joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50fbfc
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x50fc05
mov eax, dword [ebp - 4]
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50fdd4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x50fdaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x50fdf0
xor eax, eax
call fcn.0050f608
test al, al
je 0x50fc8b
mov edx, 2
mov eax, 0x50fdf0
call fcn.0050f670
mov edx, 0x50fdf0
xor eax, eax
call fcn.0050f768
xor ebx, ebx
jmp 0x50fc7b
push 0x3e8
call fcn.00407a60
inc ebx
cmp ebx, 0xa
jae 0x50fc8b
mov edx, 0x50fdf0
xor eax, eax
call fcn.0050f4f0
test al, al
je 0x50fc6b
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 6
jg 0x50fcaf
mov dword [ebp - 0x28], 0x1779
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
mov edx, 0x50fdf0
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x50fcca
mov dword [ebp - 0x28], 0x1b59
mov dword [ebp - 0x2c], 0x44d
lea eax, [ebp - 8]
mov edx, 0x50fe10
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push 0x50fe48
push 0
call sub.advapi32.dll_OpenEventLogW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x50fda5
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x1002c]
xor ecx, ecx
mov edx, 0x10000
call sub.rtl120.bpl__System__FillChar_qqrpvib
jmp 0x50fd73
lea ebx, [ebp - 0x1002c]
jmp 0x50fd5e
mov eax, dword [ebx + 0x10]
call fcn.0050f900
fstp qword [ebp - 0x20]
wait
lea eax, [ebp - 4]
mov edx, edi
add edx, 0x38
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebx + 0x14]
call fcn.0050fbf4
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00407720
test al, al
je 0x50fd58
cmp esi, dword [ebp - 0x28]
jne 0x50fd58
movzx eax, word [ebx + 0x1c]
cmp eax, dword [ebp - 0x2c]
jne 0x50fd58
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [eax - 0x10], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax - 0xc], edx
mov byte [ebp - 0x21], 1
jmp 0x50fd6d
mov eax, dword [ebx]
add eax, ebx
mov ebx, eax
lea eax, [ebp - 0x1002c]
add eax, dword [ebp - 0x10]
mov edi, ebx
cmp eax, edi
ja 0x50fd03
cmp byte [ebp - 0x21], 0
jne 0x50fd9c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10000
lea eax, [ebp - 0x1002c]
push eax
push 0
push 9
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ReadEventLogW
test eax, eax
jne 0x50fcfb
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseEventLog
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50fdb9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50fddb
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x513a30
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x513bb0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 4]
xor eax, eax
call fcn.0040efb4
mov edx, 0x513bcc
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x513a71
mov bl, 2
jmp 0x513b9a
mov edx, 0x513bf0
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x513a89
mov bl, 3
jmp 0x513b9a
mov edx, 0x513c18
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x513aa1
mov bl, 5
jmp 0x513b9a
mov edx, 0x513c3c
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x513ab9
mov bl, 4
jmp 0x513b9a
mov edx, 0x513c70
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x513ad1
mov bl, 6
jmp 0x513b9a
mov edx, 0x513c98
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x513ae9
mov bl, 7
jmp 0x513b9a
mov edx, 0x513cb8
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x513b87
lea eax, [ebp - 0x120]
mov edx, 0x11c
call fcn.00402094
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
mov edx, 0x24
call fcn.00402094
push 0x513ccc
push 0x513cf4
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00401878
test eax, eax
je 0x513b58
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x513b64
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo
cmp dword [ebp - 0x110], 2
jne 0x513b9a
cmp dword [ebp - 0x11c], 6
jne 0x513b83
cmp dword [ebp - 0x118], 3
jne 0x513b83
mov bl, 9
jmp 0x513b9a
mov bl, 8
jmp 0x513b9a
mov edx, 0x513d1c
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x513b9a
mov bl, 0xa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513bb7
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x51bfc4
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51c16a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 4]
mov al, 1
call fcn.0040efb4
mov edx, 0x51c184
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x51c005
mov bl, 2
jmp 0x51c154
mov edx, 0x51c1a8
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x51c01d
mov bl, 3
jmp 0x51c154
mov edx, 0x51c1d0
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x51c035
mov bl, 5
jmp 0x51c154
mov edx, 0x51c1f4
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x51c04d
mov bl, 4
jmp 0x51c154
mov edx, 0x51c228
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x51c065
mov bl, 6
jmp 0x51c154
mov edx, 0x51c250
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x51c07d
mov bl, 7
jmp 0x51c154
mov edx, 0x51c270
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x51c11b
lea eax, [ebp - 0x120]
mov edx, 0x11c
call fcn.00402094
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
mov edx, 0x24
call fcn.00402094
push 0x51c284
push 0x51c2ac
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00401878
test eax, eax
je 0x51c0ec
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x51c0f8
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo
cmp dword [ebp - 0x110], 2
jne 0x51c154
cmp dword [ebp - 0x11c], 6
jne 0x51c117
cmp dword [ebp - 0x118], 3
jne 0x51c117
mov bl, 9
jmp 0x51c154
mov bl, 8
jmp 0x51c154
mov edx, 0x51c2d4
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x51c141
mov eax, dword [sym.imp.rtl120.bpl__Sysutils_Win32BuildNumber]
cmp dword [eax], 0x55f0
jl 0x51c13d
mov bl, 0xb
jmp 0x51c154
mov bl, 0xa
jmp 0x51c154
mov edx, 0x51c2f8
mov eax, dword [ebp - 4]
call fcn.00407720
test al, al
je 0x51c154
mov bl, 0xb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c171
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x53e2d8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x53e400
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0053e1c4
mov eax, dword [esi]
call sub.rtl120.bpl__System__DynArrayLength_qqrv
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [sym.imp.rtl120.bpl___xp_15Sysutils_TBytes]
call sub.rtl120.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call sub.rtl120.bpl__System_Move_qqrpxvpvi
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call sub.rtl120.bpl__System_Move_qqrpxvpvi
add ebx, 0x1c
mov eax, dword [esi]
call sub.rtl120.bpl__System__DynArrayLength_qqrv
mov dword [ebp - 0xc], eax
mov eax, dword [0x56bdb4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.00528a70
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call sub.rtl120.bpl__System__FillChar_qqrpvib
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call sub.rtl120.bpl__System__DynArrayLength_qqrv
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.00528918
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.005284fc
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.00528a68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53e407
lea eax, [ebp - 4]
mov edx, dword [sym.imp.rtl120.bpl___xp_15Sysutils_TBytes]
call sub.rtl120.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x432005
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1d7f6969
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x57523b2b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401fc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x487580]
xor eax, ebp
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004516c0
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40202d
mov eax, dword [ebp - 0x114]
cmp eax, 5
jae 0x40201d
cmp eax, 4
jne 0x40202d
cmp dword [ebp - 0x110], 0x5a
jb 0x40202d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045167e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0045167e
mov esp, ebp
pop ebp
ret

Function at 0x404490
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x487580]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x60
push 0
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x408], 0
call ebx
mov edi, eax
test edi, edi
jne 0x404500
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x404500
call fcn.00401f80
mov esi, eax
jmp 0x4045b9
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x404523
call fcn.00401f80
jmp 0x4045ac
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x404538
call fcn.00401f80
jmp 0x4045ac
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x404550
mov esi, 0x8007000e
jmp 0x4045ae
push eax
lea ecx, [ebp - 0x408]
call fcn.00401cc0
cmp dword [ebp - 0x408], 0
jne 0x40456c
mov esi, 0x8007000e
jmp 0x4045ae
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40458c
call fcn.00401f80
jmp 0x4045ac
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.00404330
mov esi, eax
test edi, edi
je 0x4045b9
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x4045d2
lea ecx, [ebp - 0x408]
call fcn.00402820
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045167e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405110
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x405129
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405135
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x405130
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x405170
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x405185
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x405190
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405190
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x406390
Capabilities:
Extract resource via kernel32 functions
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
mov dword [ebp - 4], ebx
mov word [ebx + 0x74], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x489a84]
add esi, 0x10
mov dword [ebp - 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x489b20]
lea eax, [ebp - 8]
push eax
call fcn.00406300
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebx + 0x34]
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
push eax
lea ecx, [edi + 4]
call fcn.00405fc0
lea eax, [ebx + 0x38]
mov dword [ebp - 8], eax
lea ecx, [edi + 0x10]
lea eax, [ebp - 8]
push eax
call fcn.00405fc0
push 0
lea ecx, [ebx + 0x68]
push 0x46ca48
call fcn.00406ae0
push 0x46cb0c
push 0xc9
push 0
mov dword [ebx + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40654f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40654f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push eax
call fcn.004076b0
push 0
push dword [ebx + 4]
lea esi, [ebx + 0x58]
mov dword [ebx + 0x54], eax
mov dword [esi], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x60], 0
call dword [sym.imp.USER32.dll_SetMenu]
push str.LenovoShowBox0620
push dword [ebx + 4]
push dword [ebx + 0x54]
call fcn.00407910
push str.LenovoShowBox0620
push dword [ebx + 4]
call fcn.0040dfa0
mov edi, dword [ebp - 4]
mov ebx, eax
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x78]
mov ecx, dword [ebx]
mov esi, eax
mov edi, dword [edi + 0x64]
push ebx
call dword [ecx + 0x78]
mov edx, dword [ebp - 4]
push 0
push 1
push esi
mov ecx, dword [edx + 0x60]
push edi
sub ecx, eax
mov edi, edx
add ecx, 2
push ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx]
push 1
push ebx
call dword [eax + 0xf0]
mov esi, dword [ebx]
push ebx
call dword [esi + 0x78]
mov ecx, dword [edi + 0x60]
sub ecx, eax
add ecx, 2
push ecx
push ebx
call dword [esi + 0x1b4]
push dword [edi + 0x64]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x1bc]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x14
push 0x3e8
push dword [edi + 4]
call esi
push 0x80080
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0xea60
push 0x3f0
push dword [edi + 4]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4068c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push 1
push 0
push 0
push dword [ebp + 8]
push str.open
push 0
call ebx
or edi, 0xffffffff
cmp eax, 0x20
jg 0x406957
cmp eax, 2
je 0x406957
push 1
push 0
push dword [ebp + 8]
push str.iexplore.exe
push str.open
push 0
call ebx
cmp eax, 0x20
jg 0x406957
cmp eax, 2
je 0x406957
push esi
lea ecx, [ebp - 4]
call fcn.00401160
push dword [ebp + 8]
lea eax, [ebp - 4]
push str.url.dll_FileProtocolHandler__s
push eax
call fcn.00406190
mov esi, dword [ebp - 4]
add esp, 0xc
push 1
push 0
push esi
push str.rundll32.exe
push str.open
push 0
call ebx
add esi, 0xfffffff0
mov ecx, edi
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406956
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
pop esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
pop edi
pop ebx
jg 0x406973
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x406bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406bc5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406c04
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x406c00
lea ebx, [ebx]
cmp esi, edx
jae 0x406c04
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x406bf0
cmp esi, edx
jb 0x406c09
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4086c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a021
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x487580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x38]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
call fcn.0040f0d0
mov dword [edi + 0x38], eax
lea ecx, [edi + 0x40]
mov dword [ebp - 4], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
call fcn.00406ef0
mov dword [edi + 0x40], eax
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 1
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
call fcn.0040d590
mov dword [edi + 0x48], eax
mov eax, edi
mov byte [ebp - 4], 2
lea ecx, [edi + 0x38]
mov dword [eax + 0x50], 0
mov dword [eax + 0x10], 0
call fcn.0040f1e0
lea ecx, [edi + 0x40]
call fcn.0040f1e0
mov eax, dword [edi + 0x48]
lea ecx, [edi + 0x48]
push dword [eax + 4]
call fcn.00440730
mov eax, dword [edi + 0x48]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x48]
mov dword [eax], eax
mov eax, dword [edi + 0x48]
mov dword [eax + 8], eax
mov dword [edi + 0x4c], 0
call fcn.00413c50
mov ecx, edi
mov dword [ecx + 0x28], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409030
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x487580]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x4091bc
test ebx, ebx
je 0x4091bc
cmp word [ebx], 0
je 0x4091bc
push esi
push 0xfffffffffffffff0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x409125
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
jne 0x409125
push 0x30
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.004516c0
mov eax, dword [edi + 0x18]
add esp, 0xc
mov dword [ebp - 0x34], 0x2c
mov dword [ebp - 0x30], 0xa1
mov dword [ebp - 0x2c], eax
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x432
push dword [edi]
mov dword [ebp - 0x10], ebx
call esi
lea ecx, [ebp - 0x3c]
call fcn.00413170
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x38]
add eax, 0xf
movzx ecx, ax
mov eax, dword [ebp - 0x3c]
add eax, 0xf
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push 0
push 0x412
push dword [edi]
call esi
lea eax, [ebp - 0x34]
push eax
push 1
push 0x411
jmp 0x4091b7
push 0x30
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.004516c0
mov eax, dword [edi + 0x18]
add esp, 0xc
mov dword [ebp - 0x34], 0x2c
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], eax
push 0
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push dword [edi + 0x18]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x34]
push eax
push 0
push 0x432
push dword [edi]
call esi
push dword [edi + 0x18]
call fcn.00413b30
test eax, eax
je 0x40919c
push 0x1f4
push 0
push 0x418
push dword [edi]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00413170
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 0
push 0x41c
push dword [edi]
call esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0045167e
mov esp, ebp
pop ebp
ret 4