joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xffffffff
push 0x5eab7a
xor esi, esi
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [ebp - 0x14], eax
xor edi, edi
push 0
push 0
push 0x1f0fff
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_GetCurrentProcess
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_DuplicateHandle
mov ebx, eax
lea eax, [ebp - 8]
push eax
test ebx, ebx
je 0x43f2b7
mov edx, dword [ebp - 0x10]
jmp 0x43f2ba
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_GetExitCodeProcess
test eax, eax
je 0x43f30d
mov eax, dword [ebp - 8]
cmp eax, 0x103
jne 0x43f30d
push 0x5eab83
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_GetProcAddress
lea edx, [ebp - 4]
push edx
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push eax
push 0
push 0
test ebx, ebx
je 0x43f2f4
mov eax, dword [ebp - 0x10]
jmp 0x43f2f7
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_CreateRemoteThread
mov esi, eax
test esi, esi
jne 0x43f314
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0xc], eax
jmp 0x43f314
mov dword [ebp - 0xc], 0x42b
test esi, esi
je 0x43f337
push 0xffffffffffffffff
test ebx, ebx
je 0x43f323
mov eax, dword [ebp - 0x10]
jmp 0x43f326
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push esi
call sub.KERNEL32.dll_CloseHandle
mov edi, 1
test ebx, ebx
je 0x43f344
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_CloseHandle
test edi, edi
jne 0x43f351
mov edx, dword [ebp - 0xc]
push edx
call sub.KERNEL32.dll_SetLastError
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43f3dc
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
mov eax, dword [0x51d6b4]
cmp eax, 1
je 0x43f423
mov edx, dword [0x611fbc]
test edx, edx
je 0x43f423
mov ecx, dword [0x51d6b4]
test ecx, ecx
je 0x43f423
mov eax, dword [0x51d6b4]
push eax
push 0
push 1
call sub.KERNEL32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x43f423
push 0
push esi
call sub.KERNEL32.dll_TerminateProcess
mov ebx, eax
push esi
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
xor edx, edx
mov dword [0x51d6b4], eax
mov eax, ebx
mov dword [0x611fbc], edx
pop esi
pop ebx
ret
Function at 0x43f7cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff340
mov ecx, 0x104
lea eax, [ebp - 0x820]
lea edx, [ebp - 0x410]
push ebx
push esi
push edi
lea edi, [ebp - 0x410]
mov ebx, dword [ebp + 0xc]
mov esi, 0x51f26c
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x820]
mov ecx, 0x104
mov esi, 0x51f67c
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc30]
mov ecx, 0x104
mov esi, 0x51fa8c
rep movsd dword es:[edi], dword [esi]
push eax
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043f438
add esp, 0x14
mov al, byte [ebp - 0x820]
test al, al
je 0x43f841
lea esi, [ebp - 0x820]
jmp 0x43f843
xor esi, esi
test ebx, ebx
jne 0x43f84b
xor ebx, ebx
jmp 0x43f869
push ebx
lea eax, [ebp - 0xc30]
push eax
call fcn.0043e3cc
add esp, 8
lea ebx, [ebp - 0xc30]
mov al, byte [ebx]
test al, al
jne 0x43f869
xor ebx, ebx
push 0x44
push 0
lea eax, [ebp - 0xc74]
push eax
call fcn.004d2d9c
add esp, 0xc
lea edx, [ebp - 0xc84]
push 0x10
push 0
push edx
call fcn.004d2d9c
add esp, 0xc
lea ecx, [ebp - 0xc74]
mov dword [ebp - 0xc74], 0x44
push ecx
call sub.KERNEL32.dll_GetStartupInfoA
push 0x8000
call sub.KERNEL32.dll_SetErrorMode
push 7
call sub.KERNEL32.dll_SetErrorMode
push 0x3c
push 0
lea eax, [ebp - 0xcc0]
push eax
call fcn.004d2d9c
mov dword [ebp - 0xcc0], 0x3c
mov dword [ebp - 0xcbc], 0x800400
lea edx, [ebp - 0x410]
add esp, 0xc
mov dword [ebp - 0xcb0], edx
mov dword [ebp - 0xca8], ebx
mov dword [ebp - 0xcac], esi
mov dword [ebp - 0xca4], 5
test byte [ebp + 0x11], 2
je 0x43f90f
mov dword [ebp - 0xcb4], 0x5eab9b
mov cl, byte [ebp - 0x410]
test cl, cl
je 0x43f92d
lea eax, [ebp - 0xcc0]
push eax
call sub.SHELL32.dll_ShellExecuteExA
test eax, eax
jne 0x43f92d
xor eax, eax
jmp 0x43f932
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f97c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff37c
mov ecx, 0x104
lea eax, [ebp - 0x820]
lea edx, [ebp - 0x410]
push ebx
push esi
push edi
lea edi, [ebp - 0x410]
mov ebx, dword [ebp + 0xc]
mov esi, 0x51fe9c
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x820]
mov ecx, 0x104
mov esi, 0x5202ac
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc30]
mov ecx, 0x104
mov esi, 0x5206bc
rep movsd dword es:[edi], dword [esi]
push eax
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043f438
add esp, 0x14
push 0x5eaba1
lea eax, [ebp - 0x410]
push eax
call fcn.004d2e40
add esp, 8
lea edx, [ebp - 0x820]
push edx
lea ecx, [ebp - 0x410]
push ecx
call fcn.004d2e40
add esp, 8
test ebx, ebx
jne 0x43fa11
xor ebx, ebx
jmp 0x43fa2f
push ebx
lea eax, [ebp - 0xc30]
push eax
call fcn.0043e3cc
add esp, 8
lea ebx, [ebp - 0xc30]
mov al, byte [ebx]
test al, al
jne 0x43fa2f
xor ebx, ebx
push 0x8000
call sub.KERNEL32.dll_SetErrorMode
push 7
call sub.KERNEL32.dll_SetErrorMode
push 0x44
push 0
lea eax, [ebp - 0xc74]
push eax
call fcn.004d2d9c
add esp, 0xc
lea edx, [ebp - 0xc84]
push 0x10
push 0
push edx
call fcn.004d2d9c
add esp, 0xc
lea ecx, [ebp - 0xc74]
mov dword [ebp - 0xc74], 0x44
push ecx
call sub.KERNEL32.dll_GetStartupInfoA
mov al, byte [ebp - 0x410]
test al, al
je 0x43fabc
lea edx, [ebp - 0xc84]
lea ecx, [ebp - 0xc74]
push edx
push ecx
push ebx
push 0
push 0x4000000
push 0
push 0
lea eax, [ebp - 0x410]
push 0
push eax
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
je 0x43fabc
mov eax, dword [ebp - 0xc7c]
jmp 0x43fabe
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43fb08
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x43fb38
mov al, byte [ebx]
test al, al
je 0x43fb38
lea edx, [ebp - 0x100]
push edx
push pe_nt_image_headers32
call sub.KERNEL32.dll_GetCurrentDirectoryA
push ebx
call fcn.004d911c
pop ecx
call fcn.0043e4f4
mov esi, eax
push 5
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_WinExec
cmp eax, 0x21
jae 0x43fb51
xor eax, eax
mov dword [0x51d6b4], eax
mov dword [0x611fbc], 0x4000
push esi
call fcn.0043e600
pop ecx
test ebx, ebx
je 0x43fb7e
mov dl, byte [ebx]
test dl, dl
je 0x43fb7e
lea ecx, [ebp - 0x100]
push ecx
call fcn.004d911c
pop ecx
mov eax, dword [0x51d6b4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43fc08
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x43fc3e
cmp byte [esi], 0
je 0x43fc3e
lea eax, [ebp - 0x100]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push esi
call fcn.004d911c
pop ecx
push edi
push 0x5eaba3
lea edx, [ebp - 0x200]
push edx
call fcn.004d75f8
add esp, 0xc
test ebx, ebx
je 0x43fc73
mov cl, byte [ebx]
test cl, cl
je 0x43fc73
push edi
push ebx
push 0x5eabb2
lea eax, [ebp - 0x200]
push eax
call fcn.004d75f8
add esp, 0x10
mov ebx, 1
push 5
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.dll_WinExec
cmp eax, 0x21
jae 0x43fc8d
xor ebx, ebx
test ebx, ebx
je 0x43fcb1
push 1
call fcn.0043fb94
pop ecx
push 1
call fcn.0043fb94
pop ecx
push 1
call fcn.0043fb94
pop ecx
push 0
call fcn.0043fb94
pop ecx
test esi, esi
je 0x43fcc8
mov al, byte [esi]
test al, al
je 0x43fcc8
lea edx, [ebp - 0x100]
push edx
call fcn.004d911c
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4405c4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x44060f
mov byte [ebx], 0
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
push ebx
call sub.KERNEL32.dll_GetComputerNameA
test eax, eax
je 0x4405ec
mov al, 1
jmp 0x440611
push 1
push pe_nt_image_headers32
push ebx
push 0x5eadc8
push 0x5ead8d
push 0x80000002
call fcn.00406a10
add esp, 0x18
mov al, 1
jmp 0x440611
xor eax, eax
pop ebx
pop ecx
pop ebp
ret

Function at 0x4408d4
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
mov ecx, 0x41
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x104]
push esi
push edi
lea edi, [ebp - 0x104]
mov esi, 0x520ea0
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x208]
mov ecx, 0x41
mov esi, 0x520fa4
rep movsd dword es:[edi], dword [esi]
push eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00440790
add esp, 0xc
lea eax, [ebp - 0x104]
mov byte [ebp - 0x102], 0
push eax
call fcn.0044083c
pop ecx
xor edx, edx
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 0x101]
mov dword [ebp - 0x214], eax
xor edx, edx
mov dword [ebp - 0x20c], edx
push 0
push 0
push 0
lea ecx, [ebp - 0x228]
push ecx
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
jne 0x4409ba
mov al, byte [ebp - 0x208]
test al, al
je 0x4409b3
movsx edx, byte [ebp - 0x207]
cmp edx, 0x3a
jne 0x4409b3
push pe_nt_image_headers32
lea ecx, [ebp - 0x104]
push ecx
call fcn.004d6b3c
add esp, 8
lea eax, [ebp - 0x208]
push eax
call fcn.004d911c
pop ecx
lea edx, [ebp - 0x104]
push edx
call fcn.004d911c
pop ecx
mov eax, 1
jmp 0x4409c3
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x442110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [ebp + 0xc], 1
mov ebx, dword [ebp + 8]
jne 0x442127
push 5
push ebx
call sub.USER32.dll_ShowWindow
jmp 0x44212f
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 1
push 0
push ebx
call sub.USER32.dll_InvalidateRect
push ebx
call sub.USER32.dll_UpdateWindow
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_Sleep
pop ebx
pop ebp
ret

Function at 0x44226c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x104
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x442292
mov esi, 0x5eb1a9
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push ebx
call fcn.004d2f1c
pop ecx
test eax, eax
je 0x4422bc
push ebx
call fcn.004d2f1c
pop ecx
movsx edx, byte [ebx + eax - 1]
cmp edx, 0x5c
je 0x4422bc
push 0x5eb1b4
push ebx
call fcn.004d2e40
add esp, 8
push 0x5eb1b6
push ebx
call fcn.004d2e40
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x442aa0
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 4
mov esi, ebx
push esi
push 0x5eb387
push 0x5eb351
push 0x80000002
call fcn.00406a4c
add esp, 0x14
push 4
push esi
push 0x5eb3ce
push 0x5eb398
push 0x80000001
call fcn.00406a4c
add esp, 0x14
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x442b3c
Capabilities:
Find taskbar

Disassembly:
push ebx
xor ebx, ebx
push 0
push 0x5eb3df
push ebx
push 0
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x442b67
push 0x5eb3ed
push 0
push 0
push ebx
call sub.USER32.dll_FindWindowExA
test eax, eax
jne 0x442b3f
mov eax, ebx
pop ebx
ret

Function at 0x442b6c
Capabilities:
Acquire debug privileges
Hide graphical window
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
push 0
call fcn.00443644
pop ecx
call fcn.00442b3c
mov esi, eax
test esi, esi
jne 0x442b93
call fcn.00442b10
mov eax, 1
jmp 0x442c71
push 0
call fcn.00442aa0
pop ecx
push esp
push esi
call sub.USER32.dll_GetWindowThreadProcessId
push 1
push 0x5eb3ff
call fcn.004038e4
add esp, 8
mov edx, dword [esp]
push edx
push 0
push 0x401
call sub.KERNEL32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x442bf5
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0x300
push 0x5eb410
call fcn.0043f1a0
add esp, 8
push 0x300
push 0x5eb41d
call fcn.0043f1a0
add esp, 8
jmp 0x442c08
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.dll_GetExitCodeProcess
push 1
push ebx
call sub.KERNEL32.dll_TerminateProcess
xor edx, edx
mov dword [esp], edx
push 4
mov ecx, dword [esp + 4]
push ecx
push 0x5eb468
push 0x5eb435
push 0x80000001
call fcn.00406a4c
add esp, 0x14
push 4
mov eax, dword [esp + 4]
push eax
push 0x5eb4a4
push 0x5eb471
push 0x80000001
call fcn.00406a4c
add esp, 0x14
push 4
mov edx, dword [esp + 4]
push edx
push 0x5eb4e2
push 0x5eb4af
push 0x80000001
call fcn.00406a4c
add esp, 0x14
call fcn.00442b10
mov eax, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x442fdc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov cl, byte [0x52136c]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov byte [ebp - 1], cl
test eax, eax
jne 0x442ff8
xor eax, eax
pop ecx
pop ebp
ret
mov cl, byte [eax]
test cl, cl
jne 0x443003
xor eax, eax
pop ecx
pop ebp
ret
test edx, edx
jne 0x44300a
lea edx, [ebp - 1]
push 1
push edx
push eax
push 0x5eb4f9
push 0x80000001
call fcn.00406a4c
add esp, 0x14
test eax, eax
je 0x44302c
mov eax, 1
pop ecx
pop ebp
ret
xor eax, eax
pop ecx
pop ebp
ret
Function at 0x44311c
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x443100
xor eax, eax
mov dword [ebp - 0x24], eax
xor edx, edx
mov dword [ebp - 0x20], edx
call fcn.00401288
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.USER32.dll_LoadIconA
mov dword [ebp - 0x18], eax
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push 0
call sub.GDI32.dll_GetStockObject
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x30]
mov dword [ebp - 8], 0x5eb5b5
push edx
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 8], 0x5eb5c3
lea ecx, [ebp - 0x30]
push ecx
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 8], 0x5eb5d1
lea eax, [ebp - 0x30]
push eax
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 8], 0x5eb5e1
lea edx, [ebp - 0x30]
push edx
call sub.USER32.dll_RegisterClassExA
push 0
push 0x5eb5ea
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x4431d6
mov eax, ebx
jmp 0x44333b
push 0
call fcn.00401288
push eax
push 0
push 0
push 0xc8
push 0xc8
push 0xa
push 0xa
push 0
push 0x5eb606
push 0x5eb5f8
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 0
call fcn.00401288
push eax
push 0
push ebx
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5eb60e
push 0x5eb607
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401288
push eax
push 0
push ebx
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5eb61c
push 0x5eb615
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401288
push eax
push 0
push ebx
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5eb63c
push 0x5eb62e
push 0
call sub.USER32.dll_CreateWindowExA
mov esi, eax
push 0
call fcn.00401288
push eax
push 0
push esi
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5eb64d
push 0x5eb63d
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401288
push eax
push 0
push esi
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5eb657
push 0x5eb64e
push 0
call sub.USER32.dll_CreateWindowExA
push 0
call fcn.00401288
push eax
push 0
push esi
push 0x14
push 0x14
push 0x14
push 0x14
push 0x50800000
push 0x5eb65f
push 0x5eb658
push 0
call sub.USER32.dll_CreateWindowExA
mov eax, dword [ebp + 8]
dec eax
jne 0x443339
jmp 0x443321
push ebx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x443339
lea edx, [ebp - 0x4c]
push edx
call sub.USER32.dll_TranslateMessage
lea ecx, [ebp - 0x4c]
push ecx
call sub.USER32.dll_DispatchMessageA
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.USER32.dll_GetMessageA
mov esi, eax
test eax, eax
je 0x443339
inc esi
jne 0x443305
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443854
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
cmp word [0x4ed314], 0x6c
je 0x443870
xor eax, eax
jmp 0x4438fa
mov ebx, 5
push 0
push 0x5eb85b
call sub.USER32.dll_FindWindowA
test eax, eax
jne 0x4438a4
test esi, 0x10
jne 0x443891
xor eax, eax
jmp 0x4438fa
dec ebx
test ebx, ebx
jne 0x44389a
xor eax, eax
jmp 0x4438fa
push 1
call fcn.004dee84
pop ecx
jmp 0x443875
push 0
call fcn.00443644
pop ecx
mov ebx, 5
push 0
push 0x5eb869
call sub.USER32.dll_FindWindowA
test eax, eax
je 0x4438dd
push esi
call fcn.00443780
pop ecx
mov edi, eax
push 0
push 0
call fcn.00401400
add esp, 8
push esi
call fcn.00443780
pop ecx
test esi, 0x10
je 0x4438f8
test edi, edi
jne 0x4438f8
dec ebx
test ebx, ebx
je 0x4438f8
push 1
call fcn.004dee84
pop ecx
jmp 0x4438b1
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44393c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, esi
and eax, 0x200
test eax, eax
jne 0x44395e
push 1
call fcn.004439b8
pop ecx
push 0
push edi
call sub.USER32.dll_MapVirtualKeyA
test esi, 1
mov byte [ebp - 1], al
je 0x443981
push 0
push 0
mov dl, byte [ebp - 1]
push edx
mov ecx, edi
push ecx
call sub.USER32.dll_keybd_event
test esi, 2
je 0x443999
push 0
push 2
mov al, byte [ebp - 1]
push eax
mov edx, edi
push edx
call sub.USER32.dll_keybd_event
and esi, 0x200
test esi, esi
jne 0x4439ad
push 2
call fcn.004439b8
pop ecx
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4439b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, 1
je 0x443afc
test byte [0x521475], 1
je 0x4439e8
mov bl, 1
push 0x201
push 0x10
call fcn.0044393c
add esp, 8
test byte [0x521475], 8
je 0x443a05
mov bl, 1
push 0x201
push 0xa3
call fcn.0044393c
add esp, 8
test byte [0x521475], 4
je 0x443a22
mov bl, 1
push 0x201
push 0xa2
call fcn.0044393c
add esp, 8
test byte [0x521475], 0x40
je 0x443a3c
mov bl, 1
push 0x201
push 0x5b
call fcn.0044393c
add esp, 8
test byte [0x521475], 0x10
je 0x443a59
mov bl, 1
push 0x201
push 0xa4
call fcn.0044393c
add esp, 8
test byte [0x521475], 0x20
je 0x443a76
mov bl, 1
push 0x201
push 0xa5
call fcn.0044393c
add esp, 8
test byte [0x521475], 0x80
je 0x443aad
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
jne 0x443ad9
push 0x201
push 0x14
call fcn.0044393c
add esp, 8
push 0x202
push 0x14
call fcn.0044393c
add esp, 8
mov bl, 1
jmp 0x443ad9
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
je 0x443ad9
push 0x201
push 0x14
call fcn.0044393c
add esp, 8
push 0x202
push 0x14
call fcn.0044393c
add esp, 8
mov bl, 1
test bl, bl
je 0x443afc
push 0
push 0
call fcn.00401400
add esp, 8
push 0x64
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.00401400
add esp, 8
test esi, 2
je 0x443c37
test byte [0x521475], 1
je 0x443b20
push 0x202
push 0x10
call fcn.0044393c
add esp, 8
test byte [0x521475], 8
je 0x443b3b
push 0x202
push 0xa3
call fcn.0044393c
add esp, 8
test byte [0x521475], 4
je 0x443b56
push 0x202
push 0xa2
call fcn.0044393c
add esp, 8
test byte [0x521475], 0x40
je 0x443b6e
push 0x202
push 0x5b
call fcn.0044393c
add esp, 8
test byte [0x521475], 0x10
je 0x443b89
push 0x202
push 0xa4
call fcn.0044393c
add esp, 8
test byte [0x521475], 0x20
je 0x443ba4
push 0x202
push 0xa5
call fcn.0044393c
add esp, 8
test byte [0x521475], 0x80
je 0x443bd9
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
jne 0x443c03
push 0x201
push 0x14
call fcn.0044393c
add esp, 8
push 0x202
push 0x14
call fcn.0044393c
add esp, 8
jmp 0x443c03
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
je 0x443c03
push 0x201
push 0x14
call fcn.0044393c
add esp, 8
push 0x202
push 0x14
call fcn.0044393c
add esp, 8
test byte [0x521475], 0x7d
je 0x443c37
and dword [0x521474], 0xffff82ff
push 0
push 0
call fcn.00401400
add esp, 8
push 0x64
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.00401400
add esp, 8
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x443c40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0
call fcn.00401288
push eax
push 0
push 0
push 6
push 0
push ebx
call fcn.00401524
add esp, 0xc
push eax
push 5
push 0
push ebx
call fcn.00401524
add esp, 0xc
push eax
push 7
push 0
push ebx
call fcn.00401524
add esp, 0xc
push eax
push 8
push 0
push ebx
call fcn.00401524
add esp, 0xc
push eax
push 0x90800000
push 0x5eb877
push 0x521499
push 0x8000008
call sub.USER32.dll_CreateWindowExA
mov esi, eax
push 0xda0000
push 0xffffffffffffffeb
push esi
call sub.USER32.dll_SetWindowLongA
push 0
mov eax, dword [0x521484]
test eax, eax
jns 0x443cc2
add eax, 3
sar eax, 2
mov ecx, dword [0x521480]
test ecx, ecx
lea edx, [eax + eax*2]
push edx
jns 0x443cd6
add ecx, 3
sar ecx, 2
shl ecx, 2
push ecx
push 3
push 0x64
push esi
call fcn.00446298
add esp, 0x18
push 0
push ebx
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
pop ebp
ret

Function at 0x4470a8
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ecx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edx
test eax, eax
je 0x4470c0
mov cl, byte [eax]
test cl, cl
jne 0x4470c0
xor eax, eax
lea edx, [ebp - 4]
push edx
push 0
push 2
mov ecx, dword [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call sub.ADVAPI32.dll_LogonUserA
dec eax
jne 0x4470ed
mov eax, dword [ebp - 4]
test eax, eax
je 0x4470e9
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
jmp 0x4470f2
call sub.KERNEL32.dll_GetLastError
pop ecx
pop ebp
ret

Function at 0x447450
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0x200
mov eax, dword [ebp + 0x10]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x447497
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x20c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4474ac
lea eax, [ebp - 0x20c]
push eax
call fcn.004472e4
pop ecx
test al, al
jne 0x4474ac
xor eax, eax
jmp 0x4474db
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
push edx
push ecx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 4]
push eax
push edx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push ecx
push eax
push 0
call sub.ADVAPI32.dll_LookupAccountNameA
test eax, eax
jne 0x4474d9
xor eax, eax
jmp 0x4474db
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret