joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498404
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4984a6
cmp dword [ebx + 0x94], 0
jne 0x4984a0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x498350
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4984a0
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongW
test al, 8
je 0x498466
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4984a0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a868
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x498475
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4986c4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x570400]
cmp dword [eax + 0x170], 0
je 0x498829
test bl, bl
jne 0x498777
cmp dword [esi + 0x9c], 0
jne 0x49876c
mov eax, esi
call fcn.0049b5b4
push eax
push 0x4985d0
call sub.USER32.DLL_EnumWindows
cmp dword [esi + 0x44], 0
je 0x49873d
mov eax, dword [0x570400]
cmp byte [eax + 0xd3], 0
je 0x49873d
mov eax, dword [esi + 0xd8]
call fcn.004510ec
mov edi, eax
cmp edi, 0
jl 0x49873d
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.USER32.DLL_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x498726
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x49876c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041a868
push eax
call sub.USER32.DLL_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x49874c
inc dword [esi + 0x9c]
jmp 0x498829
cmp dword [esi + 0x9c], 0
jle 0x498829
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x498829
cmp dword [esi + 0x44], 0
je 0x4987d4
mov eax, dword [0x570400]
cmp byte [eax + 0xd3], 0
je 0x4987d4
mov eax, dword [esi + 0xd8]
call fcn.004510ec
mov edi, eax
cmp edi, 0
jl 0x4987d4
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.USER32.DLL_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4987bd
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x498803
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041a868
push eax
call sub.USER32.DLL_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4987e3
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x48b844]
call fcn.004512ac
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x499478
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4994e3
cmp byte [ebx + 0xd3], 0
jne 0x4994e3
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.USER32.DLL_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0044fb38
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4994d0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4994f0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0044f9fc
jmp 0x4994f0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0044f9fc
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x49ad18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x49ad86
mov eax, esi
call fcn.004bd478
test al, al
je 0x49ad86
mov eax, dword [ebx + 0x84]
call fcn.004bd0cc
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x49ad86
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x49ad7a
push 0
mov eax, dword [ebx + 0x84]
call fcn.004bd0cc
push eax
call sub.USER32.DLL_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004b40a0
jmp 0x49ad86
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0049ab50
pop esi
pop ebx
ret
Function at 0x4b16e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x5704c4], 0
je 0x4b1829
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x56aa28]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x4b1829
mov eax, dword [0x5704c8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5704c4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4b17f8
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x5704c4]
call fcn.0041a868
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4b17f0
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ea], 0
je 0x4b17f0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x4b17f0
mov eax, dword [ebp - 0x14]
call fcn.004bd0cc
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4b17f0
push ebp
call fcn.004b16a4
pop ecx
test al, al
jne 0x4b17f0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.0044e0a0
test al, al
je 0x4b17f0
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.0044e0a0
cmp byte [ebp - 1], 0
je 0x4b17f0
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0042e6f8
test al, al
je 0x4b17f0
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5704c8]
call fcn.004b0dfc
inc edi
dec ebx
jne 0x4b174d
mov eax, dword [0x5704c8]
cmp dword [eax + 8], 0
jle 0x4b1810
mov eax, dword [0x5704c8]
call fcn.004b0eb4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b1829
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004b1508
pop ecx
test al, al
jne 0x4b1829
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b9c78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.USER32.DLL_GetMessagePos
call fcn.0042e6e0
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.004b3cb0
test ebx, ebx
jne 0x4b9ccb
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.004b9af4
mov ebx, eax
test ebx, ebx
je 0x4b9dc1
cmp esi, ebx
je 0x4b9cf4
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4b9d09
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4b9d41
add eax, 0xffffff5f
sub eax, 2
jb 0x4b9d59
dec eax
sub eax, 2
jb 0x4b9d6d
dec eax
sub eax, 2
jb 0x4b9d63
jmp 0x4b9d77
add eax, 0xfffffdff
sub eax, 2
jb 0x4b9d59
dec eax
sub eax, 2
jb 0x4b9d6d
dec eax
sub eax, 2
jb 0x4b9d63
jmp 0x4b9d77
mov byte [esp + 0x120], 0
jmp 0x4b9d7f
mov byte [esp + 0x120], 2
jmp 0x4b9d7f
mov byte [esp + 0x120], 1
jmp 0x4b9d7f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.USER32.DLL_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0048da1c
mov esi, eax
call fcn.004b04e8
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004b5670
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4b9dc3
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4d0a28
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x57053c], 0
jne 0x4d0a4b
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x4d099c
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExW
mov dword [0x57053c], eax
ret

Function at 0x4d2024
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4d2111
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4d20e3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
xor edx, edx
push ebp
push 0x4d20d2
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.0044d3a0
mov eax, dword [ebp - 4]
call fcn.004d1d64
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.USER32.DLL_SetClipboardData
test eax, eax
jne 0x4d20bb
mov ecx, dword [0x56ace0]
mov dl, 1
mov eax, dword [0x40f4e0]
call fcn.0043aa4c
call fcn.0044e8ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d20d9
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
Function at 0x4d2348
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4d23f0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x4d23c3
mov edx, ebx
mov eax, dword [0x476f40]
call fcn.0047f270
test al, al
je 0x4d23b3
movzx eax, bx
push eax
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0047f188
call fcn.0044e9e0
jmp 0x4d23f7
movzx eax, bx
push eax
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x4d237b
mov ecx, dword [0x56ade4]
mov dl, 1
mov eax, dword [0x4d1c78]
call fcn.0043aa4c
call fcn.0044e8ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d23f7
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4d2400
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4d245c
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov dx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2463
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4d246c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4d24c1
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d24c8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4d2538
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4d25ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d1d64
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0047f24c
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4d2597
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d25b4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4d25bc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4d2631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d1d64
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4d261b
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2638
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x550aec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x550b08
call fcn.00551c64
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x550b27
test bl, 1
je 0x550b27
call fcn.005582d4
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x554a78
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.0054f850
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.0054f950
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0054f950
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x56920d
lea ecx, [ebp - 0x200]
push ecx
call fcn.0054f850
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.0054f950
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.00555f18
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x554b89
push esi
call fcn.0054f950
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0054f950
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0054eacc
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x554b60
xor eax, eax
jmp 0x554c10
push esi
call fcn.0054f950
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0054f950
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.0054f77f
add esp, 0xc
jmp 0x554bc9
mov edi, dword [ebx + 0x24]
push edi
call fcn.0054f950
pop ecx
push eax
push esi
call fcn.0054f950
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0054f950
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0054eaec
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x554bc9
xor eax, eax
jmp 0x554c10
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.0054f850
add esp, 8
push 0x56920f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0054f850
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.0054f850
add esp, 8
push 0x569211
mov edx, dword [ebx + 0x24]
push edx
call fcn.0054f850
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x558268
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x558295
jmp 0x5582cc
call fcn.00558218
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0054f950
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0054f950
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x558350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x56984c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x55842a
cmp dword [0x569848], 0
jne 0x55842a
cmp dword [0x569a48], 0
je 0x5583e4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00557d20
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5583ca
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00557d20
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5583ca
lea ebx, [ebp - 0x84]
jmp 0x5583cb
inc ebx
call fcn.00558308
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x558465
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x569850
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0054f950
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x569853
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x558465
cmp dword [0x569848], 0
je 0x558444
cmp dword [0x569848], 0xffffffff
je 0x558465
push esi
call dword [0x569848]
pop ecx
mov eax, dword [0x56984c]
test eax, eax
je 0x558465
cmp dword [0x56984c], 0xffffffff
je 0x558465
cmp byte [eax], 0
je 0x558465
push esi
push eax
call fcn.00558268
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x558cfc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x571424], 0
jne 0x558d7d
cmp dword [0x571444], 0
jne 0x558d2c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x571444], eax
test eax, eax
jne 0x558d2c
push str.GetEnvironmentStrings_failed
call fcn.0055847c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x571444]
jmp 0x558d40
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0054f950
pop ecx
mov edi, eax
test eax, eax
jne 0x558d38
lea edi, [ebp + 1]
push edi
call fcn.0054eacc
pop ecx
mov ebx, eax
mov dword [0x571428], ebx
test ebx, ebx
jne 0x558d6a
xor eax, eax
jmp 0x558e40
push edi
mov edx, dword [0x571444]
push edx
push ebx
call fcn.0054f598
add esp, 0xc
jmp 0x558d9d
xor esi, esi
mov ebx, dword [0x571424]
jmp 0x558d97
push eax
call fcn.0054f950
pop ecx
test eax, eax
jne 0x558d93
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x558d87
lea ebx, [esi + 4]
push 4
mov dword [0x57142c], ebx
inc ebx
push ebx
call fcn.0054ea30
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x558dc0
xor eax, eax
jmp 0x558e40
cmp dword [0x571424], 0
jne 0x558df1
xor esi, esi
mov ebx, dword [0x571428]
mov eax, dword [esp]
mov ebp, eax
jmp 0x558de2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0054f950
pop ecx
mov edi, eax
test eax, eax
jne 0x558dd8
jmp 0x558e22
xor esi, esi
mov ebx, dword [0x571424]
mov eax, dword [esp]
mov edi, eax
jmp 0x558e1c
push eax
call fcn.0054f950
pop ecx
test eax, eax
je 0x558e11
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x558e15
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x558e00
mov eax, dword [0x571424]
test eax, eax
je 0x558e32
push eax
call fcn.0054eadc
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x571424], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401a46
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x401a7b
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x401a78
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x401a84
add edx, 0x28
cmp edx, esi
jne 0x401a66
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x401a81

Function at 0x401ec9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401f08
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401f08
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401f08
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401f08
cmp dword [ecx + 0x74], 0xe
jbe 0x401f08
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407b34
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x407bd1
push ebx
push esi
call fcn.00407afd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407a93
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x407b7e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407bd0
push edi
push eax
call fcn.00405cc0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x407b9e
call fcn.00405c70
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407bcf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407a93
add esp, 0x20
test eax, eax
jne 0x407bbd
push edi
call fcn.00405c70
jmp 0x407bc5
push ebx
call fcn.00405c70
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40ea30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40ea5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ea5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219