joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008a66
Capabilities:
Listen for remote procedure calls

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [0x100a07c], 2
push ebx
push esi
push edi
mov edi, 0x100258c
je 0x1008a99
cmp byte [0x100a079], 4
jb 0x1008a99
push edi
push 0x1a
push dword [0x100a074]
push dword [0x100a070]
call fcn.010027af
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x1008aa7
mov ebx, fcn.010080bf
jmp 0x1008acb
cmp eax, 1
jne 0x1008ab3
mov ebx, 0x1008625
jmp 0x1008acb
cmp eax, 2
jne 0x1008abf
mov ebx, 0x100879a
jmp 0x1008acb
cmp eax, 3
jne 0x1008c43
mov ebx, dword [ebp + 0x14]
test byte [0x100a07c], 2
je 0x1008afa
cmp byte [0x100a079], 5
jb 0x1008afa
push dword [0x100a148]
push dword [ebp + 0xc]
push edi
push 0x1b
push dword [0x100a074]
push dword [0x100a070]
call fcn.01008045
push 0
push dword [ebp + 0xc]
push 0xa
push dword [0x100a148]
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov esi, eax
xor eax, eax
cmp esi, eax
je 0x1008b35
test byte [0x100a07c], 2
je 0x1008c46
cmp byte [0x100a079], 2
jb 0x1008c46
push esi
push edi
push 0x1c
jmp 0x1008b68
push ebx
push eax
push 8
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov esi, eax
test esi, esi
je 0x1008b7e
test byte [0x100a07c], 2
je 0x1008c46
cmp byte [0x100a079], 2
jb 0x1008c46
push esi
push edi
push 0x1d
push dword [0x100a074]
push dword [0x100a070]
call fcn.010050cb
jmp 0x1008c46
mov ebx, 0x100a18c
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
test byte [0x100a07c], 2
mov dword [ebp + 0x10], eax
je 0x1008bdf
cmp byte [0x100a079], 5
jb 0x1008bb6
push dword [ebp + 0xc]
push edi
push 0x1e
push dword [0x100a074]
push dword [0x100a070]
call fcn.010027d5
test byte [0x100a07c], 2
je 0x1008bdf
cmp byte [0x100a079], 5
jb 0x1008bdf
push dword [ebp + 0x10]
push edi
push 0x1f
push dword [0x100a074]
push dword [0x100a070]
call fcn.010050cb
cmp dword [ebp + 0x10], 1
jne 0x1008c56
push 1
push 0x4d2
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
cmp esi, 0x6b1
jne 0x1008c00
xor esi, esi
test esi, esi
je 0x1008c56
test byte [0x100a07c], 2
je 0x1008c2b
cmp byte [0x100a079], 2
jb 0x1008c2b
push esi
push edi
push 0x20
push dword [0x100a074]
push dword [0x100a070]
call fcn.010050cb
push 1
push 0
push dword [ebp + 8]
call dword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x1008c46
push 0x57
pop esi
test esi, esi
jle 0x1008c56
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40ae0a
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x432040], 0x20
push esi
push edi
mov esi, ecx
je 0x40ae4b
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x428d88
push dword [0x43204c]
push dword [0x432048]
call 0x40db77
push 0x1c135e
call fcn.004049dc
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x10], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 4]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x40ae93
cmp ecx, edi
je 0x40aec3
mov esi, eax
mov dword [ebp - 0x10], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x40ae93
cmp ecx, dword [ebp - 0x10]
jne 0x40ae93
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x401030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x401038
mov eax, esi
pop esi
ret
Function at 0x421851
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x42187c
push 0
push 0
push 0
push 0
push 0x1f26
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x421894
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 1
push dword [ebp - 4]
push 0x7b77
call fcn.0041e1b4
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x424720
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
mov byte [ebp - 4], dl
je 0x42474e
test dl, dl
je 0x424735
inc dword [ecx]
jmp 0x424754
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f26
push 1
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x424754
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov esp, ebp
pop ebp
ret

Function at 0x424c75
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
test cl, cl
je 0x424cf0
cmp byte [ebp + 0x14], 0
je 0x424cd1
mov esi, dword [ebp + 0x18]
xor ebx, ebx
mov dword [esi], ebx
jmp 0x424cca
mov dword [ebp - 0xc], 0xdb74a71a
mov dword [ebp - 0xc], 3
cmp dword [ebp - 0xc], ebx
jl 0x424cc8
mov byte [ebp - 1], bl
mov byte [ebp - 8], bl
cmp byte [ebp - 1], bl
je 0x424cc3
push 0xf20
push 0x2356
push 0x1fd
call dword [sym.imp.KERNEL32.dll_MulDiv]
dec dword [ebp - 0xc]
jns 0x424ca3
inc dword [esi]
cmp dword [esi], 0x12
jge 0x424c90
jmp 0x424d30
mov dword [edx], 0
cmp dword [edx], 2
jge 0x424d30
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x424cdf
jmp 0x424d30
cmp byte [ebp + 8], 0
je 0x424d19
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x424d30
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
jmp 0x424d30
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 0x1f26
push 1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431c8d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], 0x6df37d45
mov dword [ebp - 0x10], 0
push 3
lea ecx, [ebp - 0x48]
call fcn.0041796c
mov dword [ebp - 0x24], 0xdca27289
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x431cd7
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x431cf0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x48]
call fcn.00417a5a
mov dword [eax], 0xf58
jmp 0x431cd0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x431d19
push 0
push 0
push 0
push 0
push 0x1f26
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x431d2a
mov dword [ebp - 0x14], 1
jmp 0x431d2e
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push 0
lea ecx, [ebp - 0x48]
call fcn.00417a5a
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x431d5e
mov dword [ebp - 0x2c], 1
jmp 0x431d62
and dword [ebp - 0x2c], 0
cmp dword [ebp - 8], 1
jne 0x431d71
mov dword [ebp - 0x1c], 1
jmp 0x431d75
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1c], eax
jge 0x431d86
mov dword [ebp - 0x20], 1
jmp 0x431d8a
and dword [ebp - 0x20], 0
imul eax, dword [ebp - 0x20], 0x2524
sub eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x28], eax
jne 0x431dae
mov dword [ebp - 0x30], 1
jmp 0x431db2
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x30]
jg 0x431dc3
mov dword [ebp - 0x34], 1
jmp 0x431dc7
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x48]
call fcn.00417a3e
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push 0x50f6
push 0x2965
push 1
push dword [ebp + 8]
push 0x7227
push 0x6ad
call fcn.004335d2
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x43749d
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], cl
test dl, dl
je 0x4374f5
test cl, cl
je 0x4374c7
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x43756e
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x43756e
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x43756e
push 0
push 0x1147
push 0x134d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x43756e
cmp byte [ebp + 8], 0
push esi
je 0x43751e
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x43756d
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x43750d
jmp 0x43756d
push 0xbc0
push 0x2324
push 0xe67
push 0
push 0x118d
push 0x870
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x1a2b
push 0xf34
push 0x1ad3
push 0x2272
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x437a77
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 6
mov dword [ebp - 0xc], 0
jmp 0x437a94
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x437aa7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x18], 6
jmp 0x437a8d
mov dword [ebp - 8], 2
jmp 0x437ab7
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x437ad1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x437acf
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x437ab0
mov dword [ebp - 8], 0
jmp 0x437ae1
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x437af4
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18], 0xfffffffd
jmp 0x437ada
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0
call fcn.0044b298
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x43bbef
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43bc60
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43bc53
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.00417a5a
mov esi, eax
push 3
mov ecx, dword [ebp - 4]
call fcn.00417a5a
mov ecx, dword [esi]
add ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x43bc5e
push 0x21f4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x43bca8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
push 0x204c
push 0x168d
push 0x568b
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x63cc
push 0x1b3a
push dword [ebp - 0x28]
push 0x49e2
push 0
push 0x67c1
call fcn.00447af6
add esp, 0x2c
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43c3a7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43c3cf
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x282e
push dword [ebp - 4]
push 1
call fcn.0043c434
add esp, 0xc
jmp 0x43c430
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43c3f9
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x43c430
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43cc44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43cd10
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43ccf1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jge 0x43ccc3
mov dword [ebp - 4], 1
jmp 0x43ccc7
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 4]
je 0x43cce2
mov dword [ebp - 0xc], 1
jmp 0x43cce6
and dword [ebp - 0xc], 0
imul eax, dword [ebp - 0xc], 0xfffffffd
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x43cd0e
push 0
push 0
push 0
push 0
push 0x1f26
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x43cd18
push 1
call fcn.0043bcad
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x43f3e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43f457
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43f42c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43f42a
push 0
push 0x328
push 0x82d
push 0xc1
push 1
push 0x9f1
call fcn.0043c3a7
add esp, 0x18
jmp 0x43f455
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43f455
push 0
push 0
push 0
push 0
push 0x1f26
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x43f471
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0x5e
push 0x76e0
push 1
push dword [ebp - 0xc]
call fcn.0043943e
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x447d51
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x447d75
push 0x7ace
push 0x23f7
push 1
call fcn.00447dcf
add esp, 0xc
jmp 0x447dcb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x447db4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x447db2
push 0x239e
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x447dcb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x453ff7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x45409d
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x454050
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x45404e
push 0
push 0
push 0
push 0
push 0x1f26
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x45409b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x45407e
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x45409b
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.00417a5a
mov dword [eax], 0xe13f
jmp 0x454073
jmp 0x4540cc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
push 0
push 0x285e
push dword [ebp - 0x24]
push 0x5455
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0045740f
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x454455
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4544ec
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4544cd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4544b1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x4544cb
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.00417a5a
or dword [eax], 0xffffffff
jmp 0x4544a6
jmp 0x4544ea
push 0
push 0
push 0
push 0
push 0x1f26
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x45450a
push 0x76cc
push 0x3ee6
push 0x4b68
push 0
push 0xbff
call fcn.00466aaa
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4669e5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x466a26
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
call fcn.00466aaa
add esp, 0x14
jmp 0x466aa6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x466a5b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x466a59
push 0x21f4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x466aa6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x466a89
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x466aa6
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00417a5a
mov dword [eax], 0x77862fd4
jmp 0x466a7e
mov esp, ebp
pop ebp
ret
Function at 0x4769ff
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47cacc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0047333e
mov dword [ebp - 0x14], eax
cmp dword [0xa6effc], esi
jne 0x476af2
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x476a7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x476bd2
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x476bd2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x476bd2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xa6effc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xa6f000], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xa6f004], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa6f00c], eax
test eax, eax
je 0x476aef
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa6f008], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x476b17
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x476b0a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x476b2c
push 4
pop eax
jmp 0x476bd4
cmp dword [ebp - 0x14], esi
je 0x476b2c
push dword [0xa6effc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x476b11
mov eax, dword [0xa6f008]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x476b8a
cmp dword [0xa6f00c], edi
je 0x476b8a
push eax
call ebx
push dword [0xa6f00c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x476b8a
test eax, eax
je 0x476b8a
call ecx
test eax, eax
je 0x476b7f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x476b7f
test byte [ebp - 8], 1
jne 0x476b8a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x476bba
mov eax, dword [0xa6f000]
cmp eax, edi
je 0x476bb7
push eax
call ebx
test eax, eax
je 0x476bb7
call eax
mov esi, eax
test esi, esi
je 0x476bb7
mov eax, dword [0xa6f004]
cmp eax, edi
je 0x476bb7
push eax
call ebx
test eax, eax
je 0x476bb7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xa6effc]
call ebx
test eax, eax
je 0x476bd2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x476bd4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046fd3b
mov esp, ebp
pop ebp
ret