joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ab160
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac901
mov eax, dword fs:[0]
push eax
sub esp, 0x2d4
mov eax, dword [0x100de040]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100ab1a1
xor al, al
jmp 0x100ab34a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
jmp 0x100ab1c0
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 9
jae 0x100ab348
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax*4 + 0x100e0aac]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x100ab343
movzx eax, byte [0x100e79f4]
test eax, eax
jne 0x100ab2a7
xor ecx, ecx
mov word [ebp - 0x23c], cx
push 0x206
push 0
lea edx, [ebp - 0x23a]
push edx
call fcn.10064e10
add esp, 0xc
push 0x104
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x23c]
lea eax, [ebp - 0x258]
call fcn.10002180
mov dword [ebp - 4], 0
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x274]
push eax
call fcn.100aaeb0
add esp, 8
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp - 0x2e0], ecx
mov byte [ebp - 4], 1
push 0x100e7dc4
mov eax, dword [ebp - 0x2e0]
call fcn.1000afd0
mov byte [ebp - 4], 0
lea esi, [ebp - 0x274]
call fcn.100021c0
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x258]
call fcn.100021c0
mov byte [0x100e79f4], 1
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x290]
call fcn.10002180
mov dword [ebp - 4], 2
lea edx, [ebp - 0x290]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.100aaeb0
add esp, 8
mov byte [ebp - 4], 4
lea esi, [ebp - 0x290]
call fcn.100021c0
push 0x100e7dc4
lea ecx, [ebp - 0x34]
push ecx
call fcn.100603d0
add esp, 8
movzx edx, al
test edx, edx
je 0x100ab316
mov byte [ebp - 0x291], 0
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x34]
call fcn.100021c0
mov al, byte [ebp - 0x291]
jmp 0x100ab34a
mov byte [ebp - 0x292], 1
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x34]
call fcn.100021c0
mov al, byte [ebp - 0x292]
jmp 0x100ab34a
jmp 0x100ab1b7
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10062448
mov esp, ebp
pop ebp
ret
Function at 0x4367e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x436805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x436878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x43683a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x43686d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x43686b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x436831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4367fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x40164e
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x2d39a2c]
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x2d39984]
test esi, esi
je 0x401694
push ebx
xor ebx, ebx
cmp eax, 0x959
jne 0x40167f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.004014f2
add edi, 8
dec esi
je 0x401693
mov eax, dword [0x2d39a2c]
jmp 0x401667
pop ebx
pop edi
pop esi
ret 4
Function at 0x40d069
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a36c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404ed5
mov dword [ebp - 0x14], eax
cmp dword [0x4400e0], esi
jne 0x40d15c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d0e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d23c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d23c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d23c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4400e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4400e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4400e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4400f0], eax
test eax, eax
je 0x40d159
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4400ec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d181
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d174
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d196
push 4
pop eax
jmp 0x40d23e
cmp dword [ebp - 0x14], esi
je 0x40d196
push dword [0x4400e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d17b
mov eax, dword [0x4400ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d1f4
cmp dword [0x4400f0], edi
je 0x40d1f4
push eax
call ebx
push dword [0x4400f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d1f4
test eax, eax
je 0x40d1f4
call ecx
test eax, eax
je 0x40d1e9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d1e9
test byte [ebp - 8], 1
jne 0x40d1f4
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d224
mov eax, dword [0x4400e4]
cmp eax, edi
je 0x40d221
push eax
call ebx
test eax, eax
je 0x40d221
call eax
mov esi, eax
test esi, esi
je 0x40d221
mov eax, dword [0x4400e8]
cmp eax, edi
je 0x40d221
push eax
call ebx
test eax, eax
je 0x40d221
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4400e0]
call ebx
test eax, eax
je 0x40d23c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d23e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040415b
mov esp, ebp
pop ebp
ret
Function at 0xc29e60
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
jmp 0x8e138b
test eax, eax
je 0x8be54a
cmp eax, edx
jb 0x797df0
mov esi, dword [ebp - 0x10]
lea esi, [esi + edx]
test bp, sp
stc
cmp eax, esi
jmp 0x916235
mov dword [ebp - 0xc], eax
jmp 0x8a73d9
mov dword [ebp - 8], eax
jmp 0x929afc
mov ecx, esi
clc
stc
sub ecx, eax
cmc
stc
cmp ecx, 0x104
jae 0x8be54a
sub edi, edi
cmc
test ecx, ecx
jmp 0xbf7ff3
pop edi
rcr ebx, 0xff
movzx esi, si
pop ebx
bswap esi
or esi, 0x123a73f3
add eax, ecx
pop esi
jmp 0xc78374
mov edi, dword [edx + ecx + 0x18]
cmp edi, 0x24e0269f
test edi, edi
jmp 0x802dd0
je 0x8690d6
mov eax, dword [eax + ecx + 0x7c]
test esp, 0x35da3174
test dx, sp
push ebx
cmp dx, 0x1f51
jmp 0xbed4b8
je 0x8c741c
mov eax, dword [edx + ecx + 0x20]
clc
lea eax, [eax + ecx]
xor ebx, ebx
jmp 0x8cde01
jns 0x8e137c
lea edi, [esi - 1]
jmp 0x71dc00
je 0x8b1ab5
xor eax, eax
pop esi
jmp 0x87e7e6
mov esp, ebp
bswap ebp
movsx ebp, cx
cmovne ebp, eax
pop ebp
jmp 0xbfe8fb
je 0x8690d6
mov eax, 0x5a4d
cmp esp, 0x6ac40495
stc
cmp word [ecx], ax
jmp 0x8690d0
pop ebp
jmp 0x715399
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
cmp dh, 0xc4
lea esi, [edi + ebx]
test esp, edi
test si, 0x7632
sar esi, 1
jmp 0x909ecf
js 0x8c741c
jmp 0x89a083
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x8690d6
mov edx, dword [eax + ecx + 0x78]
mov dword [ebp - 4], edx
cmc
jmp 0xc53377
jae 0x8be54a
mov esi, dword [edx + ecx + 0x1c]
cmp esp, 0x386e0b78
lea eax, [esi + eax*4]
test edx, 0x56c71869
stc
mov eax, dword [eax + ecx]
jmp 0x7255fa
je 0x7871e8
mov cl, byte [esi + 1]
inc esi
test si, 0x1ca1
test cl, cl
jne 0x916250
mov eax, dword [ebp + 8]
and cx, 0x3fc
bsr dx, ax
shr dx, cl
mov ecx, dword [ebp - 4]
cmp edx, edx
mov edx, dword [ecx + eax + 0x24]
setne ch
adc cl, ch
bt cx, cx
lea ecx, [edx + esi*2]
rol edx, cl
movzx edx, word [ecx + eax]
shl ecx, cl
ror cl, cl
bsr cx, si
mov dword [ebp - 8], edx
shr ecx, 0xf8
mov ecx, eax
mov ax, 0x3196
mov edx, dword [ebp - 4]
xor al, dh
sar ax, 0xcd
mov eax, dword [ebp - 8]
clc
cmp edi, ebp
cmp eax, dword [edx + ecx + 0x14]
jmp 0x8b3882
dec edi
jmp 0x72dcc4
jle 0x8c73d5
lea ebx, [esi + 1]
ror cl, 0x3a
bsr ecx, esp
mov ecx, dword [ebp + 8]
test esp, edx
cmp ebx, edi
jle 0x89a080
jmp 0x8c7413
je 0x8690d6
mov esi, dword [ebp + 0xc]
test esp, edx
test esi, esi
jmp 0x88111a
ja 0x7ccfc7
mov eax, esi
stc
sub eax, dword [edx + ecx + 0x10]
jmp 0x778cf8
mov eax, dword [eax + esi*4]
push edx
mov edx, dword [ebp + 0xc]
add eax, ecx
jmp 0xc271e8
jae 0x797df0
lea eax, [eax + ecx]
cmp al, 0x2c
mov cl, byte [eax]
cmovns si, dx
mov esi, eax
test cl, cl
je 0x8be54a
cmp cl, 0x2e
jmp 0x8be533
jmp 0x8c741c
push edi
stc
test dx, bp
mov dword [ebp - 0x10], eax
cmp ebx, 0x70d8518e
mov dword [ebp - 8], 0xffffffff
cmp dl, 0x69
cmp esi, 0xffff
jmp 0x8f00ea
ret
call fcn.00835a1c
add esp, 4
test eax, eax
jmp 0x838fbb
push ebp
mov ebp, esp
shr cx, 0x9a
shl ecx, 0x3c
mov ecx, dword [ebp + 8]
lea esp, [esp - 0x114]
test ch, 0x94
push esi
cmp ebp, eax
test edx, esi
test ecx, ecx
jmp 0x8ea324
test edx, edx
jmp 0x7f8c71
mov esp, ebp
xchg bp, bp
jmp 0x8878ca
Function at 0x4023b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4023c5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402404
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402400
lea ebx, [ebx]
cmp esi, edx
jae 0x402404
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4023f0
cmp esi, edx
jb 0x402409
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x40d973
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40d9b8
call fcn.0040b45f
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40d9b8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40d9d4
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00420ace
mov ebx, eax
test edi, edi
je 0x40d9d2
test esi, esi
je 0x40d9d2
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4218c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0040b45f
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4218fa
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0042191b
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42e2ac
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00411f9c
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x42e2e8
call fcn.0042e4cb
mov dword [esi + 0xc], 1
jmp 0x42e2ed
call fcn.0042e4cb
cmp dword [esi], 0
je 0x42e336
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x42e310
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0040aafd
jmp 0x42e321
push 0xff
mov ecx, esi
call fcn.004021d0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040944e
jmp 0x42e35a
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x42e35a
push dword [esi]
push dword [ebp - 4]
call fcn.0041e5b0
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42e420
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0042e4cb
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42e468
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040aafd
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040944e
jmp 0x42e473
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041e5b0
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4cc208
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x54a1c4
call fcn.00528480
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00406a55
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x551820
call fcn.00416b47
cmp eax, 0xffffffff
jne 0x4cc2bc
push 0
push 0x55af34
lea ecx, [ebp - 0x4d0]
call fcn.00416b47
cmp eax, 0xffffffff
jne 0x4cc2bc
push 0
push 0x5533b4
lea ecx, [ebp - 0x4d0]
call fcn.00416b47
cmp eax, 0xffffffff
jne 0x4cc2bc
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00406a55
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4cc298
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00402310
jmp 0x4cc2eb
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00409656
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00402310
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4cc2e2
mov ebx, dword [ebp - 0x4cc]
jmp 0x4cc2eb
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00402310
mov eax, ebx
call fcn.0052842f
ret
Function at 0x53a078
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a0058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0052e8a3
mov dword [ebp - 0x14], eax
cmp dword [0x5ab768], esi
jne 0x53a16b
push 0x800
push esi
push 0x57e4d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x53a0f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x53a24b
push esi
push esi
push 0x57e4d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x53a24b
push 0x57e4e8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x53a24b
push eax
call ebx
push 0x57e4f4
push edi
mov dword [0x5ab768], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x57e504
push edi
mov dword [0x5ab76c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5ab770], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5ab778], eax
test eax, eax
je 0x53a168
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5ab774], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x53a190
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x53a183
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x53a1a5
push 4
pop eax
jmp 0x53a24d
cmp dword [ebp - 0x14], esi
je 0x53a1a5
push dword [0x5ab768]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x53a18a
mov eax, dword [0x5ab774]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x53a203
cmp dword [0x5ab778], edi
je 0x53a203
push eax
call ebx
push dword [0x5ab778]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x53a203
test eax, eax
je 0x53a203
call ecx
test eax, eax
je 0x53a1f8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x53a1f8
test byte [ebp - 8], 1
jne 0x53a203
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x53a233
mov eax, dword [0x5ab76c]
cmp eax, edi
je 0x53a230
push eax
call ebx
test eax, eax
je 0x53a230
call eax
mov esi, eax
test esi, esi
je 0x53a230
mov eax, dword [0x5ab770]
cmp eax, edi
je 0x53a230
push eax
call ebx
test eax, eax
je 0x53a230
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5ab768]
call ebx
test eax, eax
je 0x53a24b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x53a24d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052768a
mov esp, ebp
pop ebp
ret
Function at 0x466e80
Capabilities:
Encode data using xor

Disassembly:
jne 0x466e27
mov eax, 0xe6f9ceae
invalid
cli
insd dword es:[edi], dx
dec ebx
salc
ror byte [ecx + edx*4], 1
push dword [edx + ebx*2 + 0xa]
push ebx
lahf
frstor dword [eax + 0x29238dca]
retf
jl 0x466e0f
mov ch, 0xa1
push 0xa42b38f
adc bh, byte [ecx + 0x55]
test byte [ebp + 0x10], bh
inc edi
jle sym.StealerClient.exe_Start
outsd dx, dword [esi]
rcr dword [ebx - 0x4dcca9e4], 0x39
push ebx
mov ah, 0x72
xor al, 0x3b
mov ds, word [eax*4 - 0x419106b]
xchg ebp, eax
out dx, eax
out 0xfb, al
mov bh, 0x1a
adc ah, byte [ebp + eax*2 + 0x59baae9b]
lodsd eax, dword [esi]
xor edx, dword [ecx - 0x23]
test eax, 0x8a38ef69
add ah, byte [esi - 0x5951eeb9]
push edi
mov al, byte [0x4dfe1b31]
adc ebp, dword [edx]
jne 0x466ea3
xlatb
daa
sub cl, byte [esi]
stosb byte es:[edi], al
nop
pop eax
push ss
dec ecx
jo 0x466ed4
invalid
cmp eax, 0xab7c52a6
scasb al, byte es:[edi]
xchg ecx, eax
mov ebp, 0x83519db9
sal ecx, 1
mov ebp, 0x306de157
adc al, 0x44
push cs
xor ah, bh
sub dh, al
sbb eax, 0x3a5ab240
cld
mov byte [0xb8df57bd], al
mov dl, 0xcf
or eax, 0xfc414e89
stc
add al, 0xbb
and byte [edx - 0x6b36a85e], ch
mov edx, 0x56d08075
cmp byte [edx], bh
xchg ecx, eax
push ebx
insd dword es:[edi], dx
invalid
Function at 0x401447
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, esi
je 0x4014a4
push edi
push esi
push esi
push esi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x40149c
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
call fcn.004013aa
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4014aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.00425dd7
mov esi, eax
pop ecx
test esi, esi
je 0x4014f8
xor edx, edx
test ebx, ebx
jbe 0x4014f8
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
inc edx
cmp edx, ebx
mov byte [ecx], al
jb 0x4014e2
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406b6f
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00401046
mov ecx, eax
call fcn.0041ac34
mov edi, dword [esp + 0x10]
mov esi, eax
push edi
push dword [esp + 0x18]
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x406bb0
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
mov ecx, ebx
call fcn.00406c05
test eax, eax
jne 0x406bfc
push dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jle 0x406bcc
push esi
push edi
mov ecx, ebx
call fcn.00406c05
test eax, eax
jne 0x406bfc
push 0x440140
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push esi
push 3
call fcn.0041f3d5
add esp, 0xc
test eax, eax
jge 0x406bfc
push edi
push esi
push 4
call fcn.0041f3d5
add esp, 0xc
test eax, eax
jge 0x406bfc
xor eax, eax
jmp 0x406bff
push 1
pop eax
pop edi
pop esi
pop ebx
ret 8