joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424a80
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x200
push ebx
push ebp
push 0
call fcn.004372c8
push eax
call fcn.00436eb4
mov ebx, dword [sym.imp.KERNEL32.dll__lopen]
add esp, 8
push 0
push str.Img_nhaext.img
call ebx
cmp eax, 0xffffffff
je 0x424c4c
mov ebp, dword [sym.imp.KERNEL32.dll__lclose]
push esi
push edi
push eax
call ebp
call fcn.00436ec1
mov esi, eax
and esi, reloc.WS2_32.dll_closesocket
jns 0x424acf
dec esi
or esi, 0xfffffffc
inc esi
add esi, 5
mov edi, 2
cmp esi, edi
mov byte [esp + 0x110], 0x41
mov byte [esp + 0x111], 0x59
jbe 0x424b07
call fcn.00436ec1
cdq
mov ecx, 0x1a
idiv ecx
add dl, 0x61
mov byte [esp + edi + 0x110], dl
inc edi
cmp edi, esi
jb 0x424aeb
mov byte [esp + edi + 0x110], 0
call fcn.00436ec1
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x424b32
lea edx, [esp + 0x10]
push pe_nt_image_headers32
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x424b6f
cmp edx, 1
jne 0x424b49
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x424b6f
mov edi, 0x440ffc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x440ff8
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x114]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.Img_nhaext.img
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x20
push str.Img_nhaext.img
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.Img_nhaext.img
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
push 1
push ecx
call ebx
pop edi
cmp eax, 0xffffffff
pop esi
je 0x424c4c
push eax
call ebp
push 0
push 0
lea edx, [esp + 0x10]
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
pop ebx
add esp, 0x200
ret
Function at 0x424c60
Capabilities:
Delete file
Query environment variable
Set file attributes

Disassembly:
sub esp, 0x200
lea eax, [esp + 0x100]
push ebx
push ebp
push esi
push edi
push pe_nt_image_headers32
push eax
push str._CommonProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, str.BackGame_fip.txt
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x110]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [esp + 0x214]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 7
jbe 0x424d5d
xor ecx, ecx
test ebp, ebp
jle 0x424d1f
mov bl, 0xa
mov al, byte [ecx + esi]
cmp al, 0x2c
jne 0x424d15
mov byte [esp + edx + 0x10], 0xd
inc edx
mov byte [esp + edx + 0x10], bl
jmp 0x424d19
mov byte [esp + edx + 0x10], al
inc edx
inc ecx
cmp ecx, ebp
jl 0x424d02
mov byte [esp + edx + 0x10], 0
lea edx, [esp + 0x110]
push 0
push edx
call dword [sym.imp.KERNEL32.dll__lcreat]
mov esi, eax
cmp esi, 0xffffffff
je 0x424d5d
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret

Function at 0x424d70
Capabilities:
Create thread

Disassembly:
movsx ecx, byte [0x444d60]
mov eax, dword [esp + 4]
cmp eax, ecx
jge 0x424db1
cmp word [eax*2 + 0x446684], 0
je 0x424db1
push 0x446120
push 0
push 0x444f84
push 0x424dc0
push 0
push 0
mov dword [0x444f84], eax
call fcn.0043718f
add esp, 0x18
mov dword [0x44a54c], eax
ret

Function at 0x426110
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x44d34c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x426126
mov dword [0x44ca98], eax
ret
mov ecx, 0x44c658
jmp fcn.00435650

Function at 0x428ed0
Capabilities:
Create thread

Disassembly:
call fcn.0042a950
test eax, eax
jne 0x428eda
ret
call fcn.00423d60
test eax, eax
jne 0x428ee4
ret
call fcn.004220d0
test eax, eax
jne 0x428eee
ret
call fcn.00401090
test eax, eax
jne 0x428ef8
ret
push esi
call fcn.00401000
xor esi, esi
push esi
mov dword [0x44b5cc], esi
mov dword [0x44b5d8], esi
mov dword [0x44b5dc], esi
mov dword [0x44b5bc], esi
call fcn.004372c8
push eax
call fcn.00436eb4
push 0x44b5d4
push esi
push esi
push 0x4292c0
push esi
push esi
mov dword [0x44b5c0], esi
mov dword [0x44b5c8], esi
mov dword [0x44b5d0], 1
mov dword [0x44b5e4], esi
call fcn.0043718f
add esp, 0x20
mov dword [0x44b5c4], eax
mov eax, 1
pop esi
ret
Function at 0x4294a0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push edi
mov edi, dword [esp + 8]
push edi
call fcn.00429d50
add esp, 4
mov dword [edi*4 + 0x44b7e0], 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [edi*4 + 0x44c230], eax
jne 0x4295d4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd8d8
cmp eax, 0x45
ja case.0x4294f1.10033
xor ecx, ecx
mov cl, byte [eax + 0x429670]
jmp dword [ecx*4 + 0x429648]
push 0x4414a8
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push str.The_network_subsystem_or_the_associated_service_provider_has_failed.
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push str.The_specified_address_family_is_not_supported.
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push str.A_blocking_Windows_Sockets_1.1_call_is_in_progress__or_the_service_provider_is_still_processing_a_callback_function.
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push str.No_more_socket_descriptors_are_available.
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push str.No_buffer_space_is_available._The_socket_cannot_be_created.
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push str.The_specified_protocol_is_not_supported.
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push str.The_specified_protocol_is_the_wrong_type_for_this_socket.
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push str.The_specified_socket_type_is_not_supported_in_this_address_family.
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push 0x44127c
push 0x441498
call fcn.0042c420
add esp, 8
xor eax, eax
pop edi
ret
push esi
mov esi, edi
shl esi, 4
push 0
mov word [esi + 0x44c2f8], 2
call dword [sym.imp.WS2_32.dll_htonl]
lea edx, [esp + 0xc]
push 4
mov dword [esi + 0x44c2fc], eax
mov eax, dword [edi*4 + 0x44c230]
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push edx
push 0x1002
push 0xffff
push eax
mov dword [esp + 0x20], 0x10000
call esi
mov edx, dword [edi*4 + 0x44c230]
lea ecx, [esp + 0xc]
push 4
push ecx
push 0x1001
push 0xffff
push edx
call esi
mov dword [edi*4 + 0x44b5fc], 0
pop esi
mov eax, 1
pop edi
ret
Function at 0x429de0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
push eax
mov edx, dword [esi*4 + 0x44c230]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x429e30
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x429e2c
mov dword [esi*4 + 0x44b7e0], 0
mov dword [esi*4 + 0x44b5fc], 1
or eax, 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x429e40
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push 0x4004667f
mov ecx, dword [edi*4 + 0x44c230]
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x429e77
mov ecx, dword [esp + 0xc]
test ecx, ecx
jbe 0x429e77
cmp ecx, eax
jbe 0x429e77
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [esp + 0x10]
mov edx, dword [edi*4 + 0x44c230]
push 0
push eax
push esi
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x429ed6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x429e72
cmp eax, 0x2745
mov dword [edi*4 + 0x44b7e0], 0
mov dword [edi*4 + 0x44b5fc], 1
je 0x429ed0
cmp eax, 0x2746
je 0x429ed0
push eax
call fcn.00429ef0
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov byte [eax + esi], 0
mov eax, dword [esp + 0xc]
pop edi
pop esi
ret

Function at 0x42a950
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
mov ecx, 6
xor eax, eax
mov dword [0x44b5f8], 0
push edi
mov edi, 0x44c5e0
rep stosd dword es:[edi], eax
mov ecx, 6
mov edi, 0x44c438
rep stosd dword es:[edi], eax
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, 0x61a8
mov dword [0x44b7dc], eax
lea eax, [esp + 4]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
pop edi
je 0x42aa41
add eax, 0xffffd8cc
cmp eax, 0x38
ja case.0x42a9b3.10040
xor ecx, ecx
mov cl, byte [eax + 0x42aa80]
jmp dword [ecx*4 + 0x42aa6c]
push str.Indicates_that_the_underlying_network_subsystem_is_not_ready_for_network_communication.
push 0x44207c
call fcn.0042c420
add esp, 8
xor eax, eax
add esp, 0x190
ret
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation.
push 0x44207c
call fcn.0042c420
add esp, 8
xor eax, eax
add esp, 0x190
ret
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress.
push 0x44207c
call fcn.0042c420
add esp, 8
xor eax, eax
add esp, 0x190
ret
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached.
push 0x44207c
call fcn.0042c420
add esp, 8
xor eax, eax
add esp, 0x190
ret
push 0x441f54
push 0x44207c
call fcn.0042c420
add esp, 8
xor eax, eax
add esp, 0x190
ret
mov byte [0x4431c4], 0xf5
mov byte [0x4431c5], 0x1f
mov byte [0x4431c6], 0xe7
mov byte [0x4431c7], 0x26
mov eax, 1
add esp, 0x190
ret
Function at 0x42b2e0
Capabilities:
Set current directory

Disassembly:
sub esp, 0x160
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3c]
push esi
push edi
mov edi, str.NewHalGame
push 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.NewHalGame
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x42b366
push 0
push 0x441e5c
push 0x4420e8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x160
ret 0x10
lea edx, [esp + 0x64]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x64]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x42b39a
mov al, 0x5c
cmp byte [esp + ecx + 0x64], al
je 0x42b395
dec ecx
jne 0x42b38a
jmp 0x42b39a
mov byte [esp + ecx + 0x64], 0
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x300
lea ecx, [esp + 0x48]
mov edx, dword [esp + 0x17c]
mov eax, dword [esp + 0x170]
push 0x400
push ecx
push edx
push eax
call fcn.0042bd20
add esp, 0x14
test eax, eax
jne 0x42b3db
pop edi
pop esi
add esp, 0x160
ret 0x10
call fcn.00428ed0
test eax, eax
jne 0x42b3ef
pop edi
pop esi
add esp, 0x160
ret 0x10
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
call esi
test eax, eax
je 0x42b423
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
jmp 0x42b402
mov eax, dword [esp + 0x14]
pop ebx
pop edi
pop esi
add esp, 0x160
ret 0x10
Function at 0x42bd20
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
push 0x1e
push 0x2ee
push 0
push 0
push 0x44c630
mov dword [0x44d344], esi
call dword [sym.imp.USER32.dll_SetRect]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x10]
push 0x6c
rep stosd dword es:[edi], eax
push esi
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x42b440
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x6f
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], eax
push ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call ebx
push 0xa
push edi
mov dword [0x44c624], eax
call ebx
push edi
mov dword [0x44c620], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x44c624]
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
cmp eax, 0x400
jle 0x42be1f
cmp dword [0x44c620], 0x300
jle 0x42be1f
push 0x10
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
push 0x11
mov edi, eax
mov eax, ebp
cdq
sub eax, edx
sar edi, 1
sar eax, 1
sub edi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
mov ecx, eax
mov eax, ebx
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
jmp 0x42be23
xor edi, edi
xor ecx, ecx
push 0
mov edx, dword [esp + 0x48]
push esi
push 0
push 0
push ebx
push ebp
push ecx
push edi
push 0x82080000
push 0x442120
push edx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x44d340], eax
jne 0x42be56
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov ecx, dword [esp + 0x40]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ecx
push eax
call esi
mov edx, dword [0x44d340]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x44d340]
push 0
push eax
mov dword [0x44d33c], ebp
mov dword [0x44d338], ebx
call esi
push 0x190
push 0x258
push str.loading
call fcn.0042beb0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x42beb0
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x34]
push ebp
push esi
mov esi, dword [esp + 0x40]
push edi
push esi
push ebx
push 0
push 0
push 0x44c608
call dword [sym.imp.USER32.dll_SetRect]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x10]
push 0x6c
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], eax
mov eax, dword [0x44d344]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x42b7d0
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x24], eax
mov eax, dword [0x44d344]
push 0x6f
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], edi
call dword [sym.imp.USER32.dll_RegisterClassA]
mov edx, dword [0x44d344]
mov eax, dword [0x44d340]
mov ebp, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push edx
push 0
push eax
push esi
push ebx
push 0x11
call ebp
cdq
sub eax, edx
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
push ecx
push 0x10
call ebp
cdq
sub eax, edx
mov ecx, eax
mov eax, ebx
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
push ecx
push 0x82080000
push edi
push edi
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x44c628], eax
jne 0x42bf8f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x44c628]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x44d344]
push 0x68
push eax
mov dword [0x44c654], ebx
mov dword [0x44c650], esi
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov ecx, dword [0x44c628]
mov dword [esp + 0x44], eax
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esp + 0x44]
mov ebp, eax
push edx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push ebp
push esi
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x44c628]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x44]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret

Function at 0x42c070
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x44d34c]
test eax, eax
jne 0x42c0cc
push 0x20
push 0x10e
push 0
push 0
push 0x44c5f8
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [0x44d340]
mov ecx, dword [0x44d344]
push 0
push 0x42b8d0
push eax
push 0x71
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x44d34c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov dword [0x44c61c], edx
mov dword [0x44c618], eax
mov eax, 1
ret
Function at 0x42d1a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
xor esi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x42d1ec
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call edi
test eax, eax
jne 0x42d1ec
pop edi
pop esi
add esp, 0x9c
ret
mov eax, dword [esp + 0x18]
sub eax, 0
je 0x42d328
dec eax
je 0x42d2b9
dec eax
jne 0x42d32d
mov eax, dword [esp + 0xc]
cmp eax, 4
ja 0x42d220
mov esi, 7
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
cmp eax, 5
jne 0x42d267
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x42d23d
mov esi, 8
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
cmp eax, 1
jne 0x42d252
mov esi, 9
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
cmp eax, 2
jne 0x42d2a9
mov esi, 0xa
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
cmp eax, 6
jne 0x42d2a9
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x42d294
mov dl, byte [esp + 0xa2]
pop edi
dec dl
neg dl
sbb edx, edx
and edx, 2
add edx, 0xb
mov esi, edx
mov eax, esi
pop esi
add esp, 0x9c
ret
cmp eax, 1
jne 0x42d2a9
mov esi, 0xc
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
mov esi, 0xe
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0xc], 4
jne 0x42d32d
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x42d2f4
mov al, byte [esp + 0x1d]
cmp al, 0x43
je 0x42d2e4
cmp al, 0x42
je 0x42d2e4
mov esi, 3
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
mov esi, 2
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
cmp eax, 0xa
jne 0x42d313
mov dl, byte [esp + 0x1d]
xor eax, eax
cmp dl, 0x41
pop edi
sete al
add eax, 4
mov esi, eax
pop esi
add esp, 0x9c
ret
cmp eax, 0x5a
jne 0x42d32d
mov esi, 6
pop edi
mov eax, esi
pop esi
add esp, 0x9c
ret
mov esi, 1
mov eax, esi
pop edi
pop esi
add esp, 0x9c
ret

Function at 0x42e680
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0042e730
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push eax
mov dword [esi + 8], eax
mov eax, dword [esp + 0x28]
push 0
mov dword [esi + 4], ecx
push ecx
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push edi
mov dword [esi + 0xc], edx
push edx
mov edx, dword [esp + 0x44]
or edx, 0x40000000
mov dword [esi + 0x10], edi
push edx
push 0
push str.EDIT
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [esi], eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 0x1c

Function at 0x42e6f0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x42e709
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push ecx
push edx
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
ret 8

Function at 0x42e750
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x435650
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x110
push esi
lea eax, [esp + 4]
push edi
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x3c]
lea ecx, [esp + 0x10]
xor edi, edi
push ecx
push edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], eax
mov dword [esi], eax
lea eax, [esp + 0x18]
sub ecx, edx
push eax
mov dword [esp + 0x10], ecx
mov dword [esi + 4], ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dl, byte [esp + 0x19]
mov al, 0x80
test al, dl
mov ecx, 1
je 0x4356be
mov dword [esi + 8], ecx
jmp 0x4356c1
mov dword [esi + 8], edi
test byte [esp + 0x1a], al
je 0x4356d3
mov dword [esi + 0xc], ecx
pop edi
pop esi
add esp, 0x110
ret
mov dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0x110
ret

Function at 0x4358e0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push 0x435870
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x477a74], eax
ret

Function at 0x4359d0
Capabilities:
Create thread
Delete file

Disassembly:
mov edx, dword [0x477e84]
push edi
xor edi, edi
test edx, edx
jbe 0x435a41
mov eax, dword [0x477e88]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
xor esi, esi
cmp word [esi + eax], 0xffff
je 0x435a32
mov cx, word [esi + eax + 0x30e]
test cx, cx
je 0x435a32
cmp cx, 1
jne 0x435a21
cmp word [esi + eax + 0x310], 0
je 0x435a21
lea eax, [esi + eax + 0x106]
push eax
call ebx
mov eax, dword [0x477e88]
mov word [esi + eax], 0xffff
mov edx, dword [0x477e84]
mov eax, dword [0x477e88]
inc edi
add esi, 0x316
cmp edi, edx
jb 0x4359ec
pop esi
pop ebx
jmp 0x435a46
mov eax, dword [0x477e88]
xor ecx, ecx
pop edi
test edx, edx
jbe 0x435a5e
cmp word [eax], 0xffff
jne 0x435a5e
inc ecx
add eax, 0x316
cmp ecx, edx
jb 0x435a4d
cmp ecx, edx
jne 0x435a72
mov dword [0x477e7c], 0xffff
mov eax, 1
ret
push 0x477e8c
push 0
push 0
push 0x435aa0
push 0
push 0
mov dword [0x477e7c], ecx
call fcn.0043718f
mov dword [0x477e80], eax
add esp, 0x18
mov eax, 1
ret