joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bcae0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push edi
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x4bcb7d
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x4bcb00
cmp dword [esi + 0x4c], edi
je 0x4bcb2c
mov edx, dword [esi + 0x30]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 8]
push ecx
push edx
mov dword [esi + 0x4c], edi
call ebx
test eax, eax
jne 0x4bcb6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
jmp 0x4bcbf9
mov edx, dword [esi + 0x3c]
lea eax, [esi + 8]
push eax
mov eax, dword [esi + 0x40]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x30]
push edx
push eax
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call ebp
test eax, eax
je 0x4bcbee
mov edx, dword [esp + 0xc]
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x3c]
sub ecx, dword [esi + 0x44]
push edx
push eax
push ecx
push str.read_total:_p__remaining:__u__numread:__u_n
call fcn.0048f0a0
add esp, 0x10
mov eax, dword [esp + 0xc]
add dword [esi + 0x40], eax
sub dword [esi + 0x3c], eax
cmp dword [esi + 0x3c], edi
jne 0x4bcb00
cmp dword [esi + 0x48], edi
je 0x4bcbb2
mov eax, esi
call fcn.004bbdd0
mov eax, dword [esi + 0x44]
cmp eax, edi
je 0x4bcb96
push eax
call fcn.004a4850
push 4
call fcn.004a47f0
mov dword [esi + 0x48], edi
pop edi
pop ebp
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], 4
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x44]
mov edi, dword [eax]
lea edx, [edi - 8]
cmp edx, 0x7ffff8
ja 0x4bcc07
push eax
call fcn.004a4850
push edi
call fcn.004a47f0
mov dword [esi + 0x44], eax
mov dword [eax], edi
mov eax, dword [esi + 0x44]
add eax, 4
add edi, 0xfffffffc
mov dword [esi + 0x3c], edi
pop edi
pop ebp
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], 1
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4bcc07
pop edi
pop ebp
mov dword [esi + 0x4c], 1
pop ebx
pop ecx
ret
pop edi
pop ebp
mov dword [esi + 0x38], 1
pop ebx
pop ecx
ret
Function at 0x4cb270
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x218
mov eax, dword [0x597f98]
xor eax, esp
mov dword [esp + 0x214], eax
cmp byte [0x599180], 0
push ebx
push esi
mov esi, dword [esp + 0x224]
push edi
jne 0x4cb360
cmp dword [0x599184], 5
jae 0x4cb360
lea eax, [esp + 0xc]
push eax
call fcn.00401210
mov edi, dword [esp + 0x22c]
push edi
push esi
xor ebx, ebx
call fcn.004c4570
mov dword [esp + 0xc], eax
add eax, 1
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.00527550
mov ebx, dword [esp + 0x14]
push edi
push esi
call fcn.004c4570
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push edx
push eax
call fcn.00401000
add eax, 1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4cb354
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push ecx
push edx
push eax
call fcn.00401120
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4cb34d
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
push ecx
call fcn.00401230
jmp 0x4cb3c8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0xc]
push ecx
call fcn.00401230
jmp 0x4cb3c8
push ebp
mov ebp, dword [esp + 0x230]
push ebp
push esi
xor ebx, ebx
call fcn.004c4570
lea edx, [eax + eax + 2]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4cb3c7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
push esi
mov ebx, eax
call fcn.004c4570
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4cb3c0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4cb3c7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
mov ecx, dword [esi + 0x180]
push ecx
call fcn.004b84f0
push esi
call fcn.004cae40
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005498cd
add esp, 0x218
ret 8

Function at 0x4cb750
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push str.ui_close_n
call fcn.0048f0a0
mov esi, dword [esp + 0x10]
add esp, 4
call fcn.004c7b90
mov eax, dword [esi + 0x60]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, esi
call fcn.004c4830
cmp dword [esi + 0x440], 0
jne 0x4cb7b8
cmp byte [0x598ef2], 0
je 0x4cb795
push esi
call fcn.0050fef0
jmp 0x4cb7b8
mov eax, esi
mov dword [esi + 0x440], 1
call fcn.004c3210
mov ecx, dword [0x5992f8]
mov dword [esi + 0x124], ecx
mov dword [0x5992f8], esi
cmp byte [0x58b61a], 0
pop esi
pop ebx
jne 0x4cb7d4
cmp dword [0x59930c], 0
jne 0x4cb7d4
call fcn.004c00c0
ret 4
call fcn.004b7320
mov dword [esp + 4], 0
jmp fcn.00409710
Function at 0x4cc4c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
cmp byte [0x58b690], 0
je 0x4cc5f3
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00510c80
test eax, eax
je 0x4cc5e3
mov eax, dword [esi + 0x180]
push eax
call fcn.004b84f0
push esi
call fcn.004cae40
mov ecx, dword [esi + 0x2d4]
push ecx
push str.CUT_isviewing__d_n
push 0xffffffffffffffff
call fcn.0048f0c0
add esp, 0xc
cmp dword [esi + 0x2d4], 0
je 0x4cc52c
mov edx, dword [esi + 0x2d8]
mov eax, dword [esi + 0x60]
push edx
push eax
call dword [sym.imp.USER32.dll_ChangeClipboardChain]
mov dword [esi + 0x2d4], 0
mov ecx, dword [esi + 0x60]
push edi
push ecx
xor edi, edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4cc57a
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
call fcn.004c29d0
test eax, eax
je 0x4cc574
mov edi, dword [sym.imp.USER32.dll_SetClipboardData]
push eax
push 0xf
call edi
push 2
call fcn.004c2980
test eax, eax
je 0x4cc56f
push eax
call fcn.004c2fb0
movzx edx, ax
push edx
call edi
mov edi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
push edi
push str.iscut__d_n
push 0xffffffffffffffff
call fcn.0048f0c0
add esp, 0xc
test edi, edi
je 0x4cc5dc
push str.ghost_selection_n
push 0xffffffffffffffff
call fcn.0048f0c0
add esp, 8
push esi
call fcn.004f0950
mov eax, dword [esi + 0x2d4]
push eax
push str.viewing__d_n
push 0xffffffffffffffff
call fcn.0048f0c0
add esp, 0xc
cmp dword [esi + 0x2d4], 0
jne 0x4cc5dc
mov ecx, dword [esi + 0x60]
push ecx
call dword [sym.imp.USER32.dll_SetClipboardViewer]
mov dword [esi + 0x2d8], eax
mov dword [esi + 0x2d4], 1
mov dword [esi + 0x2d0], edi
pop edi
push str.is_cut_done_n
push 0xffffffffffffffff
call fcn.0048f0c0
add esp, 8
pop esi
ret 4
Function at 0x4d4860
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x114
mov eax, dword [0x597f98]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push edi
push esi
mov dword [esi + 4], 0xff
mov dword [esi + 0x10], 1
mov dword [esi], 0
mov dword [esi + 8], 0
push 0x4d4770
mov dword [esi + 0x6c], 0
call fcn.004b2210
mov dword [esi + 0x68], eax
lea eax, [esp + 8]
push eax
call fcn.00401210
mov eax, dword [0x58eecc]
mov ecx, dword [eax]
mov edx, dword [eax + 0x14]
push ecx
push edx
lea eax, [esp + 0x10]
push eax
call fcn.00524440
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x58]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push ecx
push 0x2711
push edx
call edi
push eax
call fcn.004aa300
lea eax, [esp + 8]
push eax
call fcn.00401230
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
push ecx
mov ecx, dword [esi + 0x28]
push edx
mov edx, dword [esi + 0x58]
push eax
push ecx
push 0x2711
push edx
call fcn.004aa3a0
mov eax, dword [esi + 0x58]
push 0
push 0x2712
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x58]
push 0
push 0x2713
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0x58]
push 0
push 0x2714
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0x58]
push 0
push 0x2715
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0x58]
push 0
push 0x2716
push ecx
call edi
push eax
call ebx
mov ecx, dword [esp + 0x118]
pop edi
pop ebx
xor ecx, esp
call fcn.005498cd
add esp, 0x114
ret
Function at 0x4f6be0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
push 2
push esi
call fcn.00510f80
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 0
mov ebp, 1
je 0x4f6c49
cmp dword [esi + 0x354], ebp
push esi
jne 0x4f6c24
call fcn.004ee200
mov edi, eax
imul edi, dword [esi + 0x35c]
jmp 0x4f6c2b
call fcn.004ee200
mov edi, eax
push edi
push esi
call fcn.004ee620
cmp ebx, edi
jl 0x4f6c3c
add eax, edi
cmp ebx, eax
jl 0x4f6c45
cmp byte [0x598e81], 0
je 0x4f6c49
mov dword [esp + 0x10], ebp
push esi
call fcn.004ee200
cmp dword [esi + 0x354], ebp
mov dword [esp + 0x14], eax
jne 0x4f6c67
mov eax, dword [esi + 0x35c]
mov dword [esp + 0x20], eax
jmp 0x4f6c6b
mov dword [esp + 0x20], ebp
xor edi, edi
push edi
push esi
call fcn.004f46c0
call dword [sym.imp.USER32.dll_GetCapture]
mov ecx, dword [esi + 0x60]
push eax
push ecx
call fcn.004ad0f0
test eax, eax
je 0x4f6c8e
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ebx, dword [esp + 0x24]
cmp ebx, dword [esi + 0x354]
mov ebp, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x4f6cf0
mov edx, dword [esi + 0x2e4]
push 0
push 0
push edx
mov dword [esi + 0x354], ebx
call ebp
test ebx, ebx
jne 0x4f6ccb
mov eax, dword [esi + 0x6c]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call fcn.004ee4e0
jmp 0x4f6cd7
mov ecx, dword [esi + 0x6c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call fcn.004f46c0
push esi
call fcn.004efab0
push esi
call fcn.004f60b0
mov edi, 1
cmp ebx, 1
jne 0x4f6d27
mov eax, dword [esp + 0x28]
cmp eax, dword [esi + 0x358]
je 0x4f6d21
mov dword [esi + 0x358], eax
call fcn.004f0a30
push esi
call fcn.004f60b0
mov edx, dword [esi + 0x2e4]
push 0
push 0
push edx
call ebp
mov edi, ebx
push esi
call fcn.004efab0
test edi, edi
je 0x4f6d78
cmp ebx, 1
jne 0x4f6d38
mov ecx, dword [esi + 0x35c]
jmp 0x4f6d3d
mov ecx, 1
mov eax, dword [esp + 0x20]
cmp ecx, eax
je 0x4f6d64
imul dword [esp + 0x14]
push 1
mov edi, eax
push 1
mov ebx, edx
mov eax, ecx
cdq
push edx
push eax
push ebx
push edi
call fcn.0054a480
push eax
push esi
call fcn.004f6840
cmp dword [esp + 0x10], 0
je 0x4f6d78
mov eax, dword [esp + 0x18]
push 0
push eax
push esi
call fcn.004f6a10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4fb7b0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x334
mov eax, dword [0x597f98]
xor eax, esp
mov dword [esp + 0x330], eax
push esi
lea eax, [esp + 0x114]
push eax
call fcn.00401210
lea ecx, [esp + 0x114]
push ecx
push 0x554ad8
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
xor esi, esi
call fcn.004ae630
test eax, eax
je 0x4fb8eb
lea edx, [esp + 4]
push edx
call fcn.00401210
lea eax, [esp + 0x224]
push eax
mov esi, 2
call fcn.00401210
push 0
lea ecx, [esp + 0x228]
push ecx
call fcn.004ad680
mov edx, dword [esp + 0x22c]
push edx
lea eax, [esp + 8]
push str.__s___startup
push eax
call fcn.00524440
add esp, 0xc
call fcn.004a3a60
test eax, eax
je 0x4fb85e
call fcn.004a3a60
push eax
lea ecx, [esp + 8]
push str.__instance___s_
push ecx
call fcn.005245e0
add esp, 0xc
mov eax, dword [0x599168]
cmp dword [eax + 0x10], 0
je 0x4fb87f
mov edx, dword [eax + 0x10]
push edx
lea eax, [esp + 8]
push str.__config___s_
push eax
call fcn.005245e0
add esp, 0xc
lea ecx, [esp + 0x224]
push ecx
call fcn.00401230
mov edx, dword [esp + 0x11c]
push edx
push str.reg:__s_n
call fcn.0048f0a0
mov eax, dword [esp + 0x14]
push eax
push str.set:__s_n
call fcn.0048f0a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x12c]
mov dl, byte [eax]
add esp, 0x10
cmp dl, byte [ecx]
jne 0x4fb8d2
test dl, dl
je 0x4fb8dc
mov dl, byte [eax + 1]
add eax, 1
add ecx, 1
cmp dl, byte [ecx]
je 0x4fb8c1
movzx ecx, byte [ecx]
movzx eax, byte [eax]
sub eax, ecx
jne 0x4fb8e1
mov esi, 1
lea edx, [esp + 4]
push edx
call fcn.00401230
lea eax, [esp + 0x114]
push eax
call fcn.00401230
mov ecx, dword [esp + 0x334]
mov eax, esi
pop esi
xor ecx, esp
call fcn.005498cd
add esp, 0x334
ret
Function at 0x502130
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x224
mov eax, dword [0x597f98]
xor eax, esp
mov dword [esp + 0x220], eax
push 0x554ad8
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call fcn.004b3ce0
push 0
push str.InstallRunOnStartup
call fcn.004fdf70
lea eax, [esp]
push eax
call fcn.00401210
lea ecx, [esp + 0x110]
push ecx
call fcn.00401210
push 0
lea edx, [esp + 0x114]
push edx
call fcn.004ad680
mov eax, dword [esp + 0x118]
push eax
lea ecx, [esp + 4]
push str.__s___startup
push ecx
call fcn.00524440
add esp, 0xc
call fcn.004a3a60
test eax, eax
je 0x5021c4
call fcn.004a3a60
push eax
lea edx, [esp + 4]
push str.__instance___s_
push edx
call fcn.005245e0
add esp, 0xc
mov eax, dword [0x599168]
cmp dword [eax + 0x10], 0
je 0x5021e5
mov eax, dword [eax + 0x10]
push eax
lea ecx, [esp + 4]
push str.__config___s_
push ecx
call fcn.005245e0
add esp, 0xc
lea edx, [esp + 0x110]
push edx
call fcn.00401230
mov eax, dword [esp + 8]
push eax
push 0x554ad8
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call fcn.004b3b40
push 1
push str.InstallRunOnStartup
call fcn.004fdf70
lea ecx, [esp]
push ecx
call fcn.00401230
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.005498cd
add esp, 0x224
ret
Function at 0x512e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, dword [esp + 0x60]
push edi
mov edi, eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x34], ebp
cmp byte [edi], 0
je 0x512f8f
mov al, byte [edi]
cmp al, 0x25
jne 0x512f51
mov al, byte [edi + 1]
add edi, 1
cmp al, 0x25
jne 0x512f0b
cmp byte [esi], al
jne 0x512f94
add esi, 1
add edi, 1
jmp 0x512f86
cmp al, 0x30
jb 0x512f48
cmp al, 0x39
ja 0x512f48
movzx ebx, al
sub ebx, 0x30
add edi, 1
mov dword [esp + ebx*4 + 0x38], esi
cmp byte [esi], 0
je 0x512f40
mov eax, dword [esp + 0x68]
push eax
lea ecx, [esi + ebp]
mov eax, edi
call fcn.005128b0
test eax, eax
jne 0x512f40
add ebp, 1
cmp byte [esi + ebp], al
jne 0x512f25
mov dword [esp + ebx*4 + 0x10], ebp
add esi, ebp
jmp 0x512f84
test al, al
je 0x512f8f
add edi, 1
jmp 0x512f86
cmp dword [esp + 0x68], ebp
je 0x512f63
cmp byte [esi], al
jne 0x512f94
add esi, 1
add edi, 1
jmp 0x512f86
push esi
call fcn.00522810
push edi
mov ebx, eax
call fcn.00522810
mov ebp, eax
push ebp
push edi
push ebx
push esi
call fcn.00414450
test eax, eax
jne 0x512f94
add esi, ebx
add edi, ebp
xor ebp, ebp
cmp byte [edi], 0
jne 0x512ee8
cmp byte [esi], 0
je 0x512fad
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x70]
push ecx
push edx
call fcn.00523f80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
mov eax, dword [esp + 0x6c]
push ebp
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
call fcn.00512960
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
Function at 0x519820
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push edi
mov edi, dword [esp + 0x2c]
push 0
push edi
call fcn.00516eb0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x519847
push eax
call fcn.004b7d10
mov dword [edi + 0x28], 0
jmp 0x519865
mov eax, dword [0x58b714]
mov ecx, dword [0x58b71c]
push eax
push ecx
push 0x551656
call fcn.004b74b0
mov dword [edi + 0x28], 1
test eax, eax
mov dword [edi + 0x14], eax
je 0x519a79
mov edx, dword [esp + 0x34]
push ebp
or eax, 0xffffffff
push esi
mov esi, dword [0x598de4]
mov dword [edi + 8], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov eax, dword [esp + 0x40]
push 0x7f00
push 0
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call esi
push eax
push 0
push 0
push 0x516d30
push str.EVERYTHING_DROPDOWNLIST_BORDER
push 0
call fcn.004aa4c0
push 0x7f00
push 0
call esi
push eax
push 0
push 0
push 0x518550
push str.EVERYTHING_DROPDOWNLIST
push 0
call fcn.004aa4c0
mov ecx, dword [0x599190]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x86000000
push 0x551656
push str.EVERYTHING_DROPDOWNLIST_BORDER
push 0x88
call fcn.004aa610
mov cl, byte [edi + 0x184]
push 0
mov dword [edi + 0xc], eax
mov edx, dword [0x599190]
mov eax, dword [edi + 0x60]
push edx
push 0
push eax
push 0
push 0
neg cl
push 0
push 0
push 0x86200000
push 0x551656
push str.EVERYTHING_DROPDOWNLIST
sbb ecx, ecx
and ecx, 0x400000
or ecx, 0x88
push ecx
call fcn.004aa610
push edi
push eax
mov dword [edi + 0x10], eax
call fcn.004ac9d0
mov eax, edi
call fcn.00517e00
cmp dword [edi + 0x18], 0
je 0x51996d
push edi
call fcn.004c5600
mov edx, dword [edi + 0xc]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 8
push edx
call esi
mov eax, dword [edi + 0x10]
push 8
push eax
call esi
mov ecx, dword [edi + 0x68]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [edi + 0x10]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [edi + 0x10], 0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [edi], edx
mov dword [edi + 4], eax
je 0x519a4d
mov ebp, dword [0x598df8]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call ebp
test eax, eax
je 0x519a3d
cmp dword [esp + 0x18], 0x12
je 0x519a6f
lea esi, [esp + 0x14]
call fcn.00516f60
test eax, eax
jne 0x519a54
cmp dword [esp + 0x18], 0x100
jne 0x519a00
cmp dword [esp + 0x1c], 9
je 0x519a5b
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
call dword [0x598dc8]
test eax, eax
jle 0x519a62
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.00518a30
test eax, eax
jne 0x519a43
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x14]
push edx
call dword [0x598da4]
jmp 0x519a43
call dword [sym.imp.USER32.dll_WaitMessage]
cmp dword [edi + 0x10], 0
jne 0x5199c4
push str.no_search_history_hwnd_n
jmp 0x519a67
push str.outside_click_n
jmp 0x519a67
push str.tab_out_n
jmp 0x519a67
push str.no_getmsg_n
call fcn.0048f0a0
add esp, 4
push 0
push edi
call fcn.00516eb0
pop esi
pop ebp
pop edi
add esp, 0x24
ret 0x10
Function at 0x520b8a
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x520bc5
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x520bac
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x520bbd
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x520bc7
inc edi
add eax, 0x28
cmp edi, esi
jb 0x520ba2
xor eax, eax
pop edi
pop esi
ret

Function at 0x520f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esi, eax
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00520b5a
push eax
push esi
push dword [ebp + 8]
call fcn.00520b0f
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00520b5a
push eax
push esi
push dword [ebp + 8]
call fcn.00520b0f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00520b4a
jnp 0x520fc6
invalid
mov dword [0x7c9d888f], eax
invalid

Function at 0x521fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ecx
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
Function at 0x525300
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push edi
push 1
push eax
xor edi, edi
call fcn.004a9cf0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5253ad
push esi
lea ecx, [esp + 0xc]
push ecx
push ebx
call fcn.004aba90
test eax, eax
je 0x5253a5
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, edx
or eax, ecx
je 0x525396
mov eax, edx
add eax, 1
adc ecx, edi
mov esi, eax
or esi, ecx
je 0x5253a5
test ecx, ecx
jg 0x5253a5
jl 0x525356
cmp eax, 0x80000000
jae 0x5253a5
mov esi, dword [esp + 0x18]
add edx, 1
push edx
push esi
call fcn.00523690
test eax, eax
je 0x5253a5
mov eax, dword [esp + 0xc]
mov edx, dword [esi + 8]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push edx
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5253a5
mov eax, dword [esi]
cmp dword [esp + 0x1c], eax
jne 0x5253a5
mov ecx, dword [esi + 8]
mov byte [eax + ecx], 0
jmp 0x5253a0
mov edx, dword [esp + 0x18]
push edx
call fcn.005240c0
mov edi, 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 8
ret 8

Function at 0x5297a0
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [eax + 0x34]
push ebx
push esi
xor esi, esi
cmp dword [eax + 0x38], esi
lea ebx, [esi + 1]
jle 0x5297da
push ebp
push edi
movzx edi, dl
mov ecx, dword [eax + 0x260]
mov ebp, ecx
shr ebp, 0x18
xor ebp, edi
shl ecx, 8
xor ecx, dword [ebp*4 + 0x597260]
add esi, ebx
mov dword [eax + 0x260], ecx
cmp esi, dword [eax + 0x38]
jl 0x5297b4
pop edi
pop ebp
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x529862
sub ecx, ebx
je 0x529847
sub ecx, ebx
je 0x52983b
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret