4], 0
je 0x4606d4
cmp dword [0x469ef4], 0xffffffff
je 0x4606f5
push esi
call dword [0x469ef4]
pop ecx
mov eax, dword [0x469ef8]
test eax, eax
je 0x4606f5
cmp dword [0x469ef8], 0xffffffff
je 0x4606f5
cmp byte [eax], 0
je 0x4606f5
push esi
push eax
call fcn.00460500
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460e8c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x46cea8], 0
jne 0x460f0d
cmp dword [0x46cec8], 0
jne 0x460ebc
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x46cec8], eax
test eax, eax
jne 0x460ebc
push str.GetEnvironmentStrings_failed
call fcn.0046070c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x46cec8]
jmp 0x460ed0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0045c814
pop ecx
mov edi, eax
test eax, eax
jne 0x460ec8
lea edi, [ebp + 1]
push edi
call fcn.0045c118
pop ecx
mov ebx, eax
mov dword [0x46ceac], ebx
test ebx, ebx
jne 0x460efa
xor eax, eax
jmp 0x460fd0
push edi
mov edx, dword [0x46cec8]
push edx
push ebx
call fcn.0045c6c4
add esp, 0xc
jmp 0x460f2d
xor esi, esi
mov ebx, dword [0x46cea8]
jmp 0x460f27
push eax
call fcn.0045c814
pop ecx
test eax, eax
jne 0x460f23
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x460f17
lea ebx, [esi + 4]
push 4
mov dword [0x46ceb0], ebx
inc ebx
push ebx
call fcn.0045bbf0
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x460f50
xor eax, eax
jmp 0x460fd0
cmp dword [0x46cea8], 0
jne 0x460f81
xor esi, esi
mov ebx, dword [0x46ceac]
mov eax, dword [esp]
mov ebp, eax
jmp 0x460f72
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0045c814
pop ecx
mov edi, eax
test eax, eax
jne 0x460f68
jmp 0x460fb2
xor esi, esi
mov ebx, dword [0x46cea8]
mov eax, dword [esp]
mov edi, eax
jmp 0x460fac
push eax
call fcn.0045c814
pop ecx
test eax, eax
je 0x460fa1
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x460fa5
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x460f90
mov eax, dword [0x46cea8]
test eax, eax
je 0x460fc2
push eax
call fcn.0045c128
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x46cea8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4013c3
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
or eax, 0xffffffff
mov dword [esi + 0x84], eax
mov dword [esi + 0xa8], eax
lea eax, [esp + 4]
push eax
mov dword [esi + 0x2c], 0x33
mov dword [esi + 0x30], 0x64
mov dword [esi + 0x34], 0x3c
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0xc]
shr ecx, 2
mov dword [esi + 0x38], ecx
mov eax, 1
mov dword [esi + 0xb4], 0x112
mov dword [esi + 0xb8], 0x201
mov dword [esi + 0xb0], eax
mov dword [esi + 0x8c], 0
mov ecx, 2
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], eax
mov byte [esi + 0x28], 3
pop esi
add esp, 0x20
ret

Function at 0x404950
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov eax, dword [ebp + 0x40054]
mov esi, dword [eax]
lea ebx, [ebp + 0x40050]
mov edi, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
test edi, edi
mov eax, ebx
mov ecx, dword [eax + 4]
je 0x4049f9
cmp edi, eax
jne 0x4049f9
cmp esi, ecx
je 0x4049fe
cmp esi, dword [edi + 4]
je 0x4049f4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jb 0x4049e1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x10], eax
cmp esi, dword [edi + 4]
je 0x4049f4
movzx ecx, byte [esi + 0xc]
mov edx, dword [esi + 0x18]
push ecx
mov ecx, ebp
call edx
test al, al
jne 0x4049e1
lea edx, [esp + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
call fcn.00406740
push esi
push edi
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.004058a0
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
jmp 0x40496f
lea edx, [esp + 0x10]
call fcn.00406740
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
jmp 0x404977
call fcn.00406600
call fcn.00406670
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x413070
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x4d24ac]
test eax, eax
je 0x4130b4
mov eax, dword [eax + 0xbc]
push 0
push 0
push 0
push 0
mov dword [0x4d2458], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0x4131b0
push 0
push 0
mov dword [0x4d2460], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4d245c], eax
pop ecx
ret
Function at 0x43fff0
Capabilities:
Access the windows event log

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 0x18
sub eax, 0
je 0x440016
sub eax, 1
je 0x44000f
sub eax, 1
jne 0x440016
mov eax, 1
jmp 0x44001b
mov eax, 2
jmp 0x44001b
mov eax, 4
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 1
push 0
push ecx
push 0
push eax
mov eax, dword [0x4d24b8]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
xor eax, eax
ret
Function at 0x442a80
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
mov ebx, ecx
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [ebx + 0xa0]
mov edi, dword [ecx]
lea eax, [ebx + 0x9c]
mov edx, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], edx
jmp 0x442ac4
mov edi, dword [esp + 0x14]
lea ecx, [ebx + 0x9c]
cmp eax, ecx
jne 0x442c3a
cmp edi, dword [esp + 0x2c]
je 0x442c44
test eax, eax
je 0x442c3a
cmp edi, dword [eax + 4]
je 0x442c3f
mov eax, dword [edi + 0x10]
movzx ecx, word [eax + 4]
push ecx
mov eax, ebx
call fcn.00442c50
mov edx, dword [edi + 0x10]
mov esi, eax
movzx eax, word [edx + 6]
push eax
mov eax, ebx
call fcn.00442c50
test esi, esi
mov edi, eax
je 0x442c25
test edi, edi
je 0x442c25
mov eax, dword [esi + 8]
add eax, dword [esi]
lea ebx, [esp + 0x30]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
mov esi, dword [esp + 0xc]
cdq
sub eax, edx
sar eax, 1
sar ecx, 1
push eax
push ecx
call fcn.004432e0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [edi + 8]
add eax, dword [edi]
mov dword [esp + 0x1c], edx
cdq
sub eax, edx
mov dword [esp + 0x18], ecx
mov ecx, eax
mov eax, dword [edi + 0xc]
add eax, dword [edi + 4]
sar ecx, 1
cdq
sub eax, edx
sar eax, 1
push eax
push ecx
lea ebx, [esp + 0x40]
call fcn.004432e0
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0x10]
mov eax, dword [edx + 9]
lea ebx, [eax + eax*2]
mov eax, dword [esp + 0x18]
add eax, ecx
cdq
sub eax, edx
mov edi, eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esi + ecx]
cdq
sub eax, edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x24], esi
mov esi, eax
sar edi, 1
sar esi, 1
cmp byte [edx + 0xbb], 0
lea ebx, [ebx*4 + 0x4d0ea0]
je 0x442bf8
mov eax, dword [ebx]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
cmp byte [eax + 8], 0
je 0x442be1
mov eax, dword [eax]
push eax
push str._02dP
jmp 0x442be9
mov ecx, dword [eax]
push ecx
push str._02d
push 0
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.0044f470
add esp, 0x14
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [ebx + 8]
call fcn.0044f8c0
mov ebx, dword [esp + 0x24]
add esp, 0x18
lea edx, [esp + 0x10]
call fcn.00445c40
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x442ac0
call fcn.00445ab0
call fcn.00445a40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x447620
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov edi, ecx
mov ebx, eax
mov eax, dword [edi + 0xb4]
push 0
push eax
call esi
mov eax, dword [ebx + 0x14]
push 5
push eax
mov dword [edi + 0xb4], eax
call esi
mov ecx, dword [edi + 0x14]
push 0
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call esi
push 2
push eax
call esi
push 2
push eax
call esi
cmp ebx, dword [edi + 0xc0]
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
mov esi, eax
jne 0x447692
push 8
push 0xbb9
push esi
call ebx
push 0
push 0xbba
push esi
call ebx
call fcn.00447480
pop edi
pop esi
pop ebx
ret
push 0
push 0xbb9
push esi
call ebx
push 8
push 0xbba
push esi
call ebx
call fcn.00447480
pop edi
pop esi
pop ebx
ret

Function at 0x4476b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov ecx, dword [ebp + 0xa8]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [ebp + 0xa8]
mov dword [ecx + 4], ecx
cmp eax, dword [ebp + 0xa8]
mov dword [ebp + 0xac], 0
je 0x4476f9
mov esi, dword [eax]
push eax
call fcn.00480ed5
add esp, 4
cmp esi, dword [ebp + 0xa8]
mov eax, esi
jne 0x4476e4
mov eax, dword [ebp + 0x94]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp + 0x9c]
mov ebx, dword [ecx]
lea esi, [ebp + 0x98]
mov edx, ecx
mov dword [esp + 0x14], edx
lea esp, [esp]
cmp esi, esi
jne 0x4477a0
cmp ebx, dword [esp + 0x14]
je 0x447753
cmp ebx, dword [esi + 4]
je 0x44774e
mov edi, dword [ebx + 8]
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
cmp ebx, dword [esi + 4]
je 0x44774e
mov ebx, dword [ebx]
jmp 0x447720
jmp fcn.00448740
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esi + 4]
mov dword [ecx + 4], ecx
cmp eax, dword [esi + 4]
mov dword [esi + 8], 0
je 0x447782
lea esp, [esp]
mov edi, dword [eax]
push eax
call fcn.00480ed5
add esp, 4
cmp edi, dword [esi + 4]
mov eax, edi
jne 0x447770
mov eax, dword [ebp + 0x90]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, ebp
call fcn.00449180
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
jmp 0x4487b0
push 0xffffffffffffffff
push 0x4a9c28
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4ce090]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push 0x18
push str.invalid_list_T__argument
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.004031b0
mov dword [esp + 0x50], 0
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x24]
call fcn.00402db0
push 0x4bdaf0
lea ecx, [esp + 0x24]
push ecx
call fcn.00483c4b
int3
Function at 0x449930
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x104
mov eax, dword [0x4ce090]
xor eax, esp
mov dword [esp + 0x100], eax
push 0xfe
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.00485500
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp eax, 0x412
jg 0x4499a4
je 0x449993
sub eax, 0x404
je 0x44998c
sub eax, 0xd
jne 0x4499ab
push str.MS_Gothic
push 0xff
lea ecx, [esp + 8]
push ecx
jmp 0x4499cb
push str.PMingliu
jmp 0x4499c1
push str.Gulim
push 0xff
lea eax, [esp + 8]
push eax
jmp 0x4499cb
cmp eax, 0x804
je 0x4499bc
push str.Gulim
push 0xff
lea ecx, [esp + 8]
push ecx
jmp 0x4499cb
push str.SimSun
push 0xff
lea edx, [esp + 8]
push edx
call fcn.004824ec
add esp, 0xc
mov ecx, dword [esp + 0x108]
lea eax, [esp]
push eax
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00480d70
add esp, 0x104
ret
Function at 0x454a50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x454ad1
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x454a67
push esi
sub eax, edx
push edi
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x454a93
sub eax, edi
lea ecx, [eax + 1]
cmp ecx, 0x7fffffff
ja 0x454ab4
mov eax, ebx
call fcn.0040c710
test eax, eax
je 0x454ab9
call fcn.004599e0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret
Function at 0x45aab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edx]
push esi
mov ecx, 0x20
push edi
lea esp, [esp]
mov edi, eax
shr edi, 2
xor edi, eax
shr edi, 2
xor edi, eax
shr edi, 1
xor edi, eax
shr edi, 1
xor edi, eax
shr edi, 1
mov esi, eax
ror esi, 1
xor edi, eax
and esi, 0xfffffffe
and edi, 1
or esi, edi
sub ecx, 1
mov eax, esi
jne 0x45aac0
pop edi
mov dword [edx], eax
pop esi
ret

Function at 0x45aef0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
cmp dword [esi + 4], 0xffffffff
mov dword [esi + 8], eax
jne 0x45af23
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x45af23
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, esi
call fcn.0045aed0
xor eax, eax
ret
mov eax, 1
ret