joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4059d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
push 0x10
lea eax, [esp + 0x18]
push 0x405bd0
push eax
mov dword [esp + 0x20], esi
call sub.USER32.dll_DdeInitializeA
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x405bc3
mov ecx, dword [esp + 0x10]
push 0x3ec
push str.ACDSee_32
push ecx
call sub.USER32.dll_DdeCreateStringHandleA
mov edx, dword [esp + 0x10]
push 0x3ec
mov edi, eax
push str.System
push edx
mov dword [esp + 0x24], edi
call sub.USER32.dll_DdeCreateStringHandleA
mov ebp, eax
mov eax, dword [esp + 0x10]
push esi
push ebp
push edi
push eax
mov dword [esp + 0x2c], ebp
call sub.USER32.dll_DdeConnect
mov ebx, eax
cmp ebx, esi
jne 0x405aa8
mov ecx, dword [esp + 0x10]
push ecx
call sub.USER32.dll_DdeGetLastError
cmp eax, 0x400a
jne 0x405aa8
mov edx, dword [esp + 0x74]
push 0xa
push 0x4caf4c
push 0x4be07c
push edx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x405bc3
test ebx, ebx
jne 0x405ab0
mov eax, dword [esp + 0x10]
push ebx
push ebp
push edi
push eax
call sub.USER32.dll_DdeConnect
mov ebx, eax
test ebx, ebx
jne 0x405a9a
mov ecx, dword [esp + 0x10]
push ecx
call sub.USER32.dll_DdeGetLastError
mov dword [esp + 0x14], eax
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x14
jl 0x405a75
test ebx, ebx
je 0x405b9f
mov al, byte [0x4be218]
mov edx, dword [str.open]
mov byte [esp + 0x24], al
mov ecx, 0x12
xor eax, eax
lea edi, [esp + 0x25]
mov dword [esp + 0x20], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x7c]
cmp eax, 0xffffffff
je 0x405af6
test eax, eax
mov eax, str._add
jne 0x405aea
mov eax, str._noadd
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x80]
cmp eax, 0xffffffff
je 0x405b1c
test eax, eax
mov eax, str._viewall
jne 0x405b10
mov eax, str._noviewall
lea edx, [esp + 0x20]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebp, dword [esp + 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
call edi
mov esi, eax
lea eax, [esp + 0x20]
push eax
call edi
lea ecx, [esi + eax + 5]
push ecx
call fcn.004985f0
add esp, 4
lea edx, [esp + 0x20]
mov esi, eax
push edx
push 0x4be20c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call ebp
push 0x4be208
push esi
call ebp
push 0
push 0xffffffffffffffff
push 0x4050
push 0
push 0
push ebx
push esi
call edi
inc eax
push eax
push esi
call sub.USER32.dll_DdeClientTransaction
mov eax, dword [esp + 0x10]
push eax
call sub.USER32.dll_DdeGetLastError
push esi
mov dword [esp + 0x18], eax
call fcn.00498600
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
add esp, 4
mov ecx, dword [esp + 0x10]
push edi
push ecx
call sub.USER32.dll_DdeFreeStringHandle
mov edx, dword [esp + 0x10]
push ebp
push edx
call sub.USER32.dll_DdeFreeStringHandle
mov eax, dword [esp + 0x10]
push eax
call sub.USER32.dll_DdeUninitialize
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x4065c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
push esi
push edi
push 0x17c
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov edi, eax
push 0x50
push 0x141
push edi
call ebx
push 0x1000
call fcn.004985f0
mov edx, dword [str.SoftwareACD_SystemsACDSee32]
add esp, 4
lea ecx, [esp + 0xc]
mov esi, eax
push ecx
push 0x20019
push 0
push edx
push DrawStatusTextA
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push esi
push ecx
push 0
push str.HistRenameTemplates
push edx
mov dword [esp + 0x34], 0xfff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406676
mov eax, dword [esp + 0x1c]
mov byte [eax + esi - 1], 0
mov al, byte [esi]
test al, al
je 0x406676
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push 0
push 0x143
push edi
call ebx
push esi
call ebp
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x40665a
mov esi, dword [esp + 0x14]
pop ebp
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00498600
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4066a0
Capabilities:
Get graphical window text
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x118
push ebx
push ebp
push esi
push edi
push 0x17c
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov edi, eax
push 0
push 0x147
push edi
call ebx
test eax, eax
jle 0x4066e2
lea ecx, [esp + 0x24]
push ecx
push eax
push 0x148
push edi
call ebx
jmp 0x4066f3
lea edx, [esp + 0x24]
push 0x104
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 0x24]
test al, al
je 0x40682d
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push 0x158
push edi
call ebx
test eax, eax
jl 0x40671d
push 0
push eax
push 0x144
push edi
call ebx
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x14a
push edi
call ebx
push 0
push 0
push 0x146
push edi
call ebx
cmp eax, 0x14
jle 0x406749
push 0
push 0x14
push 0x144
push edi
call ebx
push 0
push 0
push 0x14e
push edi
call ebx
push 0
push 0
push 0x146
push edi
mov dword [esp + 0x20], 1
call ebx
mov ebp, eax
xor esi, esi
test ebp, ebp
mov dword [esp + 0x18], ebp
jle 0x406791
push 0
push esi
push 0x149
push edi
call ebx
mov edx, dword [esp + 0x10]
inc esi
cmp esi, ebp
lea eax, [edx + eax + 1]
mov dword [esp + 0x10], eax
jl 0x406775
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004985f0
mov dword [esp + 0x20], eax
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
xor ebp, ebp
test eax, eax
jle 0x4067cc
push esi
push ebp
push 0x148
push edi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jl 0x4067ae
lea edx, [esp + 0x20]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x20006
mov byte [esi], 0
mov ecx, dword [str.SoftwareACD_SystemsACDSee32]
push 0
push 0x4caf4c
push 0
push ecx
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push edx
push esi
push 3
push 0
push str.HistRenameTemplates
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00498600
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x407170
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x13c
mov ecx, dword [esp + 0x144]
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
xor edi, edi
push eax
push ecx
mov dword [esp + 0x1c], edi
call fcn.00431160
add esp, 8
cmp eax, edi
mov dword [esp + 0x1c], eax
je 0x4072db
push eax
call fcn.00431390
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4072db
mov ebp, dword [esp + 0x150]
mov edx, dword [ebx]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push 0x4aa970
push ecx
push 1
push ebp
push ebx
call dword [edx + 0x28]
mov esi, eax
cmp esi, edi
jl 0x4072a9
call dword [sym.imp.USER32.dll_CreatePopupMenu]
cmp eax, edi
mov dword [esp + 0x18], eax
je 0x40729f
mov ecx, dword [esp + 0x10]
push 4
push 0x7fff
push 1
mov edx, dword [ecx]
push edi
push eax
push ecx
call dword [edx + 0xc]
mov esi, eax
cmp esi, edi
jl 0x407294
mov eax, dword [esp + 0x15c]
mov ecx, dword [esp + 0x158]
mov edx, dword [esp + 0x18]
push edi
push ebp
push edi
push eax
push ecx
push 0x102
push edx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
cmp eax, edi
je 0x407294
dec eax
mov dword [esp + 0x20], 0x24
and eax, 0xffff
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x44]
push eax
push 0x105
mov dword [esp + 0x30], ebp
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov esi, eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00431110
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call fcn.00431110
add esp, 4
xor eax, eax
cmp esi, edi
setge al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x13c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x13c
ret
Function at 0x407370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x224
mov dl, byte [0x4caf4c]
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x7d
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], dl
rep stosd dword es:[edi], eax
mov ecx, dword [str.SoftwareACD_SystemsACDSee32]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push ecx
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407420
lea edx, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.RegName
push edx
mov dword [esp + 0x20], 0x1f
call esi
lea eax, [esp + 8]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push str.RegCode
push eax
mov dword [esp + 0x20], 0x1f5
call esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
lea edx, [esp + 0x30]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.004072f0
add esp, 8
pop edi
add esp, 0x224
ret
Function at 0x408b10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4caf6c]
sub esp, 0xf0
test eax, eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
jne 0x408b34
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf0
ret 4
mov eax, dword [esp + 0x104]
test eax, eax
jne 0x408b4e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf0
ret 4
mov ecx, esi
call fcn.0041a530
mov ecx, dword [esi + 0x90]
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x20]
push 0x50
push eax
push 0x9d
push ecx
call ebx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x90]
lea edx, [esp + 0x20]
push 0x1f4
push edx
push eax
push ecx
call fcn.0043ff40
add esp, 0x10
mov edi, eax
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x90]
lea edx, [esp + 0x20]
push 0x50
push edx
push 0x9e
push eax
call ebx
lea ecx, [esp + 0x20]
push ecx
push 0x71
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esp + 0x104]
lea edx, [esp + 0x70]
push 0
push edx
mov cx, word [eax + 0x58]
push 0
lea ebp, [esi + 0x6f4]
push 0
push ecx
push ebp
call dword [0x4caf64]
test ax, ax
je 0x408c1f
mov ecx, dword [esi + 0x90]
movsx edx, ax
mov eax, dword [esi + 4]
push edx
push eax
push ecx
call fcn.00407e60
add esp, 0xc
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, esi
call fcn.0041a5b0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf0
ret 4
mov eax, dword [esp + 0x84]
push eax
mov dword [esp + 0x18], eax
call fcn.004985f0
add esp, 4
lea edx, [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x90]
push 0x50
push edx
push 0xa1
push eax
mov dword [esp + 0x28], 0x408d50
mov dword [esp + 0x2c], edi
call ebx
lea ecx, [esp + 0x20]
push ecx
push 0x71
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x74]
push eax
push ecx
push ebp
call dword [0x4caf68]
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_DestroyWindow]
test bx, bx
je 0x408cbe
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x90]
movsx edx, bx
push edx
push eax
push ecx
call fcn.00407e60
add esp, 0xc
mov ecx, esi
call fcn.0041a5b0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf0
ret 4
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0xac]
mov edi, 1
call fcn.00443ed0
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0xa0]
mov edx, dword [esi + 0x90]
push ecx
mov ecx, dword [eax + 0x6bc]
push edx
push 0
lea edx, [esp + 0xb0]
push ecx
push edx
call fcn.00405150
add esp, 0x14
test eax, eax
jne 0x408d27
mov ecx, dword [esi + 0x90]
push eax
mov eax, dword [esi + 4]
push 0x203
push 0x202
push eax
push ecx
call fcn.0043cea0
add esp, 0x14
xor edi, edi
mov ecx, esi
call fcn.0041a5b0
lea ecx, [esp + 0xa4]
call fcn.00443ff0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf0
ret 4
Function at 0x4094f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x4caf6c]
sub esp, 0x60
test eax, eax
push ebx
push ebp
push esi
push edi
jne 0x40950b
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov esi, dword [esp + 0x84]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebx, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f02
push 0
call ebx
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebp
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
lea eax, [esp + 0x3c]
push 0
push eax
push 0
push 0
push ecx
push edx
call dword [0x4caf64]
push 0x7f00
push 0
mov edi, eax
call ebx
push eax
call ebp
test di, di
je 0x40957f
mov ecx, dword [esp + 0x80]
movsx eax, di
push eax
push esi
push ecx
call fcn.00407e60
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov eax, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x50]
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], edx
mov dword [esp + 0x18], eax
call fcn.004985f0
add esp, 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x10], eax
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x40]
push eax
push ecx
push edx
mov dword [esp + 0x28], 0x4096e0
call dword [0x4caf68]
test ax, ax
je 0x409610
cmp ax, 0xfc14
je 0x4095f8
mov ecx, dword [esp + 0x80]
movsx eax, ax
push eax
push esi
push ecx
call fcn.00407e60
add esp, 0xc
mov edx, dword [esp + 0x10]
push edx
call fcn.00498600
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov eax, dword [esp + 0x7c]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40965d
push str.CreateFile__
push esi
call fcn.0043cf40
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
call fcn.00498600
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x84]
push 0
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call fcn.00498600
add esp, 4
test esi, esi
je 0x4096c0
lea eax, [esp + 0x28]
lea ecx, [esp + 0x5c]
push eax
push ecx
call fcn.00408aa0
add esp, 8
lea edx, [esp + 0x20]
lea eax, [esp + 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x20]
push ecx
push 0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60
ret
Function at 0x40d7f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x4ca950
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40d878
mov eax, dword [0x4ca94c]
test eax, eax
je 0x40d878
push esi
push 0x4ca950
call fcn.00498c50
add esp, 8
cmp eax, 0xffffffff
jne 0x40d864
push 0x5c
push 0x4ca950
call fcn.004989e0
add esp, 8
test eax, eax
je 0x40d85d
push 0
push 0x4ca950
mov byte [eax], 0
call fcn.00498c50
add esp, 8
cmp eax, 0xffffffff
je 0x40d831
jmp 0x40d864
mov byte [0x4ca950], 0
push 0
push 0
push 1
push 0x4ca950
mov ecx, edi
call fcn.00413120
mov esi, eax
test esi, esi
jne 0x40d89e
lea ecx, [esp + 8]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push esi
lea edx, [esp + 0x10]
push 1
push edx
mov ecx, edi
call fcn.00413120
mov esi, eax
mov eax, esi
pop edi
pop esi
add esp, 0x108
ret

Function at 0x40d8b0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.0041a7a0
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x40d8d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x1c]
jne 0x40d919
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418d40
test eax, eax
je 0x40d9fe
mov eax, dword [eax + 8]
mov ecx, dword [esi + 4]
push 5
push 0
push 0
push eax
push 0
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov edx, dword [esi + 8]
push 0
push 0
push 0x1032
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
cmp edi, 1
jl 0x40d9fe
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebx
cmp edi, 1
mov ebp, eax
mov ecx, esi
jg 0x40d9f6
call fcn.00413740
mov ecx, eax
test ecx, ecx
je 0x40d9fe
mov eax, dword [ecx + 8]
test eax, eax
mov eax, dword [ecx + 4]
je 0x40d9c0
cmp eax, 2
jne 0x40d98d
mov ecx, esi
call fcn.0040e710
push ebp
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
lea eax, [esp + 0x10]
push 1
lea edx, [esi + 0xa4]
push eax
push edx
call fcn.0041dd10
push 0
push 0
lea eax, [esp + 0x18]
push 1
push eax
mov ecx, esi
call fcn.00413120
push ebp
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
test eax, eax
jne 0x40d9fb
mov eax, dword [esi + 0x6e8]
test eax, eax
jne 0x40d9f4
mov eax, dword [ecx + 0x30]
test eax, eax
jge 0x40d9f4
call fcn.0041dce0
test eax, eax
jne 0x40d9f4
push eax
mov ecx, esi
call fcn.0040e540
push ebp
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov ecx, esi
call fcn.0040da10
push ebp
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40e230
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, dword [esp + 0x18]
mov dword [esi + 0x34], eax
cmp edi, 0x4eb1
jne 0x40e275
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test al, 0x80
je 0x40e262
mov edi, 0x4ef0
jmp 0x40e275
push 0x10
call edi
and al, 0x80
neg al
sbb eax, eax
neg eax
add eax, 0x4eed
mov edi, eax
cmp edi, 0x4ef0
jne 0x40e28f
push 0
push 0x3ff00000
push 0
push 0
push 0
jmp 0x40e31e
mov ecx, esi
call fcn.00413740
mov ebx, eax
test ebx, ebx
je 0x40e341
mov eax, dword [ebx + 0x30]
test eax, eax
jl 0x40e341
xor eax, eax
cmp edi, 0x4eee
sete al
mov edi, eax
call fcn.0043c1c0
cmp eax, 8
jne 0x40e2de
mov ecx, dword [esi + 0xa0]
push 0
push 1
push 1
push 0
call fcn.00449910
push 0
mov ecx, esi
call fcn.004151a0
mov eax, dword [0x4caec8]
test eax, eax
je 0x40e2fd
mov ecx, dword [0x4caed0]
mov edx, dword [0x4caed4]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
jmp 0x40e30d
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x3ff00000
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [ebx + 0x5c]
push 0
push eax
push ecx
push edi
push edx
mov eax, dword [str.ACDSee_32]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x90]
push eax
push ecx
push edx
call fcn.0043fff0
mov eax, dword [esi + 0x34]
add esp, 0x20
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
add esp, 8
ret 4

Function at 0x40e600
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x210
push esi
mov esi, ecx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x40e625
mov ecx, esi
call fcn.0040e700
pop esi
add esp, 0x210
ret
push edi
push ebp
push ebx
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebx
mov ebp, eax
mov eax, dword [0x4cab50]
test eax, eax
je 0x40e680
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xb
push eax
call edi
push 0
push 0
mov ecx, esi
call fcn.00418280
lea ecx, [esi + 0xa4]
push ecx
mov ecx, esi
call fcn.00417990
mov edx, dword [esi + 0xc]
push 0
push 1
push 0xb
push edx
call edi
mov eax, dword [0x4cab58]
test eax, eax
je 0x40e690
mov ecx, esi
call fcn.00418850
lea eax, [esi + 0x1a4]
lea ecx, [esi + 0xa4]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.0043c6e0
add esp, 0xc
mov ecx, esi
call fcn.00413740
test eax, eax
je 0x40e6db
mov eax, dword [eax + 0x5c]
lea ecx, [esp + 0x118]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x118]
lea eax, [esp + 0x10]
push edx
push 0
push 0
push eax
jmp 0x40e6e6
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
mov ecx, esi
call fcn.00413120
push ebp
call ebx
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x210
ret
Function at 0x40e7a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x4caa64]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
mov esi, ecx
je 0x40e7c5
push 0x11
call edi
test ah, 0x80
jne 0x40e7c5
mov ebx, 1
jmp 0x40e7c7
xor ebx, ebx
mov eax, dword [0x4caa68]
test eax, eax
jne 0x40e7e0
push 0x10
call edi
test ah, 0x80
jne 0x40e7e0
mov edi, 1
jmp 0x40e7e2
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
mov eax, dword [esi + 8]
cmp ebp, eax
jne 0x40e806
push edi
push ebx
mov ecx, esi
call fcn.0040e840
push ebp
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ebp, dword [esi + 0xc]
jne 0x40e820
push edi
push ebx
mov ecx, esi
call fcn.0040ebe0
push ebp
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp ebp, dword [esi + 0x1c]
jne 0x40e82e
push edi
push ebx
mov ecx, esi
call fcn.0040ef50
push ebp
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40eee0
Capabilities:
Create process on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push edi
push 0x7f02
mov ebp, ecx
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call edi
push 1
push 0
push 0
push str.http:__www.acdsystems.com
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x7f00
push 0
mov ebx, eax
call esi
push eax
call edi
cmp ebx, 0x1f
jg 0x40ef43
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 0x90]
push 0x20c
push eax
push ecx
call fcn.0043cfa0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret