joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov eax, 0x5a4d
cmp word [ebp], ax
je 0x4026ff
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], reloc.MSVCR90.dll__strdup
je 0x40271d
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
xor eax, eax
pop ebp
ret
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x34]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
push 0x3000
push ecx
push edx
call esi
mov edi, eax
test edi, edi
jne 0x40275f
mov eax, dword [ebx + 0x50]
push 4
push 0x3000
push eax
push edi
call esi
mov edi, eax
test edi, edi
jne 0x40275f
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x402795
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x24]
push 4
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x28], edx
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0x54]
push 0x1000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp + 0x3c]
add ecx, dword [ebx + 0x54]
mov dword [esp + 0x14], eax
push ecx
push ebp
push eax
call sub.MSVCR90.dll_memcpy
mov edx, dword [ebp + 0x3c]
mov eax, dword [esp + 0x20]
push esi
add eax, edx
push ebx
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], edi
call fcn.00401df0
mov eax, edi
add esp, 0x18
sub eax, dword [ebx + 0x34]
je 0x40280f
push eax
mov eax, esi
call fcn.00401f60
add esp, 4
call fcn.00401fe0
test eax, eax
je 0x402842
push esi
call fcn.00401ea0
mov ecx, dword [esi]
mov eax, dword [ecx + 0x28]
add esp, 4
test eax, eax
je 0x402859
push 0
push 1
add eax, edi
push edi
call eax
test eax, eax
jne 0x402852
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.00402300
add esp, 4
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret
mov dword [esi + 0x10], 1
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x573755
Capabilities:
Encode data using xor

Disassembly:
add byte [ecx], bh
add byte [0x33003600], dh
add byte [ecx], bh
add byte [eax], dh
add byte [esi], ch
add byte [ebx], al
xor eax, dword [eax]
cmp dword [eax], eax
xor byte [eax], al
add byte cs:[ebx], al
inc ecx
add byte [eax + eax], dl
add byte [eax + eax], bl
jg 0x5736d3
dec edx
xchg dword [edi - 0x4fa81542], edx
or dword [esi - 0x78930653], edx
invalid
insb byte es:[edi], dx
xchg ebp, eax
in eax, 0x13
or dword [ebp - 0x47], ebp
jle 0x57372a
add byte [eax], al
add byte [eax], al
add al, 0
add byte [eax + eax], 0x14
add ch, ah
dec edx
xchg dword [edi - 0x4fa81542], edx
xchg esi, eax
lodsd eax, dword [esi]
stc
insb byte es:[edi], dx
xchg ebp, eax
in eax, 0x13
insd dword es:[edi], dx
mov ecx, 0x100277e
add al, 0
dec ebx
add byte [edx], al
add byte [ecx], bh
add byte [0x37003600], dh
cmp dword [eax], eax
xor eax, 0x37003600
add byte [eax + eax], dh
xor al, 0
add byte cs:[ebx], al
inc ecx
add byte [eax + eax], dl
add byte [eax + eax], bl
jg 0x573729
cmp byte ds:[0x64a1d4c8], ah
or dword [ebx - 0x21b6e2ce], esi
mov ecx, edi
push ebp
or eax, esp
loopne 0x5736da
sub bh, bl
loopne 0x5736da
sub bh, bl
add byte [eax], al
add byte [eax], al
add al, 0
add byte [eax + eax], 0x14
add ch, ah
cmp byte ds:[0x64a1d4c8], ah
mov bl, 0x32
sbb eax, 0xcf8bde49
push ebp
loopne 0x5736f9
sub bh, bl
add byte [ecx], al
add al, 0
dec ebx
add byte [edx], al
cmp dword [eax], eax
cmp byte [eax], al
xor dword [eax], eax
cmp byte [eax], al
xor eax, 0x2e003200
add byte [ecx], bh
add byte [eax], bh
add byte [ecx], dh
add byte [eax], bh
add byte [0x2e003200], dh
add byte [ebx], al
inc ecx
add byte [eax + eax], dl
add byte [eax + eax], bl
jg 0x57377f
dec esi
das
push edx
mov esp, 0x90dc362
jmp 0xc3b7e2a1
Function at 0x405ef7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a1274], 0
push esi
jne 0x405f2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f08
mov dword [ecx*4 + 0x7a1270], eax
inc ecx
cmp ecx, 0x100
jl 0x405f03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1270]
xor eax, esi
inc ecx
dec edx
jne 0x405f41
pop edi
not eax
pop esi
ret 0xc

Function at 0x2945d79
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi + 0x7c]
cmc
pushfd
cmp bx, 0xa834
pushal
add ecx, edx
pushfd
pushfd
stc
mov dword [ebp - 0x10], ecx
bt ax, 0xc
sal cl, cl
mov ecx, dword [ebp + 0xc]
test ax, 0xcb9d
pushfd
cmp ecx, 0xffff
jmp 0x294ed60
lea esp, [esp + 0x28]
je fcn.029489dc
shrd si, dx, 6
mov esi, dword [eax + 0x3c]
cmc
rcr dx, 3
mov edx, esi
add esi, eax
push ebx
cmc
mov edx, dword [esi + 0x78]
push 0xcdda35d5
cmc
stc
mov byte [esp], al
test edx, edx
pushfd
lea esp, [esp + 0xc]
je fcn.029489dc
shrd cx, ax, 0xb
add edx, eax
jmp 0x15e7462
Function at 0x406ed0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
push esi
push edi
mov esi, ecx
call fcn.004e7820
xor edi, edi
lea eax, [esp + 0xc]
mov ebx, 1
mov dword [esi + 0x5c], edi
push eax
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], 0x140
mov dword [esi + 0x68], 0xf0
mov dword [esi + 0x78], edi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], 0x1f4
mov dword [esi + 0x28], 0x14
mov dword [esi + 0x38], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], 0xffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x6c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x3c], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esp + 0x10], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x70], edi
cmp eax, 4
jbe 0x406f81
mov dword [esi + 0x70], 0x40000000
cmp eax, 5
ja 0x406f9c
jne 0x406f8e
cmp dword [esp + 0x14], ebx
jae 0x406f9c
mov dword [esi], edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x94
ret
mov dword [esi], ebx
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x408f80
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
sub esp, 0x100
push ebp
push esi
push edi
push 0
call dword [sym.imp.user32.dll_GetTopWindow]
mov edi, eax
test edi, edi
je 0x409184
mov ebp, dword [sym.imp.user32.dll_GetWindow]
push edi
call dword [sym.imp.user32.dll_IsWindowVisible]
test eax, eax
jne 0x408fbd
push 2
push edi
call ebp
mov edi, eax
test edi, edi
je 0x409184
jmp 0x408fa1
test edi, edi
je 0x409184
lea eax, [esp + 0xc]
push 0xff
push eax
push edi
call dword [sym.imp.user32.dll_GetClassNameA]
mov byte [esp + 0x10b], 0
mov esi, str.tooltips_class32
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40900b
test cl, cl
je 0x409007
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40900b
add eax, 2
add esi, 2
test cl, cl
jne 0x408fe7
xor eax, eax
jmp 0x409010
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409166
mov esi, str.OfficeTooltip
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x409045
test cl, cl
je 0x409041
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x409045
add eax, 2
add esi, 2
test cl, cl
jne 0x409021
xor eax, eax
jmp 0x40904a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409166
mov esi, str.FlyHelp
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40907f
test cl, cl
je 0x40907b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40907f
add eax, 2
add esi, 2
test cl, cl
jne 0x40905b
xor eax, eax
jmp 0x409084
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409166
mov esi, str.SysShadow
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4090b9
test cl, cl
je 0x4090b5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4090b9
add eax, 2
add esi, 2
test cl, cl
jne 0x409095
xor eax, eax
jmp 0x4090be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409166
mov esi, str.MozillaWindowClass
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4090f3
test cl, cl
je 0x4090ef
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4090f3
add eax, 2
add esi, 2
test cl, cl
jne 0x4090cf
xor eax, eax
jmp 0x4090f8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409132
mov esi, str.32774
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x409129
test cl, cl
je 0x409125
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x409129
add eax, 2
add esi, 2
test cl, cl
jne 0x409105
xor eax, eax
jmp 0x40912e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40916f
lea eax, [esp + 0xc]
push 0xff
push eax
push edi
call dword [sym.imp.user32.dll_GetWindowTextA]
mov al, byte [esp + 0xc]
test al, al
jne 0x40916f
mov esi, dword [sym.imp.user32.dll_GetWindowLongA]
push 0xffffffffffffffec
push edi
call esi
test al, 8
je 0x40916f
push 0xfffffffffffffff0
push edi
call esi
test eax, 0x80000000
je 0x40916f
push 0
push edi
call dword [sym.imp.user32.dll_ShowWindow]
push 2
push edi
mov esi, edi
call ebp
mov edi, eax
test edi, edi
je 0x409184
cmp esi, edi
jne 0x408fa1
pop edi
pop esi
pop ebp
add esp, 0x100
ret
Function at 0x40a970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x74]
test eax, eax
je 0x40a986
push eax
call fcn.004f5907
add esp, 4
mov esi, dword [esp + 0x18]
mov dword [ebp + 0x74], 0
test esi, esi
jne 0x40a99d
call fcn.005b2355
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x14]
push str.WAVE
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x40a9ff
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov esi, eax
test esi, esi
je 0x40a9ff
lea ecx, [ebx + 8]
push 1
push ecx
call fcn.004f5c63
add esp, 8
mov dword [ebp + 0x74], eax
test eax, eax
je 0x40a9f3
push ebx
push esi
push eax
call fcn.004f5580
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x417cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5c92c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push eax
push 0x7f5
mov dword [esp + 0x1c], ebx
call fcn.00597905
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyExA]
lea ebp, [ebx + 0x5c]
push ebp
push 0xf003f
lea edi, [ebx + 0x60]
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push 0x80000001
mov dword [esp + 0x34], 0
mov dword [ebx], method.CDialog.virtual_0
mov dword [edi], 0
mov dword [ebp], 0
mov dword [ebx + 0x64], 1
call esi
test eax, eax
je 0x417d4d
push ebp
push 0xf003f
push 0
push 0
push 0x80000000
mov dword [0x61debc], 0
call esi
test eax, eax
je 0x417d4d
mov dword [ebp], 0
cmp dword [ebp], 0
je 0x417e3e
mov dword [esp + 0x28], 0x63e0c0
mov ebp, 0x61de28
mov ecx, dword [esp + 0x28]
push 0x63df70
call fcn.005981bb
mov dword [ebp], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x5c]
push edi
push 0xf003f
push 0
push ecx
push edx
call esi
test eax, eax
jne 0x417e24
lea esi, [ebx + 0x68]
mov edx, dword [edi]
mov dword [esp + 0x10], 0x200
mov byte [esi], al
mov ecx, dword [0x61debc]
lea eax, [esp + 0x10]
neg ecx
push eax
push esi
sbb ecx, ecx
push 0
and ecx, str.Application
push 0
push ecx
push edx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x417e15
cmp byte [esi], 0
je 0x417e15
mov eax, dword [0x63e28c]
push eax
push esi
call fcn.004f6130
add esp, 8
test eax, eax
je 0x417e0b
lea ecx, [esp + 0x10]
mov dword [ebp], 1
mov edx, dword [edi]
push ecx
push esi
push 0
push 0
push str.HprSnapOld
push edx
mov dword [esp + 0x28], 0x200
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x417e15
mov ecx, dword [esp + 0x28]
push esi
call fcn.005981bb
mov eax, dword [edi]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x28]
add ebp, 0xc
add ecx, 4
cmp ebp, 0x61dec4
mov dword [esp + 0x28], ecx
jl 0x417d64
push 0x63e28c
lea ecx, [esp + 0x14]
push str.Applications_
push ecx
call fcn.0059833b
push str._shellopencommand
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x2c], 1
call fcn.005982c7
mov eax, dword [eax]
push edi
push 0xf003f
push 0
push eax
push 0x80000000
call esi
lea ecx, [esp + 0x28]
mov esi, eax
call fcn.00598032
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.00598032
test esi, esi
jne 0x417ed6
mov ecx, dword [edi]
lea eax, [esp + 0x28]
lea esi, [ebx + 0x68]
push eax
push esi
push 0
push 0
push 0
push ecx
mov dword [esp + 0x40], 0x200
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edx, dword [edi]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
push str.__onewin
push esi
call fcn.004f6130
add esp, 8
neg eax
sbb eax, eax
neg eax
mov dword [ebx + 0x64], eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x4183d0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov edi, 0x61de24
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x63e0c0
lea ebx, [ebp + 0x60]
mov dword [esp + 0x14], edi
mov eax, dword [edi]
mov ecx, dword [ebp + 0x5c]
push ebx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4184d4
lea edx, [esp + 0x1c]
lea esi, [ebp + 0x68]
push edx
push esi
push eax
mov byte [esi], al
push eax
mov eax, dword [0x61debc]
mov ecx, dword [ebx]
mov dword [esp + 0x2c], 0x200
neg eax
sbb eax, eax
and eax, str.Application
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x4184cb
mov edx, dword [0x63e28c]
push edx
push esi
call fcn.004f6130
add esp, 8
test eax, eax
je 0x4184cb
mov eax, dword [esp + 0x10]
or ecx, 0xffffffff
mov dword [esp + 0x18], 1
mov edx, dword [eax]
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4184a1
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [0x61debc]
neg ecx
sbb ecx, ecx
push edx
mov edx, dword [ebx]
push 1
and ecx, str.Application
push eax
push ecx
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
jmp 0x4184b9
mov eax, dword [0x61debc]
mov ecx, dword [ebx]
neg eax
sbb eax, eax
and eax, str.Application
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
mov edx, dword [ebx]
push str.HprSnapOld
push edx
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
mov edi, dword [esp + 0x14]
mov eax, dword [ebx]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
add edi, 0xc
add ecx, 4
cmp edi, str..j2k
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ecx
jl 0x4183f5
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x41850f
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.shell32.dll_SHChangeNotify]
add esp, 0x10
ret
Function at 0x41c770
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x5c97ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x63094c]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
mov eax, dword [esi + 8]
mov ebx, 1
test eax, eax
mov dword [esp + 0x34], ebx
jne 0x41c7c0
push 0x85
lea ecx, [esp + 0xc]
call fcn.005985fc
jmp 0x41c8ef
test byte [esi + 4], 2
je 0x41c817
lea ecx, [esp + 0x10]
push 0x7177
push ecx
call fcn.004b9db0
add esp, 8
push 0x61e150
lea edx, [esp + 0x10]
push eax
push edx
mov byte [esp + 0x40], 2
call fcn.005982c7
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 3
call fcn.0059816b
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 2
call fcn.00598032
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], bl
call fcn.00598032
test byte [esi + 4], 4
je 0x41c86e
lea eax, [esp + 0xc]
push 0x7178
push eax
call fcn.004b9db0
add esp, 8
push 0x61e150
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x40], 4
call fcn.005982c7
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 5
call fcn.0059844a
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 4
call fcn.00598032
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], bl
call fcn.00598032
test byte [esi + 4], bl
je 0x41c8c4
lea edx, [esp + 0xc]
push 0x7176
push edx
call fcn.004b9db0
add esp, 8
push 0x61e150
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x3c], 6
push eax
call fcn.005982c7
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 7
call fcn.0059844a
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 6
call fcn.00598032
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], bl
call fcn.00598032
mov edx, dword [esi + 8]
lea ecx, [esp + 0x18]
push 0x14
push ecx
push 0
push edx
call dword [sym.imp.user32.dll_MapVirtualKeyA]
shl eax, 0x10
push eax
call dword [sym.imp.user32.dll_GetKeyNameTextA]
lea eax, [esp + 0x18]
lea ecx, [esp + 8]
push eax
call fcn.0059840e
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00597da7
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x34], 0
call fcn.00598032
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x422e40
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov esi, eax
mov edi, dword [esp + 0x10]
test edi, edi
je 0x422e7b
call fcn.005b2355
mov dword [eax + 0xc], edi
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0xc]
mov dword [0x63e6f0], eax
xor eax, eax
cmp edi, esi
setne al
dec eax
pop edi
and eax, 0x4c7
pop esi
ret 0xc
push 1
call fcn.004f548a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
mov esi, ecx
push 0
lea ecx, [esi + 0xc0]
call fcn.004bec20
mov dword [esi + 0x1bc], eax
pop esi
ret
Function at 0x422eb0
Capabilities:
Create process on windows
Delete file
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ca097
push eax
mov dword fs:[0], esp
sub esp, 0x414
push ebx
push esi
push edi
mov esi, ecx
push str.wininet.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
xor ebx, ebx
cmp eax, ebx
je 0x4230ef
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push ecx
mov edi, 0x400
push ebx
push str.http:__www.hyperionics.com
mov dword [esp + 0x2c], edi
call dword [0x63df40]
cmp eax, ebx
je 0x4230ef
lea edx, [esp + 0x20]
lea ecx, [esp + 0xc]
push edx
mov byte [esp + 0x423], bl
mov dword [esp + 0x20], edi
call fcn.005980a0
mov eax, dword [eax]
lea ecx, [esp + 0x1c]
push 0x30000000
lea edx, [esp + 0x24]
push ecx
push edx
push eax
call dword [0x63df3c]
lea ecx, [esp + 0xc]
call fcn.00598032
lea edi, [esi + 0xc0]
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.004bb5e0
mov ecx, dword [esp + 0x14]
push 0x61f1a4
push ecx
mov dword [esp + 0x430], ebx
call fcn.004f59f0
add esp, 8
test eax, eax
jle 0x4230db
lea edx, [esp + 0x20]
push str.AfIDCRK
push edx
call fcn.004f6130
add esp, 8
test eax, eax
je 0x4230db
lea eax, [esp + 0x14]
push ebp
push eax
lea ecx, [esp + 0x14]
push str.crsn
push ecx
call fcn.0059833b
mov eax, dword [eax]
lea edx, [esp + 0x24]
push eax
push edx
call fcn.004f6130
add esp, 8
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.00598032
cmp ebp, ebx
pop ebp
je 0x4230db
lea eax, [esp + 0x18]
mov ecx, edi
push eax
mov dword [0x64096c], ebx
mov dword [0x640968], ebx
call fcn.004bb5e0
push eax
lea ecx, [esp + 0x14]
push 0x61f18c
push ecx
mov byte [esp + 0x434], 1
call fcn.0059833b
push 0x61ed90
lea edx, [esp + 0x10]
push eax
push edx
mov byte [esp + 0x434], 2
call fcn.005982c7
push eax
lea ecx, [esi + 0x198]
mov byte [esp + 0x42c], 3
call fcn.0059844a
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], 2
call fcn.00598032
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 1
call fcn.00598032
lea ecx, [esp + 0x18]
mov byte [esp + 0x428], bl
call fcn.00598032
mov eax, dword [esi + 0x160]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ecx, dword [esi + 0x160]
and al, 0xfc
push eax
push ecx
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
mov esi, dword [esi + 0x160]
push esi
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, edi
call fcn.004bc0d0
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004bb5e0
push eax
lea ecx, [esp + 0x1c]
push str.http:__www.hyperionics.com_hsdx_crack.asp_sn
push ecx
mov byte [esp + 0x434], 4
call fcn.0059833b
mov eax, dword [eax]
push 5
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
lea ecx, [esp + 0x18]
call fcn.00598032
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], bl
call fcn.00598032
lea ecx, [esp + 0x14]
mov dword [esp + 0x428], 0xffffffff
call fcn.00598032
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x420
ret