joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006321
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
xor ebx, ebx
inc ebx
push ebx
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 4], eax
test eax, eax
je 0x10006354
push esi
push esi
push edi
push 0x10006082
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [edi + 8], eax
cmovne esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x406300
Capabilities:
Parse pe header
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x41b250]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x58], 0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffff
jne 0x406356
jmp 0x406447
push 0
lea ecx, [ebp - 0x154]
push ecx
push 0x40
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40638d
cmp dword [ebp - 0x154], 0x40
jne 0x40638d
movzx ecx, word [ebp - 0x48]
cmp ecx, 0x5a4d
je 0x406392
jmp 0x406447
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x154]
push ecx
push 0xf8
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x4063e4
cmp dword [ebp - 0x154], 0xf8
jne 0x4063e4
cmp dword [ebp - 0x150], 0x4550
je 0x4063e6
jmp 0x406447
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x406405
jmp 0x406447
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x406422
jmp 0x406447
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00406490
test eax, eax
jne 0x406439
jmp 0x406447
mov dword [ebp - 0x58], 1
jmp 0x406447
cmp dword [ebp - 4], 0
je 0x406457
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x4c], 0
je 0x406467
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x50], 0xffffffff
je 0x406477
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040fa05
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406490
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x4064af
jmp 0x40654f
cmp dword [ebp + 0x10], 0x320
je 0x4064bd
jmp 0x40654f
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x4064da
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x4064dc
jmp 0x40654f
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x4064f5
jmp 0x40654f
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00406df0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40651d
cmp dword [ebp - 8], 0
je 0x40651d
cmp dword [ebp - 0xc], 0
jne 0x40651f
jmp 0x40654f
cmp dword [ebp - 0xc], 0x320
je 0x40652a
jmp 0x40654f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040faa0
add esp, 0xc
mov dword [ebp - 0x14], 1
jmp 0x40654f
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407390
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [0x41b250]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xb8], 0x41c21a
mov dword [ebp - 0xb4], 0x40e5e0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0x94
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x101
push 0x4216a0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x320
lea edx, [ebp - 0x3e0]
push edx
push 0x4216a0
call fcn.00406300
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0
je 0x40746f
lea eax, [ebp - 0x3e0]
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
movsx edx, byte [ecx]
mov dword [0x41c274], edx
mov eax, dword [ebp - 0xbc]
movsx ecx, byte [eax + 1]
mov dword [0x41c278], ecx
mov edx, dword [ebp - 0xbc]
movsx eax, byte [edx + 2]
mov dword [0x41c27c], eax
push 0x100
mov ecx, dword [ebp - 0xbc]
add ecx, 0x20
push ecx
push 0x41c280
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x98], 2
jne 0x40753e
cmp dword [ebp - 0xa4], 5
jb 0x4074e7
mov dword [0x41c23c], 1
cmp dword [ebp - 0xa4], 5
ja 0x4074a1
cmp dword [ebp - 0xa0], 1
jb 0x4074ab
mov dword [0x41c240], 1
cmp dword [ebp - 0xa4], 6
jb 0x4074be
mov dword [0x41c244], 1
cmp dword [ebp - 0xa4], 6
jbe 0x4074e7
mov dword [0x41c248], 1
cmp dword [ebp - 0x9c], 0x55f0
jb 0x4074e7
mov dword [0x41c24c], 1
push 0x2e
push 0x4216a0
call fcn.0040c960
mov dword [ebp - 8], eax
push str..EXS
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407513
mov dword [0x41c264], 1
cmp dword [0x41c244], 0
jne 0x40753e
mov dword [ebp - 0x3e8], 2
push 4
lea eax, [ebp - 0x3e8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov byte [0x421280], 0
cmp dword [0x41c264], 0
je 0x407630
mov ecx, dword [ebp + 8]
mov dword [0x42192c], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x42126c], edx
mov eax, dword [ebp + 0x14]
mov dword [0x421a6c], eax
mov dword [0x41d080], 0x110
mov dword [0x41d084], 1
mov dword [0x41d088], 1
mov dword [0x41d08c], 0
mov dword [0x41d090], 0
mov dword [0x41d094], 0
mov dword [0x41d098], 0
mov dword [ebp - 4], 0
jmp 0x4075c4
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x10
jg 0x4075da
mov edx, dword [ebp - 4]
mov dword [edx*4 + 0x4218e0], 0
jmp 0x4075bb
mov dword [0x421928], 0
mov dword [0x421a70], 0
mov dword [0x421bac], 1
mov dword [0x421270], 0
mov dword [0x421924], 0
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x407629
mov eax, 0xff
jmp 0x407645
mov eax, dword [0x41c26c]
jmp 0x407645
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00407660
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fa05
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a8a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x41b250]
xor eax, ebp
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x40a8da
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x5c
jne 0x40a8da
mov dword [ebp - 0x14], 1
jmp 0x40a8e1
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40a937
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
lea eax, [eax + edx - 1]
xor edx, edx
div dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x20]
jb 0x40a935
mov dword [ebp - 4], 1
jmp 0x40a93e
mov dword [ebp - 4], 1
cmp dword [0x41c230], 0
je 0x40aa20
mov dword [ebp - 0xd8], 0x94
lea edx, [ebp - 0xd8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xcc]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0x3e8
jle 0x40aa20
push 0x41af18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x40aa20
push str.GetDiskFreeSpaceExA
mov edx, dword [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x40aa13
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40aa13
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xe8]
jb 0x40aa0c
ja 0x40aa03
mov ecx, dword [ebp - 0xe0]
cmp ecx, dword [ebp - 0xec]
jb 0x40aa0c
mov dword [ebp - 4], 1
jmp 0x40aa13
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.0040fa05
mov esp, ebp
pop ebp
ret 8
Function at 0x40be50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x41b250]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 0
mov edx, dword [ebp + 0x1c]
push edx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x2e
lea ecx, [ebp - 0x230]
push ecx
call fcn.0040c3e0
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x40beb0
mov edx, dword [ebp - 0x120]
mov byte [edx], 0
push str.SoftwareWilson_WindowWareSettings_
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41b05c
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp + 0x20], 0
je 0x40bf65
lea eax, [ebp - 8]
push eax
push 1
push 0
lea ecx, [ebp - 0x118]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x40bf65
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x40bf5b
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x11c], 0
jne 0x40bfd9
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x24]
or edx, 1
push edx
push 0
lea eax, [ebp - 0x118]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x40bfd9
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x40bfcf
mov dword [ebp - 0x11c], 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040fa05
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40c5b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
je 0x40c64a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, 1
test ecx, ecx
je 0x40c64a
push 0x4ff
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x102
jne 0x40c5fb
jmp 0x40c64a
call fcn.0040c420
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40c60d
xor eax, eax
jmp 0x40c657
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
jae 0x40c62c
or ecx, 0xffffffff
sub ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
jmp 0x40c635
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jb 0x40c63f
jmp 0x40c64a
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
jmp 0x40c5cf
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x40ca10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x2c], str.WBShutdownWaiter
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], sym.wbcmp44i.exe_WaitShutWndProc
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0x1e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
push 0x41b0d4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x40], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x3c], eax
cmp dword [0x41c220], 0
jne 0x40ca73
mov dword [ebp - 0x38], 6
jmp 0x40ca7a
mov dword [ebp - 0x38], 0x10
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
movzx ecx, ax
test ecx, ecx
jne 0x40caaa
mov dword [0x41c38c], 0xf7
or eax, 0xffffffff
jmp 0x40cbb7
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov word [ebp - 4], ax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov word [ebp - 0xc], ax
push str.WbtShutdownRun__
push 0x4215a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movsx edx, byte [0x41cf60]
test edx, edx
je 0x40caef
push 0x41cf60
push 0x4215a0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40caff
push str.DEFAULT.WBT
push 0x4215a0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
movzx eax, word [ebp - 0xc]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
movzx eax, word [ebp - 4]
cdq
sub eax, edx
sar eax, 1
push eax
movzx eax, word [ebp - 0xc]
imul eax, eax, 3
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
movzx eax, word [ebp - 4]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
push 0xcf0000
push 0x4215a0
mov ecx, dword [ebp - 0x2c]
push ecx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40cb6e
mov dword [0x41c38c], 0xf6
or eax, 0xffffffff
jmp 0x40cbb7
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40cba4
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40cb7a
cmp dword [0x41c38c], 0
je 0x40cbb4
mov eax, dword [0x41c38c]
jmp 0x40cbb7
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret 4
Function at 0x40fa05
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b250]
jne 0x40fa0f
repz ret
jmp fcn.00410325

Function at 0x414173
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004111b4
and dword [ebp - 4], 0
cmp dword [0x41cd60], 0
mov ebx, eax
jne 0x414224
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4142d5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4185a4
push edi
call esi
test eax, eax
je 0x4142d5
push eax
call fcn.00411142
mov dword [esp], 0x418594
push edi
mov dword [0x41cd60], eax
call esi
push eax
call fcn.00411142
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41cd64], eax
call esi
push eax
call fcn.00411142
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41cd68], eax
call esi
push eax
call fcn.00411142
pop ecx
mov dword [0x41cd70], eax
test eax, eax
je 0x414224
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00411142
pop ecx
mov dword [0x41cd6c], eax
mov eax, dword [0x41cd6c]
cmp eax, ebx
je 0x41427c
cmp dword [0x41cd70], ebx
je 0x41427c
push eax
call fcn.004111bd
push dword [0x41cd70]
mov esi, eax
call fcn.004111bd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41427c
test edi, edi
je 0x41427c
call esi
test eax, eax
je 0x414273
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x414273
test byte [ebp - 0xc], 1
jne 0x41427c
or dword [ebp + 0x10], 0x200000
jmp 0x4142b5
mov eax, dword [0x41cd64]
cmp eax, ebx
je 0x4142b5
push eax
call fcn.004111bd
pop ecx
test eax, eax
je 0x4142b5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4142b5
mov eax, dword [0x41cd68]
cmp eax, ebx
je 0x4142b5
push eax
call fcn.004111bd
pop ecx
test eax, eax
je 0x4142b5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41cd60]
call fcn.004111bd
pop ecx
test eax, eax
je 0x4142d5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4142d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4033a8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c207f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.mfc42.dll_CString::CString_4
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x4fb5f0
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.mfc42.dll_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.mfc42.dll_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.mfc42.dll_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x403438
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c20af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.mfc42.dll_CString::CString_4
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x4fb5f6
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.mfc42.dll_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.mfc42.dll_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.mfc42.dll_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x406278
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c270f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.mfc42.dll_CString::CString_4
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x4fbe0c
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.mfc42.dll_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.mfc42.dll_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.mfc42.dll_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x4076c0
Capabilities:
Log keystrokes via application hook

Disassembly:
push 0xffffffffffffffff
push 0x4c28a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push 0
push 0x50b650
lea ecx, [esp + 0xc]
call sub.mfc42.dll_CSingleLock::CSingleLock
push 0xffffffffffffffff
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0
call sub.mfc42.dll_CSingleLock::Lock
mov eax, dword [0x50b674]
test eax, eax
jne 0x407722
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4080d0
push 2
call dword [sym.imp.user32.dll_SetWindowsHookExA]
mov dword [0x50b674], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [0x50b640]
push eax
push ecx
mov ecx, 0x50b638
call sub.mfc42.dll_CPtrArray::SetAtGrow
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call sub.mfc42.dll_CSingleLock::Unlock
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x408c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c2a43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4cc424
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call sub.mfc42.dll_CPtrArray::CPtrArray
mov dword [ebx], 0x4cc410
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call sub.mfc42.dll_CPtrArray::CPtrArray
or eax, 0xffffffff
push 0x50b6b8
mov dword [ebx], 0x4cc3d4
push edi
mov dword [esi], 0x4cc3e8
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.kernel32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret