joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ff68
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43006c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a0a0
lea eax, [ebp - 4]
call fcn.0040a234
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a974
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x430054
mov eax, ebx
call fcn.00407094
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x43004d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a974
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x430035
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x430080
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x430035
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430054
mov eax, dword [ebp - 0x10]
call fcn.004070b0
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430073
lea eax, [ebp - 4]
call fcn.00409c78
pop eax
jmp eax

Function at 0x431ac8
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040aa2c
add esp, 0x800
pop ebx
ret

Function at 0x431e6c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00409c78
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040a974
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x431eb1
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00409e00
jmp 0x431eca
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040ab04
push ebx
mov eax, dword [esi]
call fcn.0040a974
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43290c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x43292c
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x432946
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x432941
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x43294b
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x4329b9
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x432a02
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x432977
inc dword [ebp - 0xc]
jmp 0x43298f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x43298f
cmp dword [ebp - 0xc], 0
jle 0x43298f
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x4329b1
xor eax, eax
jmp 0x4329ad
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x4329ac
mov eax, esi
jmp 0x432a05
inc eax
cmp eax, ecx
jle 0x432999
inc esi
cmp esi, dword [ebp - 8]
jl 0x432963
jmp 0x432a02
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x432a02
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x4329da
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x4329fc
xor eax, eax
jmp 0x4329f8
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x4329f7
mov eax, esi
jmp 0x432a05
inc eax
cmp eax, ecx
jle 0x4329e4
inc esi
cmp esi, dword [ebp - 8]
jl 0x4329c2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x432de4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x432e03
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x432e13
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x432f35
test ebx, ebx
jl 0x432f35
test esi, esi
jle 0x432f35
mov eax, dword [ebp - 8]
call fcn.0040a974
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040a974
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x432ed2
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x432f35
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x432eb7
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x432e86
inc dword [ebp - 0x14]
jmp 0x432e96
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x432e96
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x432ea1
or eax, 0xffffffff
jmp 0x432eb7
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x432eb4
inc eax
jmp 0x432eb7
or eax, 0xffffffff
test eax, eax
jl 0x432ebf
cmp esi, eax
jg 0x432e74
cmp esi, eax
jg 0x432eca
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x432f38
inc edx
dec dword [ebp - 0x1c]
jne 0x432e70
jmp 0x432f35
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x432f35
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x432f1c
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x432efb
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x432f06
or eax, 0xffffffff
jmp 0x432f1c
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x432f19
inc eax
jmp 0x432f1c
or eax, 0xffffffff
test eax, eax
jl 0x432f24
cmp esi, eax
jg 0x432ee4
cmp esi, eax
jg 0x432f2f
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x432f38
inc edx
dec dword [ebp - 0x1c]
jne 0x432ee0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47a640
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x47a648
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4bdfd4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4be022
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004bd9a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4be03b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4be044
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004bd9a4
dec esi
jne 0x4be066
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4c08bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0xa7f904
cmp dword [edi], 0
jne 0x4c0938
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0xa7f900]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0xa5ca4c
mov ecx, 2
call fcn.004072d4
mov edx, 0x4c0894
lea eax, [esi + 5]
call fcn.004c08b4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004c08b4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4c090d
mov dword [0xa7f900], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x5faed0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
mov si, ax
test bl, 4
je 0x5faee2
or si, 1
test bl, 8
je 0x5faeeb
or si, 4
test bl, 1
je 0x5faef4
or si, 8
test bl, 2
je 0x5faefd
or si, 0x10
test bl, 0x10
je 0x5faf06
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5faf16
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5faf74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5faf8d
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5faf9d
or bx, 4
test esi, 0x20000000
je 0x5fafa9
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x5fb164
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5fb23d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409c78
test si, si
je 0x5fb225
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
shl edi, 0x10
test edi, edi
je 0x5fb1dc
mov eax, pe_nt_image_headers32
call fcn.00429fec
mov dword [ebp - 4], eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
push eax
push edi
call sub.user32.dll_GetKeyNameTextW
test eax, eax
jle 0x5fb1d4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a9d8
mov eax, dword [ebp - 4]
call fcn.0042a02c
cmp dword [ebx], 0
jne 0x5fb20d
push 0x5fb258
lea edx, [ebp - 8]
mov eax, esi
and ax, 0xff
movzx eax, ax
call fcn.00428784
push dword [ebp - 8]
push 0x5fb268
mov eax, ebx
mov edx, 3
call fcn.0040ac64
jmp 0x5fb225
push 0x5fb278
push dword [ebx]
push 0x5fb278
mov eax, ebx
mov edx, 3
call fcn.0040ac64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fb244
lea eax, [ebp - 8]
call fcn.00409c78
pop eax
jmp eax
Function at 0x5fc41c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc64
push ebx
xor eax, eax
mov dword [ebp - 0x39c], eax
xor eax, eax
push ebp
push 0x5fc5c4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0xa7fd4c], 0
jne 0x5fc5a3
mov dl, 1
mov eax, dword [0x4848a0]
call fcn.004ae450
mov dword [0xa7fd4c], eax
mov eax, 0xa7fd50
call fcn.00409c78
lea eax, [ebp - 0x110]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5fc593
inc eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
push eax
call sub.imm32.dll_ImmIsIME
test eax, eax
je 0x5fc586
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x394], 0
lea ecx, [ebp - 0x398]
mov edx, 0x5fc5d4
lea eax, [ebp - 0x390]
call fcn.0042a0d8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5fc586
xor eax, eax
push ebp
push 0x5fc57f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x200
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x310]
push eax
push 0
push 0
push 0x5fc644
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5fc566
lea eax, [ebp - 0x39c]
lea edx, [ebp - 0x310]
mov ecx, pe_nt_image_headers32
call fcn.0040aa2c
mov edx, dword [ebp - 0x39c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov eax, dword [0xa7fd4c]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [0xa7fd54]
jne 0x5fc566
mov eax, 0xa7fd50
lea edx, [ebp - 0x310]
mov ecx, pe_nt_image_headers32
call fcn.0040aa2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fc586
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
add dword [ebp - 0x10], 4
dec dword [ebp - 0xc]
jne 0x5fc488
mov eax, dword [0xa7fd4c]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004ae378
mov ebx, dword [0xa7fd4c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fc5cb
lea eax, [ebp - 0x39c]
call fcn.00409c78
pop eax
jmp eax

Function at 0x5fccc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5fcd4e
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthW
mov ebx, eax
test ebx, ebx
jle 0x5fcd12
lea edi, [ebx + 1]
push edi
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404d24]
call fcn.0040ccf8
add esp, 4
push edi
mov eax, dword [ebp - 4]
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov esi, dword [ebp - 4]
test esi, esi
je 0x5fcd1e
sub esi, 4
mov esi, dword [esi]
push ebx
mov eax, dword [ebp - 8]
push eax
mov edx, esi
dec edx
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00432690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fcd55
lea eax, [ebp - 4]
mov edx, dword [0x404d24]
call fcn.0040ce1c
pop eax
jmp eax
Function at 0x6a7670
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, edx
call fcn.004fad24
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x30]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.0051b53c
test al, al
je 0x6a77a7
xor edx, edx
push ebp
push 0x6a77a0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.0051a5a0
dec eax
test eax, eax
jl 0x6a7785
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0xc]
call fcn.0051a2d0
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0051a5dc
mov edi, eax
dec edi
test edi, edi
jl 0x6a7779
inc edi
mov eax, dword [ebp - 4]
call fcn.0051a5a8
mov edx, eax
mov eax, esi
call fcn.00847e40
mov ebx, eax
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
movzx eax, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x16]
imul edx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebp - 0x1a], al
movzx eax, byte [ebp - 0x13]
movzx edx, byte [ebp - 0x17]
imul edx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebp - 0x1b], al
movzx eax, byte [ebp - 0x14]
movzx edx, byte [ebp - 0x18]
imul edx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebp - 0x1c], al
movzx eax, byte [ebp - 0x11]
movzx edx, byte [ebp - 0x15]
imul edx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebp - 0x19], al
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0051a5a8
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.00847f2c
add esi, 4
dec edi
jne 0x6a76e9
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x6a76c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a77a7
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0051b614
pop eax
jmp eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7080e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0070804c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
call fcn.00501e94
xor eax, eax
push ebp
push 0x7081b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00703ff8
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
call fcn.00501f14
mov eax, dword [ebp - 4]
call fcn.00703ff8
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
call fcn.00502090
mov eax, dword [ebp - 4]
call fcn.00703ff8
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
call fcn.00501f44
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.007023f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 4]
call fcn.00707864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7081bb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
call fcn.00501d1c
pop eax
jmp eax
Function at 0x71e0ec
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, eax
push 0
mov eax, dword [ebx + 0x10]
push eax
call sub.user32.dll_ShowWindow
lea esi, [ebx + 0x8c]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x454
lea eax, [ebp - 0x10]
call fcn.00413650
push eax
lea eax, [ebp - 0x10]
call fcn.00413640
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0xfffffffffffffffe
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_SetWindowPos
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x80afcc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x22c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x80b162
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x228]
push eax
mov eax, dword [0xa774f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x228]
mov dx, 0x5c
call fcn.00429ed8
test eax, eax
je 0x80b029
lea edx, [eax + 2]
lea eax, [ebp - 0x228]
call fcn.00429d04
lea eax, [ebp - 0x228]
mov dx, 0x2e
call fcn.00429ebc
test eax, eax
je 0x80b041
mov word [eax], 0
lea eax, [ebp - 0x228]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [esi + 0x10]
lea edx, [ebp - 0x228]
mov ecx, pe_nt_image_headers32
call fcn.0040aa2c
mov eax, dword [0xa77a9c]
cmp dword [eax], 0
je 0x80b092
lea edx, [ebp - 0x22c]
mov eax, dword [0xa77a9c]
mov eax, dword [eax]
call fcn.00875260
mov edx, dword [ebp - 0x22c]
lea eax, [esi + 0xc]
call fcn.0040a058
jmp 0x80b09d
lea eax, [esi + 0xc]
mov edx, dword [esi + 0x10]
call fcn.0040a058
mov eax, dword [0xa7c634]
mov dword [0xa72a40], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0xa72a54]
push eax
mov eax, dword [0xa7c634]
push eax
call sub.user32.dll_GetClassInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
push 0x80b174
mov eax, dword [0xa774f4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov dword [0xa72a44], eax
test bl, bl
je 0x80b0e7
mov eax, 0x80998c
cmp eax, dword [ebp - 0x24]
je 0x80b106
test bl, bl
je 0x80b0fc
mov eax, dword [0xa7c634]
push eax
mov eax, dword [0xa72a54]
push eax
call sub.user32.dll_UnregisterClassW
push 0xa72a30
call sub.user32.dll_RegisterClassW
push 0x80020000
push 0
push 0
push 0
push 0
call sub.user32.dll_GetDesktopWindow
push eax
push 0
mov eax, dword [0xa7c634]
push eax
push 0
mov eax, dword [esi + 0xc]
call fcn.0040a974
mov ecx, eax
mov edx, dword [0xa72a54]
mov eax, 0x40100
call fcn.00418600
mov ebx, eax
push 1
push ebx
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x80b169
lea eax, [ebp - 0x22c]
call fcn.00409c78
pop eax
jmp eax
Function at 0x80e6dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 4], ecx
test dl, dl
je 0x80e6f3
add esp, 0xfffffff0
call fcn.004084dc
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x80e843
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00409c78
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00407f40
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.0040ab04
push 0x104
mov eax, dword [ebp - 4]
call fcn.0040a974
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea edx, [ebp - 4]
xchg edx, eax
call fcn.0040ab04
mov eax, dword [ebp - 8]
add eax, 0xc
mov edx, dword [ebp - 4]
call fcn.0040a058
mov eax, dword [ebp - 8]
add eax, 0x10
mov edx, 0x80e878
call fcn.0040a058
mov eax, dword [ebp - 8]
add eax, 0x14
mov edx, 0x80e894
call fcn.0040a058
mov eax, dword [ebp - 8]
mov byte [eax + 0x20], 1
mov eax, dword [0xa77204]
cmp dword [eax], 6
jg 0x80e815
mov eax, dword [0xa77204]
cmp dword [eax], 6
jne 0x80e799
mov eax, dword [0xa77920]
cmp dword [eax], 2
jge 0x80e815
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x80e8b0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x80e815
xor eax, eax
push ebp
push 0x80e80e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80e8f8
push 0x80e954
push 0x80e970
lea eax, [ebp - 4]
push eax
mov ecx, 0x80e998
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0080ea24
cmp dword [ebp - 4], 0
setne al
mov edx, dword [ebp - 8]
mov byte [edx + 0x20], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x80e815
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov eax, dword [ebp - 8]
call fcn.0080f6f8
mov edx, dword [ebp - 8]
mov byte [edx + 0x40], al
mov eax, dword [ebp - 8]
call fcn.0080efd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x80e84a
lea eax, [ebp - 4]
call fcn.00409c78
pop eax
jmp eax
Function at 0x80f520
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x80f5c0
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.005fcc38
call fcn.005fcbc8
xor eax, eax
push ebp
push 0x80f5a1
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00429988
mov eax, dword [ebp - 8]
call fcn.0040a974
push eax
push 0
mov eax, ebx
call fcn.0040a974
push eax
push 0x80f5d0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.shell32.dll_ShellExecuteW
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x80f5a8
call fcn.005fcc38
call fcn.005fcbfc
pop eax
jmp eax