joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5230
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4c528c
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c525b
call fcn.004115c4
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004030f4
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c528c
call fcn.004115c4
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4cd484
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x5420c0]
cmp byte [eax], 0
jne 0x4cd4b2
mov ecx, 0xda
mov edx, 0x4cd500
mov eax, 0x4cd534
call fcn.00404aec
mov eax, ebx
call fcn.00405220
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4cd4f1
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004053b4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cd548
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4cd694
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x20
lea edx, [ebp - 0x40]
push edx
and eax, 0x1ff
shl eax, 0x10
push eax
call sub.user32.dll_GetKeyNameTextW
mov esi, eax
lea edx, [ebp - 0x40]
mov eax, ebx
mov ecx, esi
call fcn.00405314
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x48]
mov eax, dword [ebx]
call fcn.0040b2b4
mov eax, dword [ebp - 0x48]
mov ecx, esi
dec ecx
mov edx, 2
call fcn.004055fc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebx]
mov ecx, 1
mov edx, 1
call fcn.004055fc
mov edx, dword [ebp - 0x4c]
mov eax, ebx
pop ecx
call fcn.004054c8
mov edx, dword [ebx]
mov eax, 0x4cd6a8
call fcn.00405774
test eax, eax
jle 0x4cd679
lea eax, [ebp - 0x50]
push eax
mov edx, dword [ebx]
mov eax, 0x4cd6a8
call fcn.00405774
mov ecx, eax
mov eax, dword [ebx]
mov edx, 1
call fcn.004055fc
push dword [ebp - 0x50]
lea eax, [ebp - 0x58]
push eax
mov edx, dword [ebx]
mov eax, 0x4cd6a8
call fcn.00405774
mov edx, eax
inc edx
mov eax, dword [ebx]
mov ecx, 1
call fcn.004055fc
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.0040b280
push dword [ebp - 0x54]
lea eax, [ebp - 0x5c]
push eax
mov edx, dword [ebx]
mov eax, 0x4cd6a8
call fcn.00405774
sub esi, eax
dec esi
push esi
mov edx, dword [ebx]
mov eax, 0x4cd6a8
call fcn.00405774
mov edx, eax
add edx, 2
mov eax, dword [ebx]
pop ecx
call fcn.004055fc
push dword [ebp - 0x5c]
mov eax, ebx
mov edx, 3
call fcn.00405530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd69b
lea eax, [ebp - 0x5c]
mov edx, 7
call fcn.00405238
ret
Function at 0x4cd6ac
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cd7dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, ebx
and di, 0xff
movzx eax, di
cmp eax, 0x20
jge 0x4cd6ed
add eax, 0xfffffff8
sub eax, 2
jb 0x4cd720
sub eax, 3
je 0x4cd720
sub eax, 0xe
je 0x4cd720
jmp 0x4cd734
add eax, 0xffffffe0
sub eax, 9
jb 0x4cd707
add eax, 0xfffffffc
sub eax, 2
jb 0x4cd707
add eax, 0xffffffbf
sub eax, 0x18
jb 0x4cd720
jmp 0x4cd734
push 0
movzx eax, di
push eax
call sub.user32.dll_MapVirtualKeyW
add eax, 0x100
mov edx, esi
call fcn.004cd548
jmp 0x4cd73d
push 0
movzx eax, di
push eax
call sub.user32.dll_MapVirtualKeyW
mov edx, esi
call fcn.004cd548
jmp 0x4cd73d
mov edx, esi
mov eax, edi
call fcn.004cd484
test bh, 0x20
je 0x4cd769
push 0
push 0x10
call sub.user32.dll_MapVirtualKeyW
lea edx, [ebp - 4]
call fcn.004cd548
push dword [ebp - 4]
push 0x4cd7f0
push dword [esi]
mov eax, esi
mov edx, 3
call fcn.00405530
test bh, 0x80
je 0x4cd795
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyW
lea edx, [ebp - 8]
call fcn.004cd548
push dword [ebp - 8]
push 0x4cd7f0
push dword [esi]
mov eax, esi
mov edx, 3
call fcn.00405530
test bh, 0x40
je 0x4cd7c1
push 0
push 0x11
call sub.user32.dll_MapVirtualKeyW
lea edx, [ebp - 0xc]
call fcn.004cd548
push dword [ebp - 0xc]
push 0x4cd7f0
push dword [esi]
mov eax, esi
mov edx, 3
call fcn.00405530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd7e3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405238
ret

Function at 0x4d1f94
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.004d1f50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d2008
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x548008], eax
mov ebx, 0x4d1edc
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4d2008
xor eax, eax
push ebp
push 0x4d2001
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2008
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d2010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.004d1f50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d207b
mov ebx, dword [0x548008]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4d207b
xor eax, eax
push ebp
push 0x4d2074
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d207b
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d6d6c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d6d9a
mov eax, ebx
call fcn.004d7820
cmp dword [ebx + 0x40], 0
je 0x4d6d93
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d6e0b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d6dfd
cmp dword [ebx + 8], 0
je 0x4d6dbc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d6dce
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d6dfd
cmp dword [ebx + 8], 0
je 0x4d6daf
cmp eax, 3
je 0x4d6de1
dec eax
jne 0x4d6daf
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d6daf
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d6daf
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d6e29
cmp dword [ebx + 0x14], 0xcc
je 0x4d6e29
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d6e34
pop ebx
ret
Function at 0x528b10
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x32
push 0
push 0
dec ecx
jne 0x528b18
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x168]
mov edx, dword [0x40a1cc]
call fcn.0040582c
xor eax, eax
push ebp
push 0x528d7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b14
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
lea ecx, [ebp - 0x170]
mov edx, 4
call fcn.0040b97c
mov ecx, dword [ebp - 0x170]
lea eax, [ebp - 0x16c]
mov edx, 0x528d94
call fcn.00404e20
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 8]
call fcn.004053d0
mov dl, 1
mov eax, dword [0x4bd4b4]
call fcn.004be220
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x528ced
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x178]
xor eax, eax
call fcn.00403300
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.0040c00c
lea eax, [ebp - 0x174]
mov edx, 0x528da0
call fcn.00404ddc
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040be60
lea edx, [ebp - 0x184]
xor eax, eax
call fcn.00403300
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.0040c00c
push dword [ebp - 0x180]
push 0x528db8
push dword [ebp - 0x15c]
lea eax, [ebp - 0x17c]
mov edx, 3
call fcn.00404e94
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x18c]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 0x18c]
call fcn.0040545c
push eax
lea ecx, [ebp - 0x190]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 0x190]
mov edx, 2
pop ecx
call fcn.004055fc
mov edx, dword [ebp - 0x188]
mov eax, dword [ebp - 8]
call fcn.00405774
test eax, eax
jle 0x528cc5
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x15c]
call fcn.00404bac
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x528dcc
call fcn.0040bf28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00405034
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x528d2c
lea eax, [ebp - 0x168]
call fcn.0040beb0
test eax, eax
je 0x528be9
lea eax, [ebp - 0x168]
call fcn.0040bed4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x528d0f
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x528d24
mov eax, dword [ebp - 4]
mov edx, 0x528e28
call fcn.00404b68
mov eax, dword [ebp - 0xc]
call fcn.00403cf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x528d82
lea eax, [ebp - 0x190]
mov edx, 3
call fcn.00405238
lea eax, [ebp - 0x184]
mov edx, 7
call fcn.00404b38
lea eax, [ebp - 0x168]
mov edx, dword [0x40a1cc]
call fcn.004058fc
lea eax, [ebp - 0x10]
call fcn.00404b14
lea eax, [ebp - 8]
call fcn.00405220
ret
Function at 0x5291b0
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffff7c8
push esp
push 0x1800
lea eax, [esp + 0x40]
push eax
push 8
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x5292ee
mov eax, dword [0x541f2c]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x5292e7
inc eax
mov dword [esp + 0x28], eax
lea ebx, [esp + 0x38]
mov esi, 0x548494
mov dword [esp + 0x2c], 0x548694
mov edi, 0x548c94
mov ebp, 0x549094
mov dword [esp + 0x30], 0x548894
mov eax, ebx
call fcn.00529174
fstp qword [esp + 0x20]
wait
lea eax, [ebx + 8]
call fcn.00529174
fstp qword [esp + 0x10]
wait
lea eax, [ebx + 0x10]
call fcn.00529174
fstp qword [esp + 0x18]
wait
mov dword [esi], 0x64
mov eax, dword [esp + 0x2c]
xor edx, edx
mov dword [eax], edx
cmp byte [0x541e1c], 0
jne 0x52929b
fld qword [esp + 0x10]
fsub qword [edi]
fld qword [esp + 0x18]
fsub qword [ebp]
faddp st(1)
fstp qword [esp + 8]
wait
fld qword [esp + 8]
fcomp dword [0x5292fc]
fnstsw ax
sahf
jbe 0x52929b
fld qword [esp + 0x20]
mov eax, dword [esp + 0x30]
fsub qword [eax]
fmul dword [0x529300]
fdiv qword [esp + 8]
call fcn.004033c8
mov dword [esi], eax
mov eax, 0x64
sub eax, dword [esi]
mov edx, dword [esp + 0x2c]
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
mov dword [eax], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x10]
mov dword [edi], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x18]
mov dword [ebp], eax
mov eax, dword [esp + 0x1c]
mov dword [ebp + 4], eax
add dword [esp + 0x30], 8
add ebp, 8
add edi, 8
add dword [esp + 0x2c], 4
add esi, 4
add ebx, 0x30
dec dword [esp + 0x28]
jne 0x529213
mov byte [0x541e1c], 0
add esp, 0x1838
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x529304
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffff4
push esp
push 0x2c
push 0x549494
push 0
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x529486
push esp
push 0x20
push 0x549740
push 3
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x529486
mov eax, dword [0x54267c]
cmp byte [eax], 0
je 0x52935c
push esp
push 0x148
push 0x5495f8
push 2
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x529486
jmp 0x529376
push esp
push 0x138
push 0x5494c0
push 2
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x529486
cmp dword [0x541e24], 0
jne 0x529386
cmp dword [0x541e20], 0
je 0x529456
mov eax, 0x5495f8
call fcn.00529174
fstp qword [esp + 4]
wait
mov eax, 0x541e20
call fcn.00529174
fsubr qword [esp + 4]
fstp qword [0x549768]
wait
mov eax, 0x549748
call fcn.00529174
fstp qword [esp + 4]
wait
mov eax, 0x541e28
call fcn.00529174
fsubr qword [esp + 4]
fstp qword [0x549760]
wait
fld qword [0x549768]
fdiv qword [0x549760]
fstp qword [0x549768]
wait
fld qword [0x549768]
fmul dword [0x52948c]
mov eax, dword [0x541f2c]
fild dword [eax]
fdivp st(1)
fsubr dword [0x52948c]
fadd dword [0x529490]
fstp qword [0x549770]
wait
fld dword [0x52948c]
fsub qword [0x549770]
fstp qword [0x549768]
wait
fld qword [0x549768]
call fcn.004033c8
mov ebx, eax
mov eax, dword [0x542b4c]
mov eax, dword [eax]
mov dword [eax + 0x128], ebx
mov eax, dword [0x542b4c]
mov eax, 0x64
sub eax, ebx
mov edx, dword [0x542b4c]
mov edx, dword [edx]
mov dword [edx + 0x12c], eax
mov eax, dword [0x5495f8]
mov dword [0x541e20], eax
mov eax, dword [0x5495fc]
mov dword [0x541e24], eax
mov eax, dword [0x549748]
mov dword [0x541e28], eax
mov eax, dword [0x54974c]
mov dword [0x541e2c], eax
add esp, 0xc
pop ebx
ret
Function at 0x52aeb8
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52b07c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0040b784
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x52b098
call fcn.00404e20
mov eax, dword [ebp - 0x24]
call fcn.0052b434
cmp ebx, 0x8c
jne 0x52af53
mov eax, 0x89
call fcn.0052aeb8
test al, al
je 0x52af44
mov eax, dword [0x549790]
mov eax, dword [eax + 0x10c]
call fcn.0052ad68
test al, al
jne 0x52af53
mov eax, 0x52b0b8
call fcn.0052b434
jmp 0x52b061
mov eax, 0x52b0e0
call fcn.0052b434
jmp 0x52b061
cmp ebx, 0x8d
jne 0x52af9b
mov eax, 0x89
call fcn.0052aeb8
test al, al
je 0x52af8c
mov eax, dword [0x549790]
mov eax, dword [eax + 0x108]
call fcn.0052ad68
test al, al
jne 0x52af9b
mov eax, 0x52b10c
call fcn.0052b434
jmp 0x52b061
mov eax, 0x52b134
call fcn.0052b434
jmp 0x52b061
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
je 0x52b057
mov eax, 0x52b160
call fcn.0052b434
push pe_nt_image_headers32
push 0x52b170
push esi
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x52b04f
mov eax, 0x52b188
call fcn.0052b434
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp byte [ebp - 1], 0
je 0x52b023
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0040b954
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x52b1a0
call fcn.00404e20
mov eax, dword [ebp - 0x2c]
call fcn.0052b434
jmp 0x52b049
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.0040b954
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x52b1ac
call fcn.00404e20
mov eax, dword [ebp - 0x34]
call fcn.0052b434
push edi
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x52b061
mov eax, 0x52b1bc
call fcn.0052b434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b083
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.00404b38
ret
Function at 0x52b5e0
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
cmp eax, 0x5e
ja case.default.0x52b5eb
jmp dword [eax*4 + 0x52b5f2]
mov dl, 2
mov eax, edx
ret
mov dl, 3
mov eax, edx
ret
mov dl, 5
mov eax, edx
ret
mov dl, 6
mov eax, edx
ret
mov dl, 7
mov eax, edx
ret
mov dl, 8
mov eax, edx
ret
mov dl, 9
mov eax, edx
ret
mov dl, 0xa
mov eax, edx
ret
mov dl, 0xb
mov eax, edx
ret
mov dl, 0xd
mov eax, edx
ret
mov dl, 0xc
mov eax, edx
ret
mov dl, 0xe
mov eax, edx
ret
mov dl, 0xf
mov eax, edx
ret
mov dl, 0x10
mov eax, edx
ret
mov dl, 0x11
mov eax, edx
ret
mov dl, 0x14
mov eax, edx
ret
mov dl, 0x15
mov eax, edx
ret
mov dl, 0x16
mov eax, edx
ret
mov dl, 0x18
mov eax, edx
ret
mov dl, 0x19
mov eax, edx
ret
mov dl, 0x1a
mov eax, edx
ret
mov dl, 0x1b
mov eax, edx
ret
mov dl, 0x1c
mov eax, edx
ret
mov dl, 0x1d
mov eax, edx
ret
mov dl, 0x1e
mov eax, edx
ret
mov dl, 0x1f
mov eax, edx
ret
mov dl, 0x20
mov eax, edx
ret
mov dl, 0x21
mov eax, edx
ret
mov dl, 0x22
mov eax, edx
ret
mov dl, 0x23
mov eax, edx
ret
mov dl, 0x24
mov eax, edx
ret
mov dl, 0x25
mov eax, edx
ret
mov dl, 0x26
mov eax, edx
ret
mov dl, 0x27
mov eax, edx
ret
mov dl, 0x28
mov eax, edx
ret
mov dl, 0x29
mov eax, edx
ret
mov dl, 0x2a
mov eax, edx
ret
mov dl, 0x2b
mov eax, edx
ret
mov dl, 0x2c
mov eax, edx
ret
mov dl, 0x2d
mov eax, edx
ret
mov dl, 0x2e
mov eax, edx
ret
mov dl, 0x2f
mov eax, edx
ret
mov dl, 0x30
mov eax, edx
ret
mov dl, 0x31
mov eax, edx
ret
mov dl, 0x32
mov eax, edx
ret
mov dl, 0x33
mov eax, edx
ret
mov dl, 0x34
mov eax, edx
ret
mov dl, 0x35
mov eax, edx
ret
mov dl, 0x36
mov eax, edx
ret
mov dl, 0x37
mov eax, edx
ret
mov dl, 0x38
mov eax, edx
ret
mov dl, 0x39
mov eax, edx
ret
mov dl, 0x3a
mov eax, edx
ret
mov dl, 0x3b
mov eax, edx
ret
mov dl, 0x3c
mov eax, edx
ret
mov dl, 0x3d
mov eax, edx
ret
mov dl, 0x3e
mov eax, edx
ret
mov dl, 0x3f
mov eax, edx
ret
mov dl, 0x40
mov eax, edx
ret
mov dl, 0x41
mov eax, edx
ret
mov dl, 0x42
mov eax, edx
ret
mov dl, 0x43
mov eax, edx
ret
mov dl, 0x44
mov eax, edx
ret
mov dl, 0x45
mov eax, edx
ret
mov dl, 0x46
mov eax, edx
ret
mov dl, 0x47
mov eax, edx
ret
mov dl, 0x49
mov eax, edx
ret
mov dl, 0x4a
mov eax, edx
ret
mov dl, 0x4b
mov eax, edx
ret
mov dl, 0x4c
mov eax, edx
ret
mov dl, 0x4d
mov eax, edx
ret
mov dl, 0x4e
mov eax, edx
ret
mov dl, 0x4f
mov eax, edx
ret
mov dl, 0x50
mov eax, edx
ret
mov dl, 0x51
mov eax, edx
ret
mov dl, 0x52
mov eax, edx
ret
mov dl, 0x53
mov eax, edx
ret
mov dl, 0x54
mov eax, edx
ret
mov dl, 0x55
mov eax, edx
ret
mov dl, 0x56
mov eax, edx
ret
mov dl, 0x57
mov eax, edx
ret
mov dl, 0x58
mov eax, edx
ret
mov dl, 0x59
mov eax, edx
ret
mov dl, 0x5a
mov eax, edx
ret
mov dl, 0x5b
mov eax, edx
ret
mov dl, 0x5c
mov eax, edx
ret
mov dl, 0x5d
mov eax, edx
ret
mov dl, 0x5e
mov eax, edx
ret
mov dl, 0x5f
mov eax, edx
ret
mov dl, 0x60
mov eax, edx
ret
mov dl, 0x61
mov eax, edx
ret
mov dl, 0x62
mov eax, edx
ret
mov dl, 0x63
mov eax, edx
ret
mov dl, 0x64
mov eax, edx
ret
mov dl, 0x65
mov eax, edx
ret
Function at 0x532b1c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fc4
mov eax, dword [ebp - 8]
call fcn.00404fc4
xor eax, eax
push ebp
push 0x532d9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x532db4
call fcn.0052b434
cmp byte [0x541e30], 0
je 0x532b7d
cmp byte [0x549d98], 0
jne 0x532b7d
cmp byte [0x541ec0], 0
je 0x532b8c
mov al, byte [0x541ec0]
xor al, 1
test al, bl
je 0x532ca9
push 0x532dcc
push dword [ebp - 4]
push 0x532e04
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404e94
mov eax, dword [ebp - 0xc]
call fcn.0052b434
mov eax, dword [0x549e1c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x54978c]
mov eax, dword [eax + 0x550]
xor edx, edx
call fcn.0043f060
xor eax, eax
push ebp
push 0x532c21
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
mov al, byte [0x532e08]
push eax
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00403300
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 4]
push 0x532e04
push dword [ebp - 8]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404e94
mov ecx, dword [ebp - 0x14]
xor eax, eax
pop edx
call fcn.00527fd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x532c98
mov eax, dword [0x542738]
mov eax, dword [eax]
call fcn.0047ecc8
jmp 0x532d76
push 0x532e64
push dword [ebp - 4]
push 0x532e04
push dword [ebp - 8]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404e94
mov eax, dword [ebp - 0x20]
call fcn.0052b434
mov edx, dword [ebp - 4]
mov eax, 0x532e9c
call fcn.00405118
test eax, eax
jg 0x532d01
mov edx, dword [ebp - 4]
mov eax, 0x532eac
call fcn.00405118
test eax, eax
jg 0x532d01
mov edx, dword [ebp - 4]
mov eax, 0x532ebc
call fcn.00405118
test eax, eax
jle 0x532d54
xor eax, eax
push ebp
push 0x532d4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.0052b1d0
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404fd4
push eax
mov eax, dword [ebp - 4]
call fcn.00404fd4
push eax
push 0x532ec4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532d76
xor eax, eax
call fcn.0052b1d0
ret
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404fd4
push eax
mov eax, dword [ebp - 4]
call fcn.00404fd4
push eax
push 0x532ec4
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x532ed4
call fcn.0052b434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532da2
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404b38
ret
Function at 0x532fc4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fc4
mov eax, dword [ebp - 8]
call fcn.00404fc4
xor eax, eax
push ebp
push 0x5330ec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x533100
push dword [ebp - 4]
push 0x533138
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404e94
mov eax, dword [ebp - 0xc]
call fcn.0052b434
test bl, bl
jne 0x533052
mov edx, dword [ebp - 4]
mov eax, 0x533144
call fcn.00405118
test eax, eax
jg 0x533052
mov edx, dword [ebp - 4]
mov eax, 0x533154
call fcn.00405118
test eax, eax
jg 0x533052
mov edx, dword [ebp - 4]
mov eax, 0x533164
call fcn.00405118
test eax, eax
jle 0x5330a5
xor eax, eax
push ebp
push 0x53309e
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.0052b1d0
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404fd4
push eax
mov eax, dword [ebp - 4]
call fcn.00404fd4
push eax
push 0x53316c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5330c7
xor eax, eax
call fcn.0052b1d0
ret
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404fd4
push eax
mov eax, dword [ebp - 4]
call fcn.00404fd4
push eax
push 0x53316c
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x53317c
call fcn.0052b434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5330f3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b38
ret