joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b158
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44b28d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x4241fc]
call fcn.004242fc
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x44b263
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004243d8
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.004049a0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x44b2a4
call fcn.00404a3c
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.00424518
lea ecx, [ebp - 4]
mov edx, 0x44b2e0
mov eax, dword [ebp - 0xc]
call fcn.00424898
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040e48c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x44b246
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x44b2ec
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x49ffb8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b24d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x44b33c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x44b383
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b366
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b377
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x44b383
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x44fdd4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4a4b7c], 0
je 0x44ff1d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4a3854]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x44ff1d
mov eax, dword [0x4a4b80]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4a4b7c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44feec
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4a4b7c]
call fcn.00418ab8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x44fee4
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ae], 0
je 0x44fee4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x44fee4
mov eax, dword [ebp - 0x14]
call fcn.00459288
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44fee4
push ebp
call fcn.0044fd90
pop ecx
test al, al
jne 0x44fee4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403ae8
test al, al
je 0x44fee4
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403ae8
cmp byte [ebp - 1], 0
je 0x44fee4
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x44fee4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4a4b80]
call fcn.0044f4ec
inc edi
dec ebx
jne 0x44fe39
mov eax, dword [0x4a4b80]
cmp dword [eax + 8], 0
jle 0x44ff04
mov eax, dword [0x4a4b80]
call fcn.0044f5a4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44ff1d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044fbf4
pop ecx
test al, al
jne 0x44ff1d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45368c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x4536da
xor edx, edx
mov eax, esi
call fcn.004398dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4536da
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x268], 0
je 0x4536da
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x268]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x45381b
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x45371c
cmp eax, 0x109
ja 0x45371c
mov dl, 1
mov eax, esi
call fcn.004398dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x453812
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xfc]
test al, al
jne 0x45381b
jmp 0x453812
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x4537fb
cmp eax, 0x20a
ja 0x4537fb
test byte [esi + 0x50], 0x80
jne 0x45374e
sub eax, 0x203
je 0x45374b
sub eax, 3
je 0x45374b
sub eax, 3
jne 0x45374e
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x453762
dec eax
je 0x453777
dec eax
je 0x453794
dec eax
je 0x453777
jmp 0x45379b
mov ecx, ebx
mov eax, dword [0x4a3854]
mov eax, dword [eax]
mov edx, esi
call fcn.00443ed4
jmp 0x453812
cmp byte [esi + 0x5d], 1
jne 0x45378d
mov eax, esi
mov si, 0xffed
call fcn.00403ae8
jmp 0x45381b
or word [esi + 0x54], 1
jmp 0x453812
and word [esi + 0x54], 0xfffe
jmp 0x453812
mov eax, dword [0x4a4b38]
cmp byte [eax + 0x20], 0
je 0x453812
mov eax, dword [0x4a4b38]
cmp dword [eax + 0x1c], 0
je 0x453812
mov eax, dword [ebx]
mov edx, dword [0x4a4b38]
cmp eax, dword [edx + 0x1c]
jne 0x453812
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00439820
mov byte [ebp - 0xc], al
movzx eax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403ae8
jmp 0x45381b
cmp eax, 0xb00b
jne 0x453812
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00451f20
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45675c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004069fc
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00451ec4
test ebx, ebx
jne 0x4567af
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00456698
mov ebx, eax
test ebx, ebx
je 0x45689a
cmp esi, ebx
je 0x4567d8
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4567ed
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x456825
add eax, 0xffffff5f
sub eax, 2
jb 0x45683d
dec eax
sub eax, 2
jb 0x456851
dec eax
sub eax, 2
jb 0x456847
jmp 0x45685b
add eax, 0xfffffdff
sub eax, 2
jb 0x45683d
dec eax
sub eax, 2
jb 0x456851
dec eax
sub eax, 2
jb 0x456847
jmp 0x45685b
mov byte [esp + 0x120], 0
jmp 0x456863
mov byte [esp + 0x120], 2
jmp 0x456863
mov byte [esp + 0x120], 1
jmp 0x456863
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00439820
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004535bc
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x45689c
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x457270
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x210], 0
je 0x45728c
cmp dword [esi + 4], 0
je 0x4572b9
test byte [ebx + 0x55], 1
jne 0x4572ab
mov eax, ebx
call fcn.004559fc
test eax, eax
jne 0x4572ab
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4573c9
mov edx, esi
mov eax, ebx
call fcn.00456cac
jmp 0x4573c9
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4573c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00459288
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004535bc
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00457270
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00459288
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4573c9
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e198
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4a3aac]
cmp byte [eax + 0xc], 0
je 0x45e305
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45e2fe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a4b8c], 0
jne 0x45e1ec
push 0x45e30c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x45e314
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b8c], eax
cmp dword [0x4a00fc], 0
jne 0x45e2e7
push 0x45e324
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4a00fc], eax
cmp dword [0x4a00fc], 0
je 0x45e2e7
push 0x45e330
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b90], eax
push 0x45e340
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b94], eax
push 0x45e354
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b98], eax
push 0x45e36c
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4b9c], eax
push 0x45e384
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4ba0], eax
push 0x45e398
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4ba4], eax
push 0x45e3b0
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4ba8], eax
push 0x45e3c8
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4bac], eax
push 0x45e3e4
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4bb0], eax
push 0x45e3f0
mov eax, dword [0x4a00fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a4bb4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e305
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4924e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x49253a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004924d0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00490268
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0048fdc0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492541
lea eax, [ebp - 4]
call fcn.00404730
ret
Function at 0x496f28
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x49704d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x4a5e54], eax
xor ebx, ebx
mov dword [ebp - 0x130], 0x128
xor edx, edx
mov eax, 2
call fcn.004968dc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x497028
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 8]
call fcn.004968fc
test eax, eax
je 0x496ffe
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.004089f4
mov eax, dword [ebp - 0x134]
push eax
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.004049a0
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.004089f4
mov edx, dword [ebp - 0x138]
pop eax
call fcn.00404b3c
jne 0x496fe8
mov ebx, dword [ebp - 0x128]
test ebx, ebx
jne 0x496ffe
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 8]
call fcn.0049691c
test eax, eax
jne 0x496f99
push ebx
push 0x496ef4
call sub.user32.dll_EnumWindows
mov eax, dword [0x4a5e54]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49702f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x497060
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be0
xor eax, eax
push ebp
push 0x49710e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [0x4a3854]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jbe 0x4970eb
push 0xff
lea eax, [ebp - 0x109]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.004097e8
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.00404d34
test eax, eax
je 0x4970dd
mov esi, ebx
jmp 0x4970ed
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x4970a4
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497115
lea eax, [ebp - 0x110]
call fcn.00404730
lea eax, [ebp - 4]
call fcn.00404730
ret
Function at 0x499b7c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be0
xor eax, eax
push ebp
push 0x499cfd
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.004968dc
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.004968fc
mov ebx, eax
jmp 0x499cc9
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004049a0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040950c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408838
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408838
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404b3c
je 0x499ca0
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004049a0
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408838
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408838
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404b3c
jne 0x499cba
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.0049691c
mov ebx, eax
test ebx, ebx
jne 0x499bfb
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499d04
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404754
lea eax, [ebp - 4]
call fcn.00404730
ret
Function at 0x49bba0
Capabilities:
Hide graphical window

Disassembly:
push 5
push 0x49bbb8
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x49bbc8
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x49bbe4
call sub.user32.dll_FindWindowA
test eax, eax
je 0x49bbe0
push 1
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x49c134
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x49c236
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0xf020
push 0x112
lea ecx, [ebp - 4]
mov eax, dword [0x4a37cc]
mov eax, dword [eax]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
call fcn.00496f28
push eax
call sub.user32.dll_PostMessageA
push 0xffffffffffffffec
lea ecx, [ebp - 8]
mov eax, dword [0x4a37cc]
mov eax, dword [eax]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
call fcn.00496f28
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
lea ecx, [ebp - 0xc]
mov eax, dword [0x4a37cc]
mov eax, dword [eax]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.00496f28
push eax
call sub.user32.dll_SetWindowLongA
push 0
lea ecx, [ebp - 0x10]
mov eax, dword [0x4a37cc]
mov eax, dword [eax]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00496f28
push eax
call sub.user32.dll_ShowWindow
push 0
lea ecx, [ebp - 0x14]
mov eax, dword [0x4a37cc]
mov eax, dword [eax]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00404bf0
push eax
call sub.user32.dll_FindWindowA
test eax, eax
je 0x49c211
push 0
push eax
call sub.user32.dll_ShowWindow
inc ebx
cmp ebx, 0x64
jne 0x49c150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c23d
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404754
ret
Function at 0x49d508
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x4a3a9c]
cmp dword [eax], 2
jne 0x49d582
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x49d582
lea eax, [esp + 0xc]
push eax
push 0x49d598
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x49d582
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x534090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdd000]
push edi
jmp 0x5340aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5340b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5340a0
mov eax, 1
add ebx, ebx
jne 0x5340c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5340d4
jne 0x5340f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5340f3
dec eax
add ebx, ebx
jne 0x5340e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5340b8
add ebx, ebx
jne 0x5340ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x534145
xor ecx, ecx
sub eax, 3
jb 0x53410b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53417a
sar eax, 1
mov ebp, eax
jmp 0x534116
add ebx, ebx
jne 0x534116
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5340e4
inc ecx
add ebx, ebx
jne 0x534124
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5340e4
add ebx, ebx
jne 0x534131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x534126
jne 0x534142
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x534126
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x534164
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x534156
jmp 0x5340a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x534164
add edi, ecx
jmp 0x5340a6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x534182
cmp byte [edi], 0x11
jne 0x534182
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x534187
lea edi, [esi + 0x12d000]
mov eax, dword [edi]
or eax, eax
je 0x5341ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18fb3c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18fcb8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5341b4
mov ecx, edi
jns 0x5341e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18fcbc]
or eax, eax
je 0x5341f9
mov dword [ebx], eax
add ebx, 4
jmp 0x5341d1
call dword [esi + 0x18fccc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x534230
cmp al, 0xef
ja 0x534223
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x534205
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x534212
mov ebp, dword [esi + 0x18fcc0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x534264
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x4019d6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 7
push ebx
push esi
push edi
mov esi, edx
jbe 0x4019f2
mov ecx, dword [ecx]
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401a15
xor al, al
jmp 0x401a3e
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x401a3c
mov eax, dword [ebp + 8]
cmp dword [ebp - 8], eax
jne 0x401a3c
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404a8d
leave
ret