joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59de2c
Capabilities:
Encode data using xor

Disassembly:
push dword [esp]
pop ebx
push eax
mov eax, esp
add eax, 4
add eax, 4
push eax
push dword [esp + 4]
pop eax
pop dword [esp]
mov esp, dword [esp]
push dword [esp]
pop eax
push esi
mov esi, esp
add esi, 4
sub esp, 4
mov dword [esp], eax
mov eax, 4
add esi, eax
pop eax
xchg dword [esp], esi
pop esp
jmp 0x56e57b
add dl, ch
jne 0x59ddb4
inc ebx
mov cl, 0x93
add byte [edx], ah
add byte [eax], al
fadd dword [eax]
add byte [eax], al
mov esp, 0xe4c02ce7
inc ebp
adc dword [eax], eax
mov byte [eax], bh
xchg ebp, eax
xor byte [ecx + ebp*8 + 0x3d], bh
add bh, al
push es
add byte [eax], al
and ch, byte [esi + ecx*4]
cmp dh, dh
push ebp
adc eax, dword [eax]
cmp al, 0xef
add dword [edx + 0x3d4948], ecx
cli
add al, 0
add byte [eax], cl
or byte [ecx], cl
add byte [eax], al
xchg ebx, eax
add byte [0x322c23], al
add al, 0x1a
sbb al, 0x1e
mov esi, 0x729cac
cmp eax, 0x1e0f400
add byte [eax], al
add byte [ebx + 0x7f55300], dl
add byte [eax], al
test dword [0x1a4d83a7], edi
cmp byte [eax - 0x4efffffa], dh
add bh, byte [0x90009300]
add byte [ebx + 8], cl
add byte [eax], al
mov dword [eax + eax], eax
add byte [0x93003da4], bl
add al, cl
inc ebp
mov cl, 0x93
add ah, dh
mov edi, 0x7426b24b
or dword [eax], eax
add cl, ah
or byte [eax], al
add byte [edi], bh
sahf
mov eax, dword [0x8059487]
mov al, byte [0x93000006]
add byte [ebx], ah
pop ebp
or esp, dword [ebx - 0x7ffffff6]
mov es, word [ecx]
cmp eax, 0x77408300
sub dword [eax + 0x10000000], esp
adc dl, byte [esi]
push ss
push es
inc edx
pushal
mov ah, 0xe2
call 0x3d5a3c1a
add byte [esi - 0xa], dl
add al, byte [eax]
add byte [eax], al
stosb byte es:[edi], al
add byte [esi - 0x3efffffe], bh
and dword [edi - 0x3a], edx
cmp edx, 0x3dbaef7f
add byte [esi], cl
pop ebp
insd dword es:[edi], dx
xor eax, 0xbe38d008
mov dword [ecx], esp
add byte [ebp - 0xa885d40], ah
dec edi
cmp eax, 0x58100
add byte [edx - 0x13c55696], al
add al, byte [eax]
add byte [0x4539d600], bh
sub ebx, 0x6b
xchg edx, eax
leave
add al, 0
add byte [ecx + 5], ch
add byte [eax], al
mov ah, 3
add byte es:[0xe6ab0100], bh
dec esp
jns 0x59dee1
add byte [eax], al
add byte [edi + 0x74f], ah
push cs
salc
push ebx
add byte [0xfe687700], bh
out dx, al
std
adc byte [eax], al
add byte [eax], al
cmp al, byte [esi]
add byte [eax], al
push ss
add byte [ebx - 0x4e8b3600], dl
xchg ebx, eax
add ah, dh
push edi
invalid
Function at 0x10004de0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
jmp 0x10004e1f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x10004f3b
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x10], 0
jne 0x10004eac
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jle 0x10004ea7
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10004e80
xor eax, eax
jmp 0x10004f40
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.1002c9a0
add esp, 0xc
jmp 0x10004e0d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10004dc0
add esp, 8
test eax, eax
jne 0x10004ecd
xor eax, eax
jmp 0x10004f40
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10004f04
xor eax, eax
jmp 0x10004f40
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1002c630
add esp, 0xc
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
jmp 0x10004e0d
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10009970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
cmp dword [0x1005edc8], 0
jne 0x10009993
call fcn.10009520
xor eax, eax
jne 0x10009993
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x10016d17
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x10016d5a
call fcn.1001e703
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10016d5a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10016d75
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.100168ce
test ebx, ebx
mov esi, eax
je 0x10016d73
test edi, edi
je 0x10016d73
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x10017aa1
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x10048981
call fcn.10030bc7
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x10017ac6
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10017b12
call fcn.100194f0
push eax
lea ecx, [ebp - 0x10]
call fcn.10013e47
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100173e3
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10012032
mov eax, esi
call fcn.10030c9f
ret 8

Function at 0x1001be72
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x1001be92
cmp dword [edi + 0x54], 0
jne 0x1001be92
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.1001e703
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1001be39
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x1001c34a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x1001c390
call fcn.1001e703
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1001c390
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x1001c3d3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x1001c3bc
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x1001c3bc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x1001c3d0
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002c435
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005d85c]
jne 0x1002c43f
repz ret
jmp fcn.1003387c

Function at 0x1003cdf4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10033259
xor ebx, ebx
cmp dword [0x100617cc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1003cec9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1003ce34
xor eax, eax
jmp 0x1003cf8d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1004fe40
push edi
call esi
cmp eax, ebx
je 0x1003ce2d
push eax
call fcn.100331f6
mov dword [esp], 0x1004fe30
push edi
mov dword [0x100617cc], eax
call esi
push eax
call fcn.100331f6
mov dword [esp], 0x1004fe1c
push edi
mov dword [0x100617d0], eax
call esi
push eax
call fcn.100331f6
mov dword [0x100617d4], eax
lea eax, [ebp - 8]
push eax
call fcn.100314ec
test eax, eax
pop ecx
pop ecx
je 0x1003ce97
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1002dca4
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1003cec9
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100331f6
cmp eax, ebx
pop ecx
mov dword [0x100617dc], eax
je 0x1003cec9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100331f6
pop ecx
mov dword [0x100617d8], eax
mov eax, dword [0x100617d8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1003cf42
cmp dword [0x100617dc], esi
je 0x1003cf42
push eax
call fcn.10033262
pop ecx
call eax
cmp eax, ebx
je 0x1003cf0f
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x100617dc]
call fcn.10033262
pop ecx
call eax
test eax, eax
je 0x1003cf0f
test byte [ebp - 0x18], 1
jne 0x1003cf42
lea eax, [ebp - 0xc]
push eax
call fcn.10031523
test eax, eax
pop ecx
je 0x1003cf2a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1002dca4
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1003cf39
or dword [ebp + 0x10], 0x200000
jmp 0x1003cf73
or dword [ebp + 0x10], 0x40000
jmp 0x1003cf73
mov eax, dword [0x100617d0]
cmp eax, esi
je 0x1003cf73
push eax
call fcn.10033262
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1003cf73
mov eax, dword [0x100617d4]
cmp eax, esi
je 0x1003cf73
push dword [ebp - 4]
push eax
call fcn.10033262
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x100617cc]
call fcn.10033262
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d20
Capabilities:
Capture screenshot

Disassembly:
push 0xffffffffffffffff
push 0x4a3300
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
mov dword [esp + 8], ecx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00487b7c
xor ebx, ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x58], ebx
call fcn.00487b7c
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push ebx
push ebx
lea eax, [esp + 0x40]
push ebx
push eax
mov byte [esp + 0x6c], 1
call esi
test eax, eax
je 0x402d9d
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [esp + 0x34]
push ecx
call edi
lea edx, [esp + 0x34]
push edx
call ebp
push 1
push ebx
push ebx
lea eax, [esp + 0x40]
push ebx
push eax
call esi
test eax, eax
jne 0x402d7f
push ebx
push ebx
push ebx
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
push eax
lea ecx, [esp + 0x18]
call fcn.00487c33
cmp eax, ebx
je 0x402eb4
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x14]
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x28]
call fcn.00487c33
cmp eax, ebx
jne 0x402dee
lea ecx, [esp + 0x14]
call fcn.00487c9b
jmp 0x402eb4
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 8
push ecx
call esi
mov edx, dword [esp + 0x1c]
push 0xa
push edx
mov edi, eax
call esi
mov ecx, dword [esp + 0x18]
mov ebp, eax
mov eax, dword [esp + 0x10]
push ebp
push edi
push ecx
lea esi, [eax + 0x5c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, esi
call fcn.00488797
cmp eax, ebx
jne 0x402e3e
lea ecx, [esp + 0x14]
call fcn.00487c9b
lea ecx, [esp + 0x24]
call fcn.00487c9b
jmp 0x402eb4
cmp esi, ebx
jne 0x402e46
xor esi, esi
jmp 0x402e49
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.00487d74
mov ecx, dword [esp + 0x18]
mov esi, eax
lea eax, [esp + 0x14]
push 0xcc0020
neg eax
sbb eax, eax
push ebx
and eax, ecx
push ebx
push eax
mov eax, dword [esp + 0x38]
push ebp
push edi
push ebx
push ebx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
cmp esi, ebx
jne 0x402e83
xor esi, esi
jmp 0x402e86
mov esi, dword [esi + 4]
mov ecx, dword [esp + 0x28]
push esi
push ecx
call fcn.00487d74
lea ecx, [esp + 0x14]
call fcn.00487c9b
lea ecx, [esp + 0x24]
call fcn.00487c9b
mov edx, dword [esp + 0x10]
push 1
push ebx
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x24]
mov byte [esp + 0x58], bl
call fcn.00487cb1
lea ecx, [esp + 0x14]
mov dword [esp + 0x58], 0xffffffff
call fcn.00487cb1
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x408b80
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a3a08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4e64d8]
test eax, eax
jne 0x408c2b
mov eax, dword [0x4d5184]
push esi
mov dword [esp + 4], eax
push 0x104
push 0x104
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call fcn.00484e30
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call fcn.00484e7f
push str.winhlp32.exe
lea ecx, [esp + 8]
call fcn.00484ddc
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x408c12
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x408c12
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [0x4e64d8], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.00484a00
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x408c40
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x408ca2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret

Function at 0x408eb0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [esp + 0x214]
push esi
push edi
push ebx
push 0
push 0
push ebp
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x408f99
lea eax, [esp + 0x10]
push eax
push str..htm
push SysReAllocStringLen
call fcn.00408c40
add esp, 0xc
test eax, eax
jne 0x408f99
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push str._shellopencommand
push ecx
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push eax
push SysReAllocStringLen
call fcn.00408c40
add esp, 0xc
test eax, eax
jne 0x408f99
lea ecx, [esp + 0x10]
push str.__1_
push ecx
call fcn.0046b780
mov esi, eax
add esp, 8
test esi, esi
jne 0x408f73
lea edx, [esp + 0x10]
push 0x4ce9b4
push edx
call fcn.0046b700
mov esi, eax
add esp, 8
test esi, esi
jne 0x408f73
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x408f76
mov byte [esi], 0
push 0x4ce9b0
push esi
call edi
push ebp
push esi
call edi
lea ecx, [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x409c50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4a3bc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0
call fcn.004854bd
mov eax, dword [esp + 0x4c]
push 0
push 0
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 1
call fcn.004855cf
test eax, eax
je 0x409ce9
lea ecx, [esp + 0x18]
call fcn.004858c9
lea ecx, [esp + 8]
push 0xe
push ecx
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.004856ec
cmp eax, 0xe
jne 0x409ce9
cmp word [esp + 8], 0x4d42
jne 0x409ce9
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x409ce9
mov edx, dword [esp + 0x18]
add edi, 0xfffffff2
push edi
push esi
lea ecx, [esp + 0x20]
call dword [edx + 0x34]
cmp eax, edi
je 0x409d1b
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.00485512
lea ecx, [esp + 0x4c]
mov dword [esp + 0x30], 0xffffffff
call fcn.00484a00
pop edi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x18
mov edx, dword [esi + 0x20]
test edx, edx
je 0x409d26
mov eax, edx
jmp 0x409d30
mov cl, byte [esi + 0xe]
mov eax, 1
shl eax, cl
cmp word [esi + 0xe], 8
push ebx
push ebp
jbe 0x409d4a
mov ebp, dword [esi + 0x10]
xor eax, eax
cmp ebp, 3
setne al
dec eax
and eax, 3
add eax, edx
mov ebp, dword [esi + 4]
lea ebx, [esi + eax*4 + 0x28]
mov eax, 0x66
mov edi, dword [esi + 8]
sub eax, ebp
cdq
sub eax, edx
mov ecx, eax
mov eax, 0x66
sub eax, edi
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
test ecx, ecx
jge 0x409d74
xor ecx, ecx
test eax, eax
jge 0x409d7a
xor eax, eax
mov edx, dword [esp + 0x48]
push 0
push esi
push ebx
push edi
push 0
push 0
push 0
lea eax, [edx + eax + 2]
mov edx, dword [esp + 0x60]
push edi
push ebp
push eax
lea eax, [edx + ecx + 2]
mov ecx, dword [esp + 0x68]
push eax
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.00485512
lea ecx, [esp + 0x54]
mov dword [esp + 0x38], 0xffffffff
call fcn.00484a00
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x18

Function at 0x40f450
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x160
lea ecx, [esp]
push eax
push 0x160
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [esp + 4]
add esp, 0x160
ret 8
Function at 0x4127a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x164]
test eax, eax
je 0x412851
mov ecx, dword [esi + 0x90]
test ecx, ecx
jne 0x41280d
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x412851
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [esi + 0x15c]
mov eax, dword [esi + 0x160]
mov ecx, dword [esi + 0x164]
push 0
push edx
push eax
push ecx
call fcn.0041daba
add esp, 0x10
test eax, eax
je 0x41284b
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret 4
mov edx, dword [esi + 0x15c]
mov ecx, dword [esi + 0x160]
push edx
push ecx
push eax
call fcn.0041db30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x412851
mov edx, dword [esp + 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x412851
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret 4
Function at 0x413550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a4b07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov dword [esp + 0x24], 0
lea eax, [esp + 0x14]
push 3
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x38], 1
call fcn.0047d634
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 8]
mov byte [esp + 0x30], 2
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x3c]
add eax, 0xfffffffc
push eax
push edx
call fcn.0047d6b0
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 3
call fcn.0047d634
push 0x4d98d8
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 4
call fcn.00484a6e
mov bl, 5
push str.1234567890
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], bl
call fcn.00484f02
cmp eax, 0xffffffff
jle 0x41366d
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call fcn.00484e18
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
mov eax, dword [edx - 8]
dec eax
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0047d6b0
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 6
call fcn.00484b39
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.00484a00
lea ecx, [esp + 0x1c]
push 1
push ecx
lea ecx, [esp + 0x10]
call fcn.0047d634
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 7
call fcn.00484b39
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.00484a00
push str.1234567890
lea ecx, [esp + 0x14]
call fcn.00484f02
cmp eax, 0xffffffff
jg 0x4135ed
lea ecx, [esp + 0xc]
call fcn.00484f46
mov edx, dword [esp + 0xc]
push edx
call fcn.0046bddb
add esp, 4
inc eax
push eax
lea eax, [esp + 0x10]
push 0x4cf590
push eax
call fcn.0047da97
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
lea eax, [esp + 0x20]
push ecx
push edx
push eax
call fcn.00484c2f
push 0x4ceaf0
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x3c], 8
call fcn.00484c95
lea edx, [esp + 0x14]
mov byte [esp + 0x30], 9
push edx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00484c2f
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 0xa
call fcn.00484b39
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 9
call fcn.00484a00
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 8
call fcn.00484a00
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call fcn.00484a00
mov esi, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00484775
mov dword [esp + 0x24], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 4
call fcn.00484a00
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.00484a00
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.00484a00
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.00484a00
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.00484a00
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8