joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41860d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 0x1b
jne 0x418632
mov edx, dword [0x55f674]
test edx, edx
je 0x418632
mov eax, edx
jmp 0x418709
push 2
movzx ecx, ax
push ecx
push ebx
call sub.KERNEL32.dll_FindResourceA
test eax, eax
jne 0x418649
xor eax, eax
jmp 0x418709
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
push eax
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
jne 0x418663
xor eax, eax
jmp 0x418709
lea edx, [ebx + 0x28]
mov dword [ebp - 0x18], edx
mov cx, word [ebx + 0xe]
mov eax, 1
shl eax, cl
shl eax, 2
add dword [ebp - 0x18], eax
mov edx, dword [ebx + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x14], eax
xor edi, edi
push 0
call sub.USER32.dll_GetDC
mov esi, eax
test esi, esi
je 0x418707
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4186ff
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
mov edi, eax
test edi, edi
je 0x4186f7
push edi
push dword [ebp - 8]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 4], eax
push 0xcc0020
push 0
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0
push 0
push dword [ebp - 8]
call sub.GDI32.dll_StretchDIBits
push dword [ebp - 4]
push dword [ebp - 8]
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
call sub.GDI32.dll_DeleteDC
push esi
push 0
call sub.USER32.dll_ReleaseDC
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41aafc
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [0x55f848], 0
jne 0x41abea
mov dword [0x55f848], 1
xor eax, eax
mov al, byte [ebp + 8]
cmp eax, 6
ja case.0x41ab25.0
jmp dword [eax*4 + 0x41ab2c]
cmp dword [0x55f844], 0
jne case.0x41ab25.0
push 0
push str.Shell_TrayWnd
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x41abb6
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x41ab91
cmp ebx, dword [0x56f018]
je 0x41ab91
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x41ab67
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x41ab67
cmp ebx, dword [0x56f018]
jne 0x41abb6
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x41abb6
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x41abb6
call fcn.0041abef
test eax, eax
jne case.0x41ab25.0
cmp dword [0x56a6a4], 0
je 0x41abd5
push 0
push 0
push 0x8043
push dword [0x56f018]
call sub.USER32.dll_PostMessageA
jmp case.0x41ab25.0
push 1
call fcn.0041aa4c
jmp case.0x41ab25.0
call fcn.0041a60c
xor eax, eax
mov dword [0x55f848], eax
pop ebx
pop ebp
ret 4

Function at 0x41abef
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebx
push 0x10
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x41ac0d
mov ebx, 1
jmp 0x41ac0f
xor ebx, ebx
push 0x11
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x41ac49
mov eax, dword [0x56a698]
test eax, eax
je 0x41ac35
mov dword [0x56a6a4], eax
jmp 0x41ac49
push 1
push 0
push 0x8043
push dword [0x56f018]
call sub.USER32.dll_PostMessageA
cmp dword [0x55f82c], 0
jne 0x41ac6b
cmp dword [0x55f828], 0
je 0x41ac63
test ebx, ebx
je 0x41ac6b
xor eax, eax
pop ebx
ret
test ebx, ebx
jne 0x41ac6b
xor eax, eax
pop ebx
ret
push 1
call fcn.0041b199
test eax, eax
jne 0x41ac7a
xor eax, eax
pop ebx
ret
cmp dword [0x55f828], 0
je 0x41acb2
test ebx, ebx
je 0x41ac96
push 6
push dword [0x56f018]
call sub.USER32.dll_ShowWindow
jmp 0x41acdf
push 6
push dword [0x56f018]
call sub.USER32.dll_ShowWindow
push 0
push dword [0x56f018]
call sub.USER32.dll_ShowWindow
jmp 0x41acdf
test ebx, ebx
je 0x41acd2
push 6
push dword [0x56f018]
call sub.USER32.dll_ShowWindow
push 0
push dword [0x56f018]
call sub.USER32.dll_ShowWindow
jmp 0x41acdf
push 6
push dword [0x56f018]
call sub.USER32.dll_ShowWindow
mov eax, 1
pop ebx
ret
Function at 0x41b578
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, 0x105
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push esi
push ebx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x41b5ac
mov eax, 0x3f3
jmp 0x41b5e4
push edi
lea edx, [ebp - 0x10c]
push edx
push 0
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegEnumKeyA
test eax, eax
jne 0x41b5d1
lea ecx, [ebp - 0x10c]
push ecx
push dword [ebp - 4]
call fcn.0041b578
test eax, eax
je 0x41b5ac
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
push esi
push ebx
call sub.ADVAPI32.dll_RegDeleteKeyA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41b5ed
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
push 0
push 0x20006
push 0
push 0x55f8d6
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallmIRC
push 0x80000002
call sub.ADVAPI32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
je 0x41b629
xor eax, eax
jmp 0x41b659
push esi
call fcn.0054e28c
pop ecx
inc eax
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x41b654
xor eax, eax
jmp 0x41b659
mov eax, 1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x41b756
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
call fcn.0054e1b0
add esp, 8
lea eax, [ebp - 0x140]
push eax
push ebx
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x41b78c
mov edi, 1
jmp 0x41b78e
xor edi, edi
push ebx
call fcn.0054e28c
pop ecx
push eax
push dword [ebp + 0xc]
call fcn.0054e28c
pop ecx
pop edx
sub edx, eax
mov byte [ebx + edx], 0
test edi, edi
jne 0x41b849
test byte [ebp - 0x140], 0x10
je 0x41b7cf
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x41b7a6
mov edi, 1
jmp 0x41b7a6
push esi
push edi
mov esi, 0x582088
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea eax, [ebp - 0x114]
push eax
push 0x582088
call fcn.0054e1b0
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x41b82b
push 0
push 0x582088
mov edx, dword [ebp + 0x10]
push dword [edx]
call fcn.004c6a18
test eax, eax
je 0x41b82b
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x41b841
mov edi, 1
test edi, edi
je 0x41b7ae
cmp esi, 0xffffffff
je 0x41b854
push esi
call sub.KERNEL32.dll_FindClose
push 0x55f964
push ebx
call fcn.0054e1b0
add esp, 8
lea eax, [ebp - 0x140]
push eax
push ebx
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x41b87d
mov edi, 1
jmp 0x41b87f
xor edi, edi
push ebx
call fcn.0054e28c
pop ecx
mov byte [ebx + eax - 3], 0
test edi, edi
jne 0x41b92d
test byte [ebp - 0x140], 0x10
je 0x41b90f
xor eax, eax
mov al, byte [ebp - 0x114]
cmp eax, 0x2e
je 0x41b90f
lea edx, [ebp - 0x114]
push edx
push ebx
call fcn.0054e1b0
add esp, 8
cmp dword [ebp + 0x14], 0
je 0x41b8d5
push 0
push ebx
mov ecx, dword [ebp + 0x14]
push dword [ecx]
call fcn.004c6a18
test eax, eax
je 0x41b8d5
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
push ebx
call fcn.0042e6d8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041b756
push 0x5c
push ebx
call fcn.0054e39d
add esp, 8
test eax, eax
je 0x41b90f
mov byte [eax], 0
push 0x5c
push ebx
call fcn.0054e39d
add esp, 8
test eax, eax
je 0x41b90f
inc eax
mov byte [eax], 0
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x41b925
mov edi, 1
test edi, edi
je 0x41b893
cmp esi, 0xffffffff
je 0x41b938
push esi
call sub.KERNEL32.dll_FindClose
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ba7b
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa4
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
push edx
push 0
push dword [0x56f018]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jl 0x41bc0a
cmp dword [ebp - 4], 0
je 0x41bc0a
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call sub.SHELL32.dll_SHGetPathFromIDListA
test eax, eax
jl 0x41bc0a
lea eax, [ebp - 0x110]
push eax
call fcn.0042e6d8
push dword [ebp + 8]
push str._s.lnk
lea edx, [ebp - 0x110]
push edx
call fcn.0054e28c
pop ecx
lea ecx, [ebp - 0x110]
add eax, ecx
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x57573c
push 1
push 0
push 0x57564c
call sub.OLE32.dll_CoCreateInstance
test eax, eax
jl 0x41bc0a
lea edx, [ebp - 8]
push edx
push 0x57610c
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jge 0x41bb37
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
jmp 0x41bc0a
push 0x104
lea eax, [ebp - 0x41c]
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0x110]
push edx
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
push 0
lea ecx, [ebp - 0x41c]
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jge 0x41bb82
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
jmp 0x41bc0a
push 0
lea eax, [ebp - 0x55c]
push eax
push 0x104
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jge 0x41bbb8
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x41bc0a
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
push 0x57a361
push 0x581f80
push 0x55f99a
push 0x579f7a
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
push 0x579f7a
call fcn.0054e450
add esp, 8
test eax, eax
jne 0x41bc0a
lea edx, [ebp - 0x110]
push edx
call sub.KERNEL32.dll_DeleteFileA
mov esp, ebp
pop ebp
ret 4
Function at 0x41bc10
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff78
mov esi, 0x579f7a
push 0xa
push 0x2a
push dword [0x56f014]
call sub.KERNEL32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x41bccd
push ebx
push dword [0x56f014]
call sub.KERNEL32.dll_SizeofResource
mov ebp, eax
push ebx
push dword [0x56f014]
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x41bccd
push eax
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x41bccd
push esi
push 0x180
call sub.KERNEL32.dll_GetTempPathA
push str.miunst_.exe
push esi
call fcn.0054e1b0
add esp, 8
mov byte [esp], 0x88
push 0x1001
lea eax, [esp + 4]
push eax
push esi
call sub.KERNEL32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41bccd
push ebp
push edi
push ebx
call sub.KERNEL32.dll__lwrite
push ebx
call sub.KERNEL32.dll__lclose
push 0x57a361
push 0x581f80
push str.__s_s
push esi
call fcn.0054e28c
pop ecx
add eax, esi
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0
push esi
call sub.KERNEL32.dll_WinExec
add esp, 0x88
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42009f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0
push 0
push 0x147
push 0x7a
push ebx
call sub.USER32.dll_SendDlgItemMessageA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4200cc
push 0
call fcn.0042c6cc
jmp 0x4201aa
push 0x585ce2
push esi
push 0x148
push 0x7a
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x585ce2], 0
jne 0x4200f4
push 0
call fcn.0042c6cc
jmp 0x4201aa
push esi
mov esi, 0x57a361
mov edi, 0x57c784
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
cmp byte [0x57a361], 0
je 0x420155
push 1
push 0x57a361
call fcn.0042cbc2
test eax, eax
je 0x420155
push 0
push 0x46d109
push 0xa0
push ebx
call fcn.0046a7c4
dec eax
jne 0x420155
push 0x57a361
call sub.KERNEL32.dll_DeleteFileA
push 0x585ce2
push 0x55fedd
push 0x579f7a
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x579f7a
push 0x57c680
call fcn.004ad20b
push 0
push esi
push 0x144
push 0x7a
push ebx
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0xffffffffffffffff
push 0x14e
push 0x7a
push ebx
call sub.USER32.dll_SendDlgItemMessageA
push 0
push ebx
call fcn.0041f9c5
push ebx
call fcn.0041f534
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x42c88b
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x560780
lea edi, [ebp - 0x104]
test ebx, ebx
je 0x42c8ae
cmp byte [ebx], 0
jne 0x42c8b5
xor eax, eax
jmp 0x42caac
push 0x100
push edi
call fcn.0042e6b1
push 0
push edi
push 0
push 0
push ebx
call fcn.0050e5fc
add esp, 0x14
or ebx, 0xffffffff
lea eax, [esi + 0x21]
push eax
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea edx, [esi + 0x26]
push edx
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea ecx, [esi + 0x2c]
push ecx
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea eax, [esi + 0x32]
push eax
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea edx, [esi + 0x38]
push edx
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea ecx, [esi + 0x3e]
push ecx
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea eax, [esi + 0x43]
push eax
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea edx, [esi + 0x48]
push edx
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea ecx, [esi + 0x4d]
push ecx
