joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442670
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4426a3
push esi
call fcn.00445760
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44269c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x442729
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x442712
mov eax, dword [esi + 8]
test eax, eax
je 0x4426c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44270e
cmp eax, 2
je 0x442712
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4426ba
cmp eax, 3
je 0x4426ed
cmp eax, 1
jne 0x4426ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4426ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4426ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00442750
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x442738
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00442750
add esp, 4
pop esi
ret

Function at 0x452190
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4521f6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4521f6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4521d7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x452580
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4525b8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x453290
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4532d9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x453750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47f780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00453300
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00453380
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00453380
lea ecx, [esi + 0xc]
call fcn.0046ee69
lea ecx, [esi + 0x10]
call fcn.0046ee69
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00454910
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00454910
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00454910
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046eede
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046eede
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4712d1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x471309
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046f385
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046f35d
jmp 0x471315
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4729c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x472a05
call fcn.0047896b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x472a05
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4729fc
xor eax, eax
jmp 0x472a0d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00472a13
pop edi
pop esi
pop ebx
ret 4

Function at 0x478e9b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x478ec9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x478ee7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00478e01
jmp 0x478ee7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x478ee7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00478e01
test edi, edi
mov eax, edi
jne 0x478ed1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4019a0
Capabilities:
Create thread
Read .ini file

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str..Server.ini
push 2
push str.Shortcuts1
push str.NETWORK
call esi
push str..Server.ini
push 2
push str.Shortcuts2
push str.NETWORK
mov dword [0x4058fc], eax
call esi
push str..Server.ini
push 2
push str.Shortcuts3
push str.NETWORK
mov dword [0x4058f8], eax
call esi
push str..Server.ini
push 2
push str.Shortcuts4
push str.NETWORK
mov dword [0x4058f4], eax
call esi
push str..Server.ini
push 2
push str.Shortcuts5
push str.NETWORK
mov dword [0x4058f0], eax
call esi
push str..Server.ini
push 2
push str.Shortcuts6
push str.NETWORK
mov dword [0x4058ec], eax
call esi
push str..Server.ini
push 2
push str.Shortcuts7
push str.NETWORK
mov dword [0x4058e8], eax
call esi
push str..Server.ini
push 2
push str.Shortcuts8
push str.NETWORK
mov dword [0x4058e4], eax
call esi
push str..Server.ini
push 2
push str.Shortcuts9
push str.NETWORK
mov dword [0x4058e0], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 4
push 0
push 0x4015e0
push 0
push 0
mov dword [0x4058dc], eax
call esi
push 0
push 4
push 0
push 0x4016d0
push 0
push 0
mov dword [0x4058a8], eax
call esi
push 0
push 4
push 0
push 0x401720
push 0
push 0
mov dword [0x4058a4], eax
call esi
mov dword [0x4058a0], eax
push 0
push 4
push 0
push 0x401770
push 0
push 0
call esi
push 0
push 4
push 0
push 0x4017c0
push 0
push 0
mov dword [0x40589c], eax
call esi
push 0
push 4
push 0
push 0x401810
push 0
push 0
mov dword [0x405898], eax
call esi
push 0
push 4
push 0
push 0x401860
push 0
push 0
mov dword [0x405894], eax
call esi
push 0
push 4
push 0
push 0x4018b0
push 0
push 0
mov dword [0x405890], eax
call esi
push 0
push 4
push 0
push 0x401900
push 0
push 0
mov dword [0x40588c], eax
call esi
push 0
push 4
push 0
push 0x401950
push 0
push 0
mov dword [0x405888], eax
call esi
mov dword [0x405884], eax
pop esi
ret

Function at 0x401b70
Capabilities:
Resume thread

Disassembly:
mov eax, dword [0x4058a8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push eax
call esi
mov ecx, dword [0x4058a4]
push ecx
call esi
mov edx, dword [0x4058a0]
push edx
call esi
mov eax, dword [0x40589c]
push eax
call esi
mov ecx, dword [0x405898]
push ecx
call esi
mov edx, dword [0x405894]
push edx
call esi
mov eax, dword [0x405890]
push eax
call esi
mov ecx, dword [0x40588c]
push ecx
call esi
mov edx, dword [0x405888]
push edx
call esi
mov eax, dword [0x405884]
push eax
call esi
pop esi
ret

Function at 0x401bd0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push edi
mov edi, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
test eax, eax
je 0x401bf2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
mov esi, eax
push edi
call ebx
dec esi
jne 0x401bea
pop esi
pop ebx
pop edi
ret
Function at 0x401e40
Capabilities:
Create service
Start service

Disassembly:
sub esp, 0x104
mov ecx, dword [esp + 0x10c]
push ebx
lea eax, [esp + 8]
push 0
push eax
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 4], ebx
jne 0x401e99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager___Faild__d____n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
xor eax, eax
pop ebx
add esp, 0x104
ret
push ebp
push esi
mov esi, dword [sym.imp.MSVCRT.dll_printf]
push edi
push str.OpenSCManager___ok____n
call esi
add esp, 4
mov edi, dword [esp + 0x118]
lea edx, [esp + 0x14]
push 0
push 0
push 0
push 0
push 0
push edx
push 0
push 3
push 1
push 0xf01ff
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x401f3d
call ebp
cmp eax, 0x3e5
je 0x401f04
cmp eax, 0x431
je 0x401f04
push eax
push str.CrateService___Faild__d____n
call esi
add esp, 8
xor esi, esi
jmp 0x401f92
push str.CrateService___Faild_Service_is_ERROR_IO_PENDING_or_ERROR_SERVICE_EXISTS___n
call esi
mov eax, dword [esp + 0x14]
add esp, 4
push 0xf01ff
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x401f36
call ebp
push eax
push str.OpenService___Faild__d____n
call esi
add esp, 8
xor esi, esi
jmp 0x401f92
push str.OpenService___ok____n
jmp 0x401f42
push str.CrateService___ok____n
call esi
add esp, 4
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x401f8d
call ebp
cmp eax, 0x3e5
je 0x401f75
cmp eax, 0x420
je 0x401f83
push eax
push str.StartService___Faild__d____n
call esi
add esp, 8
xor esi, esi
jmp 0x401f92
push str.StartService___Faild_ERROR_IO_PENDING____n
call esi
add esp, 4
xor esi, esi
jmp 0x401f92
push str.StartService___Faild_ERROR_SERVICE_ALREADY_RUNNING____n
call esi
add esp, 4
mov esi, 1
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x401f9f
push ebx
call edi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x401fc0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x401ff5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager___Faild__d____n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
xor eax, eax
pop ebp
add esp, 0x1c
ret
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_printf]
push edi
push str.OpenSCManager___ok____n
call esi
mov eax, dword [esp + 0x34]
add esp, 4
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x402034
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService___Faild__d____n
call esi
add esp, 8
xor esi, esi
jmp 0x402098
push str.OpenService___ok____n
call esi
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x402065
call ebx
push eax
push str.ControlService___Faild__d___n
call esi
add esp, 8
jmp 0x40206f
push str.ControlService___ok___n
call esi
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402089
call ebx
push eax
push str.DeleteSrevice___Faild__d___n
call esi
add esp, 8
jmp 0x402093
push str.DelServer:eleteSrevice___ok___n
call esi
add esp, 4
mov esi, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x4020a5
push edi
call ebx
push ebp
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x1c
ret

Function at 0x4020c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str..myialdnwxf
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4020fb
push 0
push 0
push 0x405688
call sub.MFC42.DLL_AfxMessageBox_1
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 4]
push 0
push ecx
lea edx, [esp + 0x10]
push 8
push edx
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 2
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0xc
ret
Function at 0x4026c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push edi
push 6
push 1
mov esi, ecx
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x64], eax
jne 0x4026e4
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov ecx, dword [esi + 0x20]
push 0x33
push 0x401
push ecx
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
mov edi, dword [esp + 0x1c]
push edi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x40272f
push edi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x402728
mov edx, dword [esi + 0x64]
push edx
call sub.WSOCK32.dll_closesocket
mov dword [esi + 0x64], 0xffffffff
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
mov edx, dword [esp + 0x20]
mov dword [esp + 0xc], eax
push edx
mov word [esp + 0xc], 2
call sub.WSOCK32.dll_htons
mov ecx, dword [esi + 0x64]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
push ecx
call sub.WSOCK32.dll_connect
mov edx, dword [esi + 0x88]
push 0x405758
push 0
push 0x401
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x64]
pop edi
mov dword [0x4058d4], eax
mov eax, 1
pop esi
add esp, 0x10
ret 8
Function at 0x401ec0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
not edx
dec ebx
not ebx
inc eax
rol ebx, 0xc1
inc edx
rcl eax, 0x79
and edi, 0x49
add esi, 0x7e
dec edi
or eax, 0x33
rcr edx, 0x31
sub esi, 0xa2
and esi, 0x69
inc ebx
rcl eax, 0xbe
sbb esi, 0x4a
sub edx, 0xf7
rcr edi, 0x98
imul edx
ror edx, 0xae
sub ebx, 0x75
rcr edx, 0x71
and eax, 0x5c
dec edi
dec esi
inc eax
inc ebx
rol edi, 0xc6
rcl esi, 0xb0
mov eax, 0xa3
and eax, 9
or esi, 0x46
imul edi
or edi, 0xf9
rcr edx, 0x6d
and eax, 0x76
ror ebx, 0x7a
dec esi
imul ebx
inc ebx
inc edx
and edi, 0x40
or esi, 0xe2
neg edi
neg esi
rcr eax, 0x40
neg eax
rcl edx, 0xfa
bswap ebx
xor ecx, ecx
xor edi, edi
inc edx
imul esi
neg edx
sbb ebx, 0x3e
or edi, 0x9c
bswap edx
not ebx
ror esi, 0xe6
rcl edx, 0xc1
add eax, 0xb8
bswap edx
rcl ebx, 0x61
neg edi
dec edx
not edx
inc ebx
inc edi
dec esi
imul esi
not ebx
dec eax
imul edx
neg ebx
dec edi
imul edx
inc edi
inc esi
rol ebx, 0xd9
mov edi, 0x65
sub esi, 0x12
dec edi
not esi
not edi
not edi
imul edx
bswap edi
mov edi, 0x3c
neg edx
imul esi
sbb edx, 0xb0
rcr ebx, 0x29
and eax, 0x2b
bswap eax
dec esi
mov ebx, 0xab
bswap edx
sub ebx, 0xdd
rcl ebx, 0xcf
or edi, 0x31
sub edi, 0xe9
mov ecx, dword [ebp + 0xc]
imul edx
rol edx, 0x3b
and edi, 0xd7
neg esi
neg esi
or edx, 0x81
rcl eax, 0xa6
not edx
or edx, 0x38
rol ebx, 0x53
mov ebx, 0xec
inc esi
rcl eax, 0xcb
add ebx, 0x19
neg esi
or ebx, 0x13
dec esi
ror eax, 0x93
rcl esi, 0xa3
not edx
and eax, 0x92
inc ebx
add esi, 0xaf
dec eax
add esi, 0xa6
ror eax, 0x1f
bswap ebx
sbb eax, 0x21
bswap eax
rol eax, 0xd6
dec edi
rcl edx, 0x87
neg esi
dec eax
not eax
not eax
bswap edx
add ebx, 0x72
not edx
rcr ebx, 0xb8
imul esi
add eax, 0x34
imul esi
sbb edx, 0xf1
dec edi
sbb edi, 0x96
imul edi
imul eax
dec esi
or ebx, 0x90
mov edi, dword [ebp + 8]
xor esi, esi
mov esi, esi
xor eax, ebx
not byte [edi]
mov ebx, ebx
xor esi, esi
xor eax, ebx
add byte [edi], 0x68
xor ebx, ebx
mov ebx, ebx
xor esi, esi
sub byte [edi], 0x34
xor ebx, eax
xor ebx, ebx
mov ebx, ebx
imul byte [edi]
inc edi
loop 0x402066
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40758a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417484]
jne 0x407594
repz ret
jmp fcn.0040bd65

Function at 0x40d56d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a6a0
and dword [ebp - 4], 0
cmp dword [0x4189f4], 0
mov ebx, eax
jne 0x40d61e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d6cf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40d6cf
push eax
call fcn.0040a62e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4189f4], eax
call esi
push eax
call fcn.0040a62e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4189f8], eax
call esi
push eax
call fcn.0040a62e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4189fc], eax
call esi
push eax
call fcn.0040a62e
pop ecx
mov dword [0x418a04], eax
test eax, eax
je 0x40d61e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a62e
pop ecx
mov dword [0x418a00], eax
mov eax, dword [0x418a00]
cmp eax, ebx
je 0x40d676
cmp dword [0x418a04], ebx
je 0x40d676
push eax
call fcn.0040a6a9
push dword [0x418a04]
mov esi, eax
call fcn.0040a6a9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d676
test edi, edi
je 0x40d676
call esi
test eax, eax
je 0x40d66d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d66d
test byte [ebp - 0xc], 1
jne 0x40d676
or dword [ebp + 0x10], 0x200000
jmp 0x40d6af
mov eax, dword [0x4189f8]
cmp eax, ebx
je 0x40d6af
push eax
call fcn.0040a6a9
pop ecx
test eax, eax
je 0x40d6af
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d6af
mov eax, dword [0x4189fc]
cmp eax, ebx
je 0x40d6af
push eax
call fcn.0040a6a9
pop ecx
test eax, eax
je 0x40d6af
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4189f4]
call fcn.0040a6a9
pop ecx
test eax, eax
je 0x40d6cf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d6d1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403006
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x428e58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
call fcn.00427660
mov eax, dword [eax + 0xc]
push 0x40004
push eax
push 0x3e9
call dword [sym.imp.WINMM.dll_PlaySoundA]
push str.NOTEPAD.EXE
lea ecx, [esp + 8]
call fcn.0041ca26
mov eax, dword [esi + 0x64]
mov dword [esp + 0x10], 0
mov ecx, eax
shl ecx, 3
sub ecx, eax
movsx eax, word [esi + ecx*8 + 0x6c]
lea ecx, [esi + ecx*8 + 0x6c]
cmp eax, 3
ja case.default.0x403050
jmp dword [eax*4 + 0x4030c0]
push 1
call fcn.004033a0
jmp case.default.0x403050
mov ecx, esi
call fcn.00403600
jmp case.default.0x403050
add esi, 0x810
lea ecx, [esp + 4]
push esi
call fcn.0041cca1
push str.Readme.txt
lea ecx, [esp + 8]
call fcn.0041cca1
mov edx, dword [esp + 4]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x403050
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.0041c9b8
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x403550
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x6ac]
lea edi, [esi + 0x6ac]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + edi + 4]
cmp dword [edx + 0x4c], 0xffffffff
jne 0x40359a
lea ebx, [esi + 0x5ac]
lea eax, [esi + 0x910]
push ebx
push 0
push 0x43221c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [0x42de18]
push ecx
push 2
push ebx
mov ecx, edi
call fcn.00416120
mov edx, dword [esp + 0x10]
add esi, 0x6b8
push edx
mov ecx, esi
call fcn.00416610
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4035c9
push 0x4035f0
push 0xa
mov ecx, esi
call fcn.00416400
mov ecx, eax
call fcn.004035d0
pop edi
pop esi
pop ebx
ret 8
Function at 0x4080b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
inc eax
push edi
push eax
mov byte [ebp], 0
mov dword [esp + 0x20], 0
call fcn.0041893e
mov edx, dword [esp + 0x1c]
add esp, 4
lea ecx, [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x40815e
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push ebx
push edx
push eax
mov eax, dword [esp + 0x34]
inc esi
push eax
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x1c]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40815e
cmp byte [ebx], 0
je 0x40815e
mov eax, dword [esp + 0x20]
mov edi, ebx
dec eax
or ecx, 0xffffffff
mov dword [esp + 0x20], eax
mov byte [ebx + eax], 0
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call fcn.0041897a
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x14

Function at 0x408180
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10]
push eax
push esi
push edi
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4081d2
lea ecx, [esp + 0x14]
lea edx, [esp + 8]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0x4371f4
push 0
push esi
push edi
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x408202
mov edx, dword [esp + 0x18]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
pop ecx
ret 0x10

Function at 0x408210
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10]
push eax
push esi
push edi
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x408262
lea ecx, [esp + 0x14]
lea edx, [esp + 8]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0x4371f4
push 0
push esi
push edi
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40828b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
pop ecx
ret 0x14