joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e640
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], ecx
cmp dword [edi], ebx
jae 0x40e660
pop edi
mov eax, 0xea
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x10]
mov edx, ebx
push ebx
push dword [ebp + 8]
call fcn.00406f20
push eax
call fcn.00407000
add esp, 0xc
mov dword [ebp + 0xc], ebx
lea eax, [ebp + 0xc]
push dword [edi]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
push 0
push 1
push dword [0x44c6ac]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x40e6a9
call fcn.00407210
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40e6c0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebx], edi
jae 0x40e6e0
pop edi
mov eax, 0xea
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x10]
mov edx, edi
push edi
push dword [ebp + 8]
call fcn.00406f20
push eax
call fcn.00407000
add esp, 0xc
mov dword [ebp + 0xc], edi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
push 0
push 1
push dword [0x44c6ac]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x40e727
call fcn.00407210
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40efd0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
lea edx, [ecx + 0x10]
push edi
lea ecx, [esi + 0xc]
mov dword [esi], 0x208
mov dword [esi + 4], 0x660e
mov dword [esi + 8], 0x10
test ecx, ecx
je 0x40f01f
test edx, edx
je 0x40f012
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
jmp 0x40f02f
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
call fcn.0042a4e5
mov dword [eax], 0x16
call fcn.0042a011
mov edi, dword [ebp + 8]
push 0xf0000000
push 0x18
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40f059
call fcn.00407210
test eax, eax
jns 0x40f059
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
push dword [ebp + 0xc]
push 0
push dword [0x44c6b0]
push 0x1c
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x40f083
call fcn.00407210
not eax
pop edi
shr eax, 0x1f
pop esi
pop ebp
ret 0xc
xor eax, eax
not eax
pop edi
shr eax, 0x1f
pop esi
pop ebp
ret 0xc
Function at 0x410300
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x30
mov esi, ecx
push 0
push esi
call fcn.00423450
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
mov edi, 0x30
call fcn.00423450
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x410364
cmp dword [ebp - 0x114], 6
jae 0x410369
mov edi, 0x2c
mov ecx, dword [ebp + 0x14]
mov dword [esi], edi
mov dword [esi + 4], 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x41039a
mov eax, dword [ecx]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x1c], eax
mov eax, dword [0x44b9b8]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x20], eax
xor ecx, ebp
mov eax, dword [ebp + 0x18]
pop edi
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0
pop esi
pop ebx
call fcn.00420347
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4124a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov ecx, dword [edi + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x4124f9
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [edi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call esi
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
shr ecx, 2
test cl, 1
je 0x412531
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
movzx ecx, si
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push dword [edi + 0x28]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x412562
or byte [edi + 0x58], 2
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412be0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436e30
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x40]
mov dword [esi], vtable.CAsyncRequest.0
call fcn.0040b090
mov edx, dword [esi + 0x3c]
or edi, 0xffffffff
sub edx, 0x10
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412c31
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x24]
call fcn.00413040
lea ecx, [esi + 0xc]
call fcn.00412f80
mov edx, dword [esi + 8]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x412c59
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 4]
mov dword [esi], vtable.CAsyncWorker.0
test eax, eax
je 0x412c91
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x412c81
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412e80
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437f50
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.application_x_www_form_urlencoded
push str.Content_Type
lea ecx, [esi + 0x40]
mov dword [ebp - 4], 1
call fcn.0040afa0
lea eax, [ebp + 8]
lea ecx, [esi + 8]
push eax
call fcn.004085c0
lea eax, [ebp + 0xc]
lea ecx, [esi + 0x3c]
push eax
call fcn.004085c0
mov eax, dword [esi + 4]
test eax, eax
je 0x412f08
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x412ef8
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
push 0
push 0
push esi
push 0x406f00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
or esi, 0xffffffff
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412f40
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x412f5f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x413250
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
mov dword [esi + 0x24], 0
call edi
shr eax, 0xe
and eax, 2
or dword [esi + 0x24], eax
push 0x10
call edi
shr eax, 0xd
and eax, 4
or dword [esi + 0x24], eax
push 0x12
call edi
shr eax, 0xf
and eax, 1
or dword [esi + 0x24], eax
push 0x5b
call edi
mov ebx, 0x8000
test bx, ax
jne 0x4132a0
push 0x5c
call edi
test bx, ax
je 0x4132a4
or dword [esi + 0x24], 8
pop edi
pop esi
pop ebx
ret
Function at 0x4132b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test bl, bl
je 0x4132cb
cmp edi, 0x2c
jne case.0x41334b.16
push 0x11
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xe
and eax, 2
or dword [esi + 0x24], eax
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xd
and eax, 4
or dword [esi + 0x24], eax
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and eax, 1
or dword [esi + 0x24], eax
push 0x5b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x413334
push 0x5c
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x413334
xor eax, eax
jmp 0x413339
mov eax, 8
or dword [esi + 0x24], eax
lea eax, [edi - 0x10]
cmp eax, 0x4c
ja case.0x41334b.19
movzx eax, byte [eax + 0x4133ac]
jmp dword [eax*4 + 0x4133a4]
mov dword [esi + 0x28], edi
test bl, bl
je 0x413366
cmp dword [esi + 0x28], 0
jne 0x413366
mov ecx, esi
call fcn.00413250
push dword [esi + 0x28]
mov edx, dword [esi + 0x24]
lea ecx, [ebp + 0xc]
call fcn.00414e10
add esp, 4
push dword [eax]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
pop edi
pop esi
pop ebx
test eax, eax
jg 0x4133a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
pop ebp
ret 8
Function at 0x413ac0
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437fd0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x41f
push dword [ebx + 4]
call esi
push 0x41e
push dword [ebx + 4]
mov dword [ebx + 0x58], eax
call esi
push 0x419
push dword [ebx + 4]
mov dword [ebx + 0x5c], eax
call esi
push 0x41b
push dword [ebx + 4]
mov dword [ebx + 0x60], eax
call esi
push 0x41d
push dword [ebx + 4]
mov dword [ebx + 0x64], eax
call esi
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x43f0f8
mov dword [ebx + 0x68], eax
call fcn.004075c0
push ecx
mov ecx, esp
mov dword [ebp - 4], 0
push str.UploadFormat
call fcn.004075c0
mov ecx, 1
mov dword [ebp - 4], 0xffffffff
call fcn.0040c3c0
add esp, 8
mov ecx, ebx
push eax
call fcn.00413990
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x43f0f8
call fcn.004075c0
push ecx
mov ecx, esp
mov dword [ebp - 4], 1
push str.JpegQuality
call fcn.004075c0
mov ecx, 0x5a
mov dword [ebp - 4], 0xffffffff
call fcn.0040c3c0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 8
mov edi, 0x5a
lea ecx, [eax - 0x32]
push 0x640032
push 1
push 0x406
push dword [ebx + 0x64]
cmp ecx, 0x32
cmovbe edi, eax
call esi
push edi
push 1
push 0x405
push dword [ebx + 0x64]
call esi
push edi
mov ecx, ebx
call fcn.00413a10
push 0
push 3
push 0xc5
push dword [ebx + 0x68]
call esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x440e58
call fcn.004075c0
push ecx
mov ecx, esp
mov dword [ebp - 4], 2
push str.__screenshot_app.options.uploadformat__
call fcn.004075c0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.00409de0
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [eax]
push dword [ebx + 0x58]
call edi
mov edx, dword [ebp - 0x10]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413c4f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.JPEG_quality
call fcn.004075c0
push ecx
mov ecx, esp
mov dword [ebp - 4], 3
push str.__screenshot_app.options.jpegquality__
call fcn.004075c0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.00409de0
push dword [eax]
push dword [ebx + 0x5c]
call edi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x413ca2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x414d40
Capabilities:
Log keystrokes

Disassembly:
push esi
mov esi, ecx
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
add esi, 0xffffffed
cmp esi, 0x7d
ja case.0x414d5b.20
movzx ecx, byte [esi + 0x414d90]
jmp dword [ecx*4 + 0x414d80]
or eax, 0x100
shl eax, 0x10
pop esi
ret
mov eax, 0x137
shl eax, 0x10
pop esi
ret
mov eax, 0x45
shl eax, 0x10
pop esi
ret
Function at 0x414e10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438191
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00406c60
mov ecx, eax
test ecx, ecx
jne 0x414e62
push 0x80004005
call fcn.00406fc0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
test bl, 2
je 0x414e8d
push 7
push 0x441364
mov ecx, edi
call fcn.00407c70
test bl, 4
je 0x414ea0
push 8
push str.Shift_
mov ecx, edi
call fcn.00407c70
test bl, 1
je 0x414eb3
push 6
push str.Alt_
mov ecx, edi
call fcn.00407c70
test bl, 8
je 0x414ec6
push 6
push str.Win_
mov ecx, edi
call fcn.00407c70
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x414f6d
call fcn.00406c60
mov ecx, eax
test ecx, ecx
jne 0x414ee6
push 0x80004005
call fcn.00406fc0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x64
or eax, ecx
jge 0x414f17
push 0x64
lea ecx, [ebp - 0x10]
call fcn.004079c0
mov esi, dword [ebp - 0x10]
push 0x64
push esi
mov ecx, ebx
call fcn.00414d40
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push dword [esi - 8]
push esi
call fcn.0042a1ae
add esp, 8
test eax, eax
js 0x414f81
cmp eax, dword [esi - 8]
jg 0x414f81
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov ecx, edi
push dword [esi - 0xc]
push esi
call fcn.00407c70
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x414f6d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00406fc0
int3
Function at 0x418150
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x44a00c]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push esi
push edi
push eax
push edx
push dword [ecx]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0040bf50
mov esi, eax
test esi, esi
jne 0x418247
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x418219
lea esp, [esp]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00418150
mov esi, eax
test esi, esi
jne 0x418247
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x4181e0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x418230
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
call fcn.00418070
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x418256
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00420347
mov esp, ebp
pop ebp
ret 4
Function at 0x4186c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438886
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x41876c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x41876c
call fcn.00407210
mov esi, eax
jmp 0x41885c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41878f
call fcn.00407210
jmp 0x41884f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4187ad
call fcn.00407210
jmp 0x41884f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4187ce
mov esi, 0x8007000e
jmp 0x418851
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0041a570
jmp 0x4187f8
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x41880f
mov esi, 0x8007000e
jmp 0x418851
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x41882f
call fcn.00407210
jmp 0x41884f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00419590
mov esi, eax
test edi, edi
je 0x41885c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x418880
lea ecx, [ebp - 0x418]
call fcn.0041a670
jmp 0x418880
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00420347
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ad60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x41addc
mov esi, dword [ebp + 8]
mov ecx, 1
mov eax, dword [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x41ad95
push edi
mov ecx, esi
call fcn.004079c0
push edi
push dword [esi]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x41adbd
mov ecx, dword [esi]
test ecx, ecx
je 0x41adc1
push dword [ecx - 8]
push ecx
call fcn.0042a1ae
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x41addc
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x41addc
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.00406fc0
int3

Function at 0x41adf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x41af67
mov eax, dword [ebp + 0xc]
cmp eax, 0x110
jne 0x41ae45
mov eax, dword [esi + 0x18]
sub esp, 8
mov ecx, esp
mov dword [eax + 0x20], 1
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov ecx, esi
call fcn.0041b3f0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, dword [esi + 0x18]
cmp dword [eax + 0x20], 0
je 0x41af67
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
cmp eax, 0x111
jne 0x41af3e
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov edi, ebx
shr edi, 0x10
cmp ax, di
jne 0x41ae8a
mov eax, 0x40c
cmp ax, bx
jne 0x41ae8a
mov eax, dword [esi + 0x18]
mov dword [eax + 0x20], 1
call fcn.0041bb10
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, dword [esi + 0x18]
cmp dword [eax + 0x20], 0
jne 0x41ae39
xor eax, eax
cmp ax, di
jne 0x41aec2
mov eax, 0x40d
cmp ax, bx
jne 0x41aec2
mov eax, dword [esi + 0x18]
mov ecx, esi
mov dword [eax + 0x20], 1
call fcn.0041bb10
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, dword [esi + 0x18]
cmp dword [eax + 0x20], 0
jne 0x41ae39
xor eax, eax
cmp ax, di
jne 0x41aefa
mov eax, 0x40e
cmp ax, bx
jne 0x41aefa
mov eax, dword [esi + 0x18]
mov ecx, esi
mov dword [eax + 0x20], 1
call fcn.0041bb10
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, dword [esi + 0x18]
cmp dword [eax + 0x20], 0
jne 0x41ae39
xor eax, eax
cmp ax, di
jne 0x41af67
mov eax, 0x429
cmp ax, bx
jne 0x41af67
mov eax, dword [esi + 0x18]
push 1
push 0
push str.shell32.dll_Control_RunDLL_inetcpl.cpl__4
push str.rundll32.exe
push str.open
push 0
mov dword [eax + 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
jmp 0x41ae2c
cmp eax, 0x4e
jne 0x41af67
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 1
push eax
push dword [ebp + 0x14]
sub esp, 8
call fcn.0041bd40
mov ecx, dword [ebp + 0x18]
cmp dword [ebp + 0x10], 0
mov dword [ecx], eax
jmp 0x41ae33
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18