joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421624
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
movsx edi, ax
shr eax, 0x10
cmp dword [esi + 0xbc], 0
movsx ebx, ax
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
je 0x4216ca
cmp dword [esi + 0xc0], 0
je 0x4216ca
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
cmp dword [esi + 0x6c], eax
je 0x42166b
sub ebx, dword [esi + 0xcc]
mov dword [esi + 0xc4], ebx
jmp 0x421677
sub edi, dword [esi + 0xc8]
mov dword [esi + 0xc4], edi
xor ebx, ebx
cmp dword [esi + 0xc4], eax
je 0x4216ac
lea edi, [esi + 0x10c]
cmp dword [edi], eax
mov dword [ebp - 4], eax
je 0x4216ac
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.0041ec9c
test eax, eax
je 0x4216aa
mov edi, dword [edi]
push dword [ebp - 4]
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ebx, eax
xor eax, eax
cmp ebx, eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
je 0x421725
push 1
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x421725
lea ecx, [ebp - 8]
mov eax, esi
call fcn.00421360
test eax, eax
jl 0x421725
cmp eax, dword [esi + 0x114]
jge 0x421725
lea ecx, [esi + 0x110]
call fcn.0041e00e
push dword [esi + 4]
add eax, 4
mov edi, dword [eax]
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
push edi
push 0x7f9
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x421725
push 1
push eax
push eax
push edi
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.00499d20
pop edi
xor eax, eax
pop ebx
leave
ret

Function at 0x422c75
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
cmp dword [esi + 0xc], 0x202
push ebx
jne 0x422cd7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
and ax, 0xfffe
je 0x422cd7
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 0x18]
push 4
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x422cd7
push edi
mov edi, dword [esp + 0xc]
push ebx
push dword [esi + 0x1c]
add edi, 4
push dword [esi + 0x18]
push edi
call fcn.00422d4e
push 1
push 0
push 0
push ebx
push str.open
push dword [edi]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
pop edi
xor eax, eax
pop ebx
ret 4
Function at 0x428684
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
or dword [edi + 8], 0xffffffff
push esi
lea eax, [ebp - 0x98]
xor esi, esi
push eax
mov dword [edi], esi
mov dword [edi + 0xc], esi
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4286c8
cmp dword [ebp - 0x94], 5
jb 0x4286c8
xor eax, eax
inc eax
cmp dword [ebp - 0x90], eax
jae 0x4286ca
xor eax, eax
cmp eax, esi
mov dword [edi + 4], eax
je 0x4286d9
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
jmp 0x428710
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0xc
push esi
push 3
push 0xc
mov dword [ebp - 4], eax
pop eax
lea esi, [ebp - 4]
call fcn.004281bb
push 0xc
push 1
push 3
push 0xc
mov dword [edi + 0x10], eax
pop eax
call fcn.004281bb
push dword [ebp - 4]
mov dword [edi + 0x14], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, edi
pop esi
leave
ret

Function at 0x42969d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea edi, [esi + 0x20]
mov dword [edi], eax
cmp dword [esi + 4], 0
jne 0x4296cd
lea ebx, [ebp - 4]
mov eax, edi
call fcn.0040aa39
mov eax, dword [eax]
push 0
push eax
mov eax, esi
call fcn.00430387
test eax, eax
je 0x429756
mov eax, dword [edi]
test eax, eax
je 0x429720
lea ecx, [ebp - 8]
push ecx
push 0
push 0x434
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
push 2
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x429720
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call fcn.00422d4e
test eax, eax
jle 0x429718
push ebx
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x24]
push eax
call fcn.0042fec4
push dword [ebp + 8]
push esi
call fcn.0042985d
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4
Function at 0x42975c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov esi, eax
lea edi, [esi + 0x24]
push dword [edi]
mov dword [ebp - 8], edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jne 0x429780
or eax, 0xffffffff
jmp 0x429859
push ebx
lea ebx, [eax + 1]
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x42979b
or eax, 0xffffffff
jmp 0x429858
push ebx
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x3f6
push dword [esi + 4]
call edi
mov ebx, eax
neg ebx
push 0x3f2
push dword [esi + 4]
sbb ebx, ebx
inc ebx
call edi
test eax, eax
je 0x4297cd
or ebx, 4
push 0x3f4
push dword [esi + 4]
call edi
test eax, eax
je 0x4297de
or ebx, 2
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x14]
push eax
push 0
push 0x434
push dword [esi + 0x20]
call edi
test bl, 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
je 0x429808
mov eax, dword [ebp - 0x10]
or dword [ebp - 0x24], 0xffffffff
jmp 0x42980f
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x24], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push ebx
push 0x44f
push dword [esi + 0x20]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x429832
push eax
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x429842
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x437
push dword [esi + 0x20]
call edi
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
call fcn.00437ad1
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp - 0xc]
pop ecx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x429c36
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [edi + 0x2c], esi
jne 0x429c63
push 1
push edi
call fcn.0042985d
push 1
push dword [edi + 0x28]
push 0x28
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
jmp 0x429d2a
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x14]
push eax
push esi
push 0x434
push dword [edi + 0x20]
call ebx
push 0x3f6
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x429ca5
push esi
push esi
push 0xe
push dword [edi + 0x20]
call ebx
dec eax
cmp dword [ebp - 0x10], eax
jge 0x429c9d
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x429cb3
cmp dword [ebp - 0x14], esi
jle 0x429cad
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x437
push dword [edi + 0x20]
call ebx
mov eax, edi
call fcn.0042975c
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x429cd6
or eax, 0xffffffff
jmp 0x429d29
lea esi, [edi + 0x28]
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
inc eax
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 4], eax
je 0x429cd1
push dword [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [ebp - 4]
push 1
push 0xc2
push dword [edi + 0x20]
call ebx
mov ebx, dword [ebp - 4]
call fcn.00437ad1
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov eax, edi
call fcn.0042975c
mov eax, dword [ebp - 0xc]
pop ebx
pop esi
leave
ret
Function at 0x429d2d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, eax
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jne 0x429d4b
or eax, 0xffffffff
jmp 0x429ea1
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
push edi
lea edi, [eax + 1]
push edi
call ebx
test eax, eax
pop ecx
mov dword [ebp - 8], eax
jne 0x429d69
or eax, 0xffffffff
jmp 0x429e9f
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
push eax
push dword [esi + 0x24]
call edi
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
inc eax
push eax
mov dword [ebp - 4], eax
call ebx
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
jne 0x429d9f
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
or eax, 0xffffffff
jmp 0x429e9e
push dword [ebp - 4]
push eax
push dword [esi + 0x28]
call edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x14]
push eax
push 0
push 0x434
push dword [esi + 0x20]
call edi
mov eax, dword [ebp - 8]
mov ebx, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x3f8
push dword [esi + 4]
mov dword [ebp - 0x20], eax
call ebx
test eax, eax
je 0x429de8
xor eax, eax
push eax
push eax
push 0xe
push dword [esi + 0x20]
mov dword [ebp - 0x28], eax
call edi
jmp 0x429dff
push 0x3f9
push dword [esi + 4]
call ebx
test eax, eax
je 0x429e02
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
push 0x3f2
push dword [esi + 4]
mov dword [ebp - 4], 1
call ebx
test eax, eax
je 0x429e1e
mov dword [ebp - 4], 5
push 0x3f4
push dword [esi + 4]
call ebx
test eax, eax
je 0x429e30
or dword [ebp - 4], 2
mov eax, dword [ebp - 0xc]
call fcn.00429a93
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00429a93
sub ebx, eax
jmp 0x429e75
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x437
push dword [esi + 0x20]
call edi
push dword [ebp - 0xc]
push 1
push 0xc2
push dword [esi + 0x20]
call edi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x24], ebx
add eax, ebx
cmp eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
jge 0x429e8b
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
push 0x44f
push dword [esi + 0x20]
call edi
cmp eax, 0xffffffff
jne 0x429e46
push dword [ebp - 8]
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
push dword [ebp - 0xc]
call esi
pop ecx
xor eax, eax
pop ecx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42b05e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push esi
push edi
push 2
push 0xffffffffffffffff
push 0x100c
lea esi, [ebx + 0x24]
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x41
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
mov byte [ebp - 0x130], 0
lea edi, [ebp - 0x12f]
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
mov ecx, ebx
call fcn.0042a7c4
push dword [eax]
lea eax, [ebp - 0x130]
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 8]
add eax, 0xfffffff4
cmp eax, dword [0x4e4154]
pop ecx
pop ecx
je 0x42b0c3
push eax
call fcn.00401377
mov eax, dword [ebx + 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x20], eax
xor edi, edi
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x18], 0x40
mov dword [ebp - 0x16], edi
mov dword [ebp - 0x12], edi
mov dword [ebp - 0xe], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
jne 0x42b10a
cmp dword [ebp - 0x16], edi
jne 0x42b10a
push dword [ebp - 4]
mov eax, esi
call fcn.00413f9f
pop edi
xor eax, eax
pop esi
leave
ret

Function at 0x42b1b8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x42b285
cmp byte [eax], 0
je 0x42b285
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.0042a7c4
mov eax, dword [0x4e4150]
mov dword [ebp - 4], eax
mov eax, 0x104
push eax
lea ecx, [ebp - 4]
call fcn.004030e2
push eax
push 1
push dword [esi + 0x10]
lea eax, [edi + 0x24]
push eax
call fcn.00413f22
or eax, 0xffffffff
lea ecx, [ebp - 4]
call fcn.0040310e
push dword [esi + 0x20]
lea eax, [ebp - 4]
push eax
call fcn.00403081
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x42b28b
push 0x8187
lea eax, [ebp - 8]
call fcn.00408a73
pop ecx
push 0x10
push dword [0x4e5c1c]
push dword [eax]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 8]
add eax, 0xfffffff4
cmp eax, dword [0x4e4154]
je 0x42b263
push eax
call fcn.00401377
lea eax, [esi - 0xc]
cmp eax, dword [0x4e4154]
je 0x42b274
push eax
call fcn.00401377
lea eax, [ebx - 0xc]
cmp eax, dword [0x4e4154]
je 0x42b285
push eax
call fcn.00401377
xor eax, eax
pop esi
pop ebx
leave
ret
lea eax, [esi - 0xc]
cmp eax, dword [0x4e4154]
je 0x42b29c
push eax
call fcn.00401377
lea eax, [ebx - 0xc]
cmp eax, dword [0x4e4154]
je 0x42b2ad
push eax
call fcn.00401377
xor eax, eax
inc eax
jmp 0x42b287
Function at 0x42ec34
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push esi
push 0x4cc158
lea eax, [ebp - 4]
push eax
add ecx, 0x218
call fcn.0041d016
mov esi, dword [ebp - 4]
cmp dword [esi - 8], 0
jne 0x42ec75
lea eax, [esi - 0xc]
cmp eax, dword [0x4e4154]
je 0x42ed87
push eax
call fcn.00401377
jmp 0x42ed87
push ebx
push edi
call fcn.0049905a
neg eax
sbb eax, eax
and eax, 0xc
inc eax
cmp eax, 0xd
mov dword [ebp - 0xc], eax
jne 0x42eced
lea eax, [ebp - 8]
push 0
push eax
mov eax, esi
call fcn.00401809
mov esi, dword [ebp - 8]
mov edi, dword [esi - 8]
pop ecx
pop ecx
lea edi, [edi + edi + 2]
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x42ecc6
add esi, 0xfffffff4
cmp esi, dword [0x4e4154]
je 0x42ed71
push esi
jmp 0x42ed1a
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
add esi, 0xfffffff4
cmp esi, dword [0x4e4154]
je 0x42ed4b
push esi
jmp 0x42ed46
lea ecx, [ebp - 4]
lea esi, [ebp - 8]
call fcn.00402f86
mov edi, dword [ebp - 8]
mov esi, dword [edi - 8]
inc esi
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x42ed21
lea eax, [edi - 0xc]
cmp eax, dword [0x4e4154]
je 0x42ed71
push eax
call fcn.00401377
jmp 0x42ed71
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [edi - 0xc]
cmp eax, dword [0x4e4154]
je 0x42ed4b
push eax
call fcn.00401377
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42ed71
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
cmp eax, dword [0x4e4154]
je 0x42ed85
push eax
call fcn.00401377
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 4

Function at 0x432f4b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
ret
Function at 0x433ee9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push edi
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
mov byte [ebp - 0x414], 0
mov ecx, 0xff
lea edi, [ebp - 0x413]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x400
lea eax, [ebp - 0x414]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test al, 2
mov dword [ebp - 4], 0x20
je 0x433f4e
mov dword [ebp - 4], 0x22
jmp 0x433f59
test al, 1
je 0x433f59
mov dword [ebp - 4], 0x21
test ah, 2
je 0x433f62
or dword [ebp - 4], 4
push dword [esi + 0x24]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push 1
push ebx
mov dword [ebp + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [esi + 0x28]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp + 8]
push ebx
call edi
pop edi
pop ebx
leave
ret 4

Function at 0x435269
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 4], edi
jne 0x435275
mov eax, esi
cmp dword [esp + 0x10], ebx
mov dword [esi + 8], eax
mov eax, dword [esp + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], 7
mov dword [esi + 0x14], eax
je 0x4352a3
push 0x40
push dword [esp + 0x14]
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4352d2
cmp dword [esi + 0x14], ebx
jne 0x4352c1
push ebx
push ebx
push 0x7f
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
cmp byte [eax], bl
jne 0x4352d2
push 0x40
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
inc eax
pop ebx
ret 0xc

