joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ca754
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ca8ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5ca8e0
mov dl, 1
mov eax, dword [0x48aad8]
call fcn.004ade88
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.004096ec
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5ca8cf
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00534114
test al, al
je 0x5ca8c2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5ca910
lea eax, [ebp - 0x394]
call fcn.0042451c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5ca8c2
xor eax, eax
push ebp
push 0x5ca8bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5ca980
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5ca8a4
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a310
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5ca8a4
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a310
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ca8c2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5ca7c5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004addd8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ca906
lea eax, [ebp - 0x3a0]
call fcn.004096ec
ret

Function at 0x5cb4ac
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x613750]
cmp byte [eax + 0xc5], 0
jne 0x5cb51e
cmp dword [0x613774], 0
jne 0x5cb4de
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x60c270]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x613774], eax
cmp dword [0x613770], 0
jne 0x5cb4f9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x613770], eax
cmp dword [0x613778], 0
jne 0x5cb51e
push esp
push 0
push 0
mov eax, dword [0x60c26c]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x613778], eax
pop edx
ret
Function at 0x5cb940
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5cb957
add esp, 0xfffffff0
call fcn.00407fd8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004be66c
mov eax, dword [0x60c7ec]
cmp byte [eax], 0
jne 0x5cb984
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x60cc30]
cmp word [eax + 2], 0
jne 0x5cb99e
mov eax, dword [0x60cc30]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cdc14
mov eax, dword [0x60cdb8]
cmp word [eax + 2], 0
jne 0x5cb9b8
mov eax, dword [0x60cdb8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cde18
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4f3764]
call fcn.004f98b4
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5ce390
mov dl, 1
mov eax, dword [0x48731c]
call fcn.0040793c
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48731c]
call fcn.0040793c
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f818c]
call fcn.00502ec4
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5cbba0
mov eax, dword [0x60ca80]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0050335c
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5ce678
mov dl, 1
mov eax, dword [0x48731c]
call fcn.0040793c
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x60ca80]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0042431c
test eax, eax
je 0x5cbad2
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00424158
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00424300
test eax, eax
je 0x5cbaea
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a310
push ebx
push 0x5cd5f0
call fcn.005c11d4
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x60c7ec]
cmp byte [eax], 0
jne 0x5cbb3b
mov eax, ebx
call fcn.005cbd84
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005ce8b0
mov eax, ebx
call fcn.005cf51c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5cbb98
call fcn.00408030
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5cc0c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5cc16a
cmp dword [ebx + 0xac], 0
jne 0x5cc164
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5cc004
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5cc164
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5cc12a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5cc164
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004a9528
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5cc139
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5cc3a8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x613750]
cmp dword [eax + 0x188], 0
je 0x5cc522
test bl, bl
jne 0x5cc46d
cmp dword [esi + 0xb4], 0
jne 0x5cc462
mov eax, esi
call fcn.005cf36c
push eax
push 0x5cc29c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5cc433
mov eax, dword [0x613750]
cmp byte [eax + 0xeb], 0
je 0x5cc433
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5cc414
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5cc433
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5cc41c
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5cc462
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a9528
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5cc442
inc dword [esi + 0xb4]
jmp 0x5cc522
cmp dword [esi + 0xb4], 0
jle 0x5cc522
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5cc522
cmp dword [esi + 0x58], 0
je 0x5cc4d7
mov eax, dword [0x613750]
cmp byte [eax + 0xeb], 0
je 0x5cc4d7
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5cc4b8
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5cc4d7
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5cc4c0
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5cc506
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a9528
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5cc4e6
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5be034]
call fcn.0040b80c
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5cd17c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5cd1d9
cmp byte [ebx + 0xeb], 0
jne 0x5cd1d9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409874
mov eax, dword [esi]
test eax, eax
je 0x5cd1c6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5cd1e6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409acc
jmp 0x5cd1e6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409acc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5cea98
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5ceb09
mov eax, esi
call fcn.0052dbc0
test al, al
je 0x5ceb09
mov eax, dword [ebx + 0x98]
call fcn.0052d7f0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5ceb09
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x5ceafa
push 0
mov eax, dword [ebx + 0x98]
call fcn.0052d7f0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.0052440c
jmp 0x5ceb09
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005ce8d0
pop esi
pop ebx
ret
Function at 0x5d33d8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5d3452
mov eax, dword [ebx + 8]
call fcn.0052d7f0
mov ecx, eax
mov dl, 1
mov eax, dword [0x539d74]
call fcn.00527b18
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.0053e524
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5d2cd0
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0052d7f0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0052d7f0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5d34c8
mov eax, dword [ebx + 8]
call fcn.0052d7f0
mov ecx, eax
mov dl, 1
mov eax, dword [0x539d74]
call fcn.00527b18
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.0053e524
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5d2d1c
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052d7f0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052d7f0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5d3534
mov eax, dword [ebx + 8]
call fcn.0052d7f0
mov ecx, eax
mov dl, 1
mov eax, dword [0x53a7f4]
call fcn.00527b18
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052d7f0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052d7f0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5dc630
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x613b90], 0
jne 0x5dc647
call fcn.005dc5ec
mov eax, edi
dec eax
test eax, eax
jl 0x5dc66f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x613790]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5dc651
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x5df364
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5df3fe.0
jmp dword [ecx*4 + 0x5df397]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5df3c9
sub dl, 8
je 0x5df3d8
jmp case.0x5df3fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df030
jmp case.0x5df3fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df084
jmp case.0x5df3fe.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5df3fe.0
movzx ecx, byte [ecx + 0x5df405]
jmp dword [ecx*4 + 0x5df416]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df124
jmp case.0x5df3fe.0
cmp dl, 3
jne 0x5df443
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df17c
jmp case.0x5df3fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df138
jmp case.0x5df3fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df1c0
jmp case.0x5df3fe.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5df46e
sub dl, 8
je 0x5df47a
jmp case.0x5df3fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df1ec
jmp case.0x5df3fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df250
jmp case.0x5df3fe.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5df499
sub dl, 8
je 0x5df4a5
jmp case.0x5df3fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df300
jmp case.0x5df3fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5df328
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x5df547
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005de578
test eax, eax
je 0x5df547
mov eax, ebx
call fcn.005df550
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5df4e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5df550
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5df581
dec al
je 0x5df5bc
dec al
je 0x5df5f9
dec al
je 0x5df662
jmp 0x5df6ec
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5df6ec
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5df591
jmp 0x5df6ec
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5df6ec
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x5df5cc
jmp 0x5df6ec
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5df6ec
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5df628
xor ebp, ebp
jmp 0x5df638
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5df641
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5df609
jmp 0x5df6ec
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5df6ec
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5df6bb
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005dc678
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5df676
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5f92f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004097d0
mov eax, dword [ebp - 8]
call fcn.004097d0
xor eax, eax
push ebp
push 0x5f936e
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00423f44
mov eax, dword [ebp - 0xc]
call fcn.0040a254
push eax
mov eax, dword [ebp - 8]
call fcn.0040a254
push eax
mov eax, dword [ebp - 4]
call fcn.0040a254
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f9375
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040974c
ret
Function at 0x5fa1f0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, eax
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x202]
push eax
call sub.advapi32.dll_GetUserNameW
mov edx, ebx
lea eax, [ebp - 0x202]
call fcn.00424404
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403160
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
mov eax, dword [0x49c50c]
mov ecx, dword [0x499418]
sub esp, 0x424
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403258
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x49c50c], 0x959
jne 0x40323e
call esi
push 0
lea eax, [esp + 0x34]
push eax
push 0x402c34
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapWalk]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edx, dword [esp + 0x14]
push edx
call fcn.00402fc0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x4031a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret
Function at 0x408e60
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430c00]
jne 0x408e6a
repz ret
jmp fcn.0040bebc

Function at 0x40b98c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404df9
and dword [ebp - 4], 0
cmp dword [0x431fc4], 0
mov ebx, eax
jne 0x40ba3d
push 0x402b8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40baee
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402b80
push edi
call esi
test eax, eax
je 0x40baee
push eax
call fcn.00404d87
mov dword [esp], 0x402b70
push edi
mov dword [0x431fc4], eax
call esi
push eax
call fcn.00404d87
mov dword [esp], 0x402b5c
push edi
mov dword [0x431fc8], eax
call esi
push eax
call fcn.00404d87
mov dword [esp], 0x402b40
push edi
mov dword [0x431fcc], eax
call esi
push eax
call fcn.00404d87
pop ecx
mov dword [0x431fd4], eax
test eax, eax
je 0x40ba3d
push 0x402b28
push edi
call esi
push eax
call fcn.00404d87
pop ecx
mov dword [0x431fd0], eax
mov eax, dword [0x431fd0]
cmp eax, ebx
je 0x40ba95
cmp dword [0x431fd4], ebx
je 0x40ba95
push eax
call fcn.00404e02
push dword [0x431fd4]
mov esi, eax
call fcn.00404e02
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ba95
test edi, edi
je 0x40ba95
call esi
test eax, eax
je 0x40ba8c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ba8c
test byte [ebp - 0xc], 1
jne 0x40ba95
or dword [ebp + 0x10], 0x200000
jmp 0x40bace
mov eax, dword [0x431fc8]
cmp eax, ebx
je 0x40bace
push eax
call fcn.00404e02
pop ecx
test eax, eax
je 0x40bace
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bace
mov eax, dword [0x431fcc]
cmp eax, ebx
je 0x40bace
push eax
call fcn.00404e02
pop ecx
test eax, eax
je 0x40bace
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431fc4]
call fcn.00404e02
pop ecx
test eax, eax
je 0x40baee
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40baf0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret