joyce8/EMBER2024-capa huggingface dataset:
Function at 0x596290
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x596332
cmp dword [ebx + 0xac], 0
jne 0x59632c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5961cc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x59632c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5962f2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x59632c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004ab9bc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x596301
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5965ec
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5fc0dc]
cmp dword [eax + 0x188], 0
je 0x596766
test bl, bl
jne 0x5966b1
cmp dword [esi + 0xb4], 0
jne 0x5966a6
mov eax, esi
call fcn.00599680
push eax
push 0x5964e0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x596677
mov eax, dword [0x5fc0dc]
cmp byte [eax + 0xeb], 0
je 0x596677
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x596658
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x596677
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x596660
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5966a6
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ab9bc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x596686
inc dword [esi + 0xb4]
jmp 0x596766
cmp dword [esi + 0xb4], 0
jle 0x596766
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x596766
cmp dword [esi + 0x58], 0
je 0x59671b
mov eax, dword [0x5fc0dc]
cmp byte [eax + 0xeb], 0
je 0x59671b
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5966fc
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x59671b
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x596704
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x59674a
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ab9bc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x59672a
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x587b48]
call fcn.0040c1e4
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x597404
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x597461
cmp byte [ebx + 0xeb], 0
jne 0x597461
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409ec4
mov eax, dword [esi]
test eax, eax
je 0x59744e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x59746e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a11c
jmp 0x59746e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a11c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x598da4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x598e15
mov eax, esi
call fcn.005c7284
test al, al
je 0x598e15
mov eax, dword [ebx + 0x98]
call fcn.005c6eb0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x598e15
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x598e06
push 0
mov eax, dword [ebx + 0x98]
call fcn.005c6eb0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.005bd874
jmp 0x598e15
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.00598bb0
pop esi
pop ebx
ret
Function at 0x59d78c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x59d80a
mov eax, dword [ebx + 8]
call fcn.005c6eb0
mov ecx, eax
mov dl, 1
mov eax, dword [0x513a94]
call fcn.005c0f34
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.00518750
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x59d05c
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005c6eb0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005c6eb0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x59d884
mov eax, dword [ebx + 8]
call fcn.005c6eb0
mov ecx, eax
mov dl, 1
mov eax, dword [0x513a94]
call fcn.005c0f34
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.00518750
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x59d0a8
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005c6eb0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005c6eb0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x59d8f2
mov eax, dword [ebx + 8]
call fcn.005c6eb0
mov ecx, eax
mov dl, 1
mov eax, dword [0x514530]
call fcn.005c0f34
mov dword [ebx + 0x94], eax
mov eax, dword [ebx + 0x94]
mov byte [eax + 0x2a0], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.005c6eb0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.005c6eb0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5a7340
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00409d3c
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5a7392
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5a738b
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040a8e8
jmp 0x5a7392
mov eax, esi
call fcn.00409d3c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5acdec
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5acf4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5f483c], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4e5680]
call fcn.004e67cc
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5acf21
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004e68b4
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a8e8
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5acf64
call fcn.0040aa98
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004e6b40
test al, al
je 0x5acf0b
lea ecx, [ebp - 4]
mov edx, 0x5acfd8
mov eax, dword [ebp - 0xc]
call fcn.004e73cc
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042bafc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5acf0b
xor edx, edx
push ebp
push 0x5acf04
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5acff0
mov eax, dword [ebp - 8]
push eax
call fcn.00414ce8
test eax, eax
je 0x5aceed
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5aceed
call fcn.005acd78
test eax, eax
je 0x5acedd
mov eax, dword [ebx + 0x50]
jmp 0x5acee0
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x5f483c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5acf0b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5acf28
mov eax, dword [ebp - 0xc]
call fcn.00407ed0
ret

Function at 0x5ad054
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5ad09b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5ad07e
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5ad08f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5ad09b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x5baca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x5fc180], 0
je 0x5bade1
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x5f4f0c]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x5bade1
mov eax, dword [0x5fc184]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5fc180]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x5badb0
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x5fc180]
call fcn.004ab9bc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x5bada8
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x215], 0
je 0x5bada8
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x74]
test al, al
je 0x5bada8
mov eax, dword [ebp - 0x14]
call fcn.005c6eb0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5bada8
push ebp
call fcn.005bac5c
pop ecx
test al, al
jne 0x5bada8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb8
call fcn.004082a8
test al, al
je 0x5bada8
mov byte [ebp - 9], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 9]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.004082a8
cmp byte [ebp - 9], 0
je 0x5bada8
lea edx, [ebp - 8]
lea eax, [ebp - 0x28]
call fcn.004127c4
test al, al
je 0x5bada8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5fc184]
call fcn.005ba3a4
inc edi
dec ebx
jne 0x5bad05
mov eax, dword [0x5fc184]
cmp dword [eax + 8], 0
jle 0x5badc8
mov eax, dword [0x5fc184]
call fcn.005ba458
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5bade1
push ebp
mov eax, dword [ebp - 0x18]
call fcn.005baac4
pop ecx
test al, al
jne 0x5bade1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c3704
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00412cac
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.005bd330
test ebx, ebx
jne 0x5c3757
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.005c357c
mov ebx, eax
test ebx, ebx
je 0x5c384d
cmp esi, ebx
je 0x5c3780
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x5c3795
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x5c37cd
add eax, 0xffffff5f
sub eax, 2
jb 0x5c37e5
dec eax
sub eax, 2
jb 0x5c37f9
dec eax
sub eax, 2
jb 0x5c37ef
jmp 0x5c3803
add eax, 0xfffffdff
sub eax, 2
jb 0x5c37e5
dec eax
sub eax, 2
jb 0x5c37f9
dec eax
sub eax, 2
jb 0x5c37ef
jmp 0x5c3803
mov byte [esp + 0x120], 0
jmp 0x5c380b
mov byte [esp + 0x120], 2
jmp 0x5c380b
mov byte [esp + 0x120], 1
jmp 0x5c380b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0058adbc
mov esi, eax
call fcn.005b9d50
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.005beec8
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x5c384f
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x5d384c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x5d3864
add esp, 0xfffffff0
call fcn.00408558
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x5d397e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00406e6c
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x5d3968
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.005807bc
xor eax, eax
push ebp
push 0x5d3955
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.005807bc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.0040a924
jmp 0x5d3926
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0040ac50
mov eax, dword [ebx + 4]
call fcn.0040a200
dec eax
jle 0x5d393a
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x5d3914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d395c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d3985
lea eax, [ebp - 4]
call fcn.00409d84
ret
Function at 0x5da600
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5da87e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0xc8], 0
jne 0x5da855
mov eax, dword [edi + 0x40]
test eax, eax
je 0x5da659
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5da679
mov eax, dword [edi + 0x44]
test eax, eax
je 0x5da669
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5da679
mov eax, edi
call fcn.005da934
jmp 0x5da855
cmp dword [edi + 0xcc], 0
jne 0x5da6c8
lea eax, [ebp - 0x108]
mov edx, dword [edi + 0x40]
mov ecx, 0
call fcn.0040a5c0
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00423c94
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5fc1c0]
call fcn.005da09c
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xcc], eax
cmp dword [edi + 0xd0], 0
jne 0x5da717
lea eax, [ebp - 0x10c]
mov edx, dword [edi + 0x44]
mov ecx, 0
call fcn.0040a5c0
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x101]
call fcn.00423c94
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5fc1c0]
call fcn.005da09c
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xd0], eax
mov ecx, dword [edi + 0xd0]
mov edx, dword [edi + 0xcc]
mov eax, edi
call fcn.005da974
mov ebx, eax
test bl, bl
jne 0x5da80a
mov eax, dword [edi + 0x40]
test eax, eax
je 0x5da740
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5da75a
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x5da753
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
jmp 0x5da75c
xor eax, eax
test al, al
jne 0x5da80a
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x5da773
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x5da7a0
lea eax, [ebp - 0x110]
mov edx, dword [edi + 0xc0]
mov ecx, 0
call fcn.0040a5c0
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x101]
call fcn.00423c94
jmp 0x5da7e2
push dword [edi + 0x40]
push 0x5da89c
push dword [edi + 0x44]
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.0040ab20
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0
call fcn.0040a5c0
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x101]
call fcn.00423c94
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x5da80a
mov ecx, dword [edi + 0xd0]
mov edx, dword [edi + 0xcc]
mov eax, edi
call fcn.005da974
mov ebx, eax
test bl, bl
jne 0x5da817
mov eax, edi
call fcn.005da934
jmp 0x5da855
mov eax, dword [edi + 0x64]
test eax, eax
je 0x5da826
mov dword [edi + 0xac], eax
jmp 0x5da830
mov dword [edi + 0xac], 1
mov eax, edi
call fcn.005da9f8
test al, al
je 0x5da855
mov eax, edi
mov si, 0xffee
call fcn.004082a8
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.005daee8
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5da885
lea eax, [ebp - 0x118]
call fcn.00409d3c
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00409dcc
ret
Function at 0x5de220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x5de228
xor eax, eax
push ebp
push 0x5de3d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.005de1fc
mov dl, 1
mov eax, dword [0x48cb90]
call fcn.004b0528
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x48cb90]
call fcn.004b0528
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
call fcn.004e501c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.0042a1f4
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x5de3ec
push 0x5de400
lea eax, [ebp - 8]
mov edx, 4
call fcn.0040ab20
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x48]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x5de410
push 0
push 0x5de424
lea eax, [ebp - 0x34]
mov edx, 5
call fcn.0040ab20
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0x11
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x5de3ec
push 0x5de400
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.0040ab20
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x11
lea edx, [ebp - 0x30]
mov ecx, 1
mov eax, dword [0x5f4a1c]
call fcn.004240c0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x30]
push 0x5de438
push 0x5de448
mov ecx, dword [0x5f9634]
mov dl, 1
mov eax, dword [0x490428]
call fcn.004b3570
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.004b3210
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x5de464
push 0x5de478
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.0040ab20
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x80]
push 0
push 0
push 0
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x5de464
push 0x5de478
lea eax, [ebp - 0x40]
mov edx, 4
call fcn.0040ab20
mov eax, dword [ebp - 0x40]
call fcn.0040a82c
push eax
push 0x5de480
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
call fcn.00409b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5de3dc
lea eax, [ebp - 0x40]
mov edx, 4
call fcn.00409d9c
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00409d9c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409d9c
ret
Function at 0x4028e7
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x4028ff
push dword [esp + 4]
push 0x402880
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x40293c
push esi
mov esi, dword [0x40afb4]
test esi, esi
je 0x40293b
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x402933
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40afb4
call fcn.00407cae
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x40290c
pop edi
pop ebx
pop esi
ret 4
Function at 0x404d04
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
push dword [0x44b9a0]
xor esi, esi
call fcn.00407a8b
push edi
push edi
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 0xc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x404e69
push edi
lea ecx, [ebp - 0xc]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 4], 0x4d42
jne 0x404dc9
mov al, byte [ebp + 0x10]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xffffe000
add eax, 0x2010
push eax
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [0x40afa4]
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, eax
cmp esi, edi
je 0x404e69
lea eax, [ebp - 0x38]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp word [ebp - 0x26], 8
ja 0x404e3f
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x10
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [0x40afa4]
call dword [sym.imp.USER32.dll_LoadImageA]
jmp 0x404e2c
push 0x10
push edi
push edi
push 1
push dword [ebp + 0xc]
push dword [0x40afa4]
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, eax
cmp esi, edi
je 0x404e16
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x404e3f
lea eax, [ebp - 0x38]
push eax
push 0x18
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_GetObjectA]
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x404e3f
push edi
push dword [ebp + 0xc]
call fcn.00405010
cmp eax, edi
je 0x404e3f
push dword [ebp + 0x10]
push eax
call fcn.00404e84
mov esi, eax
cmp esi, edi
je 0x404e69
lea eax, [ebp - 0x38]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp esi, edi
je 0x404e69
cmp dword [ebp + 8], 0xffffffff
mov dword [ebx], esi
mov ax, word [ebp - 0x34]
mov word [ebx + 4], ax
mov ax, word [ebp - 0x30]
mov word [ebx + 6], ax
mov al, byte [ebp - 0x26]
mov byte [ebx + 8], al
mov al, byte [ebp + 0x10]
mov byte [ebx + 9], al
jne 0x404e69
mov esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x407580
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x4075ee
push 0x11
call esi
test al, al
js 0x4075ee
push 0x10
call esi
test al, al
js 0x4075ee
push 0x12
call esi
test al, al
js 0x4075ee
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x4075ee
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x407612
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x407612
dec eax
push eax
push dword [0x44bb68]
call fcn.00407aef
mov eax, dword [eax + 8]
jmp 0x407614
xor eax, eax
pop esi
leave
ret 4