joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40159e
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x4015b5
cmp dword [eax], 7
jne 0x4015b5
add eax, 8
jmp 0x4015b7
xor eax, eax
cmp eax, ebx
jne 0x4015c3
push 0xfffffffffffffff0
pop eax
jmp 0x40168b
mov eax, dword [eax]
add eax, ecx
push esi
cmp eax, ebx
je 0x4015d6
cmp dword [eax], 2
jne 0x4015d6
lea esi, [eax + 8]
jmp 0x4015d8
xor esi, esi
cmp esi, ebx
jne 0x4015e0
push 0xffffffffffffffef
jmp 0x401650
push edi
push 0x44
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.0040c7b0
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esi, 4
push esi
push str.executing:__s_n
stosd dword es:[edi], eax
call fcn.00405f61
call fcn.00405bc6
add eax, 0x20
push eax
call fcn.00405f05
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
test eax, eax
jne 0x401653
push str.execution_failed
call fcn.00406026
call fcn.00405bc6
add eax, 0x20
push eax
call fcn.00405f05
pop ecx
pop ecx
push 0xffffffffffffffee
pop eax
jmp 0x40168a
push str.execution_succeeded.
call fcn.00406026
call fcn.00405bc6
add eax, 0x20
push eax
call fcn.00405f05
pop ecx
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x405a65
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4163f4]
jne 0x405a6f
repz ret
jmp fcn.0040681d

Function at 0x40cf55
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040aa41
and dword [ebp - 4], 0
cmp dword [0x417a6c], 0
mov ebx, eax
jne 0x40d006
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d0b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40d0b7
push eax
call fcn.0040a9cf
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x417a6c], eax
call esi
push eax
call fcn.0040a9cf
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x417a70], eax
call esi
push eax
call fcn.0040a9cf
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x417a74], eax
call esi
push eax
call fcn.0040a9cf
pop ecx
mov dword [0x417a7c], eax
test eax, eax
je 0x40d006
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a9cf
pop ecx
mov dword [0x417a78], eax
mov eax, dword [0x417a78]
cmp eax, ebx
je 0x40d05e
cmp dword [0x417a7c], ebx
je 0x40d05e
push eax
call fcn.0040aa4a
push dword [0x417a7c]
mov esi, eax
call fcn.0040aa4a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d05e
test edi, edi
je 0x40d05e
call esi
test eax, eax
je 0x40d055
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d055
test byte [ebp - 0xc], 1
jne 0x40d05e
or dword [ebp + 0x10], 0x200000
jmp 0x40d097
mov eax, dword [0x417a70]
cmp eax, ebx
je 0x40d097
push eax
call fcn.0040aa4a
pop ecx
test eax, eax
je 0x40d097
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d097
mov eax, dword [0x417a74]
cmp eax, ebx
je 0x40d097
push eax
call fcn.0040aa4a
pop ecx
test eax, eax
je 0x40d097
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x417a6c]
call fcn.0040aa4a
pop ecx
test eax, eax
je 0x40d0b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d0b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434004]
jne 0x401010
repz ret
jmp fcn.004016df

Function at 0x406568
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004023d2
and dword [ebp - 4], 0
cmp dword [0x4360bc], 0
mov ebx, eax
jne 0x406619
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4066ca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4066ca
push eax
call fcn.00402360
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4360bc], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4360c0], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4360c4], eax
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4360cc], eax
test eax, eax
je 0x406619
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4360c8], eax
mov eax, dword [0x4360c8]
cmp eax, ebx
je 0x406671
cmp dword [0x4360cc], ebx
je 0x406671
push eax
call fcn.004023db
push dword [0x4360cc]
mov esi, eax
call fcn.004023db
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406671
test edi, edi
je 0x406671
call esi
test eax, eax
je 0x406668
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406668
test byte [ebp - 0xc], 1
jne 0x406671
or dword [ebp + 0x10], 0x200000
jmp 0x4066aa
mov eax, dword [0x4360c0]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4066aa
mov eax, dword [0x4360c4]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4360bc]
call fcn.004023db
pop ecx
test eax, eax
je 0x4066ca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4066cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e6f3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x444024]
push dword [0x443d40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x42e7f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ebx, 0x19f
jne 0x42e80d
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x42e831
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.0042e7ee
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x42e815
pop esi
pop edi
cmp ebx, 0x2d
jne 0x42e848
or dword [0x444034], 0xffffffff
mov dword [0x444030], 0xa62e7790
leave
ret
Function at 0x402710
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
cmp eax, 0x201
ja 0x4027a0
je 0x402784
mov ecx, eax
sub ecx, 0xf
je 0x402768
sub ecx, 1
je 0x402757
sub ecx, 0x1f0
jne 0x4027b9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
mov ebx, 0x200
call fcn.00402850
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 8]
call fcn.004030d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ecx
push edx
push 0xf
push eax
call fcn.00415c60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push 0x201
call fcn.00402960
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x202
je 0x40282e
cmp eax, 0x806b
je 0x402813
cmp eax, 0x80ff
je 0x4027d8
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 8]
mov esi, dword [edx + 4]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push eax
push 0x806b
push ecx
call fcn.00402a10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ecx, 0x202
call fcn.00402900
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4046e0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
mov al, 1
mov dword [esi], vtable.CAuntecBasedThread.0
mov byte [esi + 4], al
mov byte [esi + 5], al
lea eax, [esp]
push eax
push 4
push esi
push 0x42f690
push 0
push 0
call fcn.0044d9ae
mov ecx, dword [esp + 0x20]
add esp, 0x18
mov dword [esi + 8], eax
mov dword [esi], vtable.CBZReportThread.0
mov byte [esi + 0xc], 0
mov dword [esi + 0x10], ecx
test eax, eax
je 0x40472d
mov edx, dword [esi + 8]
push edx
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
pop ecx
ret 4

Function at 0x404760
Capabilities:
Resume thread
Terminate thread

Disassembly:
mov al, byte [esi + 4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov dword [esi], vtable.CBZReportThread.0
mov byte [esi + 0xc], 1
test al, al
je 0x404789
cmp dword [esi + 8], 0
je 0x404789
mov ecx, dword [esi + 8]
push ecx
mov byte [esi + 4], 0
call ebp
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4047ab
push 1
push eax
call edi
test eax, eax
je 0x4047ab
mov edx, dword [esi + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [esi + 8], 0
mov dword [esi], vtable.CAuntecBasedThread.0
je 0x4047e1
mov al, byte [esi + 4]
test al, al
je 0x4047c4
mov ecx, dword [esi + 8]
push ecx
call ebp
mov eax, dword [esi + 8]
test eax, eax
je 0x4047d0
push 0xffffffffffffffff
push eax
call edi
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
pop edi
pop ebp
ret
Function at 0x4059c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x46c238
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x487550]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.004042a0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x405a16
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00403e00
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.004042a0
cmp dword [esp + 0x24], 8
jb 0x405a5f
mov edx, dword [esp + 0x10]
push edx
call fcn.0044caf8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x4070e0
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46eb6b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x487550]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push esi
push edi
mov eax, dword [0x487550]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], esi
cmp eax, 0x200
ja 0x407260
je 0x40724a
cmp eax, 0x111
ja 0x40721a
je 0x407177
mov ecx, eax
sub ecx, 0xf
je 0x407165
sub ecx, 1
jne 0x4072b4
call fcn.00407b00
jmp 0x4072f5
mov eax, dword [ebp + 0x14]
push eax
push esi
push 0xf
push edi
call fcn.00415c60
jmp 0x4072f5
cmp si, 5
jne 0x407201
mov ecx, esi
shr ecx, 0x10
cmp ecx, 0x200
jne 0x407201
mov ebx, 5
mov eax, edi
call fcn.004159f0
mov ebx, eax
test ebx, ebx
je 0x407201
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x3e]
push eax
mov word [esp + 0x40], dx
call fcn.00452c80
mov edx, dword [ebx + 0x17c]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x18]
call fcn.004037f0
lea edx, [esp + 0x18]
mov ecx, edi
mov dword [esp + 0x250], 0
call fcn.00407320
lea esi, [esp + 0x18]
call fcn.00418c90
mov esi, dword [esp + 0x14]
mov eax, dword [ebp + 0x14]
mov ecx, dword [edi + 4]
push eax
push esi
push 0x111
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x4072f5
cmp eax, 0x133
jne 0x4072b4
push 0x1a1a1a
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xffffff
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x4072f5
mov ecx, dword [ebp + 0x14]
mov eax, esi
mov ebx, 0x200
mov esi, edi
call fcn.004076a0
jmp 0x4072f5
cmp eax, 0x806b
ja 0x4072ad
je 0x40729e
mov ecx, eax
sub ecx, 0x201
je 0x40728b
sub ecx, 1
jne 0x4072b4
mov ebx, dword [ebp + 0x14]
mov eax, esi
mov ecx, 0x202
mov esi, edi
call fcn.00407750
jmp 0x4072f5
mov ecx, dword [ebp + 0x14]
push 0x201
mov eax, esi
mov edx, edi
call fcn.004077b0
jmp 0x4072f5
push esi
push 0x806b
mov ecx, edi
call fcn.00407870
jmp 0x4072f5
cmp eax, 0x80ff
je 0x4072c6
mov edx, dword [ebp + 0x14]
push edx
push esi
push eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x4072f5
mov edi, dword [edi + 4]
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.0044c790
mov esp, ebp
pop ebp
ret 0x10
Function at 0x407e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46eadb
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x487550]
xor eax, esp
mov dword [esp + 0x83c], eax
push esi
mov eax, dword [0x487550]
xor eax, esp
push eax
lea eax, [esp + 0x848]
mov dword fs:[0], eax
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x4e]
push ecx
mov word [esp + 0x50], ax
call fcn.00452c80
mov edx, dword [edi + 4]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x18], 0x4783f8
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test eax, eax
je 0x407f8d
lea ecx, [esp + 0x44]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x407f77
xor edx, edx
lea eax, [esp + 0x44]
mov word [esp + 0x2c], dx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407f30
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x48]
lea esi, [esp + 0x2c]
call fcn.00403ee0
mov edx, esi
mov ecx, edi
mov dword [esp + 0x850], 0
call fcn.00407320
cmp dword [esp + 0x40], 8
jb 0x407f8d
mov eax, dword [esp + 0x2c]
push eax
call fcn.0044caf8
add esp, 4
jmp 0x407f8d
mov ecx, dword [edi + 4]
push 0
push 0x478408
push 0x478418
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0x848]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x83c]
xor ecx, esp
call fcn.0044c790
add esp, 0x84c
ret
Function at 0x409260
Capabilities:
Capture screenshot
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp esi, 0x201
ja 0x4092d2
je 0x4092b7
mov eax, esi
sub eax, 0xf
je 0x4092a8
sub eax, 1
je 0x40929e
sub eax, 0x1f0
jne 0x4092ea
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov ebx, 0x200
call fcn.00409370
pop esi
pop ebx
ret 0x10
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4092ea
pop esi
pop ebx
mov dword [esp + 8], 0xf
jmp fcn.00415c60
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push 0x201
call fcn.004098f0
pop esi
pop ebx
ret 0x10
cmp esi, 0x202
je 0x409353
cmp esi, 0x806b
je 0x409340
cmp esi, 0x80ff
je 0x409308
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [edx + 4]
push ecx
push esi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop esi
pop ebx
ret 0x10
mov ecx, dword [esp + 0xc]
mov esi, dword [ecx + 4]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
xor eax, eax
pop ebx
ret 0x10
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push edx
call fcn.004099c0
pop esi
pop ebx
ret 0x10
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov ecx, 0x202
call fcn.00410690
pop esi
pop ebx
ret 0x10

Function at 0x409420
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, 0x20019
lea eax, [esp + 0x10]
push eax
push edi
push 0
push str.SoftwareClasses.zxm
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x409487
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push eax
push eax
push eax
push eax
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x40947c
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
push esi
push esi
push esi
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x4094a3
cmp ebp, 0x80000002
jne 0x4094a3
cmp edi, 0x20019
jne 0x4094a3
mov edi, 0x20119
jmp 0x409436
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40ade2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
push ebx
push esi
cmp eax, 0x806e
ja 0x40ad64
je 0x40ad46
cmp eax, 0x201
ja 0x40ad06
je 0x40aceb
cmp eax, 0xf
je 0x40acd0
cmp eax, 0x200
jne case.0x40ad7d.32888
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, 0x200
call fcn.0040af30
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push eax
push ecx
push 0xf
push edx
call fcn.00415c60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push 0x201
call fcn.0040b020
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x202
je 0x40ad2b
cmp eax, 0x806b
jne case.0x40ad7d.32888
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
call fcn.0040b0e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ecx, 0x202
call fcn.0040afd0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x10], 0
jne 0x40ae27
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.0040b230
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [eax - 0x8076]
cmp ecx, 0x89
ja case.0x40ad7d.32888
movzx ecx, byte [ecx + 0x40ae98]
jmp dword [ecx*4 + 0x40ae80]
mov eax, dword [0x48a700]
mov ecx, dword [ebp + 8]
inc eax
cmp eax, 3
mov dword [0x48a700], eax
jl 0x40ada4
call fcn.0040bff0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 1
call fcn.0040b930
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x48a704]
mov ecx, dword [ebp + 8]
inc eax
cmp eax, 3
mov dword [0x48a704], eax
jl 0x40add3
call fcn.0040c240
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 2
call fcn.0040b930
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
cmp byte [esi + 0x41c], 0
je 0x40ae31
mov eax, esi
mov byte [esi + 0x41c], 0
call fcn.0040b470
mov edx, dword [esi + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 0
push 4
push 0x806a
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.00415d70
mov eax, esi
call fcn.0040beb0
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call fcn.0040bb70
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
call fcn.00415d70
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
call fcn.0040be60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b410
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push edi
push 0x66
push 0xfffffffffffffffa
lea edi, [esi + 0x2c]
push eax
mov dword [edi], 0x3bc
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 7
mov dword [esi + 0x3c], 0x806e
call dword [sym.imp.USER32.dll_GetWindowLongW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esi + 0x40], eax
push 0x478aa0
lea eax, [esi + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
pop edi
ret
Function at 0x40be60
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, eax
mov eax, dword [esi + 4]
push 5
push eax
call edi
lea ecx, [esi + 0x2c]
push ecx
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov esi, dword [esi + 4]
push 1
push esi
call edi
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
xor eax, eax
pop esi
ret
Function at 0x40d9b0
Capabilities:
Capture screenshot
Hide graphical window

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
cmp ecx, 0x202
ja 0x40da33
je 0x40da18
mov eax, ecx
sub eax, 0xf
je 0x40da09
sub eax, 0x1f1
je 0x40d9ee
sub eax, 1
jne 0x40da43
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push 0x201
call fcn.0040db60
pop esi
pop ebx
ret 0x10
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov ebx, 0x200
call fcn.0040dab0
pop esi
pop ebx
ret 0x10
pop esi
pop ebx
mov dword [esp + 8], 0xf
jmp fcn.00415c60
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov ecx, 0x202
call fcn.00410690
pop esi
pop ebx
ret 0x10
cmp ecx, 0x806b
je 0x40da92
cmp ecx, 0x80ff
je 0x40da5a
pop esi
pop ebx
mov dword [esp + 8], ecx
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov dword [esp + 4], ecx
jmp dword [sym.imp.USER32.dll_DefWindowProcW]
mov edx, dword [esp + 0xc]
mov esi, dword [edx + 4]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
xor eax, eax
pop ebx
ret 0x10
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push eax
call fcn.0040dc10
pop esi
pop ebx
ret 0x10