joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412416
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x848
mov eax, dword [0x5a0b04]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push 0x5a4e98
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
shr eax, 1
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor ebx, ebx
cmp dword [edi + 0x204], ebx
jle 0x4124c4
lea eax, [edi + 0x208]
mov dword [ebp - 0x848], eax
inc ebx
lea eax, [ebp - 0x44]
push ebx
push str._.2i
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x400
lea eax, [ebp - 0x844]
push eax
push 0x5209bc
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.00411ea9
add esp, 0x20
test eax, eax
je 0x4124bc
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.SHLWAPI.dll_StrDupW]
mov ecx, dword [ebp - 0x848]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x848], ecx
cmp ebx, dword [edi + 0x204]
jl 0x41246b
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0049badb
leave
ret
Function at 0x4127b2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa34
mov eax, dword [0x5a0b04]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
mov ebx, 0x104
push edi
mov edi, dword [ebp + 8]
push 0x10
pop eax
cmovne eax, ecx
mov dword [ebp - 0xa34], esi
mov dword [ebp - 0xa30], eax
lea eax, [ebp - 0x61c]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x414]
push eax
xor eax, eax
push eax
push eax
push 5
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp dword [ebp + 0x1c], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
je 0x4128d2
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x4128d2
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsPrefixW]
test eax, eax
jne 0x4128d2
push edi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsPrefixW]
test eax, eax
je 0x4128d2
push dword [ebp - 0xa30]
lea eax, [ebp - 0x414]
push edi
push 0x10
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRelativePathToW]
test eax, eax
je 0x4128d2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x414]
push str._CSIDL:MYDOCUMENTS_
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov esi, dword [ebp - 0xa34]
jmp 0x412927
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x412917
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
test eax, eax
jne 0x412917
push dword [ebp - 0xa30]
lea eax, [ebp - 0x61c]
push edi
push 0x10
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRelativePathToW]
test eax, eax
jne 0x412927
mov ecx, 0x104
lea eax, [ebp - 0x20c]
push ecx
push edi
push eax
call ebx
cmp dword [ebp + 0x18], 0
mov eax, 0x104
push eax
je 0x412951
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnExpandEnvStringsW]
test eax, eax
jne 0x412961
mov eax, 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call ebx
test esi, esi
je 0x412981
cmp edi, esi
je 0x412981
mov eax, dword [ebp + 0x10]
mov ecx, 0x104
test eax, eax
cmove eax, ecx
push eax
lea eax, [ebp - 0x824]
push eax
push esi
jmp 0x412997
mov eax, dword [ebp + 0x10]
mov ecx, 0x104
test eax, eax
cmove eax, ecx
push eax
lea eax, [ebp - 0x824]
push eax
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049badb
leave
ret
Function at 0x412a2f
Capabilities:
Check if file exists
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412a76
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call edi
mov ecx, dword [ebp + 0x10]
mov esi, eax
add ecx, 0xc
push ecx
jmp 0x412aa9
mov eax, dword [ebp + 0x18]
or eax, 0x10
push eax
push dword [ebp + 0x14]
push esi
push 0x80
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call edi
mov esi, eax
mov eax, dword [ebp + 0x10]
add eax, 0xc
push eax
call edi
cmp eax, esi
jge 0x412ac9
push 0x104
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
mov eax, dword [ebp + 0x10]
add eax, 0xc
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413a79
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x5a0b04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp + 0x24]
push edi
mov dword [ebp - 0x26c], eax
call fcn.0041371f
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
add eax, 0x271a
push eax
lea eax, [ebp - 0x25c]
push 0x12c
push eax
call fcn.00411c37
lea eax, [ebp - 0x25c]
push eax
push 0xff
push dword [0x5adac4]
call fcn.00412e82
add esp, 0x1c
xor edi, edi
inc edi
push 0
push edi
push 0x409
push dword [0x5adac4]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push dword [0x5adac4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x5adac4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [ebp + 8], 0
je 0x413b5d
push dword [ebp - 0x260]
push dword [ebp - 0x264]
push dword [ebp - 0x268]
push ebx
push dword [ebp + 0x10]
push esi
push dword [0x5adacc]
call fcn.0040decb
add esp, 0x1c
jmp 0x413b77
push dword [ebp + 0x28]
push dword [ebp - 0x26c]
push dword [ebx]
push esi
push dword [0x5adacc]
call fcn.0040f7c9
add esp, 0x14
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413b89
test al, 1
jne 0x413b8b
xor edi, edi
push 0
push 0
push 0x409
push dword [0x5adac4]
mov dword [0x5a54d4], edi
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.004139ab
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049badb
leave
ret
Function at 0x416c76
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1367c
call fcn.0049baf0
mov eax, dword [0x5a0b04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x208
mov dword [ebp - 0x13620], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x13624], esi
call fcn.004bd230
add esp, 0xc
lea eax, [ebp - 0x61c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
call esi
lea eax, [ebp - 0x1361c]
push 0x9800
push eax
call fcn.00418f62
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
pop ecx
pop ecx
push ebx
call edi
test eax, eax
je 0x416cf1
push ebx
jmp 0x416d96
mov ebx, 0x5a9d00
push ebx
call edi
test eax, eax
je 0x416d19
push ebx
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x416d9f
mov ebx, 0x5ad460
push ebx
call edi
test eax, eax
je 0x416d91
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x416d9f
push esi
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
jmp 0x416d9f
push 0x5a6e68
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x58
pop esi
push esi
lea eax, [ebp - 0x1367c]
push 0
push eax
call fcn.004bd230
mov eax, dword [ebp - 0x13620]
add esp, 0xc
mov dword [ebp - 0x13678], eax
lea eax, [ebp - 0x1361c]
mov dword [ebp - 0x13670], eax
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x1367c], esi
mov esi, 0x5ad3e0
mov dword [ebp - 0x13660], eax
lea eax, [ebp - 0x20c]
push esi
mov dword [ebp - 0x13650], eax
mov dword [ebp - 0x1365c], 0x104
mov dword [ebp - 0x13648], 0x2000806
call edi
neg eax
sbb eax, eax
and eax, esi
mov dword [ebp - 0x13640], eax
lea eax, [ebp - 0x1367c]
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
pop edi
pop esi
pop ebx
test eax, eax
je 0x416e41
push dword [ebp + 0x10]
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x13624]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
inc eax
jmp 0x416e43
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049badb
leave
ret
Function at 0x417814
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5a0b04]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [0x5adad4], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
mov esi, 0x104
movzx ecx, al
shl cx, 8
shr ax, 8
push 0x5a6e68
or cx, ax
push esi
mov word [0x5adad0], cx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0xffffffffffffffff
push dword [0x5a70f8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 0x500
cmp word [0x5adad0], ax
jae 0x4178f8
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x400
push 0x47e
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x30
push 0x5217c0
push dword [ebp - 0x210]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4179b6
call fcn.0041200b
mov dword [0x5a6e20], eax
call fcn.004109da
call fcn.004140a9
push 0x5a6e28
call fcn.004129d8
pop ecx
cmp dword [0x5a70d8], ebx
je 0x41792b
push ebx
call fcn.00408ee3
pop ecx
jmp 0x4179b6
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
cmp dword [0x5a6e20], ebx
je 0x417945
push 0x5217dc
push str.Notepad2
call esi
cmp dword [0x5a70b0], ebx
je 0x417959
push 0x56b54c
push str.Notepad2
call esi
call fcn.00413166
test eax, eax
jne 0x4179b6
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 8
push eax
mov dword [ebp - 0x214], 0x6ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x5217e0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.uxtheme.dll
mov dword [0x5a55ec], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
mov dword [0x5a55f0], eax
call fcn.004975b7
pop ecx
call fcn.00414526
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049badb
leave
ret 0x10

Function at 0x418505
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5a0b04]
xor eax, ebp
mov dword [ebp - 4], eax
or eax, 0xffffffff
cmp dword [0x5aa0b0], eax
je 0x418538
cmp dword [0x5aa0b4], eax
je 0x418538
cmp dword [0x5aa0b8], eax
je 0x418538
cmp dword [0x5aa0bc], eax
jne 0x418569
push 3
lea eax, [ebp - 0xc]
push eax
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [ebp - 0xc], 0x30
jne 0x41855b
movaps xmm0, xmmword [0x5224a0]
jmp 0x418562
movaps xmm0, xmmword [0x522490]
movups xmmword [0x5aa0b0], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049badb
leave
ret
Function at 0x41af4b
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
movsd xmm1, qword [ebp + 8]
xorps xmm0, xmm0
ucomisd xmm1, xmm0
lahf
test ah, 0x44
jnp 0x41af63
movaps xmm0, xmm1
movsd qword [ebp + 8], xmm0
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ebp + ecx + 8]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0x41af6f
mov eax, edx
pop ebp
ret 8
Function at 0x42dae0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x42db40
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x42db3f
cmp eax, 0x29
jne 0x42db44
cmp dword [esi + 0x10], 0
jne 0x42db3f
test dword [esi + 0x50], edx
je 0x42dc3c
cmp eax, 0x5d
jne 0x42db1a
test dword [esi + 0x50], edx
je 0x42dc30
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0042cee1
mov ecx, esi
call fcn.00431c5c
mov ecx, esi
call fcn.00431cd9
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x42daee
pop ebx
mov al, cl
pop esi
ret
cmp eax, 0x2e
jne 0x42db55
push 5
lea ecx, [esi + 0x24]
call fcn.00431be8
jmp 0x42db27
cmp eax, 0x5c
jne 0x42dba1
mov ecx, esi
call fcn.00431c5c
test byte [esi + 0x50], 0x80
je 0x42db98
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x42db81
push 4
lea ecx, [esi + 0x24]
call fcn.00431be8
mov ecx, esi
call fcn.00431c5c
jmp 0x42db35
cmp al, 0x42
jne 0x42db98
push 4
lea ecx, [esi + 0x24]
call fcn.00431be8
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x42db78
mov ecx, esi
call fcn.0042ddaf
jmp 0x42db2e
cmp eax, 0x5b
jne 0x42dbc4
mov ecx, esi
call fcn.00431c5c
mov ecx, esi
call fcn.0042e8c9
push 4
push 0x5d
mov ecx, esi
call fcn.00430848
jmp 0x42db2e
cmp eax, 0x28
jne 0x42dbf1
mov ecx, esi
call fcn.00431c5c
mov ecx, esi
call fcn.00432cee
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00430848
test bl, bl
je 0x42db35
jmp 0x42db2e
cmp eax, 0x5e
jne 0x42dbfd
push 2
jmp 0x42db70
cmp eax, 0x24
jne 0x42dc09
push 3
jmp 0x42db70
cmp eax, 0x2a
je 0x42dc34
cmp eax, 0x2b
je 0x42dc34
cmp eax, 0x3f
je 0x42dc34
cmp eax, 0x7b
je 0x42dc34
cmp eax, 0x7d
jne 0x42db0c
test dword [esi + 0x50], edx
je 0x42dc38
jmp 0x42db1a
push 4
jmp 0x42dc3e
push 0xa
jmp 0x42dc3e
push 6
jmp 0x42dc3e
push 5
mov ecx, esi
call fcn.004307cc
int3
Function at 0x42dc46
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x42dca6
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x42dca5
cmp eax, 0x29
jne 0x42dcaa
cmp dword [esi + 0x10], 0
jne 0x42dca5
test dword [esi + 0x50], edx
je 0x42dda5
cmp eax, 0x5d
jne 0x42dc80
test dword [esi + 0x50], edx
je 0x42dd99
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0042cf3e
mov ecx, esi
call fcn.00431c8a
mov ecx, esi
call fcn.00431da4
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x42dc54
pop ebx
mov al, cl
pop esi
ret
cmp eax, 0x2e
jne 0x42dcbb
push 5
lea ecx, [esi + 0x24]
call fcn.00431c22
jmp 0x42dc8d
cmp eax, 0x5c
jne 0x42dd0a
mov ecx, esi
call fcn.00431c8a
test byte [esi + 0x50], 0x80
je 0x42dd01
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x42dce9
push 4
lea ecx, [esi + 0x24]
call fcn.00431c22
mov ecx, esi
call fcn.00431c8a
jmp 0x42dc9b
cmp eax, 0x42
jne 0x42dd01
push 4
lea ecx, [esi + 0x24]
call fcn.00431c22
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x42dce0
mov ecx, esi
call fcn.0042de55
jmp 0x42dc94
cmp eax, 0x5b
jne 0x42dd2d
mov ecx, esi
call fcn.00431c8a
mov ecx, esi
call fcn.0042e912
push 4
push 0x5d
mov ecx, esi
call fcn.00430865
jmp 0x42dc94
cmp eax, 0x28
jne 0x42dd5a
mov ecx, esi
call fcn.00431c8a
mov ecx, esi
call fcn.00432d6d
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00430865
test bl, bl
je 0x42dc9b
jmp 0x42dc94
cmp eax, 0x5e
jne 0x42dd66
push 2
jmp 0x42dcd8
cmp eax, 0x24
jne 0x42dd72
push 3
jmp 0x42dcd8
cmp eax, 0x2a
je 0x42dd9d
cmp eax, 0x2b
je 0x42dd9d
cmp eax, 0x3f
je 0x42dd9d
cmp eax, 0x7b
je 0x42dd9d
cmp eax, 0x7d
jne 0x42dc72
test dword [esi + 0x50], edx
je 0x42dda1
jmp 0x42dc80
push 4
jmp 0x42dda7
push 0xa
jmp 0x42dda7
push 6
jmp 0x42dda7
push 5
mov ecx, esi
call fcn.004307d8
int3
Function at 0x434073
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x5a0b04]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov dword [ebp - 0x84], 0x54ffd0
mov dword [ebp - 0x80], 0x54ffd4
mov dword [ebp - 0x7c], 0x54ffd8
mov dword [ebp - 0x78], 0x54ffdc
mov dword [ebp - 0x74], 0x54ffe0
mov dword [ebp - 0x70], 0x54ffe4
mov dword [ebp - 0x6c], 0x54ffe8
mov dword [ebp - 0x68], 0x54ffec
mov dword [ebp - 0x64], 0x54fff0
mov dword [ebp - 0x60], 0x54fff4
mov dword [ebp - 0x5c], 0x54fff8
mov dword [ebp - 0x58], 0x54fffc
mov dword [ebp - 0x54], 0x550000
mov dword [ebp - 0x50], 0x550004
mov dword [ebp - 0x4c], 0x550008
mov dword [ebp - 0x48], 0x55000c
mov dword [ebp - 0x44], 0x550010
mov dword [ebp - 0x40], 0x550014
mov dword [ebp - 0x3c], 0x550018
mov dword [ebp - 0x38], 0x55001c
mov dword [ebp - 0x34], 0x550020
mov dword [ebp - 0x30], 0x550024
mov dword [ebp - 0x2c], 0x550028
mov dword [ebp - 0x28], 0x55002c
mov dword [ebp - 0x24], 0x550030
mov dword [ebp - 0x20], 0x550034
mov dword [ebp - 0x1c], 0x550038
mov dword [ebp - 0x18], 0x55003c
mov dword [ebp - 0x14], 0x550040
mov dword [ebp - 0x10], 0x550044
mov dword [ebp - 0xc], 0x550048
mov dword [ebp - 8], 0x55004c
cmp al, 0x20
jae 0x43417c
movzx eax, al
mov eax, dword [ebp + eax*4 - 0x84]
jmp 0x434181
mov eax, 0x550050
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049badb
leave
ret
Function at 0x495d34
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0
push dword [ebp + 0xc]
mov edi, ecx
push dword [edi + 4]
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, dword [ebp + 8]
mov ebx, eax
xor eax, eax
mov ecx, esi
push eax
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov eax, ebx
cdq
sub eax, edx
mov dword [esi + 0x14], 7
sar eax, 1
push eax
call fcn.004974c1
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x495d78
mov eax, dword [esi]
push ebx
push eax
push dword [ebp + 0xc]
push dword [edi + 4]
call sub.IMM32.dll_ImmGetCompositionStringW
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x503eb5
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00503d89
Function at 0x506b8e
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5a0b04]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x506bd9
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00506f32
test al, al
jne 0x506bd3
sub edx, 2
cmp edx, edi
jne 0x506bb9
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x506bfb
lea eax, [edi + 2]
cmp edx, eax
je 0x506bfb
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00506855
add esp, 0x10
jmp 0x506cf5
push esi
lea ecx, [ebp - 0x255]
call fcn.00506f32
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x506c3e
push dword [ebp - 0x25c]
jmp 0x506beb
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x506c7b
cmp word [ebp - 0x226], 0
je 0x506c9c
cmp word [ebp - 0x226], ax
jne 0x506c7b
cmp word [ebp - 0x224], 0
je 0x506c9c
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00506855
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x506ce8
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x506c55
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x506cd0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x506cf5
push 0x506374
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.005162f0
add esp, 0x10
jmp 0x506cc5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049badb
leave
ret
Function at 0x50820b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5082a8
push ebx
push esi
call fcn.005081c7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005080b9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x508255
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5082a7
push edi
push eax
call fcn.00504e1f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x508275
call fcn.00500148
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5082a6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005080b9
add esp, 0x20
test eax, eax
jne 0x508294
push edi
call fcn.00500148
jmp 0x50829c
push ebx
call fcn.00500148
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5082ab
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5082bc
pop esi
ret
push ebx
push edi
push esi
call fcn.005081c7
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00504e1f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5082e4
push ebx
push esi
push edi
call fcn.004bd390
add esp, 0xc
push 0
call fcn.00500148
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x508b8f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00508557

Function at 0x5094df
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x563ddc
push 0x563dd4
push str.FlsAlloc
push 0x1e
call fcn.005091af
mov esi, eax
add esp, 0x10
test esi, esi
je 0x509513
push dword [ebp + 8]
mov ecx, esi
call dword [0x5206ac]
call esi
jmp 0x509519
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x50955d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x563dec
push 0x563de4
push str.FlsGetValue
push 0x20
call fcn.005091af
mov esi, eax
add esp, 0x10
test esi, esi
je 0x509594
push dword [ebp + 8]
mov ecx, esi
call dword [0x5206ac]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x511570
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00511138

Function at 0x51157b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005112c7