joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5059a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x5059c1
test edi, 0x40000
je 0x5059db
test bl, bl
jne 0x505a5c
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x505a5c
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x505a0e
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x505a23
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x505a32
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x505a43
cmp byte [esp + 2], 0
je 0x505a5c
cmp byte [esp + 2], 0
je 0x505a54
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x505a5c
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x505d08
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x505d2e
mov eax, esp
push eax
push 0x505cd0
call sub.user32.dll_EnumWindows
jmp 0x505d41
mov eax, esp
push eax
push 0x505cb0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x505e04
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x505e54]
test bl, 4
je 0x505e18
or si, 1
test bl, 8
je 0x505e21
or si, 4
test bl, 1
je 0x505e2a
or si, 8
test bl, 2
je 0x505e33
or si, 0x10
test bl, 0x10
je 0x505e3c
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x505e4c
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x505e58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x505e94]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x505e73
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x505e83
or bx, 4
test esi, 0x20000000
je 0x505e8f
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x50eb0c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x50eb1e
add esp, 0xfffffff0
call fcn.00405354
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00440adc
mov eax, dword [0x51e86c]
mov dword [eax + 4], ebx
mov dword [eax], 0x50ef68
mov eax, dword [0x51e878]
mov dword [eax + 4], ebx
mov dword [eax], 0x50ef74
mov eax, ebx
call fcn.0050ef80
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x429ee8]
call fcn.00404df0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x429ee8]
call fcn.00404df0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x429ee8]
call fcn.00404df0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x429ee8]
call fcn.00404df0
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x429ee8]
call fcn.00404df0
mov dword [ebx + 0x78], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x44], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x509800
push eax
push 0
push 0
mov eax, dword [0x51eb0c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x44e398]
call fcn.004548d4
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x44e398]
call fcn.004548d4
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x44e398]
call fcn.004548d4
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x44e398]
call fcn.004548d4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x44e398]
call fcn.004548d4
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.0050f4e0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x50f350
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x50f350
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x50f350
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x50f350
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x50f350
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x50ec99
call fcn.004053ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x50f0f0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50f29d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x50f27e
mov dl, 1
mov eax, dword [0x42c5e8]
call fcn.00438488
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.00406938
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x50f26d
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004e6f4c
test al, al
je 0x50f260
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x50f2ac
lea eax, [ebp - 0x394]
call fcn.004143b0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x50f260
xor eax, eax
push ebp
push 0x50f259
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x50f31c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x50f242
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406b20
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x50f242
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f260
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x50f163
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.004383c4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f2a4
lea eax, [ebp - 0x3a0]
call fcn.00406928
ret

Function at 0x50fdfc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x524b30]
cmp byte [eax + 0xad], 0
jne 0x50fe6e
cmp dword [0x524b48], 0
jne 0x50fe2e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x51e664]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x524b48], eax
cmp dword [0x524b44], 0
jne 0x50fe49
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x524b44], eax
cmp dword [0x524b4c], 0
jne 0x50fe6e
push esp
push 0
push 0
mov eax, dword [0x51e660]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x524b4c], eax
pop edx
ret
Function at 0x510194
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5101ab
add esp, 0xfffffff0
call fcn.00405354
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00440adc
mov eax, dword [0x51e6e0]
cmp byte [eax], 0
jne 0x5101d8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x51ead8]
cmp word [eax + 2], 0
jne 0x5101f2
mov eax, dword [0x51ead8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0051228c
mov eax, dword [0x51ec3c]
cmp word [eax + 2], 0
jne 0x51020c
mov eax, dword [0x51ec3c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0051249c
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44e398]
call fcn.004548d4
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x512a4c
mov dl, 1
mov eax, dword [0x429ee8]
call fcn.00404df0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x429ee8]
call fcn.00404df0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x452a98]
call fcn.0045e0e4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x5103ec
mov eax, dword [0x51e938]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0045e578
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x512d34
mov dl, 1
mov eax, dword [0x429ee8]
call fcn.00404df0
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x51e938]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004141a8
test eax, eax
je 0x51031d
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00413f58
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0041418c
test eax, eax
je 0x510335
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406b20
push ebx
push 0x511c5c
call fcn.00505de8
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x51e6e0]
cmp byte [eax], 0
jne 0x510386
mov eax, ebx
call fcn.00510560
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00512f60
mov eax, ebx
call fcn.00513b94
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5103e3
call fcn.004053ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x510834
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x5108d6
cmp dword [ebx + 0x94], 0
jne 0x5108d0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x510780
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x5108d0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x510896
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5108d0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00434e1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5108a5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x510af4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x524b30]
cmp dword [eax + 0x170], 0
je 0x510c59
test bl, bl
jne 0x510ba7
cmp dword [esi + 0x9c], 0
jne 0x510b9c
mov eax, esi
call fcn.005139e4
push eax
push 0x510a00
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x510b6d
mov eax, dword [0x524b30]
cmp byte [eax + 0xd3], 0
je 0x510b6d
mov eax, dword [esi + 0xd8]
call fcn.004080a0
mov edi, eax
cmp edi, 0
jl 0x510b6d
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x510b56
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x510b9c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00434e1c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x510b7c
inc dword [esi + 0x9c]
jmp 0x510c59
cmp dword [esi + 0x9c], 0
jle 0x510c59
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x510c59
cmp dword [esi + 0x44], 0
je 0x510c04
mov eax, dword [0x524b30]
cmp byte [eax + 0xd3], 0
je 0x510c04
mov eax, dword [esi + 0xd8]
call fcn.004080a0
mov edi, eax
cmp edi, 0
jl 0x510c04
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x510bed
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x510c33
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00434e1c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x510c13
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x503cc0]
call fcn.00408260
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5118a8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x511913
cmp byte [ebx + 0xd3], 0
jne 0x511913
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406a74
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x511900
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x511920
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406938
jmp 0x511920
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406938
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x513148
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x5131b6
mov eax, esi
call fcn.004df898
test al, al
je 0x5131b6
mov eax, dword [ebx + 0x84]
call fcn.004df330
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5131b6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x5131aa
push 0
mov eax, dword [ebx + 0x84]
call fcn.004df330
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004d3a88
jmp 0x5131b6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00512f80
pop esi
pop ebx
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
mov ebx, 0x40915c
nop
mov ecx, 0x19e61de0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x7ab764a2
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x549ac6
Capabilities:
Packed with generic packer

Disassembly:
mov esi, 0x45e308
jmp 0x54af17
pushfd
pushal
mov word [esp + 0x1c], 0x52a
pushal
nop
pushfd
jmp 0x55f931
pushfd
xchg dword [esp + 8], eax
inc esp
and al, 8
mov byte [esp], cl
push dword [esp + 4]
push 0xe0ad556f
push dword [esp + 0x10]
ret 0x18
call fcn.00509dcc
outsd dx, dword [esi]
rcl dword [esi], 0xf9
mov byte [0x39187692], al
sub dword [edi + 0x71], ecx
imul esi, dword [ecx], 0x4f
mov ah, 0x2c
mov cl, 0xcb
push ebp
popal
clc
pop edx
xchg dword [ebx], ebx
sub edi, esp
adc bh, bl
in al, dx
dec ebp
loop 0x54afa4
jp 0x54aeff
cmp dword [edi + ecx], 0x802de04d
cmp edi, eax
ficomp dword [eax + 0x40]
sbb dl, byte [ecx - 0x2bb79cfe]
js 0x54af01
lcall 0x5930, 0xba0f6cb
wait
pop es
adc eax, 0x7ad5e0c4
add bl, byte [esi]
add dword [edx + 0x7fde002d], esi
mov dword [0xf6248834], eax
adc dword [edi], 0xffffffbc
add byte [edi + 0x7179ba0b], cl
test al, 0x91
invalid
push 0x7327ed45
mov dword [esp + 0x20], 0xd068d9ec
pushfd
pushfd
lea esp, [esp + 0x28]
jmp fcn.004a772f
push dword [esp]
mov dword [esp + 0x48], esi
mov word [esp], bp
jmp 0x533548

Function at 0x555933
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x52ab8e
mov esi, 0x4de965
call fcn.004ffed5
lea esp, [esp + 0x3c]
ja 0x508cc2
mov esi, 0x4de965
call fcn.0055487a

Function at 0x555947
Capabilities:
Packed with generic packer

Disassembly:
nop
movzx si, cl
mov esi, dword [esp + 0x20]
push dword [esp + 8]
jmp loc.004d6a0a
pushal
movsx si, al
jmp 0x500616

Function at 0x402e5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40d00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ef4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ed4
xor eax, eax
push ebp
push 0x402ecd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402f10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ed4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x40d00c]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40d00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4035f4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40f034], 0
je 0x403655
cmp word [0x40f208], 0xd7b2
jne 0x40361d
cmp dword [0x40f210], 0
jbe 0x40361d
mov eax, 0x40f204
call dword [0x40f220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40367c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40d018], 0
jne 0x403671
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0xdb1f1c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdb1f26
pushal
call 0xdb1f2c
pop ebp
sub ebp, 0x10
sub ebp, 0x9b1f1c
jmp 0xdb1f42
add al, 0
add byte [eax], al
adc eax, 0xb874b926
sbb al, 0x1f
wait
add byte [ebx], al
lds eax, [ecx + 0x4cc0]
add byte [ecx + 0x5e7], bh
mov eax, 0x9b1f1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e7
mov edx, 0x9abeac2b
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb1f59
jmp 0xdb1f6c
mov al, byte [0x17a2a0e6]
sub ebp, dword [ebx]
sub ebp, dword [edx + 0x2b2bd3ea]
sub ebp, dword [eax]
out 0x93, al
das
sub ebp, dword [ebx]
sub edx, dword [ecx + 0x2b2b2b03]
fmul st(1), st(0)
sub bl, ah
mov al, byte [0x2b2b27aa]
sub ebp, dword [eax]
out dx, al
jnp 0xdb1f3a
dec edi
invalid
Function at 0x4074e8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x407509
jl 0x407500
test edi, edi
jne 0x407509
xor eax, eax
xor edx, edx
jmp 0x4075ca
cmp dword [ebx + 0x38], 0
je 0x40751e
push eax
push edi
push dword [ebp + 8]
call fcn.004075d0
jmp 0x4075ca
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x407565
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x407565
cmp eax, edi
jb 0x40753f
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409ac0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40756b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x4075bf
mov ecx, ebx
call fcn.00406d37
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x4075aa
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040fc5d
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x4075bf
jmp 0x40757d
test edx, edx
je 0x4075bf
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040fc5d
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40915d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40919c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40919c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40919c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40919c
cmp dword [ecx + 0x74], 0xe
jbe 0x40919c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x417310
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4290e0
push 0x4290d8
push str.FlsAlloc
push 0x1f
call fcn.0041717b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417344
push dword [ebp + 8]
mov ecx, esi
call dword [0x42517c]
call esi
jmp 0x41734a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41738e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4290f0
push 0x4290e8
push str.FlsGetValue
push 0x21
call fcn.0041717b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4173c5
push dword [ebp + 8]
mov ecx, esi
call dword [0x42517c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4173cd
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4290f8
push 0x4290f0
push str.FlsSetValue
push 0x22
call fcn.0041717b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417407
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42517c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]