joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411850
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x41187b
call fcn.00414e57
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x41189e
push eax
push dword [esi + 4]
call fcn.004117d6
push esi
push eax
mov ecx, 0x45e1fc
call fcn.0041145d
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x4122b4
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x4451c6
call fcn.004313f2
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x20]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.00412274
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00401850
push dword [esi + 8]
mov edi, dword [edi + 8]
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push 3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
jne 0x41231b
push eax
push dword [esi + 8]
call fcn.004117d6
push dword [esi + 0xc]
mov ecx, 0x45e1fc
push eax
call fcn.0041145d
mov eax, esi
call fcn.004314ca
ret 0x1c

Function at 0x413962
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4139aa
call fcn.00414e57
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4139aa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4139ed
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4139d6
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4139d6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4139ea
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41b88d
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x445984
call fcn.004313f2
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41b8b2
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41b8f8
lea ecx, [ebp - 0x10]
call fcn.00401850
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00410a09
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401960
mov eax, esi
call fcn.004314ca
ret 8

Function at 0x42a618
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42a65f
call fcn.00414e57
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42a65f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42a67b
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042a190
mov esi, eax
test edi, edi
je 0x42a679
test ebx, ebx
je 0x42a679
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42d911
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x42d935
cmp dword [edi + 0x54], 0
jne 0x42d935
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00414e57
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042d8d2
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42ece6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45c970]
jne 0x42ecf0
repz ret
jmp fcn.004362b3
Function at 0x4010a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x4010a8
mov eax, esi
pop esi
ret

Function at 0x401258
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x18], 0x50
cmp dword [ebp - 0x18], 0x220a
jle 0x4012dc
sar dword [eax - 0x7f], 0x66
test byte [ebx - 0x5b8d1a5d], 0x84
mov ecx, 0x6baf6806
mov dh, 0x28
mov byte [0xe5ac0d9b], al
mov byte [0x83348fa2], al
invalid
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x1f
jmp 0x4012f0
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x40146c
mov dword [ebp - 0x1c], 0x889
cmp dword [ebp - 0x1c], 0x1c68
jle 0x40137d
das
lahf
into
mov esi, 0xe87af024
in eax, dx
dec ecx
push cs
mov ecx, 0x5a8b9175
pop ebx
mov cl, 0x2f
push esp
test dh, ch
mov esi, 0xf644a87e
jl 0x401322
test al, 0x44
mul byte [ebp + 0x7c]
cli
popal
loopne 0x4012bf
loop 0x40134d
and ch, byte ds:[edx + 0x6850d8ce]
xchg esi, eax
add byte [eax], al
adc ch, byte [ebx]
add al, byte [eax]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x401390
mov byte [ebp - 1], 1
jmp 0x401394
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x4013ad
mov byte [ebp - 2], 1
jmp 0x4013b1
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
mov dword [ebp - 0x20], 0x136a
cmp dword [ebp - 0x20], 0x1612
jle 0x401430
mov bh, 0xc9
invalid
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x401442
and dword [ebp - 0x14], 0
jmp 0x40144f
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x4012e9
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x40d346
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x40d3d9
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x40d394
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0x1eb4
push 1
push dword [ebp - 0xc]
call fcn.0040d3eb
add esp, 0xc
jmp 0x40d3d7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x40d3c8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x40d3c6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x40d3d7
push 0
push 0x12fe
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x40d3e7
push 0
push 0x205b
call fcn.0040abd3
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40d428
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x40d46a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
push 0x1983
push 0x5b4d
call fcn.0040d53e
add esp, 0x18
jmp 0x40d53a
lea eax, [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x40d4bb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x797
push 0
call fcn.00412c55
add esp, 0x10
jmp 0x40d53a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x40d4f2
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40d4f0
push 0x142b
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x40d53a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x40d520
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x40d53a
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x40d515
mov esp, ebp
pop ebp
ret
Function at 0x413c8b
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x413cbf
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
push 0x3f57
call fcn.004166da
add esp, 0x10
jmp 0x413dd4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x413d8f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x413d4f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 1
jmp 0x413d2f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x1b
je 0x413d4d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x413d4b
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x413d24
jmp 0x413d8d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x413d71
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x13
jge 0x413d8d
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x413d8b
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x413d66
jmp 0x413dd4
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 1
push 0x4abe
push 0x1d0f
push 0
push dword [ebp - 0x44]
push 0
push dword [ebp - 0x48]
push 0x6d6a
push 0x881
push 0x7b8b
push 1
push 0x678e
push 0x1bc6
call fcn.00412592
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x41d59e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41d653
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x41d61f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41d5f8
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x41d61d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41d61d
push 0
push 0x12fe
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x41d651
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x4193
push dword [ebp - 0x28]
push 0x656c
push 0
push 1
push dword [ebp - 0x2c]
push 0x52c6
push 0x2384
call fcn.00413dd8
add esp, 0x20
jmp 0x41d679
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0x494a
push 0
push dword [ebp - 0x34]
push 0xe48
call fcn.00408712
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x420020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4200e1
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x420082
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x1489
push 0x2163
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x14]
call fcn.00420106
add esp, 0x14
jmp 0x4200df
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4200d5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4200d3
push 0
push 0x3c47
push 0xc8e
push 0
push 0x4a7b
push 0x5bac
push 0x2352
call fcn.0042a553
add esp, 0x1c
jmp 0x4200df
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x420102
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0x43c0
push 0
push dword [ebp - 0x34]
call fcn.0041c1cc
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4229c9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x422a8a
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x422a0d
push 1
push 0x394a
push 0x75d9
call fcn.00422acc
add esp, 0xc
jmp 0x422a88
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x422a62
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x422a60
push 0x6336
push 0
push 0xea5
push 0x65f8
push 1
push 0x5e02
push 1
push 0x2209
call fcn.0041ce55
add esp, 0x20
jmp 0x422a88
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x422a88
push 0x2120
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x422ac8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
push 1
push 0x519b
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
push eax
push 0x1088
call fcn.0041cedf
add esp, 0x20
mov esp, ebp
pop ebp
ret

Function at 0x4231c9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x423262
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x423211
push 0x4bb0
push 0x42c9
push 0x2607
push 1
push 0x3011
call fcn.0042328c
add esp, 0x14
jmp 0x423260
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x42322b
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x423260
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x423260
push 1
push 0x1d3b
push 0x45b0
push 0
push 0xb39
push 0x3db
push 1
push 0x5693
push 1
call fcn.00411d93
add esp, 0x24
jmp 0x423288
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 1
push 0x4c23
push 0xc4e
push dword [ebp - 0x18]
call fcn.00409e0d
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x42a6c5
Capabilities:
Connect pipe
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x42a72e
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x38]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 1
call fcn.0042a7c0
add esp, 0x24
jmp 0x42a7bc
lea eax, [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42a79b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x42a779
push 0
push 0x98d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x42a799
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x42a799
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x42a7bc
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0x92
push 0x6a7f
push 1
push 1
push dword [ebp - 0x44]
push 1
call fcn.004132c6
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x42e7c4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x42e86a
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42e833
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42e80c
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x42e831
push 0x6a3
push 0
push 0x12c1
push 0x2281
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x42e868
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42e85b
push 0x198b
push 0
push 0
push 0x192b
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x42e868
push 0x142b
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x42e882
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0x668d
push 1
call fcn.0042c689
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x42fd2b
Capabilities:
Extract resource via kernel32 functions
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x42fe3b
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42fdf1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42fdb5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x42fdb3
push 0x1fa
push 0x2141
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x42fdef
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x42fdef
push 0x16fc
push 0x7172
push 0
push 0x47ed
push 0
push 0x7011
push 1
push 0
call fcn.0043a23a
add esp, 0x20
jmp 0x42fe39
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x42fe27
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x42fe25
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x42fe39
push 1
push 0x1c06
push 0xc30
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x42fea7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x42fe86
push 0x19d1
push 0x6400
push 0x5c67
push 0x6a5c
push 0x5198
push 0x4b53
push 0x46e1
push 1
call fcn.0042f6b5
add esp, 0x20
jmp 0x42fea7
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
push 0x7f66
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
call fcn.0042f7e9
add esp, 0x10
mov esp, ebp
pop ebp
ret