joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4423dc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push fcn.004423dc
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov word [0x470a74], 1
mov ebx, dword [ebp + 0xc]
fild word [ebx]
fstp qword [ebp - 0x94]
fld1
fstp qword [ebp - 0x8c]
fild word [0x48316c]
fstp qword [0x470a60]
jmp 0x442506
fld qword [0x470a60]
fiadd word [0x4836c8]
fistp qword [ebp - 0x5c]
push dword [ebp - 0x5c]
mov ebx, 0x46f020
push ebx
fld qword [0x470a60]
fiadd word [0x4836c8]
fistp qword [ebp - 0x5c]
push dword [ebp - 0x5c]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetDlgItem]
call fcn.0046d0ef
push eax
call dword [sym.imp.USER32.DLL_GetWindowTextA]
call fcn.0046d0ef
mov ebx, 0x46f020
call fcn.0046d62c
fld qword [0x470a60]
fistp qword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov ebx, dword [0x4731f0]
mov edx, dword [ebx + eax*4]
call fcn.0046d792
call fcn.0046d04d
je 0x4424f4
fld1
fcomp qword [0x470a60]
fnstsw ax
sahf
jae 0x4424f4
mov eax, 0x34
add eax, dword [0x471d18]
mov edx, dword [eax]
call fcn.0046d792
mov edx, str.nderung_von_Vollzeit_auf_Teilzeit
call fcn.0046d7a6
call fcn.0046d04d
jne 0x4424f4
xor eax, eax
movsx ecx, word [0x4715d8]
cmp ecx, eax
jne 0x4424f4
mov word [0x471398], 1
mov edx, 0x4741fc
call fcn.0046d7a6
mov ebx, 0x4714b4
call fcn.0046cdad
fld qword [ebp - 0x8c]
fadd qword [0x470a60]
fstp qword [0x470a60]
fld qword [0x470a60]
fcomp qword [ebp - 0x94]
fnstsw ax
sahf
jbe 0x442421
mov word [0x470a74], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45ec99
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push fcn.0045ec99
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
fldz
fstp qword [0x470a60]
push 0x70
call dword [sym.imp.USER32.DLL_GetKeyState]
call fcn.0046d0ef
cwde
call fcn.0046b12d
fstp qword [ebp - 0x8c]
fldz
fcomp qword [ebp - 0x8c]
fnstsw ax
sahf
jae 0x45ed02
mov eax, 1
movsx ecx, word [0x471370]
cmp ecx, eax
jne 0x45ed02
mov word [0x471370], 0
fild word [0x483680]
fstp qword [0x470a60]
fldz
fcomp qword [ebp - 0x8c]
fnstsw ax
sahf
jb 0x45ed31
xor eax, eax
movsx ecx, word [0x471370]
cmp ecx, eax
jne 0x45ed31
mov word [0x471370], 1
fild word [0x483680]
jmp 0x4a10d0
fild word [0x483680]
fcomp qword [0x470a60]
fnstsw ax
sahf
jne 0x45ed79
mov word [0x471374], 1
xor eax, eax
movsx ecx, word [0x471678]
cmp ecx, eax
jne 0x45ed79
push 0
push 0xd
push 0x100
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.USER32.DLL_PostMessageA]
call fcn.0046d0ef
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4678f4
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word cs:[0x467d06], 4
jne 0x467910
jmp 0x467d24
jmp fcn.00467b2e
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.00467a2a
mov dword [ebx + 0x2ac], 1
lea eax, [ebx + 0x470]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je fcn.00467d75
jmp loc.004a4780

Function at 0x467915
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x46796e
mov dword [ebx + 0x28c], eax
mov dword [ebx + 0x294], 0
mov dword [ebx + 0x290], 0
call fcn.00467bc1
jb 0x46796e
mov dword [ebx + 0x290], eax
mov dword [eax + 0x58], 8
call 0x467962
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x46797c
push ebx
jb 0x4679c9
add byte [esi - 4], bl
mov ecx, 0xe
lea edi, [eax + 0x38]
rep movsb byte es:[edi], byte [esi]
ret
call dword [sym.imp.KERNEL32.DLL_TlsFree]
ret
or bl, ch
mov esp, 0x8d02e6c1
or al, 0x33

Function at 0x467c53
Capabilities:
Set thread local storage value

Disassembly:
push eax
push eax
push dword [0x46e28c]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
pop eax
test eax, eax
jne 0x467c6d
jmp loc.004a6850
inc dword [0x46e294]
ret
Function at 0x40108d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403170
push 0x401008
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x404830], 0xffffffff
or dword [0x404834], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40482c]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x404828]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x404838], eax
call fcn.00401000
cmp dword [0x4040b8], ebx
jne 0x401110
push 0x401efd
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00401c3a
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
lea esi, [ebp - 0x64]
mov eax, dword [0x404824]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x60]
push dword [0x404820]
push esi
lea esi, [ebp - 0x70]
push esi
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x4011a3
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x401177
cmp al, 0x22
jne 0x401169
cmp byte [esi], 0x22
jne 0x401180
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x40118a
cmp al, 0x20
jbe 0x40117c
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x4011ae
movzx eax, word [ebp - 0x2c]
jmp 0x4011b1
cmp byte [esi], 0x20
jbe 0x401180
inc esi
mov dword [ebp - 0x74], esi
jmp 0x4011a3
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x401ce6
Capabilities:
Authenticate hmac

Disassembly:
test al, 0xaf
adc al, 0xf2
xchg ebx, eax
sbb eax, dword [esi + 0x63]
and eax, 0x6d2e78c6
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
invalid
Function at 0x4013fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push 0x40e0c0
call fcn.004074b0
xor ebx, ebx
mov dword [esp], 0x40fde0
push ebx
mov dword [ebp - 0x14], eax
call fcn.0040530f
push ebx
push 0x40fba1
call fcn.00403464
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x444]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov dword [ebp - 0x340], 0x224
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x18], eax
push ecx
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4015ef
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004073c0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.0040c590
add esp, 0x10
test eax, eax
je 0x4015ef
push dword [ebp - 0x338]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4015ef
push esi
mov esi, 0x80000
push edi
push esi
mov edi, 0x4119e0
push ebx
push edi
call fcn.00407360
mov eax, dword [ebp - 0x328]
add esp, 0xc
cmp eax, esi
jb 0x4014e1
mov eax, esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x401506
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x32c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4015e1
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x4015e1
push dword [ebp + 8]
push 0x40fba1
call fcn.00403434
push eax
mov dword [ebp - 0x10], eax
call fcn.004074b0
xor esi, esi
add esp, 0xc
cmp dword [ebp + 0xc], esi
mov ebx, eax
je 0x40153c
lea eax, [ebx + 0x6e]
mov dword [ebp - 8], eax
jmp 0x40153f
mov eax, dword [ebp - 8]
sub eax, ebx
sub eax, 0xa
je 0x4015d2
push dword [ebp - 0x14]
lea edi, [esi + 0x4119e0]
push edi
push 0x40e0c0
call fcn.0040c4e0
add esp, 0xc
test eax, eax
je 0x4015cb
cmp dword [ebp + 0xc], 0
jne 0x40158b
push ebx
push edi
push dword [ebp - 0x10]
call fcn.0040c4e0
add esp, 0xc
test eax, eax
je 0x40158b
mov eax, dword [ebp - 8]
inc esi
sub eax, ebx
sub eax, 0xa
cmp esi, eax
jb 0x40154a
jmp 0x4015d2
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push str._aWyu_mWA
call fcn.00403434
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
jne 0x4015cb
lea eax, [ebp - 0x11c]
push eax
call fcn.00403dfa
pop ecx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x401512
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4053e8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 1
pop ebx
push ebx
call fcn.004046ab
mov esi, 0x104
xor edi, edi
push esi
push edi
push 0x491df4
call fcn.00407360
push esi
push edi
push 0x491cf0
call fcn.00407360
push esi
push edi
push 0x491bec
call fcn.00407360
push esi
push edi
push 0x491ae8
call fcn.00407360
push esi
push edi
push 0x4919e4
call fcn.00407360
add esp, 0x40
push 0x40e0d0
push 0x1f16
push 0x40e0d4
call fcn.00403529
push 0x491f00
call fcn.00402642
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
mov dword [0x491f08], edi
mov dword [0x491ef8], eax
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
jne 0x4054a8
cmp dword [ebp - 0x8c], ebx
jne 0x4054a8
mov dword [0x491f08], ebx
call fcn.004048ef
mov esi, 0x7d000
push esi
call fcn.00407bff
cmp eax, edi
pop ecx
mov dword [0x4919e0], eax
jne 0x4054c6
xor eax, eax
jmp 0x4054ea
push esi
push edi
push eax
call fcn.00407360
call fcn.004055a8
push ebx
push 0x40fde0
call fcn.00403434
push eax
push edi
call fcn.0040530f
add esp, 0x1c
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4055a8
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
push edi
push 2
push 0x40fb6f
call fcn.00403434
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop ecx
pop ecx
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
mov edi, 0x40fc6f
je 0x40560d
push 1
push edi
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
push 4
push edi
mov dword [0x491f10], eax
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
push 5
push edi
mov dword [0x491f0c], eax
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
mov dword [0x491f14], eax
push 3
push 0x40fb6f
call fcn.00403434
pop ecx
pop ecx
push eax
call ebx
mov ebp, eax
test ebp, ebp
je 0x405637
push 3
push edi
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
mov dword [0x491f18], eax
mov edi, str._aoaoy_
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x405658
push 1
push edi
call fcn.00403434
pop ecx
pop ecx
push eax
push ebx
call esi
mov dword [0x491f1c], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x406ab2
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2240
call fcn.00407bd0
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 8], eax
jne 0x406ae6
push dword [ebp + 8]
call fcn.0040471a
test eax, eax
pop ecx
jne 0x406c24
mov edi, str.Uy_YS
push ebx
push edi
call fcn.00403464
pop ecx
cmp esi, ebx
pop ecx
mov dword [ebp + 0xc], eax
jge 0x406b0a
push ebx
call fcn.004046ab
xor edx, edx
pop ecx
div dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov esi, 0x40f1dc
push ebx
push esi
call fcn.00403464
cmp dword [ebp + 0x10], ebx
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
jge 0x406b2f
push ebx
call fcn.004046ab
xor edx, edx
pop ecx
div dword [ebp + 0xc]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x10c]
push eax
call fcn.00403d8c
lea eax, [ebp - 0x314]
mov dword [esp], 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push ebx
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x406c24
lea eax, [ebp - 0x10c]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x1f2a
lea eax, [ebp - 0x2240]
push 0x40e0c0
push eax
call fcn.00407870
lea eax, [ebp - 0x2240]
mov byte [ebp - 0x122c], bl
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004054ef
push ebx
call fcn.004046ab
xor edx, edx
mov ecx, 0x2800
div ecx
lea eax, [ebp - 0x10c]
add edx, 0x13200
push edx
push eax
call fcn.00403f63
push dword [ebp - 4]
push edi
call fcn.00403434
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004073c0
push dword [ebp - 8]
push esi
call fcn.00403434
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004073d0
add esp, 0x40
lea eax, [ebp - 0x210]
push dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
call fcn.004050fd
lea eax, [ebp - 0x10c]
push eax
call fcn.00403dfa
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406dbf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
pop ebx
push 0x927c0
call edi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ax, word [ebp - 0x12]
test bl, al
je 0x406dd1
cmp word [ebp - 0xe], 6
jne 0x406dd1
and dword [0x491f04], 0
cmp ax, 7
mov dword [0x491f08], ebx
jne 0x406e0a
mov dword [0x491f04], ebx
cmp ax, bx
jne 0x406e15
mov dword [0x491f04], ebx
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x406d66
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
inc esi
cmp esi, 0x1a
jl 0x406e17
push 0x1b7740
call edi
call fcn.00406da8
push 0xffffffffffffffff
call edi
jmp 0x406dd1
Function at 0x4014b8
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x1369e
lea edi, [esi + 0x10]
mov dword [esi], 0x416ae8
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4da8c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x4015d0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Print debug messages
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push esi
push edi
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov ebx, ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x41b9d4]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, 1
jne 0x401615
or al, 1
mov byte [0x41b9d4], al
call esi
mov dword [0x41b9d0], eax
cmp dword [0x41b9e0], 8
jle 0x401653
mov dword [0x41b9e0], 0
call esi
mov ecx, dword [0x41b9d0]
mov edx, eax
sub edx, ecx
mov dword [0x41b9d0], eax
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fmul dword [0x416af0]
fdivr dword [0x416aec]
fstp dword [0x41b9cc]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.worinimahuorong
call esi
push 0x4da78
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x401681
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov eax, dword [0x41b070]
push ebp
add ebx, 0x4da90
push eax
push ebx
push edi
call fcn.00401560
add esp, 0xc
push str.worinimahuorong1
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.VirtualProtect
push str.KERNEL32.dll
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
push str.worinimahuorong2
mov dword [esp + 0x18], eax
call esi
push str.CreateThread
push str.KERNEL32.dll
call ebx
push eax
call ebp
push 0x41b9e4
call esi
lea ecx, [esp + 0x18]
push ecx
push 0x40
push 0x4da78
push edi
call dword [esp + 0x24]
push str.worinimahuorong3
call esi
push 0
push 0
push edi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.worinimahuorong4
call esi
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x405340
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
push edi
mov edi, ecx
mov eax, dword [edi + 0x48]
test eax, eax
jne 0x405356
mov al, 1
pop edi
add esp, 0x38
ret 8
push ebx
push ebp
push esi
push 0xd
mov dword [esp + 0x20], 9
xor esi, esi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x20]
push esi
push esi
push 0x1200
push eax
mov byte [esp + 0x23], 1
call ebx
xor ebp, ebp
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4053e1
mov edx, dword [edi + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x1203
push edx
call ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
add esi, eax
mov eax, 1
shl eax, cl
test dword [edi + 0x48], eax
je 0x4053d8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x4c]
cdq
sub eax, edx
mov edx, esi
sar eax, 1
sub edx, eax
cmp ecx, edx
jle 0x4053d8
add eax, esi
cmp ecx, eax
jge 0x4053d8
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jl 0x405391
mov al, byte [esp + 0x13]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x38
ret 8

Function at 0x405c20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414462
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.00413888
lea edi, [esi + 0x5c]
mov byte [esp + 0x18], 1
mov ecx, edi
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 2
call fcn.00407330
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 3
call fcn.00407e90
lea ecx, [esi + 0x114]
mov byte [esp + 0x18], 4
call fcn.00407a80
mov al, byte [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov byte [esi + 0x46], al
mov eax, dword [esp + 0x24]
push 0x7fe2
push ebx
mov byte [esp + 0x20], 5
mov dword [esi], 0x417308
mov dword [esi + 0x64], ecx
mov dword [esi + 0x54], edx
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], ebx
call dword [sym.imp.USER32.dll_LoadBitmapA]
lea ecx, [esp + 0x28]
mov dword [esi + 0x68], eax
push ecx
mov ecx, edi
call fcn.00413822
push 0x15
mov dword [esi + 0x154], esi
mov dword [esi + 0xc0], esi
mov dword [esi + 0x10c], esi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dl, byte [esp + 0x30]
or edi, 0xffffffff
push 8
mov dword [esi + 0x50], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x4c], dl
mov byte [esi + 0x160], 1
mov dword [esi + 0x48], edi
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], 1
call dword [sym.imp.USER32.dll_GetSysColor]
lea ecx, [esp + 0x28]
mov dword [esi + 0x164], eax
mov dword [esp + 0x18], edi
call fcn.004137f8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x411770
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x415137
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x418208
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call sub.MFC42.DLL_CImageList::CImageList
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x4181ec
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.00412290
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret