joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d0b
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x78]
push eax
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
or dword [ebp - 0x70], 0xffffffff
mov edi, eax
mov eax, dword [0x4341fc]
mov ecx, 0x4341fc
call dword [eax + 0xc]
push 0x10
pop ecx
add eax, ecx
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.004025a5
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x6c]
push str._App_GetReadCount_md5_semail_svisitor_s
call fcn.00402bdd
mov eax, dword [ebp - 0x68]
add esp, 0x18
add eax, 0xfffffff0
call fcn.004018b2
cmp edi, ebx
je 0x401e26
push 0x13
pop ecx
mov esi, str.Content_Type:_text_html__charsetUTF_8
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
push ebx
push ebx
push ebx
push ebx
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.WININET.dll_InternetOpenW]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
push 0x42cd00
push eax
mov dword [ebp - 0x74], eax
call dword [sym.imp.WININET.dll_InternetConnectW]
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
push 0x42cd1c
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
push ebx
mov esi, eax
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00416aee
pop ecx
push eax
lea eax, [ebp - 0x64]
push eax
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x401e13
xor eax, eax
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x7c]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x401e13
lea eax, [ebp - 0x14]
push eax
call fcn.00416957
pop ecx
mov dword [ebp - 0x70], eax
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call edi
push dword [ebp - 0x68]
call edi
push dword [ebp - 0x74]
call edi
mov eax, dword [ebp - 0x6c]
add eax, 0xfffffff0
call fcn.004018b2
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004018b2
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.004018b2
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004161d1
leave
ret
Function at 0x4020c0
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x4021a1
push 0x13
pop ecx
mov esi, str.Content_Type:_text_html__charsetUTF_8
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
push ebx
push ebx
push ebx
push ebx
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.WININET.dll_InternetOpenW]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
push 0x42cd00
push eax
mov dword [ebp - 0x70], eax
call dword [sym.imp.WININET.dll_InternetConnectW]
push ebx
push ebx
push ebx
push ebx
push ebx
push str._App_GetTime
push 0x42cd1c
push eax
mov dword [ebp - 0x74], eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
push ebx
mov esi, eax
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.00416aee
pop ecx
push eax
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x40218e
xor eax, eax
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x7c]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40218e
lea eax, [ebp - 0x14]
push eax
call fcn.00416957
pop ecx
mov dword [ebp - 0x6c], eax
cmp eax, ebx
jbe 0x40218e
push eax
call fcn.004023bf
pop ecx
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call edi
push dword [ebp - 0x74]
call edi
push dword [ebp - 0x70]
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x6c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004161d1
leave
ret
Function at 0x4023bf
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x27c
mov eax, dword [0x433024]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x42cd7c
lea eax, [esp + 0x7c]
push esi
push eax
call fcn.0041625a
push 0x42cd80
lea eax, [esp + 0x88]
push esi
push eax
call fcn.0041625a
add esp, 0x18
xor esi, esi
push esi
push 4
push 2
push esi
push esi
push 0x40000000
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402484
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [ebp + 8]
push eax
push ebx
call esi
test eax, eax
je 0x40247d
push 4
lea eax, [ebp + 8]
push eax
lea edi, [esp + 0x70]
lea ecx, [esp + 0x18]
call fcn.00426400
push 0
lea eax, [esp + 0x10]
push eax
push 0x10
mov eax, edi
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x402486
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004161d1
mov esp, ebp
pop ebp
ret

Function at 0x40249b
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
mov eax, dword [0x433024]
xor eax, esp
mov dword [esp + 0x284], eax
push esi
push edi
mov esi, 0x104
push esi
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x42cd7c
lea eax, [esp + 0x84]
push esi
push eax
call fcn.0041625a
push 0x42cd80
lea eax, [esp + 0x90]
push esi
push eax
call fcn.0041625a
add esp, 0x18
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40258f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x402585
push edi
call fcn.0041676c
pop ecx
push 0
mov esi, eax
lea eax, [esp + 0x18]
push eax
push edi
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 4
lea eax, [esp + 0x10]
push esi
push eax
call fcn.00416340
add esp, 0xc
push 4
lea eax, [esp + 0x10]
push eax
lea edi, [esp + 0x78]
lea ecx, [esp + 0x20]
call fcn.00426400
xor eax, eax
mov cl, byte [esp + eax + 0x70]
cmp cl, byte [esi + eax + 4]
jne 0x402585
inc eax
cmp eax, 0x10
jl 0x40256f
mov eax, dword [esp + 0xc]
jmp 0x402591
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x28c]
pop edi
pop esi
xor ecx, esp
call fcn.004161d1
mov esp, ebp
pop ebp
ret
Function at 0x40385b
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
mov eax, dword [0x433024]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x14c]
xor ebx, ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebx
cmp eax, ebx
je 0x403895
push eax
call fcn.00416b09
pop ecx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
jne 0x403917
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x42ce08
push 0x12e
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x403a72
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x403a72
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x403a72
push dword [esp + 0x14]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov dword [esp + 0x18], eax
call fcn.0041676c
pop ecx
push dword [esp + 0x14]
mov esi, eax
push dword [esp + 0x14]
push esi
call fcn.00416340
add esp, 0xc
jmp 0x403990
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x403a72
mov ecx, dword [edi + 0xc0]
call fcn.00427a40
mov ecx, dword [edi + 0x130]
push ebx
push ebx
mov dword [esp + 0x1c], eax
call fcn.00427a40
add eax, 0x2c
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esp + 0x14]
call fcn.0041676c
pop ecx
push ebx
mov esi, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x403a72
mov eax, dword [0x4341fc]
mov ecx, 0x4341fc
call dword [eax + 0xc]
push dword [edi + 0x12c]
add eax, 0x10
push dword [edi + 0x128]
mov dword [esp + 0x18], eax
push str._cn__d_cxy__dhzr
lea eax, [esp + 0x1c]
call fcn.00402bdd
add esp, 0xc
lea eax, [edi + 0x118]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x10
pop ecx
call fcn.004025a5
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.0040349a
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004018b2
mov ecx, dword [edi + 0xc0]
call fcn.00427a40
mov ebx, eax
push ebx
call fcn.0041676c
pop ecx
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, eax
mov dword [edi + 0x14c], eax
call fcn.00427d50
pop ecx
push dword [edi + 0xc0]
lea ecx, [esp + 0x24]
push dword [edi + 0x14c]
lea edi, [esp + 0x84]
call fcn.00426400
mov dword [esp + 0x18], 1
xor eax, eax
mov cl, byte [esp + eax + 0x7c]
mov edx, dword [esp + 0x1c]
cmp cl, byte [edx + eax + 0xc8]
jne 0x403a5a
inc eax
cmp eax, 0x10
jb 0x403a41
jmp 0x403a5f
and dword [esp + 0x18], 0
push esi
call fcn.00416b09
mov eax, dword [esp + 0x14]
pop ecx
add eax, 0xfffffff0
call fcn.004018b2
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004018b2
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004161d1
mov esp, ebp
pop ebp
ret 4
Function at 0x403f95
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x234], 0
push ebx
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x230]
push eax
mov esi, 0x22c
push ebx
mov dword [ebp - 0x230], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40402a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x403ffa
lea eax, [ebp - 0x20c]
push str.excel.exe
push eax
call fcn.0041727b
pop ecx
pop ecx
test eax, eax
je 0x404010
lea eax, [ebp - 0x230]
push eax
push ebx
mov dword [ebp - 0x230], esi
call edi
test eax, eax
jne 0x403fe3
jmp 0x40401c
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x234], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x234]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004161d1
leave
ret

Function at 0x404922
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404986
cmp dword [ebp + 0xc], 1
je 0x40495e
cmp dword [ebp + 0xc], 2
je 0x40495e
push 0xd
pop eax
jmp 0x404986
mov eax, dword [ebp - 4]
test edi, edi
je 0x404980
test eax, eax
je 0x40497b
test al, 1
jne 0x404959
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x404980
jmp 0x404959
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x40498a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
or ecx, 0x2001f
push ecx
push eax
push dword [esi]
xor ebx, ebx
lea edi, [ebp - 0x218]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], ebx
call fcn.004048db
mov edi, eax
cmp edi, ebx
je 0x4049f8
cmp dword [ebp - 0x218], ebx
je 0x4049f1
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x404abb
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x404a1c
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
call fcn.0040498a
mov dword [ebp - 0x224], eax
cmp eax, ebx
jne 0x404a85
lea eax, [ebp - 0x22c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x100
call edi
test eax, eax
je 0x404a00
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x218], ebx
je 0x404a67
push dword [ebp - 0x218]
call edi
mov dword [ebp - 0x218], ebx
mov eax, dword [esi + 8]
push dword [ebp - 0x220]
mov dword [ebp - 0x214], ebx
push dword [esi]
cmp eax, ebx
je 0x404aa1
mov esi, eax
call fcn.004042cb
jmp 0x404aa7
cmp dword [ebp - 0x218], ebx
je 0x404a99
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x224]
jmp 0x404abb
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
cmp dword [ebp - 0x218], ebx
je 0x404ab9
push dword [ebp - 0x218]
call edi
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004161d1
leave
ret 4
Function at 0x404d93
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
push 2
push esi
push eax
mov edi, edx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x408], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x40c], eax
cmp eax, esi
jne 0x404de5
call fcn.004041d9
mov esi, eax
jmp 0x404eaa
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x404dfe
call fcn.004041d9
jmp 0x404e9c
push edi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, esi
je 0x404df4
push edi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x404e2e
mov esi, 0x8007000e
jmp 0x404e9e
push 2
push eax
call fcn.00412507
pop ecx
pop ecx
cmp eax, 0x400
jbe 0x404e4e
push eax
lea eax, [ebp - 0x408]
push eax
call fcn.00411380
jmp 0x404e5a
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], esi
je 0x404e27
push edi
push dword [ebp - 0x408]
push edi
push ebx
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x404df4
mov edx, dword [ebp - 0x408]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x408]
lea edx, [ebp - 0x414]
call fcn.0040584f
mov esi, eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x404ec3
lea eax, [ebp - 0x408]
call fcn.004108de
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004161d1
leave
ret 0xc
Function at 0x405fe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004161e0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x406043
cmp dword [ebp - 0x114], 5
jae 0x40603f
cmp dword [ebp - 0x114], 4
jne 0x406043
cmp dword [ebp - 0x110], 0x5a
jb 0x406043
xor eax, eax
jmp 0x406046
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004161d1
leave
ret
Function at 0x40946e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x14]
lea esi, [ebx + 0x1e0]
call fcn.0040642d
cmp dword [ebx + 0x58], 0xffffffff
jle 0x4094e5
cmp byte [ebx + 0x322], 2
jb 0x4094e5
lea eax, [ebx + 0x354]
lea edi, [ebx + 0x204]
call fcn.00403316
lea eax, [ebx + 0x358]
lea edi, [ebx + 0x208]
call fcn.00403316
jmp 0x409504
mov edi, 0x42c8e4
push edi
lea eax, [ebx + 0x204]
push eax
call fcn.004028bb
push edi
lea eax, [ebx + 0x208]
push eax
call fcn.004028bb
push 1
push 0
push dword [ebx + 0x1e0]
mov dword [ebx + 0x200], 3
call dword [sym.imp.USER32.dll_InvalidateRect]
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004019ee
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004161d1
leave
ret
Function at 0x40aca8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push edi
xor edi, edi
cmp dword [0x4365a0], edi
sete al
mov dword [0x4365a0], eax
cmp eax, edi
je 0x40adda
lea eax, [ebx + 0x364]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
call esi
push 1
mov dword [ebp - 0x54], eax
call esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0x1b8]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call esi
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x24]
lea esi, [ebx + 0x390]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], edi
mov dword [ebx + 0x394], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], 0x2c
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x48], 1
mov dword [ebx + 0x398], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
lea edi, [ebp - 0x34]
add eax, dword [ebp - 0x58]
mov dword [ebx + 0x39c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebx + 4]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SetWindowPlacement]
push 0
push 0x26
push 0xf2
push 8
push 8
push dword [ebx + 4]
push dword [ebx + 0x1b0]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [ebx + 0x1b0]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 0x1b0]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push 0x9c4
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x40ae0b
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push edi
push dword [ebx + 0x1b0]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebx + 0x364]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowPlacement]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004161d1
leave
ret
Function at 0x40e0ef
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and dword [ebx], 0
push esi
mov esi, eax
mov eax, dword [esi + 0xa8]
cmp eax, 0x12
je 0x40e11d
cmp eax, 0x79
jne 0x40e114
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x40e11d
cmp dword [esi + 0xa8], 0x20
jne 0x40e18f
cmp dword [ebp + 8], 0xf100
jne 0x40e18f
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x40e14c
mov eax, esi
call fcn.0041025f
push 0
push 0xffffffffffffffff
push 0x448
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40e18f
mov eax, dword [esi + 0xa8]
cmp eax, 0x20
je 0x40e18f
test byte [esi + 0x84], 0x40
jne 0x40e184
mov al, byte [esi + 0x85]
test al, 2
je 0x40e179
test al, 4
jne 0x40e179
test al, 8
je 0x40e179
mov al, 1
call fcn.004102dd
push edi
mov edi, esi
call fcn.00410238
pop edi
jmp 0x40e189
cmp eax, 0x20
je 0x40e18f
mov dword [ebx], 1
and byte [esi + 0x84], 0xbf
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x41032b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
push edi
mov byte [ebp - 1], 1
cmp cl, 0xc
jne 0x410375
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
jmp 0x41039c
shr eax, 2
test al, 1
je 0x4103a5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4103d8
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x28]
push 0x42e964
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x4103d7
or byte [esi + 0x58], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
mov al, byte [ebp - 1]
pop edi
leave
ret

Function at 0x4161d1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433024]
jne 0x4161db
repz ret
jmp fcn.00418ede

Function at 0x418ef2
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x435738], eax
mov dword [0x435734], ecx
mov dword [0x435730], edx
mov dword [0x43572c], ebx
mov dword [0x435728], esi
mov dword [0x435724], edi
mov word [0x435750], ss
mov word [0x435744], cs
mov word [0x435720], ds
mov word [0x43571c], es
mov word [0x435718], fs
mov word [0x435714], gs
pushfd
pop dword [0x435748]
mov eax, dword [ebp]
mov dword [0x43573c], eax
mov eax, dword [ebp + 4]
mov dword [0x435740], eax
lea eax, [ebp + 8]
mov dword [0x43574c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x435688], 0x10001
mov eax, dword [0x435740]
mov dword [0x43563c], eax
mov dword [0x435630], 0xc0000409
mov dword [0x435634], 1
mov eax, dword [0x433024]
mov dword [ebp - 0x328], eax
mov eax, dword [0x433028]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x435680], eax
push 1
call fcn.0041e880
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x42a758
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x435680], 0
jne 0x418fd0
push 1
call fcn.0041e880
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret