joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4581cc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4a1b48]
cmp byte [eax + 0xa5], 0
jne 0x45823d
cmp dword [0x4a1b60], 0
jne 0x4581fe
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x458188
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a1b60], eax
cmp dword [0x4a1b5c], 0
jne 0x458219
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a1b5c], eax
cmp dword [0x4a1b64], 0
jne 0x45823d
push esp
push 0
push 0
push 0x45812c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4a1b64], eax
pop edx
ret

Function at 0x4588d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a1b48]
cmp dword [eax + 0x30], 0
je 0x45897a
cmp dword [ebx + 0x94], 0
jne 0x458974
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458860
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458974
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45893a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458974
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418980
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x458949
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4594d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45950d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045bc
jmp 0x45951a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404520
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45a6d4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45a715
mov eax, esi
call fcn.00440538
test al, al
je 0x45a715
mov eax, dword [ebx + 0x84]
call fcn.00440234
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45a715
push 0
mov eax, dword [ebx + 0x84]
call fcn.00440234
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46a354
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46a4ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x464]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edi, dword [eax + 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x208]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x42c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x464]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov esi, dword [eax + 0xb0]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.0046b244
add esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, 2
call fcn.0046b244
mov ecx, esi
sub ecx, eax
xor edx, edx
xor eax, eax
call fcn.004068d0
push edi
lea esi, [ebp - 0x1c]
add edi, 0x24
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x464]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [eax + 0x58]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x208]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, ebx
call fcn.0046b058
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0x108]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, ebx
mov si, 0xffb0
call fcn.00403928
lea eax, [edi + 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00404c14
mov eax, dword [ebp - 0xc]
push eax
mov al, byte [ebp - 5]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, ebx
mov ebx, dword [eax]
call dword [ebx + 0x144]
lea edx, [ebp - 0x24]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov ebx, dword [ebp - 0x20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a4b5
lea eax, [ebp - 0xc]
call fcn.00404bd8
ret
Function at 0x46cfc4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov ebx, eax
xor esi, esi
test byte [ebx + 0x474], 8
je 0x46d078
mov eax, dword [ebx + 0x280]
test eax, eax
jl 0x46d0a8
cmp dword [ebx + 0x284], 0
jl 0x46d0a8
mov edx, eax
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebx + 0x284]
mov edx, dword [ebx + 0x280]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x1bc]
mov edx, dword [ebx + 0x284]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x120]
mov edx, eax
lea ecx, [ebp - 0x10]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x60]
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0046d608
test byte [ebx + 0x420], 0x20
jne 0x46d054
dec dword [ebp - 8]
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.0046ae2c
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xc]
jle 0x46d0a8
xor edx, edx
mov eax, dword [ebx + 0x2d0]
call fcn.004398f8
jmp 0x46d15f
test byte [ebx + 0x474], 0x40
je 0x46d15f
mov edx, dword [ebx + 0x2d8]
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov esi, eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x2d8]
mov eax, ebx
call fcn.0046b38c
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_InflateRect
cmp dword [ebp - 0x10], 0
jge 0x46d0c0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.0046ae2c
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x10]
jle 0x46d0e2
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.0046ae2c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov ebx, dword [ebx + 0x2d0]
push 0
mov eax, ebx
call fcn.00440234
push eax
call sub.user32.dll_ShowWindow
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
test al, 0x10
setne al
and eax, 0x7f
mov eax, dword [eax*4 + 0x49f394]
or eax, 0x40
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
sub eax, edi
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
push 0
mov eax, ebx
call fcn.00440234
push eax
call sub.user32.dll_SetWindowPos
mov eax, ebx
call fcn.00440234
push eax
call sub.user32.dll_SetFocus
lea edx, [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, ebx
call fcn.00440234
push eax
call sub.user32.dll_InvalidateRect
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f80c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46f988
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [eax + 0x94]
mov eax, dword [ebx + 0x208]
call fcn.004228e8
mov dword [ebp - 8], eax
mov edx, esi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [eax + 0x94]
mov eax, dword [ebx + 0x208]
call fcn.004228cc
mov edi, eax
mov edx, esi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov al, byte [eax + 0x98]
sub al, 1
jb 0x46f8d0
jne 0x46f91f
mov edx, esi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
add eax, 2
mov dword [ebp - 0x18], eax
add edi, dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, ebx
call fcn.0046b118
mov edi, eax
mov eax, dword [ebp - 8]
add eax, 2
sub edi, eax
mov dword [ebp - 0x14], edi
add edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
jmp 0x46f91f
mov edx, esi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
lea edx, [edi + 2]
sub eax, edx
mov dword [ebp - 0x18], eax
add edi, dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, ebx
call fcn.0046b118
mov dword [ebp - 0x14], eax
mov edx, esi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 0x10]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov edi, dword [ebx + 0x208]
mov eax, dword [edi + 0xc]
mov dl, byte [0x46f998]
call fcn.00421dd8
mov eax, dword [edi + 0xc]
mov edx, dword [ebx + 0x45c]
call fcn.00421b0c
mov edx, esi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [eax + 0x94]
lea eax, [ebp - 0x1c]
call fcn.00404d3c
mov eax, dword [ebp - 0x1c]
push eax
push 0
xor ecx, ecx
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x208]
call fcn.00460478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f98f
lea eax, [ebp - 0x1c]
call fcn.00404bd8
ret
Function at 0x4789f8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x478b52
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, edi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, edi
mov eax, ebx
call fcn.0046b058
mov byte [ebp - 5], al
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x208]
mov dword [eax + 0x20], edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
mov edx, edi
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x1bc]
mov eax, dword [ebp - 0xc]
push edi
lea esi, [ebp - 0x20]
lea edi, [eax + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, edi
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x108]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, edi
mov eax, ebx
mov si, 0xffb0
call fcn.00403928
mov eax, dword [ebp - 0xc]
add eax, 0x1c
mov edx, dword [ebp - 0x10]
call fcn.00404c14
mov edx, edi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [eax + 0x58]
mov eax, dword [ebx + 0x208]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov al, byte [ebp - 5]
push eax
mov ecx, dword [ebp - 4]
mov edx, edi
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x144]
mov esi, dword [ebx + 0x208]
test byte [ebp - 5], 1
je 0x478af9
mov eax, dword [esi + 0xc]
call fcn.00421dcc
mov edx, eax
or dl, byte [0x478b64]
mov eax, dword [esi + 0xc]
call fcn.00421dd8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
mov al, byte [ebx + 0x2bc]
sub al, 1
jae 0x478b22
mov edx, edi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0xb0]
jmp 0x478b34
mov edx, edi
mov eax, dword [ebx + 0x464]
mov ecx, dword [eax]
call dword [ecx + 0x30]
call fcn.0047eeac
add esi, 5
cmp eax, esi
setge bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478b59
lea eax, [ebp - 0x10]
call fcn.00404bd8
ret
Function at 0x48092c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415b7c]
call fcn.00404f48
xor eax, eax
push ebp
push 0x480a70
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49f3bc], 0
jne 0x48097f
mov ecx, dword [0x49fe2c]
mov dl, 1
mov eax, dword [0x407c08]
call fcn.0040cb7c
call fcn.00403ec0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403114
mov eax, ebx
call fcn.00404d4c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x480a80
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004060a4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d5c
test eax, eax
jle 0x480a17
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x480a10
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404754
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040473c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408bb8
test eax, eax
jne 0x480a10
mov ebx, 0x15
jmp 0x480a1c
mov ebx, 0x10
jmp 0x480a1c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x49f3bc]
call fcn.004807a4
mov eax, dword [ebp - 8]
call fcn.004807a4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004060bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480a77
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004044f0
lea eax, [ebp - 0x10]
mov edx, dword [0x415b7c]
call fcn.00405018
ret

Function at 0x48ac68
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x48ac96
mov eax, ebx
call fcn.0048b71c
cmp dword [ebx + 0x40], 0
je 0x48ac8f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x48ad07
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x48acf9
cmp dword [ebx + 8], 0
je 0x48acb8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48acca
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48acf9
cmp dword [ebx + 8], 0
je 0x48acab
cmp eax, 3
je 0x48acdd
dec eax
jne 0x48acab
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48acab
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48acab
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x48ad25
cmp dword [ebx + 0x14], 0xcc
je 0x48ad25
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048ad30
pop ebx
ret
Function at 0x49b934
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x4a0110]
mov eax, dword [eax]
call fcn.00459818
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x49b977
cmp eax, dword [esp]
pop edx
pop eax
jae 0x49b942
jmp 0x49b97b
pop edx
pop eax
jge 0x49b942
pop esi
pop ebx
pop ebp
ret

Function at 0x49cf70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
xor edx, edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040497c
xor eax, eax
push ebp
push 0x49d0a4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403114
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403114
mov dword [ebp - 0x48], 0x44
mov eax, dword [0x4a1e1c]
mov eax, dword [eax + 0x358]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x49d031
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.00402e84
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.0040949c
mov eax, dword [ebp - 0x5c]
call fcn.0040498c
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 4]
mov edx, 0x49d0b8
call fcn.004047d8
mov eax, dword [ebp - 0x64]
call fcn.0040498c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
jmp 0x49d081
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x6c]
xor eax, eax
call fcn.00402e84
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.0040949c
mov eax, dword [ebp - 0x68]
call fcn.0040498c
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 4]
mov edx, 0x49d0f0
call fcn.004047d8
mov eax, dword [ebp - 0x70]
call fcn.0040498c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d0ab
lea eax, [ebp - 0x70]
mov edx, 6
call fcn.004044f0
lea eax, [ebp - 4]
call fcn.004044cc
ret
Function at 0x13a891c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13a8926
pushal
call 0x13a892c
pop ebp
sub ebp, 0x10
sub ebp, 0xfa891c
jmp 0x13a8942
mov eax, 0xfa891c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c8
mov edx, 0x26d5fc45
xor byte [eax], dl
inc eax
dec ecx
jne 0x13a8959
jmp 0x13a896c
into
mov dh, cl
int3
Function at 0x4030e9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4170c0]
jne 0x4030f3
repz ret
jmp fcn.004056bd

Function at 0x40d980
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4170c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407565
and dword [ebp - 0x14], 0
cmp dword [0x41937c], 0
mov dword [ebp - 0x18], eax
jne 0x40da33
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40dadb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40dadb
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41937c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x419380], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x419384], eax
call edi
push eax
call esi
mov dword [0x41938c], eax
test eax, eax
je 0x40da33
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x419388], eax
mov eax, dword [0x419388]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40da8c
cmp dword [0x41938c], ecx
je 0x40da8c
push eax
call esi
push dword [0x41938c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40da8c
test ebx, ebx
je 0x40da8c
call edi
test eax, eax
je 0x40da83
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40da83
test byte [ebp - 8], 1
jne 0x40da8c
or dword [ebp + 0x10], 0x200000
jmp 0x40dabf
mov eax, dword [0x419380]
cmp eax, dword [ebp - 0x18]
je 0x40dabf
push eax
call esi
test eax, eax
je 0x40dabf
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40dabf
mov eax, dword [0x419384]
cmp eax, dword [ebp - 0x18]
je 0x40dabf
push eax
call esi
test eax, eax
je 0x40dabf
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41937c]
call esi
test eax, eax
je 0x40dadb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40dadd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004030e9
leave
ret
Function at 0x44d21f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44d24d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44d26b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0044d189
jmp 0x44d26b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44d26b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0044d189
test edi, edi
mov eax, edi
jne 0x44d255
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x478624]
test ecx, ecx
je 0x44d31e
jmp 0x44d21e
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100023f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 4]
mov esi, dword [esi + 8]
je 0x10002428
test esi, esi
je 0x1000246c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000246c
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x2a0], 1
jmp 0x1000244b
test esi, esi
je 0x1000246c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000246c
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x2a0], 0
cmp dword [0x100af23c], 0
je 0x1000246c
push 0x1330684
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x100af23c], 0
xor eax, eax
pop esi
pop ebp
ret 8