joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4decc4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x4ded31
cmp dword [esi + 0x10], 0
je 0x4ded31
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0054f230
mov ebx, esp
test ebx, ebx
je 0x4ded31
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1b8
call fcn.004bf330
mov ecx, dword [esi + 0x10]
push ecx
push 0
push 0
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004c293a
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4e97c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x98], esi
mov dword [esi + 0x10], eax
mov dword [eax + 0x5b8], ebx
cmp dword [esi + 4], ebx
jne 0x4e9855
lea eax, [ebp - 0xa8]
push eax
call fcn.004e98ce
mov ecx, dword [esi + 0x10]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0xa8]
mov eax, dword [ecx]
movsd dword es:[edi], dword [esi]
push ecx
push ebx
push 0x40000000
movsd dword es:[edi], dword [esi]
push ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004c077f
mov esi, dword [ebp - 0x98]
mov ecx, esi
push eax
call fcn.004c4470
mov ecx, dword [esi + 0x10]
call fcn.004ccb33
push eax
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004c33a6
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
call fcn.004bf2cb
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.004bf1a3
mov edi, 0x5a8
test bl, bl
je 0x4e988d
mov eax, dword [esi + 0x10]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esi + 0x10]
add eax, edi
push eax
push 0
push 0x1002
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 8]
pop edi
mov byte [esi + 0x18], 1
xor ecx, ebp
pop esi
pop ebx
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 4
Function at 0x4f0376
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x4f0398
cmp dword [esi + 8], edi
jge 0x4f0390
call fcn.004efbe3
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov ecx, dword [esi + 8]
xor edx, edx
test ecx, ecx
jle 0x4f03be
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub ecx, 8
mov byte [ebp + edx - 4], al
inc edx
shr edi, 8
mov dword [esi + 0xc], edi
test ecx, ecx
jg 0x4f03a4
mov dword [esi + 8], ecx
jmp 0x4f03d6
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x4f03c9
xor eax, eax
jmp 0x4f03d1
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
mov byte [ebp + edx - 4], al
inc edx
cmp edx, 4
jl 0x4f03be
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp - 2]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4f040d
mov ecx, str.zlib_corrupt
call fcn.004ececa
jmp 0x4f044a
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4f041d
mov ecx, str.read_past_buffer
jmp 0x4f0406
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x4f0434
mov edx, edi
mov ecx, esi
call fcn.004efd34
test eax, eax
je 0x4f044a
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0053c3c0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4f51d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5a5c2c]
push esi
push edi
mov dword [ebp - 0xc], eax
mov edi, edx
mov ax, word [0x5a5c30]
mov si, cx
push 0x208
mov word [ebp - 8], ax
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0053ca90
add esp, 0xc
mov word [ebp - 0xc], si
lea eax, [ebp - 0x214]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp word [ebp - 0x214], 0
jne 0x4f523a
xor eax, eax
jmp 0x4f5252
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4f5243
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
call fcn.004203d0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0053e21c
mov esp, ebp
pop ebp
ret
Function at 0x4f73c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor dl, dl
push edi
mov dword [ebp - 8], esi
mov bl, 0x70
mov eax, str.publishbrowser
add dl, bl
lea eax, [eax + 1]
mov bl, byte [eax]
test bl, bl
jne 0x4f73d7
xor eax, eax
mov cl, al
xor cl, dl
mov byte [eax + esi], cl
inc eax
cmp eax, 0x100
jl 0x4f73e4
mov cl, 0x70
mov dword [ebp - 4], str.publishbrowser
lea esp, [esp]
movzx eax, cl
mov ch, byte [eax + esi]
mov bl, ch
movzx eax, ch
xor bl, cl
movzx edi, bl
add edi, esi
add esi, eax
mov dword [ebp - 0xc], edi
mov dl, byte [edi]
mov cl, byte [esi]
mov edi, dword [ebp - 8]
movzx eax, dl
mov byte [eax + edi], cl
movzx eax, cl
mov byte [eax + edi], dl
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
inc eax
mov dword [ebp - 4], eax
mov cl, byte [eax]
mov byte [edi], ch
mov byte [esi], bl
mov esi, dword [ebp - 8]
test cl, cl
jne 0x4f7400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f98c0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575ff0
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x208
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.0053ca90
add esp, 0xc
push 0
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp + 0x10]
call fcn.004fe860
push eax
lea ecx, [ebp + 0xc]
call fcn.004fe860
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
test eax, eax
jne 0x4f9a76
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x21c]
test eax, eax
je 0x4f9a76
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0053d2d1
add esp, 4
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 2
jle 0x4f9a40
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x21c]
cmp ecx, 0x22
jne 0x4f9a40
mov edx, dword [ebp - 0x428]
movzx eax, word [ebp + edx*2 - 0x21e]
cmp eax, 0x22
jne 0x4f9a40
xor ecx, ecx
mov word [ebp - 0x424], cx
push 0x206
push 0
lea edx, [ebp - 0x422]
push edx
call fcn.0053ca90
add esp, 0xc
lea eax, [ebp - 0x21a]
push eax
push 0x104
lea ecx, [ebp - 0x424]
push ecx
call fcn.0041f890
mov edx, dword [ebp - 0x428]
lea eax, [edx + edx - 4]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0x208
jae 0x4f99fd
jmp 0x4f9a02
call fcn.0053bdae
xor ecx, ecx
mov edx, dword [ebp - 0x42c]
mov word [ebp + edx - 0x424], cx
push 0x20a
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.0053ca90
add esp, 0xc
lea ecx, [ebp - 0x424]
push ecx
push 0x105
lea edx, [ebp - 0x21c]
push edx
call fcn.0041f890
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.004fdf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004fdf30
mov eax, dword [ebp - 0x430]
jmp 0x4f9aa1
mov dword [ebp - 0x434], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.004fdf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004fdf30
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret

Function at 0x4f9e20
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5b0ce0
push 0x53e790
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x5bb250]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x4f9ea0
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f9ec0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5b0ca0
push 0x53e790
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x5bb250]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid
Function at 0x500b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x500b54
xor eax, eax
jmp 0x500bd4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x500b6b
xor eax, eax
jmp 0x500bd4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x500bb7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x500bb7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x500b8e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x500bc3
xor eax, eax
jmp 0x500bd4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x500bd1
xor eax, eax
jmp 0x500bd4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x502b30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576be1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5bb250]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00515950
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x502b7f
mov ecx, dword [ebp - 0x10]
call fcn.00503710
jmp 0x502ca0
cmp dword [ebp + 0x2620], 1
jne 0x502bd0
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x502bd0
mov edx, dword [ebp + 0x2848]
push edx
lea esi, [ebp + 0x18]
mov eax, 0x282c
call fcn.0053e720
mov ecx, 0xa0b
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00502df0
jmp 0x502ca0
push 0x8e28
call fcn.0053bae5
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x502bfa
mov ecx, dword [ebp - 0x18]
call fcn.00503490
mov dword [ebp - 0x1c], eax
jmp 0x502c01
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.005035a0
push 0x7ee
mov ecx, dword [ebp - 0x10]
call fcn.005035c0
mov eax, dword [ebp + 0x2848]
push eax
push 0
mov ecx, dword [ebp + 0x2844]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.005035e0
lea esi, [ebp + 0x18]
mov eax, 0x282c
call fcn.0053e720
mov ecx, 0xa0b
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x10]
call fcn.005036c0
push 1
mov ecx, dword [ebp - 0x10]
call fcn.005036f0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00515850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x2844
Function at 0x502f60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12d4
call fcn.0053e720
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1290], ecx
cmp dword [ebp + 8], 0
je 0x502f96
mov eax, 2
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx]
test eax, eax
jne 0x502f9b
jmp 0x503073
xor ecx, ecx
mov word [ebp - 0x127c], cx
push 0x1276
push 0
lea edx, [ebp - 0x127a]
push edx
call fcn.0053ca90
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.00417eb0
push eax
push 0x57d02c
push 0x93c
lea ecx, [ebp - 0x127c]
push ecx
call fcn.0041f270
add esp, 0x14
mov dword [ebp - 0x12d4], 0
push 0x40
push 0
lea edx, [ebp - 0x12d0]
push edx
call fcn.0053ca90
add esp, 0xc
mov dword [ebp - 0x12d4], 0x44
mov dword [ebp - 0x12a8], 0x80
mov dword [ebp - 0x128c], 0
xor eax, eax
mov dword [ebp - 0x1288], eax
mov dword [ebp - 0x1284], eax
mov dword [ebp - 0x1280], eax
lea ecx, [ebp - 0x128c]
push ecx
lea edx, [ebp - 0x12d4]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x127c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x503073
mov ecx, dword [ebp - 0x1288]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x128c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 4
Function at 0x5038f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.00503790
test eax, eax
jne 0x50390c
xor eax, eax
jmp 0x503a9a
push 0x4f0
call fcn.0053bae5
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push 0x4f0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0053ca90
add esp, 0xc
mov edx, dword [ebp - 8]
add edx, 0x218
push edx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0x28], 0
je 0x503966
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp - 4]
add edx, 0xe0
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x10]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
movsd xmm0, qword [ebp + 0x1c]
movsd qword [edx + 0x18], xmm0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x8e18]
mov dword [eax + 0x4ec], edx
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x60
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 8]
add edx, 0x2258
push edx
mov eax, dword [ebp - 4]
add eax, 0x1e0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 8]
add ecx, 0x1258
push ecx
push 0x104
mov edx, dword [ebp - 4]
add edx, 0x2e0
push edx
call fcn.0041f890
mov eax, dword [ebp - 8]
cmp dword [eax + 0x8e18], 0x7ee
jne 0x503a3f
mov ecx, dword [ebp - 4]
add ecx, 0x2e0
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x503a3f
mov edx, dword [ebp - 4]
add edx, 0x2e0
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 8]
add eax, 0x81ec
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2e0
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 8]
cmp dword [edx + 0x8e18], 0x7ee
je 0x503a5d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x8e18], 0x7ec
jne 0x503a7a
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x7f8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x208]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x503a95
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x7f8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x208]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x24
Function at 0x504390
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576df9
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5bb250]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x125c
push eax
lea ecx, [ebp - 0x18]
call fcn.004fd630
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x18]
call fcn.004fe860
push eax
call fcn.0041b570
add esp, 8
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x34], ecx
push str.ck_W
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 9
mov ecx, dword [ebp - 0x14]
call fcn.00504220
mov ecx, dword [ebp - 0x14]
call fcn.005041f0
test eax, eax
je 0x504572
lea ecx, [ebp - 0x18]
call fcn.004fe860
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x10]
call fcn.004fd630
mov byte [ebp - 4], 1
push str..zip
lea ecx, [ebp - 0x10]
call fcn.004ff370
test eax, eax
je 0x5044a6
push str..rar
lea ecx, [ebp - 0x10]
call fcn.004ff370
test eax, eax
je 0x5044a6
push 0x57d0d8
lea ecx, [ebp - 0x10]
call fcn.004ff370
test eax, eax
je 0x5044a6
push str..tar
lea ecx, [ebp - 0x10]
call fcn.004ff370
test eax, eax
je 0x5044a6
push 0x57d0ec
lea ecx, [ebp - 0x10]
call fcn.004ff370
test eax, eax
je 0x5044a6
push 0x57d0f4
lea ecx, [ebp - 0x10]
call fcn.004ff370
test eax, eax
jne 0x5044ab
jmp 0x504566
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
lea edx, [ebp - 0x18]
push edx
call fcn.004fd4f0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
push ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
call fcn.00504b50
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 3
push 0x3c
push 0
lea edx, [ebp - 0x7c]
push edx
call fcn.0053ca90
add esp, 0xc
mov dword [ebp - 0x7c], 0x3c
mov dword [ebp - 0x74], 0
lea ecx, [ebp - 0x1c]
call fcn.004fe860
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x18]
call fcn.004fe860
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x14]
add eax, 0x85f0
push eax
call fcn.0053d2d1
add esp, 4
test eax, eax
jbe 0x504533
mov ecx, dword [ebp - 0x14]
add ecx, 0x85f0
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x78], 0x40
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x493e0
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004fdf30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004fdf30
push 0x57d0fc
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 0x10
mov ecx, dword [ebp - 0x14]
call fcn.00504220
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004fdf30
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x509620
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5774a1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5bb250]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x298
call fcn.0053bae5
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x509672
mov ecx, dword [ebp - 0x14]
call fcn.0050c780
mov dword [ebp - 0x18], eax
jmp 0x509679
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
jne 0x50969a
jmp 0x5096d5
push 0
push 0
push 0
push 0
push 0
push 0
push 0x90020000
push str.Hao123
push 0
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 4]
call fcn.004c449d
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 5
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x5096f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x597b8c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00413b10
add esp, 0xc
test eax, eax
je 0x509735
cmp dword [ebp - 4], 1
jne 0x509735
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.0041a040
add esp, 4
xor eax, eax
jmp 0x50973a
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x50f7e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2208
call fcn.0053e720
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2208], ecx
lea eax, [ebp - 0x2204]
push eax
mov ecx, 0x5bf8b0
call fcn.0050d430
mov ecx, eax
call fcn.004f8c80
movzx ecx, al
test ecx, ecx
je 0x50f836
push 5
push 0
push 0
lea edx, [ebp - 0x2204]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x511110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
call fcn.0050da90
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x511270
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0x280
call fcn.004ffbc0
movzx eax, al
test eax, eax
jne 0x51130a
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x208
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.0053ca90
add esp, 0xc
mov ecx, dword [ebp - 0x214]
add ecx, 0x280
call fcn.004fe860
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0041f890
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 5
push 0
push 0
lea edx, [ebp - 0x210]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 0xc