joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007500
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10007663
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10007400
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x10007636
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x100075b6
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x10007629
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x100075f0
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x100075e8
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x10007629
mov edi, eax
cmp dword [ebp - 4], eax
je 0x10007606
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x1000763f
cmp dword [ebp - 4], eax
jne 0x100075f7
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 4]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ebx, dword [ebp - 0x10]
mov ecx, edx
cmp edx, esi
jne 0x10007562
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x10007629
push str.invalid_hash_bucket_count
call fcn.1002260b
int3
Function at 0x10007f80
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [ebp + 8]
xor edi, edi
mov edx, dword [eax + 0x3c]
add edx, eax
mov dword [esi], eax
mov eax, dword [edx + 0x50]
mov dword [esi + 4], eax
movzx esi, word [edx + 0x14]
lea ecx, [edx + 0x18]
movzx ebx, word [edx + 6]
add esi, ecx
test ebx, ebx
je 0x10007fd6
push 8
push str.IVZhntv__45_MSbdkx_._AFL_et__1___
call fcn.10020980
add esp, 4
push eax
push esi
call fcn.1002bf00
add esp, 0xc
test eax, eax
je 0x10007fd6
inc edi
add esi, 0x28
cmp edi, ebx
jl 0x10007fb1
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
pop edi
add ecx, dword [eax]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 8]
pop esi
mov dword [eax + 0xc], ecx
pop ebx
pop ebp
ret
Function at 0x4604de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4604ed
add byte [esp + eax*2 + 0x38], cl
push eax
inc esi
xor eax, dword [ebx + 0x565e04c4]
or esi, 0x1d82
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x46056f

Function at 0x4604ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4604ed
add byte [esp + eax*2 + 0x38], cl
push eax
inc esi
xor eax, dword [ebx + 0x565e04c4]
or esi, 0x1d82
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x46056f
Function at 0x4609c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0x10016
pop ebx
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x460a28
push ecx
add ecx, 0x1018b
pop ecx
push eax
or eax, 0x166cd
or eax, 0x1614e
pop eax
push edx
push edx
add esp, 4
add edx, 0x85a5
call 0x460a15
add byte [ebx + ecx*2], bh
dec ebp
dec esp
cmp al, 0x38
cmp al, 0x83
les eax, [edx + ebx*2]
mov dword [ebp - 0xa58], 0
jmp 0x461113
Function at 0x460bb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
sub esi, 0xacf4
jmp 0x460b45
jmp 0x460b4d
pop esi
push esi
push eax
add esp, 4
xor esi, 0x18b2
pop esi
push ecx
push ecx
add esp, 4
add ecx, 0x2103
pop ecx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push eax
and eax, 0x157de
pop eax
push eax
push edi
add esp, 4
and eax, 0x16de4
jmp 0x460bac
call 0x460bb8
add byte [esp + edi], dh
cmp al, 0x43
cmp byte [ebx + eax*4], bh
les eax, [ecx + eax*4]
loopne 0x460b5a
wait
add byte [eax], al
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
sub edi, 0x30c3
pop edi
push esi
push edi
add esp, 4
call fcn.00460c35
add byte [ecx], bh
dec edi
aaa
dec ebx
push eax
cmp byte [edx], bh
cmp al, byte [eax - 0x7d]
add esp, 4
or esi, 0x2d88
and esi, 0xd097
or esi, 0x116e8
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x460c68
invalid
mov bh, 0x95
hlt
add esp, 4
or esi, 0x2d88
and esi, 0xd097
or esi, 0x116e8
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x460c68
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x460cc2
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x460b90
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x460b90
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x460cac
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x460cb6
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x460d0b
push eax
add eax, 0x1ccd
pop eax
push edi
push edx
add esp, 4
xor edi, 0x10484
pop edi
push eax
push esi
add esp, 4
and eax, 0x52d
sub eax, 0x15391
xor eax, 0x20cc
and eax, 0x14309
pop eax
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x460d73
push edi
call 0x460d18
add byte [edi + 0x49], cl
dec ecx
dec esp
aaa
dec edi
add esp, 4
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0x14dd8
jmp 0x460d30
and ecx, 0x2359
and ecx, 0x4d2b
pop ecx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x460d69
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x460b34
mov dword [ebp - 0x2a8], 0
Function at 0x460c35
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
sub esi, 0xacf4
jmp 0x460b45
jmp 0x460b4d
pop esi
push esi
push eax
add esp, 4
xor esi, 0x18b2
pop esi
push ecx
push ecx
add esp, 4
add ecx, 0x2103
pop ecx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push eax
and eax, 0x157de
pop eax
push eax
push edi
add esp, 4
and eax, 0x16de4
jmp 0x460bac
call 0x460bb8
add byte [esp + edi], dh
cmp al, 0x43
cmp byte [ebx + eax*4], bh
les eax, [ecx + eax*4]
loopne 0x460b5a
wait
add byte [eax], al
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
sub edi, 0x30c3
pop edi
push esi
push edi
add esp, 4
call fcn.00460c35
add byte [ecx], bh
dec edi
aaa
dec ebx
push eax
cmp byte [edx], bh
cmp al, byte [eax - 0x7d]
add esp, 4
or esi, 0x2d88
and esi, 0xd097
or esi, 0x116e8
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x460c68
invalid
mov bh, 0x95
hlt
add esp, 4
or esi, 0x2d88
and esi, 0xd097
or esi, 0x116e8
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x460c68
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x460cc2
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x460b90
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x460b90
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x460cac
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x460cb6
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x460d0b
push eax
add eax, 0x1ccd
pop eax
push edi
push edx
add esp, 4
xor edi, 0x10484
pop edi
push eax
push esi
add esp, 4
and eax, 0x52d
sub eax, 0x15391
xor eax, 0x20cc
and eax, 0x14309
pop eax
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x460d73
push edi
call 0x460d18
add byte [edi + 0x49], cl
dec ecx
dec esp
aaa
dec edi
add esp, 4
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0x14dd8
jmp 0x460d30
and ecx, 0x2359
and ecx, 0x4d2b
pop ecx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x460d69
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x460b34
mov dword [ebp - 0x2a8], 0
Function at 0x460d18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
sub esi, 0xacf4
jmp 0x460b45
jmp 0x460b4d
pop esi
push esi
push eax
add esp, 4
xor esi, 0x18b2
pop esi
push ecx
push ecx
add esp, 4
add ecx, 0x2103
pop ecx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push eax
and eax, 0x157de
pop eax
push eax
push edi
add esp, 4
and eax, 0x16de4
jmp 0x460bac
call 0x460bb8
add byte [esp + edi], dh
cmp al, 0x43
cmp byte [ebx + eax*4], bh
les eax, [ecx + eax*4]
loopne 0x460b5a
wait
add byte [eax], al
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
sub edi, 0x30c3
pop edi
push esi
push edi
add esp, 4
call fcn.00460c35
add byte [ecx], bh
dec edi
aaa
dec ebx
push eax
cmp byte [edx], bh
cmp al, byte [eax - 0x7d]
add esp, 4
or esi, 0x2d88
and esi, 0xd097
or esi, 0x116e8
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x460c68
invalid
mov bh, 0x95
hlt
add esp, 4
or esi, 0x2d88
and esi, 0xd097
or esi, 0x116e8
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x460c68
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x460cc2
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x460b90
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x460b90
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x460cac
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x460cb6
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x460d0b
push eax
add eax, 0x1ccd
pop eax
push edi
push edx
add esp, 4
xor edi, 0x10484
pop edi
push eax
push esi
add esp, 4
and eax, 0x52d
sub eax, 0x15391
xor eax, 0x20cc
and eax, 0x14309
pop eax
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x460d73
push edi
call 0x460d18
add byte [edi + 0x49], cl
dec ecx
dec esp
aaa
dec edi
add esp, 4
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0x14dd8
jmp 0x460d30
and ecx, 0x2359
and ecx, 0x4d2b
pop ecx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x460d69
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x460b34
mov dword [ebp - 0x2a8], 0
Function at 0x5397b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9f0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x53987c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp byte [ebp + 8], 0
jne 0x5397f5
lea eax, [ebp - 4]
mov edx, 0x53989c
call fcn.00406f58
jmp 0x539802
lea eax, [ebp - 4]
mov edx, 0x5398b4
call fcn.00406f58
xor eax, eax
push ebp
push 0x53985c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x60e]
mov edx, dword [ebp + 0x10]
call fcn.0041f020
push eax
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.0041f020
push eax
lea eax, [ebp - 0x20a]
mov edx, ebx
call fcn.0041f020
push eax
mov eax, dword [ebp - 4]
call fcn.0040764c
push eax
push 0
call fcn.004a044c
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x539866
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539883
lea eax, [ebp - 4]
call fcn.00406b30
ret
Function at 0x4d1644
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00406e34
xor eax, eax
push ebp
push 0x4d1783
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4d1756
xor edx, edx
push ebp
push 0x4d174f
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x4d1691
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4d1724
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x4d1713
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
test eax, eax
je 0x4d16d6
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00407c20
lea ecx, [esi + 2]
mov edx, ebx
call fcn.00404750
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d171a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x5b1320]
mov dl, 1
mov eax, dword [0x419ec0]
call fcn.00425394
call fcn.00406448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d178a
lea eax, [ebp - 4]
call fcn.00406d50
ret

Function at 0x4f6908
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.004f69b8
test eax, eax
je 0x4f6943
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.004f69b8
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406ed8
jmp 0x4f6951
mov ecx, esi
mov edx, 0x4f6970
mov eax, ebx
call fcn.004f6850
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.00407130
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x50e7cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
pop edx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x50e81f
push esi
push esi
add esp, 4
jmp 0x50e82d
sub esi, 0x13070
add esi, 0x480c
jmp 0x50e83e
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x15442
xor edi, 0x4076
pop edi
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push esi
and esi, 0x10059
or esi, 0xd972
pop esi
push edx
and edx, 0x15918
and edx, 0xe9b1
Function at 0x5101f6
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop ebx
push edx
push ebx
add esp, 4
add edx, 0xde8a
sub edx, 0x871
and edx, 0x127a5
add edx, 0x141a5
pop edx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x510244
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x51000f
mov dword [ebp - 0x2a8], 0
Function at 0x52cbe8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52cd93
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x52cd74
mov dl, 1
mov eax, dword [0x43e18c]
call fcn.0044d348
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.00406d50
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x52cd63
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0049e7d4
test al, al
je 0x52cd56
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x52cda4
lea eax, [ebp - 0x394]
call fcn.00420af4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x52cd56
xor eax, eax
push ebp
push 0x52cd4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x52ce14
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x52cd38
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00407ccc
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x52cd38
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00407ccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cd56
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x52cc59
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.0044d284
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cd9a
lea eax, [ebp - 0x3a0]
call fcn.00406d50
ret
Function at 0x52e42c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x52e4d8
cmp dword [ebx + 0x98], 0
jne 0x52e4d2
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x52e364
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x52e4d2
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x52e498
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x52e4d2
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00448cd4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x52e4a7
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x52f4b0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x52f51b
cmp byte [ebx + 0xd7], 0
jne 0x52f51b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406ed8
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x52f508
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x52f528
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00407130
jmp 0x52f528
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00407130
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x530d60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x530dce
mov eax, esi
call fcn.004987ac
test al, al
je 0x530dce
mov eax, dword [ebx + 0x88]
call fcn.004983f8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x530dce
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x530dc2
push 0
mov eax, dword [ebx + 0x88]
call fcn.004983f8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.0048f1dc
jmp 0x530dce
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.00530b98
pop esi
pop ebx
ret