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea eax, [esi + 0x53]
push eax
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea edx, [esi + 0x59]
push edx
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
lea ecx, [esi + 0x5f]
push ecx
push edi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x42ca9c
push 0
push 0
push 3
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x42ca01
push esi
call sub.KERNEL32.dll_GetFileType
mov dword [ebp - 4], eax
push esi
call sub.KERNEL32.dll_CloseHandle
test byte [ebp - 4], 2
jne 0x42ca9c
push 0xa
lea eax, [ebp - 0x138]
push eax
push edi
call sub.KERNEL32.dll_QueryDosDeviceA
test eax, eax
jne 0x42ca9c
lea edx, [ebp - 0x128]
push edx
push edi
call fcn.0055482c
add esp, 8
test eax, eax
jne 0x42ca43
movsx ecx, word [ebp - 0x124]
sub ecx, 0x2000
je 0x42ca9c
sub ecx, 0xd000
je 0x42ca9c
push 0x40
push 0
push edi
call fcn.0055422c
add esp, 0xc
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42ca8d
push ebx
call fcn.0055202c
pop ecx
test eax, eax
jne 0x42ca9c
lea eax, [ebp - 0x128]
push eax
push ebx
call fcn.0055425c
add esp, 8
test eax, eax
jne 0x42ca8d
movsx edx, word [ebp - 0x124]
sub edx, 0x2000
je 0x42ca9c
sub edx, 0xd000
je 0x42ca9c
test ebx, ebx
jl 0x42ca98
push ebx
call fcn.005516dc
pop ecx
xor eax, eax
jmp 0x42caac
test ebx, ebx
jl 0x42caa7
push ebx
call fcn.005516dc
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42cbc2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
je 0x42cbdd
cmp byte [esi], 0
jne 0x42cbe7
xor eax, eax
jmp 0x42ccf1
mov byte [ebx], 0x5c
push 0x2f
push esi
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x42cbe4
push 0x5607f4
push esi
call fcn.0054e548
add esp, 8
test eax, eax
je 0x42cc11
xor eax, eax
jmp 0x42ccf1
push esi
push edi
mov edi, esi
lea esi, [ebp - 0x4e8]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea eax, [ebp - 0x4e8]
push eax
call fcn.0054e28c
pop ecx
test eax, eax
jg 0x42cc52
xor eax, eax
jmp 0x42ccf1
cmp byte [ebp + eax - 0x4e9], 0x5c
jne 0x42cc6e
mov byte [ebp + eax - 0x4e8], 0x2e
mov byte [ebp + eax - 0x4e7], 0
jmp 0x42cc88
cmp byte [ebp + eax - 0x4e9], 0x3a
jne 0x42cc88
mov byte [ebp + eax - 0x4e8], 0x5c
mov byte [ebp + eax - 0x4e7], 0
push 0
lea edx, [ebp - 0x100]
push edx
push 0
push 0
lea ecx, [ebp - 0x4e8]
push ecx
call fcn.0050e5fc
add esp, 0x14
lea eax, [ebp - 0x100]
push eax
call fcn.0042c88b
test eax, eax
je 0x42ccb8
xor eax, eax
jmp 0x42ccf1
xor ebx, ebx
lea eax, [ebp - 0x4e8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x42cccf
mov eax, ebx
jmp 0x42ccf1
test al, 0x10
je 0x42cce2
test edi, 2
je 0x42ccef
mov ebx, 1
jmp 0x42ccef
test edi, 1
je 0x42ccef
mov ebx, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42d118
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffff830
cmp byte [0x585a40], 0
jne 0x42d144
push 0x56f064
push dword [0x56f018]
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.0041b199
jmp 0x42d1d6
push 0x585a40
push 0x56f064
push 0x56085e
lea eax, [esp + 0xc]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0xf
lea edx, [esp + 4]
push edx
call fcn.0050e7f8
push dword [0x56f018]
call sub.USER32.dll_GetWindowTextLengthA
mov ebx, eax
push esp
call fcn.0054e28c
pop ecx
cmp ebx, eax
jne 0x42d1c3
push 0x3b5
lea eax, [esp + 0x3ec]
push eax
push dword [0x56f018]
call sub.USER32.dll_GetWindowTextA
mov eax, esp
lea edx, [esp + 0x3e8]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x42d1c3
test cl, cl
je 0x42d1c1
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x42d1c3
add eax, 2
add edx, 2
test cl, cl
jne 0x42d1a5
je 0x42d1d6
push esp
push dword [0x56f018]
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.0041b199
add esp, 0x7d0
pop ebx
ret
Function at 0x42d1de
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ebx, dword [ebp + 8]
push 5
push 0x581f80
push 0
push ebx
push 0
push dword [0x56f018]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x42d20b
mov eax, 1
jmp 0x42d26c
lea edx, [ebp - 0x24]
push edx
push ebx
call fcn.0055482c
add esp, 8
test eax, eax
je 0x42d221
xor ecx, ecx
mov dword [ebp - 0x12], ecx
cmp dword [ebp - 0x12], 0xe678
jle 0x42d23f
push ebx
push str.write.exe__s
push 0x582088
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x42d252
push ebx
push str.notepad.exe__s
push 0x582088
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xa
push 0x582088
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
jae 0x42d267
xor eax, eax
jmp 0x42d26c
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42d273
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [0x56f018]
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x42d28f
xor eax, eax
jmp 0x42d3d2
xor esi, esi
cmp dword [ebp + 0xc], 1
jne 0x42d30a
push 1
call sub.USER32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
je 0x42d30a
push ebx
call sub.KERNEL32.dll_GlobalLock
mov edi, eax
test edi, edi
je 0x42d304
push edi
call fcn.0054e28c
pop ecx
mov esi, eax
push dword [ebp + 8]
call fcn.0054e28c
pop ecx
add esi, eax
add esi, 0xa
push esi
call fcn.00559d70
pop ecx
mov esi, eax
test esi, esi
je 0x42d304
push esi
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push dword [ebp + 8]
push esi
call fcn.0054e1b0
add esp, 8
mov dword [ebp + 8], esi
push ebx
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_EmptyClipboard
test eax, eax
jne 0x42d32a
call sub.USER32.dll_CloseClipboard
test esi, esi
je 0x42d323
push esi
call fcn.00559c5c
pop ecx
xor eax, eax
jmp 0x42d3d2
push dword [ebp + 8]
call fcn.0054e28c
pop ecx
add eax, 0xa
push eax
push 0x2042
call sub.KERNEL32.dll_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x42d35b
call sub.USER32.dll_CloseClipboard
test esi, esi
je 0x42d357
push esi
call fcn.00559c5c
pop ecx
xor eax, eax
jmp 0x42d3d2
push ebx
call sub.KERNEL32.dll_GlobalLock
mov edi, eax
test edi, edi
jne 0x42d387
push ebx
call sub.KERNEL32.dll_GlobalUnlock
push ebx
call sub.KERNEL32.dll_GlobalFree
call sub.USER32.dll_CloseClipboard
test esi, esi
je 0x42d383
push esi
call fcn.00559c5c
pop ecx
xor eax, eax
jmp 0x42d3d2
mov edx, dword [ebp + 8]
push esi
push edi
mov esi, edi
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
call sub.KERNEL32.dll_GlobalUnlock
push ebx
push 1
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
test esi, esi
je 0x42d3cd
push esi
call fcn.00559c5c
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42d4d4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [0x560770], eax
mov dword [0x56076c], eax
mov dword [0x560768], eax
mov dword [ebp - 0x94], 0x94
lea edx, [ebp - 0x94]
push edx
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
je 0x42d62f
cmp dword [ebp - 0x84], 0
jne 0x42d532
test ebx, ebx
je 0x42d649
mov esi, 0x56088c
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
jmp 0x42d649
cmp dword [ebp - 0x84], 1
jne 0x42d5c0
cmp dword [ebp - 0x90], 4
jne 0x42d570
cmp dword [ebp - 0x8c], 0x5a
jb 0x42d570
test ebx, ebx
je 0x42d561
mov esi, 0x560891
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x560768], 1
jmp 0x42d649
cmp dword [ebp - 0x90], 4
jne 0x42d5a1
cmp dword [ebp - 0x8c], 1
jb 0x42d5a1
test ebx, ebx
je 0x42d592
mov esi, 0x560895
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x560768], 1
jmp 0x42d649
test ebx, ebx
je 0x42d5b1
mov esi, 0x560899
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x560768], 1
jmp 0x42d649
cmp dword [ebp - 0x84], 2
jne 0x42d62f
cmp dword [ebp - 0x90], 5
jb 0x42d613
cmp dword [ebp - 0x8c], 1
jb 0x42d5f7
test ebx, ebx
je 0x42d5eb
mov esi, 0x56089d
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x560770], 1
jmp 0x42d649
test ebx, ebx
je 0x42d607
mov esi, 0x5608a1
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x560770], 1
jmp 0x42d649
test ebx, ebx
je 0x42d623
mov esi, 0x5608a5
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x56076c], 1
jmp 0x42d649
test ebx, ebx
je 0x42d63f
mov esi, 0x5608a9
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x560768], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4