joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b0834
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5b087b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5b085e
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5b086f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5b087b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x5bb224
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x5bb245
test edi, 0x40000
je 0x5bb25f
test bl, bl
jne 0x5bb2e0
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x5bb2e0
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x5bb292
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x5bb2a7
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x5bb2b6
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x5bb2c7
cmp byte [esp + 2], 0
je 0x5bb2e0
cmp byte [esp + 2], 0
je 0x5bb2d8
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x5bb2e0
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5bb584
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x5bb5aa
mov eax, esp
push eax
push 0x5bb54c
call sub.user32.dll_EnumWindows
jmp 0x5bb5bd
mov eax, esp
push eax
push 0x5bb52c
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x5bb680
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x5bb6d0]
test bl, 4
je 0x5bb694
or si, 1
test bl, 8
je 0x5bb69d
or si, 4
test bl, 1
je 0x5bb6a6
or si, 8
test bl, 2
je 0x5bb6af
or si, 0x10
test bl, 0x10
je 0x5bb6b8
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bb6c8
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5bb6d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x5bb710]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bb6ef
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bb6ff
or bx, 4
test esi, 0x20000000
je 0x5bb70b
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5c4abc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5c4ace
add esp, 0xfffffff0
call fcn.00408578
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c060c
mov eax, dword [0x5dfbbc]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c4f88
mov eax, dword [0x5dfbcc]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c4f94
mov eax, ebx
call fcn.005c4fa0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x488a10]
call fcn.00407ec0
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x488a10]
call fcn.00407ec0
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x488a10]
call fcn.00407ec0
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x488a10]
call fcn.00407ec0
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x488a10]
call fcn.00407ec0
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5bf48c
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4f1b48]
call fcn.004f8070
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4f1b48]
call fcn.004f8070
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4f1b48]
call fcn.004f8070
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4f1b48]
call fcn.004f8070
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4f1b48]
call fcn.004f8070
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005c557c
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c53ac
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c53ac
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c53ac
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c53ac
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c53ac
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c4c4e
call fcn.004085d0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5c514c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c52f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5c52d8
mov dl, 1
mov eax, dword [0x48c3cc]
call fcn.004afc50
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409cdc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5c52c7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0052b600
test al, al
je 0x5c52ba
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5c5308
lea eax, [ebp - 0x394]
call fcn.00424144
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5c52ba
xor eax, eax
push ebp
push 0x5c52b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5c5378
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5c529c
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a824
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5c529c
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a824
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c52ba
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5c51bd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004afb74
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c52fe
lea eax, [ebp - 0x3a0]
call fcn.00409cdc
ret

Function at 0x5c5f04
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5e7140]
cmp byte [eax + 0xc5], 0
jne 0x5c5f76
cmp dword [0x5e7164], 0
jne 0x5c5f36
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x5dfa0c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5e7164], eax
cmp dword [0x5e7160], 0
jne 0x5c5f51
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5e7160], eax
cmp dword [0x5e7168], 0
jne 0x5c5f76
push esp
push 0
push 0
mov eax, dword [0x5dfa08]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5e7168], eax
pop edx
ret
Function at 0x5c6398
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c63af
add esp, 0xfffffff0
call fcn.00408578
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c060c
mov eax, dword [0x5dfa7c]
cmp byte [eax], 0
jne 0x5c63dc
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x5dfdc0]
cmp word [eax + 2], 0
jne 0x5c63f6
mov eax, dword [0x5dfdc0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c878c
mov eax, dword [0x5dfef4]
cmp word [eax + 2], 0
jne 0x5c6410
mov eax, dword [0x5dfef4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c8990
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4f1b48]
call fcn.004f8070
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5c8f08
mov dl, 1
mov eax, dword [0x488a10]
call fcn.00407ec0
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x488a10]
call fcn.00407ec0
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f68e4]
call fcn.005023b0
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5c6600
mov eax, dword [0x5dfc6c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.005028dc
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5c91f0
mov dl, 1
mov eax, dword [0x488a10]
call fcn.00407ec0
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5dfc6c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00423f44
test eax, eax
je 0x5c652a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00423d9c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00423f28
test eax, eax
je 0x5c6542
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a824
push ebx
push 0x5c8168
call fcn.005bb664
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5dfa7c]
cmp byte [eax], 0
jne 0x5c6593
mov eax, ebx
call fcn.005c67e4
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005c9428
mov eax, ebx
call fcn.005ca0b0
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c65f7
call fcn.004085d0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c6b28
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5c6bca
cmp dword [ebx + 0xac], 0
jne 0x5c6bc4
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c6a64
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c6bc4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c6b8a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c6bc4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004ab1dc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c6b99
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c6e84
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5e7140]
cmp dword [eax + 0x188], 0
je 0x5c6ffe
test bl, bl
jne 0x5c6f49
cmp dword [esi + 0xb4], 0
jne 0x5c6f3e
mov eax, esi
call fcn.005c9f00
push eax
push 0x5c6d78
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c6f0f
mov eax, dword [0x5e7140]
cmp byte [eax + 0xeb], 0
je 0x5c6f0f
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5c6ef0
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c6f0f
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c6ef8
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c6f3e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ab1dc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c6f1e
inc dword [esi + 0xb4]
jmp 0x5c6ffe
cmp dword [esi + 0xb4], 0
jle 0x5c6ffe
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c6ffe
cmp dword [esi + 0x58], 0
je 0x5c6fb3
mov eax, dword [0x5e7140]
cmp byte [eax + 0xeb], 0
je 0x5c6fb3
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5c6f94
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c6fb3
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c6f9c
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c6fe2
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ab1dc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c6fc2
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5b84a0]
call fcn.0040c0a8
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5c7c9c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5c7cf9
cmp byte [ebx + 0xeb], 0
jne 0x5c7cf9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e64
mov eax, dword [esi]
test eax, eax
je 0x5c7ce6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5c7d06
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0bc
jmp 0x5c7d06
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0bc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5c963c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5c96ad
mov eax, esi
call fcn.00525120
test al, al
je 0x5c96ad
mov eax, dword [ebx + 0x98]
call fcn.00524d4c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5c96ad
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x5c969e
push 0
mov eax, dword [ebx + 0x98]
call fcn.00524d4c
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0051b804
jmp 0x5c96ad
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005c9448
pop esi
pop ebx
ret
Function at 0x5cdfec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5ce06a
mov eax, dword [ebx + 8]
call fcn.00524d4c
mov ecx, eax
mov dl, 1
mov eax, dword [0x531340]
call fcn.0051eeb8
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.00535ffc
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5cd8bc
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00524d4c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00524d4c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5ce0e4
mov eax, dword [ebx + 8]
call fcn.00524d4c
mov ecx, eax
mov dl, 1
mov eax, dword [0x531340]
call fcn.0051eeb8
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.00535ffc
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5cd908
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00524d4c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00524d4c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5ce152
mov eax, dword [ebx + 8]
call fcn.00524d4c
mov ecx, eax
mov dl, 1
mov eax, dword [0x531ddc]
call fcn.0051eeb8
mov dword [ebx + 0x94], eax
mov eax, dword [ebx + 0x94]
mov byte [eax + 0x2a0], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.00524d4c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.00524d4c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x1002e7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1002e7df
pop dword [ebp - 0x10]
mov eax, 0x8e613581
add eax, 0x81a1b25e
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd7db0e45
sub dword [ebp - 0x20], 0x8988c8fa
mov dword [ebp - 0x1c], 0x95872dc
add dword [ebp - 0x1c], 0x28dad969
mov dword [ebp - 0x18], 0xd5255df0
add dword [ebp - 0x18], 0x7726e63e
mov dword [ebp - 0x14], 0xc1f29048
add dword [ebp - 0x14], 0x3e0d6fb8
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xbec99933
sub dword [ebp - 0x20], 0x4a572fdd
mov dword [ebp - 0x1c], 0x8408bc1a
add dword [ebp - 0x1c], 0xbd63a55b
mov dword [ebp - 0x18], 0xfe78bb8b
add dword [ebp - 0x18], 0x64f6b0e1
mov dword [ebp - 0x14], 0x99966579
sub dword [ebp - 0x14], 0x99966579
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x46d31
push 0
call eax
mov ecx, 0xf05b638
add ecx, 0xf0fa9122
mov edi, eax
mov esi, 0x3be527fd
sub esi, 0x2bdfb9fd
add esi, dword [ebp - 0x10]
mov ebx, 0x86c83a51
sub ebx, 0x9ef45b4e
xor dword [ebp - 8], edx
mov edx, dword [esi]
add dword [ebp - 0xc], ecx
sub edx, ebx
add dword [ebp - 8], 0xa583bc77
mov dword [edi], edx
sub dword [ebp - 8], 0x4b4804d9
add edi, 4
add esi, 0x35f5f0b0
add esi, 0xca0a0f54
loop 0x1002e8f7
add eax, 0x983e5057
sub eax, 0x983d401c
mov ebx, eax
add eax, 0x571879b8
sub eax, 0x571879b3
mov ecx, 0x767cffbb
sub ecx, 0x667cffbb
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10031820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004f37c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10031850
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10031880
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10031880
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1003197a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100318a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100318dd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1003197a
cmp eax, 1
jle 0x1003193b
cmp eax, 3
jne 0x1003197a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1002e7d0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031959
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003197a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1003197a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038620
mov esp, ebp
pop ebp
ret 4