joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba02
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x44f678], 0
push esi
jne 0x41b975
call fcn.0041b89b
test eax, eax
je 0x41b9b8
mov eax, dword [0x44f678]
cmp eax, 1
jne 0x41b996
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41b9b8
pop esi
ret
push eax
call dword [0x44f680]
test eax, eax
jne 0x41ba00
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41b9bc
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x44f678]
call dword [0x44f680]
mov edi, eax
test edi, edi
je 0x41b9e1
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41b9fd
mov edi, esi
add esi, 0xff0
push edi
push dword [0x44f678]
call dword [0x44f67c]
add edi, 0x10
cmp edi, esi
jb 0x41b9e9
mov eax, edi
pop edi
pop esi
ret
jmp 0x41b962

Function at 0x41be5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d1a4]
jne 0x41be66
repz ret
jmp fcn.00421077

Function at 0x41d365
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41d396
call fcn.0041bf8e
mov dword [eax], esi
call fcn.0041bf7b
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041c836
add esp, 0x14
push 0x16
pop eax
jmp 0x41d3eb
test dword [ebp + 0xc], 0xfffffff9
jne 0x41d372
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41d3c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041bfa1
pop ecx
call fcn.0041bf7b
mov eax, dword [eax]
jmp 0x41d3eb
test al, 0x10
jne 0x41d3e9
test al, 1
je 0x41d3e9
test byte [ebp + 0xc], 2
je 0x41d3e9
call fcn.0041bf8e
mov dword [eax], 5
call fcn.0041bf7b
mov dword [eax], 0xd
jmp 0x41d3ba
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42d861
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004212ea
and dword [ebp - 4], 0
cmp dword [0x4502b4], 0
mov ebx, eax
jne 0x42d912
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42d9c3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42d9c3
push eax
call fcn.00421278
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4502b4], eax
call esi
push eax
call fcn.00421278
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4502b8], eax
call esi
push eax
call fcn.00421278
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4502bc], eax
call esi
push eax
call fcn.00421278
pop ecx
mov dword [0x4502c4], eax
test eax, eax
je 0x42d912
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00421278
pop ecx
mov dword [0x4502c0], eax
mov eax, dword [0x4502c0]
cmp eax, ebx
je 0x42d96a
cmp dword [0x4502c4], ebx
je 0x42d96a
push eax
call fcn.004212f3
push dword [0x4502c4]
mov esi, eax
call fcn.004212f3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42d96a
test edi, edi
je 0x42d96a
call esi
test eax, eax
je 0x42d961
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42d961
test byte [ebp - 0xc], 1
jne 0x42d96a
or dword [ebp + 0x10], 0x200000
jmp 0x42d9a3
mov eax, dword [0x4502b8]
cmp eax, ebx
je 0x42d9a3
push eax
call fcn.004212f3
pop ecx
test eax, eax
je 0x42d9a3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42d9a3
mov eax, dword [0x4502bc]
cmp eax, ebx
je 0x42d9a3
push eax
call fcn.004212f3
pop ecx
test eax, eax
je 0x42d9a3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4502b4]
call fcn.004212f3
pop ecx
test eax, eax
je 0x42d9c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42d9c5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42f650
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x44d1a4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.0041c880
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0041c880
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.uninst1.exe
lea eax, [ebp - 0x418]
push eax
call fcn.0041da33
add esp, 8
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x42f722
push 0
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x42f722
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x418]
push edx
push 0x4436f8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041be5c
mov esp, ebp
pop ebp
ret
Function at 0x4313d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x100]
mov byte [ebp - 2], cl
mov edx, dword [ebp + 0x10]
mov al, byte [edx + 0x101]
mov byte [ebp - 1], al
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
xor edx, edx
mov word [ebp - 8], dx
jmp 0x431409
mov ax, word [ebp - 8]
add ax, 1
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jge 0x4314d4
movzx edx, byte [ebp - 2]
add edx, 1
and edx, 0x800000ff
jns 0x43142d
dec edx
or edx, 0xffffff00
inc edx
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + eax]
movzx eax, byte [ebp - 1]
add edx, eax
and edx, 0x800000ff
jns 0x431451
dec edx
or edx, 0xffffff00
inc edx
mov byte [ebp - 1], dl
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 9], al
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov cl, byte [esi + ecx]
mov byte [eax + edx], cl
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp - 9]
mov byte [eax + edx], cl
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x10]
movzx edx, byte [eax + edx]
add ecx, edx
and ecx, 0x800000ff
jns 0x4314aa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 0xa], cl
movsx eax, word [ebp - 8]
movzx ecx, byte [ebp - 0xa]
mov edx, dword [ebp - 0x10]
movzx ecx, byte [edx + ecx]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
xor eax, ecx
movsx ecx, word [ebp - 8]
mov edx, dword [ebp + 8]
mov byte [edx + ecx], al
jmp 0x4313fd
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 2]
mov byte [eax + 0x100], cl
mov edx, dword [ebp + 0x10]
mov al, byte [ebp - 1]
mov byte [edx + 0x101], al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4315f0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e38b
mov eax, dword fs:[0]
push eax
sub esp, 0x3c8
mov eax, dword [0x44d1a4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3d4], 0
lea ecx, [ebp - 0x10]
call fcn.00414c10
mov dword [ebp - 4], 1
push 1
push 0x23
push 0x105
lea ecx, [ebp - 0x10]
call fcn.00414ba0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004158d0
lea ecx, [ebp - 0x10]
call fcn.00414c80
mov dword [ebp - 0x130], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
push 0x105
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00414c60
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x128], eax
lea ecx, [ebp - 0x14]
call fcn.004157e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x12c]
call fcn.004157e0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x130]
push edx
push str._.8x
lea eax, [ebp - 0x14]
push eax
call fcn.00414da0
add esp, 0xc
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041ddf0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00431500
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.00414bf0
movzx ecx, al
test ecx, ecx
jne 0x4317c8
lea ecx, [ebp - 0x14]
call fcn.00414bd0
push eax
lea ecx, [ebp - 0x3cc]
call fcn.00414cc0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14]
call fcn.00414bd0
push eax
lea ecx, [ebp - 0x14]
call fcn.00411e50
push eax
lea ecx, [ebp - 0x3cc]
call fcn.00411e50
push eax
call fcn.0041da80
add esp, 0xc
lea edx, [ebp - 0x124]
push edx
lea ecx, [ebp - 0x14]
call fcn.00414bd0
push eax
lea ecx, [ebp - 0x3cc]
call fcn.00411e50
push eax
call fcn.004313d0
add esp, 0xc
mov dword [ebp - 0x3d0], 0
jmp 0x43177d
mov eax, dword [ebp - 0x3d0]
add eax, 1
mov dword [ebp - 0x3d0], eax
lea ecx, [ebp - 0x14]
call fcn.00414bd0
cmp dword [ebp - 0x3d0], eax
jge 0x4317b9
lea ecx, [ebp - 0x3cc]
call fcn.00411e50
mov ecx, dword [ebp - 0x3d0]
movzx edx, byte [eax + ecx]
push edx
push 0x4439d0
lea eax, [ebp - 0x12c]
push eax
call fcn.00414dd0
add esp, 0xc
jmp 0x43176e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3cc]
call fcn.00414cf0
lea ecx, [ebp - 0x12c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00415650
mov edx, dword [ebp - 0x3d4]
or edx, 1
mov dword [ebp - 0x3d4], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x12c]
call fcn.004156b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004156b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00414b50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0041be5c
mov esp, ebp
pop ebp
ret
Function at 0x431860
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x54]
test ecx, ecx
jne 0x431884
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x50
call fcn.00406ad0
movzx eax, al
test eax, eax
jne 0x43188f
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x54], 0
xor eax, eax
jmp 0x4318ba
cmp dword [ebp + 0x24], 0
je 0x43189e
or edx, 0xffffffff
mov eax, dword [ebp + 0x24]
mov word [eax], dx
push 1
push 0
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 8]
push edx
push 0x443ec4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop ebp
ret 0x20
Function at 0x4329b0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f06c
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x44d1a4]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
push 0x444028
mov ecx, 0x450330
call fcn.00406680
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, dword [ebp - 0x74]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x74]
mov eax, dword [edx + 0x24]
push eax
push 1
push 0x80
mov ecx, dword [ebp - 0x74]
add ecx, 4
call fcn.00406650
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx + 0x24]
push edx
push 0
push 0x80
mov ecx, dword [ebp - 0x74]
add ecx, 4
call fcn.00406650
lea ecx, [ebp - 0x1c]
call fcn.00406610
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x74]
add ecx, 4
call fcn.00406060
lea ecx, [ebp - 0x45]
call fcn.0040a340
push eax
push 0x444048
lea ecx, [ebp - 0x40]
call fcn.004026a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x74]
add ecx, 0x4c
call fcn.00401f80
movzx ecx, al
test ecx, ecx
jne 0x432ac3
mov edx, dword [ebp - 0x74]
add edx, 0x48
je 0x432a82
mov eax, dword [ebp - 0x74]
add eax, 0x4c
mov dword [ebp - 0x78], eax
jmp 0x432a89
mov dword [ebp - 0x78], 0
mov ecx, dword [ebp - 0x78]
push ecx
push 0x444060
lea edx, [ebp - 0x64]
push edx
call fcn.00401c70
add esp, 0xc
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.004010a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00403140
lea ecx, [ebp - 0x3c]
call fcn.004031f0
push eax
mov ecx, dword [ebp - 0x74]
add ecx, 4
call fcn.004065f0
push 0x58
call fcn.0041bfdf
add esp, 4
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x6c], 0
je 0x432b09
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x6c]
call fcn.00432580
mov dword [ebp - 0x84], eax
jmp 0x432b13
mov dword [ebp - 0x84], 0
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x68], edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], eax
push 0x1388
mov ecx, dword [ebp - 0x74]
add ecx, 0x28
push ecx
mov ecx, dword [ebp - 0x44]
call fcn.00431bf0
mov ecx, dword [ebp - 0x74]
call fcn.00432840
mov dword [ebp - 0x70], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00402ed0
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0041be5c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x438fa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x438fd5
mov eax, 8
jmp 0x43904e
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.0041be46
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43901c
mov eax, 1
jmp 0x43904e
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00438ef0
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0041c86c
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x439150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x44d1a4]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x44e404], 0xffffffff
jne 0x4391af
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0041c880
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
mov dword [ebp - 4], eax
xor eax, eax
cmp eax, dword [ebp - 4]
sbb ecx, ecx
neg ecx
mov dword [0x44e404], ecx
xor eax, eax
cmp dword [0x44e404], 1
sete al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041be5c
mov esp, ebp
pop ebp
ret
Function at 0x4392c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x60], 0
push 0x40
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.0041c880
add esp, 0xc
mov dword [ebp - 0x10], 0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x60]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
push 0xc000000
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43937d
cmp dword [ebp + 0xc], 0
je 0x439367
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x64], eax
cmp dword [ebp + 0x18], 0
je 0x439353
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
cmp dword [ebp + 0x10], 0
je 0x439367
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43938e
cmp dword [ebp + 0x1c], 0
je 0x43938e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x4394a0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
je 0x4394d0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
jmp 0x4394f6
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4394f6
cmp dword [ebp + 0xc], 0
je 0x4394f6
mov ecx, dword [ebp + 8]
push ecx
call fcn.004393a0
add esp, 4
jmp 0x439586
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 8]
je 0x439504
cmp dword [ebp + 8], 0
jne 0x43950b
mov eax, 1
jmp 0x439586
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x10], eax
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 4]
je 0x439544
cmp dword [ebp - 4], 0
je 0x439544
push 1
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0xc], eax
push 0
call fcn.004392a0
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
je 0x439583
cmp dword [ebp - 4], 0
je 0x439583
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x439590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e9bc
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x44d1a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4395cf
mov ecx, dword [ebp + 8]
or ecx, 0x8000
mov dword [ebp + 8], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.0041c880
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x439680
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43962b
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
jmp 0x439638
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea ecx, [ebp - 0x241]
call fcn.0040a340
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x240]
call fcn.004026a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x240]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00402ed0
jmp 0x43968f
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp + 0xc]
add ecx, 4
call fcn.00402840
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041be5c
mov esp, ebp
pop ebp
ret
Function at 0x4396b0
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e9fa
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x44d1a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ax, word [0x4442e8]
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.0041c880
add esp, 0xc
lea ecx, [ebp - 0x245]
call fcn.0040a340
push eax
push 0x4442ec
lea ecx, [ebp - 0x244]
call fcn.004026a0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x244]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00402760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.00402ed0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43981e
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x224]
push ecx
push 4
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4397af
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
jmp 0x4397d6
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x4397d6
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x439837
lea ecx, [ebp - 0x269]
call fcn.0040a340
push eax
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x268]
call fcn.004026a0
mov dword [ebp - 4], 1
lea edx, [ebp - 0x268]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00402760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.00402ed0
jmp 0x439822
xor eax, eax
jmp 0x439837
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
add ecx, 4
call fcn.00403590
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041be5c
mov esp, ebp
pop ebp
ret