joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425475
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e3e0
and dword [ebp - 4], 0
cmp dword [0x44f1f0], 0
mov ebx, eax
jne 0x425526
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4255d7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4255d7
push eax
call fcn.0041e36e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44f1f0], eax
call esi
push eax
call fcn.0041e36e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44f1f4], eax
call esi
push eax
call fcn.0041e36e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44f1f8], eax
call esi
push eax
call fcn.0041e36e
pop ecx
mov dword [0x44f200], eax
test eax, eax
je 0x425526
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e36e
pop ecx
mov dword [0x44f1fc], eax
mov eax, dword [0x44f1fc]
cmp eax, ebx
je 0x42557e
cmp dword [0x44f200], ebx
je 0x42557e
push eax
call fcn.0041e3e9
push dword [0x44f200]
mov esi, eax
call fcn.0041e3e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42557e
test edi, edi
je 0x42557e
call esi
test eax, eax
je 0x425575
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425575
test byte [ebp - 0xc], 1
jne 0x42557e
or dword [ebp + 0x10], 0x200000
jmp 0x4255b7
mov eax, dword [0x44f1f4]
cmp eax, ebx
je 0x4255b7
push eax
call fcn.0041e3e9
pop ecx
test eax, eax
je 0x4255b7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4255b7
mov eax, dword [0x44f1f8]
cmp eax, ebx
je 0x4255b7
push eax
call fcn.0041e3e9
pop ecx
test eax, eax
je 0x4255b7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f1f0]
call fcn.0041e3e9
pop ecx
test eax, eax
je 0x4255d7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4255d9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4

Function at 0x401000
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, 0x5bfe
mov eax, ecx
mov dword [0x4b4752], eax
mov dword [0x4b4739], 0
mov eax, dword [0x4b4739]
mov dword [0x4b48ef], eax
mov dword [0x4b49c1], 0
mov eax, dword [0x4b49c1]
mov eax, ebx
xor ebx, eax
test dword [0x4b428b], eax
jne 0x401045
mov ebx, 0x19c2
sub eax, ebx
dec eax
shl eax, 1
ror eax, 1
or eax, dword [0x4b43b9]
je 0x401077
sub eax, dword [0x4b47dd]
dec eax
mov ebx, 0x11e8
add eax, ebx
dec eax
or eax, ebx
mov ebx, 0x1dd0
sub eax, ebx
add eax, dword [0x4b4a1d]
xor ebx, eax
sub eax, dword [0x4b46db]
shr eax, 1
add dword [0x4b42db], eax
jmp fcn.00402754
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x47643975
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x71ce589e
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x4352f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2a000]
push edi
or ebp, 0xffffffff
jmp 0x435312
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x435319
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x435308
mov eax, 1
add ebx, ebx
jne 0x43532b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x435320
jne 0x43533c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435320
xor ecx, ecx
sub eax, 3
jb 0x435350
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4353c2
mov ebp, eax
add ebx, ebx
jne 0x43535b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x435368
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43538c
inc ecx
add ebx, ebx
jne 0x435378
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43536d
jne 0x435389
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43536d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4353ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43539d
jmp 0x43530e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4353ac
add edi, ecx
jmp 0x43530e
pop esi
mov edi, esi
mov ecx, 0x84f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4353ca
cmp byte [edi], 6
jne 0x4353ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4353cf
lea edi, [esi + 0x33000]
mov eax, dword [edi]
or eax, eax
je 0x43543e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x36238]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x362ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4353fc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x362f0]
or eax, eax
je 0x435438
mov dword [ebx], eax
add ebx, 4
jmp 0x435419
call dword [esi + 0x362f4]
popal
jmp 0x416f64
Function at 0x417520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.00489ac0
mov dword [esp], 0xc8
mov dword [esp + 4], 0x96
push dword [0x1c53098]
call fcn.0046df19
mov ebx, eax
push dword [0x1c53098]
call fcn.0046e329
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 8], ebx
push dword [0x1c53098]
call fcn.0046df88
mov ebx, eax
push dword [0x1c53098]
call fcn.0046e889
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 4]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0xc], ebx
push reloc.WS2_32.dll_connect
push dword [0x1c52dd4]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0
call fcn.0046e337
push 0xa
call fcn.0047fec1
push eax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 6
call fcn.00468d88
push 8
call fcn.0047fec1
push eax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 4
call fcn.00468d88
push 9
call fcn.0047fec1
push eax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 5
call fcn.00468d88
push dword [0x1c5307c]
push 0x14
push 0xaa
push 0x78
push 0xf
push 7
call fcn.004675d6
call fcn.0042d4c8
call fcn.0046e228
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x417723
call fcn.004717f4
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x417720
push dword [esp + 0x20]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x41771f
call fcn.004717d6
push eax
mov ebx, 6
cmp ebx, dword [esp]
jne 0x4176d4
mov eax, 0x56671e
push eax
call fcn.004615bc
add esp, 0xc
jmp 0x417778
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4176f3
mov eax, 0x56671e
push eax
call fcn.004615bc
add esp, 0xc
jmp 0x417778
mov ebx, 5
cmp ebx, dword [esp]
jne 0x41770f
mov eax, 0x56671e
push eax
call fcn.004615bc
add esp, 0xc
jmp 0x417778
mov ebx, 7
cmp ebx, dword [esp]
jne 0x41771e
add esp, 0xc
jmp 0x417778
pop eax
pop eax
pop eax
jmp 0x41772d
push 0
call fcn.0046e897
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x417750
call fcn.0046e738
mov ebx, eax
and ebx, ebx
jne 0x417750
call fcn.0042d4c8
jmp 0x417778
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x417773
call fcn.0046e738
mov ebx, eax
and ebx, ebx
jne 0x417773
call fcn.0042d4c8
jmp 0x417778
jmp 0x417680
push 0
call fcn.0046dba7
xor eax, eax
add esp, 0x10
pop edi
pop ebx
ret 4
Function at 0x419bbb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x419bc2
call fcn.00489ac0
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.00444000
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 4]
call fcn.00444000
mov dword [esp + 8], 0x1a4
mov dword [esp + 0xc], 0xa0
push dword [0x1c53098]
call fcn.0046df19
mov ebx, eax
push dword [0x1c53098]
call fcn.0046e329
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 8]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0x10], ebx
push dword [0x1c53098]
call fcn.0046df88
mov ebx, eax
push dword [0x1c53098]
call fcn.0046e889
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 0xc]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0x14], ebx
push edx
call fcn.00489920
pop edx
push eax
push reloc.WS2_32.dll_connect
mov edx, dword [0x1c52f58]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
mov edx, dword [esp + 0xc]
push edx
call fcn.00489960
call fcn.00489a50
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x28]
push dword [esp + 0x28]
push 1
call fcn.004446b2
add dword [esp + 0x14], edx
call fcn.0046e337
call fcn.004446d0
push dword [esp + 4]
push 0x50
push 0x17c
push 0xa
push 0xf
push 3
call fcn.0046a012
push dword [0x1c52e8c]
push 0x1e
push 0x14a
push 0x6e
push 0x2d
push 7
call fcn.004675d6
call fcn.0042d4c8
call fcn.0046e228
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x419e08
call fcn.004717f4
push eax
mov ebx, 1
cmp ebx, dword [esp]
jne 0x419e05
push dword [esp + 0x1c]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x419e04
call fcn.004717d6
push eax
mov ebx, 7
cmp ebx, dword [esp]
jne 0x419e03
push dword [esp + 0xc]
mov edx, 0x57817e
pop ecx
call fcn.00444660
je 0x419d88
mov eax, 0x573780
push eax
call fcn.004615bc
jmp 0x419dfe
push dword [esp + 0xc]
mov edx, 0x571280
pop ecx
call fcn.00444660
je 0x419da6
mov eax, 0x5759dc
push eax
call fcn.004615bc
jmp 0x419dfe
push dword [esp + 0xc]
mov edx, 0x567752
pop ecx
call fcn.00444660
je 0x419dc4
mov eax, 0x5775ba
push eax
call fcn.004615bc
jmp 0x419dfe
push dword [esp + 0xc]
mov edx, 0x575d14
pop ecx
call fcn.00444660
je 0x419de2
mov eax, 0x578d0e
push eax
call fcn.004615bc
jmp 0x419dfe
push dword [esp + 0xc]
mov edx, 0x5713c8
pop ecx
call fcn.00444660
je 0x419dfe
mov eax, 0x57c51e
push eax
call fcn.004615bc
add esp, 0xc
jmp 0x419e5f
pop eax
pop eax
pop eax
jmp 0x419e12
push 1
call fcn.0046e897
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x419e36
call fcn.0046e738
mov ebx, eax
cmp ebx, 1
jne 0x419e36
call fcn.0042d4c8
jmp 0x419e5f
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x419e5a
call fcn.0046e738
mov ebx, eax
cmp ebx, 1
jne 0x419e5a
call fcn.0042d4c8
jmp 0x419e5f
jmp 0x419d1c
push 1
call fcn.0046dba7
xor eax, eax
push dword [esp]
call fcn.00489b20
push dword [esp + 4]
call fcn.00489b20
add esp, 0x1c
pop edi
pop ebx
ret 8
Function at 0x429d47
Capabilities:
Hide graphical window

Disassembly:
push ebx
call fcn.00489ac0
push dword [esp + 8]
call fcn.0046dd15
and eax, eax
je 0x429e38
mov ebx, dword [esp + 8]
cmp ebx, dword [0x1c53098]
jne 0x429dcb
push dword [0x1c5309c]
call fcn.0046dd15
and eax, eax
je 0x429d89
push 1
push dword [0x1c5309c]
call fcn.0046e075
push 0
push dword [0x1c53098]
call fcn.0046e075
push 9
push dword [0x1c53098]
call fcn.0046dd27
push eax
call sub.USER32.dll_ShowWindow
push dword [0x1c53098]
call fcn.0046dd27
push eax
call sub.USER32.dll_SetForegroundWindow
push dword [0x1c53098]
call fcn.0046e897
mov ebx, dword [esp + 8]
cmp ebx, dword [0x1c5309c]
jne 0x429e38
push dword [0x1c53098]
call fcn.0046dd15
and eax, eax
je 0x429df6
push 1
push dword [0x1c53098]
call fcn.0046e075
push 0
push dword [0x1c5309c]
call fcn.0046e075
push 9
push dword [0x1c5309c]
call fcn.0046dd27
push eax
call sub.USER32.dll_ShowWindow
push dword [0x1c5309c]
call fcn.0046dd27
push eax
call sub.USER32.dll_SetForegroundWindow
push dword [0x1c5309c]
call fcn.0046e897
xor eax, eax
pop ebx
ret 4
Function at 0x43d266
Capabilities:
Query environment variable

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.00489ac0
push dword [esp + 0x1c]
call fcn.004446d0
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.00444000
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push 0x3e8
call fcn.00486f00
call fcn.00489a50
lea eax, [esp + 8]
push eax
call fcn.004899c0
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, 0x571726
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, 0x560098
lea ecx, [esp + 8]
call fcn.00444008
push edx
call fcn.00489920
pop edx
push eax
push 0xe
mov edx, dword [esp + 0xc]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
mov edx, 0x56d8f4
push edx
call fcn.00489960
call fcn.00489a50
push edx
call fcn.00489920
pop edx
push eax
mov edx, 0x566a70
push edx
call fcn.00489960
mov edx, dword [esp + 0x10]
push edx
call fcn.00489960
call fcn.00489a50
mov edx, dword [esp + 0x14]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
mov edx, 0x56531e
push edx
call fcn.00489960
call fcn.004446b2
add dword [esp], edx
call fcn.004446b2
add dword [esp + 4], edx
call fcn.004446b2
add dword [esp + 8], edx
call fcn.0046106e
call fcn.004446d0
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x43d3f4
push dword [esp + 0xc]
call fcn.004615d3
and eax, eax
je 0x43d3eb
push dword [esp + 0xc]
call fcn.0046161a
and eax, eax
je 0x43d3e9
mov edx, dword [esp + 8]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push 0x18
push dword [esp + 0x20]
call fcn.00461640
call fcn.004446b2
add dword [esp], edx
call fcn.0041b8c1
pop eax
mov edx, 0x5775b4
push edx
call fcn.00489960
lea eax, [esp + 0xc]
push eax
call fcn.004899c0
jmp 0x43d374
push dword [esp + 0xc]
call fcn.004616ad
mov edx, dword [esp + 8]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
pop eax
push eax
call fcn.004446a0
pop edx
add eax, edx
jmp 0x43d41c
push dword [esp]
call fcn.00489b20
push dword [esp + 4]
call fcn.00489b20
push dword [esp + 8]
call fcn.00489b20
add esp, 0x10
pop ebx
ret 4
Function at 0x43f985
Capabilities:
Query service status

Disassembly:
push ebp
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x43f98b
call fcn.00489ac0
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00444000
lea eax, [esp + 4]
push 0xf003f
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
je 0x43fa12
push 0xf01ff
push dword [esp + 4]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_OpenServiceW
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x43fa00
lea eax, [esp + 4]
push eax
push dword [esp + 0x28]
call sub.ADVAPI32.dll_QueryServiceStatus
push dword [esp + 0x24]
call sub.ADVAPI32.dll_CloseServiceHandle
push dword [esp + 0x20]
call sub.ADVAPI32.dll_CloseServiceHandle
lea ebp, [esp + 4]
mov eax, dword [ebp + 4]
jmp 0x43fa14
xor eax, eax
push dword [esp]
call fcn.00489b20
add esp, 0x28
pop ebp
ret 4
Function at 0x440af4
Capabilities:
Terminate process

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.00489ac0
push dword [esp + 0x10]
push 0
push 1
call sub.KERNEL32.dll_OpenProcess
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
je 0x440b3d
push 1
push dword [esp + 4]
call sub.KERNEL32.dll_TerminateProcess
and eax, eax
je 0x440b35
mov dword [esp + 4], 1
push dword [esp]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 4]
jmp 0x440b45
add esp, 8
pop ebx
ret 4

Function at 0x442d59
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.00489ac0
push dword [esp + 0xc]
call fcn.004446d0
mov ebx, dword [0x1c536dc]
and ebx, ebx
jne 0x442d95
push 0
push 0
call sub.USER32.dll_FindWindowW
mov dword [0x1c536e0], eax
mov dword [0x1c536dc], 1
jmp 0x442daa
push 2
push dword [0x1c536e0]
call sub.USER32.dll_GetWindow
mov dword [0x1c536e0], eax
mov ebx, dword [0x1c536e0]
and ebx, ebx
je 0x442e44
push 0xfffffff0
push dword [0x1c536e0]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x10000000
cmp ebx, 0x10000000
jne 0x442e42
push 0xffffffec
push dword [0x1c536e0]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x80
cmp ebx, 0x80
je 0x442e42
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push 0x100
call fcn.00486f00
lea eax, [esp + 4]
push eax
call fcn.004899c0
push 0x100
push dword [esp + 4]
push dword [0x1c536e0]
call sub.USER32.dll_GetWindowTextW
push dword [esp]
mov edx, 0x560098
pop ecx
call fcn.00444660
jne 0x442e42
jmp 0x442e5c
jmp 0x442e4e
mov dword [0x1c536dc], 0
mov ebx, dword [0x1c536e0]
and ebx, ebx
jne 0x442d6b
mov edx, dword [esp]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
pop eax
push eax
call fcn.004446a0
pop edx
add eax, edx
jmp 0x442e83
push dword [esp]
call fcn.00489b20
add esp, 4
pop ebx
ret

Function at 0x4452b3
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x44534b
push edi
push 0x1c5538c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x1c537f8]
test edi, edi
je 0x44531f
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x445318
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x1c537f8
call fcn.0048980c
pop ecx
pop ecx
jmp 0x44531a
mov edi, dword [edi]
test edi, edi
jne 0x4452ef
pop ebx
mov eax, dword [0x1c4d314]
mov esi, eax
inc eax
push 0x10
push 0x1c537f8
mov dword [0x1c4d314], eax
call fcn.0048984c
pop ecx
pop ecx
push 0x1c5538c
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x445353
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.00445267
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x1c5538c
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x1c537f8]
jmp 0x445384
cmp dword [esi + 0xc], edi
je 0x44538a
mov esi, dword [esi]
test esi, esi
jne 0x44537d
jmp 0x4453a2
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x1c537f8
call fcn.0048980c
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4
Function at 0x446aab
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x446b00
push dword [esp + 0x10]
push 0x446a2a
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x1c53a7c]
test esi, esi
je 0x446b59
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x446af8
cmp byte [esi + 0x10], 0
je 0x446af8
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x446ad4
jmp 0x446b59
mov esi, dword [0x1c53a7c]
test esi, esi
je 0x446b59
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x446b52
cmp byte [esi + 0x11], 0
je 0x446b2e
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x446b45
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x1c53a7c
call fcn.0048980c
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x446b0d
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x460e92
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x1c556e8]
call fcn.00488ec9
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x460f92
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x460ee8
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x460ee0
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x460f28
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x460f6a
push 0x22
pop edx
cmp cx, dx
je 0x460f1a
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x460f0a
xor ecx, ecx
cmp word [eax], cx
je 0x460f6a
mov ecx, eax
add eax, 2
jmp 0x460f6c
test dx, dx
je 0x460f72
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x460f1a
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x460f60
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x460f6a
cmp cx, dx
je 0x460f5d
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x460f4d
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x460f32
jmp 0x460f1a
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x460f74
xor edx, edx
cmp dword [ebp], ebx
jne 0x460f7d
test edi, edi
jne 0x460f9a
test edx, edx
je 0x460f82
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x460ed6
test edi, edi
jne 0x460fab
mov eax, ebx
jmp 0x460faf
test esi, esi
je 0x460fab
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x460faf
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret