joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49dc66
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xe4
push 8
call fcn.0048aec1
push eax
call fcn.00457d20
mov dword [ebp - 0xc], eax
call fcn.0048aec1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax]
add eax, 0x14
mov dword [ebp - 0x10], eax
mov eax, 0x9c
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax + 0x14], edx
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xb4]
mov al, byte [eax + 0x9a]
cmp al, 1
setne al
xor ah, ah
cwde
mov dword [ebp - 0xec], eax
push 0
push dword [ebp - 0x18]
push 8
push str.Windows
call fcn.00447b37
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 4]
cmp eax, 5
je 0x49ddb1
cmp eax, 6
je 0x49de0c
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49dd7e
mov eax, dword [ebp - 0xe8]
cmp eax, 0x4f3d
jl 0x49dd4e
mov eax, str.Server_2022
jmp 0x49dd7c
mov eax, dword [ebp - 0xe8]
cmp eax, 0x42ee
jl 0x49dd62
mov eax, str.Server_2019
jmp 0x49dd7c
xor eax, eax
inc eax
je 0x49dd6e
mov eax, str.Server_2016
jmp 0x49dd7c
call fcn.0049dd73
mov eax, dword [ebp - 0xe8]
cmp eax, 0x55f0
jl 0x49dd92
mov eax, 0x585ae4
jmp 0x49ddac
xor eax, eax
inc eax
je 0x49dd9e
mov eax, 0x585ae7
jmp 0x49ddac
call fcn.0049dda3
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49dde0
cmp eax, 1
je 0x49dde7
cmp eax, 2
je 0x49ddee
call fcn.0049ddd7
mov eax, 0x585a5e
jmp 0x49de07
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49de02
mov eax, str.Server_2003_R2
jmp 0x49de07
mov eax, str.Server_2003
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49de42
cmp eax, 1
je 0x49de5d
cmp eax, 2
je 0x49de78
cmp eax, 3
je 0x49de93
call fcn.0049de39
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49de71
mov eax, str.Server_2008_R1
jmp 0x49de76
mov eax, 0x585a9d
jmp 0x49deac
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49de8c
mov eax, str.Server_2012
jmp 0x49de91
mov eax, 0x585aab
jmp 0x49deac
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49dea7
mov eax, str.Server_2012_R2
jmp 0x49deac
mov eax, 0x585abc
Function at 0x49e25b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, 0x1000
mov dword [ebp - 0x18], 0x1000
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x20]
add eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x49e2ff
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x49e2ff
mov eax, 2
push edx
mov edx, dword [ebp - 0x18]
imul edx
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.MSVCRT.DLL_realloc]
add esp, 8
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x49e27d
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
leave
ret 8
Function at 0x523c45
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x524c92
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x524cc0
cmp eax, 5
je 0x524cf7
mov dword [ebp - 0x20], 0
jmp 0x524dac
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
jmp 0x524dac
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.0044134c
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.00441382
mov dword [ebp - 0x14], eax
jmp 0x524d82
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
je 0x524d3b
mov eax, dword [ebp - 0x1c]
cmp eax, 0x11
je 0x524d3b
xor eax, eax
jmp 0x524d3e
xor eax, eax
inc eax
cmp eax, 0
je 0x524d77
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
xor al, 1
cmp eax, 0
je 0x524d9a
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
jae 0x524d9a
jmp 0x524d9e
xor eax, eax
jmp 0x524da1
xor eax, eax
inc eax
cmp eax, 0
jne 0x524d16
mov eax, dword [0x577ec4]
mov dword [ebp - 0x18], eax
mov eax, 4
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
leave
ret 8

Function at 0x52570c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
je 0x52573a
cmp eax, 0xf
je 0x525768
mov eax, 0
jmp 0x5259af
push dword [ebp + 8]
call fcn.0044134c
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.00441278
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x525766
mov eax, 0
jmp 0x5259af
jmp 0x52577a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x5259ac
Function at 0x5299e8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
and eax, 0x1000000
cmp eax, 0
setne al
xor ah, ah
cwde
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
je 0x529a40
cmp eax, 0x11
je 0x529a50
cmp eax, 0x12
je 0x529a6b
mov eax, 0
jmp 0x529a84
push 3
push dword [ebp - 0xc]
call dword [sym.imp.USER32.DLL_MapVirtualKeyW]
mov dword [ebp - 0x10], eax
jmp 0x529a84
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x529a61
mov eax, 0xa3
jmp 0x529a66
mov eax, 0xa2
mov dword [ebp - 0x10], eax
jmp 0x529a84
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x529a7c
mov eax, 0xa5
jmp 0x529a81
mov eax, 0xa4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x529a8b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, 0
mov dword [ebp - 0xc], 0
push 0x11
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529ac1
mov eax, 0x10000000
mov dword [ebp - 0xc], 0x10000000
push 0x10
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529ae0
mov eax, dword [ebp - 0xc]
or eax, 0x20000000
mov dword [ebp - 0xc], eax
push 0x12
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529aff
mov eax, dword [ebp - 0xc]
or eax, 0x40000000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
xor al, 1
cmp eax, 0
je 0x529b87
push 1
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529b2a
mov eax, dword [ebp - 0xc]
or eax, 0x2000000
mov dword [ebp - 0xc], eax
push 2
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529b49
mov eax, dword [ebp - 0xc]
or eax, 0x800000
mov dword [ebp - 0xc], eax
push 4
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529b68
mov eax, dword [ebp - 0xc]
or eax, 0x1000000
mov dword [ebp - 0xc], eax
push 5
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529b87
mov eax, dword [ebp - 0xc]
or eax, 0x400000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x532037
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x583b44]
xor al, 1
cmp eax, 0
je 0x53207f
mov eax, dword [ebp + 0xc]
cmp eax, 5
jne 0x53206e
mov eax, 8
mov dword [ebp + 0xc], 8
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052fe33
leave
ret 8
Function at 0x539cd2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xd0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x25
jne 0x539d18
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0xc]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0xc]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x10]
jmp 0x539d3f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
fld dword [eax + 4]
fstp dword [ebp - 0xc]
mov eax, dword [ebp - 0xd4]
fld dword [eax + 8]
fstp dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x1c]
mov eax, 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push 0x3f800000
fld dword [esp]
add esp, 4
fstp dword [ebp - 0x30]
jmp 0x539e9d
Function at 0x53dd3d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [0x5839ec], eax
push 0
call dword [sym.imp.USER32.DLL_GetDC]
mov dword [0x5839f4], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [0x5839f8], eax
mov eax, 0x11c
xchg edx, eax
mov eax, dword [0x583a08]
mov dword [eax], edx
push dword [0x583a08]
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov eax, dword [0x583a08]
mov eax, dword [eax + 4]
cmp eax, 5
jne 0x53ddab
mov eax, dword [0x583a08]
mov eax, dword [eax + 8]
cmp eax, 1
jge 0x53ddab
jmp 0x53ddaf
xor eax, eax
jmp 0x53ddb2
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x53ddc0
call fcn.0053daf6
call fcn.0053ea5d
mov dword [0x583b4c], eax
mov eax, dword [0x583a08]
mov eax, dword [eax + 4]
cmp eax, 0xa
setge al
xor ah, ah
cwde
mov dword [0x583b40], eax
mov eax, dword [0x583a08]
mov eax, dword [eax + 4]
cmp eax, 0xa
jge 0x53de2f
mov eax, dword [0x583a08]
mov eax, dword [eax + 4]
cmp eax, 6
jl 0x53de1d
mov eax, dword [0x583a08]
mov eax, dword [eax + 8]
cmp eax, 2
jl 0x53de1d
jmp 0x53de21
xor eax, eax
jmp 0x53de24
xor eax, eax
inc eax
cmp eax, 0
jne 0x53de2f
xor eax, eax
jmp 0x53de32
xor eax, eax
inc eax
mov dword [0x583b44], eax
mov eax, dword [0x583a08]
mov eax, dword [eax + 4]
cmp eax, 6
setl al
xor ah, ah
cwde
mov dword [0x583b48], eax
push 0x1a
push dword [0x582778]
call fcn.0044fe05
mov dword [ebp - 0xc], eax
mov eax, 3
shl eax, 0x13
mov edx, eax
mov eax, 0x27
or eax, edx
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [0x583a08]
mov eax, dword [eax + 8]
shl eax, 8
xchg edx, eax
mov eax, dword [0x583a08]
mov eax, dword [eax + 4]
or eax, edx
and eax, 0xffff
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
call fcn.0053db43
mov eax, dword [0x583b48]
xor al, 1
cmp eax, 0
je 0x53debe
call fcn.00525c49
push 0
call fcn.0053d8e9
push dword [0x5839f8]
call fcn.005286b1
push 0x1b
push dword [0x582778]
call fcn.0044fe05
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x583a08]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [0x583a08]
mov eax, dword [eax + 0xc]
cmp eax, 0x55f0
setge al
xor ah, ah
cwde
mov dword [0x583b3c], eax
push 0x1c
push dword [0x582778]
call fcn.0044fe05
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x583a08]
mov al, byte [eax + 0x11a]
and eax, 0xff
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
call fcn.0053dc2c
mov eax, dword [0x583b40]
cmp eax, 0
je 0x53df98
push 0x586784
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x53df98
push 0x84
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x583b9c], eax
call fcn.0053dfaf
mov dword [0x583b98], eax
push 0x53dd23
call fcn.004a151b
push dword [0x5839a8]
call fcn.00525afc
leave
ret
Function at 0x53e58b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
push dword [ebp + 8]
call fcn.0053ca0f
mov dword [ebp - 0x14], eax
mov eax, 0
mov edx, dword [ebp - 0x14]
cmp eax, edx
jne 0x53e5b1
jmp 0x53e69e
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e5cd
push 0
push dword [ebp + 0xc]
push 0xe
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e5e0
push 0
push dword [ebp + 0xc]
push 0x149
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0
jl 0x53e69e
push dword [ebp + 8]
call fcn.00456229
add eax, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53e61f
push 2
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.00447c38
mov eax, dword [ebp - 0x18]
cmp eax, 0
jne 0x53e636
push dword [ebp - 0xc]
call fcn.004460b6
jmp 0x53e69e
mov eax, dword [ebp - 0x18]
inc eax
shl eax, 2
push eax
push dword [ebp - 0xc]
call fcn.00433262
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e668
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 0xd
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e67c
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push 0x148
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0
call fcn.0043299b
push dword [0x583230]
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0043951e
leave
ret 8
Function at 0x53e6a2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e6cb
push 0
push dword [ebp + 0xc]
push 0xe
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e6e1
push 0
push dword [ebp + 0xc]
push 0x149
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0
jl 0x53e7c8
push 3
push dword [ebp + 8]
call fcn.0053c8af
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53e71d
push 2
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00447c38
mov eax, dword [ebp - 0xc]
cmp eax, 0
jne 0x53e734
push dword [ebp - 0x10]
call fcn.004460b6
jmp 0x53e7c8
mov eax, dword [ebp - 0xc]
inc eax
shl eax, 2
push eax
push dword [ebp - 0x10]
call fcn.00433262
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e769
push dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
inc eax
push eax
push 0xd
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e780
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push 0x148
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0
call fcn.0043299b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.00528a97
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x20
jne 0x53e7c1
push dword [0x583230]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0043951e
push 1
call fcn.0048af4d
leave
ret 8

Function at 0x53ef45
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [0x583a04]
cmp eax, 0
je 0x53ef61
call dword [sym.imp.USER32.DLL_ReleaseCapture]
call fcn.0053c114
push 0xa
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_UpdateWindow]
mov eax, dword [0x583b44]
xor al, 1
cmp eax, 0
je 0x53ef98
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052fe33
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
push dword [ebp + 8]
call fcn.0053e3e7
leave
ret 4
Function at 0x540f37
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f20]
cmp eax, edx
jne 0x540f74
mov eax, dword [0x583b38]
sub eax, 0xc
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov edx, eax
mov eax, 2
and eax, edx
cmp eax, 0
je 0x540f74
jmp 0x540f78
xor eax, eax
jmp 0x540f7b
xor eax, eax
inc eax
cmp eax, 0
je 0x540f9f
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x540f99
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0053d45a
jmp 0x540f9f
call dword [sym.imp.USER32.DLL_DestroyCaret]
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x540fc4
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f20]
cmp eax, edx
jne 0x540fbd
mov eax, 8
jmp 0x540fc2
mov eax, 5
jmp 0x540fc9
mov eax, 0
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x583b44]
xor al, 1
cmp eax, 0
je 0x540ff6
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052fe33
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f4c]
cmp eax, edx
jne 0x541026
mov eax, dword [0x583b38]
sub eax, 4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov dword [ebp + 8], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f3c]
cmp eax, edx
jne 0x54103d
push 9
push dword [ebp + 8]
call fcn.005320f5
leave
ret 0x10
Function at 0x403185
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x403211
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4031fc
cmp dword [ebp + 0x10], ebx
jne 0x4031ee
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00403185
test eax, eax
jne 0x4031fc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
jmp 0x4031c1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x403211
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x405b25
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x7c0510], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405b49
test al, 0x10
jne 0x405b4c
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x7c0510
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405b77
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x405ef2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7bdd10
push esi
call fcn.0040630d
push esi
call fcn.00405ea3
mov edi, eax
test edi, edi
jne 0x405f13
xor eax, eax
jmp 0x405f65
push edi
call fcn.00406581
test byte [0x7d1350], 0x80
je 0x405f2c
mov al, byte [edi]
test al, al
je 0x405f0f
cmp al, 0x5c
je 0x405f0f
sub edi, esi
push esi
call fcn.00406323
cmp eax, edi
push esi
jle 0x405f4f
call fcn.004067b5
test eax, eax
je 0x405f47
test byte [eax], 0x10
je 0x405f0f
push esi
call fcn.00405e57
jmp 0x405f2e
call fcn.00405e10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405fdc
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x40600b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x406050
mov eax, edi
dec edi
test eax, eax
jne 0x406016
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40604a