joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b88f0
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, 4
call fcn.005c5c30
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor ebp, ebp
push ebx
mov dword [esp + 0x10], ebp
call fcn.0053d320
push ebx
call fcn.0053d3b0
mov esi, eax
add esp, 8
test esi, esi
je 0x5b8af2
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 4]
add eax, eax
push eax
push esi
call fcn.005068e0
add esp, 8
test eax, eax
je 0x5b8af1
mov ecx, dword [edi + 4]
dec ecx
js 0x5b8ac7
mov edx, dword [edi]
mov eax, dword [edx + ecx*4]
mov edx, eax
shr edx, 1
and edx, 0x8000
mov ebp, eax
and ebp, 0x20000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x40000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x80000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x100000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x200000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x400000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x800000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x1000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x2000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x4000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x8000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x10000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x20000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x40000000
or edx, ebp
shr edx, 1
and eax, reloc.szca_Decrypt.dll_Ordinal_1
or edx, eax
mov eax, dword [esi]
shr edx, 1
mov dword [eax + ecx*8 + 4], edx
mov edx, dword [edi]
mov eax, dword [edx + ecx*4]
mov edx, eax
and edx, 0x8000
add edx, edx
mov ebp, eax
and ebp, 0x4000
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x2000
or edx, ebp
mov ebp, eax
add edx, edx
and ebp, 0x1000
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x800
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x400
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x200
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x100
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x80
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x40
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x20
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x10
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 8
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 4
or edx, ebp
mov ebp, eax
add edx, edx
and ebp, 2
or edx, ebp
and eax, 1
add edx, edx
or edx, eax
dec ecx
mov eax, dword [esi]
mov dword [eax + ecx*8 + 8], edx
jns 0x5b8946
mov ebp, dword [esp + 0x10]
mov ecx, dword [edi + 4]
add ecx, ecx
push esi
mov dword [esi + 4], ecx
call fcn.005062d0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
push edx
push esi
push eax
call fcn.005b86c0
add esp, 0x10
test eax, eax
je 0x5b8af1
mov ebp, 1
pop edi
push ebx
call fcn.0053d370
add esp, 4
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x5c5718
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x65db30]
jne 0x5c5722
repz ret
jmp fcn.005c6369
Function at 0x10047638
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edx, edx
jmp 0x10075a81
pushal
jmp 0x1004d3b3
pushfd
lea esp, [esp + 0x28]
je 0x10048ac6
bswap si
sar dl, 1
rcl dh, 2
shl si, 8
mov esi, dword [eax + 0x3c]
movzx dx, al
sar edx, cl
add esi, eax
rcl dl, cl
mov dx, ax
sar dh, cl
mov edx, dword [esi + 0x78]
jmp 0x100472d2
je 0x10048ac6
push edx
or cx, si
bsf cx, dx
bt ecx, 0x11
add edx, eax
stc
mov ecx, dword [esi + 0x7c]
clc
cmp di, sp
pushfd
call fcn.100470ec
add byte [eax], al
push edx
inc ebp
outsb dx, byte [esi]
jne 0x10075b19
dec ebx
jns 0x10075af5
js 0x10075b09
add byte [eax], dl
sar bh, 0x74
and al, 8
add edi, ecx
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
iretd
jge 0x10075afa
mov cl, 0xa8
stosb byte es:[edi], al
pop ebp
retf 0x9ba5

Function at 0x1004c1b9
Capabilities:
Encode data using xor

Disassembly:
xor cl, byte [esi - 0x33]
xlatb
pushfd
sub al, 0xde
clc
rol al, 6
test ebp, 0x23d0107a
call fcn.1004f522
pushfd
call fcn.1004823e
dec esp
push ebx
lodsb al, byte [esi]
aaa
mul dword [edx - 2]
lodsd eax, dword [esi]
cmp eax, dword [eax + esi*2 + 0x21]
sar dword [edx + 0x6a], 1
jp 0x1004c1a3
jae 0x1004c24d
invalid
adc al, 0x85
inc edx
or dword [ebx + 0x11], eax
lea ebp, [esp + 0x1c]
pushfd
movzx edx, cl
mov dword [esp + 0x1c], ecx
stc
add dx, 0x4698
movzx dx, dl
setae dl
mov dword [esp + 0x18], ebx
bswap dx
pop edx
adc dh, ch
setl dh
mov dword [esp + 0x10], edi
add dh, dl
xchg dword [esp + 0xc], esi
neg dh
stc
mov edx, dword [ebp + 8]
stc
mov esi, dword [ebp + 0xc]
clc
clc
mov word [esp + 4], cx
pushal
or edx, edx
pushfd
pushfd
lea esp, [esp + 0x34]
je 0x1004b660
call fcn.100470c1
lea esp, [esp + 0x20]
jae 0x10048165
pushal
setae bl
mov bl, 2
pushfd
mov al, byte [esp]
setne al
inc ecx
setg al
mov al, 0x10
lea esp, [esp + 0x24]
Function at 0x40245e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x4024f1
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40249f
mov eax, 0x47a2d5
push eax
push 1
mov ebx, 0x25c
call fcn.00456760
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.00456770
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x4024fb
mov eax, 0
jmp 0x4024fb
mov esp, ebp
pop ebp
ret 4

Function at 0x402533
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.00456790
add esp, 0x10
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x4025af
cmp dword [ebp - 4], 0
je 0x4025aa
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
jmp 0x4025b7
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x4025c8
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4025ce
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40260b
mov eax, 0x47a2d5
push eax
push 3
mov ebx, 0x270
call fcn.00456870
add esp, 0x28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40274e
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x278
call fcn.00456950
add esp, 0x10
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40265c
mov eax, 0x47a2d5
push eax
push 1
mov ebx, 0x244
call fcn.00456560
add esp, 0x10
call fcn.0040177b
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40268c
mov eax, 0x47a2d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4026a0
mov eax, 0x47a2d5
push eax
push 2
mov ebx, 0x23c
call fcn.00456570
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4026c3
push ebx
call fcn.00451880
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456050
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456050
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402739
push ebx
call fcn.00451880
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402749
push ebx
call fcn.00451880
add esp, 4
jmp 0x40283e
push dword [ebp + 8]
call fcn.0040245e
and eax, 1
xor eax, 1
test eax, eax
je 0x4027b8
call fcn.0040177b
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402781
mov eax, 0x47a2d5
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402795
mov eax, 0x47a2d5
push eax
push 2
mov ebx, 0x23c
call fcn.00456570
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4027b8
push ebx
call fcn.00451880
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456050
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456050
add esp, 0x10
mov dword [ebp - 0xc], eax
push 5
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40282e
push ebx
call fcn.00451880
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40283e
push ebx
call fcn.00451880
add esp, 4
push 0x630241
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
mov esp, ebp
pop ebp
ret 4
Function at 0x407161
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 8
call fcn.0045187a
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0045187a
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.0045187a
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.00455ff0
add esp, 0x1c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456050
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x407285
push ebx
call fcn.00451880
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
jmp 0x40731c
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.00451880
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00451880
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00451880
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x408928
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x408968
mov esp, ebp
pop ebp
ret 8
Function at 0x408dce
Capabilities:
Create http request
Download and write a file
Inspect section memory permissions
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 0x24
call fcn.0045187a
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 9
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx], 0
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0x14], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456050
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456050
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.WININET.dll_InternetOpenA]
nop
nop
nop
nop
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x408e95
push ebx
call fcn.00451880
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x408ea5
push ebx
call fcn.00451880
add esp, 4
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
mov dword [ebx], eax
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], 0
jne 0x408ef6
push 0x630295
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
push dword [ebp + 0x14]
push 0
push 0
push 0xffffffffffffffff
call dword [ebp + 0x10]
push 0x630295
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, 0xffffffff
jmp 0x4094e1
push dword [ebp + 8]
call fcn.00409525
mov dword [ebp - 0x14], eax
push str._r_nAccept_Language:_zh_cn_r_n
push dword [ebp - 0x14]
push str.Accept:_image_gif__image_x_xbitmap__image_jpeg__image_pjpeg__application_x_shockwave_flash__application_vnd.ms_excel__application_vnd.ms_powerpoint__application_msword____r_nReferer:
mov ecx, 3
call fcn.004010d5
add esp, 0xc
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408f2e
push ebx
call fcn.00451880
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408f42
push ebx
call fcn.00451880
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
Function at 0x410662
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push dword [ebp + 8]
push dword [0x63025d]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4106b1
mov eax, 0x47a38d
jmp 0x410770
push dword [ebp + 8]
push dword [0x63025d]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4106db
mov eax, 0x47a38d
jmp 0x410770
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4106ff
mov eax, 0x47a38d
jmp 0x410770
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.00456980
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410732
push ebx
call fcn.00451880
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410746
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41076b
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0045187a
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x410770
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410781
push ebx
call fcn.00451880
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x413b60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ebx, dword [0x630245]
mov dword [ebp - 4], ebx
push 0x47a2d5
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.00401c1c
add esp, 8
cmp eax, 0
je 0x413c1c
mov ebx, dword [0x630245]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456050
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00456050
add esp, 0x10
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x413c0c
push ebx
call fcn.00451880
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x413c1c
push ebx
call fcn.00451880
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41cf24
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x41cf53
mov esp, ebp
pop ebp
ret 4

Function at 0x41cf59
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 5
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x41cf88
mov esp, ebp
pop ebp
ret 4

Function at 0x41cf8e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [0x630361], 0
jle 0x41cfc6
cmp dword [0x63034d], 0
jle 0x41cfc6
mov eax, 1
jmp 0x41cfc8
xor eax, eax
test eax, eax
je 0x41d071
push 1
push dword [0x630361]
call fcn.0041d077
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x41d058
push 0x63035d
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 8]
push eax
call fcn.0040787c
push eax
push dword [0x63034d]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41d044
push dword [0x63034d]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
mov dword [0x63034d], 0
mov dword [0x630361], 0
push 0x63035d
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
jmp 0x41d071
cmp dword [ebp - 4], 0
jne 0x41d071
push 0x6303bd
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41dfb9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00456010
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41dffe
push ebx
call fcn.00451880
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040881e
push eax
push 0x200
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
nop
nop
mov eax, dword [ebp - 4]
test eax, eax
je 0x41e03f
push eax
mov ebx, eax
call fcn.0040106a
inc eax
push eax
call fcn.0045187a
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41e044
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41e055
push ebx
call fcn.00451880
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4266c2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0xc4
call fcn.00456770
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42674b
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00455ff0
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0xc4
call fcn.00456770
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4267bd
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00455ff0
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0xc4
call fcn.00456770
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42682f
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00455ff0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x426837
mov esp, ebp
pop ebp
ret

Function at 0x42a38f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x47a385]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00401131
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00456010
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42a413
push ebx
call fcn.00451880
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
mov eax, dword [ebp - 8]
test eax, eax
je 0x42a453
push eax
mov ebx, eax
call fcn.0040106a
inc eax
push eax
call fcn.0045187a
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x42a458
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42a469
push ebx
call fcn.00451880
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x431228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push VariantCopy
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x431254
mov eax, 0x47a38d
push eax
push 1
mov ebx, 0x194
call fcn.00457750
add esp, 0x10
mov dword [ebp - 4], eax
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x431298
add eax, 8
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
mov eax, dword [ebp - 8]
jmp 0x4312ae
mov esp, ebp
pop ebp
ret 4