joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512648
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x56fe10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0050789b
and dword [ebp - 0x14], 0
cmp dword [0x5776fc], 0
mov dword [ebp - 0x18], eax
jne 0x5126fb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5127a3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x54eb68
push ebx
call edi
test eax, eax
je 0x5127a3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x54eb58
push ebx
mov dword [0x5776fc], eax
call edi
push eax
call esi
push 0x54eb44
push ebx
mov dword [0x577700], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x577704], eax
call edi
push eax
call esi
mov dword [0x57770c], eax
test eax, eax
je 0x5126fb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x577708], eax
mov eax, dword [0x577708]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x512754
cmp dword [0x57770c], ecx
je 0x512754
push eax
call esi
push dword [0x57770c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x512754
test ebx, ebx
je 0x512754
call edi
test eax, eax
je 0x51274b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x51274b
test byte [ebp - 8], 1
jne 0x512754
or dword [ebp + 0x10], 0x200000
jmp 0x512787
mov eax, dword [0x577700]
cmp eax, dword [ebp - 0x18]
je 0x512787
push eax
call esi
test eax, eax
je 0x512787
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x512787
mov eax, dword [0x577704]
cmp eax, dword [ebp - 0x18]
je 0x512787
push eax
call esi
test eax, eax
je 0x512787
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5776fc]
call esi
test eax, eax
je 0x5127a3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5127a5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050112e
leave
ret
Function at 0x40191e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb84
mov eax, dword [0x44f524]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.MsgBox_
lea edi, [ebp - 0x20c]
push 0x1f8
xor ebx, ebx
lea eax, [ebp - 0x1fc]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00424c80
push 0x978
lea eax, [ebp - 0xb84]
push ebx
push eax
call fcn.00424c80
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov eax, 0x4bb
push eax
push eax
lea eax, [ebp - 0xb84]
push eax
call fcn.00401322
add esp, 0x30
cmp dword [ebp + 8], 0xa
jne 0x4019a5
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xb84]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401a1a
call fcn.00401887
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
lea eax, [ebp - 0x20c]
jne 0x4019c2
push dword [ebp + 8]
jmp 0x401994
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x401a29
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push esi
mov edi, eax
mov byte [0x453719], bl
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0xb84]
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
test edi, edi
je 0x401a18
push edi
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422ed4
leave
ret

Function at 0x403789
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x4037a7
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x11]
xor al, byte [ecx + 0x10]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x403792
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x4037b1
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x4037cf
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x12]
xor al, byte [ecx + 0x11]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x4037ba
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x404128
Capabilities:
Get common file path

Disassembly:
push 0xd8
mov eax, 0x437e94
call fcn.004233a3
mov esi, ecx
mov dword [ebp - 0xe0], esi
push 0xc8
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xe4], esi
and dword [ebp - 0xdc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xe0]
call fcn.00402527
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xdc], ecx
mov ecx, esi
push eax
call fcn.00402582
push 5
pop ecx
mov dword [ebp - 0xdc], ecx
and dword [ebp - 4], 0
mov dword [ebp - 0xdc], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0xdc], ecx
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0xe0]
add ecx, 0xfffffff0
call fcn.0040148d
mov eax, esi
call fcn.00423352
ret
Function at 0x4041ba
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x24
mov eax, 0x437f33
call fcn.004233a3
mov edi, edx
mov ebx, ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x28], 0xb
mov dword [ebp - 0x24], 0xcbcfc3b2
mov dword [ebp - 0x20], 0x24ebedea
mov dword [ebp - 0x1c], 0x6ebceeb
mov dword [ebp - 0x18], 0xae58
call fcn.00403789
push eax
lea ecx, [ebp - 0x2c]
call fcn.004024cc
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00404128
mov byte [ebp - 4], 2
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004037d9
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.0040148d
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.0040148d
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x18], 0xae5806
test eax, eax
je 0x4042e8
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x20], 0x2b26d92b
mov dword [ebp - 0x1c], 0xea2b26ea
call fcn.004049e0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004024cc
mov byte [ebp - 4], 8
push edi
push ebx
push dword [ebp + 8]
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.00402f5d
add esp, 0x14
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.0040148d
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0xe4ebd6e5
xor ebx, ebx
mov dword [ebp - 0x18], 0xae5806
call fcn.00404a30
push eax
lea ecx, [ebp - 0x2c]
call fcn.004024cc
mov byte [ebp - 4], 0xa
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
push dword [eax]
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40431d
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0xe4ebd6e5
xor ebx, ebx
call fcn.00404a30
push eax
lea ecx, [ebp - 0x2c]
call fcn.004024cc
mov byte [ebp - 4], 0xc
push 1
push ebx
push ebx
push dword [ebp + 8]
push dword [eax]
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.0040148d
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040148d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040148d
call fcn.00423352
ret
Function at 0x4045ec
Capabilities:
Enumerate process modules

Disassembly:
push 0x444
mov eax, 0x437ffd
call fcn.004233a3
mov edi, edx
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
jne 0x40460e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x404707
push 0x424
lea eax, [ebp - 0x444]
push ebx
push eax
call fcn.00424c80
add esp, 0xc
mov dword [ebp - 0x448], 0x428
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x4046f6
push ecx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x44c], esp
mov ecx, esp
push eax
call fcn.00402527
mov byte [ebp - 4], 1
lea eax, [ebp - 0x428]
push ecx
mov ecx, esp
mov dword [ebp - 0x450], esp
push eax
call fcn.00402527
mov byte [ebp - 4], 2
push dword [ebp - 0x430]
push dword [ebp - 0x42c]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.004039b5
mov byte [ebp - 4], 3
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x4046bc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404a85
pop ecx
pop ecx
test al, al
jne 0x4046dd
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x20]
push ecx
cmp eax, dword [edi + 8]
je 0x4046d5
mov ecx, eax
call fcn.00404e94
add dword [edi + 4], 0x10
jmp 0x4046dd
push eax
mov ecx, edi
call fcn.00404d56
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.00404721
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x404653
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040148d
mov al, bl
call fcn.00423352
ret

Function at 0x4049b8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x4049d6
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x24]
xor al, byte [ecx + 0x23]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x4049c1
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x4049e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x4049fe
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0xe]
xor al, byte [ecx + 0xd]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x4049e9
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x404a08
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x404a26
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0xf]
xor al, byte [ecx + 0xe]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x404a11
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x404a30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x404a4e
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0xa]
xor al, byte [ecx + 9]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x404a39
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret
Function at 0x404a58
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x404a76
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x18]
xor al, byte [ecx + 0x17]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x404a61
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x40509b
Capabilities:
Enumerate process modules

Disassembly:
push 0x448
mov eax, 0x43822e
call fcn.004233a3
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x44c], eax
and dword [ebp - 4], 0
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
cmp esi, edi
je 0x4050d7
mov ecx, esi
call fcn.00404721
add esi, 0x10
cmp esi, edi
jne 0x4050c1
mov esi, dword [ebx]
mov eax, dword [ebp - 0x44c]
push eax
push 8
mov dword [ebx + 4], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x454], esi
test esi, esi
je 0x405234
push 0x424
lea eax, [ebp - 0x444]
push 0
push eax
call fcn.00424c80
add esp, 0xc
mov dword [ebp - 0x448], 0x428
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x405223
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x44c]
call fcn.00402527
mov byte [ebp - 4], 1
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x450]
call fcn.00402527
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x430]
mov esi, dword [ebp - 0x42c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18]
call fcn.004025b5
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.004025b5
mov byte [ebp - 4], 6
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
call fcn.00402868
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402868
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x450]
lea ecx, [ecx - 0x10]
call fcn.0040148d
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x44c]
lea ecx, [ecx - 0x10]
call fcn.0040148d
mov byte [ebp - 4], 9
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x4051e2
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404a85
pop ecx
pop ecx
test al, al
jne 0x405203
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x20]
push ecx
cmp eax, dword [ebx + 8]
je 0x4051fb
mov ecx, eax
call fcn.00404e94
add dword [ebx + 4], 0x10
jmp 0x405203
push eax
mov ecx, ebx
call fcn.00405ab8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00404721
mov esi, dword [ebp - 0x454]
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x405126
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040148d
mov al, bl
call fcn.00423352
ret
Function at 0x405519
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4382b1
call fcn.00423370
mov edi, ecx
push 0xa4
xor esi, esi
call fcn.0040c705
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x405566
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push edi
mov ecx, eax
call fcn.0040501e
mov edi, eax
jmp 0x405568
mov edi, esi
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x28], 0
je 0x40559f
mov ecx, edi
call fcn.004053bf
mov esi, eax
test esi, esi
je 0x405590
cmp dword [ebp + 0x20], 0
mov dword [edi + 0xa0], esi
je 0x405590
push edi
call dword [ebp + 0x20]
pop ecx
push 0xa4
push edi
call fcn.004231f8
pop ecx
pop ecx
jmp 0x4055ba
push esi
push esi
push edi
push 0x4055c2
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4055ba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.0042333e
ret

Function at 0x405a40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x405a5e
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0xb]
xor al, byte [ecx + 0xa]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x405a49
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret
Function at 0x406154
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push 0x454
mov eax, 0x4385e9
call fcn.004233a3
mov ebx, edx
mov edi, ecx
mov eax, 0x80
mov dword [ebp - 0x430], 0x3bc
push 0x3b0
mov dword [0x453734], eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x424]
push 0
push eax
mov dword [ebp - 0x42c], edi
call fcn.00424c80
add esp, 0xc
cmp ebx, 1
jne 0x4062de
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00424c80
add esp, 0xc
lea eax, [ebp - 0x74]
push 0x32
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
movzx eax, word [0x453734]
push eax
push 0
mov dword [ebp - 0x424], 0x17
mov dword [ebp - 0x420], 0x469
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x41c], eax
mov esi, 0x100
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.00429e30
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x10c]
push 0x40
push eax
call fcn.00429e30
movaps xmm0, xmmword [0x446ba0]
add esp, 0x18
movups xmmword [ebp - 0x45c], xmm0
mov dl, 0x24
mov dword [ebp - 0x460], 0x25
movaps xmm0, xmmword [0x446b40]
mov ah, 0xcc
movups xmmword [ebp - 0x44c], xmm0
mov dword [ebp - 0x43c], 0xd14d5dbb
xor ecx, ecx
mov dword [ebp - 0x438], 0xcc24f0d9
mov al, byte [ebp + ecx - 0x45c]
sub al, ah
xor al, dl
mov byte [ebp + ecx - 0x45c], al
inc ecx
mov eax, dword [ebp - 0x460]
cmp ecx, eax
jae 0x40628a
mov ah, byte [ebp - 0x435]
mov dl, byte [ebp - 0x436]
jmp 0x40625f
mov byte [ebp + eax - 0x45c], 0
lea ecx, [ebp - 0x434]
lea eax, [ebp - 0x45c]
push eax
call fcn.004024cc
and dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x310]
push esi
push eax
call fcn.00429e30
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x434]
lea ecx, [ecx - 0x10]
call fcn.0040148d
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 6
push edi
call esi
push 0
push edi
call esi
jmp 0x4062ee
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x430]
xor ecx, ecx
push eax
push 2
pop eax
test ebx, ebx
cmovne eax, ecx
push eax
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
call fcn.00423352
ret

Function at 0x406516
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x406534
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x13]
xor al, byte [ecx + 0x12]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x40651f
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret
Function at 0x407084
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x424
mov eax, 0x438ae3
call fcn.004233a3
mov dword [ebp - 0x41c], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x428], 4
mov dword [ebp - 0x424], 0x201c1c18
mov dword [ebp - 0x420], 0xcc24f0
call fcn.00404a30
push eax
lea ecx, [ebp - 0x42c]
call fcn.004024cc
mov byte [ebp - 4], 1
push ebx
push ebx
push ebx
push ebx
push dword [eax]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
mov dword [ebp - 0x430], esi
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x42c]
add ecx, 0xfffffff0
call fcn.0040148d
test esi, esi
je 0x4071b2
push ebx
push SysReAllocString
push ebx
push ebx
push dword [ebp + 8]
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, eax
test esi, esi
je 0x4071aa
mov edi, dword [ebp - 0x41c]
mov dword [ebp - 0x418], ebx
push 0x401
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00424c80
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
push ecx
lea edx, [ebp - 0x414]
lea ecx, [ebp - 0x41c]
call fcn.00401dbe
pop ecx
mov byte [ebp - 4], 3
mov ecx, edi
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00402e04
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x41c]
add ecx, 0xfffffff0
call fcn.0040148d
cmp dword [ebp - 0x418], 0
jne 0x407132
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov bl, 1
push esi
call edi
push dword [ebp - 0x430]
call edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040148d
mov al, bl
call fcn.00423352
ret
Function at 0x407773
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x438cc7
call fcn.00423370
mov ebx, edx
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 0x14]
mov byte [ebp - 0x14], al
and dword [ebp - 4], 0
push 0x40
call fcn.0040c705
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x4077db
push dword [ebp - 0x14]
lea eax, [ebp + 8]
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push ebx
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00402582
mov byte [ebp - 4], 2
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00406840
xor ecx, ecx
jmp 0x4077df
xor ecx, ecx
mov eax, ecx
mov byte [ebp - 4], cl
push ecx
push ecx
push eax
push 0x407a5c
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x4461c4
push 0x4461cc
lea ecx, [ebp + 8]
call fcn.00404b00
push dword [ebp + 8]
call fcn.00401bf8
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040148d
call fcn.0042333e
ret

Function at 0x407a65
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438dd9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x44f524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ecx]
push 0x10
pop edi
sub ecx, edi
call fcn.0040148d
mov byte [ebp - 4], 3
lea ecx, [esi + 0x2c]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ecx]
sub ecx, edi
call fcn.0040148d
mov byte [ebp - 4], 2
lea ecx, [esi + 0x28]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ecx]
sub ecx, edi
call fcn.0040148d
mov byte [ebp - 4], 1
lea ecx, [esi + 0x24]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ecx]
sub ecx, edi
call fcn.0040148d
mov byte [ebp - 4], 0
lea ecx, [esi + 0x20]
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 0
mov ecx, dword [ecx]
sub ecx, edi
call fcn.0040148d
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x10]
call fcn.004025f5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret