joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565e4a
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x5a1a61
call fcn.005348dc
push ecx
mov al, byte [ebp + 0xb]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push fcn.0058e1df
push 0x565efc
push 2
push 0xc
lea eax, [esi + 0x10]
push eax
mov dword [ebp - 4], ebx
call fcn.0053579e
mov eax, dword [ebp + 8]
mov dword [esi + 0x2c], eax
mov eax, dword [0x5a9b80]
mov dword [esi + 0x30], eax
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], ebx
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ebp - 4], 1
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.00567995
push 0x18
lea eax, [esi + 0x48]
push ebx
push eax
mov byte [ebp - 4], 2
call fcn.00535700
add esp, 0xc
mov dword [esi + 0x60], 0x461c4000
mov dword [esi + 0x64], 0xc61c4000
call fcn.00569124
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x2c]
cmp dword [eax + 0x504], 1
sete al
mov byte [esi + 0x68], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x5663dc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5a1af4
call fcn.005348dc
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
or dword [esi + 0x10], 0xffffffff
or dword [esi + 0xc], 0xffffffff
lea ecx, [esi + 0x60]
mov dword [ebp - 4], 3
call fcn.00489cf0
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call fcn.00489cf0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 1
call fcn.0058e1df
and byte [ebp - 4], 0
lea ecx, [esi + 0x30]
call fcn.0058e1df
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x1c]
call fcn.00489cf0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x567d58
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x5a1bac
call fcn.005348dc
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov cl, byte [eax]
push esi
mov byte [ebx], cl
push edi
mov esi, eax
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov cl, byte [eax + 0x14]
mov byte [ebx + 0x14], cl
mov ecx, dword [eax + 0x18]
add eax, 0x1c
mov dword [ebx + 0x18], ecx
push eax
lea ecx, [ebx + 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.00426078
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2c]
and dword [ebp - 4], 0
mov dword [ebx + 0x2c], eax
lea eax, [esi + 0x30]
push eax
lea ecx, [ebx + 0x30]
call fcn.0056718b
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
lea eax, [esi + 0x40]
push eax
lea ecx, [ebx + 0x40]
mov byte [ebp - 4], 1
call fcn.0056718b
lea eax, [esi + 0x4c]
push eax
lea ecx, [ebx + 0x4c]
mov byte [ebp - 4], 2
call fcn.00426078
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x5c], eax
lea eax, [esi + 0x60]
push eax
lea ecx, [ebx + 0x60]
mov byte [ebp - 4], 3
call fcn.00426078
mov eax, dword [esi + 0x70]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
pop edi
mov dword [ebx + 0x74], eax
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x569156
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5a1c21
call fcn.005348dc
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], 0x5a9bd4
mov al, byte [ebp - 0xd]
xor ebx, ebx
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
mov byte [edi], al
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x14]
mov byte [ecx], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 4], 1
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.005698de
mov al, byte [ebp - 0xd]
mov byte [esi + 0x24], 1
mov byte [esi + 0x25], 1
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov ecx, edi
mov byte [ebp - 4], 3
mov dword [esi], 0x5a9bb8
call fcn.004af3c5
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x5738cc
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x5a2a0a
call fcn.005348dc
push ecx
push esi
push dword [ebp + 0x1c]
mov esi, ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push 4
call fcn.0055aa17
and dword [ebp - 4], 0
lea ecx, [esi + 0x30]
call fcn.00585688
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
mov dword [esi + 0x34], eax
call fcn.0056e937
lea ecx, [esi + 0x40]
call fcn.00585688
push dword [ebp + 0x10]
mov ecx, dword [esi + 0x18]
mov byte [ebp - 4], 2
mov dword [esi], fcn.0055af2c
call fcn.00409d71
mov ecx, dword [esi + 0x18]
call fcn.00409bd5
mov ecx, dword [esi + 0x18]
call fcn.00409caa
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x579b3a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5a3036
call fcn.005348dc
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.00586cf1
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [ebx + 0xc], eax
push 0
lea eax, [esi + 0x24]
push eax
mov dword [ebx + 8], ecx
call fcn.0056ae36
fldz
and byte [ebx + 0x14], 0
mov dword [ebx + 0x10], eax
fstp dword [ebx + 0x18]
fldz
fstp dword [ebx + 0x1c]
fldz
fstp dword [ebx + 0x20]
fldz
fstp dword [ebx + 0x24]
fldz
fstp dword [ebx + 0x28]
mov edi, dword [esi + 0xc]
mov eax, edi
imul eax, eax, 0x124
add eax, 4
push eax
call fcn.00533fdc
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x579bd3
push fcn.00579d16
push 0x579c5a
push edi
mov dword [eax], edi
add eax, 4
push 0x124
push eax
mov dword [ebp + 8], eax
call fcn.0053579e
mov eax, dword [ebp + 8]
jmp 0x579bd5
xor eax, eax
and byte [ebp - 4], 0
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0xc]
lea eax, [eax + eax*2]
shl eax, 2
push eax
call fcn.00533fdc
fldz
mov dword [ebx + 0x30], eax
fstp dword [ebx + 0x54]
fldz
pop ecx
fstp dword [ebx + 0x58]
push 0x21
fldz
pop ecx
lea edi, [ebx + 0x6c]
fstp dword [ebx + 0x5c]
lea eax, [ebx + 0x44]
fldz
push eax
lea eax, [ebx + 0x34]
fstp dword [ebx + 0x60]
push eax
fldz
push 1
fstp dword [ebx + 0x64]
fldz
fstp dword [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
fild dword [ebx + 0xb8]
push dword [ebx + 0xb0]
mov dword [ebx], 0x5aa6a8
push ecx
fstp dword [esp]
push ecx
fild dword [ebx + 0xb4]
mov ecx, dword [ebx + 8]
fstp dword [esp]
call fcn.0056b09c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x57a66e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5a305c
call fcn.005348dc
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.00586cf1
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [ebx + 0xc], eax
push 0
lea eax, [esi + 0x10]
push eax
mov dword [ebx + 8], ecx
call fcn.0056ae36
mov dword [ebx + 0x10], eax
call fcn.004f22f0
fld dword [0x5a5768]
and byte [ebx + 0x1c], 0
fst dword [ebx + 0x18]
fstp dword [ebx + 0x20]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x28], 1
fldz
fstp dword [ebx + 0x2c]
lea eax, [ebx + 0x44]
fldz
mov ecx, eax
fstp dword [ebx + 0x30]
mov edx, 0x80
fldz
fstp dword [ebx + 0x34]
fldz
fstp dword [ebx + 0x38]
fldz
fstp dword [ebx + 0x3c]
fldz
fstp dword [ebx + 0x40]
fldz
fstp dword [ecx]
fldz
add ecx, 0xc
dec edx
fstp dword [ecx - 8]
fldz
fstp dword [ecx - 4]
jne 0x57a6ee
mov dword [ebx + 0x744], eax
fld1
mov eax, dword [ebx + 0x14]
push 0x1b
pop ecx
lea edi, [ebx + 0x74c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], 0x5aa6d4
fstp dword [eax + 0x28]
mov eax, dword [ebx + 0x14]
fld1
fstp dword [eax + 0x14]
mov eax, dword [ebx + 0x14]
fld1
fstp dword [eax]
fldz
mov eax, dword [ebx + 0x14]
fstp dword [eax + 0x10]
fldz
mov eax, dword [ebx + 0x14]
fstp dword [eax + 8]
fldz
mov eax, dword [ebx + 0x14]
fstp dword [eax + 4]
fldz
mov eax, dword [ebx + 0x14]
fstp dword [eax + 0x24]
fldz
mov eax, dword [ebx + 0x14]
fstp dword [eax + 0x20]
fldz
mov eax, dword [ebx + 0x14]
fstp dword [eax + 0x18]
fldz
mov eax, dword [ebx + 0x14]
fstp dword [eax + 0x38]
fldz
mov eax, dword [ebx + 0x14]
fstp dword [eax + 0x34]
fldz
mov eax, dword [ebx + 0x14]
fstp dword [eax + 0x30]
mov eax, dword [ebx + 0x14]
or dword [eax + 0xc], 0x20003
fild dword [ebx + 0x784]
lea eax, [ebx + 0x6c4]
push eax
lea eax, [ebx + 0x644]
push eax
push dword [ebx + 0x788]
push dword [ebx + 0x77c]
push ecx
fstp dword [esp]
push ecx
fild dword [ebx + 0x780]
mov ecx, dword [ebx + 8]
fstp dword [esp]
call fcn.0056b09c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x57e948
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5a31fc
call fcn.005348dc
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.00586cf1
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ebx + 0xc], eax
push edi
lea eax, [esi + 0x15]
push eax
mov dword [ebp - 4], edi
mov dword [ebx + 8], ecx
call fcn.0056ae36
mov dword [ebx + 0x10], eax
call fcn.004f22f0
mov dword [ebx + 0x14], eax
call fcn.004f22f0
fldz
mov dword [ebx + 0x18], eax
fstp dword [ebx + 0x1c]
fldz
push 0x20
fstp dword [ebx + 0x20]
pop ecx
fldz
mov eax, ebx
fstp dword [ebx + 0x24]
fldz
fstp dword [ebx + 0x28]
fldz
fstp dword [ebx + 0x2c]
fldz
fstp dword [ebx + 0x30]
fld dword [0x5a5768]
fst dword [ebx + 0x34]
mov dword [ebx + 0x44], edi
fst dword [ebx + 0x38]
mov dword [ebx + 0x58], edi
fstp dword [ebx + 0x3c]
mov dword [ebx + 0x5c], edi
fldz
lea edi, [ebx + 0x6c0]
fstp dword [ebx + 0x40]
fldz
fstp dword [ebx + 0x48]
fldz
fstp dword [ebx + 0x50]
fldz
fstp dword [ebx + 0x54]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ebx], 0x5aa82c
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x5804d6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5a32a9
call fcn.005348dc
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.00586cf1
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [ebx + 0xc], eax
push 0
lea eax, [esi + 0x20]
push eax
mov dword [ebx + 8], ecx
call fcn.0056ae36
mov dword [ebx + 0x10], eax
call fcn.004f22f0
fldz
and byte [ebx + 0x18], 0
fstp dword [ebx + 0x1c]
push 0x586dde
fldz
fstp dword [ebx + 0x20]
push fcn.00586d42
fldz
push 2
mov dword [ebx + 0x14], eax
fstp dword [ebx + 0x24]
lea eax, [ebx + 0x30]
fld dword [0x5a5768]
push 0x10c
fst dword [ebx + 0x28]
push eax
fstp dword [ebx + 0x2c]
call fcn.0053579e
fldz
and byte [ebx + 0x280], 0
fstp dword [ebx + 0x284]
lea eax, [ebx + 0x284]
fldz
fstp dword [eax + 4]
push 0x23
pop ecx
fldz
lea edi, [ebx + 0x290]
fstp dword [eax + 8]
mov byte [ebp - 4], 1
rep movsd dword es:[edi], dword [esi]
fild dword [ebx + 0x2d8]
lea eax, [ebx + 0x270]
push eax
lea eax, [ebx + 0x260]
push eax
push 1
push dword [ebx + 0x2d0]
mov dword [ebx], 0x5aa89c
push ecx
fstp dword [esp]
push ecx
fild dword [ebx + 0x2d4]
mov ecx, dword [ebx + 8]
fstp dword [esp]
call fcn.0056b09c
mov ecx, dword [ebx + 0x318]
fldz
fstp dword [ebx + 0x24c]
lea eax, [ebx + 0x318]
fldz
mov eax, ecx
fstp dword [ebx + 0x250]
mov dword [ebx + 0x254], eax
fldz
lea eax, [ebx + 0x29c]
mov dword [ebx + 0x248], ecx
fstp dword [ebx + 0x258]
fldz
fstp dword [ebx + 0x25c]
fld dword [eax]
fld dword [ebx + 0x298]
lea ecx, [ebx + 0x298]
fstp dword [ebx + 0x130]
pop edi
fstp dword [ebx + 0x134]
pop esi
fld dword [eax]
mov eax, ebx
fld dword [ecx]
mov ecx, dword [ebp - 0xc]
fstp dword [ebx + 0x23c]
fstp dword [ebx + 0x240]
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x58ac6b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5a3b53
call fcn.005348dc
sub esp, 0x18
mov al, byte [ebp + 0xf]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x24], al
call fcn.00401321
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
push 1
lea ecx, [eax + 1]
pop edi
mov dword [esi], ecx
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], edi
call fcn.0058af7a
movsx eax, byte [eax]
cmp eax, ebx
jle 0x58acda
mov dword [ebp + 0x10], eax
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0058af7a
mov al, byte [eax]
xor al, 0x75
mov byte [ebp - 0x10], al
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
push edi
call fcn.0040b4c2
dec dword [ebp + 0x10]
jne 0x58acb2
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0058af7a
mov esi, dword [ebp + 8]
mov al, byte [ebp - 0x24]
push ebx
mov ecx, esi
mov byte [esi], al
call fcn.00401321
push dword [0x5a5498]
lea eax, [ebp - 0x24]
push ebx
push eax
mov ecx, esi
call fcn.00403575
mov dword [ebp - 0x14], edi
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00401321
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x58c144
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], 0x5a9ac4
call fcn.00535700
and dword [esi + 0x48], 0
and dword [esi + 0x44], 0
add esp, 0xc
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
pop esi
ret
Function at 0x822344
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov ebx, ecx
mov esi, dword [edi]
call dword [sym.imp.user32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
mov dword [edi + 0x16c], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x170], eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.user32.dll_ScreenToClient]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp ecx, dword [edi + 0x174]
jne 0x8223eb
cmp eax, dword [edi + 0x178]
jne 0x8223eb
push dword [ebx + 0x18]
mov esi, dword [sym.imp.user32.dll_GetAsyncKeyState]
call esi
push dword [ebx + 0x1c]
movzx eax, ax
shr eax, 0xf
mov dword [ebp + 8], eax
call esi
movzx esi, ax
mov eax, dword [ebp + 8]
shr esi, 0xf
cmp eax, dword [edi + 0x17c]
jne 0x85c1fe
cmp dword [ebp + 0xc], 0
je 0x8223ca
mov dword [edi + 0x17c], eax
cmp esi, dword [edi + 0x180]
jne 0x85c26a
cmp dword [ebp + 0xc], 0
je 0x8223e2
mov dword [edi + 0x180], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 1
mov dword [edi + 0x174], ecx
mov dword [edi + 0x178], eax
jl 0x822390
jmp 0x85c1ed
push eax
push ecx
push edi
push 0xfffffffffffffff5
mov ecx, ebx
call fcn.008a63d0
jmp 0x822390
cmp dword [ebp + 0xc], 1
jl 0x8223be
cmp byte [edi + 0x1a8], 0
je 0x8223be
mov ecx, ebx
push dword [ebp - 4]
push dword [ebp - 8]
push edi
test eax, eax
je 0x85c226
push 0xfffffffffffffff9
jmp 0x85c256
push 0xfffffffffffffff8
call fcn.008a63d0
cmp byte [edi + 0x184], 0
je 0x85c25b
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.user32.dll_GetWindowLongW]
mov ecx, ebx
push dword [ebp - 4]
push dword [ebp - 8]
push edi
test eax, 0x1000000
je 0x85c254
push 0xfffffffffffffffa
jmp 0x85c256
push 0xfffffffffffffff4
call fcn.008a63d0
mov eax, dword [ebp + 8]
mov byte [edi + 0x184], 0
jmp 0x8223be
cmp dword [ebp + 0xc], 1
jl 0x8223d6
mov ecx, ebx
push dword [ebp - 4]
push dword [ebp - 8]
push edi
test esi, esi
je 0x85c285
push 0xfffffffffffffff7
jmp 0x85c287
push 0xfffffffffffffff6
call fcn.008a63d0
jmp 0x8223d6
Function at 0x822a5b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push edi
mov edi, 0x8e67b0
jne 0x85c41c
mov ecx, dword [0x8e681c]
cmp ecx, 0xffffffff
je 0x822af4
mov eax, dword [0x8e6810]
xor edx, edx
push esi
mov eax, dword [eax + ecx*4]
mov esi, dword [eax]
mov ecx, dword [esi]
mov dword [ebp + 0xc], ecx
cmp byte [esi + 0x3a], dl
je 0x822a9f
mov byte [esi + 0x3a], dl
cmp dword [esi + 0x18c], edx
jge 0x85c433
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x85c475
je 0x822ac7
test edi, edi
je 0x822b15
cmp edi, 1
je 0x822ac7
cmp edi, 2
je 0x822b0c
cmp edi, 3
je 0x822b03
jle 0x822aeb
cmp edi, 5
jg 0x822af8
cmp byte [esi + 0x38], 0
jne 0x822b23
push edi
push ecx
call dword [sym.imp.user32.dll_ShowWindow]
cmp edi, 8
je 0x822ae7
cmp edi, 4
je 0x822ae7
push dword [ebp + 0xc]
call fcn.00824a35
mov byte [esi + 0x38], 1
xor eax, eax
inc eax
pop esi
pop edi
pop ebp
ret 8
xor eax, eax
jmp 0x822aef
cmp edi, 6
je 0x85c45d
jmp 0x822aeb
mov byte [esi + 0x38], 1
jmp 0x85c4ca
mov byte [esi + 0x38], 1
jmp 0x85c45d
push edx
push ecx
call dword [sym.imp.user32.dll_ShowWindow]
mov byte [esi + 0x38], 0
jmp 0x822aeb
xor eax, eax
jmp 0x822aee
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00822612
mov ecx, eax
mov dword [0x8e681c], ecx
jmp 0x822a74
cmp byte [esi + 0x198], dl
je 0x822a9f
push dword [esi + 0x194]
mov ecx, edi
push esi
call fcn.008ab958
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov byte [esi + 0x198], dl
jmp 0x822a9f
cmp byte [esi + 0x38], 0
je 0x822b23
push 6
push ecx
call dword [sym.imp.user32.dll_ShowWindow]
jmp 0x822aeb
mov eax, edi
sub eax, 9
je 0x85c4ca
sub eax, 0x37
je 0x85c4bc
dec eax
je 0x85c4b9
dec eax
je 0x85c4a9
dec eax
jne 0x822aeb
push edx
mov byte [esi + 0x39], dl
call dword [sym.imp.user32.dll_LockWindowUpdate]
push 1
push 0
push dword [esi]
call dword [sym.imp.user32.dll_InvalidateRect]
jmp 0x822aeb
push ecx
mov byte [esi + 0x39], 1
call dword [sym.imp.user32.dll_LockWindowUpdate]
jmp 0x822aeb
push edx
jmp 0x85c4be
push 1
push ecx
call dword [sym.imp.user32.dll_EnableWindow]
jmp 0x822aeb
cmp byte [esi + 0x38], 0
je 0x822b23
push edi
push ecx
call dword [sym.imp.user32.dll_ShowWindow]
push dword [ebp + 0xc]
call fcn.00824a35
jmp 0x822aeb
Function at 0x8235b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x82362f
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x82362f
xor eax, eax
xor ebx, ebx
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
push ebx
push edx
push ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x82362f
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x823614
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x823626
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x823612
xor al, al
jmp 0x823620
Function at 0x823b4c
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2002c
call fcn.00851b90
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.008277c7
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 6], al
mov byte [ebp - 5], al
lea eax, [ebp - 0x1002c]
push eax
push 0x7fff
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 7]
push eax
push dword [ebp + 8]
call fcn.00823778
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
jne 0x85d4ad
mov eax, dword [0x8e62e0]
test eax, eax
je 0x823c97
xor edi, edi
mov esi, 0x8e7290
inc edi
cmp eax, edi
je 0x85d4c7
lea eax, [ebp - 6]
push eax
push ecx
push 0x8e62e0
push 0x8e62f8
mov ecx, esi
call fcn.008273e5
test al, al
je 0x823ca0
mov al, byte [0x8e7290]
mov byte [0x8e62e4], al
mov al, byte [0x8e7291]
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2002c]
push eax
push 0x7fff
push dword [0x8e62f8]
call dword [sym.imp.kernel32.dll_GetFullPathNameW]
push dword [ebp - 0xc]
mov ecx, 0x8e62d0
call fcn.00827d2c
mov al, byte [ebp - 6]
mov dword [ebp - 0xc], eax
push dword [0x8e62e0]
push 0x8e62f8
call fcn.00830a8d
test eax, eax
jne 0x85d4e6
cmp byte [ebp - 5], 1
je 0x85d505
call fcn.00823a58
call fcn.008239e7
cmp byte [0x8e62e4], 0
jne 0x823c55
mov ecx, 0x8e6890
call fcn.008243db
push edi
mov ecx, 0x8e6310
call fcn.00830b30
cmp byte [0x8e62e4], 0
jne 0x823c73
mov ecx, 0x8e6890
call fcn.008244cb
mov ecx, esi
call fcn.0082743b
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x2c]
call fcn.00825a64
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
or dword [0x8e627c], 0xffffffff
jmp 0x823c7a
mov dword [0x8e627c], edi
jmp 0x823c7a
push 0x10
push 0x8d93f0
push str.This_is_a_third_party_compiled_AutoIt_script.
xor eax, eax
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
jmp 0x823c87
push 0xffffffffffffffff
push dword [0x8e62e8]
mov ecx, esi
push edi
call fcn.00827373
mov al, byte [0x8e6284]
mov byte [0x8e7292], al
jmp 0x823c16
mov ecx, esi
call fcn.0082743b
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
mov dword [0x8e627c], edi
jmp 0x823c87
call fcn.00884c03
test al, al
jne 0x823c38
cmp byte [ebp - 7], al
jne 0x823c38
lea ecx, [ebp - 0x2c]
call fcn.00824864
push 0x8d5d40
lea ecx, [ebp - 0x1c]
call fcn.00827f41
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x1c]
test al, al
je 0x85d55f
mov edi, 0x8d9424
push edi
call fcn.00827e0b
push 0x8e62f8
lea ecx, [ebp - 0x1c]
call fcn.00827c8e
push edi
lea ecx, [ebp - 0x1c]
call fcn.00827e0b
push 1
jmp 0x85d568
push dword [ebp + 8]
call fcn.00827e0b
push edi
lea eax, [ebp - 0x1002c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
push 0x8d9428
call dword [sym.imp.user32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.shell32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.00825a64
jmp 0x823c73
Function at 0x824a35
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.user32.dll_GetForegroundWindow]
mov ebx, dword [ebp + 8]
mov esi, eax
cmp ebx, esi
jne 0x85da81
xor eax, eax
inc eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
xor edi, edi
test esi, esi
jne 0x85da96
push edi
push str.Shell_TrayWnd
call dword [sym.imp.user32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.user32.dll_IsIconic]
test eax, eax
je 0x85daaa
push 9
push ebx
call dword [sym.imp.user32.dll_ShowWindow]
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.user32.dll_SetForegroundWindow]
test eax, eax
jne 0x85db85
push edi
push esi
mov esi, dword [sym.imp.user32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp + 8], eax
call esi
mov esi, dword [sym.imp.user32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
push 1
push edi
push dword [ebp + 8]
call esi
push 1
push dword [ebp - 4]
push edi
call esi
push ebx
call dword [sym.imp.user32.dll_SetForegroundWindow]
test eax, eax
jne 0x85db61
mov edi, dword [sym.imp.user32.dll_MapVirtualKeyW]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.user32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.user32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.user32.dll_AttachThreadInput]
mov edi, dword [ebp - 8]
test eax, eax
je 0x85db66
push 4
jmp 0x85db63
push 3
pop ebx
jmp 0x85db69
mov ebx, dword [ebp - 0xc]
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call esi
push 0
push edi
push dword [ebp + 8]
call esi
push 0
push dword [ebp - 4]
push edi
call esi
jmp 0x85db88
push 2
pop ebx
mov eax, ebx
pop edi
jmp 0x824a53