joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498381
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00454d4b
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call fcn.00454d4b
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.MSVCRT.DLL__wrename]
add esp, 8
mov edx, eax
mov eax, 0
cmp eax, edx
sete al
xor ah, ah
cwde
leave
ret 8
Function at 0x49de4e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov dword [ebp - 0xc], eax
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
cmp eax, 0
je 0x49df92
push 0x64
call fcn.00441fb9
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x49df75
mov eax, dword [ebp - 0x1c]
cmp eax, 0
je 0x49dec4
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0x3d
jne 0x49dec4
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 1]
cmp al, 0
jne 0x49dec4
jmp 0x49dec8
xor eax, eax
jmp 0x49decb
xor eax, eax
inc eax
cmp eax, 0
je 0x49df63
push 0xffffffffffffffff
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.00447c7b
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.00447c7b
mov eax, dword [ebp - 0x1c]
shl eax, 1
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 2]
cmp al, 0
jne 0x49df39
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 3]
cmp al, 0
jne 0x49df39
jmp 0x49df3d
xor eax, eax
jmp 0x49df40
xor eax, eax
inc eax
cmp eax, 0
je 0x49df4c
jmp 0x49df7e
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x14], eax
mov eax, 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
jne 0x49dea2
push dword [ebp - 0x18]
call fcn.0044133b
mov dword [ebp - 0x1c], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x18]
call fcn.00462402
leave
ret
Function at 0x49dfeb
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xe4
push 8
call fcn.0048b22f
push eax
call fcn.00457dfe
mov dword [ebp - 0xc], eax
call fcn.0048b22f
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax]
add eax, 0x14
mov dword [ebp - 0x10], eax
mov eax, 0x9c
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax + 0x14], edx
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xb4]
mov al, byte [eax + 0x9a]
cmp al, 1
setne al
xor ah, ah
cwde
mov dword [ebp - 0xec], eax
push 0
push dword [ebp - 0x18]
push 8
push str.Windows
call fcn.00447bb7
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 4]
cmp eax, 5
je 0x49e136
cmp eax, 6
je 0x49e191
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49e103
mov eax, dword [ebp - 0xe8]
cmp eax, 0x4f3d
jl 0x49e0d3
mov eax, str.Server_2022
jmp 0x49e101
mov eax, dword [ebp - 0xe8]
cmp eax, 0x42ee
jl 0x49e0e7
mov eax, str.Server_2019
jmp 0x49e101
xor eax, eax
inc eax
je 0x49e0f3
mov eax, str.Server_2016
jmp 0x49e101
call fcn.0049e0f8
mov eax, dword [ebp - 0xe8]
cmp eax, 0x55f0
jl 0x49e117
mov eax, 0x585c3c
jmp 0x49e131
xor eax, eax
inc eax
je 0x49e123
mov eax, 0x585c3f
jmp 0x49e131
call fcn.0049e128
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49e165
cmp eax, 1
je 0x49e16c
cmp eax, 2
je 0x49e173
call fcn.0049e15c
mov eax, 0x585bb6
jmp 0x49e18c
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49e187
mov eax, str.Server_2003_R2
jmp 0x49e18c
mov eax, str.Server_2003
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49e1c7
cmp eax, 1
je 0x49e1e2
cmp eax, 2
je 0x49e1fd
cmp eax, 3
je 0x49e218
call fcn.0049e1be
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49e1f6
mov eax, str.Server_2008_R1
jmp 0x49e1fb
mov eax, 0x585bf5
jmp 0x49e231
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49e211
mov eax, str.Server_2012
jmp 0x49e216
mov eax, 0x585c03
jmp 0x49e231
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49e22c
mov eax, str.Server_2012_R2
jmp 0x49e231
mov eax, 0x585c14
Function at 0x49e5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, 0x1000
mov dword [ebp - 0x18], 0x1000
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x20]
add eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x49e684
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x49e684
mov eax, 2
push edx
mov edx, dword [ebp - 0x18]
imul edx
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.MSVCRT.DLL_realloc]
add esp, 8
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x49e602
