joyce8/EMBER2024-capa huggingface dataset:
Function at 0x685f37c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x686da074]
test esi, esi
jle 0x685f38e0
mov eax, dword [0x686da078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x685f37f4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x685f3877
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x685f37e0
mov dword [esp], ebx
call fcn.685f3fb0
mov edi, eax
test eax, eax
je 0x685f3907
mov eax, dword [0x686da078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.685f40f0
mov edx, dword [0x686da078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x685f38e7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x685f3870
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x685f3880
add dword [0x686da074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x686da078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x685f3870
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.685f3760
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x685f37fe
mov eax, dword [0x686da078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.685f3760
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.685f3760
lea esi, [esi]
nop

Function at 0x685f3c20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x686da084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x686da07c]
sub esp, 4
test ebx, ebx
je 0x685f3c75
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x685f3c6e
test esi, esi
je 0x685f3c6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x685f3c50
mov dword [esp], 0x686da084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x685f3fb0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x68280000], 0x5a4d
jne 0x685f3fd5
mov ecx, dword [0x6828003c]
cmp dword [ecx + 0x68280000], 0x4550
lea edx, [ecx + 0x68280000]
je 0x685f3fe0
ret
cmp word [ecx + 0x68280018], 0x10b
jne 0x685f3fd5
push esi
movzx eax, word [ecx + 0x68280014]
push ebx
movzx esi, word [ecx + 0x68280006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x68280000
test si, si
je 0x685f4028
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x685f401e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x685f402a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x685f4010
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x43b651
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
mov ecx, dword [esp]
add esp, 4
inc esi
dec edx
call fcn.0043b69a
sub edx, 0x7c4a39f5
xor dword [ebx], ecx
or esi, esi
mov esi, 0x11d62996
add ebx, 1
or edx, edx
sub edx, edx
cmp ebx, eax
jne fcn.0043b651
add esi, 1
ret
Function at 0x4010c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x3c], 1
xor eax, eax
mov word [ebp - 0x38], ax
xor ecx, ecx
mov word [ebp - 0x36], cx
mov dword [ebp - 0x34], 0
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40114c
cmp dword [ebp - 0x1c], 2
jge 0x401158
mov dword [ebp - 8], 0xffffffff
jmp 0x4012cd
xor ecx, ecx
mov word [ebp - 0x898], cx
push 0x40e
push 0
lea edx, [ebp - 0x896]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x8a4], 0
jmp 0x401192
mov eax, dword [ebp - 0x8a4]
add eax, 1
mov dword [ebp - 0x8a4], eax
mov ecx, dword [ebp - 0x8a4]
cmp ecx, dword [ebp - 0x1c]
jge 0x4011ca
cmp dword [ebp - 0x8a4], 1
jne 0x4011c8
mov edx, dword [ebp - 0x8a4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4]
push ecx
push 0x208
lea edx, [ebp - 0x898]
push edx
call dword [sym.imp.MSVCR90.dll_wcscat_s]
add esp, 0xc
jmp 0x401183
mov byte [ebp - 0x480], 0
push 0x40f
push 0
lea eax, [ebp - 0x47f]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x89c], 0x410
lea ecx, [ebp - 0x89c]
push ecx
lea edx, [ebp - 0x480]
push edx
push 0x208
lea eax, [ebp - 0x898]
push eax
call section..text
add esp, 0x10
mov dword [ebp - 0x484], eax
push str.DRW_Installer
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 0
je 0x4012be
mov dword [ebp - 0x8b0], 0x3e7
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x8b4], ecx
mov edx, dword [ebp - 0x8b4]
add edx, 1
mov dword [ebp - 0x8b8], edx
mov eax, dword [ebp - 0x8b4]
mov cl, byte [eax]
mov byte [ebp - 0x8b9], cl
add dword [ebp - 0x8b4], 1
cmp byte [ebp - 0x8b9], 0
jne 0x40125e
mov edx, dword [ebp - 0x8b4]
sub edx, dword [ebp - 0x8b8]
mov dword [ebp - 0x8c0], edx
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x8ac], eax
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x8a8], ecx
lea edx, [ebp - 0x8b0]
push edx
push 0
push 0x4a
mov eax, dword [ebp - 0x8a0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], 0
xor ecx, ecx
jne 0x40112c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x6c]
xor ecx, ebp
call fcn.004012e0
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4012e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4012ea
repz ret
jmp fcn.00401604
Function at 0x401a8d
Capabilities:
Get disk information

Disassembly:
push 1
push 0
push 3
call dword [sym.imp.KERNEL32.dll_SleepEx]
dec dword [esp]
jne 0x40192a
add esp, 4
cmp bp, 0xfd00
jb 0x401a88
push str.gntfs.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x401a88
lea ecx, str.gntfs.DLL
mov byte [ecx], 0x75
push ecx
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ecx
mov dword [0x40e204], eax
mov ecx, dword [0x40e204]
add ecx, dword [ecx + 0x3c]
add ecx, 0xa4
push ecx
push 0
lea ebx, str.MvdplJJEqWC
push ebx
lea esi, str.xXfuLOwSbpoIJnNf
push esi
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
jne 0x401a88
pop ecx
sub eax, eax
push 0
push 4
push ecx
push 0x40e21d
push 0xffffffffffffffff
lea eax, sym.imp.KERNEL32.dll_WriteProcessMemory
call dword [eax]
cmp dword [0x40e21d], 0x1900
jb 0x401a88
lea ecx, [0x90ee0748]
add ecx, 0x6f521290
push ecx
jmp dword [esp]
lea esi, [0x40e23f]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [0x40e23f]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x401a88
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
lea esp, [esp - 0x54]
cmp bp, 0xfcfe
jbe 0x401a88
push 0xc
lea esi, [0x40e233]
push esi
lea esi, str.SnDwLgTRUPfIY
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x401a6a
push 0
lea esi, str.MvdplJJEqWC
push esi
lea edi, str.xXfuLOwSbpoIJnNf
push edi
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
cmp eax, 0
jne 0x401a6a
jmp 0x401928
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x77206fe6
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3c0256bb
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x104d2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104d21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104d207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104d206a
add dl, dl
jne 0x104d2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104d20dc
xor eax, eax
add dl, dl
jne 0x104d2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104d217d
add dl, dl
jne 0x104d20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104d20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104d20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104d20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104d20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104d2075
mov eax, 1
add dl, dl
jne 0x104d20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104d20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104d20e1
sub eax, ebx
mov ebx, 1
jne 0x104d2128
mov ecx, 1
add dl, dl
jne 0x104d210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104d2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104d2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104d2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104d213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104d214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104d2136
cmp eax, 0x7d00
jae 0x104d216d
cmp eax, 0x500
jb 0x104d2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104d2075
cmp eax, 0x7f
ja 0x104d2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104d2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104d219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104d2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401190
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x4343a0]
test eax, eax
push esi
push edi
je 0x4011eb
mov eax, dword [esp + 0x10]
mov edx, dword [0x433054]
mov ecx, dword [0x433058]
lea esi, [edx + eax]
cmp esi, ecx
jl 0x4011b6
sub ecx, edx
mov eax, ecx
test eax, eax
jle 0x40125f
mov esi, dword [0x433050]
mov edi, dword [esp + 0xc]
add esi, edx
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x433054]
add ecx, eax
pop edi
mov dword [0x433054], ecx
pop esi
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
push eax
push ecx
push 1
push esi
call fcn.0041fc25
mov edi, eax
mov eax, dword [0x434390]
add esp, 0x10
test eax, eax
je 0x40125d
test edi, edi
jle 0x40125d
mov edx, dword [0x4341fc]
mov eax, dword [0x4341e0]
lea ecx, [eax + edx]
mov edx, dword [0x4341ec]
mov eax, dword [0x4341e8]
add eax, edx
and ecx, 0xff
and eax, 0xff
test edi, edi
jle 0x40125d
mov dl, byte [0x4341f4]
push ebx
push ebp
mov ebp, edi
mov bl, byte [esi]
xor bl, cl
sub bl, al
add dl, bl
mov byte [esi], dl
inc esi
dec ebp
jne 0x401247
pop ebp
mov byte [0x4341f4], dl
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x40fa10
Capabilities:
Create process on windows

Disassembly:
mov cl, byte [esp + 4]
sub esp, 0x3c
test cl, 2
mov eax, 0xa
je 0x40fa26
mov eax, 2
cmp byte [esi], 0
je 0x40fa8c
push edi
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [0x434be4]
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x14], edx
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
jne 0x40faeb
push 0x4316c0
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x48], 0xe
call fcn.004200e0
test cl, 0x10
push eax
je 0x40faa9
push 0x42c3a1
push 0x42c3a1
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40facf
test cl, 0x20
je 0x40fac8
push 0x42c3a1
push 0x42c3a1
push edx
push str.print
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40facf
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jge 0x40faeb
push 0x4316c0
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], 0xe
call fcn.004200e0
add esp, 0x3c
ret
Function at 0x412f00
Capabilities:
Log keystrokes

Disassembly:
push ecx
push edi
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x434c08]
test byte [eax + 0x30c], 2
je 0x412f8c
mov edx, dword [esi + 4]
cmp edx, 0x200
mov edi, dword [0x434c00]
jne 0x412f6d
test edi, edi
movzx eax, word [esi + 0xc]
movzx ecx, word [esi + 0xe]
jne 0x412f62
cmp dword [0x434bf8], eax
jne 0x412f4b
cmp dword [0x434bfc], ecx
je 0x412f6d
push 0x4316c0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.004200e0
mov dword [0x434bf8], eax
mov dword [0x434bfc], ecx
cmp edx, 0x100
jne 0x412f8c
test edi, edi
jne 0x412f8c
push 0x4316c0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], edi
call fcn.004200e0
cmp dword [esi + 4], 0x100
jne 0x412fca
cmp dword [esi + 8], 9
jne 0x412fa0
call fcn.00412c50
push 2
call fcn.00403cc0
add esp, 4
test eax, eax
je 0x412fca
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ecx
push eax
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 2
call fcn.00404a50
add esp, 0x10
pop edi
pop ecx
ret
Function at 0x412fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x38]
cmp dword [edi + 0xec], 9
je 0x41317b
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ebp, dword [sym.imp.WINMM.dll_timeGetTime]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x413024
cmp dword [esp + 0x1c], 0x12
je 0x41318d
lea esi, [esp + 0x18]
call fcn.00412f00
jmp 0x41316e
mov eax, dword [edi + 0xec]
dec eax
cmp eax, 7
ja case.0x413034.4
jmp dword [eax*4 + 0x4131ec]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
cmp dword [esp + 0x1c], 0x12
je 0x4131a4
lea esi, [esp + 0x18]
call fcn.00412f00
cmp dword [edi + 0xec], 3
je case.0x413034.3
push 0xff
push 0x3e8
push 0
push 0
push 0
call ebx
jmp 0x41316e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00403a40
add esp, 4
mov dword [edi + 0xec], eax
cmp dword [0x43313c], 0xffffffff
jne 0x4130fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
push esi
call fcn.00403a80
add esp, 4
test eax, eax
je 0x4130d3
mov edx, dword [edi + 0xf8]
push 0xff
sub edx, esi
push edx
push 0
push 0
push 0
call ebx
jmp 0x41316e
mov eax, dword [0x434c08]
test byte [eax + 0x30c], 2
je 0x41316e
mov eax, dword [0x434c00]
test eax, eax
je 0x41316e
dec eax
mov dword [0x434c00], eax
jmp 0x41316e
call ebp
mov esi, eax
add esi, 5
push esi
call fcn.00403a80
add esp, 4
test eax, eax
je 0x413126
mov ecx, dword [edi + 0xf8]
push 0xff
sub ecx, esi
push ecx
push 0
push 0
push 0
call ebx
jmp 0x41316e
call ebp
cmp eax, dword [edi + 0xf8]
jge 0x413142
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
cmp eax, dword [edi + 0xf8]
jl 0x413130
mov edx, dword [0x434c08]
mov dword [edi + 0xfc], eax
mov dword [edi + 0xec], 0
test byte [edx + 0x30c], 2
jmp 0x4130df
mov dword [edi + 0xec], 3
cmp dword [edi + 0xec], 9
jne 0x412ff4
mov dword [edi + 0xec], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 0x4316c0
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0
call fcn.004200e0
push 0x4316c0
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], 0
call fcn.004200e0
push 0x4316c0
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], 0xa
call fcn.004200e0
push 0x4316c0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x2a
call fcn.004200e0
lea ecx, [ecx]
test dword [eax], esi
inc ecx
add byte [edx + 0x40004130], bl
xor byte [ecx], al
test dword [ecx], esi
inc ecx
add byte [ebp - 0x44ffbecf], al
xor dword [ecx], eax
sal byte [ecx], cl
inc ecx
add byte [ecx + esi + 0x41], ah
add ah, cl
int3
Function at 0x4155e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetClientRect]
push esi
mov esi, dword [esp + 0x120]
push edi
lea eax, [esp + 0x10]
mov ebx, ecx
mov ecx, dword [esi + 8]
push eax
push ecx
call ebp
mov eax, dword [esi + 0xc]
test eax, eax
mov edi, dword [esp + 0x128]
jl 0x41566d
mov ecx, dword [ebx + 0x130]
push eax
call fcn.004163b0
mov ecx, dword [esp + 0x12c]
dec ecx
je 0x41563f
dec ecx
je 0x415635
movsx ecx, word [esi + 0x14]
movsx edx, word [esi + 0x16]
jmp 0x415647
movsx ecx, word [esi + 0x18]
movsx edx, word [esi + 0x1a]
jmp 0x415647
movsx ecx, word [esi + 0x1c]
movsx edx, word [esi + 0x1e]
push 0xcc0020
push edx
mov edx, dword [eax + 0x10]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test byte [esi + 3], 2
je 0x415699
push 0xfffffffffffffffd
push 0xfffffffffffffffd
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_InflateRect]
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov ecx, dword [esi + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call ebp
mov eax, dword [esi + 8]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [esp + 0x20]
push edx
push 0xff
push 0xd
push eax
call ebx
mov ecx, dword [esi + 8]
push 0
push 0
push 0x31
push ecx
call ebx
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push edi
call esi
push 1
push edi
mov ebx, eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x25
lea edx, [esp + 0x14]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.USER32.dll_DrawTextA]
push ebx
push edi
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc

Function at 0x418840
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push ebx
mov edi, ecx
call fcn.00416300
mov eax, dword [edi + 0x320]
mov ecx, dword [eax + ebx*4]
xor ebp, ebp
test ecx, ecx
je 0x418891
mov ecx, eax
mov esi, dword [ecx + ebx*4]
test esi, esi
mov ebp, dword [esi + 0x34]
je 0x41887b
mov ecx, esi
call fcn.00418420
push esi
call fcn.0042009c
add esp, 4
mov edx, dword [edi + 0x320]
push 0
push ebp
mov dword [edx + ebx*4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x158
call fcn.004200a1
add esp, 4
test eax, eax
je 0x4188ac
mov dword [eax], 0
mov esi, eax
jmp 0x4188ae
xor esi, esi
mov eax, dword [edi + 0x320]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
and ecx, 1
push ecx
mov dword [eax + ebx*4], esi
mov eax, dword [esp + 0x1c]
push edx
push eax
mov dword [esi + 0x48], ebx
mov dword [esi + 0x130], edi
mov dword [esi + 0x44], 1
mov ecx, dword [edi + 0x31c]
push ebp
push ecx
mov ecx, esi
call fcn.00418660
xor eax, eax
pop edi
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
pop esi
pop ebp
pop ebx
ret 0x10