joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bb49e46
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f2
push dword [ebp + 8]
mov esi, ecx
mov dword [esi + 0xc4], 1
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push eax
mov dword [ebp - 4], eax
call ebx
push 1
push 0
push 0xf4
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x409
push dword [ebp + 8]
call edi
push eax
call ebx
push 0x408
push dword [ebp + 8]
call edi
mov edi, eax
push 1
push edi
call ebx
push 1
push 1
push 0xf4
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_SetFocus]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x3fe
push dword [ebp + 8]
xor edi, edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xbc], edi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.5bb49137
push eax
mov ecx, esi
call fcn.5bb49159
push edi
push edi
push edi
push 0x9cdd
mov ecx, esi
call fcn.5bb49d19
cmp dword [esi + 0xc0], edi
je 0x5bb49f27
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0xc4], edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x5bb4a612
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov esi, ecx
je 0x5bb4a6fb
cmp dword [esi + 0x50], ebx
jne 0x5bb4a63e
push 0xcc
push dword [0x5bb73708]
call sub.SHLWAPI.dll_Ordinal_100
mov dword [esi + 0x50], eax
push esi
push 0x5bb4a5cf
push ebx
push 0x58
push dword [0x5bb73708]
call sub.SHLWAPI.dll_Ordinal_49
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x5bb4a6fb
push edi
lea edi, [esi + 0x58]
push edi
push ebx
call fcn.5baac53d
test eax, eax
jl 0x5bb4a6fa
mov eax, dword [edi]
mov ecx, dword [eax]
lea edx, [esi + 0x5c]
push edx
push 0x5ba51ec4
push eax
call dword [ecx]
lea eax, [esi + 0xe0]
push eax
push 0x5ba4a460
push esi
push dword [edi]
call dword [sym.imp.ATL.DLL_AtlAdvise]
mov edi, dword [edi]
mov eax, dword [edi]
lea ebx, [esi + 0x48]
push ebx
push esi
push dword [esi + 0x18]
push edi
call dword [eax + 0xc]
test eax, eax
jl 0x5bb4a6fa
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [ebp + 8]
push dword [eax + 4]
push 0x3fd
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.5baf33b2
test eax, eax
jl 0x5bb4a6fa
push 8
call fcn.5ba5615b
test eax, eax
pop ecx
je 0x5bb4a6f5
mov dword [eax], 0x5ba533b8
mov dword [eax + 4], 1
jmp 0x5bb4a6f7
xor eax, eax
mov dword [esi + 0x64], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x5bb4a7f7
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push 8
call fcn.5ba5615b
mov esi, eax
test esi, esi
pop ecx
jne 0x5bb4a818
mov ebx, 0x8007000e
jmp 0x5bb4a85e
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov al, byte [ebp + 0xc]
mov byte [esi], al
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x5bb4a706
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x5bb4a844
mov ebx, 0x80004005
jmp 0x5bb4a848
xor esi, esi
xor ebx, ebx
test eax, eax
je 0x5bb4a853
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x5bb4a85e
push esi
call fcn.5ba56257
pop ecx
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x5bb4a8d4
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5bb70c3c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x1f4
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x208], ebx
mov byte [ebp - 0x204], bl
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x200
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x224]
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x21c]
sub eax, dword [ebp - 0x224]
sub ecx, dword [ebp - 0x220]
push ebx
push dword [0x5bb73710]
push edi
push esi
push ecx
push eax
push dword [ebp - 0x220]
lea eax, [ebp - 0x204]
push dword [ebp - 0x224]
push 0x40a18844
push eax
call fcn.5bb4a86b
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edi, dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x208]
push eax
push 0x5bb4a890
push esi
call edi
test eax, eax
je 0x5bb4aa4c
mov eax, dword [ebp - 0x208]
shl eax, 2
push eax
call fcn.5ba6c1a3
cmp eax, ebx
mov dword [ebp - 0x214], eax
je 0x5bb4aa4c
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x22c], ecx
mov ecx, dword [ebp - 0x20c]
push 0x5bb4a8a6
push esi
mov dword [ebp - 0x230], ecx
call edi
test eax, eax
je 0x5bb4aa3b
dec dword [ebp - 0x208]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x208]
lea esi, [eax + ecx*4]
je 0x5bb4aa3b
mov edi, dword [sym.imp.USER32.dll_SetParent]
push ebx
push dword [esi]
call edi
push eax
push dword [esi]
call edi
sub esi, 4
dec dword [ebp - 0x208]
jne 0x5bb4aa26
mov eax, dword [0x5bb73714]
push dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret 8
Function at 0x5bb4ac82
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4a8
mov eax, dword [0x5bb70c3c]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4a8], eax
push 0x26
xor eax, eax
and word [ebp - 0x404], ax
pop ecx
lea edi, [ebp - 0x49c]
rep stosd dword es:[edi], eax
mov ecx, 0xff
lea edi, [ebp - 0x402]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x4a0]
push eax
mov dword [ebp - 0x4a0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5bb4ad2e
cmp dword [ebp - 0x490], 2
jne 0x5bb4ad2e
cmp dword [ebp - 0x49c], 5
jne 0x5bb4ad2e
cmp dword [ebp - 0x498], 1
jne 0x5bb4ad2e
cmp word [ebp - 0x494], 0xa28
jne 0x5bb4ad2e
call fcn.5babcc7f
test eax, eax
je 0x5bb4ad2e
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x1b22
call fcn.5babcc7f
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x4a4]
push eax
push 0x5ba51bb4
push 1
push 0
push 0x5ba51b94
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x5bb4ad9f
mov eax, dword [ebp - 0x4a4]
mov ecx, dword [eax]
push 0x5ba51648
push eax
call dword [ecx + 0x10]
mov esi, eax
test esi, esi
jl 0x5bb4ad9f
mov eax, dword [ebp - 0x4a4]
mov ecx, dword [eax]
lea edx, [ebp - 0x404]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jl 0x5bb4ad9f
push dword [ebp - 0x4a8]
mov eax, dword [ebp - 0x4a4]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
mov esi, eax
mov eax, dword [ebp - 0x4a4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret 8

Function at 0x5bb4b230
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
add eax, eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
and word [eax], 0
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [ebp + 8]
push eax
push 0x5ba5351c
push 0
call fcn.5ba57156
push eax
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
jle 0x5bb4b26d
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 8
Function at 0x5bb4e840
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5bb70c3c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 2
push 0xffffffffffffffff
mov esi, ecx
or dword [esi + 0x4c], 0xffffffff
push 0x100c
push dword [esi + 0x48]
mov dword [ebp - 4], eax
call edi
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x234]
push eax
xor ebx, ebx
push ebx
push 0x1005
push dword [esi + 0x48]
mov dword [ebp - 0x234], 0xd
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x224], 0xf003
mov dword [ebp - 0x21c], 0x200
call edi
xor eax, eax
cmp word [ebp + 0xc], 0x4e21
push ebx
setne al
push ebx
push 0x4e26
push dword [esi + 4]
dec eax
and eax, 0xfffffffd
inc eax
inc eax
add dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x20c], eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov ecx, dword [ebp - 0x20c]
mov dword [ecx + 8], eax
lea eax, [ebp - 0x234]
push eax
push ebx
push 0x1007
push dword [esi + 0x48]
call edi
push ebx
push dword [ebp - 0x230]
push 0x1013
push dword [esi + 0x48]
call edi
push dword [ebp - 0x230]
push dword [ebp - 0x230]
push 0x1015
push dword [esi + 0x48]
call edi
or dword [esi + 0x4c], 0xffffffff
xor eax, eax
cmp word [ebp + 0xc], 0x4e21
push ebx
sete al
add eax, dword [ebp - 0x208]
push eax
push 0x1008
push dword [esi + 0x48]
call edi
push 1
mov ecx, esi
call fcn.5bb4e285
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.5bb3f314
leave
ret 0x10
Function at 0x5bb4f5c8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x5bb70c3c]
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x21c], 0x80004005
mov dword [ebp - 0x228], 0xa52f
call dword [sym.imp.USER32.dll_CreatePopupMenu]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x218], eax
jne 0x5bb4f612
mov eax, 0x8007000e
jmp 0x5bb4f7ea
lea eax, [ebp - 0x214]
push eax
push 0x20019
push esi
push 0x5ba4c79c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x25c], 0x2c
mov dword [ebp - 0x258], 0x32
mov dword [ebp - 0x254], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5bb4f7d3
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x220], esi
mov edi, 0x104
push esi
jmp 0x5bb4f793
cmp eax, esi
jne 0x5bb4f7ac
lea eax, [ebp - 0x224]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5bb4f775
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
push esi
push dword [ebp - 0x224]
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5bb4f769
cmp dword [ebp - 0x210], esi
je 0x5bb4f769
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x224]
mov dword [ebp - 0x210], edi
call fcn.5babb2c8
test eax, eax
jne 0x5bb4f769
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x238], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x20c]
push eax
call sub.MSOERT2.dll_PszDupA
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x228]
inc dword [ebp - 0x228]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x25c]
push eax
push 1
push esi
push dword [ebp - 0x218]
call dword [sym.imp.USER32.dll_InsertMenuItemA]
test eax, eax
je 0x5bb4f769
mov dword [ebp - 0x21c], esi
push dword [ebp - 0x224]
call dword [entry0]
inc dword [ebp - 0x220]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x220]
push dword [ebp - 0x214]
mov dword [ebp - 0x210], edi
call ebx
cmp eax, 0x103
jne 0x5bb4f67c
push dword [ebp - 0x214]
call dword [entry0]
cmp dword [ebp - 0x21c], esi
pop edi
pop ebx
jl 0x5bb4f7d3
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x22c]
mov dword [ecx + 8], eax
jmp 0x5bb4f7e4
push dword [ebp - 0x218]
mov ecx, dword [ebp - 0x22c]
call fcn.5bb4f3f3
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
pop esi
call fcn.5bb3f314
leave
ret
Function at 0x5bb5219f
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5bb70c3c]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0
push dword [ebp + 8]
mov edi, ecx
push 0x419
push dword [edi + 0x2c]
mov dword [ebp - 4], eax
call esi
lea ecx, [ebp - 0x18]
push ecx
push eax
push 0x417
push dword [edi + 0x2c]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
call fcn.5bb3f314
leave
ret 4
Function at 0x5bb5442f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5bb70c3c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x208]
push eax
xor ebx, ebx
push 0xf003f
push ebx
push 0x5ba4d500
push SysReAllocString
mov dword [ebp - 0x208], ebx
mov byte [ebp - 0x204], bl
mov byte [ebp - 0x104], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, 0xff
jne 0x5bb544f7
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push ebx
push 0x5ba4d540
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], edi
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push ebx
push 0x5ba4d530
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], edi
call esi
push dword [ebp - 0x208]
mov dword [ebp - 0x214], eax
call dword [entry0]
cmp dword [ebp - 0x214], ebx
je 0x5bb54574
lea eax, [ebp - 0x208]
push eax
push 0xf003f
push ebx
push 0x5ba4d558
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5bb545bf
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push ebx
push 0x5ba4d594
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], edi
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push ebx
push 0x5ba4d588
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], edi
call esi
push dword [ebp - 0x208]
mov esi, eax
call dword [entry0]
cmp esi, ebx
jne 0x5bb545bf
push 0x5bb71eec
lea eax, [ebp - 0x204]
push eax
call fcn.5bb54363
push 0x5bb71ef0
lea eax, [ebp - 0x104]
push eax
call fcn.5bb54363
mov eax, dword [ebp - 0x210]
cmp eax, ebx
je 0x5bb545a8
mov ecx, dword [0x5bb71eec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0x5bb545ba
mov ecx, dword [0x5bb71ef0]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x5bb545c1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret 8
Function at 0x5bb5463d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 8], 0xffffffff
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 4]
mov ebx, dword [esi + 0x10]
shr edi, 1
not edi
and edi, 1
cmp dword [esi], 0
jbe 0x5bb54684
mov eax, dword [ebx]
test eax, eax
je 0x5bb54677
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x5bb546b1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add ebx, 4
cmp eax, dword [esi]
jb 0x5bb54663
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
xor ebx, ebx
test ecx, ecx
mov edx, eax
jbe 0x5bb5469e
cmp dword [edx], 0
je 0x5bb546bf
inc ebx
add edx, 4
cmp ebx, dword [esi]
jb 0x5bb54691
mov edx, dword [esi + 0x14]
mov bl, byte [edx + ecx - 1]
movsx ecx, bl
lea edx, [eax + ecx*4 - 0x184]
jmp 0x5bb546c2
mov bl, byte [ebp - 4]
mov eax, dword [ebp - 4]
add bl, 0x61
mov dword [ebp - 8], eax
jmp 0x5bb54702
add bl, 0x61
push dword [ebp + 8]
mov ecx, esi
push edx
call fcn.5bb545d5
test eax, eax
je 0x5bb54702
push dword [ebp + 8]
movsx eax, bl
sub eax, 0x61
mov dword [ebp - 8], eax
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 8]
xor edi, edi
inc edi
push edi
push 0
lea eax, [ebp - 2]
push eax
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movsx ax, bl
push eax
push dword [esi + 0x14]
call sub.SHLWAPI.dll_StrChrA
test eax, eax
mov dword [ebp + 8], eax
je 0x5bb5472d
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 8], 0xffffffff
je 0x5bb54746
push dword [esi]
mov eax, dword [esi + 0x14]
push eax
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
mov eax, dword [esi + 0x14]
mov byte [eax], bl
test edi, edi
je 0x5bb54770
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 0x14]
push 1
push 0
push 0x5ba54534
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
and dword [esi + 4], 0xfffffff7
jmp 0x5bb54774
or dword [esi + 4], 8
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x5bb54783
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 0x10], 0xffffffff
xor eax, eax
cmp dword [ebp + 8], eax
push esi
mov esi, ecx
mov byte [ebp - 1], 0
jne 0x5bb547a6
or dword [ebp - 0x10], 0xffffffff
jmp 0x5bb54884
push ebx
mov ebx, dword [esi + 0x10]
push edi
mov edi, dword [esi + 4]
shr edi, 1
not edi
and edi, 1
cmp dword [esi], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], ebx
jbe 0x5bb547f2
mov eax, dword [ebx]
test eax, eax
je 0x5bb547d3
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x5bb547e5
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add ebx, 4
cmp eax, dword [esi]
mov dword [ebp - 0x14], ebx
jb 0x5bb547bf
jmp 0x5bb547f2
mov ecx, dword [ebp - 0xc]
mov al, cl
add al, 0x61
mov byte [ebp - 1], al
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi]
jb 0x5bb54802
or dword [ebp - 0x10], 0xffffffff
jmp 0x5bb54882
movsx ax, byte [ebp - 1]
push eax
push dword [esi + 0x14]
call sub.SHLWAPI.dll_StrChrA
mov ebx, eax
test ebx, ebx
je 0x5bb5482a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebx + 1]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
push dword [ebp - 0x14]
mov ecx, esi
call fcn.5bb545d5
test eax, eax
je 0x5bb54854
mov al, byte [ebp - 1]
mov byte [ebp - 8], al
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov byte [ebp - 7], 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor edi, edi
inc edi
test edi, edi
je 0x5bb5487e
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 0x14]
push 1
push 0
push 0x5ba54534
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
and dword [esi + 4], 0xfffffff7
jmp 0x5bb54882
or dword [esi + 4], 8
pop edi
pop ebx
mov eax, dword [ebp - 0x10]
pop esi
leave
ret 4
Function at 0x5bb59a01
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
xor ebx, ebx
inc ebx
push ebx
push 0xffffffffffffffff
mov edi, ecx
mov eax, dword [edi + 0xd4]
push 0x100c
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x5bb59a51
and dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0x102b
push dword [edi + 0xd4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
call esi
mov eax, dword [edi + 0xd4]
push 2
pop ebx
push ebx
push dword [ebp - 4]
push 0x102c
push eax
call esi
test eax, eax
jne 0x5bb59aaf
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], ebx
push eax
jge 0x5bb59a93
push dword [ebp - 4]
mov dword [ebp - 0x24], ebx
push 0x102b
push dword [edi + 0xd4]
call esi
jmp 0x5bb59afa
and dword [ebp - 0x24], 0
push 0xffffffffffffffff
push 0x102b
push dword [edi + 0xd4]
call esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], ebx
push eax
jmp 0x5bb59a7e
xor esi, esi
cmp dword [edi + 0x144], esi
je 0x5bb59aeb
mov eax, dword [edi + 0x16c]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0xc
push dword [ebp - 4]
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x5bb59aeb
test byte [ebp - 8], 4
je 0x5bb59aeb
test dword [ebp - 8], 8
jne 0x5bb59aeb
push dword [ebp - 4]
mov ecx, edi
call fcn.5baa6109
push esi
push esi
push esi
push 0x9cd2
mov ecx, edi
call fcn.5bb5833e
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2a2107c3
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xbb77463
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x402710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402725
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402764
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402760
lea ebx, [ebx]
cmp esi, edx
jae 0x402764
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x402750
cmp esi, edx
jb 0x402769
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret