joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426fce
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push edi
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov ax, word [0x44bd88]
mov word [ebp - 0x208], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.DumpFailedJobCreationSQL___n
call fcn.004303d5
add esp, 4
cmp dword [ebp + 8], 0
je 0x427023
cmp dword [ebp + 0xc], 0
jne 0x427028
jmp 0x4270b0
mov ecx, dword [ebp + 8]
push ecx
push 0x44da74
push str._sTempCreateJob_s.SQL
lea edx, [ebp - 0x208]
push edx
mov eax, dword [0x44df4c]
call dword [eax + 0x4cc]
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SQLUNIRL.dll__CreateFile_28]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
je 0x4270b0
push 0
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
shl eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x42a88c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x218], 0
mov ax, word [0x44bee0]
mov word [ebp - 0x214], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 1
push str.SQLServerAgentJobListJobIDMemory
push 0x100
lea edx, [ebp - 0x214]
push edx
call fcn.00421862
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
push 0
push 4
mov ecx, dword [0x44df4c]
call dword [ecx + 0x354]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42a966
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x42a95c
push 0x10
mov eax, dword [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042a98b
add esp, 8
mov ecx, dword [0x44df0c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42f330
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x10c], 0
mov ax, word [0x44bfdc]
mov word [ebp - 0x100], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xfe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x108], 0
cmp dword [0x44b08c], 0
je 0x42f4bd
mov ecx, dword [0x44b0bc]
and ecx, 0x200
test ecx, ecx
jne 0x42f398
jmp 0x42f4d2
call fcn.0041e4ea
test eax, eax
jne 0x42f3a6
jmp 0x42f4d2
push 0x44997c
push 0x44b4f4
push 0x81
push 0
push 4
call fcn.0041bfab
add esp, 0x14
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.W95SCM_s
lea ecx, [ebp - 0x100]
push ecx
mov edx, dword [0x44df4c]
call dword [edx + 0x4cc]
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
push 8
push 0
push 4
mov ecx, dword [0x44c148]
push ecx
push 0xffffffffffffffff
mov edx, dword [0x44df4c]
call dword [edx + 0x9c]
mov dword [ebp - 0x108], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xb7
jne 0x42f427
jmp 0x42f4d2
cmp dword [ebp - 0x108], 0
je 0x42f4bb
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x44bfd4], eax
cmp dword [0x44bfd4], 0
jne 0x42f459
jmp 0x42f4d2
push 0
push 0
push 0
push 2
call fcn.0042f8a6
add esp, 0x10
push 0
push 0
push 0x42f528
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x42f482
jmp 0x42f4d2
call fcn.0041eb62
test eax, eax
jne 0x42f48d
jmp 0x42f4d2
call fcn.0041fa32
test eax, eax
jne 0x42f498
jmp 0x42f4d2
push 0xffffffffffffffff
mov ecx, dword [0x44df00]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xf
call fcn.0040ff36
add esp, 4
mov dword [ebp - 0x104], 1
jmp 0x42f4d2
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x44df4c]
call dword [eax + 0x47c]
mov dword [ebp - 0x104], eax
call fcn.0042fad3
cmp dword [0x44bfd4], 0
je 0x42f507
push 0
push 0
push 0
push 1
call fcn.0042f8a6
add esp, 0x10
mov ecx, dword [0x44bfd4]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x44bfd4], 0
cmp dword [ebp - 0x108], 0
je 0x42f51d
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x104]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x431670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x431689
cmp dword [ebp + 0xc], 0
jne 0x43168d
xor eax, eax
jmp 0x4316e6
mov eax, dword [ebp + 8]
mov word [eax], 0
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4316e4
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x4316e4
mov eax, dword [ebp + 8]
jmp 0x4316e6
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4323ba
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438500
push 0x4321d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x44df50], 0xffffffff
or dword [0x44df54], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x44c02c]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x44c028]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x44df58], eax
call fcn.00432509
cmp dword [0x44a5f0], 0
jne 0x43243d
push 0x432506
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.004324ee
push 0x43a00c
push 0x43a008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x44c024]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x44c020]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___wgetmainargs]
push 0x43a004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___winitenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.0041d3f0
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x432b99
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438520
push 0x4321d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffdc8
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x432be6
jmp 0x432d12
mov word [ebp - 0x244], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x242]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x248], 0x105
push 0x44a6a4
call sub.MSVCRT.dll_wcslen
add esp, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x248]
push eax
lea ecx, [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x432c96
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x248]
jae 0x432c96
lea eax, [ebp - 0x244]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
mov ecx, dword [ebp - 0x34]
lea edx, [eax + ecx + 2]
cmp edx, dword [ebp - 0x248]
ja 0x432c96
push 0x44a6c0
lea eax, [ebp - 0x244]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 8
push 0x44a6c4
lea ecx, [ebp - 0x244]
push ecx
call sub.MSVCRT.dll_wcscat
add esp, 8
lea edx, [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x432c9e
jmp 0x432d12
push str.NetServerGetInfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
push 0x44a6f4
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x1c], 0
je 0x432cce
cmp dword [ebp - 0x30], 0
jne 0x432cd0
jmp 0x432d12
cmp dword [ebp + 8], 0
jne 0x432ce6
lea edx, [ebp - 0x2c]
push edx
push 0x65
push 0
call dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
jmp 0x432cf6
lea eax, [ebp - 0x2c]
push eax
push 0x65
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x432cfe
jmp 0x432d12
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x10]
and eax, 0x10
test eax, eax
je 0x432d12
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00432d20
jmp 0x432d5a
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x84
push 0
push 0x4157cc
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x4157d0], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4157cc], eax
mov eax, 0x4143b4
mov dword [0x415808], eax
call fcn.0040dfa0
call fcn.0040bfac
call fcn.0040b2d0
call fcn.0040add3
call fcn.0040a700
call fcn.0040a37b
call fcn.0040a324
call fcn.0040a0f0
call fcn.0040a0d8
call fcn.0040a04f
call fcn.004097aa
call fcn.004088a1
call fcn.0040708c
call fcn.0040546f
call fcn.00404c59
call fcn.004040b3
mov edx, str.ygdiplus.dll
lea ecx, [0x415810]
call fcn.00404008
mov edx, str.AutoStart.ini
lea ecx, [0x41582c]
call fcn.00404008
mov dword [0x415820], 0
call fcn.00403026
push 0x1f4
lea eax, [0x402469]
push eax
call fcn.00404101
mov dword [0x4157f8], eax
call fcn.004089e2
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x40110a
call fcn.0040ae9c
push eax
mov ebx, dword [0x415828]
cmp ebx, dword [esp]
jne 0x401104
call fcn.0040295f
pop eax
jmp 0x401199
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x40115f
call fcn.0040aeab
push eax
mov ebx, dword [0x4157dc]
cmp ebx, dword [esp]
jne 0x40113c
mov ebx, dword [0x4157d4]
and ebx, ebx
jne 0x40113a
push dword [0x4157fc]
call fcn.0040510a
jmp 0x40115c
mov ebx, dword [0x4157e0]
cmp ebx, dword [esp]
jne 0x40115c
mov ebx, dword [0x4157d4]
and ebx, ebx
jne 0x40115c
push dword [0x41582c]
call fcn.00402998
pop eax
jmp 0x401199
mov ebx, 0x3334
cmp ebx, dword [esp]
jne 0x40117d
call fcn.0040ae9c
push eax
mov ebx, dword [0x415828]
cmp ebx, dword [esp]
jne 0x40117a
pop eax
jmp 0x401199
mov ebx, 0x333e
cmp ebx, dword [esp]
jne 0x401199
call fcn.0040ae9c
push eax
mov ebx, dword [0x415828]
cmp ebx, dword [esp]
jne 0x401198
pop eax
pop eax
jmp 0x4010de

Function at 0x4023d8
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
push eax
mov eax, dword [esp + 0x10]
mov dword [0x415f5c], eax
mov dword [esp], 0
push dword [0x415f5c]
push dword [0x415f5c]
push 0x10e
call fcn.00404200
lea eax, [esp + 8]
push eax
call fcn.0040e020
lea eax, [esp]
push eax
push dword [esp + 0x10]
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov eax, dword [esp + 4]
push eax
push dword [esp + 4]
call sub.SHELL32.DLL_SHGetPathFromIDListW
push dword [0x415f5c]
push dword [0x415f5c]
push dword [esp + 0xc]
call fcn.00404320
pop eax
add eax, dword [0x414404]
jmp 0x40245a
push dword [esp + 4]
call fcn.0040e0a0
add esp, 8
ret 4
Function at 0x402bc1
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402bc8
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00404000
mov edx, dword [esp + 0x34]
lea ecx, [esp + 4]
call fcn.00404000
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
call fcn.00404000
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0xc]
call fcn.00404000
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x10]
call fcn.00404000
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x14]
call fcn.00404000
push 0
call sub.OLE32.DLL_CoInitialize
lea eax, [esp + 0x18]
push eax
mov ebp, 0x4143d4
push ebp
push 1
push 0
mov ebp, 0x4143b4
push ebp
call sub.OLE32.DLL_CoCreateInstance
mov ebx, eax
and ebx, ebx
jne 0x402d3c
sub esp, 4
push dword [esp + 4]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0xc]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
push eax
pop eax
add esp, 4
push dword [esp + 0x44]
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
push 0
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x34]
sub esp, 4
push dword [esp + 0x50]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
push eax
pop eax
add esp, 4
lea eax, [esp + 0x1c]
push eax
mov ebp, 0x4143c4
push ebp
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax]
mov ebx, eax
and ebx, ebx
jne 0x402d32
sub esp, 4
push 1
push dword [esp + 0xc]
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
push eax
pop eax
add esp, 4
mov ebx, eax
and ebx, ebx
jne 0x402d28
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 8]
call sub.OLE32.DLL_CoUninitialize
mov eax, dword [esp + 0x20]
jmp 0x402d49
push dword [esp + 8]
call fcn.0040e0a0
push dword [esp + 0xc]
call fcn.0040e0a0
push dword [esp]
call fcn.0040e0a0
push dword [esp + 4]
call fcn.0040e0a0
push dword [esp + 0x10]
call fcn.0040e0a0
push dword [esp + 0x14]
call fcn.0040e0a0
add esp, 0x24
pop ebx
pop ebp
ret 0x20
Function at 0x404101
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
xor esi, esi
push esi
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0xc], eax
test eax, eax
je 0x404199
push ebx
push ebp
mov ebp, 0x415f60
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x415858]
mov ebx, 0x415858
test esi, esi
je 0x404171
push edi
push 0
lea edi, [esi + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40416a
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi]
push edi
push ebx
call fcn.0040dec0
pop ecx
pop ecx
jmp 0x40416c
mov esi, dword [esi]
test esi, esi
jne 0x404144
pop edi
mov esi, dword [0x414408]
inc dword [0x414408]
push 0x10
push ebx
call fcn.0040df00
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
push ebp
mov dword [eax], ecx
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 8

Function at 0x40419f
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0
push esi
call fcn.00404046
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, 0x415f60
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x415858]
jmp 0x4041ce
cmp dword [eax + 0xc], esi
je 0x4041d4
mov eax, dword [eax]
test eax, eax
jne 0x4041c7
jmp 0x4041ec
lea esi, [eax + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x415858
call fcn.0040dec0
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
ret 4
Function at 0x406fe3
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 1
jne 0x407005
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_send]
jmp 0x407044
push 2
pop eax
mov word [ebp - 0x10], ax
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], eax
movzx eax, word [esi + 8]
push eax
call dword [sym.imp.WSOCK32.DLL_htons]
mov word [ebp - 0xe], ax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40702c
mov eax, dword [eax]
jmp 0x40702f
mov eax, dword [esi + 0x10]
push 0x10
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WSOCK32.DLL_sendto]
pop esi
leave
ret 0xc

Function at 0x407d77
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x415fe8]
call fcn.0040d81b
mov edi, eax
test edi, edi
je 0x407ddb
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x407da0
push dword [esp + 0xc]
push edi
call eax
jmp 0x407ddb
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthW]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.0040e270
mov ebx, eax
xor eax, eax
mov word [ebx], ax
lea eax, [esi + 1]
push eax
push ebx
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextW]
push ebx
call sub.MSVCRT.dll_wcslen
pop ecx
sub esi, eax
push esi
call fcn.0040e3a0
pop esi
pop ebx
pop edi
ret 8

Function at 0x409529
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
mov bl, pe_nt_image_headers32
test edi, edi
je 0x4095a5
push 9
call esi
test bl, al
je 0x4095a5
push 0x11
call esi
test bl, al
jne 0x4095a5
push 0x10
call esi
test bl, al
jne 0x4095a5
push 0x12
call esi
test bl, al
jne 0x4095a5
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x4095a5
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x4095a5
xor eax, eax
jmp 0x409627
push ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x4095ce
push 0x11
call esi
test bl, al
jne 0x4095c6
push 0x10
call esi
test bl, al
jne 0x4095c6
push 0x12
call esi
test bl, al
je 0x4095ce
push 1
push ebp
call fcn.004094e2
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test edi, edi
je 0x4095e4
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x409624
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x409624
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x409624
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x409624
dec esi
push esi
push dword [0x415ff4]
call fcn.0040d81b
test eax, eax
je 0x409624
mov eax, dword [eax + 8]
jmp 0x409626
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4097aa
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edi, edi
mov dword [0x415cd4], eax
cmp eax, edi
je 0x4097db
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x415cd8], eax
lea eax, [ebp - 0x114]
push eax
mov dword [0x415cd0], 1
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40982b
cmp dword [ebp - 0x104], 1
je 0x40983c
cmp dword [ebp - 0x104], 2
jne 0x40982b
cmp dword [ebp - 0x110], 5
jb 0x40983c
jne 0x40982b
cmp dword [ebp - 0x10c], edi
jne 0x40982b
mov dword [0x415cd0], edi
cmp dword [0x415cd0], edi
je 0x409842
call fcn.004096f1
test eax, eax
jne 0x409842
mov dword [0x415cd0], edi
pop edi
leave
ret

Function at 0x40a640
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x40a675
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x9756164
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2f6e303a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219