joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478d74
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x50cbf0]
cmp dword [eax + 0x30], 0
je 0x478e1e
cmp dword [ebx + 0x94], 0
jne 0x478e18
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x478d04
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x478e18
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x478dde
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x478e18
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d858
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x478ded
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x479980
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4799b5
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043a8
jmp 0x4799c2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040430c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x47aacc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x47ab0d
mov eax, esi
call fcn.00460cd4
test al, al
je 0x47ab0d
mov eax, dword [ebx + 0x84]
call fcn.004609d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47ab0d
push 0
mov eax, dword [ebx + 0x84]
call fcn.004609d0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4901d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4901fe
mov eax, ebx
call fcn.00490c84
cmp dword [ebx + 0x40], 0
je 0x4901f7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x49026f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x490261
cmp dword [ebx + 8], 0
je 0x490220
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x490232
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x490261
cmp dword [ebx + 8], 0
je 0x490213
cmp eax, 3
je 0x490245
dec eax
jne 0x490213
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x490213
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x490213
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x49028d
cmp dword [ebx + 0x14], 0xcc
je 0x49028d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00490298
pop ebx
ret
Function at 0x4bc624
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4bc649
cmp dword [esp + 4], 5
jb 0x4bc649
mov al, 1
jmp 0x4bc64b
xor eax, eax
add esp, 0x94
ret
Function at 0x4cd7d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cda38
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4cd83b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004cd2a0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d49c
cmp al, 1
jne 0x4cd83b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004cd5b8
test al, al
je 0x4cd9c7
cmp dword [ebp - 8], 0
jge 0x4cd859
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004cd2a0
mov eax, dword [ebp - 0x210]
call fcn.00404578
cmp ebx, eax
jge 0x4cd8a3
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004cd2a0
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x50bb5c]
and eax, 0xff
bt dword [edx], eax
jae 0x4cd8a3
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4cd8b7
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004cd7b4
cmp ebx, dword [ebp - 8]
je 0x4cd9b9
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4cd8e3
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403644
and eax, 0x7f
movzx eax, word [eax*2 + 0x50b3a0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4cd9a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403644
and eax, 0x7f
movzx eax, word [eax*2 + 0x50b3a0]
push eax
push 0x100
mov eax, dword [ebp - 4]
call fcn.004609d0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403644
and eax, 0x7f
movzx eax, word [eax*2 + 0x50b3a0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004609d0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd9ad
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4cda1a
cmp dword [ebp - 8], 0
jge 0x4cd9d2
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004cd2a0
mov eax, dword [ebp - 0x218]
call fcn.00404578
cmp eax, dword [ebp - 8]
jg 0x4cda0c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004cd2a0
mov eax, dword [ebp - 0x21c]
call fcn.00404578
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cd7b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cda3f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004042dc
ret
Function at 0x4024f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x41904c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
cmp dword [ebp + 8], 0
je 0x402519
cmp dword [ebp + 0xc], 0
jne 0x402523
jmp 0x402670
cmp dword [ebp + 0x10], 0
je 0x402578
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
add ecx, 2
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0x218]
mov ax, word [edx]
mov word [ebp - 0x21e], ax
add dword [ebp - 0x218], 2
cmp word [ebp - 0x21e], 0
jne 0x402541
mov ecx, dword [ebp - 0x218]
sub ecx, dword [ebp - 0x21c]
sar ecx, 1
mov dword [ebp - 0x224], ecx
jne 0x402582
jmp 0x402670
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00409e60
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x4025bb
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [0x41508c]
jmp 0x402603
cmp dword [0x41a070], 3
jne 0x4025f1
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [0x415020]
push 0x416db8
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00406353
add esp, 0xc
jmp 0x402603
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [0x41508c]
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00406353
add esp, 0xc
mov dword [ebp - 4], 0
push 0x416dbc
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004066a5
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x402644
jmp 0x402670
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00406998
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00406a2c
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00406344
mov esp, ebp
pop ebp
ret

Function at 0x402840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41904c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00409e60
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x40288f
cmp dword [ebp + 0xc], 0
jne 0x402893
jmp 0x402908
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [0x41508c]
push str.golfinfo.ini
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00406353
add esp, 0xc
push 0x416df8
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004066a5
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4028fe
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00406c0a
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00406a2c
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00406344
mov esp, ebp
pop ebp
ret
Function at 0x404200
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x416cdc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.004066a5
add esp, 0xc
test eax, eax
je 0x404234
xor eax, eax
jmp 0x404315
mov dword [ebp - 0x14], 0
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.004071ee
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.00407410
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.004071ee
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, dword [ebp + 0x10]
push edx
call fcn.0040700c
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00406998
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00406a2c
add esp, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
push edx
call fcn.00404320
add esp, 8
push 0x416ce4
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.004066a5
add esp, 0xc
test eax, eax
je 0x4042ce
xor eax, eax
jmp 0x404315
mov edx, dword [ebp - 0x14]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00406c0a
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00406a2c
add esp, 4
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 0
je 0x404312
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004070d6
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4061b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00410970
mov eax, dword [0x41904c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x1014], 0
push 0x416d94
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.004066a5
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x4061fa
xor eax, eax
jmp 0x406291
push 0
push 4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [0x4151e0]
cmp eax, 4
je 0x406217
xor eax, eax
jmp 0x406291
mov edx, dword [ebp - 0x1014]
cmp edx, dword [ebp - 0xc]
jae 0x406271
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [0x4151e0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x406247
jmp 0x406271
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
lea edx, [ebp - 0x1010]
push edx
call fcn.00406c0a
add esp, 0x10
mov eax, dword [ebp - 0x1014]
add eax, dword [ebp - 4]
mov dword [ebp - 0x1014], eax
jmp 0x406217
mov ecx, dword [ebp - 8]
push ecx
call fcn.00406a2c
add esp, 4
mov edx, dword [ebp - 0x1014]
cmp edx, dword [ebp - 0xc]
jae 0x40628c
xor eax, eax
jmp 0x406291
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406344
mov esp, ebp
pop ebp
ret

Function at 0x10001d44
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x6b441184
stc
and al, 0x8b
xor edi, dword [ecx + esi + 0x192d528b]
push edx
sub eax, 0xbd698b19
and al, 0xb1
mov dh, 0x19
and eax, 0x691f699b
stosd dword es:[edi], eax
push 9
and al, 0xb1
stosb byte es:[edi], al
sbb dword [0x6d1f699b], esp
stosd dword es:[edi], eax
push 9
and al, 0xb1
invalid
inc ebp
sub dword [ecx + edi*2 - 0x53457cf4], edx
ret 0x86b0
push eax
dec esi
clc
sti
sbb bh, byte [ebx + 0x46b2e28d]
das
je 0x10001ce7
jge 0x10001d70
pop esi
jb 0x10001d75
mov ch, 0xb
clc
push eax
sbb dh, byte [edi + 0x311388a2]
dec ecx
wait
mov byte [ebx], dl
xor dword [ecx - 0x65], ecx
add al, 0x1a
xchg esp, eax
jecxz 0x10001d4e
sub dh, cl
arpl dx, bp
sub eax, 0x4c6df38a
jne 0x10001d01
insd dword es:[edi], dx
mov gs, word [edx]
dec eax
dec ebx
lahf
cmp edx, dword [ebx + 0x43fcf31]
cmpsb byte [esi], byte es:[edi]
pop ebp
punpckldq mm4, dword [eax - 0xa]
add esi, 0xffffff79
jmp 0x10001da1
cmp dword [esi], 0
jmp 0x10001daf
je 0x10001eed
clc
jmp 0x10001de5
mov ecx, esi
jae 0x10001e09
fcomp st(2)
or dword [ecx + eax*8 - 0x69], ecx
mov dword [0x6c34bb45], eax
dec ebx
invalid
add esi, 4
jmp 0x10001e36
mov eax, dword [esi]
jmp 0x10001e57
mov ebx, 0xf8c603c0
add eax, esi
clc
jmp 0x10001e8a
mov edx, dword [esi + 4]
jmp 0x10001ea0
sub dword [eax], 0x8b24f96a
jmp 0x10001eaf
add eax, 4
jmp 0x10001eb9
sub edx, 1
stc
jb 0x10001ec0
in eax, dx
jne 0x10001e8d
jb 0x10001eca
push es
cmp byte [ebx + 0x2eb08c6], al
lodsd eax, dword [esi]
jle 0x10001e55
add esi, 8
jmp 0x10001ed1
sub dword [ecx], 1
sub dword [ecx], eax
clc
jmp 0x10001ed8
jne 0x10001e0c
jmp 0x10001ee2
mov ebx, esi
jmp 0x10001ee8
call fcn.10001efb
jmp 0x10001ef1
popal
clc
jmp 0x10001ef6
jmp 0x10001bbc
Function at 0x401390
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x4013a7
pop edi
pop ebx
ret
push esi
push edi
call fcn.00403597
push edi
mov esi, eax
push 0
push esi
call fcn.004054f0
add esp, 0x10
push edi
push esi
call ebx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013c5
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
mov eax, esi
je 0x4013e4
push 0x41287c
call fcn.00401290
add esp, 4
pop esi
pop edi
pop ebx
ret

Function at 0x4013f0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x401407
pop edi
pop ebx
ret
push esi
push edi
call fcn.00403597
push edi
mov esi, eax
push 0
push esi
call fcn.004054f0
add esp, 0x10
push edi
push esi
call ebx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401425
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
mov eax, esi
je 0x401444
push 0x41287c
call fcn.00401290
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x4014c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
mov edx, str.temp
mov ecx, esi
lea ecx, [ecx]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4014f0
test al, al
je 0x4014ec
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4014f0
add ecx, 2
add edx, 2
test al, al
jne 0x4014d0
xor eax, eax
jmp 0x4014f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401559
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
push eax
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x401514
pop edi
pop ebx
pop esi
pop ebp
jmp fcn.00401290
push edi
call fcn.00403597
push edi
mov esi, eax
push 0
push esi
call fcn.004054f0
add esp, 0x10
push esi
push edi
call ebx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401531
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
mov eax, esi
je 0x401550
push 0x41287c
call fcn.00401290
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
jmp fcn.00401290
mov edx, str.current
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x401580
test al, al
je 0x40157c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x401580
add ecx, 2
add edx, 2
test al, al
jne 0x401560
xor eax, eax
jmp 0x401585
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4015b9
call fcn.00401450
mov esi, eax
push 0x5c
push esi
call fcn.004036e0
add esp, 8
test eax, eax
jne 0x4015a6
pop esi
pop ebp
jmp fcn.00401290
sub eax, esi
inc eax
push esi
call fcn.00401320
add esp, 4
pop esi
pop ebp
jmp fcn.00401290
mov edx, str.system
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4015e0
test al, al
je 0x4015dc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4015e0
add ecx, 2
add edx, 2
test al, al
jne 0x4015c0
xor eax, eax
jmp 0x4015e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4015fd
mov eax, dword [ebp + 8]
push eax
call fcn.00401390
call fcn.00401290
add esp, 4
pop esi
pop ebp
ret
mov edx, str.windows
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x401624
test al, al
je 0x401620
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x401624
add ecx, 2
add edx, 2
test al, al
jne 0x401604
xor eax, eax
jmp 0x401629
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401641
mov ecx, dword [ebp + 8]
push ecx
call fcn.004013f0
call fcn.00401290
add esp, 4
pop esi
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov eax, esi
call fcn.00401290
add esp, 4
pop esi
pop ebp
ret
Function at 0x401660
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x4144b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov dword [ebp - 0x13c], eax
call edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x140], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x124
lea ecx, [ebp - 0x130]
push 0
push ecx
mov dword [ebp - 0x138], 0
call fcn.004054f0
add esp, 0xc
lea edx, [ebp - 0x134]
push edx
push esi
mov dword [ebp - 0x134], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00403710
add esp, 8
test eax, eax
je 0x401739
push 1
call edi
mov edx, dword [ebp - 0x12c]
push edx
push 0
push 1
call ebx
mov esi, eax
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 1
call edi
mov ecx, dword [ebp - 0x138]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x401739
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x134]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4016df
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004031ae
mov esp, ebp
pop ebp
ret 4
Function at 0x401d60
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4144b0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x28]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401df4
push 0x2253
lea ecx, [ebp - 0x24]
push 0x412940
push ecx
mov byte [ebp - 0x24], al
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x28]
add esp, 0xc
lea edx, [ebp - 0x24]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004031ae
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004031ae
mov esp, ebp
pop ebp
ret
Function at 0x4031ae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4144b0]
jne 0x4031b8
repz ret
jmp fcn.00406a44

Function at 0x40cb0c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4144b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407567
and dword [ebp - 0x14], 0
cmp dword [0x4166c8], 0
mov dword [ebp - 0x18], eax
jne 0x40cbbf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40cc67
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40cc67
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4166c8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4166cc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4166d0], eax
call edi
push eax
call esi
mov dword [0x4166d8], eax
test eax, eax
je 0x40cbbf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4166d4], eax
mov eax, dword [0x4166d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40cc18
cmp dword [0x4166d8], ecx
je 0x40cc18
push eax
call esi
push dword [0x4166d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40cc18
test ebx, ebx
je 0x40cc18
call edi
test eax, eax
je 0x40cc0f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40cc0f
test byte [ebp - 8], 1
jne 0x40cc18
or dword [ebp + 0x10], 0x200000
jmp 0x40cc4b
mov eax, dword [0x4166cc]
cmp eax, dword [ebp - 0x18]
je 0x40cc4b
push eax
call esi
test eax, eax
je 0x40cc4b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40cc4b
mov eax, dword [0x4166d0]
cmp eax, dword [ebp - 0x18]
je 0x40cc4b
push eax
call esi
test eax, eax
je 0x40cc4b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4166c8]
call esi
test eax, eax
je 0x40cc67
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40cc69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004031ae
leave
ret