joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cdb1
Capabilities:
Create directory

Disassembly:
mov eax, 0x4c8978
call fcn.004c4460
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x28]
call fcn.0040b207
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
mov dword [ebp + 8], 0x5c
call fcn.0042d6b5
cmp eax, 0xffffffff
je 0x42cea8
push eax
lea eax, [ebp - 0x28]
push eax
lea esi, [ebp - 0x44]
call fcn.0040b374
cmp dword [eax + 0x18], 8
jb 0x42ce05
mov eax, dword [eax + 4]
jmp 0x42ce08
add eax, 4
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
push 1
lea esi, [ebp - 0x44]
mov edi, eax
call fcn.00409cb7
cmp edi, ebx
je 0x42ce5d
cmp edi, 0x50
je 0x42ce5d
cmp edi, 0xb7
je 0x42ce5d
cmp edi, ebx
jle 0x42ce3f
and edi, 0xffff
or edi, 0x80070000
push ebx
push 1
lea esi, [ebp - 0x28]
call fcn.00409cb7
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x42ce69
lea eax, [ebp - 0x24]
push ebx
push 0x80
push 1
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x42ce9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42ce99
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x42ce3f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x42ce3f
mov edi, 0x80070057
jmp 0x42ce3f
Function at 0x4346d6
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
xor ebx, ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4346f8
xor eax, eax
inc eax
jmp 0x434762
cmp dword [edi], esi
je 0x434701
xor ebx, ebx
inc ebx
jmp 0x434746
lea eax, [ebp - 8]
push eax
push 0x4dea20
push 1
push esi
push 0x4dea10
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x434720
push 2
jmp 0x434745
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jge 0x434735
push 3
jmp 0x434745
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
test eax, eax
jge 0x434746
push 4
pop ebx
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x434753
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x434760
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x435570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4355f3
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x4355bc
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x4355bc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x4355c0
xor eax, eax
jmp 0x4355f2
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ebx + 1]
push edi
call fcn.00409455
test eax, eax
je 0x4355de
push ebx
push dword [ebp + 0xc]
push eax
call fcn.00481f90
add esp, 0xc
mov eax, edi
call fcn.0040947b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x435723
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x4c7ad8
call fcn.004c4460
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
cmp dword [eax - 0xc], edi
mov dword [ebp - 0x14], edi
je 0x435809
mov eax, dword [0x50038c]
mov ecx, 0x50038c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [esi]
push str._s_d._s
call fcn.0040881a
add esp, 0x10
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x4357fe
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, edi
je 0x4357f5
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebx + 0xa]
push eax
mov dword [ebp + 8], edi
call fcn.00409455
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x4357ec
cmp dword [ebp + 8], ebx
jne 0x4357ec
mov eax, ebx
call fcn.0040947b
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407bab
xor eax, eax
inc eax
jmp 0x43580c
xor eax, eax
mov edx, esi
call fcn.004095bb
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407bab
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x4359a5
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4c888a
call fcn.004c4460
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
call fcn.00435977
push dword [esi]
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.00435adf
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
je 0x435ac8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435ac5
lea eax, [ebp - 0x24]
mov ebx, vtable.Gdiplus::PrivateFontCollection.0
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
call sub.gdiplus.dll_GdipNewPrivateFontCollection
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipPrivateAddFontFile
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call sub.gdiplus.dll_GdipGetFontCollectionFamilyCount
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
cmp eax, edi
jle 0x435ab2
xor ecx, ecx
push 8
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.gdiplus.dll_GdipAlloc
mov dword [ebp - 0x1c], eax
test eax, eax
mov byte [ebp - 4], 2
je 0x435a7b
mov ecx, dword [ebp - 0x14]
push 0x4353d6
push 0x4353cc
push ecx
lea edi, [eax + 4]
push 8
push edi
mov dword [eax], ecx
call fcn.00483ba5
mov eax, edi
jmp 0x435a7d
xor eax, eax
test eax, eax
mov byte [ebp - 4], 1
mov dword [esi + 4], eax
je 0x435ab2
push eax
push dword [ebp - 0x14]
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x28]
call fcn.004352fc
test eax, eax
jne 0x435aad
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x435aad
mov ecx, dword [ebp - 0x14]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
jmp 0x435ab2
call fcn.00435977
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], ebx
call sub.gdiplus.dll_GdipDeletePrivateFontCollection
mov dword [ebp - 0x28], vtable.Gdiplus::FontCollection.0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407bab
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x435bed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
xor eax, eax
push 0x20e
push eax
mov dword [ebp - 4], eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00480cb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 8]
call fcn.00407e3d
mov eax, dword [ebp + 8]
leave
ret 4
Function at 0x43717b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4c70d4
call fcn.004c4460
fld dword [0x4e3578]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
or dword [edi + 0x18], 0xffffffff
fstp dword [edi + 0xc]
fld dword [0x4e357c]
xor ebx, ebx
fstp dword [edi + 0x10]
push 0xa
fld dword [0x4e3580]
pop ebp
mov esi, edi
fstp dword [edi + 0x14]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], 0x11
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebp
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
call fcn.00448300
mov dword [esp + 0x18], ebx
fld dword [0x4e3578]
lea esi, [edi + 0x30]
or dword [esi + 0x18], 0xffffffff
fstp dword [esi + 0xc]
fld dword [0x4e357c]
mov dword [esi], ebx
fstp dword [esi + 0x10]
mov dword [esi + 4], ebx
fld dword [0x4e3580]
mov dword [esi + 8], 0x11
fstp dword [esi + 0x14]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00448300
mov byte [esp + 0x18], 1
push 0x501d18
mov dword [edi + 0x60], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x43741d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4c8818
call fcn.004c4460
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [edi], vtable.CBkWindow.0
call fcn.004373db
push 0x501d18
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.004373db
add eax, 0x60
inc dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call fcn.004373db
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.00447ba6
push 0x501d18
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov dword [edi + 4], eax
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], esi
mov dword [edi + 0x24], esi
lea esi, [edi + 0x28]
mov ecx, 0x50038c
call fcn.0040959a
xor ebx, ebx
lea esi, [edi + 0x40]
mov ecx, 0x50038c
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
call fcn.0040959a
lea esi, [edi + 0x48]
mov ecx, 0x50038c
mov dword [edi + 0x44], ebx
call fcn.0040959a
lea esi, [edi + 0x4c]
mov ecx, 0x50038c
call fcn.0040959a
or dword [edi + 0x50], 0xffffffff
or dword [edi + 0x54], 0xffffffff
or dword [edi + 0x60], 0xffffffff
lea eax, [edi + 0x14]
push eax
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x9c], ebx
mov dword [edi + 0xa0], ebx
mov dword [edi + 0xa4], ebx
mov dword [edi + 0xa8], 1
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb0], ebx
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb8], ebx
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x43c170
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
inc edi
cmp eax, 0xf
mov esi, ecx
jne 0x43c19f
mov ecx, dword [ebp + 0x18]
lea eax, [esi + 0xb4]
mov dword [eax], edi
and dword [ecx], 0
cmp dword [eax], 0
je 0x43c1d6
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp eax, 2
jne 0x43c1f7
push dword [esi + 0x10]
mov dword [esi + 0xb4], edi
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x43c1d0
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43c1d0
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [esi + 0xb4], 0
jne 0x43c196
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004389db
jmp 0x43c198
cmp eax, 0x47
jne 0x43c21c
push dword [ebp + 0x14]
lea ebx, [esi + 0xb4]
mov eax, esi
mov dword [ebx], edi
call fcn.0043c04d
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [ebx], 0
jmp 0x43c194
cmp eax, 0x18
jne 0x43c1d6
push dword [ebp + 0x10]
lea ebx, [esi + 0xb4]
mov dword [ebx], edi
call fcn.0043c124
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [ebx], 0
jne 0x43c196
jmp 0x43c1d6

Function at 0x442e6c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
test byte [esi + 0x14], 2
je 0x442ec5
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
sub eax, ecx
je 0x442eb6
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
sub edx, eax
je 0x442eb6
mov edx, dword [esi + 0x10]
push 0x11
push 0
push 0
sub ecx, edx
push ecx
sub eax, edx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x442ec5
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
leave
ret 4

Function at 0x442ec9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 1
push edi
mov edi, eax
jne 0x442ee9
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [edi + 0x14], 0xfd
jmp 0x442f46
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
je 0x442f4b
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
je 0x442f4b
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x442f46
or byte [edi + 0x14], 4
mov al, byte [edi + 0x14]
test al, 2
jne 0x442f3d
push dword [ebp + 8]
or al, 2
mov byte [edi + 0x14], al
call fcn.00443028
push 8
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x442f46
cmp dword [edi + 0x18], esi
je 0x442f46
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], esi
jmp 0x442f5a
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [edi + 0x14], 0xfd
pop edi
leave
ret 8
Function at 0x444070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cc26d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x100
push ebx
push esi
push edi
push 6
xor ebx, ebx
pop ecx
xor eax, eax
mov dword [esp + 0x14], ebx
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x30]
call fcn.0044343f
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x114], ebx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
xor edi, edi
inc edi
push edi
push ecx
sub eax, edx
mov dword [esp + 0x30], eax
mov eax, esp
mov dword [esp + 0x18], esp
push str.0_0__0__0
sub esi, ecx
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
call fcn.004093a3
push ecx
mov byte [esp + 0x120], 1
mov eax, esp
mov dword [esp + 0x18], esp
push 0x4def3c
push eax
call fcn.004093a3
lea ecx, [esp + 0x3c]
mov byte [esp + 0x120], bl
call fcn.00443911
lea eax, [esp + 0x14]
push eax
push ebx
push 0x47
lea ecx, [esp + 0x3c]
call fcn.00437647
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
mov esi, 0x4df508
push esi
push eax
call fcn.004093a3
push ecx
mov byte [esp + 0x120], 2
mov eax, esp
mov dword [esp + 0x1c], esp
push str.margin_left
push eax
call fcn.004093a3
lea ecx, [esp + 0x3c]
mov byte [esp + 0x120], bl
call fcn.00443911
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push esi
push eax
call fcn.004093a3
push ecx
mov byte [esp + 0x120], 3
mov eax, esp
mov dword [esp + 0x1c], esp
push str.margin_right
push eax
call fcn.004093a3
lea ecx, [esp + 0x3c]
mov byte [esp + 0x120], bl
call fcn.00443911
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push esi
push eax
call fcn.004093a3
push ecx
mov byte [esp + 0x120], 4
mov eax, esp
mov dword [esp + 0x1c], esp
push str.margin_top
push eax
call fcn.004093a3
lea ecx, [esp + 0x3c]
mov byte [esp + 0x120], bl
call fcn.00443911
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push esi
push eax
call fcn.004093a3
push ecx
mov byte [esp + 0x120], 5
mov eax, esp
mov dword [esp + 0x1c], esp
push str.margin_bottom
push eax
call fcn.004093a3
lea ecx, [esp + 0x3c]
mov byte [esp + 0x120], bl
call fcn.00443911
push edi
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push str.cnm_showdow
push eax
call fcn.004093a3
push ecx
mov byte [esp + 0x120], 6
mov eax, esp
mov dword [esp + 0x1c], esp
push str.skin
push eax
call fcn.004093a3
lea ecx, [esp + 0x3c]
mov byte [esp + 0x120], bl
call fcn.00443911
push ebx
push dword [ebp + 8]
lea ecx, [esp + 0x38]
push 0xf
call fcn.00437647
or dword [esp + 0x114], 0xffffffff
mov eax, dword [esp + 0x104]
add eax, 0xfffffff0
call fcn.00407bab
lea ecx, [esp + 0x30]
call fcn.00437540
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x444bbc
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp ebp, esi
push edi
mov edi, eax
mov dword [esp + 0x18], esi
jne 0x444bf3
mov eax, dword [0x501d5c]
cmp eax, esi
je 0x444be1
mov ebp, dword [eax + 4]
jmp 0x444be3
xor ebp, ebp
cmp ebp, esi
jne 0x444bf3
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, eax
cmp ebp, esi
je 0x444c18
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebp, eax
je 0x444c18
push ebp
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x444c18
push esi
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x18], 1
push ecx
mov eax, esp
mov dword [edi + 0x390], esi
push ebp
mov ebx, edi
mov dword [eax], esi
call fcn.00445465
mov ecx, eax
cmp ecx, esi
mov dword [esp + 0x14], ecx
jne 0x444c45
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x444d36
mov eax, dword [0x501d5c]
cmp eax, esi
mov dword [esp + 0x1c], esi
je 0x444c5c
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov dword [eax + 4], ecx
lea eax, [edi + 4]
push eax
mov eax, ebp
call fcn.00448d68
cmp dword [edi + 0x384], esi
je 0x444cd7
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, dword [esp + 0x24]
je 0x444cbb
push 1
push ebx
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, dword [esp + 0x24]
je 0x444cd7
push esi
push ebx
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
call fcn.004455c0
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [edi + 4]
mov dword [edi + 0x390], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x18], esi
je 0x444d1a
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebp, esi
je 0x444d1a
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 4]
jne 0x444d1a
push ebp
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x501d5c]
cmp eax, esi
je 0x444d2a
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x44650b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x2d8]
cmp dword [edi], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x446536
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov eax, dword [esi + 0x2cc]
cmp eax, ebx
je 0x446615
push eax
call fcn.00437241
mov edi, eax
cmp edi, ebx
pop ecx
je 0x4465ca
mov eax, dword [edi]
push 2
push ebx
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x44656f
push 1
push edi
push esi
call fcn.00445aa7
mov eax, dword [esi + 0x2cc]
cmp eax, dword [esi + 0x2c8]
jne 0x4465ca
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.00437647
mov eax, dword [edi + 0x40]
cmp eax, ebx
je 0x4465b9
cmp word [eax], bx
je 0x4465b9
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4465ca
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x4465ca
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
mov dword [esi + 0x2cc], ebx
je 0x446615
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push dword [esi + 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x18]
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebx
leave
ret 0xc

Function at 0x446c65
Capabilities:
Log keystrokes via polling

Disassembly:
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x446cac
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x446ca5
cmp dword [esp + 4], 0x1b
jne 0x446c8c
push 0
push 2
jmp 0x446c97
cmp dword [esp + 4], 0xd
jne 0x446ca5
push 0
push 1
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [esi + 0x394], 0
ret 4