joyce8/EMBER2024-capa huggingface dataset:
Function at 0x520fd4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x521181
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x521162
mov dl, 1
mov eax, dword [0x4228f8]
call fcn.00428458
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
call fcn.00406610
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x521151
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0053aebc
test al, al
je 0x521144
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x521190
lea eax, [ebp - 0x394]
call fcn.0040ef0c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x521144
xor eax, eax
push ebp
push 0x52113d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x521200
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x521126
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.004067f8
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x521126
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.004067f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x521144
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x521047
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.00428244
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x521188
lea eax, [ebp - 0x3a0]
call fcn.00406600
ret

Function at 0x521c94
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5570e0]
cmp byte [eax + 0xa9], 0
jne 0x521d06
cmp dword [0x5570f8], 0
jne 0x521cc6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x54f9a0]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5570f8], eax
cmp dword [0x5570f4], 0
jne 0x521ce1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5570f4], eax
cmp dword [0x5570fc], 0
jne 0x521d06
push esp
push 0
push 0
mov eax, dword [0x54f99c]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5570fc], eax
pop edx
ret
Function at 0x521f1c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x521f33
add esp, 0xfffffff0
call fcn.00404698
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00430220
mov eax, dword [0x54fd34]
cmp byte [eax], 0
jne 0x521f60
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x55010c]
cmp word [eax + 2], 0
jne 0x521f7a
mov eax, dword [0x55010c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00524018
mov eax, dword [0x55026c]
cmp word [eax + 2], 0
jne 0x521f94
mov eax, dword [0x55026c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00524228
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x432370]
call fcn.00433df0
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x524734
mov dl, 1
mov eax, dword [0x422214]
call fcn.0040419c
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x422214]
call fcn.0040419c
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x432bc8]
call fcn.0043a2b0
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x522170
mov eax, dword [0x54ff48]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0043a6f0
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5249e4
mov dl, 1
mov eax, dword [0x422214]
call fcn.0040419c
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x54ff48]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040ed44
test eax, eax
je 0x5220a2
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040ead4
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040ed2c
test eax, eax
je 0x5220ba
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004067f8
push ebx
push 0x5239e8
call fcn.00517f28
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x54fd34]
cmp byte [eax], 0
jne 0x52210b
mov eax, ebx
call fcn.005222e4
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.00524c0c
mov eax, ebx
call fcn.00525824
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x522168
call fcn.004046f0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5225b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x52265a
cmp dword [ebx + 0x90], 0
jne 0x522654
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x522504
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x522654
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x52261a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x522654
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.00424df0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x522629
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x522878
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5570e0]
cmp dword [eax + 0x170], 0
je 0x5229dd
test bl, bl
jne 0x52292b
cmp dword [esi + 0x98], 0
jne 0x522920
mov eax, esi
call fcn.00525674
push eax
push 0x522784
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x5228f1
mov eax, dword [0x5570e0]
cmp byte [eax + 0xcf], 0
je 0x5228f1
mov eax, dword [esi + 0xd4]
call fcn.0040801c
mov edi, eax
cmp edi, 0
jl 0x5228f1
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5228da
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x522920
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00424df0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x522900
inc dword [esi + 0x98]
jmp 0x5229dd
cmp dword [esi + 0x98], 0
jle 0x5229dd
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x5229dd
cmp dword [esi + 0x40], 0
je 0x522988
mov eax, dword [0x5570e0]
cmp byte [eax + 0xcf], 0
je 0x522988
mov eax, dword [esi + 0xd4]
call fcn.0040801c
mov edi, eax
cmp edi, 0
jl 0x522988
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x522971
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5229b7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00424df0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x522997
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x517930]
call fcn.004081dc
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x523690
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x5236fb
cmp byte [ebx + 0xcf], 0
jne 0x5236fb
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040674c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x5236e8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x523708
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00406610
jmp 0x523708
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00406610
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x524de0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x524e4e
mov eax, esi
call fcn.005357c8
test al, al
je 0x524e4e
mov eax, dword [ebx + 0x80]
call fcn.0053541c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x524e4e
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x524e42
push 0
mov eax, dword [ebx + 0x80]
call fcn.0053541c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.0052c928
jmp 0x524e4e
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.00524c2c
pop esi
pop ebx
ret
Function at 0x52a0bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x557158], 0
je 0x52a1fd
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x550238]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x52a1fd
mov eax, dword [0x55715c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x557158]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x52a1cc
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x557158]
call fcn.00424df0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x52a1c4
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x52a1c4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x52a1c4
mov eax, dword [ebp - 0x14]
call fcn.0053541c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x52a1c4
push ebp
call fcn.0052a078
pop ecx
test al, al
jne 0x52a1c4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00404414
test al, al
je 0x52a1c4
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00404414
cmp byte [ebp - 1], 0
je 0x52a1c4
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040939c
test al, al
je 0x52a1c4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x55715c]
call fcn.005297f0
inc edi
dec ebx
jne 0x52a121
mov eax, dword [0x55715c]
cmp dword [eax + 8], 0
jle 0x52a1e4
mov eax, dword [0x55715c]
call fcn.005298a8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x52a1fd
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00529edc
pop ecx
test al, al
jne 0x52a1fd
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x532060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00409384
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0052c538
test ebx, ebx
jne 0x5320b3
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00531ef4
mov ebx, eax
test ebx, ebx
je 0x53219e
cmp esi, ebx
je 0x5320dc
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x5320f1
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x532129
add eax, 0xffffff5f
sub eax, 2
jb 0x532141
dec eax
sub eax, 2
jb 0x532155
dec eax
sub eax, 2
jb 0x53214b
jmp 0x53215f
add eax, 0xfffffdff
sub eax, 2
jb 0x532141
dec eax
sub eax, 2
jb 0x532155
dec eax
sub eax, 2
jb 0x53214b
jmp 0x53215f
mov byte [esp + 0x120], 0
jmp 0x532167
mov byte [esp + 0x120], 2
jmp 0x532167
mov byte [esp + 0x120], 1
jmp 0x532167
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00517fdc
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0052ddbc
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x5321a0
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x5421d8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406610
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x54221f
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004067f8
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x5479b4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x547aed
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x431914]
call fcn.00431a50
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x547ac3
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00431af0
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.004067f8
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x547b08
call fcn.00406acc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00431b54
test al, al
je 0x547aad
lea ecx, [ebp - 4]
mov edx, 0x547b7c
mov eax, dword [ebp - 0xc]
call fcn.00431da0
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00414ebc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x547aa6
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x547b94
mov eax, dword [ebp - 8]
push eax
call fcn.00409820
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x54fcec]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547aad
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547aca
mov eax, dword [ebp - 0xc]
call fcn.004041cc
ret

Function at 0x547bf8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x547c3f
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x547c22
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x547c33
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x547c3f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x549a54
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x549b97
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x549bb0
mov edx, ebx
call fcn.00406acc
mov eax, dword [ebp - 0x25c]
call fcn.0040669c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x549b71
xor eax, eax
push ebp
push 0x549b6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x549bcc
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0040ecc0
test eax, eax
jne 0x549b3b
test byte [ebp - 0x258], 0x10
jne 0x549b3b
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.004067f8
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406acc
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x549b2d
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.0040669c
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.0040669c
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x549ac5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549b71
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549b9e
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00406608
lea eax, [ebp - 4]
call fcn.00406600
ret
Function at 0x549bd8
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x549cd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00406610
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00479060
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x549cf4
call fcn.0040ef94
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406acc
mov eax, dword [ebp - 8]
call fcn.0040669c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x549c78
test esi, 0x10
jne 0x549ca8
test esi, 1
je 0x549c78
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.0040669c
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.0040669c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040669c
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x549ca2
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406610
jmp 0x549cb5
inc edi
cmp edi, 0xa
je 0x549cb5
inc ebx
cmp ebx, 0x3e8
jne 0x549c19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549cdf
lea eax, [ebp - 0x14]
call fcn.00406600
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406608
ret
Function at 0x401aa0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402a10
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402a10
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x50608c]
test esi, esi
jle 0x401c20
mov eax, dword [0x506090]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401b34
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401bb7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401b20
mov dword [esp], ebx
call fcn.004024f0
mov edi, eax
test eax, eax
je 0x401c47
mov eax, dword [0x506090]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402630
mov edx, dword [0x506090]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c27
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401bb0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401bc0
add dword [0x50608c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x506090]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401bb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401aa0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401b3e
mov eax, dword [0x506090]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401aa0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401aa0
lea esi, [esi]
nop
Function at 0x402160
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5060a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5060a0]
sub esp, 4
test ebx, ebx
je 0x4021b5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4021ae
test esi, esi
je 0x4021ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402190
mov dword [esp], 0x5060a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4024f0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402515
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402520
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402515
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402568
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40255e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40256a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402550
xor eax, eax
pop ebx
pop esi
ret