joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c932c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [eax + 0x190]
test al, al
jns 0x4c934e
or eax, 0xffffffff
jmp 0x4c9353
mov eax, dword [0x5c341c]
mov edx, dword [esi]
lea ecx, [ebp - 4]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x290]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x5c48e4
call fcn.00446047
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x4c93f0
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x4c93f0
cmp edi, ebx
je 0x4c93a5
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x200]
push eax
push 0x5c4f38
call fcn.00446047
pop ecx
pop ecx
mov ebx, eax
cmp dword [ebp - 8], 2
jne 0x4c93f9
test ebx, ebx
je 0x4c93dc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x198]
test al, 0x40
je 0x4c93f0
cmp dword [ebp - 4], 0
je 0x4c93dc
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x224]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, esi
jmp 0x4c93f2
mov eax, dword [esi]
push 5
push 0
push edi
mov ecx, esi
call dword [eax + 0x1d0]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 8], 3
jne 0x4c93f0
test edi, edi
je 0x4c93f0
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x15c]
test eax, eax
je 0x4c93f0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x164]
test eax, eax
je 0x4c93f0
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x218]
mov eax, dword [esi]
push 0
push 1
push 5
push edi
mov ecx, esi
call dword [eax + 0x328]
mov edx, dword [ebp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
jmp 0x4c93f2
Function at 0x4cccf3
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [0x5cf3fc], 1
push ebx
push esi
push edi
mov ebx, ecx
jne 0x4ccd22
or dword [0x5cf3fc], 1
mov ecx, 0x5cf3f8
call fcn.00402e10
push 0x56ff31
call fcn.0053ee30
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4ccd2e
call fcn.00443573
mov eax, dword [ebx + 0x318]
test eax, eax
je 0x4ccda7
cmp dword [eax + 0x20], 0
je 0x4ccda7
test eax, eax
je 0x4ccd45
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x4ccda7
mov eax, dword [edi + 4]
dec eax
je 0x4ccd86
dec eax
je 0x4ccd5c
dec eax
jne 0x4ccda7
mov esi, 0x428e
jmp 0x4ccd8b
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4ccd8b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x31c]
test eax, eax
je 0x4ccd8b
add esi, 3
jmp 0x4ccd8b
mov esi, 0x3ea0
push esi
mov ecx, 0x5cf3f8
call fcn.004027e0
test eax, eax
je 0x4ccd29
mov eax, dword [0x5cf3f8]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x4ccda9
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4cd788
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
xor ecx, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebx + 0x9c], ecx
cmp dword [ebx + 0x90], ecx
je 0x4cd808
cmp dword [ebp + 0xc], ecx
jne 0x4cd808
cmp dword [ebx + 0x94], ecx
jne 0x4cd808
mov eax, dword [ebx + 0x20]
cmp eax, ecx
je 0x4cd7fe
cmp eax, 0xffffffff
je 0x4cd7fe
lea eax, [ebp - 8]
push eax
call esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call edi
push dword [ebp - 4]
lea ecx, [ebx + 0xc8]
push dword [ebp - 8]
call fcn.0041def0
mov dword [ebx + 0x9c], eax
test eax, eax
jne 0x4cd808
xor eax, eax
jmp 0x4cd948
mov dword [ebx + 0x9c], 1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xec]
test eax, eax
je 0x4cd843
cmp dword [ebp + 0xc], 0
jne 0x4cd843
lea eax, [ebp - 8]
push eax
call esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call edi
push dword [ebp - 4]
lea ecx, [ebx + 0xd8]
push dword [ebp - 8]
call fcn.0041def0
test eax, eax
jne 0x4cd7f7
xor ecx, ecx
cmp dword [ebx + 0x9c], ecx
jne 0x4cd869
mov eax, dword [ebx + 0x20]
cmp eax, ecx
jbe 0x4cd869
cmp eax, 0xffffffff
je 0x4cd869
cmp dword [ebx + 0x90], ecx
jne 0x4cd869
cmp dword [ebx + 0xa8], ecx
je 0x4cd7f7
push dword [ebx + 0x6c]
push 0x5c4778
call fcn.00446047
lea esi, [ebx + 0x8c]
mov dword [ebp - 4], eax
mov eax, dword [esi]
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x4cd8a2
mov dword [eax + 0xf8], edi
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x60]
mov ecx, dword [ebp - 4]
mov dword [esi], edi
cmp ecx, edi
je 0x4cd908
push edi
jmp 0x4cd903
push dword [ebx + 0x6c]
push 0x5c43b8
call fcn.00446047
pop ecx
pop ecx
cmp dword [ebp + 0xc], edi
je 0x4cd8ce
cmp eax, edi
je 0x4cd8ce
cmp dword [0x5cdccc], edi
jne 0x4cd8ce
push 1
push ebx
mov ecx, eax
call fcn.004b6609
jmp 0x4cd8fb
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x4cd8e6
push edi
call fcn.00467814
cmp eax, edi
je 0x4cd8e6
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x58]
push dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test eax, eax
je 0x4cd7f7
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x4cd908
push ebx
call fcn.0046a3d9
cmp dword [ebx + 0x6c], edi
je 0x4cd945
lea esi, [ebx + 0x54]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0045abc0
mov eax, dword [eax + 0x94]
push eax
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push 0x401
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x6c]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4e0f75
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x565361
call fcn.00541110
xor edi, edi
cmp dword [0x5c42b4], edi
je 0x4e103e
cmp dword [0x5c4de4], 0xfffffffe
jne 0x4e102b
cmp dword [ebp + 8], 0xffffffff
je 0x4e103e
test byte [0x5cf7bc], 1
mov esi, 0x5cf79c
jne 0x4e0fd4
or dword [0x5cf7bc], 1
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.004789f0
push 0x56ffb1
call fcn.0053ee30
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, esi
call fcn.00478a47
cmp dword [0x5cf798], edi
je 0x4e0fe8
call fcn.00443573
push edi
push edi
push 0x4e0f1d
call fcn.005452f0
add esp, 0xc
mov dword [0x5cf798], eax
cmp eax, edi
jbe 0x4e1018
cmp eax, 0xffffffff
je 0x4e1018
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
mov dword [0x5c4de4], eax
jmp 0x4e101e
mov dword [0x5cf798], edi
push 0x5cf7a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4e103e
mov eax, dword [ebp + 8]
mov dword [0x5c4de4], eax
cmp eax, 0xffffffff
jne 0x4e103e
mov dword [0x5cf798], edi
call fcn.005411e8
ret
Function at 0x5199d8
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x56774b
call fcn.00541179
mov esi, ecx
mov dword [ebp - 0x22c], esi
call fcn.0051f425
push 0x15c
call fcn.00441d3d
pop ecx
mov ecx, eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x519a1c
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.00520894
jmp 0x519a1e
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.0051f3f7
call fcn.00451c08
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
xor eax, eax
mov dword [ebp - 0x228], esi
mov word [ebp + esi*2 - 0x218], ax
mov dword [ebp - 0x224], ebx
cmp edi, ebx
je 0x519bbe
cmp dword [edi + 4], ebx
jle 0x519bbe
lea ecx, [ebp - 0x21c]
call fcn.00402e10
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x519ba2
lea ecx, [ebp - 0x220]
call fcn.00402e10
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x519af3
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__s
push eax
call fcn.004030a0
add esp, 0xc
jmp 0x519b25
jge 0x519b13
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push str._d__s
push eax
call fcn.004030a0
add esp, 0x10
jmp 0x519b25
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.004090a0
push 0x15c
call fcn.00441d3d
pop ecx
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x519b49
mov ecx, eax
call fcn.004f2878
mov esi, eax
jmp 0x519b4b
xor esi, esi
push dword [ebp - 0x220]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.00452d24
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x22c]
push esi
call fcn.0051f3f7
mov ecx, dword [ebp - 0x220]
inc dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402e60
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00402e60
inc ebx
cmp ebx, dword [edi + 4]
jl 0x519a8c
call fcn.005411fc
ret
Function at 0x51e588
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x51e5a0
mov edi, dword [esi + 0xc]
jmp 0x51e5e0
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x51e5b9
call fcn.004440b4
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x51e5ce
call fcn.004440b4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x51e5e0
call fcn.004440b4
call fcn.00451c08
cmp dword [eax + 0x3c], 0
je 0x51e5f5
push edi
mov ecx, ebx
call fcn.0051d46b
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0051e4ae
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x51e613
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x51e61f
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x524fe1
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x52502b
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x52502b
call fcn.0052489c
test eax, eax
je 0x52502b
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.0040e7f0
xor eax, eax
inc eax
jmp 0x525243
cmp dword [ebx + 4], 0x100
push edi
jne 0x52523a
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x525128
push 0x11
call edi
test ax, ax
jl 0x525128
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x525128
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x52509b
cmp eax, 0x20
jbe 0x525128
cmp eax, 0x24
jbe 0x52508e
cmp eax, 0x26
je 0x52508e
cmp eax, 0x28
jne 0x525128
call fcn.0052489c
test eax, eax
je 0x525128
mov ecx, esi
call fcn.0044d3b7
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.0052489c
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x5250d0
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0040e7f0
jmp 0x525235
call fcn.00439310
test eax, eax
je 0x525235
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.0044b368
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x5250fe
xor edi, edi
jmp 0x525101
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.00439310
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x525235
mov eax, dword [ebx + 8]
sub eax, 9
je 0x525204
sub eax, 0x12
je 0x5251dc
sub eax, 0xb
je 0x52514a
dec eax
dec eax
jne 0x52523a
push 0x12
call edi
test ax, ax
jl 0x52523a
push 0x11
call edi
test ax, ax
jl 0x52523a
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x52523a
call fcn.0052489c
test eax, eax
jne 0x525235
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.00524846
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.00449cba
test eax, eax
je 0x525235
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.00449cba
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x525235
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x5251f0
push 0
call fcn.00524846
mov ecx, esi
call fcn.0044ae15
test eax, eax
je 0x52523a
mov ecx, esi
call fcn.0044ae15
jmp 0x52522e
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.00449cba
test eax, eax
je 0x52523a
push dword [esi + 0x20]
call edi
push eax
call fcn.00449cba
push 0
push esi
mov ecx, eax
call fcn.00441f23
mov ecx, eax
call fcn.0044d3b7
xor eax, eax
inc eax
jmp 0x525242
push ebx
mov ecx, esi
call fcn.00447b73
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x5313a2
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x564e76
call fcn.00541110
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0x100
jne 0x53147b
mov ebx, dword [esi + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x53147b
cmp ebx, 0x43
je 0x5313e4
cmp ebx, 0x2d
jne 0x53147b
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x53147b
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x10]
call fcn.00402e10
movzx ecx, byte [edi + 0xae]
and dword [ebp - 4], 0
push ecx
lea eax, [edi + 0xac]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push eax
lea eax, [ebp - 0x10]
push str.RGB__d___d___d_
push eax
call fcn.004030a0
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
add esp, 0x14
lea eax, [eax + eax + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00402e60
mov esi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.004b535f
call fcn.005411e8
ret 4

Function at 0x539506
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x53954b
test edi, edi
jl 0x53954b
cmp ax, 0x20
je 0x539540
cmp word [ebp + 8], 0x71
jne 0x53954b
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x53e694
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5c6590]
jne 0x53e69e
repz ret
jmp fcn.00546b46
Function at 0x555fa9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005464aa
and dword [ebp - 4], 0
cmp dword [0x5d1508], 0
mov ebx, eax
jne 0x55605a
push 0x598f9c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x55610b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x55610b
push eax
call fcn.00546438
mov dword [esp], 0x598f80
push edi
mov dword [0x5d1508], eax
call esi
push eax
call fcn.00546438
mov dword [esp], 0x598f6c
push edi
mov dword [0x5d150c], eax
call esi
push eax
call fcn.00546438
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5d1510], eax
call esi
push eax
call fcn.00546438
pop ecx
mov dword [0x5d1518], eax
test eax, eax
je 0x55605a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00546438
pop ecx
mov dword [0x5d1514], eax
mov eax, dword [0x5d1514]
cmp eax, ebx
je 0x5560b2
cmp dword [0x5d1518], ebx
je 0x5560b2
push eax
call fcn.005464b3
push dword [0x5d1518]
mov esi, eax
call fcn.005464b3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5560b2
test edi, edi
je 0x5560b2
call esi
test eax, eax
je 0x5560a9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5560a9
test byte [ebp - 0xc], 1
jne 0x5560b2
or dword [ebp + 0x10], 0x200000
jmp 0x5560eb
mov eax, dword [0x5d150c]
cmp eax, ebx
je 0x5560eb
push eax
call fcn.005464b3
pop ecx
test eax, eax
je 0x5560eb
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5560eb
mov eax, dword [0x5d1510]
cmp eax, ebx
je 0x5560eb
push eax
call fcn.005464b3
pop ecx
test eax, eax
je 0x5560eb
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5d1508]
call fcn.005464b3
pop ecx
test eax, eax
je 0x55610b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x55610d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4034d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40350e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x403506
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x403510
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4034f6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4035e0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4035f6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x403611
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x40f15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x40f168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x40f14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x40f145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x40f145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x4204cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0x18], 0x4e52454b
mov dword [ebp - 0x14], 0x32334c45
mov dword [ebp - 0x10], 0x6c6c642e
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
mov eax, dword [eax + 0x80]
add eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp eax, 0
je 0x42057c
add eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00420485
cmp eax, 0
jne 0x420576
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0
je 0x420576
and eax, 0x80000000
jne 0x420570
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
add eax, 2
mov ebx, dword [ebp + 0xc]
push eax
push ebx
push eax
call fcn.00420485
cmp eax, 0
pop eax
jne 0x420570
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
sub eax, dword [ebx]
mov ebx, dword [ebx + 0x10]
add ebx, dword [ebp + 8]
add eax, ebx
mov eax, dword [eax]
leave
ret 8
add dword [ebp - 8], 4
jmp 0x42052a
add dword [ebp - 4], 0x14
jmp 0x420502
mov eax, 0
leave
ret 8

Function at 0x4206eb
Capabilities:
Check os version
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x50]
mov dword [ebp - 4], eax
push 4
push 0x3000
push dword [ebp - 4]
push 0
call fcn.00420226
call dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x54]
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0042044b
lea ebx, [ebp - 0x10]
push ebx
push 2
push eax
push dword [ebp - 0xc]
call fcn.00420234
call dword [eax]
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 6]
movzx esi, word [eax + 0x14]
add esi, dword [ebp - 8]
add esi, 0x18
cmp ecx, 0
je 0x420776
push esi
push ecx
mov eax, dword [ebp - 0xc]
add eax, dword [esi + 0xc]
mov ebx, dword [ebp + 8]
add ebx, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
push ecx
push ebx
push eax
call fcn.0042044b
pop ecx
pop esi
add esi, 0x28
dec ecx
jmp 0x420750
push dword [ebp - 0xc]
call fcn.004205cb
push dword [ebp - 0xc]
call fcn.00420630
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 6]
movzx esi, word [eax + 0x14]
add esi, dword [ebp - 8]
add esi, 0x18
cmp ecx, 0
je 0x4207c4
push esi
push ecx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x24]
and eax, 0xffff
push eax
push dword [esi + 8]
mov eax, dword [ebp - 0xc]
add eax, dword [esi + 0xc]
push eax
call fcn.00420234
call dword [eax]
pop ecx
pop esi
add esi, 0x28
dec ecx
jmp 0x420797
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xa4]
cmp eax, 5
jne 0x4207e2
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.004203b4
jmp 0x4207ed
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.0042031d
mov eax, dword [ebp - 0xc]
leave
ret 4