Function at 0x4353af
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x435402
xor eax, eax
inc eax
cmp dword [ebp - 0xc], eax
jne 0x4353ef
cmp dword [ebp - 0x18], 4
jb 0x435402
cmp dword [ebp - 0x14], 0x5a
jmp 0x435400
cmp dword [ebp - 0xc], 2
jne 0x435402
cmp dword [ebp - 0x18], 5
ja 0x435404
jne 0x435402
cmp dword [ebp - 0x14], eax
jae 0x435404
xor eax, eax
add ebp, 0x78
leave
ret
Function at 0x436753
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
push edi
je 0x436780
cmp byte [esi], bl
je 0x436780
mov edi, dword [ebp + 8]
cmp dword [edi + 4], ebx
jne 0x436789
call fcn.00403d43
test eax, eax
je 0x436780
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
or dword [ebp - 0x40], 0xffffffff
push 0x80
push 2
push 1
push esi
mov eax, 0xc0000000
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0x1000
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0040d226
test eax, eax
je 0x4368e1
push 3
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x4e414c
call fcn.0041ccf7
mov eax, edi
call fcn.004328a7
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4368d8
mov eax, dword [0x4e4150]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], ebx
push eax
lea ebx, [ebp - 0x18]
lea esi, [ebp - 0xc]
call fcn.004328d4
push 0
push dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.0040188b
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
push dword [ecx - 8]
lea eax, [ebp - 0x40]
push eax
call fcn.0041ccf7
push dword [ebp - 0x14]
lea eax, [ebp - 4]
push str._d
push eax
call fcn.004058d5
mov ecx, dword [ebp - 4]
add esp, 0xc
push dword [ecx - 8]
lea eax, [ebp - 0x40]
push eax
call fcn.0041ccf7
mov ebx, dword [ebp - 8]
push 0
push ebx
lea eax, [ebp - 0x10]
call fcn.0040188b
pop ecx
mov edi, eax
pop ecx
lea eax, [ebp - 4]
call fcn.0040301a
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff4
cmp eax, dword [0x4e4154]
je 0x436876
push eax
call fcn.00401377
mov esi, dword [ebp - 4]
push dword [esi - 8]
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.0041ccf7
push 2
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x4cc158
call fcn.0041ccf7
lea eax, [esi - 0xc]
cmp eax, dword [0x4e4154]
je 0x4368a8
push eax
call fcn.00401377
lea eax, [ebx - 0xc]
cmp eax, dword [0x4e4154]
je 0x4368b9
push eax
call fcn.00401377
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
cmp eax, dword [0x4e4154]
je 0x4368cd
push eax
call fcn.00401377
xor ebx, ebx
cmp dword [ebp - 0xc], ebx
jne 0x4367e7
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], ebx
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x40]
call fcn.0040d27c
mov eax, ebx
jmp 0x436782
Function at 0x43979c
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea esi, [ebx + 0x124]
push dword [esi]
call edi
push dword [esp + 0x10]
mov eax, dword [esp + 0x10]
push ebx
call fcn.0044750d
push 5
push dword [esi]
call edi
pop edi
pop esi
ret 8

Function at 0x43d61c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.0049905a
test eax, eax
je 0x43d692
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x28
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43d68e
push edi
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
pop edi
je 0x43d692
xor eax, eax
jmp 0x43d6a0
push 0x40000
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret

Function at 0x4418c2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push esi
xor esi, esi
inc esi
push 0
lea eax, [esi + 0x7dc8]
push eax
push dword [ebp + 0x7c]
call fcn.0042ff98
add esp, 0xc
inc esi
cmp esi, 9
jle 0x4418d1
push ebx
push edi
xor esi, esi
push 0xa
inc esi
pop ebx
mov eax, dword [0x4e4150]
push ebx
mov dword [ebp + 0x6c], eax
lea eax, [ebp + 0x6c]
push 0x81c7
push eax
call fcn.00405867
add esp, 0xc
cmp ebx, dword [0x4e5e18]
mov eax, 0x400
jne 0x44191f
mov eax, 0x608
mov edi, dword [ebp + 0x6c]
push edi
lea ecx, [esi + 0x7dc8]
push ecx
push eax
push esi
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_InsertMenuA]
lea eax, [edi - 0xc]
cmp eax, dword [0x4e4154]
je 0x441946
push eax
call fcn.00401377
add ebx, 0xa
inc esi
cmp ebx, 0x5a
jle 0x4418f3
cmp dword [0x4e5e18], 0
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
jne 0x44196d
push 0x208
push 0x7dc8
push dword [ebp + 0x7c]
call esi
cmp dword [0x4e5e14], 0
je 0x441982
push 8
push 0x7dd2
push dword [ebp + 0x7c]
call esi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
pop edi
pop ebx
jne 0x4419cf
cmp dword [ebp - 0x24], 5
ja 0x4419b3
jne 0x4419cf
cmp dword [ebp - 0x20], 1
jb 0x4419cf
push dword [ebp + 0x78]
call fcn.00448895
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x7dde
push dword [ebp + 0x7c]
call esi
jmp 0x4419df
push 3
push 0x7dde
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_EnableMenuItem]
pop esi
add ebp, 0x70
leave
ret 8