joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d628
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a42e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00533b7e
and dword [ebp - 0x14], 0
cmp dword [0x5ac628], 0
mov dword [ebp - 0x18], eax
jne 0x53d6db
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x53d783
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x57e4dc
push ebx
call edi
test eax, eax
je 0x53d783
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x57e4cc
push ebx
mov dword [0x5ac628], eax
call edi
push eax
call esi
push 0x57e4b8
push ebx
mov dword [0x5ac62c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5ac630], eax
call edi
push eax
call esi
mov dword [0x5ac638], eax
test eax, eax
je 0x53d6db
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5ac634], eax
mov eax, dword [0x5ac634]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x53d734
cmp dword [0x5ac638], ecx
je 0x53d734
push eax
call esi
push dword [0x5ac638]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x53d734
test ebx, ebx
je 0x53d734
call edi
test eax, eax
je 0x53d72b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x53d72b
test byte [ebp - 8], 1
jne 0x53d734
or dword [ebp + 0x10], 0x200000
jmp 0x53d767
mov eax, dword [0x5ac62c]
cmp eax, dword [ebp - 0x18]
je 0x53d767
push eax
call esi
test eax, eax
je 0x53d767
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x53d767
mov eax, dword [0x5ac630]
cmp eax, dword [ebp - 0x18]
je 0x53d767
push eax
call esi
test eax, eax
je 0x53d767
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5ac628]
call esi
test eax, eax
je 0x53d783
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x53d785
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052ad34
leave
ret
Function at 0x1000cc3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002d770
call fcn.10016ea3
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ccbb
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ccbb
call fcn.10005a09
mov esi, eax
jmp 0x1000cd92
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000ccde
call fcn.10005a09
jmp 0x1000cd85
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ccd4
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000cd0e
mov esi, 0x8007000e
jmp 0x1000cd87
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.100215c1
jmp 0x1000cd34
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cd07
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ccd4
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.100215c1
mov esi, eax
test edi, edi
je 0x1000cd92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000cdab
lea ecx, [ebp - 0x418]
call fcn.1000c3cf
mov eax, esi
call fcn.10016df0
ret 0x10
Function at 0x10012247
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002dc29
call fcn.10016e01
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.100215c1
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x100122f2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.100215c1
mov ecx, dword [esi]
test al, al
je 0x100122d4
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100215c1
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x100122eb
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.100215c1
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009b23
cmp dword [ebx + 0x24], 0
je 0x10012312
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.100215c1
test al, al
je 0x10012312
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016dca
ret
Function at 0x10013230
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002dcec
call fcn.10016e35
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x1001325b
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x100133e6
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x100304d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001327f
mov eax, 0x80004005
jmp 0x100133e6
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.100215c1
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.100215c1
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.100215c1
test al, al
je 0x100133be
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10019ba0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.100215c1
add esp, 0x14
test eax, eax
jne 0x10013338
push 0x2f
push edi
call fcn.100215c1
pop ecx
pop ecx
test eax, eax
je 0x10013358
add eax, 2
push 0x2e
push eax
call fcn.100215c1
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100215c1
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x100133b7
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100215c1
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x100133a9
lea eax, [ebp - 0x218]
push eax
call fcn.100215c1
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x100133af
push edi
call fcn.100215c1
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x100133cf
mov esi, 0x80004005
jmp 0x100133d8
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.100215c1
push eax
lea ecx, [ebx + 0x10]
call fcn.100215c1
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016ddf
ret 0xc
Function at 0x10013a90
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002ddab
call fcn.10016e35
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013bcc
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.10019ba0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.100215c1
add esp, 0x18
test eax, eax
jne 0x10013b31
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.100215c1
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013b70
cmp dword [ebp - 0x818], 0
jne 0x10013b70
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.100215c1
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009b23
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013bcc
cmp dword [ebp - 0x818], 0
jne 0x10013bcc
test esi, esi
jns 0x10013bcc
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016ddf
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.100215c1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x100215c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100215d0
pop dword [ebp - 0x18]
mov eax, 0x100215d0
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3ff29
push 0
mov eax, 0x16b7b67c
add eax, 0xf94b4ae0
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x24426322
add ecx, 0xdbbde384
xor esi, esi
add esi, eax
mov edx, 0xc4334273
sub edx, 0xb42e8673
add edx, dword [ebp - 0x18]
mov ebx, 0xecebed75
add ebx, 0x1de689ee
sub dword [ebp - 4], edi
mov edi, dword [edx]
mov dword [ebp - 0x14], 0xd562b7d1
sub edi, ebx
add dword [ebp - 4], 0xdfafa7b6
mov dword [esi], edi
xor dword [ebp - 0x10], 0xccffac4f
add esi, 0xac11887b
add esi, 0x53ee7789
add edx, 0x44597ff9
sub edx, 0x44597ff5
loop 0x1002162c
add eax, 0x4df2f5a5
sub eax, 0x4df1e83a
xor ebx, ebx
add ebx, eax
add eax, 0x9868db7f
add eax, 0x67972486
mov ecx, 0xaf89f340
sub ecx, 0x9f89f340
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6d4629cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x6d4629de
pop dword [ebp - 0x18]
mov eax, 0x6d4629de
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xa5215dc3
sub dword [ebp - 0x28], 0x56cf1878
mov dword [ebp - 0x24], 0x41ed601a
add dword [ebp - 0x24], 0xf045ec2b
mov dword [ebp - 0x20], 0xe9e87fd8
sub dword [ebp - 0x20], 0x9d9c3baa
mov dword [ebp - 0x1c], 0x2b484dd4
add dword [ebp - 0x1c], 0xd4b7b22c
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x217421ee
sub dword [ebp - 0x28], 0xad01b898
mov dword [ebp - 0x24], 0xafbb9e80
add dword [ebp - 0x24], 0x91b0c2f5
mov dword [ebp - 0x20], 0x7efb7465
sub dword [ebp - 0x20], 0x1b8c07f9
mov dword [ebp - 0x1c], 0x16c7518e
add dword [ebp - 0x1c], 0xe938ae72
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3a407
push 0
call eax
mov ecx, 0x81e0d72a
add ecx, 0x7e1f7d85
mov edi, eax
mov edx, 0x824f3c3f
add edx, 0xeaf7abc1
add edx, dword [ebp - 0x18]
mov esi, 0xf5c6c57
add esi, 0xb8b906d9
mov ebx, dword [edx]
xor dword [ebp - 0x10], 0x881f1e08
xor ebx, esi
xor dword [ebp - 4], 0x76b130cc
mov dword [edi], ebx
xor dword [ebp - 8], ecx
add edi, 4
add edx, 0xf16b4b69
add edx, 0xe94b49b
loop 0x6d462af1
add eax, 0x1458f
mov ebx, eax
add eax, 0x849bbcfa
sub eax, 0x849bbcf5
mov ecx, 0x9a4ed884
sub ecx, 0x2d08d884
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x6d4678c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d4678ce
repz ret
jmp fcn.6d467caf
Function at 0x401390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 4
call fcn.0040fd00
mov dword [esp], 0x4f3164
push 0x82
call fcn.00407940
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4013f5
push esi
call fcn.00407940
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4013ee
push esi
call fcn.00407940
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4013ee
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.0040fd10
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0
push ecx
mov eax, esp
mov dword [eax], str.skin_define.xml
call fcn.00401bdb
mov ecx, eax
call fcn.004115b0
pop edi
pop esi
ret

Function at 0x4015e6
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40166b
lea ecx, [esp + 8]
call fcn.0049ff73
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.004a0600
sub esp, 0x18
mov ecx, esp
push str.SoftManager
call fcn.00401bb6
push 0
push dword [ebp + 8]
call fcn.00401674
mov ecx, eax
call fcn.004a0e49
lea ecx, [esp + 8]
call fcn.004a011c
cmp eax, 1
jg 0x401652
push ecx
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040140f
pop ecx
pop ecx
jmp 0x401657
call fcn.00401507
call fcn.004017ba
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 8]
call fcn.0049ffc6
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4017ba
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x501324]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401831
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401831
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a2154
leave
ret
Function at 0x4021d8
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x2a8
mov eax, 0x4d34ee
call fcn.004a2aa5
mov edi, ecx
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x2b4]
push edx
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 4]
xor ebx, ebx
mov ecx, esi
push str.windowinit
mov dword [ebp - 4], ebx
call fcn.00415820
test al, al
jne 0x4022c6
push str.click
mov ecx, esi
call fcn.00415820
test al, al
je 0x4022c6
push str.sysclosebutton
lea ecx, [ebp - 0x2b4]
call fcn.00415d10
test eax, eax
je 0x402410
push str.btn_ok
lea ecx, [ebp - 0x2b4]
call fcn.00415d10
test eax, eax
je 0x402410
push str.btn_open_web
lea ecx, [ebp - 0x2b4]
call fcn.00415d10
test eax, eax
jne 0x4022e1
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 0xf0]
push eax
lea ecx, [ebp - 0x94]
call fcn.004154d0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.00416180
test eax, eax
jle 0x4022b8
push 5
push ebx
push ebx
lea ecx, [ebp - 0x94]
call fcn.004158e0
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], bl
call fcn.004156b0
push esi
mov ecx, edi
call fcn.00414190
lea ecx, [ebp - 0x2b4]
call fcn.004156b0
call fcn.004a2a60
ret 4
push str.soft_version
lea ecx, [ebp - 0x2b4]
call fcn.00415d10
test eax, eax
jne 0x4023cd
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004b9de0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.004b97b2
pop ecx
pop ecx
xor ecx, ecx
mov word [eax + 2], cx
xor eax, eax
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], ebx
push eax
mov dword [ebp - 0x21c], 7
call fcn.00401b8f
push str.update.exe
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0040196a
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4023ba
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 5
cmovae eax, dword [ebp - 0x230]
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], bl
call fcn.00401991
jmp 0x4022c6
push str.btn_office_url
lea ecx, [ebp - 0x2b4]
call fcn.00415d10
test eax, eax
jne 0x4023f1
push str.http:__xs_store.xsfaya.com_
call fcn.004a18ee
pop ecx
jmp 0x4022c6
push str.btn_office_priurl
lea ecx, [ebp - 0x2b4]
call fcn.00415d10
test eax, eax
jne 0x4022c6
push str.http:__xs_store.xsfaya.com_privacy
jmp 0x4023e6
push dword [edi - 0x1c]
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4022ce
Function at 0x408020
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x408041
mov ecx, dword [ebp - 4]
or ecx, 8
mov dword [ebp - 4], ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x408059
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x408071
mov edx, dword [ebp - 4]
or edx, 2
mov dword [ebp - 4], edx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x408087
mov ecx, dword [ebp - 4]
or ecx, 4
mov dword [ebp - 4], ecx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x40809f
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40f4e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0xa8]
je 0x40f51e
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x108]
je 0x40f51e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xa8]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x108]
jne 0x40f531
jmp 0x40f6a5
mov edx, dword [ebp - 4]
cmp dword [edx + 0x108], 0
je 0x40f5c3
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x28], 0x17
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x108]
mov edx, dword [eax + 0x14c]
call edx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x40f5b6
push 0
push 0
push 0
push str.killfocus
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x108]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040ef40
mov eax, dword [ebp - 4]
mov dword [eax + 0x108], 0
cmp dword [ebp + 8], 0
jne 0x40f5ce
jmp 0x40f6a5
cmp dword [ebp + 8], 0
je 0x40f6a5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
call eax
cmp eax, dword [ebp - 4]
jne 0x40f6a5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
call eax
movzx ecx, al
test ecx, ecx
je 0x40f6a5
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x114]
call edx
movzx eax, al
test eax, eax
je 0x40f6a5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x108], edx
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x48], 0x18
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x108]
mov edx, dword [eax + 0x14c]
call edx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x40f6a5
push 0
push 0
push 0
push str.setfocus
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x108]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040ef40
mov esp, ebp
pop ebp
ret 8