joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e240
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov ecx, 0x412
mov esi, 0x6183a8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x48
jle 0x41e266
mov ecx, 0x48
mov edi, dword [esp + 0x20]
mov eax, edi
lea edx, [ecx + edi]
xor esi, esi
push ebp
movzx ecx, byte [eax]
inc eax
cmp eax, edx
jb 0x41e27c
mov eax, edi
movzx ebp, byte [eax]
shl ecx, 8
or ecx, ebp
inc eax
cmp eax, edx
jb 0x41e28b
mov eax, edi
movzx ebp, byte [eax]
shl ecx, 8
or ecx, ebp
inc eax
cmp eax, edx
jb 0x41e29a
mov eax, edi
movzx ebp, byte [eax]
shl ecx, 8
or ecx, ebp
inc eax
cmp eax, edx
jb 0x41e2a9
mov eax, edi
xor dword [ebx + esi*4], ecx
inc esi
cmp esi, 0x12
jl 0x41e272
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
nop
push 1
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.0041db10
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 0xc
cmp esi, 0x12
jl 0x41e2c0
xor esi, esi
lea esp, [esp]
push 1
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.0041db10
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 0xc
cmp esi, 0x400
jl 0x41e2f0
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x422b30
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push eax
mov dword [0x62b300], 0
mov dword [0x62b2fc], 0
mov dword [0x62b2f8], 0
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov ecx, 1
je 0x422cfe
mov eax, dword [esp + 0x10]
cmp eax, ecx
jne 0x422bf6
cmp dword [esp + 4], 4
jne 0x422cfe
mov eax, dword [esp + 8]
cmp eax, 0x5a
jb 0x422bbf
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422bae
mov cx, word [0x5f57f4]
mov word [eax], cx
mov dl, byte [0x5f57f6]
mov byte [eax + 2], dl
mov dword [0x62b2f8], 3
add esp, 0x94
ret
cmp eax, ecx
jb 0x422cfe
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422be5
mov cx, word [0x5f57f0]
mov word [eax], cx
mov dl, byte [0x5f57f2]
mov byte [eax + 2], dl
mov dword [0x62b2f8], 2
add esp, 0x94
ret
cmp eax, 2
jne 0x422cfe
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x422c3d
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422c26
mov edx, dword [str.Vista]
mov dword [eax], edx
mov dx, word [0x5f57ec]
mov word [eax + 4], dx
mov dword [0x62b304], ecx
mov dword [0x62b300], 4
add esp, 0x94
ret
cmp eax, 5
jb 0x422cd3
mov eax, dword [esp + 8]
cmp eax, 2
jb 0x422c7c
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422c6b
mov ecx, dword [str.2003]
mov dword [eax], ecx
mov dl, byte [0x5f57e4]
mov byte [eax + 4], dl
mov dword [0x62b300], 3
add esp, 0x94
ret
cmp eax, ecx
mov eax, dword [esp + 0x98]
jb 0x422caf
test eax, eax
je 0x422c9e
mov cx, word [0x5f57dc]
mov word [eax], cx
mov dl, byte [0x5f57de]
mov byte [eax + 2], dl
mov dword [0x62b300], 2
add esp, 0x94
ret
test eax, eax
je 0x422cc6
mov dx, word [0x5f57d8]
mov word [eax], dx
mov dl, byte [0x5f57da]
mov byte [eax + 2], dl
mov dword [0x62b300], ecx
add esp, 0x94
ret
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422cf1
mov dx, word [0x5f57d4]
mov word [eax], dx
mov dl, byte [0x5f57d6]
mov byte [eax + 2], dl
mov dword [0x62b2fc], ecx
add esp, 0x94
ret
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422d1c
mov dx, word [0x5f57d0]
mov word [eax], dx
mov dl, byte [0x5f57d2]
mov byte [eax + 2], dl
mov dword [0x62b2f8], ecx
add esp, 0x94
ret

Function at 0x423650
Capabilities:
Log keystrokes via polling

Disassembly:
push 3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x423678
mov eax, dword [0x6441d0]
test eax, eax
je 0x423685
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x6441d0]
cmp eax, 0xfa
jae 0x42367b
xor eax, eax
ret
mov dword [0x6441d0], 0
mov eax, 1
ret
Function at 0x4238a0
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
mov al, byte [esp + 0x10]
test al, 8
push ebp
push esi
mov ebp, 0x20
push edi
mov dword [esp + 0xc], 0
mov esi, ebp
je 0x4238c4
mov esi, 0x30
mov ebp, esi
jmp 0x4238e6
test al, 4
je 0x4238ce
xor esi, esi
xor ebp, ebp
jmp 0x4238e6
test al, 2
je 0x4238db
mov esi, 0x20
mov ebp, esi
jmp 0x4238e6
test al, 1
je 0x4238e6
mov esi, 0x10
mov ebp, esi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x42390b
movzx eax, word [esp + 0x18]
mov ecx, dword [0x6a0f3c]
push edi
push esi
push ebp
push 1
push eax
push ecx
call dword [sym.imp.USER32.dll_LoadImageA]
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
je 0x423978
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ecx, 0x10c
mov edi, 0x62aeb0
rep stosd dword es:[edi], eax
push edx
push 0x423880
push ebx
stosw word es:[edi], ax
mov dword [0x62b308], 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
mov al, byte [0x62aeb0]
test al, al
je 0x423967
push 0
push esi
push ebp
push 1
push 0x62aeb0
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
jmp 0x42398f
mov eax, dword [0x6a0f3c]
push 0x10
push esi
push ebp
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esp + 0x10], eax
mov bl, byte [esp + 0x20]
test bl, 2
mov esi, dword [sym.imp.SHELL32.dll_ExtractIconExA]
je 0x4239b6
test eax, eax
jne 0x4239b6
mov edx, dword [esp + 0x1c]
push 1
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
push edi
call esi
mov eax, dword [esp + 0x10]
test bl, 1
pop ebx
je 0x4239d5
test eax, eax
jne 0x4239f2
mov ecx, dword [esp + 0x18]
push 1
lea eax, [esp + 0x10]
push eax
push 0
push ecx
push edi
call esi
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4239f2
mov edx, dword [esp + 0x18]
mov eax, dword [0x6a0f3c]
push edx
push edi
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconA]
cmp eax, 1
jne 0x4239f2
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x423a00
Capabilities:
Get disk size

Disassembly:
mov eax, dword [0x676e90]
sub esp, 0x28
test eax, eax
push esi
mov esi, dword [esp + 0x30]
je 0x423a5e
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x423a5e
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
push ecx
push esi
call eax
test eax, eax
je 0x423a5e
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x423a4c
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop esi
add esp, 0x28
ret
cmp eax, 1
jne 0x423ab4
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
pop esi
add esp, 0x28
ret
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x423ab4
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x423a9a
mov eax, dword [esp + 4]
imul eax, dword [esp + 8]
imul eax, dword [esp + 0xc]
xor edx, edx
pop esi
add esp, 0x28
ret
cmp eax, 1
jne 0x423ab4
mov eax, dword [esp + 4]
imul eax, dword [esp + 8]
imul eax, dword [esp + 0x10]
xor edx, edx
pop esi
add esp, 0x28
ret
xor eax, eax
xor edx, edx
pop esi
add esp, 0x28
ret

Function at 0x423ac0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.005d9990
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor eax, eax
mov ecx, 0x41a
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423ae8
mov edi, dword [ebp + 8]
sub eax, edx
mov esi, eax
push 0x1036
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x423b3e
mov esi, ebx
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x423b35
test cl, cl
je 0x423b31
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x423b35
add eax, 2
add esi, 2
test cl, cl
jne 0x423b11
xor eax, eax
jmp 0x423b3a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x423b46
push ebx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423e80
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push 0
push str.Shell_TrayWnd
mov dword [esp + 0x1c], eax
call esi
push str.Program_Manager
push str.PROGMAN
mov dword [esp + 0x18], eax
call esi
mov ecx, dword [0x6a0f40]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push ecx
call fcn.00508880
add esp, 0x10
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
test esi, esi
je 0x423fc2
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongA]
nop
mov edx, edi
inc edi
cmp edx, 0x3e8
mov dword [esp + 0x20], edi
jge 0x423fc2
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x423faf
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x423faf
cmp esi, dword [esp + 0x14]
je 0x423fc2
cmp esi, dword [esp + 0x18]
je 0x423fc2
cmp esi, dword [esp + 0x10]
je 0x423fc2
push 0xffffffffffffffec
push esi
call ebp
mov ebx, eax
mov edi, ebx
and edi, 8
jne 0x423f53
cmp esi, dword [esp + 0x1c]
jne 0x423fab
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x423fab
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x423fcc
test edi, edi
jne 0x423fcc
push esi
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x423fcc
push 0xfffffffffffffff0
push esi
call ebp
test eax, 0xc00000
je 0x423fcc
mov edi, dword [esp + 0x20]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x423ef0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret
test bl, 8
mov eax, 0
setne al
pop edi
pop esi
pop ebp
pop ebx
inc eax
add esp, 0x44
ret
Function at 0x424220
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x764
mov edx, dword [ebp + 8]
test edx, edx
push ebx
push esi
push edi
je 0x4243a1
cmp byte [edx], 0
je 0x4243a1
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.005da53c
add esp, 0x14
mov ecx, 0x10c
xor eax, eax
lea edi, [esp + 0x338]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x619400
lea ebx, [ebx]
lea edx, [esp + 0x38]
push esi
push edx
call fcn.005f1860
add esp, 8
test eax, eax
je 0x424388
add esi, 0xa
cmp esi, 0x6194e6
jl 0x424290
push 0
push 0
push 3
push 0
push 0
push 0
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4242e8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, 2
jne 0x424388
push 0x400
lea ecx, [esp + 0x33c]
push ecx
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x424388
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.005e62d7
add esp, 8
test eax, eax
jne 0x424331
movzx eax, word [esp + 0x1a]
cmp eax, 0x2000
je 0x424388
cmp eax, 0xf000
je 0x424388
push 0x40
lea edx, [esp + 0x3c]
push 0
push edx
call fcn.005f025f
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x424394
push esi
call fcn.005ef70e
add esp, 4
test eax, eax
jne 0x42437b
lea eax, [esp + 0x14]
push eax
push esi
call fcn.005f25bc
add esp, 8
test eax, eax
jne 0x424394
movzx eax, word [esp + 0x1a]
cmp eax, 0x2000
je 0x42437b
cmp eax, 0xf000
jne 0x424394
test esi, esi
jl 0x424388
push esi
call fcn.005e2d87
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jl 0x4243a1
push esi
call fcn.005e2d87
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x136c
call fcn.005d9990
push esi
mov esi, dword [esp + 0x1374]
test esi, esi
je 0x42454b
cmp byte [esi], 0
je 0x42454b
push 0x2f
push esi
call fcn.005d9b20
add esp, 8
test eax, eax
je 0x424464
push 0x2f
push esi
mov byte [eax], 0x5c
call fcn.005d9b20
add esp, 8
test eax, eax
jne 0x424452
push 0x5f58e4
push esi
call fcn.005dc370
add esp, 8
test eax, eax
jne 0x42454b
lea edx, [esp + 0x308]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x424485
lea eax, [esp + 0x308]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4244a0
sub eax, edx
test eax, eax
jle 0x42454b
mov cl, byte [esp + eax + 0x307]
cmp cl, 0x5c
jne 0x4244c7
mov byte [esp + eax + 0x308], 0x2e
jmp 0x4244d4
cmp cl, 0x3a
jne 0x4244dc
mov byte [esp + eax + 0x308], 0x5c
mov byte [esp + eax + 0x309], 0
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x210]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x318]
push ecx
call fcn.005da53c
lea edx, [esp + 0x1c]
push edx
call fcn.00424220
add esp, 0x18
test eax, eax
jne 0x42454b
lea eax, [esp + 0x308]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42454b
test al, 0x10
mov al, byte [esp + 0x1378]
je 0x424538
test al, 2
jmp 0x42453a
test al, 1
je 0x424541
mov esi, 1
mov eax, esi
pop esi
add esp, 0x136c
ret
xor eax, eax
pop esi
add esp, 0x136c
ret

Function at 0x424870
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x108c
call fcn.005d9990
push ebx
mov bl, byte [esp + 0x1098]
test bl, 8
push esi
mov esi, dword [esp + 0x1098]
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
je 0x4248b6
mov eax, dword [0x6a0f40]
push 5
push 0x66c330
push 0
push esi
push str.explore
push eax
call edi
cmp eax, 0x20
ja 0x424972
test bl, 4
je 0x424900
push 1
push esi
call fcn.00424420
add esp, 8
test eax, eax
je 0x424900
push esi
lea ecx, [esp + 0x34]
push str._select___s_
push ecx
call fcn.005d9929
mov eax, dword [0x6a0f40]
add esp, 0xc
push 5
push 0x66c330
lea edx, [esp + 0x38]
push edx
push str.explorer.exe
push str.open
push eax
call edi
cmp eax, 0x20
ja 0x424972
test bl, 2
je 0x42491f
mov ecx, dword [0x6a0f40]
push 5
push 0x66c330
push 0
push esi
push 0
push ecx
call edi
cmp eax, 0x20
ja 0x424972
test bl, 1
je 0x424981
lea edx, [esp + 0xc]
push edx
push esi
call fcn.005e62d7
add esp, 8
test eax, eax
jne 0x42494d
cmp dword [esp + 0x20], 0xea60
jl 0x42494d
push esi
push str.write.exe___s_
lea eax, [esp + 0x38]
push eax
jmp 0x424958
push esi
push str.notepad.exe___s_
lea ecx, [esp + 0x38]
push ecx
call fcn.005d9929
add esp, 0xc
push 0xa
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x424981
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108c
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108c
ret
Function at 0x424d90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 8
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x424da3
add esp, 8
ret
push ebx
push esi
push edi
push 1
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, dword [esp + 0x1c]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
je 0x424e5d
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x424e55
push 0xa
push ebp
call fcn.005d9b20
mov esi, eax
add esp, 8
test esi, esi
je 0x424dea
mov byte [esi], 0
push 0x1036
xor eax, eax
push ebp
mov ecx, 0x41a
mov edi, ebx
push ebx
rep stosd dword es:[edi], eax
call fcn.005da020
push 0xd
push ebx
call fcn.005d9b20
add esp, 0x14
test eax, eax
je 0x424e13
mov byte [eax], 0
mov eax, dword [esp + 0x10]
push 0
push ebx
push eax
call fcn.004e8850
add esp, 0xc
test eax, eax
je 0x424e44
test esi, esi
mov dword [esp + 0x10], eax
je 0x424e51
mov byte [esi], 0xa
mov al, byte [esi + 1]
inc esi
cmp al, 0xd
jne 0x424e3b
inc esi
cmp byte [esi], 0
je 0x424e51
mov ebp, esi
jmp 0x424dd6
lea ecx, [esp + 0x10]
push ecx
call fcn.004e8c50
add esp, 4
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebp
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x424edc
mov esi, dword [esp + 0x18]
cmp byte [esi], 0
jne 0x424eb9
mov edi, 1
push edi
push 0x66c330
push str._splayq_d.txt
push esi
call fcn.005d9929
push edi
push esi
call fcn.00424420
add esp, 0x18
test eax, eax
je 0x424eb9
inc edi
push edi
push 0x66c330
push str._splayq_d.txt
push esi
call fcn.005d9929
push 1
push esi
call fcn.00424420
add esp, 0x18
test eax, eax
jne 0x424e98
push 0x40
push 0x5f5994
push esi
call fcn.005da940
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x424ee5
lea edx, [esp + 0xc]
push edx
call fcn.004e8c50
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0xc]
test eax, eax
je 0x424f1a
lea ecx, [ecx]
mov eax, dword [eax]
push eax
push 0x5f598c
push ebx
call fcn.005d9929
push esi
push ebx
call fcn.005dc408
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
mov dword [esp + 0xc], eax
jne 0x424ef0
push esi
call fcn.005da869
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x425c90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x210c
call fcn.005d9990
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
test edx, edx
mov ecx, 0x41a
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov ecx, 0x41a
lea edi, [esp + 0x10b0]
rep stosd dword es:[edi], eax
je 0x425ce9
lea eax, [esp + 0x10b0]
push 0x1068
push eax
call fcn.00423310
push eax
push edx
lea ecx, [esp + 0x10c0]
push ecx
call fcn.005da020
add esp, 0x14
lea edx, [esp + 0x10b0]
push edx
call fcn.00542e10
mov edx, dword [ebp + 0xc]
xor eax, eax
add esp, 4
test edx, edx
mov ecx, 0x41a
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
je 0x425d2b
lea eax, [esp + 0x48]
push 0x1068
push eax
call fcn.00423310
push eax
push edx
lea ecx, [esp + 0x58]
push ecx
call fcn.005da020
add esp, 0x14
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp eax, 1
jne 0x425d55
mov eax, dword [0x62b2f8]
test eax, eax
jne 0x425d55
mov eax, dword [0x62b304]
test eax, eax
jne 0x425d50
call fcn.00423c00
test eax, eax
jne 0x425d55
mov esi, str.runas
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x425dd0
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10b0]
lea eax, [esp + 0x48]
push ecx
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x440
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 5
mov dword [esp + 0x28], 0x66c330
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x425dc1
mov edx, dword [esp + 0x44]
mov dword [ebx], edx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push 0x66c330
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10bc]
push ecx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x20
cmp edx, eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428170
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, dword [esp + 0x20]
xor ebx, ebx
cmp edi, ebx
jne 0x428187
pop edi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
push esi
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
jne 0x4281b2
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
mov word [esp + 0x14], 0x4d42
call ebp
add eax, 0xe
push edi
mov dword [esp + 0x16], eax
mov word [esp + 0x1a], bx
mov word [esp + 0x1c], bx
call fcn.004280e0
mov ecx, dword [edi]
add esp, 4
cmp ecx, 0xc
jne 0x4281e9
lea eax, [eax + eax*2]
jmp 0x4281ec
shl eax, 2
movzx edx, ax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [edx + ecx + 0xe]
lea ecx, [esp + 0x2c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
mov dword [esp + 0x2e], eax
call ebx
push 0
lea eax, [esp + 0x2c]
push eax
push 0xc
lea ecx, [esp + 0x1e]
push ecx
push esi
call ebx
push 0
lea edx, [esp + 0x2c]
push edx
push edi
call ebp
push eax
push edi
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop esi
pop edi
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x4286c0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x24
push ebp
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4287af
lea eax, [esp + 0x10]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x4287af
push edi
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
mov dword [esp + 0x30], edi
je 0x4287a5
push ebx
push esi
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x42879a
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call ebp
push edi
mov dword [esp + 0x1c], eax
call esi
mov esi, eax
test esi, esi
je 0x42878b
mov edi, dword [esp + 0x3c]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [esp + 0x10], eax
je 0x428780
push eax
push esi
call ebp
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push 0xcc0020
push ecx
mov ecx, dword [edi + 8]
push edx
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0xc]
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x14]
push edx
push esi
call ebp
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
push eax
push ebx
call ebp
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop esi
pop ebx
mov eax, dword [esp + 8]
pop edi
pop ebp
add esp, 0x24
ret
xor eax, eax
pop ebp
add esp, 0x24
ret