joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408424
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
push esi
push str.ReturnClientInfo_start
call fcn.00403cd5
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x3e8]
push dword [ebp + 0x10]
push eax
call fcn.0040ca1b
lea eax, [ebp - 0x3e8]
push eax
push 0xc9
lea eax, [ebp - 0x1f4]
push str._d__s_r_n
push eax
call fcn.0040c87c
lea eax, [ebp - 0x1f4]
push eax
push str.sending_info__s_to_client
call fcn.00403cd5
add esp, 0x28
lea eax, [ebp - 0x1f4]
push 0
push eax
call fcn.0040c9a0
mov esi, dword [ebp + 0xc]
pop ecx
push eax
lea eax, [ebp - 0x1f4]
push eax
push dword [esi + 0x124]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
jne 0x4084c0
push str.send
push esi
call fcn.0040b709
push esi
push dword [ebp + 8]
call fcn.0040bf9e
add esp, 0x10
jmp 0x4084cb
push str.ReturnClientInfo_end
call fcn.00403cd5
pop ecx
pop esi
leave
ret

Function at 0x4084ce
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push str.ReturnClientOK_start
call fcn.00403cd5
push 0xfa
lea eax, [ebp - 0xc]
push str._d_OK_r_n
push eax
call fcn.0040c87c
lea eax, [ebp - 0xc]
push eax
push str.sending_ok__s_to_client
call fcn.00403cd5
add esp, 0x18
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.0040c9a0
mov esi, dword [ebp + 0xc]
pop ecx
push eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x124]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
jne 0x408541
push str.send
push esi
call fcn.0040b709
push esi
push dword [ebp + 8]
call fcn.0040bf9e
add esp, 0x10
jmp 0x40854c
push str.ReturnClientOK_end
call fcn.00403cd5
pop ecx
pop esi
leave
ret
Function at 0x409f9a
Capabilities:
Create service
Persist via run registry key
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
push str.CreatePoweroffService_start
call fcn.00403cd5
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
push ebx
push dword [ebp + 8]
call fcn.00409d2b
add esp, 0x10
test eax, eax
je 0x40a0e9
push ebx
mov esi, reloc.WSOCK32.dll_bind
push str.SYSTEMCurrentControlSetServicesPoweroffParameters
push esi
call fcn.0040a7e4
add esp, 0xc
cmp dword [ebx + 0x750], 1
jne 0x40a021
push str.Creating_WIN98_service
call fcn.00403cd5
lea eax, [ebp - 0x104]
push eax
push str.Poweroff
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push esi
call fcn.0040631d
add esp, 0x14
test al, al
je 0x40a03e
push str.Please_restart_your_computer_to_start_the_service
push dword [ebp + 8]
push ebx
jmp 0x40a0d6
push str.Creating_real_NT_service
call fcn.00403cd5
pop ecx
xor esi, esi
push 2
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, esi
jne 0x40a04d
push dword [ebp + 8]
push ebx
call fcn.00403ed0
pop ecx
jmp 0x40a0e8
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x104]
push esi
push eax
push 1
push 2
push 0x110
mov eax, str.Poweroff
push 0xf0010
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, eax
cmp ebx, esi
jne 0x40a091
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00403ed0
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40a0e9
push str.Starting_service
call fcn.00403cd5
pop ecx
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40a0c4
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00403ed0
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ecx
pop ecx
push ebx
call esi
push edi
call esi
jmp 0x40a0e9
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.Poweroff_service_succesfully_installed
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00403dee
add esp, 0xc
push str.CreatePoweroffService_end
call fcn.00403cd5
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a0ee
Capabilities:
Delete service
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push str.RemovePoweroffService_start
call fcn.00403cd5
mov ebx, dword [ebp + 0xc]
pop ecx
cmp dword [ebx + 0x750], 1
jne 0x40a13c
push str.Deleting_WIN98_service
call fcn.00403cd5
mov dword [esp], str.Poweroff
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.WSOCK32.dll_bind
call fcn.0040650e
add esp, 0xc
test al, al
je 0x40a15d
push str.Please_restart_your_computer_to_stop_the_service
jmp 0x40a1bc
push str.Deleting_NT_service
call fcn.00403cd5
mov dword [esp], 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40a16a
push dword [ebp + 8]
push ebx
call fcn.00403ed0
pop ecx
pop ecx
jmp 0x40a1e4
push 0x10000
push str.Poweroff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40a195
push dword [ebp + 8]
push ebx
call fcn.00403ed0
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40a1e4
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40a1ab
push dword [ebp + 8]
push ebx
call fcn.00403ed0
pop ecx
pop ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push str.Poweroff_service_succesfully_deleted
push dword [ebp + 8]
push ebx
call fcn.00403dee
add esp, 0xc
push str.SYSTEMCurrentControlSetServicesPoweroffParameters
push reloc.WSOCK32.dll_bind
call fcn.0040655b
push str.RemovePoweroffService_end
call fcn.00403cd5
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a4b3
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push str.IsPoweroffServiceRunning_start
call fcn.00403cd5
mov eax, dword [ebp + 0xc]
pop ecx
cmp dword [eax + 0x750], 1
je 0x40a53c
push closesocket
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40a53c
push 4
push str.Poweroff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40a504
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40a53c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x40a521
call esi
push edi
call esi
jmp 0x40a53c
call esi
push edi
call esi
cmp dword [ebp - 0x18], 4
jne 0x40a531
push 1
pop eax
jmp 0x40a53e
push str.IsPoweroffServiceRunning_stop
call fcn.00403cd5
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40a542
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push str.StartPoweroffService_start
call fcn.00403cd5
mov esi, dword [ebp + 0xc]
pop ecx
cmp dword [esi + 0x750], 1
je 0x40a5d1
push 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40a57f
push dword [ebp + 8]
push esi
call fcn.00403ed0
pop ecx
jmp 0x40a5db
push 0x10
push str.Poweroff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40a5a9
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00403ed0
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40a5dc
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40a5c5
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00403ed0
pop ecx
pop ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push str.StartPoweroffService_end
call fcn.00403cd5
pop ecx
pop edi
pop esi
pop ebp
ret

Function at 0x40a5e0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push str.StopPoweroffService_start
call fcn.00403cd5
mov ebx, dword [ebp + 0xc]
pop ecx
cmp dword [ebx + 0x750], 1
je 0x40a671
push 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40a621
push dword [ebp + 8]
push ebx
call fcn.00403ed0
pop ecx
jmp 0x40a67b
push 0x20
push str.Poweroff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40a649
push dword [ebp + 8]
push ebx
call fcn.00403ed0
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40a67c
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40a665
push dword [ebp + 8]
push ebx
call fcn.00403ed0
pop ecx
pop ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push str.StopPoweroffService_end
call fcn.00403cd5
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40bc33
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push str.InitializeSockets_start
call fcn.00403cd5
pop ecx
lea eax, [ebp - 0x190]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x40bc6d
push str.InitializeSockets_end_because_WSAStartup_failed
call fcn.00403cd5
pop ecx
or eax, 0xffffffff
leave
ret
cmp byte [ebp - 0x190], 1
jne 0x40bc91
xor eax, eax
mov al, byte [ebp - 0x18f]
cmp al, 1
jne 0x40bc91
push str.InitializeSockets_end
call fcn.00403cd5
pop ecx
xor eax, eax
leave
ret
call dword [sym.imp.WSOCK32.dll_WSACleanup]
movzx eax, byte [ebp - 0x190]
push eax
xor eax, eax
mov al, byte [ebp - 0x18f]
movzx eax, al
push eax
push str.InitializeSockets_end__version_d._d
call fcn.00403cd5
add esp, 0xc
push 0xfffffffffffffffe
pop eax
leave
ret
Function at 0x40bcfd
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push str.CreateServerSocket_start
call fcn.00403cd5
mov esi, dword [ebp + 0xc]
or edi, 0xffffffff
pop ecx
cmp dword [esi + 0x120], edi
je 0x40bd29
push esi
push dword [ebp + 8]
call fcn.0040bfec
pop ecx
pop ecx
push 6
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, edi
mov dword [esi + 0x120], eax
jne 0x40bd46
push str.socket
jmp 0x40bdbe
mov ax, word [esi + 0x228]
mov word [ebp - 0x10], 2
push eax
call dword [sym.imp.WSOCK32.dll_htons]
push 0
mov word [ebp - 0xe], ax
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [esi + 0x120]
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, edi
jne 0x40bd86
push str.bind
jmp 0x40bdbe
push 1
push dword [esi + 0x120]
call dword [sym.imp.WSOCK32.dll_listen]
cmp eax, edi
jne 0x40bd9f
push str.listen
jmp 0x40bdbe
push 8
push 0x3e8
push dword [ebp + 8]
push dword [esi + 0x120]
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
cmp eax, edi
jne 0x40bdca
push str.WSAAsyncSelect
push esi
call fcn.0040b709
pop ecx
mov eax, edi
pop ecx
jmp 0x40bdd7
push str.CreateServerSocket_end
call fcn.00403cd5
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x40be8c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov al, byte [0x41f3f4]
push ebx
push esi
push edi
push 0x19
mov byte [ebp - 0x70], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x6f]
push str.ReadFromClientSocket_start
rep stosd dword es:[edi], eax
call fcn.00403cd5
mov esi, dword [ebp + 0xc]
pop ecx
push 0
lea eax, [ebp - 0x70]
push 0x64
push eax
push dword [esi + 0x124]
call dword [sym.imp.WSOCK32.dll_recv]
mov ebx, eax
test ebx, ebx
jne 0x40bedf
push esi
push dword [ebp + 8]
call fcn.0040bf9e
pop ecx
pop ecx
jmp 0x40bf8c
cmp ebx, 0xffffffff
jne 0x40bf02
push str.send
push esi
call fcn.0040b709
push esi
push dword [ebp + 8]
call fcn.0040bf9e
add esp, 0x10
or eax, ebx
jmp 0x40bf99
and byte [ebp + ebx - 0x70], 0
lea eax, [ebp - 0x70]
push eax
push str.Received_data_from_client:__s
call fcn.00403cd5
and dword [ebp - 8], 0
pop ecx
test ebx, ebx
pop ecx
jle 0x40bf8c
mov edi, 0x41f440
mov eax, dword [ebp - 8]
lea esi, [ebp + eax - 0x70]
mov al, byte [ebp + eax - 0x70]
cmp al, 0xa
jne 0x40bf4b
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408e17
add esp, 0xc
and byte [0x41f440], 0
jmp 0x40bf84
cmp al, 0xd
je 0x40bf84
push edi
call fcn.0040c9a0
cmp eax, 0x1f4
pop ecx
jb 0x40bf6f
push str.Command_too_long
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408387
jmp 0x40bf3f
mov al, byte [esi]
and byte [ebp - 1], 0
mov byte [ebp - 2], al
lea eax, [ebp - 2]
push eax
push edi
call fcn.0040c710
pop ecx
pop ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x40bf24
push str.ReadFromClientSocket_end
call fcn.00403cd5
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c472
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push str.get_broadcast_addr_start
call fcn.00403cd5
mov esi, dword [sym.imp.WSOCK32.dll_inet_addr]
pop ecx
push dword [esp + 0x14]
call esi
mov edi, dword [sym.imp.WSOCK32.dll_ntohl]
push eax
call edi
push dword [esp + 0x18]
mov ebx, eax
call esi
push eax
call edi
mov ecx, eax
and ecx, ebx
not eax
or ecx, eax
push ecx
call dword [sym.imp.WSOCK32.dll_htonl]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
push dword [esp + 0x14]
call fcn.0040c700
push dword [esp + 0x18]
push str.get_broadcast_addr_end__addr_s
call fcn.00403cd5
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x40c4d7
Capabilities:
Create udp socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
push esi
mov al, 0xff
push dword [ebp + 0x10]
mov byte [ebp - 0xc], al
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], al
push dword [ebp + 0xc]
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov byte [ebp - 7], al
xor eax, eax
lea edi, [ebp - 6]
push str.WakeOnLan_start__ip_s__mask_s__mac_s
mov dword [ebp - 0x1c], 1
stosd dword es:[edi], eax
call fcn.00403cd5
push dword [ebp + 0x10]
lea eax, [ebp - 0x60]
push dword [ebp + 0xc]
push eax
call fcn.0040c472
mov al, byte [esi + 1]
push eax
call fcn.0040c453
mov bl, al
mov al, byte [esi]
push eax
call fcn.0040c453
shl al, 4
add bl, al
mov al, byte [esi + 2]
push eax
mov byte [ebp - 0x18], bl
call fcn.0040c453
mov bl, al
mov al, byte [esi + 3]
push eax
shl bl, 4
call fcn.0040c453
add bl, al
mov al, byte [esi + 4]
push eax
mov byte [ebp - 0x17], bl
call fcn.0040c453
mov bl, al
mov al, byte [esi + 5]
push eax
shl bl, 4
call fcn.0040c453
add bl, al
mov al, byte [esi + 6]
push eax
mov byte [ebp - 0x16], bl
call fcn.0040c453
mov bl, al
mov al, byte [esi + 7]
push eax
shl bl, 4
call fcn.0040c453
add bl, al
mov al, byte [esi + 8]
push eax
mov byte [ebp - 0x15], bl
call fcn.0040c453
add esp, 0x40
mov bl, al
mov al, byte [esi + 9]
push eax
shl bl, 4
call fcn.0040c453
add bl, al
mov al, byte [esi + 0xa]
push eax
mov byte [ebp - 0x14], bl
call fcn.0040c453
mov bl, al
shl bl, 4
mov al, byte [esi + 0xb]
push eax
call fcn.0040c453
add bl, al
lea eax, [ebp - 0xc]
push 6
push eax
lea eax, [ebp - 0xe0]
mov byte [ebp - 0x13], bl
push eax
call fcn.0040cbe0
add esp, 0x18
lea esi, [ebp - 0xda]
push 0x14
pop edi
lea eax, [ebp - 0x18]
push 6
push eax
push esi
call fcn.0040cbe0
add esp, 0xc
add esi, 6
dec edi
jne 0x40c5ef
lea eax, [ebp - 0x60]
mov word [ebp - 0x2c], 2
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 7
mov dword [ebp - 0x28], eax
call dword [sym.imp.WSOCK32.dll_htons]
push 0
push 2
push 2
mov word [ebp - 0x2a], ax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c64d
push str.socket
push dword [ebp + 8]
call fcn.0040b709
pop ecx
pop ecx
push 0xfffffffffffffffb
pop eax
jmp 0x40c6d6
lea eax, [ebp - 0x1c]
push 4
push eax
push 0x20
push 0xffff
push esi
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x40c679
push str.setsockopt
push dword [ebp + 8]
call fcn.0040b709
pop ecx
pop ecx
push 0xfffffffffffffffa
jmp 0x40c6b2
push str.Sending_magic_packet
call fcn.00403cd5
pop ecx
lea eax, [ebp - 0x2c]
push 0x10
push eax
push 0
lea eax, [ebp - 0xe0]
push 0x7e
push eax
push esi
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x40c6be
push str.sendto
push dword [ebp + 8]
call fcn.0040b709
pop ecx
pop ecx
push 0xfffffffffffffff9
pop edi
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
mov eax, edi
jmp 0x40c6d6
test esi, esi
jl 0x40c6c9
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
push str.WakeOnLan_end
call fcn.00403cd5
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401af9
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push eax
call fcn.0042d000
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x14]
push eax
push 1
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x401c67
cmp dword [esp + 0x14], eax
je 0x401c67
lea esi, [esp + 0x20]
call fcn.00401170
mov ecx, dword [esp + 0x14]
push ecx
mov edx, esi
push edx
call fcn.00401470
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
test eax, eax
jle 0x401c3f
xor ebp, ebp
cmp dword [esp + 0x18], ebp
jle 0x401c2c
lea esp, [esp]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
imul eax, ebx
cdq
imul ecx, ebp
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0x28]
movzx edi, byte [ecx + eax + 3]
movzx esi, byte [ecx + eax]
add ecx, eax
imul esi, edi
add esi, 0x7f
mov eax, 0x80808081
imul esi
add edx, esi
movzx esi, byte [ecx + 1]
sar edx, 7
imul esi, edi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx], al
add esi, 0x7f
mov eax, 0x80808081
imul esi
add edx, esi
movzx esi, byte [ecx + 2]
sar edx, 7
imul esi, edi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx + 1], al
add esi, 0x7f
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
inc ebp
cmp ebp, dword [esp + 0x18]
mov byte [ecx + 2], al
jl 0x401ba0
inc ebx
cmp ebx, dword [esp + 0x1c]
jl 0x401b90
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ecx
push ecx
push eax
mov ebx, eax
mov eax, dword [esp + 0x60]
lea esi, [esp + 0x2c]
call fcn.00401380
mov ecx, esi
call fcn.004011e0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret 4
Function at 0x401db0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
sub esp, 0x20
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xffffff7f
or eax, 0x40000
cmp dword [0x456b38], 1
jne 0x401ddb
or eax, 8
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
lea ecx, [esp]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [esp + 0x24], 0
mov eax, 0x49
je 0x401e24
mov eax, 0x4b
xor ecx, ecx
cmp dword [0x456b38], 1
jne 0x401e32
or ecx, 0xffffffff
push eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x10]
push 0
add eax, dword [esp + 0x24]
push 0
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
add eax, dword [esp + 0x28]
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
push eax
mov eax, dword [edx + 0x48]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 1
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0x20
ret 4

Function at 0x403900
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push edi
mov ecx, esi
call edx
test eax, eax
jne 0x40391e
xor al, al
pop edi
pop esi
pop ebx
add esp, 0x18
ret
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0xc]
mov ebx, dword [esi + 4]
push 0x40
mov edx, ecx
sub edx, eax
sub eax, ecx
add eax, dword [esp + 0x20]
push edx
mov edx, edi
sub edx, ebx
push edx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
sub eax, edi
add eax, dword [esp + 0x28]
mov ecx, esi
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.00403a40
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
mov byte [esi + 0x1055], 0
pop esi
mov al, 1
pop ebx
add esp, 0x18
ret
Function at 0x4039b0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
push esi
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
test eax, eax
jne 0x4039ca
xor al, al
pop esi
add esp, 0x18
ret
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
push 0x40
push ecx
push edx
mov edx, dword [eax + 0x48]
push 0
push 0
push 0
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.00403a40
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov byte [esi + 0x1055], 1
mov al, 1
pop esi
add esp, 0x18
ret

Function at 0x4040e0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404108
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x446d54
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push ecx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret