joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fcbea
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004e9d1b
mov dword [ebp - 0x14], eax
cmp dword [0x548cf0], esi
jne 0x4fccdd
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4fcc6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4fcdbd
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4fcdbd
push 0x5286fc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4fcdbd
push eax
call ebx
push 0x528708
push edi
mov dword [0x548cf0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x548cf4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x548cf8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x548d00], eax
test eax, eax
je 0x4fccda
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x548cfc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4fcd02
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4fccf5
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4fcd17
push 4
pop eax
jmp 0x4fcdbf
cmp dword [ebp - 0x14], esi
je 0x4fcd17
push dword [0x548cf0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4fccfc
mov eax, dword [0x548cfc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4fcd75
cmp dword [0x548d00], edi
je 0x4fcd75
push eax
call ebx
push dword [0x548d00]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4fcd75
test eax, eax
je 0x4fcd75
call ecx
test eax, eax
je 0x4fcd6a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4fcd6a
test byte [ebp - 8], 1
jne 0x4fcd75
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4fcda5
mov eax, dword [0x548cf4]
cmp eax, edi
je 0x4fcda2
push eax
call ebx
test eax, eax
je 0x4fcda2
call eax
mov esi, eax
test esi, esi
je 0x4fcda2
mov eax, dword [0x548cf8]
cmp eax, edi
je 0x4fcda2
push eax
call ebx
test eax, eax
je 0x4fcda2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x548cf0]
call ebx
test eax, eax
je 0x4fcdbd
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4fcdbf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
Function at 0x4019b1
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp edi, 0x58ced85
jg 0x4019d7
inc edi
cmp edi, 0x1f6502b1
jl 0x4019bd
cmp dword [0x285bac4], 0x400
jne 0x401a34
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0x46ab10
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
push esi
call fcn.00401fbd
push esi
push esi
call fcn.00401fbd
push esi
call fcn.00402127
push esi
call fcn.00402136
add esp, 0x18
xor edi, edi
cmp edi, 0xd0fe
jge 0x401a45
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp edi, 0xd2ce6e
jg 0x401a6d
inc edi
cmp edi, 0x26bcf
jl 0x401a36
mov eax, dword [0x46dc14]
mov dword [0x285bac4], eax
call fcn.0040172b
mov edi, 0x3078f
cmp dword [0x285bac4], 0x51f
jne 0x401a99
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401a81
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x404bbe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46d930]
jne 0x404bc8
repz ret
jmp fcn.004061fc
Function at 0x403f34
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x403f68
mov edx, dword [eax + 8]
test edx, edx
jne 0x403f57
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x403f64
add edx, esi
cmp ebx, edx
jb 0x403f75
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x403f4d
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x403fb0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x403fca
xor eax, eax
jmp 0x40414a
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x403fde
xor eax, eax
jmp 0x40414a
cmp word [ebx + 0x14], 0xe0
jne 0x403fee
cmp word [ebx + 0x18], 0x10b
je 0x403ff5
xor eax, eax
jmp 0x40414a
mov dword [0x4534ec], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00403f34
add esp, 8
test eax, eax
jne 0x404020
xor eax, eax
jmp 0x40414a
mov edx, dword [0x4534ec]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00403f7c
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x404052
push 0x10
push 0
push 0x44f992
push 0
call 0x40f97a
xor eax, eax
jmp 0x40414a
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x40411c
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x40410e
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x404109
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x404100
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x4040f5
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4040f5
test cl, cl
je 0x4040ea
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4040f5
add eax, 2
add edx, 2
test cl, cl
jne 0x4040ce
jne 0x4040f5
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x40414a
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x4040b4
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x40408c
jmp 0x404148
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x404140
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x40413c
cmp dword [eax], 0
je 0x40413c
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x40414a
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x404123
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404318
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x404331
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404660
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, 0x401aa4
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x404713
mov eax, 0x401734
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x404713
mov eax, 0x403ecc
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x404713
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x404713
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x4046db
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404730
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, 0x401aa4
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x4047e6
mov eax, 0x401734
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x4047e6
mov eax, 0x403d30
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x4047e6
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x4047e6
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x4047ae
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 8]
cmp ecx, edx
jbe 0x404a28
xor byte [eax], 0xf5
inc edx
inc eax
cmp ecx, edx
ja 0x404a1f
pop ebp
ret

Function at 0x40db4c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040dbcf
jae 0x40db5a
xor ecx, ecx
call fcn.0040dbcf
jae 0x40db89
xor eax, eax
call fcn.0040dbcf
jae 0x40db99
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040dbcf
adc al, al
jae 0x40db7b
jne 0x40dbc5
stosb byte es:[edi], al
jmp 0x40db5d
call fcn.0040dbdb
sub ecx, ebx
jne 0x40dba2
call fcn.0040dbd9
jmp 0x40dbc1
lodsb al, byte [esi]
shr eax, 1
je 0x40dbeb
adc ecx, ecx
jmp 0x40dbbe
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0040dbd9
cmp eax, 0x7d00
jae 0x40dbbe
cmp ah, 5
jae 0x40dbbf
cmp eax, 0x7f
ja 0x40dbc0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40db5d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x40df18
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x40df87
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x40df4f
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x593170
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
mov ecx, 9
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x65763f
call fcn.004aeb11
nop
call fcn.005913a0
mov dword [ebp - 8], eax
mov esi, esp
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp esi, esp
call fcn.004addce
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x20], ecx
mov esi, esp
push 4
mov eax, dword [ebp - 8]
add eax, 0x24
push eax
push 0x20001004
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp esi, esp
call fcn.004addce
test eax, eax
jne 0x5931f2
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.004addce
mov esp, ebp
pop ebp
ret

Function at 0x594df0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
lea edi, [ebp - 4]
mov ecx, 1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x65763f
call fcn.004aeb11
nop
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.004addce
movsx ecx, ax
and ecx, 0x8000
je 0x594e40
mov dword [ebp - 0xc4], 1
jmp 0x594e4a
mov dword [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
pop edi
pop esi
pop ebx
add esp, 0xc4
cmp ebp, esp
call fcn.004addce
mov esp, ebp
pop ebp
ret
Function at 0x5fe230
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60af0d
mov eax, dword fs:[0]
push eax
sub esp, 0x3ec
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x278]
mov ecx, 0x9b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x64aa40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov ecx, 0x6577b8
call fcn.004aeb11
nop
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
push ecx
push 0x18
call fcn.004ad149
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x5fe350
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004ad761
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
je 0x5fe350
push str.Found_module:
mov eax, dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
call fcn.004ad4aa
add esp, 8
lea ecx, [ebp - 0x230]
push ecx
push eax
call fcn.004ad4aa
add esp, 8
push 0x619610
push eax
call fcn.004ad4aa
add esp, 8
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp + 8]
call fcn.004ae5d0
push eax
call fcn.004ac244
add esp, 8
test eax, eax
jne 0x5fe335
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004ad7f2
mov eax, dword [ebp - 0x3e8]
jmp 0x5fe383
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004ae512
mov dword [ebp - 0x25c], eax
jmp 0x5fe2b8
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004addce
nop
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004ad7f2
mov eax, dword [ebp - 0x3f4]
push edx
mov ecx, ebp
push eax
lea edx, [0x5fe3c0]
call fcn.004ad8e7
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad28e
add esp, 0x3f8
cmp ebp, esp
call fcn.004addce
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4019b1
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp edi, 0x58ced85
jg 0x4019d7
inc edi
cmp edi, 0x1f6502b1
jl 0x4019bd
cmp dword [0x281eac4], 0x400
jne 0x401a39
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0x42db18
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call fcn.00401ff7
push esi
call fcn.00401fbd
push esi
push esi
call fcn.004021b7
push esi
call fcn.00402264
push esi
call fcn.00402273
add esp, 0x18
xor edi, edi
cmp edi, 0xd0fe
jge 0x401a4a
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp edi, 0xd2ce6e
jg 0x401a72
inc edi
cmp edi, 0x26bcf
jl 0x401a3b
mov eax, dword [0x430c14]
mov dword [0x281eac4], eax
call fcn.0040172b
mov edi, 0x3078f
cmp dword [0x281eac4], 0x51f
jne 0x401a9e
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401a86
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x404c7e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430930]
jne 0x404c88
repz ret
jmp fcn.004061fc
Function at 0x401010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401084
jmp 0x401115
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0
jmp 0x4010c3
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x18]
jae 0x40110d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401790
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0xc]
jne 0x40110b
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x401117
jmp 0x4010ba
xor eax, eax
jne 0x401055
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x414014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4018e3
mov dword [ebp - 0x10], 0
jmp 0x40190a
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401906
mov dword [ebp - 0x10], 0
xor edx, edx
jne 0x4018b5
cmp dword [ebp - 0xc], 0xffffffff
je 0x40191a
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040192b
mov esp, ebp
pop ebp
ret