joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f10d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x41f25a
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41f189
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41f170
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x41f184
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x41f258
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41f1bd
push 0x24d9
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x41f258
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41f1f7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jg 0x41f258
mov dword [ebp - 0x40], 1
push 1
push 0x4665
push 0x62ed
push 0
push 1
push 0x1152
lea eax, [ebp - 0x40]
push eax
push 0x150d
push 0x599
push dword [ebp - 0x44]
push 0x383e
push 0x3026
push 1
push 1
push 1
push 0x7ea5
push 0x73d9
push 0x4df0
push dword [ebp - 0x48]
call fcn.0041aa61
add esp, 0x4c
jmp 0x41f1ec
jmp 0x41f2bb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x60], eax
lea eax, [ebp + 0x40]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0
mov eax, dword [ebp - 0x54]
push dword [eax]
mov eax, dword [ebp - 0x58]
push dword [eax]
push 0x53e
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
push eax
mov eax, dword [ebp - 0x68]
push dword [eax]
call fcn.00407b91
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x41f4d5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41f5a9
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41f57f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41f575
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41f559
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x41f573
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.00428b0e
or dword [eax], 0xffffffff
jmp 0x41f54e
jmp 0x41f57d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x41f5a7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0x660f
push dword [ebp - 0x34]
push 1
push 0x3914
push 0x7ad6
push 1
push 0
push 1
call fcn.0040fdc7
add esp, 0x20
jmp 0x41f5e4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
push 0x2faf
push 0x4ad2
push 0x2cd1
push 0x549c
push 0x4268
push dword [ebp - 0x38]
push 0x53b8
push 0x58bd
push 0x6a2d
push 1
call fcn.00418259
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x42f092
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x42f0fb
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42f0e8
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42f0d5
push 0x190c
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x42f0e6
push 0
push 0x744
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x42f0f9
push 0
push 1
push 0x6aab
call fcn.0042e739
add esp, 0xc
jmp 0x42f121
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
push 0x63b6
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x1984
push 0
call fcn.00432985
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x42fb99
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x42fc8c
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42fc00
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
call fcn.0042fce7
add esp, 0xc
jmp 0x42fc8a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x42fc42
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x42fc40
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x42fc8a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x42fc70
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x42fc8a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.00428b0e
or dword [eax], 0xffffffff
jmp 0x42fc65
jmp 0x42fce3
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x64], eax
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0x1cce
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push 1
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
call fcn.0042e7fe
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x430d4e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x430d8f
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push dword [ebp - 8]
push 0x4251
push 1
push dword [ebp - 0xc]
call fcn.00430e43
add esp, 0x14
jmp 0x430e3f
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x430df3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push 0x6440
push 0x5301
push 0x163d
push dword [ebp - 0x1c]
push 1
push 0x496f
push dword [ebp - 0x20]
push 0x3e87
push 0x6b2
call fcn.0042e85a
add esp, 0x24
jmp 0x430e3f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x430e2e
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x430e2c
push 0x24d9
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x430e3f
push 0
push 1
push 0x99a
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov esp, ebp
pop ebp
ret

Function at 0x434122
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x434171
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x70cb
push dword [ebp - 0x10]
push 0x7528
push 0
call fcn.00439c7b
add esp, 0x1c
jmp 0x4341fb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4341d8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4341b3
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
jmp 0x4341d6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4341d6
push 0x24d9
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4341fb
push 0x1352
push 0x3d21
push 0
push 0x30c2
push 0x2833
push 0x3f8e
call fcn.0044296f
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x437b36
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x437bf3
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x437bc0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x437ba5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x437bbe
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x437bbe
push 0x1b80
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x437bf1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
push 1
push 1
push 0xca3
push dword [ebp - 0x34]
push 0x444f
push dword [ebp - 0x38]
call fcn.004350ce
add esp, 0x1c
jmp 0x437c2b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x437c1d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
push 0
call fcn.00441247
pop ecx
pop ecx
jmp 0x437c2b
push 0x6e3f
push 0
call fcn.0042dd1e
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43857b
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x438674
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x438638
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43862c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x43861c
mov dword [ebp - 0x3c], 1
jmp 0x438620
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x438636
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x438672
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push 0x3f63
push 0x3546
push dword [ebp - 0x4c]
push 0
push 0x45bf
push 0x7509
push dword [ebp - 0x50]
push 0x7bf9
push 0x53fb
call fcn.0043942b
add esp, 0x24
jmp 0x43869e
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
push 0x1dc7
push 0x7749
push dword [ebp - 0x54]
push 0
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
push eax
call fcn.00441306
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43dc7d
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43ddb2
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43dd7d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43dd65
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov esi, dword [ebp - 0x60]
add edx, dword [esi]
mov esi, dword [ebp - 0xc]
mov esi, dword [esi]
mov ax, word [ecx + eax]
mov word [esi + edx], ax
jmp 0x43dd7b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43dd7b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x43ddb0
push 0x8fb
push 0x655d
push 1
push 0
push 0x2f8d
push 0x15ea
push 0x3f3
push 1
push 0x6447
push 0x2aa7
push 1
call fcn.0043db31
add esp, 0x2c
jmp 0x43dde3
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x68], eax
push 0x77de
push dword [ebp - 0x64]
push 0
push 0x8b2
push 0x2060
push 1
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
push eax
call fcn.0043cc10
add esp, 0x1c
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43e327
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43e410
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43e392
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
push 1
push 0x43a4
push dword [ebp - 0x18]
push 0x4609
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.0043e430
add esp, 0x18
jmp 0x43e40e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43e3f7
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43e3f5
push 0x996
push 0x1699
push 0x521d
push 0x3808
push 0x1b62
push 0x1738
push 0x38b1
push 0x796e
push 1
push 0
push 0
push 1
push 0x3cf6
push 0x7bdb
push 0x6353
call fcn.00433f46
add esp, 0x3c
jmp 0x43e40e
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43e40e
push 0x1fee
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x43e42c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 1
push dword [ebp - 0x30]
call fcn.0042c73d
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x441c61
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x441cf8
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x441ca5
push 0x15f5
push 1
push 0x7d75
call fcn.00441d19
add esp, 0xc
jmp 0x441cf6
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x441cee
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x441cec
push 0
push 0x1ba1
push 0
push 0
push 0xc67
push 0x25e2
call dword [sym.imp.USER32.dll_ToAsciiEx]
jmp 0x441cf6
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x441d15
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 1
push 0x684d
push 0x53ab
push dword [ebp - 0x20]
call fcn.00438a9a
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x453aaa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 3
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
call fcn.00428a20
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 8], ebx
jmp 0x453ae0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x453ad0
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x453af5
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x24]
xor edi, edi
inc edi
imul eax, dword [ecx + 4], 0xfffd
mov dword [ecx], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], edi
call fcn.00428af2
push edi
push esi
push 0x262
push 0x604d
push 0x3fcc
push edi
push 0x7c77
push edi
push 0x1cee
push edi
push 0x33e6
push 0x11c2
push edi
push 0x3302
call fcn.00445e51
push esi
call fcn.00424983
add esp, 0x3c
lea ecx, [ebp - 0x30]
mov ebx, eax
push 2
call fcn.00428a20
xor eax, eax
mov dword [ebp - 0x10], 9
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x453b85
push dword [ebp - 8]
lea ecx, [ebp - 0x30]
call fcn.00428b0e
mov dword [eax], 0xbca63185
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x453b69
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
inc ecx
cmp dword [ebp - 0x10], ecx
jg 0x453cb6
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 8], ecx
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
jl 0x453bdb
mov dword [ebp - 0xc], 8
mov dword [ebp - 0xc], eax
jmp 0x453bd1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x453bce
call esi
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x453bb7
dec dword [ebp - 8]
jns 0x453bab
mov dword [ebp - 8], eax
jmp 0x453ca1
mov dword [ebp - 0x18], 3
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x453c2d
push 0x1911
push 0x2436
push 0x1e15
call esi
push eax
call edi
push eax
push 0xa34
push 0x11f8
push 0x1f79
push 0x105
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jl 0x453c9e
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x453c74
mov dword [ebp - 0xc], 7
mov dword [ebp - 0xc], eax
jmp 0x453c6a
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x453c67
push 0x1d7f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor ecx, ecx
xor eax, eax
inc ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x453c4c
dec dword [ebp - 0x14]
jns 0x453c40
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x453c99
push eax
push 0x372
push 0x5b0
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor ecx, ecx
xor eax, eax
inc ecx
dec dword [ebp - 0x18]
jns 0x453c35
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jle 0x453be3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x453ba0
lea ecx, [ebp - 0x30]
call fcn.00428af2
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48c916
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret