joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437819
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x437840
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push esi
call fcn.00412a89
mov edx, dword [ebp + 8]
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push edx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
push edi
call fcn.00412941
xor ecx, ecx
add eax, 0x1a
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412a89
mov esi, eax
push 0x49626c
push esi
call fcn.00412998
push 0x49626c
push edi
call fcn.00413366
add esp, 0x18
test eax, eax
je 0x43792f
push str.StringFileInfo_
push esi
call fcn.00412967
push 0x49626c
push edi
call fcn.004136e7
add esp, 0x10
test eax, eax
jne 0x437925
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x437900
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push 4
lea ecx, [esi + 0x20]
push ecx
push 0
push eax
mov dword [ebp - 0xc], eax
call fcn.00436d63
mov eax, dword [ebp - 0xc]
push 4
lea edx, [esi + 0x28]
push edx
shr eax, 0x10
push 0
push eax
call fcn.00436d63
add esp, 0x20
jmp 0x43790e
push str.04090000
push esi
call fcn.00412967
add esp, 8
push 0x49626c
push esi
call fcn.00412967
push edi
push esi
call fcn.00412967
add esp, 0x10
jmp 0x43792f
push edi
push esi
call fcn.00412967
add esp, 8
push str.DefaultLangCodepage
push edi
call fcn.00412dcd
add esp, 8
test eax, eax
jne 0x43796e
mov edi, dword [ebp + 0xc]
push 8
lea eax, [esi + 0x20]
push eax
push edi
call fcn.004131e4
xor ecx, ecx
push ebx
mov word [edi + 0x10], cx
call fcn.00411076
push esi
call fcn.00411076
add esp, 0x14
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 4]
push eax
push esi
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4379f6
push 0x49626c
push edi
call fcn.00413366
add esp, 8
test eax, eax
jne 0x4379c0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
push edx
mov edx, dword [ebp + 0xc]
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
push edx
call fcn.004134c5
add esp, 0x18
jmp 0x4379de
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
push 0x200
push eax
push edi
call fcn.004131e4
add esp, 0xc
xor ecx, ecx
mov word [edi + 0x400], cx
push ebx
call fcn.00411076
push esi
call fcn.00411076
add esp, 8
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call fcn.00411076
push esi
call fcn.00411076
add esp, 8
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437ba4
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.00426630
lea eax, [ebp - 4]
push eax
push 0x800
lea ecx, [ebp - 0x102c]
push ecx
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x437bd1
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp - 4]
push eax
shr edi, 2
mov byte [edx], 0
call fcn.00437b65
add esp, 4
xor ebx, ebx
mov dword [ebp - 0xc], eax
test edi, edi
je 0x437cde
push esi
jmp 0x437c04
mov ecx, dword [ebp + 0x10]
cmp byte [ecx], 0
jne 0x437cdd
mov edx, dword [ebp + ebx*4 - 0x102c]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
mov eax, dword [ebp - 8]
push 0x104
lea edx, [ebp - 0x424]
push edx
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
test eax, eax
je 0x437ccd
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x424]
push edx
call fcn.00413c2e
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.00412967
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.00412dcd
add esp, 0x24
test eax, eax
jne 0x437cb0
mov edx, dword [ebp + ebx*4 - 0x102c]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x437cc7
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x437ccd
mov eax, dword [ebp + ebx*4 - 0x102c]
cmp ecx, eax
jne 0x437ccd
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, edi
jb 0x437c04
pop esi
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437ce6
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0
push 2
mov dword [ebp - 0x234], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ecx, dword [ebp + 8]
push ecx
mov byte [esi], 0
call fcn.00437b65
add esp, 4
cmp byte [esi], 0
mov ebx, eax
jne 0x437dc4
lea ecx, [ecx]
lea edx, [ebp - 0x234]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x437dc4
lea eax, [ebp - 0x63c]
push eax
lea ecx, [ebp - 0x438]
push ecx
lea edx, [ebp - 0x840]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00413c2e
lea edx, [ebp - 0x63c]
push edx
lea eax, [ebp - 0x438]
push eax
call fcn.00412967
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x438]
push edx
call fcn.00412dcd
add esp, 0x24
test eax, eax
jne 0x437da5
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x437db8
test ebx, ebx
je 0x437dbb
mov eax, dword [ebp - 0x22c]
cmp ebx, eax
jne 0x437dbb
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov byte [esi], 1
cmp byte [esi], 0
je 0x437d36
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437dd4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 8]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x437e35
lea ecx, [ebp - 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [ebp - 4]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43821e
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, dword [ebp + 8]
mov esi, eax
cmp edi, esi
jne 0x438242
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
test esi, esi
jne 0x438254
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x438268
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x438362
push ebx
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov eax, dword [ebp + 8]
push 0
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push ebx
mov dword [ebp - 4], eax
call esi
push 1
push edi
push ebx
call esi
mov ecx, dword [ebp - 4]
push 1
push ecx
push edi
call esi
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x438337
push eax
push eax
push eax
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x43833e
mov dword [ebp - 8], 4
jmp 0x43833e
mov dword [ebp - 8], 3
mov ecx, dword [ebp - 4]
push 0
push ecx
push ebx
call esi
push 0
push edi
push ebx
call esi
mov edx, dword [ebp - 4]
push 0
push edx
push edi
call esi
mov eax, dword [ebp - 8]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x438388
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x438420
jne 0x4383ab
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
cmp esi, 0xf
jae 0x438418
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x10]
push eax
call edi
test eax, eax
je 0x438418
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jns 0x4383d1
fadd qword [0x49d918]
fstp qword [ebp - 0x28]
lea esp, [esp]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 8]
push ecx
call edi
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.0040e0b0
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x4383d8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4385db
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
movzx edi, bl
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov byte [ebp + 0xf], al
cmp byte [ebp + 0x10], al
je 0x438630
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push ebx
push esi
call fcn.00438523
push esi
call fcn.00438582
push 2
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push ebx
push esi
call fcn.00438523
push esi
call fcn.004385af
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x43a227
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x43a244
mov eax, dword [eax]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop ebp
ret 8
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop ebp
ret 8

Function at 0x43a31f
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
push esi
mov esi, dword [ebp + 8]
jne 0x43a34c
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x43a365
push 1
jmp 0x43a34e
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
pop ebp
ret 8
Function at 0x43aa07
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push esi
push 0
push ecx
push 3
push edi
call ebx
test eax, eax
jne 0x43aa58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43aa62
mov edx, dword [esi]
push edx
call fcn.0043a97b
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x43aa62
mov edx, dword [esi]
push esi
push edx
push eax
push 3
push edi
call ebx
test eax, eax
je 0x43aa62
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x43aaac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0043a993
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
mov esi, eax
push 0
push esi
call edi
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebx
push 2
push 0
push 0
lea edx, [esi + 8]
push edx
call edi
push eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
call edi
push eax
call ebx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push 0
push 0
push esi
push 0x43aa69
push 0
push 0
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x43ab15
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp ecx, ebx
je 0x43ab70
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x43ab63
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp ecx, 1
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43ab7d
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
and eax, 2
or eax, 4
push 0
shr eax, 1
push eax
mov eax, dword [ebp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
neg eax
sbb eax, eax
neg eax
pop ebp
ret 0x14
Function at 0x43ac65
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
xor ecx, ecx
xor edi, edi
mov dword [ebp + 0x14], ecx
test al, 1
je 0x43ac82
lea edi, [ecx + 1]
jmp 0x43ac8b
test al, 2
je 0x43ac8b
mov edi, 2
xor bl, bl
test al, 4
je 0x43acca
lea eax, [ebp + 0x1c]
push eax
push 0xa
mov dword [ebp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, dword [ebp + 0x1c]
push 1
push ecx
lea edx, [ebp + 0x14]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x43acff
mov ecx, dword [ebp + 0x28]
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x20]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
or esi, 0x400
push esi
push edx
mov edx, dword [ebp + 8]
push 0
push edi
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
setne bl
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x43ad0d
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x444e3e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x194]
mov eax, dword [ebx + 4]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp + 0xc], eax
cmp ecx, dword [ebp + 0x10]
je 0x444ef8
mov edi, 3
cmp dword [esi + 0x84], edi
jl 0x444eef
mov edx, dword [esi + 0x74]
mov eax, dword [edx + edi*4]
cmp dword [eax], 0
je 0x444ee6
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
cmp dword [eax + 4], ecx
jne 0x444ee6
cmp byte [eax + 0x88], 0xb
je 0x444ee6
mov cl, byte [eax + 0x8b]
movzx edx, cl
cmp edx, dword [ebx + 0x194]
je 0x444eb6
cmp byte [ebx + 0x19c], 0
je 0x444ee6
cmp cl, 0xff
je 0x444ee6
cmp byte [eax + 0x88], 0xa
je 0x444ee6
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x74]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx]
test byte [eax + 0x8a], 0x40
je 0x444ee6
cmp byte [eax + 0x88], 0x1a
jne 0x444ee6
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
inc edi
cmp edi, dword [esi + 0x84]
jle 0x444e70
mov ecx, dword [ebp + 0x10]
mov dword [ebx + 0x194], ecx
mov edi, 3
cmp dword [esi + 0x84], edi
jl 0x444f94
jmp 0x444f0e
mov edx, dword [esi + 0x74]
mov eax, dword [edx + edi*4]
cmp dword [eax], 0
je 0x444f87
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
cmp dword [eax + 4], ecx
jne 0x444f87
cmp byte [eax + 0x88], 0xb
je 0x444f87
movzx edx, byte [eax + 0x8b]
cmp edx, dword [ebx + 0x194]
jne 0x444f87
test byte [eax + 0x8a], 0x20
jne 0x444f87
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x74]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx]
mov ecx, dword [eax]
push 4
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x74]
mov eax, dword [edx + edi*4]
mov eax, dword [eax]
test byte [eax + 0x8a], 0x40
je 0x444f87
cmp byte [eax + 0x88], 0x1a
jne 0x444f87
mov ecx, dword [eax]
push 1
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
inc edi
cmp edi, dword [esi + 0x84]
jle 0x444f0e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x18c]
push 0
push edx
push 0x130c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x445596
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
test eax, eax
je 0x445711
push eax
push 0x4b9720
call fcn.00434ef5
mov dword [0x4b978c], eax
jmp 0x445716
mov ecx, dword [0x4b9780]
mov edx, dword [ecx + eax*4]
push esi
mov esi, dword [edx]
cmp byte [esi + 0x3a], 0
push edi
mov edi, dword [esi]
je 0x445601
cmp dword [esi + 0x190], 0
mov byte [esi + 0x3a], 0
jl 0x445601
cmp byte [esi + 0x19c], 0
je 0x445601
mov eax, dword [esi + 0x198]
push eax
push esi
push 0x4b9720
call fcn.00444e3e
mov byte [esi + 0x19c], 0
cmp ebx, 0x43
ja case.0x445611.7
movzx ecx, byte [ebx + 0x44574e]
jmp dword [ecx*4 + 0x445726]
cmp byte [esi + 0x38], 0
je 0x4456a2
push ebx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call fcn.0043821e
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
cmp byte [esi + 0x38], 0
jne 0x4456a2
push ebx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp ebx, 8
je 0x44565a
cmp ebx, 4
je 0x44565a
push edi
call fcn.0043821e
pop edi
mov byte [esi + 0x38], 1
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov byte [esi + 0x38], 0
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov byte [esi + 0x38], 1
cmp byte [esi + 0x38], 0
je 0x4456a2
push 6
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
push edi
mov byte [esi + 0x39], 1
call dword [sym.imp.USER32.dll_LockWindowUpdate]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
push 0
mov byte [esi + 0x39], 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
mov edx, dword [esi]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov eax, dword [0x4b978c]
cmp eax, 0xffffffff
jne 0x4455bd
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x4460c9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
push esi
mov dword [ebp - 4], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x4461cd
mov edi, dword [ebp + 0xc]
mov eax, edi
or eax, 0x20019
mov dword [ebp - 0xc], eax
jmp 0x44611c
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
push 0
lea edx, [ebp - 0x220]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4461df
mov eax, dword [ebp - 8]
push edi
push eax
call fcn.004460c9
mov ecx, dword [ebp - 8]
add esp, 8
push ecx
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4461df
lea edx, [ebp - 0x18]
xor ebx, ebx
push edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call fcn.00434f9d
test al, al
je 0x446186
push ebx
push edi
lea eax, [ebp - 0x220]
push eax
push esi
lea ecx, [ebp - 0x18]
push ecx
call fcn.004460a6
call eax
jmp 0x446194
lea edx, [ebp - 0x220]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebx
jne 0x4461d6
lea eax, [ebp - 0x18]
push eax
call fcn.0043afd4
lea ecx, [ebp - 0x20]
push ecx
push ebx
push ebx
push ebx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x220]
push eax
push ebx
push esi
mov dword [ebp - 4], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x446119
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
push ecx
call fcn.0043afd4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44669a
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, 1
push 0
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
cmp dword [ebp + 0xc], 0
jne 0x4466cd
mov dword [ebp + 0xc], 0x400
cmp dword [ebp + 8], 0
je 0x446727
lea esp, [esp]
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0043587b
add esp, 4
mov edi, eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push eax
push edi
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x446757
mov eax, dword [ebp + 8]
test eax, eax
je 0x44671e
push eax
push edi
lea ecx, [esi + 0x44]
push ecx
call fcn.00435816
mov eax, dword [ebp + 8]
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x4466da
jmp 0x446727
push edi
call fcn.00411076
add esp, 4
mov edx, dword [esi + 8]
or edx, dword [esi + 0xc]
jne 0x446744
push edx
push 0xdeadbeef
push 0x21
push esi
call fcn.00446667
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 1
push 0
push 0
push esi
call fcn.00446667
pop edi
pop esi
pop ebx
pop ebp
ret 8
push edi
call fcn.00411076
add esp, 4
push 0
push 0xdeadbeef
push 0x20
push esi
call fcn.00446667
pop edi
pop esi
pop ebx
pop ebp
ret 8