joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b60b0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x4c]
mov byte [ebp - 4], al
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov eax, 1
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.0040ec10
call fcn.00410830
push eax
test eax, eax
jne 0x4b6205
cmp byte [ebp - 4], 0
je 0x4b61af
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040b790
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040b790
lea eax, [ebp - 0x44]
call fcn.0040bf00
movzx eax, byte [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x48]
call fcn.0040c5b0
mov edx, dword [ebp - 0x48]
mov ecx, 0x6759dc
lea eax, [ebp - 0x44]
call fcn.0040c1f0
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x10]
call fcn.0040c0f0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x4b61af
push 0
movzx eax, byte [ebp - 4]
add eax, 0x40
lea ecx, [ebp - 0x4c]
mov dx, 0
call fcn.0040a080
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov ecx, 0x6759ec
call fcn.004098c0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x4b6205
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040b790
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040b790
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
call fcn.0040bd50
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.004097c0
cmp byte [ebp - 4], 0
je 0x4b6205
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
call fcn.0040ee90
lea eax, [ebp - 0x4c]
call fcn.004044b0
lea eax, [ebp - 0x48]
call fcn.0040bf00
lea eax, [ebp - 0x44]
call fcn.0040bf00
lea eax, [ebp - 0xc]
call fcn.0040b0d0
lea eax, [ebp - 0x10]
call fcn.0040b0d0
lea eax, [ebp - 0x14]
call fcn.0040b0d0
pop eax
test eax, eax
je 0x4b6244
call fcn.0040efc0
leave
ret

Function at 0x4b63a0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040ec10
call fcn.00410830
push eax
test eax, eax
jne 0x4b63eb
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0040d710
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4b63e2
mov eax, 0x6ec2e0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
call fcn.0040ee90
lea eax, [ebp - 0x34]
call fcn.0040bf00
pop eax
test eax, eax
je 0x4b6402
call fcn.0040efc0
mov eax, dword [ebp - 8]
leave
ret
Function at 0x4b8300
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x4b839c
mov eax, dword [ebp - 0x1c]
sub eax, 2
mov dword [ebp - 0x20], 0
cmp eax, dword [ebp - 0x20]
jl 0x4b83b8
sub dword [ebp - 0x20], 1
nop
add dword [ebp - 0x20], 1
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x4b83b8
sub dx, 0x20
je 0x4b8395
sub dx, 0x80
je 0x4b8395
sub dx, 0x1f62
jb 0x4b83b8
sub dx, 1
jbe 0x4b8395
sub dx, 6
je 0x4b8395
sub dx, 0x26
jne 0x4b83b8
jmp 0x4b8395
cmp eax, dword [ebp - 0x20]
jg 0x4b8348
jmp 0x4b83b8
cmp dword [ebp - 0x1c], 2
jne 0x4b83ac
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x4b83b8
mov al, byte [ebp - 0xc]
call fcn.0040c4c0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x4b8406
sub ax, 0x21
je 0x4b8414
sub ax, 0x17
je 0x4b841a
sub ax, 0x222
je 0x4b8420
sub ax, 0x392
je 0x4b8426
sub ax, 1
je 0x4b842c
sub ax, 0x1996
je 0x4b8432
sub ax, 1
je 0x4b8438
sub ax, 6
je 0x4b843e
sub ax, 0xb
je 0x4b844a
sub ax, 0x1b
je 0x4b8444
sub ax, 0x367
je 0x4b8450
jmp 0x4b8456
mov ax, word [ebp - 0x24]
call fcn.0040c530
mov byte [ebp - 0x10], al
jmp 0x4b845c
mov byte [ebp - 0x10], 0x20
jmp 0x4b845c
mov byte [ebp - 0x10], 0x2e
jmp 0x4b845c
mov byte [ebp - 0x10], 0x27
jmp 0x4b845c
mov byte [ebp - 0x10], 0x2c
jmp 0x4b845c
mov byte [ebp - 0x10], 0x27
jmp 0x4b845c
mov byte [ebp - 0x10], 0x20
jmp 0x4b845c
mov byte [ebp - 0x10], 0x20
jmp 0x4b845c
mov byte [ebp - 0x10], 0x20
jmp 0x4b845c
mov byte [ebp - 0x10], 0x20
jmp 0x4b845c
mov byte [ebp - 0x10], 0x2d
jmp 0x4b845c
mov byte [ebp - 0x10], 0x27
jmp 0x4b845c
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0x10]
leave
ret
Function at 0x4c0ec0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x334]
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
mov dword [ebp - 8], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040ec10
call fcn.00410830
push eax
test eax, eax
jne 0x4c1042
mov eax, edi
mov edx, 0
call fcn.004097c0
mov eax, ebx
mov edx, 0
call fcn.004097c0
call sub.kernel32.dll_GetUserDefaultLCID
mov esi, eax
push 4
lea eax, [ebp - 4]
push eax
push 3
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x4c0f8e
lea eax, [ebp - 0x234]
push eax
push 3
push 0
lea ecx, [ebp - 4]
lea eax, [ebp - 0x334]
mov edx, 0xff
call fcn.00404930
lea eax, [ebp - 0x334]
mov ecx, 2
mov edx, 1
call fcn.00405010
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x134]
call fcn.004052b0
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x34]
mov dx, 0
call fcn.0040a010
mov edx, dword [ebp - 0x34]
mov eax, ebx
call fcn.004097c0
push 4
lea eax, [ebp - 4]
push eax
push 7
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x4c1042
lea eax, [ebp - 0x134]
push eax
push 3
push 0
lea ecx, [ebp - 4]
lea eax, [ebp - 0x234]
mov edx, 0xff
call fcn.00404930
lea eax, [ebp - 0x234]
mov ecx, 2
mov edx, 1
call fcn.00405010
lea eax, [ebp - 0x134]
lea ecx, [ebp - 8]
mov dx, 0
call fcn.0040a010
push 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 4]
mov cx, 0
mov edx, 3
call fcn.0040a180
mov eax, dword [ebp - 0x34]
mov edx, 0x67759c
call fcn.0040a430
test eax, eax
jne 0x4c101e
mov edx, 0x6775ac
lea eax, [ebp - 8]
call fcn.004097c0
push 0
mov eax, dword [ebx]
mov dword [ebp - 0x40], eax
mov eax, 0x6775bc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x40]
mov eax, edi
mov ecx, 2
call fcn.00409b30
call fcn.0040ee90
lea eax, [ebp - 0x34]
call fcn.004044b0
lea eax, [ebp - 8]
call fcn.004044b0
pop eax
test eax, eax
je 0x4c1061
call fcn.0040efc0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4f4f30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 4]
mov edi, edx
mov dword [esp], eax
lea eax, [ecx - 1]
mov esi, eax
mov ecx, 0
cmp esi, ecx
jl 0x4f4f78
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov al, byte [esp]
mov dl, byte [edi]
xor dl, al
movzx eax, dl
mov ebx, eax
mov eax, dword [esp]
shr eax, 8
mov edx, dword [ebx*4 + 0x6eefa0]
xor edx, eax
mov dword [esp], edx
add edi, 1
cmp esi, ecx
jg 0x4f4f50
mov eax, dword [esp]
lea esp, [esp + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x4fd0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov ecx, eax
mov eax, 0
lea ebx, [ecx + 1]
movzx edx, byte [ecx]
add edx, 1
and edx, 0xff
lea edx, [ecx + edx]
jmp 0x4fd101
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor esi, ecx
mov eax, esi
add ebx, 1
cmp ebx, edx
jb 0x4fd0f0
pop esi
pop ebx
ret

Function at 0x5063f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x506420
mov eax, esi
call fcn.0050a850
cmp byte [esi + 0x40], 0
je 0x506419
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x5064b8
mov dword [esi + 0x14], 0xcb
cmp dword [esi + 0x14], 0xcb
jne 0x50649a
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x506492
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x506449
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x50645d
mov bl, 0
jmp 0x5064b8
cmp edi, 2
je 0x506492
cmp dword [esi + 8], 0
je 0x50643c
cmp edi, 3
je 0x506472
cmp edi, 1
jne 0x50643c
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
cmp eax, dword [edx + 8]
jl 0x50643c
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
jmp 0x50643c
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x5064af
cmp dword [esi + 0x14], 0xcc
je 0x5064af
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.005067a0
mov eax, esi
call fcn.005064c0
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret

Function at 0x523930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
cmp ebx, esi
jl 0x52399b
sub esi, 1
lea esi, [esi]
add esi, 1
push dword [ebp - 8]
push esi
mov ecx, esi
mov eax, ecx
sar eax, 0x1f
mov edx, eax
mov eax, ecx
xor eax, edx
sub eax, edx
and eax, 0x1f
mov ecx, edx
xor ecx, eax
mov eax, ecx
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 4]
push dword [eax + edx*4]
push edi
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00522ed0
cmp ebx, esi
jg 0x523960
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x546830
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
cmp dword [eax + 0x28], 0
je 0x546878
mov eax, dword [0x5f0330]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x168]
cmp eax, dword [edx + 0x28]
jne 0x546878
mov eax, dword [0x5f0330]
cmp byte [eax + 0x114], 0
jne 0x546878
mov eax, dword [0x5f1e00]
mov edx, dword [0x5f1e00]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x5f1e00]
mov edx, dword [0x5f1e00]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x54696e
mov eax, dword [0x5f0330]
cmp byte [eax + 0x114], 0
jne 0x54696e
mov eax, dword [0x5f1e00]
mov edx, dword [0x5f1e00]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.0058afe0
mov eax, dword [0x5f0330]
cmp dword [eax + 0x168], 0
je 0x546933
push 0x10
push 0
mov eax, dword [0x5f0330]
mov eax, dword [eax + 0x168]
push dword [eax + 0x25c]
mov eax, dword [0x5f0330]
mov eax, dword [eax + 0x168]
push dword [eax + 0x250]
mov eax, dword [0x5f0330]
mov eax, dword [eax + 0x168]
push dword [eax + 0x130]
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x5f0330]
mov eax, dword [eax + 0x168]
call fcn.0049aed0
test al, al
je 0x546933
push 0
mov eax, dword [0x5f0330]
call fcn.00421850
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5f0330]
call fcn.00424ae0
jmp 0x546a05
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x5469c3
mov eax, dword [ebp - 4]
mov edx, dword [0x5f0330]
mov eax, dword [eax + 0x28]
cmp eax, dword [edx + 0x168]
jne 0x5469c3
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5f0330]
call fcn.00424ae0
jmp 0x546a05
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x546a05
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
test dword [eax + 0x488], 8
je 0x546a05
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5f1e00]
mov edx, dword [0x5f1e00]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
leave
ret
Function at 0x54b850
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 8
mov eax, fcn.0054a270
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00413b80
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x6ec2b0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x54b8a6
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, 0x5f94e0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x54b91e
or dword [ebp - 0x30], 0x800
cmp dword [0x648f40], 6
jb 0x54b8f8
or dword [ebp - 0x30], 0x20000
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, str.HintWindow
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
mov al, byte [ebp - 8]
leave
ret

Function at 0x54c7e0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x54c88d
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x54c88d
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040ec10
call fcn.00410830
push eax
test eax, eax
jne 0x54c86f
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040ee90
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x54c889
call fcn.0040efc0
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
leave
ret
Function at 0x54cef0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x78]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov eax, 1
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x20]
call fcn.0040ec10
call fcn.00410830
push eax
test eax, eax
jne 0x54d05b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x54cff6
lea eax, [ebp - 0x40]
call fcn.004044b0
lea eax, [ebp - 0x44]
call fcn.004044b0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
call fcn.004beef0
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
call fcn.004097c0
lea eax, [ebp - 0x44]
call fcn.004044b0
lea eax, [ebp - 0x54]
call fcn.004044b0
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x10]
call fcn.004beea0
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x44]
call fcn.004097c0
call fcn.004bf4e0
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.004c0970
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x54d05b
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
mov eax, 1
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x60]
call fcn.0040ec10
call fcn.00410830
push eax
test eax, eax
jne 0x54d039
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
call fcn.0040ee90
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x54d050
call fcn.0040efc0
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
call fcn.0040ee90
lea eax, [ebp - 0x54]
call fcn.004044b0
lea eax, [ebp - 0x44]
call fcn.004044b0
lea eax, [ebp - 0x40]
call fcn.004044b0
pop eax
test eax, eax
je 0x54d082
call fcn.0040efc0
pop ebx
leave
ret
Function at 0x58b3c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0
mov eax, 1
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.0040ec10
call fcn.00410830
push eax
test eax, eax
jne 0x58b451
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040b790
cmp dword [ebp - 0xc], 0
jbe 0x58b430
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x58b424
mov eax, 0x6ec2e0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040b790
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.0040c120
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
call fcn.004bd0a0
call fcn.0040ee90
lea eax, [ebp - 0x3c]
call fcn.0040bf00
lea eax, [ebp - 0x10]
call fcn.0040b0d0
pop eax
test eax, eax
je 0x58b470
call fcn.0040efc0
leave
ret
Function at 0x5ac9e0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, al
call fcn.005ac9d0
cmp al, bl
je 0x5aca20
test bl, bl
je 0x5aca0b
push 0
push 0
mov eax, 0x5ac980
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x64bd60], eax
jmp 0x5aca20
push dword [0x64bd60]
call sub.user32.dll_UnhookWindowsHookEx
mov dword [0x64bd60], 0
pop ebx
leave
ret

Function at 0x5b2570
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, str.Progman
push eax
call sub.user32.dll_FindWindowA
test eax, eax
je 0x5b2590
push 0
push 0
push 0x12
push eax
call sub.user32.dll_PostMessageA
push 0
mov eax, str.Shell_TrayWnd
push eax
call sub.user32.dll_FindWindowA
test eax, eax
je 0x5b25ad
push 0
push 0
push 0x12
push eax
call sub.user32.dll_PostMessageA
leave
ret

Function at 0x5b6770
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x2c], 0
mov eax, 1
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0xc]
call fcn.0040ec10
call fcn.00410830
push eax
test eax, eax
jne 0x5b67de
mov eax, esi
mov edx, 0
call fcn.004097c0
mov edi, 0
test ebx, ebx
jne 0x5b67b9
mov ebx, 0x6ec2e0
push ebx
call sub.ws2_32.dll_gethostbyname_1
mov edi, eax
test edi, edi
je 0x5b67de
mov eax, dword [edi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
lea edx, [ebp - 0x2c]
call fcn.005b6940
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.004097c0
call fcn.0040ee90
lea eax, [ebp - 0x2c]
call fcn.004044b0
pop eax
test eax, eax
je 0x5b67f5
call fcn.0040efc0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5b6be0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
leave
ret

Function at 0x5b7730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
push esi
mov ebx, eax
mov esi, dword [ebp + 8]
test edx, edx
jne 0x5b7747
mov edx, 0x6ec2e0
lea eax, [ebp + 0xc]
push eax
push ecx
lea eax, [ebp - 4]
push eax
push 0
push edx
push dword [ebx + 0x14]
call sub.advapi32.dll_RegQueryValueExA
mov dword [ebx + 4], eax
test eax, eax
je 0x5b7769
mov eax, 0xffffffff
jmp 0x5b77aa
cmp dword [ebp - 4], 1
jne 0x5b7777
mov dword [esi], 1
jmp 0x5b77a7
cmp dword [ebp - 4], 2
jne 0x5b7785
mov dword [esi], 2
jmp 0x5b77a7
cmp dword [ebp - 4], 4
jne 0x5b7793
mov dword [esi], 4
jmp 0x5b77a7
cmp dword [ebp - 4], 3
jne 0x5b77a1
mov dword [esi], 3
jmp 0x5b77a7
mov dword [esi], 0
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
leave
ret 8
Function at 0x5b7b70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test eax, eax
je 0x5b7b97
sub eax, 1
je 0x5b7b9e
sub eax, 1
je 0x5b7ba5
sub eax, 1
je 0x5b7bb3
sub eax, 1
je 0x5b7bac
jmp 0x5b7bb8
mov eax, 0
jmp 0x5b7bb8
mov eax, 1
jmp 0x5b7bb8
mov eax, 2
jmp 0x5b7bb8
mov eax, 4
jmp 0x5b7bb8
mov eax, 3
test edx, edx
jne 0x5b7bc1
mov edx, 0x6ec2e0
push esi
push ecx
push eax
push 0
push edx
push dword [ebx + 0x14]
call sub.advapi32.dll_RegSetValueExA
mov dword [ebx + 4], eax
test eax, eax
sete al
pop esi
pop ebx
leave
ret 8

Function at 0x5c10d0
Capabilities:
Hash data with md5

Disassembly:
push ebx
push esi
mov esi, eax
mov ebx, edx
mov eax, esi
mov cl, 0
mov edx, 0x78
call fcn.00403e70
mov dword [esi], ebx
mov eax, ebx
test ebx, ebx
je 0x5c114e
sub eax, 1
jb 0x5c115d
sub eax, 1
ja 0x5c115d
cmp ebx, 1
jne 0x5c1105
mov eax, 0x5c04f0
mov dword [esi + 4], eax
jmp 0x5c110d
mov eax, 0x5c0ab0
mov dword [esi + 4], eax
mov dword [esi + 8], 0x40
mov dword [esi + 0xc], 0x67452301
mov dword [esi + 0x10], 0xefcdab89
mov dword [esi + 0x14], 0x98badcfe
mov dword [esi + 0x18], 0x10325476
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
jmp 0x5c115d
mov dword [esi + 8], 0x10
mov eax, 0x5c03e0
mov dword [esi + 4], eax
pop esi
pop ebx
ret

Function at 0x5c1680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov bl, 0
test eax, eax
je 0x5c16b0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x5c16b0
push 1
push esi
call sub.kernel32.dll_TerminateProcess
or eax, eax
setne al
mov bl, al
push esi
call sub.kernel32.dll_CloseHandle
mov al, bl
pop esi
pop ebx
leave
ret