joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402170
Capabilities:
Create thread
Delete registry key
Get common file path
Read .ini file

Disassembly:
sub esp, 0x6a4
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x69c], eax
push ebx
push esi
push str.Software4399GameLoginHjsg
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call fcn.00402490
call fcn.004025b0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa2]
push ecx
mov word [esp + 0xa4], ax
call fcn.00447b40
add esp, 0xc
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x62]
push eax
mov word [esp + 0x64], dx
call fcn.00447b40
add esp, 0xc
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x22]
push edx
mov word [esp + 0x24], cx
call fcn.00447b40
add esp, 0xc
push str.UnInst
lea eax, [esp + 0x5c]
push 0x20
push eax
call fcn.004454a7
add esp, 0xc
lea ecx, [esp + 0x98]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.4399GameLoginStatistic.ini
lea edx, [esp + 0x9c]
push 0x104
push edx
call fcn.00445516
add esp, 0xc
lea eax, [esp + 0x98]
push eax
push 0x20
lea ecx, [esp + 0x20]
push ecx
push 0x46a9dc
lea edx, [esp + 0x68]
push edx
push 0x46a9e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x18]
push eax
call fcn.00445cfc
add esp, 4
mov esi, eax
inc esi
push esi
push 0x46a9ec
lea ecx, [esp + 0x20]
push 0x20
push ecx
call fcn.0044575a
add esp, 0x10
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x60]
push ecx
push 0x46a9e0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
push str.http:__client.5054399.com_uninstall.htm_taghjsgver3.0.0.1
push str._scount_u
lea edx, [esp + 0x2ac]
push 0x200
push edx
call fcn.0044575a
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0x4033b0
push 0
lea eax, [esp + 0x2b4]
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [edi + 0xdb0]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi + 0xdb0]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
xor eax, eax
mov ecx, 0x46a4fc
mov ebx, str.4399_r_n
call fcn.004037a0
mov ecx, dword [esp + 0x6a8]
add esp, 4
pop esi
pop ebx
xor ecx, esp
call fcn.00445369
add esp, 0x6a4
ret

Function at 0x402330
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x28c
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x288], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x8a]
push ecx
mov word [esp + 0x8c], ax
call fcn.00447b40
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x16]
push eax
mov word [esp + 0x18], dx
call fcn.00447b40
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x62]
push edx
mov word [esp + 0x64], cx
call fcn.00447b40
mov eax, dword [esp + 0x2b4]
add esp, 0x24
jmp dword [eax*4 + 0x402480]
Function at 0x402490
Capabilities:
Delete directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x45e4c5
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x47c944]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
mov dword [esp + 0x220], 0
cmp eax, 0x46a804
je 0x4024ee
mov esi, 0x46a804
call fcn.0040adb0
xor ecx, ecx
cmp ecx, 0x46a7b8
je 0x402507
mov esi, 0x46a7b8
call fcn.0040adb0
call fcn.0040afa0
xor edx, edx
cmp edx, 0x46a828
je 0x40251b
mov esi, 0x46a828
call fcn.0040afa0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.00447b40
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x46a9f4
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00445516
lea ecx, [esp + 0x18]
add esp, 0xc
push ecx
call fcn.004096e0
add esp, 4
test eax, eax
jne 0x40257b
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00445369
add esp, 0x21c
ret
Function at 0x4025b0
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
sub esp, 0xd88
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0xd80], eax
push esi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00447b40
add esp, 0xc
lea edx, [esp + 0x168]
push edx
xor ecx, ecx
push 0x104
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 1
mov word [esp + 0x50], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x168]
push eax
push 0
push str.DelSelf
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push str..bat
lea edx, [esp + 0x16c]
push 0x104
push edx
call fcn.00445f6d
add esp, 0xc
push 0x104
lea eax, [esp + 0x64]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4027a0
lea ecx, [esp + 0x60]
push 0x5c
push ecx
call fcn.00445ff0
add esp, 8
test eax, eax
je 0x402678
lea edx, [esp + 0x60]
sub eax, edx
push eax
mov eax, edx
push eax
push 0x104
lea ecx, [esp + 0x27c]
push ecx
jmp 0x40269c
lea eax, [esp + 0x60]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402680
sub eax, edx
push eax
lea edx, [esp + 0x64]
push edx
push 0x104
lea eax, [esp + 0x27c]
push eax
call fcn.0044601d
add esp, 0x10
push 0x104
lea ecx, [esp + 0x37c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x27c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x378]
push eax
call fcn.004096e0
add esp, 4
cmp eax, 1
push 0
jle 0x40270a
lea ecx, [esp + 0x16c]
push ecx
lea edx, [esp + 0x68]
push edx
mov eax, edx
push eax
push 1
push str.cd_r_n:delexe_r_nping__n__d_127.0.0.1_r_ndel___s__r_nif_exist___s__goto_:delexe_r_ndel___s__r_n
lea ecx, [esp + 0x598]
push 0x800
push ecx
call fcn.004460d2
add esp, 0x20
jmp 0x402741
lea edx, [esp + 0x16c]
push edx
lea eax, [esp + 0x278]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x70]
push edx
mov eax, edx
push eax
push 1
push str.cd_r_n:delexe_r_nping__n__d_127.0.0.1_r_ndel___s__r_nif_exist___s__goto_:delexe_r_ndel___s___Q__F__A_r_nrd___s__r_ndel___s__r_n
lea ecx, [esp + 0x5a0]
push 0x800
push ecx
call fcn.004460d2
add esp, 0x28
lea edx, [esp + 0x580]
push edx
lea eax, [esp + 0x16c]
call fcn.004027c0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x188]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4027a0
mov eax, dword [esp + 0xc]
push 0xfffffffffffffff1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
mov ecx, dword [esp + 0xd84]
pop esi
xor ecx, esp
call fcn.00445369
add esp, 0xd88
ret
Function at 0x4027c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
push 0
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4027e6
or eax, eax
pop esi
pop ecx
ret 4
mov eax, dword [esp + 0xc]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4027f0
push ebx
push ebp
push edi
push 2
push 0
push 0
sub eax, edx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x402837
call ebp
mov ebx, eax
test ebx, ebx
je 0x402837
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
pop ecx
ret 4
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40286c
call ebp
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
pop ecx
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4

Function at 0x402a80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x38
push esi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
push str.Software4399GameLoginHjsg
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402b4e
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov word [esp + 0x26], ax
xor edx, edx
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x1c]
push ecx
mov word [esp + 0x20], dx
lea edx, [esp + 0x18]
push edx
push 0
push 0x46aaf8
push eax
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x28], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ax, word [esp + 0x18]
cmp ax, word [esp + 0x28]
jne 0x402b36
mov cx, word [esp + 0x1a]
cmp cx, word [esp + 0x2a]
jne 0x402b36
mov dx, word [esp + 0x1e]
cmp dx, word [esp + 0x2e]
je 0x402b4e
movzx esi, word [esp + 0x2c]
call fcn.00402b60
test eax, eax
jne 0x402b4e
mov eax, 1
pop esi
add esp, 0x38
ret
xor eax, eax
pop esi
add esp, 0x38
ret
Function at 0x402b60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
push str.Software4399GameLoginHjsg
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x402b94
xor eax, eax
add esp, 0x14
ret
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.DisableDays
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
test eax, eax
je 0x402b8e
movzx ecx, al
cmp esi, ecx
je 0x402bfc
mov edx, eax
shr edx, 8
movzx ecx, dl
cmp esi, ecx
je 0x402bfc
shr eax, 0x10
movzx edx, al
cmp esi, edx
jne 0x402b8e
mov eax, 1
add esp, 0x14
ret
Function at 0x4031f0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x61c
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x618], eax
push ebx
push ebp
mov ebp, dword [esp + 0x628]
push esi
push edi
mov ebx, str.NewHjsg.exe
lea edi, [esp + 0x10]
call fcn.00409630
lea esi, [ebp + 0xa4]
add ebp, 0x9b0
push ebp
lea eax, [esi + 0x2e4]
push 0x200
push eax
call fcn.004454a7
mov ecx, edi
push ecx
lea edx, [esi + 0x6e4]
push 0x104
push edx
call fcn.004454a7
mov eax, dword [esi]
mov edx, dword [eax + 0x14c]
add esp, 0x18
mov ecx, esi
call edx
cmp eax, 1
je 0x403274
push 4
push 0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
jmp 0x4032ce
mov ebx, str.OldHjsg.exe
lea edi, [esp + 0x420]
call fcn.00409630
push 0x104
lea ecx, [esp + 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
mov edx, edi
push edx
lea eax, [esp + 0x220]
push eax
call esi
push 1
lea ecx, [esp + 0x21c]
push ecx
lea edx, [esp + 0x18]
push edx
call esi
push 4
push 0
mov eax, edi
push eax
call esi
mov eax, 1
mov ecx, dword [esp + 0x628]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00445369
add esp, 0x61c
ret 4

Function at 0x4032f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x1c
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.Software4399GameLoginHjsg
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x403324
xor eax, eax
add esp, 0x1c
ret
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, dword [esp]
push 0x10
lea eax, [esp + 0xc]
push eax
push 3
push 0
push 0x46aaf8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x1c
ret

Function at 0x403360
Capabilities:
Create thread

Disassembly:
sub esp, 0x14
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x10]
push edx
push 0x4033b0
push 0
push 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [esi + 0xdb0]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0xdb0]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, 1
add esp, 0x14
ret
Function at 0x4036b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x270
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.00447b40
add esp, 0xc
test esi, esi
jne 0x4036f8
push 0x104
lea edx, [esp + 0x64]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x40370b
push esi
lea eax, [esp + 0x64]
push 0x104
push eax
call fcn.004454a7
add esp, 0xc
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.00447b40
add esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x40
push 0
push 0
mov edx, 1
mov word [esp + 0x64], dx
push 0
lea edx, [esp + 0x80]
push edx
push 0
mov dword [esp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40376c
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00445369
add esp, 0x270
ret

Function at 0x403ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403ef9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403f34
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403f30
lea ebx, [ebx]
cmp esi, eax
jae 0x403f34
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403f20
cmp esi, eax
jb 0x403f3a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4048a0
Capabilities:
Get graphical window text
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov esi, ecx
call fcn.0040cff0
mov eax, dword [esi + 0x260]
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
push ecx
call edi
mov edx, dword [esi + 0x260]
mov eax, dword [esi + 0x20]
push edx
push 0
push 0x80
push eax
call edi
mov ecx, dword [0x48139c]
push 0
push ecx
push 0x4045c0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x481148], eax
lea eax, [esi + 0x1718]
push eax
mov dword [eax], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, esi
call fcn.00404930
call fcn.00404d70
mov ecx, esi
call fcn.00404c60
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404d70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2f8
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x2f0], eax
push edi
xor eax, eax
push 0x23e
push eax
lea ecx, [esp + 0xba]
push ecx
mov word [esp + 0xbc], ax
call fcn.00447b40
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x86]
push eax
mov word [esp + 0x88], dx
call fcn.00447b40
add esp, 0x18
xor eax, eax
push 0x104
lea edx, [esp + 0xb4]
push edx
xor ecx, ecx
push eax
mov word [esp + 0x6c], cx
mov dword [esp + 0x6e], eax
mov dword [esp + 0x72], eax
mov dword [esp + 0x76], eax
mov word [esp + 0x7a], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x46b078
lea eax, [esp + 0xb4]
push 0x120
push eax
call fcn.00445516
mov edx, dword [esi + 0x20]
push 0xa
push 0x20
lea ecx, [esp + 0x84]
push ecx
push edx
call fcn.00446aab
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0xd0]
push 0x120
push ecx
call fcn.00445516
mov eax, dword [esi + 0x183c]
push 0xa
push 8
lea edx, [esp + 0x90]
push edx
push eax
call fcn.00446aab
push 0x46b08c
lea ecx, [esp + 0xec]
push 0x120
push ecx
call fcn.00445516
add esp, 0x44
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0xb4]
push 0x120
push eax
call fcn.00445516
push 0x44
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.00447b40
add esp, 0x18
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
mov edx, 1
push 0
mov dword [esp + 0x54], 1
mov word [esp + 0x58], dx
push 0x40
push 0
push 0
push 0
lea edx, [esp + 0xd0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404ee9
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x1830]
push ecx
call edi
mov edx, dword [esp + 8]
mov dword [esi + 0x1830], edx
mov ecx, dword [esp + 0x2f4]
pop edi
xor ecx, esp
call fcn.00445369
add esp, 0x2f8
ret

Function at 0x404f00
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2a8
mov eax, dword [0x47c944]
xor eax, esp
mov dword [esp + 0x2a0], eax
push esi
xor eax, eax
push 0x23e
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.00447b40
add esp, 0xc
push 0x104
lea edx, [esp + 0x64]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.__update
lea eax, [esp + 0x64]
push 0x120
push eax
call fcn.00445516
push 0x44
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.00447b40
add esp, 0x18
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x40
push 0
push 0
mov edx, 1
mov word [esp + 0x64], dx
push 0
lea edx, [esp + 0x80]
push edx
push 0
mov dword [esp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404fb6
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov ecx, dword [esp + 0x2a4]
pop esi
xor ecx, esp
call fcn.00445369
add esp, 0x2a8
ret
Function at 0x4051b0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
push edi
mov ebx, ecx
cmp eax, 0x100
je 0x4051cb
cmp eax, 0x104
jne 0x40522e
cmp dword [esi + 0xc], 0x112f
je 0x40522e
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor edi, edi
call ebp
shr eax, 8
test al, al
je 0x4051ec
mov edi, 2
push 0x10
call ebp
shr eax, 8
test al, al
je 0x4051fa
or edi, 4
push 0x12
call ebp
shr eax, 8
test al, al
je 0x405208
or edi, 1
mov eax, dword [esi + 8]
cmp eax, dword [0x47dd98]
jne 0x40522e
cmp edi, dword [0x47dd9c]
jne 0x40522e
mov eax, ebx
call fcn.00407390
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
mov eax, dword [esi + 4]
cmp eax, 0x100
jne 0x405245
mov ecx, dword [esi + 8]
cmp ecx, 0x1b
je 0x405222
cmp ecx, 0x20
je 0x405222
cmp eax, 0x112
jne 0x4052c8
cmp dword [esi + 8], 0xf060
jne 0x4052c8
mov ecx, dword [esi + 0xc]
cmp ecx, 0x112f
jne 0x405294
cmp dword [ebx + 0x183c], 1
jl 0x4052b7
cmp ecx, ecx
jne 0x405294
mov eax, dword [ebx + 0x1830]
test eax, eax
je 0x405294
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov dword [ebx + 0x1830], 0
mov eax, 1
pop ebx
ret 4
test ecx, ecx
jne 0x4053a7
cmp dword [ebx + 0x183c], 1
jge 0x4053a7
push ecx
mov ecx, dword [ebx + 0x1830]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.004074b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
cmp eax, 0x102
jne 0x4052e9
movzx edx, word [esi + 8]
cmp edx, 4
jne 0x4052e9
mov ecx, dword [esi + 0xc]
and ecx, 0xffff0000
cmp ecx, 0x200000
je 0x405307
cmp eax, 0x100
jne 0x405385
cmp dword [esi + 8], 0x74
jne 0x405385
cmp dword [ebx + 0x183c], 0
jle 0x405385
mov eax, dword [ebx + 0x186c]
test eax, eax
jl 0x405380
cmp eax, dword [ebx + 0x183c]
jge 0x405380
mov edx, dword [ebx + 0x1838]
mov edi, dword [edx + eax*4]
mov ebp, dword [sym.imp.USER32.dll_IsWindowVisible]
push edi
call ebp
test eax, eax
je 0x40534e
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
mov eax, dword [ebx + 0x182c]
push eax
call ebp
test eax, eax
je 0x405374
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [ebx + 0x182c]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
call fcn.00418702
cmp eax, 0x112
jne 0x4053a7
cmp dword [esi + 8], 0xf120
jne 0x4053a7
cmp dword [ebx + 0x183c], 1
jge 0x4053a7
push 9
mov ecx, ebx
call fcn.0042256b
mov edx, dword [ebx + 0x189c]
push esi
push 0
push 0x407
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov ecx, ebx
call fcn.00421281
pop edi
pop esi
pop ebp
pop ebx
ret 4