joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440b24
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4a4b14]
cmp byte [eax + 0xa5], 0
jne 0x440b9b
cmp dword [0x4a4b2c], 0
jne 0x440b59
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x440ae0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a4b2c], eax
cmp dword [0x4a4b28], 0
jne 0x440b74
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a4b28], eax
cmp dword [0x4a4b30], 0
jne 0x440b9b
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x440a80
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4a4b30], eax
pop ecx
pop ebp
ret

Function at 0x440c64
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.00440bfc
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x440c85
xor eax, eax
call fcn.00440c34
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x440c9f
mov al, 1
call fcn.00440c34
mov esp, ebp
pop ebp
ret

Function at 0x441364
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x4a4b14]
cmp dword [eax + 0x30], 0
je 0x44142e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x441425
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x4412e4
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
cmp dword [eax + 8], 0
je 0x441425
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4413df
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x441425
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
call fcn.0041bfac
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4413f4
mov eax, dword [ebp - 4]
inc dword [eax + 0x94]
mov esp, ebp
pop ebp
ret

Function at 0x442148
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa4], 0
je 0x44218d
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.00404288
jmp 0x44219e
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x8c]
call fcn.004041ec
mov esp, ebp
pop ebp
ret
Function at 0x443544
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x443597
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0044f8b0
test al, al
je 0x443597
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0044f650
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x443597
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0044f650
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x446aa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4a4b78], 0
je 0x446bef
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4a3d80]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x446bef
mov eax, dword [0x4a4b7c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4a4b78]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x446bbe
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4a4b78]
call fcn.0041bfac
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x446bb6
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x446bb6
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x446bb6
mov eax, dword [ebp - 0x14]
call fcn.0044f650
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x446bb6
push ebp
call fcn.00446a5c
pop ecx
test al, al
jne 0x446bb6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x446b72
mov eax, dword [ebp - 0x14]
call fcn.0044e180
dec eax
jle 0x446bb6
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403540
cmp byte [ebp - 1], 0
je 0x446bb6
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x446bb6
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4a4b7c]
call fcn.00446228
inc edi
dec ebx
jne 0x446b05
mov eax, dword [0x4a4b7c]
cmp dword [eax + 8], 0
jle 0x446bd6
mov eax, dword [0x4a4b7c]
call fcn.004462b8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x446bef
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004468c4
pop ecx
test al, al
jne 0x446bef
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a194
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x44a1e0
mov eax, esi
call fcn.004377c8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44a1e0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x44a1e0
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x44a31f
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x44a220
cmp eax, 0x108
ja 0x44a220
mov eax, esi
call fcn.004377c8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44a316
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x44a31f
jmp 0x44a316
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x44a2ff
cmp eax, 0x20a
ja 0x44a2ff
test byte [esi + 0x50], 0x80
jne 0x44a252
sub eax, 0x203
je 0x44a24f
sub eax, 3
je 0x44a24f
sub eax, 3
jne 0x44a252
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x44a266
dec eax
je 0x44a27b
dec eax
je 0x44a298
dec eax
je 0x44a27b
jmp 0x44a29f
mov ecx, ebx
mov eax, dword [0x4a3d80]
mov eax, dword [eax]
mov edx, esi
call fcn.004433c8
jmp 0x44a316
cmp byte [esi + 0x5d], 1
jne 0x44a291
mov eax, esi
mov si, 0xffed
call fcn.00403540
jmp 0x44a31f
or word [esi + 0x54], 1
jmp 0x44a316
and word [esi + 0x54], 0xfffe
jmp 0x44a316
mov eax, dword [0x4a4b34]
cmp byte [eax + 0x20], 0
je 0x44a316
mov eax, dword [0x4a4b34]
cmp dword [eax + 0x1c], 0
je 0x44a316
mov eax, dword [ebx]
mov edx, dword [0x4a4b34]
cmp eax, dword [edx + 0x1c]
jne 0x44a316
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.004376e4
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403540
jmp 0x44a31f
cmp eax, 0xb00b
jne 0x44a316
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00448af0
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d7e0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x44d7fc
cmp dword [esi + 4], 0
je 0x44d829
test byte [ebx + 0x55], 1
jne 0x44d81b
mov eax, ebx
call fcn.0044c3ec
test eax, eax
jne 0x44d81b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x44d939
mov edx, esi
mov eax, ebx
call fcn.0044d304
jmp 0x44d939
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44d932
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0044f650
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0044a0c8
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0044d7e0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0044f650
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d939
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453d48
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4a3f84]
cmp byte [eax + 0xc], 0
je 0x453eb5
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453eae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a4b88], 0
jne 0x453d9c
push 0x453ebc
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x453ec4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b88], eax
cmp dword [0x4a2df8], 0
jne 0x453e97
push 0x453ed4
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4a2df8], eax
cmp dword [0x4a2df8], 0
je 0x453e97
push 0x453ee0
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b8c], eax
push 0x453ef0
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b90], eax
push 0x453f04
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b94], eax
push 0x453f1c
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b98], eax
push 0x453f34
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b9c], eax
push 0x453f48
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4ba0], eax
push 0x453f60
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4ba4], eax
push 0x453f78
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4ba8], eax
push 0x453f94
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4bac], eax
push 0x453fa0
mov eax, dword [0x4a2df8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4bb0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453eb5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x457d40
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404198
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x457d8f
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404408
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478628
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4786e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x10]
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x20]
mov dl, byte [ebx + 0x30]
mov byte [eax], dl
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
sub esi, eax
test esi, esi
je 0x478667
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.00402a04
add esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0xc]
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x1c], eax
mov esi, dword [ebx + 0x14]
mov dword [ebx + 0x20], esi
cmp esi, dword [ebx + 0x18]
jne 0x4786be
mov edx, esi
dec edx
mov eax, dword [ebx + 0x10]
call fcn.0041bdc0
mov edi, eax
mov dword [ebx + 0x20], edi
cmp edi, dword [ebx + 0x10]
jne 0x4786be
lea edx, [ebp - 4]
mov eax, dword [0x4a3cf0]
call fcn.00406140
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00478528
mov eax, dword [ebx + 0x20]
mov al, byte [eax]
mov byte [ebx + 0x30], al
mov eax, dword [ebx + 0x20]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4786e9
lea eax, [ebp - 4]
call fcn.00404198
ret
Function at 0x402f00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4129e0
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x419040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x4030ea
push 0x228
lea eax, [ebp - 0x250]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x254], 0x22c
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4030e6
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x25c], 0
push str.gta_sa.exe
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x258], 0
movups xmmword [ebp - 0x26c], xmm0
call fcn.00409ac0
push 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x26c]
cmp dword [ebp - 0x258], 0xf
push 0
push dword [ebp - 0x25c]
cmova eax, dword [ebp - 0x26c]
push eax
push 0
push 0xfde9
call esi
mov esi, eax
mov dword [ebp - 0x18], 0
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push ecx
lea ecx, [ebp - 0x28]
movups xmmword [ebp - 0x28], xmm0
call fcn.00409890
cmp dword [ebp - 0x14], 7
lea ecx, [ebp - 0x28]
push esi
cmova ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x26c]
cmp dword [ebp - 0x258], 0xf
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmova eax, dword [ebp - 0x26c]
push ecx
push dword [ebp - 0x25c]
push eax
push 0
push 0xfde9
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x258]
cmp ecx, 0xf
jbe 0x403078
mov edx, dword [ebp - 0x26c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40306e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40313d
push ecx
push edx
call fcn.00411902
add esp, 8
cmp dword [ebp - 0x14], 7
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ecx, dword [ebp - 0x14]
add esp, 8
test eax, eax
je 0x40310e
cmp ecx, 7
jbe 0x4030ce
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4030c4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40313d
push ecx
push edx
call fcn.00411902
add esp, 8
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402f80
xor esi, esi
test edi, edi
je 0x4030f1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041155e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x24c]
cmp ecx, 7
jbe 0x4030e6
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403143
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403143
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00411902
add esp, 8
jmp 0x4030e6
Function at 0x403150
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412a1d
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x419040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x40
lea eax, [ebp - 0x68]
mov dword [ebp - 0x6c], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x40319c
mov eax, dword [esi]
push 0
push 0
push dword [esi + 0x10]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x80], eax
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.00409890
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
mov ecx, dword [esi + 0x10]
cmova eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 0xf
jbe 0x4031e9
mov esi, dword [esi]
push dword [ebp - 0x80]
push eax
push ecx
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
push ecx
cmova eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x6c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403241
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x78]
call esi
jmp 0x40325e
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, 0x4145f4
call fcn.00408a60
push 0x408c80
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x40329a
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403290
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403290
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00411902
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041155e
mov esp, ebp
pop ebp
ret
Function at 0x4055c0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x419040]
xor eax, esp
mov dword [esp + 0x2c], eax
push 0x20
xorps xmm0, xmm0
mov dword [esp + 0x14], 0
push str.start_https:__vk.com_sextermafia
lea ecx, [esp + 8]
movaps xmmword [esp + 8], xmm0
mov dword [esp + 0x1c], 0
call fcn.00409ac0
cmp dword [esp + 0x14], 0xf
lea eax, [esp]
cmova eax, dword [esp]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, 0xf
jbe 0x405649
mov edx, dword [esp]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40563f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40563f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00411902
add esp, 8
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0041155e
mov esp, ebp
pop ebp
ret
Function at 0x4071a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4071cc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x4071f4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x4071fa
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x407262
jg 0x407211
test esi, esi
je 0x407262
test ecx, ecx
jl 0x40725d
jg 0x40721b
test eax, eax
je 0x40725d
cmp edi, ecx
jg 0x40722f
jl 0x407225
cmp esi, eax
jae 0x40722f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x407265
mov ecx, dword [ebp + 8]
jmp 0x40726f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x407289
jg 0x40726f
test esi, esi
je 0x407289
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x407289
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc