joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49daea
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov dword [ebp - 0xc], eax
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
cmp eax, 0
je 0x49dc2e
push 0x64
call fcn.00441ef6
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x49dc11
mov eax, dword [ebp - 0x1c]
cmp eax, 0
je 0x49db60
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0x3d
jne 0x49db60
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 1]
cmp al, 0
jne 0x49db60
jmp 0x49db64
xor eax, eax
jmp 0x49db67
xor eax, eax
inc eax
cmp eax, 0
je 0x49dbff
push 0xffffffffffffffff
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.00447bfb
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.00447bfb
mov eax, dword [ebp - 0x1c]
shl eax, 1
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 2]
cmp al, 0
jne 0x49dbd5
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 3]
cmp al, 0
jne 0x49dbd5
jmp 0x49dbd9
xor eax, eax
jmp 0x49dbdc
xor eax, eax
inc eax
cmp eax, 0
je 0x49dbe8
jmp 0x49dc1a
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x14], eax
mov eax, 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
jne 0x49db3e
push dword [ebp - 0x18]
call fcn.00441278
mov dword [ebp - 0x1c], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x18]
call fcn.00462138
leave
ret
Function at 0x49dc87
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xe4
push 8
call fcn.0048aee2
push eax
call fcn.00457d38
mov dword [ebp - 0xc], eax
call fcn.0048aee2
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax]
add eax, 0x14
mov dword [ebp - 0x10], eax
mov eax, 0x9c
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax + 0x14], edx
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xb4]
mov al, byte [eax + 0x9a]
cmp al, 1
setne al
xor ah, ah
cwde
mov dword [ebp - 0xec], eax
push 0
push dword [ebp - 0x18]
push 8
push str.Windows
call fcn.00447b37
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 4]
cmp eax, 5
je 0x49ddd2
cmp eax, 6
je 0x49de2d
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49dd9f
mov eax, dword [ebp - 0xe8]
cmp eax, 0x4f3d
jl 0x49dd6f
mov eax, str.Server_2022
jmp 0x49dd9d
mov eax, dword [ebp - 0xe8]
cmp eax, 0x42ee
jl 0x49dd83
mov eax, str.Server_2019
jmp 0x49dd9d
xor eax, eax
inc eax
je 0x49dd8f
mov eax, str.Server_2016
jmp 0x49dd9d
call fcn.0049dd94
mov eax, dword [ebp - 0xe8]
cmp eax, 0x55f0
jl 0x49ddb3
mov eax, 0x585b14
jmp 0x49ddcd
xor eax, eax
inc eax
je 0x49ddbf
mov eax, 0x585b17
jmp 0x49ddcd
call fcn.0049ddc4
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49de01
cmp eax, 1
je 0x49de08
cmp eax, 2
je 0x49de0f
call fcn.0049ddf8
mov eax, 0x585a8e
jmp 0x49de28
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49de23
mov eax, str.Server_2003_R2
jmp 0x49de28
mov eax, str.Server_2003
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49de63
cmp eax, 1
je 0x49de7e
cmp eax, 2
je 0x49de99
cmp eax, 3
je 0x49deb4
call fcn.0049de5a
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49de92
mov eax, str.Server_2008_R1
jmp 0x49de97
mov eax, 0x585acd
jmp 0x49decd
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49dead
mov eax, str.Server_2012
jmp 0x49deb2
mov eax, 0x585adb
jmp 0x49decd
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49dec8
mov eax, str.Server_2012_R2
jmp 0x49decd
mov eax, 0x585aec
Function at 0x49e27c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, 0x1000
mov dword [ebp - 0x18], 0x1000
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x20]
add eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x49e320
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x49e320
mov eax, 2
push edx
mov edx, dword [ebp - 0x18]
imul edx
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.MSVCRT.DLL_realloc]
add esp, 8
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x49e29e
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
leave
ret 8
Function at 0x523d93
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x524de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x524e0e
cmp eax, 5
je 0x524e45
mov dword [ebp - 0x20], 0
jmp 0x524efa
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
jmp 0x524efa
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.0044134c
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.00441382
mov dword [ebp - 0x14], eax
jmp 0x524ed0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
je 0x524e89
mov eax, dword [ebp - 0x1c]
cmp eax, 0x11
je 0x524e89
xor eax, eax
jmp 0x524e8c
xor eax, eax
inc eax
cmp eax, 0
je 0x524ec5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
xor al, 1
cmp eax, 0
je 0x524ee8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
jae 0x524ee8
jmp 0x524eec
xor eax, eax
jmp 0x524eef
xor eax, eax
inc eax
cmp eax, 0
jne 0x524e64
mov eax, dword [0x577ef4]
mov dword [ebp - 0x18], eax
mov eax, 4
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
leave
ret 8

Function at 0x52585a
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
je 0x525888
cmp eax, 0xf
je 0x5258b6
mov eax, 0
jmp 0x525afd
push dword [ebp + 8]
call fcn.0044134c
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.00441278
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x5258b4
mov eax, 0
jmp 0x525afd
jmp 0x5258c8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x525afa
Function at 0x529b36
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
and eax, 0x1000000
cmp eax, 0
setne al
xor ah, ah
cwde
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
je 0x529b8e
cmp eax, 0x11
je 0x529b9e
cmp eax, 0x12
je 0x529bb9
mov eax, 0
jmp 0x529bd2
push 3
push dword [ebp - 0xc]
call dword [sym.imp.USER32.DLL_MapVirtualKeyW]
mov dword [ebp - 0x10], eax
jmp 0x529bd2
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x529baf
mov eax, 0xa3
jmp 0x529bb4
mov eax, 0xa2
mov dword [ebp - 0x10], eax
jmp 0x529bd2
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x529bca
mov eax, 0xa5
jmp 0x529bcf
mov eax, 0xa4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x529bd9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, 0
mov dword [ebp - 0xc], 0
push 0x11
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529c0f
mov eax, 0x10000000
mov dword [ebp - 0xc], 0x10000000
push 0x10
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529c2e
mov eax, dword [ebp - 0xc]
or eax, 0x20000000
mov dword [ebp - 0xc], eax
push 0x12
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529c4d
mov eax, dword [ebp - 0xc]
or eax, 0x40000000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
xor al, 1
cmp eax, 0
je 0x529cd5
push 1
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529c78
mov eax, dword [ebp - 0xc]
or eax, 0x2000000
mov dword [ebp - 0xc], eax
push 2
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529c97
mov eax, dword [ebp - 0xc]
or eax, 0x800000
mov dword [ebp - 0xc], eax
push 4
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529cb6
mov eax, dword [ebp - 0xc]
or eax, 0x1000000
mov dword [ebp - 0xc], eax
push 5
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529cd5
mov eax, dword [ebp - 0xc]
or eax, 0x400000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x532185
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x583b74]
xor al, 1
cmp eax, 0
je 0x5321cd
mov eax, dword [ebp + 0xc]
cmp eax, 5
jne 0x5321bc
mov eax, 8
mov dword [ebp + 0xc], 8
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052ff81
leave
ret 8
Function at 0x539e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xd0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x25
jne 0x539e96
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0xc]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0xc]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x10]
jmp 0x539ebd
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
fld dword [eax + 4]
fstp dword [ebp - 0xc]
mov eax, dword [ebp - 0xd4]
fld dword [eax + 8]
fstp dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x1c]
mov eax, 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push 0x3f800000
fld dword [esp]
add esp, 4
fstp dword [ebp - 0x30]
jmp 0x53a01b
Function at 0x53debb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [0x583a1c], eax
push 0
call dword [sym.imp.USER32.DLL_GetDC]
mov dword [0x583a24], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [0x583a28], eax
mov eax, 0x11c
xchg edx, eax
mov eax, dword [0x583a38]
mov dword [eax], edx
push dword [0x583a38]
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov eax, dword [0x583a38]
mov eax, dword [eax + 4]
cmp eax, 5
jne 0x53df29
mov eax, dword [0x583a38]
mov eax, dword [eax + 8]
cmp eax, 1
jge 0x53df29
jmp 0x53df2d
xor eax, eax
jmp 0x53df30
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x53df3e
call fcn.0053dc74
call fcn.0053ebdb
mov dword [0x583b7c], eax
mov eax, dword [0x583a38]
mov eax, dword [eax + 4]
cmp eax, 0xa
setge al
xor ah, ah
cwde
mov dword [0x583b70], eax
mov eax, dword [0x583a38]
mov eax, dword [eax + 4]
cmp eax, 0xa
jge 0x53dfad
mov eax, dword [0x583a38]
mov eax, dword [eax + 4]
cmp eax, 6
jl 0x53df9b
mov eax, dword [0x583a38]
mov eax, dword [eax + 8]
cmp eax, 2
jl 0x53df9b
jmp 0x53df9f
xor eax, eax
jmp 0x53dfa2
xor eax, eax
inc eax
cmp eax, 0
jne 0x53dfad
xor eax, eax
jmp 0x53dfb0
xor eax, eax
inc eax
mov dword [0x583b74], eax
mov eax, dword [0x583a38]
mov eax, dword [eax + 4]
cmp eax, 6
setl al
xor ah, ah
cwde
mov dword [0x583b78], eax
push 0x1a
push dword [0x5827a8]
call fcn.0044fe05
mov dword [ebp - 0xc], eax
mov eax, 3
shl eax, 0x13
mov edx, eax
mov eax, 0x27
or eax, edx
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [0x583a38]
mov eax, dword [eax + 8]
shl eax, 8
xchg edx, eax
mov eax, dword [0x583a38]
mov eax, dword [eax + 4]
or eax, edx
and eax, 0xffff
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
call fcn.0053dcc1
mov eax, dword [0x583b78]
xor al, 1
cmp eax, 0
je 0x53e03c
call fcn.00525d97
push 0
call fcn.0053da67
push dword [0x583a28]
call fcn.005287ff
push 0x1b
push dword [0x5827a8]
call fcn.0044fe05
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x583a38]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [0x583a38]
mov eax, dword [eax + 0xc]
cmp eax, 0x55f0
setge al
xor ah, ah
cwde
mov dword [0x583b6c], eax
push 0x1c
push dword [0x5827a8]
call fcn.0044fe05
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x583a38]
mov al, byte [eax + 0x11a]
and eax, 0xff
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
call fcn.0053ddaa
mov eax, dword [0x583b70]
cmp eax, 0
je 0x53e116
push 0x5867b4
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x53e116
push 0x84
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x583bcc], eax
call fcn.0053e12d
mov dword [0x583bc8], eax
push 0x53dea1
call fcn.004a153c
push dword [0x5839d8]
call fcn.00525c4a
leave
ret
Function at 0x53e709
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
push dword [ebp + 8]
call fcn.0053cb8d
mov dword [ebp - 0x14], eax
mov eax, 0
mov edx, dword [ebp - 0x14]
cmp eax, edx
jne 0x53e72f
jmp 0x53e81c
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e74b
push 0
push dword [ebp + 0xc]
push 0xe
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e75e
push 0
push dword [ebp + 0xc]
push 0x149
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0
jl 0x53e81c
push dword [ebp + 8]
call fcn.00456241
add eax, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53e79d
push 2
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.00447c38
mov eax, dword [ebp - 0x18]
cmp eax, 0
jne 0x53e7b4
push dword [ebp - 0xc]
call fcn.004460b6
jmp 0x53e81c
mov eax, dword [ebp - 0x18]
inc eax
shl eax, 2
push eax
push dword [ebp - 0xc]
call fcn.00433262
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e7e6
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 0xd
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e7fa
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push 0x148
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0
call fcn.0043299b
push dword [0x583260]
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0043951e
leave
ret 8
Function at 0x53e820
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e849
push 0
push dword [ebp + 0xc]
push 0xe
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e85f
push 0
push dword [ebp + 0xc]
push 0x149
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0
jl 0x53e946
push 3
push dword [ebp + 8]
call fcn.0053ca2d
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53e89b
push 2
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00447c38
mov eax, dword [ebp - 0xc]
cmp eax, 0
jne 0x53e8b2
push dword [ebp - 0x10]
call fcn.004460b6
jmp 0x53e946
mov eax, dword [ebp - 0xc]
inc eax
shl eax, 2
push eax
push dword [ebp - 0x10]
call fcn.00433262
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e8e7
push dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
inc eax
push eax
push 0xd
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e8fe
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push 0x148
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0
call fcn.0043299b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.00528be5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x20
jne 0x53e93f
push dword [0x583260]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0043951e
push 1
call fcn.0048af6e
leave
ret 8

Function at 0x53f0c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [0x583a34]
cmp eax, 0
je 0x53f0df
call dword [sym.imp.USER32.DLL_ReleaseCapture]
call fcn.0053c292
push 0xa
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_UpdateWindow]
mov eax, dword [0x583b74]
xor al, 1
cmp eax, 0
je 0x53f116
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052ff81
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
push dword [ebp + 8]
call fcn.0053e565
leave
ret 4
Function at 0x5410b5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f50]
cmp eax, edx
jne 0x5410f2
mov eax, dword [0x583b68]
sub eax, 0xc
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov edx, eax
mov eax, 2
and eax, edx
cmp eax, 0
je 0x5410f2
jmp 0x5410f6
xor eax, eax
jmp 0x5410f9
xor eax, eax
inc eax
cmp eax, 0
je 0x54111d
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x541117
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0053d5d8
jmp 0x54111d
call dword [sym.imp.USER32.DLL_DestroyCaret]
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x541142
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f50]
cmp eax, edx
jne 0x54113b
mov eax, 8
jmp 0x541140
mov eax, 5
jmp 0x541147
mov eax, 0
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x583b74]
xor al, 1
cmp eax, 0
je 0x541174
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052ff81
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f7c]
cmp eax, edx
jne 0x5411a4
mov eax, dword [0x583b68]
sub eax, 4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov dword [ebp + 8], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f6c]
cmp eax, edx
jne 0x5411bb
push 9
push dword [ebp + 8]
call fcn.00532243
leave
ret 0x10
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d7a
nop
nop
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x381241
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x8142f80
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219