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
leave
ret 8
Function at 0x524351
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x52539e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x5253cc
cmp eax, 5
je 0x525403
mov dword [ebp - 0x20], 0
jmp 0x5254b8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ec5c
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ec5c
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
jmp 0x5254b8
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.0044140f
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.00441445
mov dword [ebp - 0x14], eax
jmp 0x52548e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
je 0x525447
mov eax, dword [ebp - 0x1c]
cmp eax, 0x11
je 0x525447
xor eax, eax
jmp 0x52544a
xor eax, eax
inc eax
cmp eax, 0
je 0x525483
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ec5c
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ec5c
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
xor al, 1
cmp eax, 0
je 0x5254a6
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
jae 0x5254a6
jmp 0x5254aa
xor eax, eax
jmp 0x5254ad
xor eax, eax
inc eax
cmp eax, 0
jne 0x525422
mov eax, dword [0x577fdc]
mov dword [ebp - 0x18], eax
mov eax, 4
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
leave
ret 8

Function at 0x525e18
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
je 0x525e46
cmp eax, 0xf
je 0x525e74
mov eax, 0
jmp 0x5260bb
push dword [ebp + 8]
call fcn.0044140f
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.0044133b
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x525e72
mov eax, 0
jmp 0x5260bb
jmp 0x525e86
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x5260b8
Function at 0x52a0f4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
and eax, 0x1000000
cmp eax, 0
setne al
xor ah, ah
cwde
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
je 0x52a14c
cmp eax, 0x11
je 0x52a15c
cmp eax, 0x12
je 0x52a177
mov eax, 0
jmp 0x52a190
push 3
push dword [ebp - 0xc]
call dword [sym.imp.USER32.DLL_MapVirtualKeyW]
mov dword [ebp - 0x10], eax
jmp 0x52a190
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x52a16d
mov eax, 0xa3
jmp 0x52a172
mov eax, 0xa2
mov dword [ebp - 0x10], eax
jmp 0x52a190
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x52a188
mov eax, 0xa5
jmp 0x52a18d
mov eax, 0xa4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x52a197
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, 0
mov dword [ebp - 0xc], 0
push 0x11
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52a1cd
mov eax, 0x10000000
mov dword [ebp - 0xc], 0x10000000
push 0x10
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52a1ec
mov eax, dword [ebp - 0xc]
or eax, 0x20000000
mov dword [ebp - 0xc], eax
push 0x12
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52a20b
mov eax, dword [ebp - 0xc]
or eax, 0x40000000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
xor al, 1
cmp eax, 0
je 0x52a293
push 1
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52a236
mov eax, dword [ebp - 0xc]
or eax, 0x2000000
mov dword [ebp - 0xc], eax
push 2
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52a255
mov eax, dword [ebp - 0xc]
or eax, 0x800000
mov dword [ebp - 0xc], eax
push 4
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52a274
mov eax, dword [ebp - 0xc]
or eax, 0x1000000
mov dword [ebp - 0xc], eax
push 5
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52a293
mov eax, dword [ebp - 0xc]
or eax, 0x400000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x532743
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x583c84]
xor al, 1
cmp eax, 0
je 0x53278b
mov eax, dword [ebp + 0xc]
cmp eax, 5
jne 0x53277a
mov eax, 8
mov dword [ebp + 0xc], 8
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0053053f
leave
ret 8
Function at 0x53a40e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xd0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x25
jne 0x53a454
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0xc]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0xc]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x10]
jmp 0x53a47b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
fld dword [eax + 4]
fstp dword [ebp - 0xc]
mov eax, dword [ebp - 0xd4]
fld dword [eax + 8]
fstp dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x1c]
mov eax, 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push 0x3f800000
fld dword [esp]
add esp, 4
fstp dword [ebp - 0x30]
jmp 0x53a5d9
Function at 0x53e479
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [0x583b30], eax
push 0
call dword [sym.imp.USER32.DLL_GetDC]
mov dword [0x583b38], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [0x583b3c], eax
mov eax, 0x11c
xchg edx, eax
mov eax, dword [0x583b4c]
mov dword [eax], edx
push dword [0x583b4c]
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov eax, dword [0x583b4c]
mov eax, dword [eax + 4]
cmp eax, 5
jne 0x53e4e7
mov eax, dword [0x583b4c]
mov eax, dword [eax + 8]
cmp eax, 1
jge 0x53e4e7
jmp 0x53e4eb
xor eax, eax
jmp 0x53e4ee
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x53e4fc
call fcn.0053e232
call fcn.0053f199
mov dword [0x583c8c], eax
mov eax, dword [0x583b4c]
mov eax, dword [eax + 4]
cmp eax, 0xa
setge al
xor ah, ah
cwde
mov dword [0x583c80], eax
mov eax, dword [0x583b4c]
mov eax, dword [eax + 4]
cmp eax, 0xa
jge 0x53e56b
mov eax, dword [0x583b4c]
mov eax, dword [eax + 4]
cmp eax, 6
jl 0x53e559
mov eax, dword [0x583b4c]
mov eax, dword [eax + 8]
cmp eax, 2
jl 0x53e559
jmp 0x53e55d
xor eax, eax
jmp 0x53e560
xor eax, eax
inc eax
cmp eax, 0
jne 0x53e56b
xor eax, eax
jmp 0x53e56e
xor eax, eax
inc eax
mov dword [0x583c84], eax
mov eax, dword [0x583b4c]
mov eax, dword [eax + 4]
cmp eax, 6
setl al
xor ah, ah
cwde
mov dword [0x583c88], eax
push 0x1a
push dword [0x5828bc]
call fcn.0044fe85
mov dword [ebp - 0xc], eax
mov eax, 3
shl eax, 0x13
mov edx, eax
mov eax, 0x27
or eax, edx
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [0x583b4c]
mov eax, dword [eax + 8]
shl eax, 8
xchg edx, eax
mov eax, dword [0x583b4c]
mov eax, dword [eax + 4]
or eax, edx
and eax, 0xffff
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
call fcn.0053e27f
mov eax, dword [0x583c88]
xor al, 1
cmp eax, 0
je 0x53e5fa
call fcn.00526355
push 0
call fcn.0053e025
push dword [0x583b3c]
call fcn.00528dbd
push 0x1b
push dword [0x5828bc]
call fcn.0044fe85
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x583b4c]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [0x583b4c]
mov eax, dword [eax + 0xc]
cmp eax, 0x55f0
setge al
xor ah, ah
cwde
mov dword [0x583c7c], eax
push 0x1c
push dword [0x5828bc]
call fcn.0044fe85
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x583b4c]
mov al, byte [eax + 0x11a]
and eax, 0xff
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
call fcn.0053e368
mov eax, dword [0x583c80]
cmp eax, 0
je 0x53e6d4
push 0x5868dc
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x53e6d4
push 0x84
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x583cdc], eax
call fcn.0053e6eb
mov dword [0x583cd8], eax
push 0x53e45f
call fcn.004a18a0
push dword [0x583aec]
call fcn.00526208
leave
ret
Function at 0x53ecc7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
push dword [ebp + 8]
call fcn.0053d14b
mov dword [ebp - 0x14], eax
mov eax, 0
mov edx, dword [ebp - 0x14]
cmp eax, edx
jne 0x53eced
jmp 0x53edda
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53ed09
push 0
push dword [ebp + 0xc]
push 0xe
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53ed1c
push 0
push dword [ebp + 0xc]
push 0x149
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0
jl 0x53edda
push dword [ebp + 8]
call fcn.004562f4
add eax, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53ed5b
push 2
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.00447cb8
mov eax, dword [ebp - 0x18]
cmp eax, 0
jne 0x53ed72
push dword [ebp - 0xc]
call fcn.00446136
jmp 0x53edda
mov eax, dword [ebp - 0x18]
inc eax
shl eax, 2
push eax
push dword [ebp - 0xc]
call fcn.00433304
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53eda4
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 0xd
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53edb8
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push 0x148
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0
call fcn.00432a3d
push dword [0x583374]
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.004395c0
leave
ret 8
Function at 0x53edde
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53ee07
push 0
push dword [ebp + 0xc]
push 0xe
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53ee1d
push 0
push dword [ebp + 0xc]
push 0x149
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0
jl 0x53ef04
push 3
push dword [ebp + 8]
call fcn.0053cfeb
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53ee59
push 2
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00447cb8
mov eax, dword [ebp - 0xc]
cmp eax, 0
jne 0x53ee70
push dword [ebp - 0x10]
call fcn.00446136
jmp 0x53ef04
mov eax, dword [ebp - 0xc]
inc eax
shl eax, 2
push eax
push dword [ebp - 0x10]
call fcn.00433304
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53eea5
push dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
inc eax
push eax
push 0xd
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53eebc
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push 0x148
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0
call fcn.00432a3d
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.005291a3
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x20
jne 0x53eefd
push dword [0x583374]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.004395c0
push 1
call fcn.0048b2bb
leave
ret 8

Function at 0x53f681
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [0x583b48]
cmp eax, 0
je 0x53f69d
call dword [sym.imp.USER32.DLL_ReleaseCapture]
call fcn.0053c850
push 0xa
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_UpdateWindow]
mov eax, dword [0x583c84]
xor al, 1
cmp eax, 0
je 0x53f6d4
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0053053f
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
push dword [ebp + 8]
call fcn.0053eb23
leave
ret 4
Function at 0x541673
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [ebp + 0x14]
mov edx, dword [0x583064]
cmp eax, edx
jne 0x5416b0
mov eax, dword [0x583c78]
sub eax, 0xc
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov edx, eax
mov eax, 2
and eax, edx
cmp eax, 0
je 0x5416b0
jmp 0x5416b4
xor eax, eax
jmp 0x5416b7
xor eax, eax
inc eax
cmp eax, 0
je 0x5416db
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x5416d5
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0053db96
jmp 0x5416db
call dword [sym.imp.USER32.DLL_DestroyCaret]
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x541700
mov eax, dword [ebp + 0x14]
mov edx, dword [0x583064]
cmp eax, edx
jne 0x5416f9
mov eax, 8
jmp 0x5416fe
mov eax, 5
jmp 0x541705
mov eax, 0
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x583c84]
xor al, 1
cmp eax, 0
je 0x541732
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0053053f
mov eax, dword [ebp + 0x14]
mov edx, dword [0x583090]
cmp eax, edx
jne 0x541762
mov eax, dword [0x583c78]
sub eax, 4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov dword [ebp + 8], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [ebp + 0x14]
mov edx, dword [0x583080]
cmp eax, edx
jne 0x541779
push 9
push dword [ebp + 8]
call fcn.00532801
leave
ret 0x10
Function at 0x1000678b
Capabilities:
Encode data using xor

Disassembly:
inc edi
and dword [ecx + 0x407f2f26], ecx
rcl ebx, 1
adc al, 0x77
inc edi
mov bh, 0x10
sbb esp, edx
sbb eax, 0xdbd56629
and ah, byte [ebx]
loope 0x100067ab
sub eax, 0xf15bec8d
movsd dword es:[edi], dword [esi]
invalid

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x52257093
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x79652781
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5a3e05
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x3aff745d
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x43b649
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x43b3c1
mov eax, dword [esp]
add esp, 4
or edx, ecx
call fcn.0043b675
sub edx, edx
xor dword [edi], eax
mov ecx, 0x16f2e2b5
inc edi
dec ecx
cmp edi, esi
jne fcn.0043b649
mov ecx, ecx
and ecx, ecx
ret