joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407483
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ecx
add esp, 4
or ecx, 0x9318
pop ecx
push ebx
or ebx, 0xfe4e
xor ebx, 0x367f
or ebx, 0x12852
call fcn.00407483
add byte [edx + 0x35], cl
dec esi
cmp eax, 0x3d3f3b4b
cmp al, 0x83
add esp, 4
pop ebx
add esp, 4
pop ebx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
push dword [ebx]
leave
mov word [ebp - 0x40], cx
push esi
push ebx
add esp, 4
xor esi, 0xfbb3
xor esi, 0xc8cc
pop esi
push edi
push ecx
add esp, 4
xor edi, 0x150ac
jmp 0x4074d6
pop edi
push esi
push ebx
add esp, 4
add esi, 0xcc1d
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
invalid
invalid
invalid
insb byte es:[edi], dx
invalid

Function at 0x407600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sar byte [ebx], 0xca
je 0x4074b1
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4074b1
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4075cd
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4075d7
mov dword [ebp - 0x1578], 1
add byte [ebx - 0x157773], cl
dec dword [ecx - 0x157b73]
inc dword [ebx - 0x157b43]
inc dword [eax]
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x40762c
push edx
push eax
add esp, 4
call 0x407600
add byte [edi], bh
inc esi
inc esi
dec esp
dec edx
cmp eax, 0x834a4e42
les eax, [ecx + eax*4]
loop 0x4075d6
push edi
add byte [eax], al
sub edx, 0x130b7
add edx, 0xa45a
pop edx
push edi
sub edi, 0xcb47
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x407694
push eax
push esi
add esp, 4
or eax, 0x12aa8
jmp 0x40763e
call 0x40764c
add byte [edi + 0x45], al
inc edi
aas
dec edi
cmp eax, 0xc4833a46
add al, 0x81
shl bh, 0x1c
add byte [eax], al
pop eax
push edi
xor edi, 0x32dd
pop edi
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x40768a
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x407455
mov dword [ebp - 0x2a8], 0
Function at 0x40764c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sar byte [ebx], 0xca
je 0x4074b1
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4074b1
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4075cd
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4075d7
mov dword [ebp - 0x1578], 1
add byte [ebx - 0x157773], cl
dec dword [ecx - 0x157b73]
inc dword [ebx - 0x157b43]
inc dword [eax]
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x40762c
push edx
push eax
add esp, 4
call 0x407600
add byte [edi], bh
inc esi
inc esi
dec esp
dec edx
cmp eax, 0x834a4e42
les eax, [ecx + eax*4]
loop 0x4075d6
push edi
add byte [eax], al
sub edx, 0x130b7
add edx, 0xa45a
pop edx
push edi
sub edi, 0xcb47
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x407694
push eax
push esi
add esp, 4
or eax, 0x12aa8
jmp 0x40763e
call 0x40764c
add byte [edi + 0x45], al
inc edi
aas
dec edi
cmp eax, 0xc4833a46
add al, 0x81
shl bh, 0x1c
add byte [eax], al
pop eax
push edi
xor edi, 0x32dd
pop edi
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x40768a
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x407455
mov dword [ebp - 0x2a8], 0
Function at 0x41f950
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.004265f2
cmp dword [0x480660], 0
je 0x41f96a
mov ecx, esi
call fcn.0041f7d3
jmp 0x41f98d
cmp dword [0x4546d8], 0
je 0x41f992
push 1
mov ecx, 0x457108
push dword [esi + 4]
call fcn.00435087
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
pop eax
jmp 0x41f9b5
mov ecx, esi
call fcn.00427fb8
push 0x6f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, esi
call fcn.0042666f
xor eax, eax
pop esi
ret 0x10

Function at 0x41f9bd
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x10]
push esi
mov esi, ecx
and dword [eax], 0
cmp word [esp + 0xc], 0xf020
jne 0x41fa0c
push ebx
mov dword [eax], 1
call fcn.004265f2
cmp dword [0x4546d4], 0
je 0x41fa06
mov ebx, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, ebx
jne 0x41fa06
push 1
push ebx
mov ecx, 0x457108
call fcn.00435087
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
pop eax
pop ebx
jmp 0x41fa0e
xor eax, eax
pop esi
ret 0x10
Function at 0x424e74
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x470638
push esi
neg eax
sbb eax, eax
push 0
and eax, 0x47063c
push 0
push 0x1042
mov esi, ecx
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push ecx
push 0x419
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esp + 8]
test eax, eax
je 0x424eef
test byte [eax + 0x1c], 8
je 0x424eef
test byte [eax + 0x14], 2
je 0x424eef
mov esi, 0x4f13
push esi
push dword [0x480620]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0xc8
push esi
push dword [0x480620]
call dword [sym.imp.USER32.dll_SetTimer]
pop esi
ret 4

