joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042a0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.0040430b
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push eax
push 0x403ef7
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
cmp eax, esi
mov dword [0x4257b4], eax
jne 0x404308
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
lea ecx, [ebp - 4]
push esi
push ecx
push esi
push eax
push esi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x404308
cmp dword [ebp + 8], esi
je 0x4042ff
push 0x10
push str.Error_hooking_keyboard
push dword [ebp - 4]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
leave
ret

Function at 0x405665
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x40bde7
call fcn.0040b8a0
sub esp, 0xd0
and dword [ebp - 0x30], 0
push ebx
lea ecx, [ebp - 0x14]
call fcn.004010a8
and byte [ebp - 0x16], 0
push 1
pop ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x70
mov byte [ebp - 0x28], 0x3a
mov byte [ebp - 0x27], 0x2f
mov byte [ebp - 0x26], 0x2f
mov byte [ebp - 0x25], 0x77
mov byte [ebp - 0x24], 0x77
mov byte [ebp - 0x23], 0x77
mov byte [ebp - 0x22], 0x2e
mov byte [ebp - 0x21], 0x73
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x77
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x6b
mov byte [ebp - 0x17], 0x2e
call fcn.0040126c
cmp dword [0x4217ec], 0
jne 0x405721
push 0x4147f4
lea ecx, [ebp - 0x10]
call fcn.0040114f
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
call fcn.004012b0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x4057b7
lea eax, [ebp - 0xdc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
test eax, eax
je 0x405794
cmp dword [ebp - 0xdc], 0xffffff10
jl 0x40576f
cmp dword [ebp - 0xdc], 0xf0
jg 0x40576f
push 0x4147f0
lea ecx, [ebp - 0x10]
call fcn.0040114f
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.004012b0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x4057b7
push 0x4147ec
lea ecx, [ebp - 0x10]
call fcn.0040114f
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 4
call fcn.004012b0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x4057b7
push 0x4147ec
lea ecx, [ebp - 0x10]
call fcn.0040114f
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 5
call fcn.004012b0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.004019e0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.004010b4
mov dword [ebp - 0x30], ebx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004019e0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4058c5
Capabilities:
Get geographical location

Disassembly:
mov ecx, 0x41ff88
jmp 0x4058b0
mov eax, 0x40bdff
call fcn.0040b8a0
mov eax, 0x1004
call fcn.0040b940
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
call fcn.004052a7
xor ebx, ebx
lea ecx, [esi + 0x1020]
mov dword [ebp - 4], ebx
call fcn.004010a8
mov edx, 0x1ff
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x80e]
mov word [ebp - 0x810], bx
mov word [ebp - 0x1010], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x100e]
mov dword [esi + 0x1034], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x400
lea eax, [ebp - 0x810]
push edi
push eax
mov dword [esi + 0x102c], ebx
mov dword [esi + 0x1030], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x1001
push edi
mov dword [esi], 0x40d438
call ebx
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x1010]
push eax
call sub.MSVCRT.dll_wcscpy
pop ecx
lea eax, [ebp - 0x810]
pop ecx
push edi
push eax
push 0x1002
push edi
call ebx
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_wcslen
test eax, eax
pop ecx
je 0x4059a3
lea eax, [ebp - 0x1010]
push 0x4147fc
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x1010]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 0x810]
push edi
push eax
push 0x1004
push 0x800
call ebx
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_wcslen
test eax, eax
pop ecx
je 0x4059ef
lea eax, [ebp - 0x1010]
push 0x4147f8
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x1010]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
push 0
call sub.MSVCRT.dll__wsetlocale
pop ecx
mov eax, esi
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x405a2c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x40be53
call fcn.0040b8a0
sub esp, 0x14
and dword [ebp - 0x20], 0
push ebx
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.004010a8
mov esi, 0x400
lea ecx, [ebp - 0x10]
push esi
mov dword [ebp - 4], 1
call fcn.00401908
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401984
push str.WinScan2PDF_Tmp_
lea ecx, [ebp - 0x14]
call fcn.0040114f
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.004012b0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004019e0
push esi
lea ecx, [ebp - 0x10]
call fcn.00401908
push eax
push 0x414810
call fcn.0040239b
pop ecx
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401984
mov esi, 0x4140b4
lea ecx, [ebp - 0x10]
push esi
push 0x41480c
call fcn.004012fe
mov edi, 0x414808
lea ecx, [ebp - 0x14]
push edi
call fcn.0040114f
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
call fcn.004012b0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004019e0
push esi
mov ebx, 0x414800
push ebx
lea ecx, [ebp - 0x10]
call fcn.004012fe
test eax, eax
je 0x405b0b
push esi
jmp 0x405afb
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
call fcn.004010b4
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.004014de
test eax, eax
jne 0x405b6b
push edi
lea ecx, [ebp - 0x14]
call fcn.0040114f
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00404b6b
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.004011e6
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.004019e0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004019e0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004010b4
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004019e0
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004019e0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x406be7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00405cff
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
invalid
Function at 0x408e83
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov eax, 0x40c174
call fcn.0040b8a0
sub esp, 0x418
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x14]
mov esi, 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, ebx
jne 0x408ed7
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x408ecd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
jmp 0x408f82
lea eax, [ebp - 0x10]
push eax
push 0x40d52c
push 1
push ebx
push 0x40d53c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, ebx
jl 0x408f6f
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], ebx
cmp eax, ebx
je 0x408f0f
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push 0x414bd0
push eax
call dword [ecx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
push edx
push eax
mov byte [ebp - 4], 1
call dword [ecx + 0x50]
mov edi, eax
cmp edi, ebx
jl 0x408f5f
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov edi, eax
cmp edi, ebx
jl 0x408f5f
push esi
lea eax, [ebp - 0x424]
push dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
mov eax, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 0x424]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
mov edi, eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x408f6f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x408f80
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x409603
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x40c23c
call fcn.0040b8a0
sub esp, 0x214
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.004096fb
mov edi, eax
cmp edi, esi
je 0x40964d
cmp dword [ebp - 0x10], esi
je 0x409646
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4096ea
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x4096be
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x10]
push eax
call fcn.00409603
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x4096ab
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x409670
cmp dword [ebp - 0x10], esi
je 0x4096b9
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x4096ea
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4096d1
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x4096e8
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x409890
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x810]
mov dword [esi], 0x40d48c
push 7
push 2
push dword [esi + 0x81c]
call fcn.004098f5
mov esi, dword [esi + 8]
test esi, esi
je 0x4098c5
push 0x444
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret
Function at 0x409982
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
mov ebx, str.Shell_TrayWnd
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x4099bf
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
cmp eax, edi
je 0x4099bf
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x409a83
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x409a25
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x409a09
dec eax
je 0x4099ea
dec eax
je 0x409a09
dec eax
jne 0x409a83
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
jmp 0x409a83
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
jmp 0x409a04
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x409a62
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x409a50
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x409a83
add eax, 0xffffffe2
jmp 0x409a80
mov esi, dword [ebp + 8]
push edi
push esi
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409b98
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [esi + 0x810], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x80c], eax
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, esi
call fcn.00409b16
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x409bd1
mov dword [esi + 0x814], eax
cmp dword [ebp + 0x18], 0
je 0x409c03
mov eax, dword [esi + 8]
test eax, eax
je 0x409bea
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x409c0b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
push 1
pop eax
pop esi
pop ebp
ret 0x14
Function at 0x40a84f
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, ecx
push edi
push dword [ebx + 0x38]
call fcn.0040a7ec
pop ecx
push dword [ebx + 0x30]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40a990
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 0x30]
jne 0x40a990
push dword [ebx + 0x24]
push dword [ebx + 0x38]
call dword [sym.imp.USER32.dll_GetSubMenu]
xor edi, edi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x40a990
push esi
push 1
pop esi
mov ecx, ebx
push esi
mov dword [ebx + 0x14], esi
push dword [ebx + 0x24]
call fcn.0040a4ee
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
mov dword [ebp - 0x1c], edi
push dword [ebx + 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.0040a4be
mov eax, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebx + 0x2c]
call esi
lea eax, [ebp - 0x1c]
push 2
push eax
push edi
push dword [ebx + 0x2c]
call esi
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], 0x14
mov dword [0x425df4], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, esi
push eax
push esi
push 0x40a994
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x425df8], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 0x2c]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x140
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
cmp eax, esi
je 0x40a965
push 0xaffe0000
push eax
push 0x111
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
or dword [ebx + 0x10], 0xffffffff
push esi
push dword [ebx + 0x24]
mov ecx, ebx
call fcn.0040a4ee
push dword [0x425df8]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x425df8], esi
mov dword [0x425df4], esi
mov dword [ebx + 0x18], esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x40b3d4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 8], 0xffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
xor edi, edi
call ebx
test eax, eax
jle 0x40b415
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax], 9
je 0x40b412
push dword [ebp + 0x10]
add dword [ebp - 4], 2
inc edi
call ebx
cmp edi, eax
jl 0x40b3f9
jmp 0x40b415
mov dword [ebp - 8], edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x48], 0
jne 0x40b458
push str.NULL_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 6
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetCurrentObject]
test eax, eax
je 0x40b458
lea ebx, [esi + 0x50]
push ebx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x4cc]
mov ebx, 0x100000
neg eax
sbb eax, eax
mov edi, dword [sym.imp.USER32.dll_DrawTextW]
and eax, 0xfff00000
add eax, ebx
or al, 0x24
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x40b4b5
mov ecx, dword [esi + 0x4cc]
neg ecx
sbb ecx, ecx
and ecx, 0xfff00000
add ecx, ebx
or ecx, 0x26
push ecx
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ecx + eax*2 + 2]
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x40b6a9
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0x10]
cmp dword [ebp + 0x10], eax
push esi
push ecx
push 0x40d4d0
setne al
and dword [ebp + 0x10], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x40b6fd
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x40b707
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0xc]
cmp dword [ebp + 0xc], eax
push esi
push ecx
push 0x40d4d0
setne al
and dword [ebp + 0xc], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x40b749
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret
Function at 0x40b76a
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc1c
push esi
xor esi, esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x41c]
push 0x208
push ecx
push eax
call fcn.0040b753
mov eax, dword [0x42571c]
mov ecx, 0x81
mov dword [ebp - 0x214], eax
xor eax, eax
lea edi, [ebp - 0x210]
push 0x414d28
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x214]
push str.___bg
push eax
call sub.MSVCRT.dll_wcscat
mov eax, dword [0x42571c]
add esp, 0x24
mov dword [ebp - 0xc1c], eax
mov ecx, 0x1ff
xor eax, eax
cmp dword [ebp + 0xc], esi
lea edi, [ebp - 0xc18]
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
setne al
lea ecx, [ebp - 4]
add eax, 0x80000001
push ecx
push 0x40d4d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push 1
lea eax, [ebp - 0xc]
pop edi
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b889
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
je 0x40b885
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, edi
jmp 0x40b88b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x452a53ff
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2aed6ce5
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x28d26070
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x1b4e33ac
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219