joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45eb40
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45eceb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45eccc
mov dl, 1
mov eax, dword [0x41588c]
call fcn.004036e0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040447c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45ecbb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044c01c
test al, al
je 0x45ecae
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45ecfc
lea eax, [ebp - 0x254]
call fcn.004095d0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45ecae
xor eax, eax
push ebp
push 0x45eca7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45ed34
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45ec90
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004046e4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45ec90
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004046e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ecae
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45ebb1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041a040
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ecf2
lea eax, [ebp - 0x260]
call fcn.0040447c
ret

Function at 0x45f620
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4cbc34]
cmp byte [eax + 0xa5], 0
jne 0x45f691
cmp dword [0x4cbc4c], 0
jne 0x45f652
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45f5dc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4cbc4c], eax
cmp dword [0x4cbc48], 0
jne 0x45f66d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4cbc48], eax
cmp dword [0x4cbc50], 0
jne 0x45f691
push esp
push 0
push 0
push 0x45f580
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4cbc50], eax
pop edx
ret
Function at 0x45f7b4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45f7cb
add esp, 0xfffffff0
call fcn.00403a74
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041fa40
mov eax, dword [0x4cad4c]
cmp word [eax + 2], 0
jne 0x45f7f3
mov eax, dword [0x4cad4c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00460e90
mov eax, dword [0x4cae20]
cmp word [eax + 2], 0
jne 0x45f80d
mov eax, dword [0x4cae20]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00461088
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4151d4]
call fcn.004036e0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4151d4]
call fcn.004036e0
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x422040]
call fcn.00429af0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45f994
mov eax, dword [0x4cac40]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429ec0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4615f8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4cac40]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cb80
test eax, eax
je 0x45f902
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408f18
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cba8
test eax, eax
je 0x45f916
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004046e4
mov eax, dword [0x4caab8]
cmp byte [eax], 0
jne 0x45f94a
mov eax, ebx
call fcn.0045fabc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004617d4
mov eax, ebx
call fcn.00462114
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45f98a
call fcn.00403acc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fd30
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4cbc34]
cmp dword [eax + 0x30], 0
je 0x45fdda
cmp dword [ebx + 0x94], 0
jne 0x45fdd4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45fcc0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45fdd4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45fd9a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45fdd4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417a58
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45fda9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4608b8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4608ed
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040456c
jmp 0x4608fa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044d0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4619b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4619f1
mov eax, esi
call fcn.004476a8
test al, al
je 0x4619f1
mov eax, dword [ebx + 0x84]
call fcn.004473a4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4619f1
push 0
mov eax, dword [ebx + 0x84]
call fcn.004473a4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x465088
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4650b6
mov eax, ebx
call fcn.00465b40
cmp dword [ebx + 0x3c], 0
je 0x4650af
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x465127
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x465119
cmp dword [ebx + 8], 0
je 0x4650d8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4650ea
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x465119
cmp dword [ebx + 8], 0
je 0x4650cb
cmp eax, 3
je 0x4650fd
dec eax
jne 0x4650cb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4650cb
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4650cb
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x465145
cmp dword [ebx + 0x10], 0xcc
je 0x465145
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00465150
pop ebx
ret
Function at 0x478764
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040492c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4787bc
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4cafec]
mov dl, 1
mov eax, dword [0x478288]
call fcn.0040bf98
call fcn.00403edc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00478390
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49edf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x49efc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x49efad
mov eax, dword [edi + 0x30]
call fcn.00404734
test eax, eax
jne 0x49ee46
mov eax, dword [edi + 0x34]
call fcn.00404734
test eax, eax
jne 0x49ee46
mov eax, edi
call fcn.0049f064
jmp 0x49efad
cmp dword [edi + 0xa0], 0
jne 0x49ee7d
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.00408f74
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4cbdc8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x49eeb4
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.00408f74
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4cbdc8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0049f0a4
mov ebx, eax
test bl, bl
jne 0x49ef62
mov eax, dword [edi + 0x30]
call fcn.00404734
test eax, eax
jne 0x49eeec
mov eax, dword [edi + 0xc0]
call fcn.00404734
test eax, eax
je 0x49ef62
mov eax, dword [edi + 0xc0]
call fcn.00404734
test eax, eax
je 0x49ef0e
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.00408f74
jmp 0x49ef3a
push dword [edi + 0x30]
push 0x49efe0
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004047f4
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00408f74
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x49ef62
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0049f0a4
mov ebx, eax
test bl, bl
jne 0x49ef6f
mov eax, edi
call fcn.0049f064
jmp 0x49efad
mov eax, dword [edi + 0x58]
test eax, eax
je 0x49ef7e
mov dword [edi + 0xa8], eax
jmp 0x49ef88
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.0049f11c
test al, al
je 0x49efad
mov eax, edi
mov si, 0xffee
call fcn.0040390c
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.0049f1c8
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49efcd
lea eax, [ebp - 0x108]
call fcn.0040447c
ret
Function at 0x4a1884
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a1ae4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4a18e7
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004a134c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c76c
cmp al, 1
jne 0x4a18e7
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004a1664
test al, al
je 0x4a1a73
cmp dword [ebp - 8], 0
jge 0x4a1905
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004a134c
mov eax, dword [ebp - 0x210]
call fcn.00404734
cmp ebx, eax
jge 0x4a194f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004a134c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4cafc8]
and eax, 0xff
bt dword [edx], eax
jae 0x4a194f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4a1963
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a1860
cmp ebx, dword [ebp - 8]
je 0x4a1a65
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4a198f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040390c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4caa68]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4a1a52
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040390c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4caa68]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004473a4
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040390c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4caa68]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004473a4
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1a59
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4a1ac6
cmp dword [ebp - 8], 0
jge 0x4a1a7e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004a134c
mov eax, dword [ebp - 0x218]
call fcn.00404734
cmp eax, dword [ebp - 8]
jg 0x4a1ab8
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004a134c
mov eax, dword [ebp - 0x21c]
call fcn.00404734
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a1860
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1aeb
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004044a0
ret
Function at 0x4ac3a4
Capabilities:
Create mailslot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff38
push edi
push edx
push eax
call sub.kernel32.dll_EnumDateFormatsA
lea eax, [esp + 0x74]
push eax
call sub.comctl32.dll_PropertySheetA
push ebp
call sub.gdi32.dll_AddFontResourceA
mov ecx, dword [esp]
mov edx, ebx
mov eax, esi
call fcn.0042ac90
lea eax, [esp + 0xa8]
push eax
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetCPInfo
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_CreateMailslotA
mov eax, dword [esp + 0x18]
call fcn.0042af18
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
call sub.wininet.dll_InternetCanonicalizeUrlA
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push eax
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push eax
call sub.advapi32.dll_LookupAccountSidA
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
call fcn.0042b0d4
lea eax, [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push eax
lea eax, [esp + 0xc4]
push eax
mov eax, dword [esp + 0x5c]
push eax
call sub.advapi32.dll_QueryServiceLockStatusA
mov eax, dword [esp + 0x5c]
call fcn.00435e58
lea eax, [esp + 0x6c]
push eax
mov eax, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x6c]
push eax
call sub.gdi32.dll_GetTextExtentPoint32A
add esp, 0xc8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ac4f0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc30
lea edx, [esp + 0x58]
push edx
push eax
call sub.kernel32.dll_FindNextFileA
push edi
push ebp
push ebx
call sub.kernel32.dll_FindFirstChangeNotificationA
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push esi
call sub.user32.dll_OpenWindowStationA
lea eax, [esp + 0x198]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.gdi32.dll_GetTextMetricsA
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
call fcn.0042ac80
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.kernel32.dll_ClearCommError
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.user32.dll_ReleaseDC
lea eax, [esp + 0x1d0]
push eax
call sub.user32.dll_RegisterClassW
lea eax, [esp + 0x23c]
push eax
lea eax, [esp + 0x1fc]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
lea eax, [esp + 0x24c]
push eax
call sub.gdi32.dll_CreateColorSpaceA
mov eax, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push eax
call sub.gdi32.dll_GetObjectW
lea eax, [esp + 0x394]
push eax
call sub.gdi32.dll_CreateFontIndirectA
add esp, 0x3d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x501cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502328
push 0x501ef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x503424], 0xffffffff
mov dword [0x503428], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x503420]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x50341c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x50342c], ecx
call fcn.00501ee0
mov eax, dword [0x503154]
test eax, eax
jne 0x501d81
push 0x501ed0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501eb0
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x503418]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x503414]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501e8f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501df5
cmp al, 0x22
jne 0x501de7
cmp byte [esi], 0x22
jne 0x501dfe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e0e
cmp al, 0x20
ja 0x501e0e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501dfe
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501e2f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501e34
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501e74
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501dfe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8f

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x617b2e47
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..reloc_1
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x32a62dd
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
call 0xdf929f21
mov esi, dword [ebp + 0x57]
mov al, byte [esi + 0x2c]
test al, al
je 0x40b3a1
mov ecx, dword [esi - 0x5b]
xor eax, eax
push ebx
cmp ecx, 1
push edi
mov dword [ebp - 4], eax
mov dword [ebp + 8], eax
lodsd eax, dword [esi]
test dword [eax + eax + 0x7e8b0000], ebx
outsb dx, byte [esi]
cmp edi, eax
mov byte [ecx + edx*4 + 0x75000000], 0x5e
cmp byte [ebx + 0x576ffff], al
cmp edi, 0xffffffff
jbe 0x40b311
or eax, 0xffffffff
salc
add cl, byte [ebx + 0x4568ba6]
dec bp
mov esp, dword [esi + 0x6604568b]
dec ebp
cld
push 0
mov ah, 0x50
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x40b358
rol byte [eax], 0x85
shr bl, 0x2f
mov eax, dword [ebp - 4]
mov edx, dword [esi - 0x2f]
mov ecx, dword [esi + 0x54]
add edx, eax
outsd dx, dword [esi]
push cs
add byte [edi + 0x31], ch
add ebx, eax
mov bh, 0xa2
push eax
pop eax
popal
mov dword [esi + 0x54], ecx
ja 0x40b307
mov eax, dword [ebp - 0x15]
aas
mov dword [esi + 0x3c], 0x600
pop ebx
pop esi
mov esp, ebp
inc esp
into
add al, 0
mov edi, dword [ebx]
cwde
rol byte [eax], 0xff
jnp 0x40b322
jne 0x40b369
mov dword [ebp + 8], eax
jmp 0x40b373
cwde
xlatb
add eax, 0xafc80
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x4e]
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
add edx, eax
jns 0x40b3c5
cmpsb byte [esi], byte es:[edi]
mov dword [esi + 0x1a], edx
adc ecx, 0
test ebp, esi
mov dword [esi + 0x54], ecx
jne 0x40b395
invalid
outsd dx, dword [esi]
or byte [edi - 0x75], bl
pop esi
inc ecx
in eax, 0x5d
ret 4
xor ecx, eax
pop esi
mov esp, ebp
pop ebp
ret 0x6704
ror dword ds:[ebp + 0x19504], 1
add byte [ebx], al
pop ebp
ret 0xf204

Function at 0x40b540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb eax, 0xa3368ad2
sbb ecx, dword [ebx + 0xf902872]
mov bh, 0x4a
xor edi, edi

Function at 0x40b54a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb eax, 0xa3368ad2
sbb ecx, dword [ebx + 0xf902872]
mov bh, 0x4a
xor edi, edi