Function at 0x424ef3
Capabilities:
Capture webcam image

Disassembly:
push esi
mov esi, 0x470638
neg esi
sbb esi, esi
push edi
and esi, 0x47063c
push 0
push 0
push 0x1042
mov eax, dword [esi]
mov edi, ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push ecx
push 0x419
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x424f56
test byte [eax + 0x1c], 8
je 0x424f56
test byte [eax + 0x14], 2
je 0x424f56
push dword [esi]
mov ecx, edi
push dword [eax + 0xc]
call fcn.00425e22
pop edi
pop esi
ret 4

Function at 0x4254da
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [ebp + 0xc]
mov esi, ecx
push 0x419
push ebx
call edi
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x41d
push ebx
call edi
test byte [ebp + 0x14], 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
je 0x425517
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
push esi
push ebx
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push 1
push dword [ebp + 0xc]
push 0x403
push ebx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
pop edi
mov dword [eax], ecx
mov ecx, dword [esi + 4]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 0x10

Function at 0x42600b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x426038
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x426034
call esi
cmp eax, 3
je 0x426034
or eax, 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret
push 0
test al, 0x10
pop eax
pop esi
setne al
inc eax
ret
Function at 0x4264d2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1218
call fcn.00437ca0
and dword [ebp - 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call ebx
lea edx, [esi + eax*2]
mov eax, dword [0x45681c]
mov dword [ebp - 0x1218], eax
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1214]
cmp esi, edx
mov dword [ebp - 4], edx
rep stosd dword es:[edi], eax
jae 0x4265eb
cmp word [esi], 0x25
jne 0x4265a9
mov dword [ebp - 0x10], esi
inc esi
inc esi
cmp esi, edx
mov dword [ebp - 0xc], esi
jae 0x4265c8
cmp word [esi], 0x25
jne 0x426576
and word [esi], 0
mov eax, dword [0x45681c]
mov dword [ebp - 0x218], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x214]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
push 0x208
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x42657f
mov word [esi], 0x25
inc esi
inc esi
cmp esi, dword [ebp - 4]
jb 0x426534
jmp 0x4265c8
mov eax, dword [ebp - 0x10]
mov word [eax], 0x25
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x1218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 8], 1
mov word [esi], 0x25
jmp 0x4265c8
lea eax, [ebp - 0x1218]
push eax
call ebx
mov cx, word [esi]
add eax, eax
mov word [ebp + eax - 0x1218], cx
and word [ebp + eax - 0x1216], 0
mov edx, dword [ebp - 4]
inc esi
inc esi
cmp esi, edx
jb 0x42651a
cmp dword [ebp - 8], 0
je 0x4265eb
lea eax, [ebp - 0x1218]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x4265f2
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x48064c], 0
jne 0x426600
jmp fcn.00426601
ret

Function at 0x429b7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x429c01
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], edi
mov eax, dword [esi]
mov eax, dword [eax - 8]
lea eax, [eax + eax + 1]
push eax
call fcn.00437d88
mov ebx, eax
mov eax, dword [esi]
pop ecx
mov ecx, dword [eax - 8]
push edi
shl ecx, 1
push edi
push ecx
push ebx
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 8]
push edi
push eax
mov eax, dword [esi]
push dword [eax - 8]
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
call fcn.00402cc3
push 1
pop eax
pop esi
pop ebx
jmp 0x429c0b
lea ecx, [ebp + 8]
call fcn.00402cc3
xor eax, eax
pop edi
leave
ret
Function at 0x42aa73
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
ret

Function at 0x4323bc
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x43ae8c
call fcn.00437c80
push ecx
push ecx
push ebx
push edi
xor edi, edi
push edi
push 0x80
push 4
push edi
push 1
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x432443
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x14]
push 2
push eax
push ebx
mov word [ebp - 0x14], 0xfeff
mov dword [ebp - 0x10], edi
call esi
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x10]
push edi
push edx
mov eax, dword [ecx]
mov eax, dword [eax - 8]
mov dword [ebp - 0x10], edi
add eax, eax
push eax
push eax
call fcn.00403013
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402cc3
push 1
pop eax
pop esi
jmp 0x432451
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402cc3
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x433f0d
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x433f91
test byte [0x480740], 1
jne 0x433f41
or byte [0x480740], 1
push str.Shell_IDList_Array
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov dword [0x48073c], eax
push dword [0x48073c]
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x433f8b
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x433f8b
push esi
push dword [ebp + 0xc]
push eax
call fcn.00433d4c
mov esi, dword [ebp + 8]
mov eax, dword [0x444120]
pop ecx
pop ecx
mov dword [esi], eax
push 1
mov ecx, esi
call fcn.00402d48
test eax, eax
je 0x433f86
mov eax, dword [esi]
mov word [eax], 1
mov eax, esi
pop esi
leave
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00402c7d
mov eax, dword [ebp + 8]
leave
ret

Function at 0x434323
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43434c
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.USER32.dll_CopyImage]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
ret
Function at 0x434350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x48077c]
and byte [ebp - 2], 0
test eax, eax
mov byte [ebp - 0xc], 0x56
mov byte [ebp - 0xb], 0x6b
mov byte [ebp - 0xa], 0x4b
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x79
mov byte [ebp - 7], 0x53
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x61
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0x57
jne 0x43439f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x48077c], eax
je 0x4343b8
cmp dword [0x480780], 0
jne 0x4343c1
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x480780], eax
cmp dword [0x480780], 0
je 0x4343cc
push dword [ebp + 8]
call dword [0x480780]
leave
ret
xor ax, ax
leave
ret

Function at 0x434e3c
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x810]
mov dword [esi], fcn.00418af4
push 7
push 2
push dword [esi + 0x81c]
call fcn.00434ed6
mov esi, dword [esi + 8]
test esi, esi
je 0x434e71
push 0x444
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret

Function at 0x434e73
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x810]
push 7
push 2
push dword [esi + 0x81c]
call fcn.00434ed6
mov eax, dword [esi + 8]
test eax, eax
je 0x434ea6
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 8], 0
pop esi
ret
Function at 0x434f5d
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
mov ebx, str.Shell_TrayWnd
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x434f9a
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
cmp eax, edi
je 0x434f9a
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x43505e
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x435000
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x434fe4
dec eax
je 0x434fc5
dec eax
je 0x434fe4
dec eax
jne 0x43505e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
jmp 0x43505e
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
jmp 0x434fdf
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x43503d
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x43502b
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x43505e
add eax, 0xffffffe2
jmp 0x43505b
mov esi, dword [ebp + 8]
push edi
push esi
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x435087
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0
je 0x4350c6
call fcn.00435063
test eax, eax
je 0x4350c6
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
call fcn.00434f5d
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret 8

Function at 0x4353f4
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
xor edx, edx
cmp dword [0x480784], edx
push esi
mov esi, ecx
jne 0x43545d
push ebx
push ebp
push edi
mov ecx, 0xac
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], edx
mov ebp, 0x2b4
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x4001
lea eax, [esp + 0x14]
push ebp
push eax
mov ebx, 0x4560b8
push edx
push ebx
call edi
mov dword [esi + 4], eax
push 0x4000
lea eax, [esp + 0x14]
push ebp
push eax
push 0
push ebx
call edi
pop edi
mov dword [esi + 8], eax
pop ebp
mov dword [0x480784], 1
pop ebx
pop esi
add esp, 0x2b4
ret
Function at 0x436f70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 8], 0xffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
xor edi, edi
call ebx
test eax, eax
jle 0x436fb1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax], 9
je 0x436fae
push dword [ebp + 0x10]
add dword [ebp - 4], 2
inc edi
call ebx
cmp edi, eax
jl 0x436f95
jmp 0x436fb1
mov dword [ebp - 8], edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x48], 0
jne 0x436ff4
push str.NULL_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 6
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetCurrentObject]
test eax, eax
je 0x436ff4
lea ebx, [esi + 0x50]
push ebx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x4cc]
mov ebx, 0x100000
neg eax
sbb eax, eax
mov edi, dword [sym.imp.USER32.dll_DrawTextW]
and eax, 0xfff00000
add eax, ebx
or al, 0x24
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x437051
mov ecx, dword [esi + 0x4cc]
neg ecx
sbb ecx, ecx
and ecx, 0xfff00000
add ecx, ebx
or ecx, 0x26
push ecx
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ecx + eax*2 + 2]
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x43748c
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0x10]
cmp dword [ebp + 0x10], eax
push esi
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
setne al
and dword [ebp + 0x10], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x4374e0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x4374ea
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0xc]
cmp dword [ebp + 0xc], eax
push esi
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
setne al
and dword [ebp + 0xc], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x43752c
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret
Function at 0x43754d
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc1c
push esi
xor esi, esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x41c]
push 0x208
push ecx
push eax
call fcn.00437536
mov eax, dword [0x45681c]
mov ecx, 0x81
mov dword [ebp - 0x214], eax
xor eax, eax
lea edi, [ebp - 0x210]
push 0x454984
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call fcn.00437e14
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00437e14
lea eax, [ebp - 0x214]
push str.___bg
push eax
call fcn.00437e14
mov eax, dword [0x45681c]
add esp, 0x24
mov dword [ebp - 0xc1c], eax
mov ecx, 0x1ff
xor eax, eax
cmp dword [ebp + 0xc], esi
lea edi, [ebp - 0xc18]
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
setne al
lea ecx, [ebp - 4]
add eax, 0x80000001
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push 1
lea eax, [ebp - 0xc]
pop edi
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43766c
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00437d94
pop ecx
test eax, eax
pop ecx
je 0x437668
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, edi
jmp 0x43766e
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x403150
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], str.VirtualProtect
push 1
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ole32.dll_CoLockObjectExternal]
mov dword [ebp - 0x14], str.kernel32.dll
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x770eec], eax
lea ecx, [ebp - 4]
push ecx
push 0x40
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x770eec]
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret