joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417f50
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov ebx, eax
mov edi, ecx
mov esi, edx
call ebp
test edi, edi
jne 0x417f79
test ebx, ebx
je 0x417f6f
mov dword [ebx], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x417fff
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x417faa
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00409990
mov esi, eax
call fcn.0040a650
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00409990
mov esi, eax
push 0x55e5b4
push 0x55d15c
mov edx, esi
call fcn.00411e80
add ebx, 4
push ebx
push 0x55d15c
mov edx, esi
call fcn.00411e80
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x418009
mov dword [ebx], eax
test eax, eax
jne 0x417f6f
cmp byte [esi + 0x128], al
je 0x41801e
add esi, 0x18
jmp 0x418021
mov esi, dword [esi + 0x14]
mov ecx, dword [esp + 0x18]
call fcn.00409990
mov edi, eax
push 0x55e5c4
push 0x55d15c
mov edx, edi
call fcn.00411e80
add esi, 4
push esi
push 0x55d15c
mov edx, edi
call fcn.00411e80
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x418060
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov edi, eax
mov esi, ecx
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4180fd
push ebx
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x4180a8
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00409990
mov esi, eax
call fcn.0040a650
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00409990
mov esi, eax
push 0x55e5e4
push 0x55d15c
mov edx, esi
call fcn.00411e80
add ebx, 4
push ebx
push 0x55d15c
mov edx, esi
call fcn.00411e80
add esp, 0x10
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x418107
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 0xc

Function at 0x418390
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push edi
push 0
push eax
mov eax, dword [esp + 0x14]
mov edi, ecx
call fcn.00417c90
test al, al
jne 0x4183ab
pop edi
ret 8
mov edx, dword [edi + 4]
push esi
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4183d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4183d6
xor esi, esi
mov dword [edi + 0x350], esi
pop esi
mov al, 1
pop edi
ret 8
Function at 0x419c60
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.00419730
test eax, eax
jl 0x419e98
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x419ccd
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x419c90
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x419e94
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x5560f0]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5560f0]
and esi, 0xff
mov esi, dword [esi*4 + 0x556cf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x5574f0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5560f0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5578f0]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x5560f0]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5570f0]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x5560f0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5560f0]
and esi, 0xff
mov esi, dword [esi*4 + 0x556cf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x5574f0]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x5560f0]
and edi, 0xff
xor esi, dword [edi*4 + 0x5570f0]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5560f0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5578f0]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x5560f0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5560f0]
and esi, 0xff
mov esi, dword [esi*4 + 0x556cf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x5574f0]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x5560f0]
and edi, 0xff
xor esi, dword [edi*4 + 0x5570f0]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5560f0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5578f0]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x5560f0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5560f0]
and esi, 0xff
mov esi, dword [esi*4 + 0x556cf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x5574f0]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x5560f0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5560f0]
and edi, 0xff
xor esi, dword [edi*4 + 0x5570f0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5578f0]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x419ce1
pop edi
xor eax, eax
pop esi
ret
Function at 0x41a9e0
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x41aa65
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x41aa00
pop ebx
test edi, edi
jle 0x41aac5
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x41aa8d
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x41aaaf
mov eax, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret

Function at 0x41ac40
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x41ac52
mov esi, 0x58c2a0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00418ce0
add esp, 4
lea ebx, [esp + 8]
mov eax, esi
call fcn.00418f80
mov eax, esi
pop esi
pop ebx
add esp, 0x5c
ret
Function at 0x41b040
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b0ae
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x41b07f
cmp eax, 2
jne 0x41b09a
mov eax, dword [esp]
test esi, esi
je 0x41b0a8
test eax, eax
je 0x41b0a3
test al, 1
jne 0x41b09a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x41b0a8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x41b2b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x522a28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x581500]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x14], ax
push 0x11
mov eax, str.SoftwareClasses_
lea esi, [esp + 0x14]
mov ebx, ecx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
call fcn.0041bb10
mov eax, edi
mov dword [esp + 0x38], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b316
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea ecx, [esp + 0x14]
call fcn.0041ba30
push 6
mov eax, str.Shell
lea ecx, [esp + 0x14]
call fcn.0041ba30
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
xor edx, edx
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push edx
lea eax, [esp + 0x34]
mov word [ecx + 4], dx
call fcn.0041b980
push 0x80000001
push ebx
call fcn.0041b4a0
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x41b38e
mov eax, dword [esp + 0x14]
push eax
call fcn.004fa74d
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004fa259
add esp, 0x30
ret
Function at 0x41b710
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x523b06
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
mov eax, dword [0x581500]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
xor ebx, ebx
xor ecx, ecx
push 0x3e
mov eax, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
lea esi, [esp + 0x2c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], cx
call fcn.0041bb10
mov eax, str.http
mov dword [esp + 0x458], ebx
lea edx, [eax + 2]
jmp 0x41b790
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41b790
sub eax, edx
sar eax, 1
push eax
mov eax, str.http
lea ecx, [esp + 0x2c]
call fcn.0041ba30
push 0xb
mov eax, str.UserChoice
lea ecx, [esp + 0x2c]
call fcn.0041ba30
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x458], 1
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x41b7dd
lea eax, [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push 1
push ebx
push eax
push 0x80000001
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41b8b0
mov eax, dword [esp + 0x14]
push 0x3fe
lea edx, [esp + 0x4a]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov word [esp + 0x50], cx
call fcn.004ff6c0
add esp, 0xc
push str.Progid
lea eax, [esp + 0x1c]
push eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], 0x200
call fcn.0041b040
test eax, eax
jne 0x41b8a1
xor ecx, ecx
cmp cx, word [esp + 0x44]
je 0x41b8a1
mov edi, esi
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.0041b2b0
test al, al
jne 0x41b873
mov eax, edi
push eax
mov edi, esi
call fcn.0041b3b0
add esp, 4
mov byte [esp + 0x13], al
jmp 0x41b878
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x41b887
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x41b89b
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004fa74d
add esp, 4
mov al, byte [esp + 0x13]
jmp 0x41b8c6
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x41b8b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x41b8c4
mov edx, dword [esp + 0x2c]
push edx
call fcn.004fa74d
add esp, 4
xor al, al
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.004fa259
mov esp, ebp
pop ebp
ret
Function at 0x41d910
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [edi + 4]
add eax, eax
add eax, eax
push eax
lea ebp, [ebx + 4]
lea esi, [eax + 4]
call fcn.004faba2
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
jne 0x41d93f
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10
ret
mov ecx, dword [edi]
mov dword [eax], ecx
mov ecx, dword [ecx + 8]
mov edx, 1
jmp 0x41d954
mov ebp, dword [esp + 0x10]
test ecx, ecx
je 0x41d963
mov dword [eax + edx*4], ecx
mov ecx, dword [ecx + 8]
inc edx
test ecx, ecx
jne 0x41d958
mov ecx, dword [eax + edx*4 - 4]
dec edx
mov dword [ebp], esi
mov eax, dword [ecx]
add ebp, 4
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
lea ebp, [esi + ebx]
nop
movzx edi, word [eax]
mov word [ebp], di
add eax, 2
add ebp, 2
test di, di
jne 0x41d980
movsx eax, word [ecx + 0x10]
lea esi, [esi + eax*2 + 2]
mov ax, word [ecx + 0x12]
mov word [esi + ebx], ax
mov edi, dword [ecx + 4]
add esi, 2
test edi, edi
je 0x41d9f7
lea esp, [esp]
mov ax, word [edi + 6]
add ax, ax
mov word [esi + ebx], ax
mov ecx, dword [edi]
movzx eax, ax
movzx ebp, ax
push ebp
add esi, 2
push ecx
lea edx, [esi + ebx]
push edx
call fcn.004ff740
movzx eax, word [edi + 4]
add esi, ebp
mov word [esi + ebx], ax
mov cl, byte [edi + 8]
add esi, 2
mov byte [esi + ebx], cl
mov edi, dword [edi + 0xc]
add esp, 0xc
inc esi
test edi, edi
jne 0x41d9b0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov ecx, dword [ecx + 0xc]
test edx, edx
jg 0x41d950
test ecx, ecx
jne 0x41d950
push eax
call fcn.004faac5
add esp, 4
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x10
ret

Function at 0x4209a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0x55f91c
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.004fffa0
add esp, 0xc
test eax, eax
jne 0x420a2d
mov eax, dword [esp]
test eax, eax
je 0x420a2d
mov edx, dword [esp + 8]
push eax
push 1
push 4
push edx
call fcn.00500534
add esp, 0x10
cmp eax, 1
je 0x4209ec
mov ecx, esi
call fcn.00409990
push 0x55f934
jmp 0x420a39
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
push eax
push 1
push 4
push ecx
call fcn.00500534
add esp, 0x10
cmp eax, 1
je 0x420a1d
push 0x55f94c
mov ecx, esi
call fcn.00402ea0
mov ecx, esi
call fcn.00409dd0
xor al, al
pop ecx
ret
mov edx, dword [esp]
push edx
call fcn.00500186
add esp, 4
mov al, 1
pop ecx
ret
mov ecx, esi
call fcn.00409990
push 0x55f920
push 0x55d15c
mov edx, eax
call fcn.00411e80
add esp, 8
mov ecx, esi
call fcn.00409dd0
xor al, al
pop ecx
ret
Function at 0x42d840
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x804], eax
mov ecx, dword [esp + 0x80c]
push esi
lea eax, [esp + 0x814]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [0x58e9f4]
lea ecx, [esi + esi]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004fa259
add esp, 0x808
ret

Function at 0x42d8b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x474
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x46c], eax
push esi
push edi
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.004ff6c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push 0x55c228
lea edx, [esp + 0x64]
push edx
call esi
push 0x58f010
lea eax, [esp + 0x64]
push eax
call esi
push 0x58f010
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jbe 0x42da73
cmp word [eax*2 + 0x58f00e], 0x5c
je 0x42d928
push 0x55d368
lea ecx, [esp + 0x64]
push ecx
call esi
push str.crashrpt.exe
lea edx, [esp + 0x64]
push edx
call esi
push 0x5630b0
lea eax, [esp + 0x64]
push eax
call esi
push 0x58ee08
lea ecx, [esp + 0x64]
push ecx
call esi
push 0x5630b0
lea edx, [esp + 0x64]
push edx
call esi
push str.sogoupy
lea eax, [esp + 0x64]
push eax
call esi
push 0x5630b0
lea ecx, [esp + 0x64]
push ecx
call esi
cmp byte [0x583109], 0
mov eax, 0x55c030
jne 0x42d983
mov eax, 0x55c02c
push eax
lea edx, [esp + 0x64]
push edx
call esi
push 0x55c228
lea eax, [esp + 0x64]
push eax
call esi
push 0x5c
push 0x58ec00
call fcn.004fcabf
mov edi, eax
add esp, 8
test edi, edi
je 0x42d9cf
push 0x5630b8
lea ecx, [esp + 0x64]
push ecx
call esi
add edi, 2
push edi
lea edx, [esp + 0x64]
push edx
call esi
push 0x55c228
lea eax, [esp + 0x64]
push eax
call esi
push 0x5c
push 0x58e9f8
call fcn.004fcabf
mov edi, eax
add esp, 8
test edi, edi
je 0x42da07
push 0x5630b8
lea ecx, [esp + 0x64]
push ecx
call esi
add edi, 2
push edi
lea edx, [esp + 0x64]
push edx
call esi
push 0x55c228
lea eax, [esp + 0x64]
push eax
call esi
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.004ff6c0
add esp, 0xc
cmp byte [0x583109], 0
mov dword [esp + 0x18], 0x44
je 0x42da3b
mov edx, 5
mov dword [esp + 0x44], 1
mov word [esp + 0x48], dx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x80]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x474]
pop edi
pop esi
xor ecx, esp
call fcn.004fa259
add esp, 0x474
ret
Function at 0x430080
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, eax
xor ebx, ebx
push edi
cmp dword [esi + 0x60], ebx
jne 0x4300de
push 0x2c
call fcn.004faf1d
add esp, 4
cmp eax, ebx
je 0x4300d9
or ecx, 0xffffffff
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], vtable.t_wndUiSub.0
mov dword [eax + 0x14], ebx
mov dword [eax], vtable.t_wndMenuSkinTool.0
mov dword [eax + 0x10], vtable.t_wndMenuSkinTool.1.0
mov dword [eax + 0x18], ebx
mov byte [eax + 0x20], bl
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x24], ecx
mov byte [eax + 0x28], bl
mov byte [eax + 0x29], bl
mov byte [eax + 0x2a], bl
jmp 0x4300db
xor eax, eax
mov dword [esi + 0x60], eax
mov edi, dword [esi + 0x60]
cmp byte [edi + 0x28], bl
jne 0x43011b
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
mov edx, dword [ebp + 8]
mov dword [0x58f29c], eax
mov eax, dword [ebp + 0xc]
push edi
push 0x461200
mov dword [0x58f2a0], ecx
mov dword [0x58f2a4], edx
mov dword [0x58f2a8], eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 0x1c]
mov dword [edi + 0x1c], ecx
mov eax, dword [esi + 0x60]
mov cl, byte [esp + 0x20]
mov byte [eax + 0x2a], cl
mov eax, dword [eax + 0x18]
cmp eax, ebx
je 0x430132
mov byte [eax + 0x334], cl
mov eax, dword [esi + 0x60]
mov cl, byte [esp + 0x24]
mov byte [eax + 0x29], cl
mov eax, dword [eax + 0x18]
cmp eax, ebx
je 0x430149
mov byte [eax + 0x335], cl
mov edx, dword [esp + 0x14]
mov esi, dword [esi + 0x60]
push edx
call fcn.00460fe0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14

Function at 0x4313c0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x128
push esi
mov esi, eax
mov eax, ebx
and eax, 0xff
jne 0x4313dc
xor al, al
pop esi
add esp, 0x128
ret
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx edi, ax
test di, di
jne 0x4313f9
pop edi
xor al, al
pop esi
add esp, 0x128
ret
mov byte [esp + 0xb], 1
test ebx, 0x100
je 0x431417
push str.Ctrl
lea eax, [esp + 0xf]
call fcn.00431370
add esp, 4
test ebx, 0x400
je 0x431430
push str.Shift
lea eax, [esp + 0xf]
call fcn.00431370
add esp, 4
test ebx, 0x200
je 0x431449
push 0x563a04
lea eax, [esp + 0xf]
call fcn.00431370
add esp, 4
lea ecx, [esp + 0xc]
call fcn.004114e0
push 0x55960c
push 0x55d15c
lea edx, [esp + 0x14]
call fcn.00411e80
add esp, 8
movzx eax, di
cmp di, 0x20
jae 0x431476
mov eax, 0x3f
movzx eax, ax
push eax
push 0x559644
lea edx, [esp + 0x14]
call fcn.00411e80
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x43149d
mov eax, dword [esp + 0x14]
add eax, 4
push eax
lea eax, [esp + 0xf]
call fcn.00431370
add esp, 4
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x4314d4
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x4314d4
push eax
call fcn.004faac5
add esp, 4
pop edi
mov al, 1
pop esi
add esp, 0x128
ret
Function at 0x435a20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov al, byte [0x58f228]
push esi
test al, al
jne 0x435aef
call fcn.004363d0
test eax, eax
jne 0x435a61
mov ecx, dword [ebp + 8]
call fcn.00409990
push 0x564594
push 0x55d15c
mov edx, eax
call fcn.00411e80
add esp, 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push 0
mov edx, esi
mov ecx, eax
call fcn.004a24a0
test al, al
jne 0x435a81
mov ecx, esi
call fcn.00409990
push str.Preview
jmp 0x435a4b
call fcn.00436640
test eax, eax
jne 0x435a9d
push 0x5645f0
mov ecx, esi
call fcn.00402ea0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
mov edx, esi
mov ecx, eax
call fcn.004a24a0
test al, al
jne 0x435abf
push str.Preview_IMode
mov ecx, esi
call fcn.00402ea0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x58f228], 1
mov byte [0x58e9a7], 0
mov cl, byte [0x58e9a6]
test cl, cl
jne 0x435aef
push 0
push 0
push 0x435c40
mov byte [0x58e9a6], 1
call fcn.004fbdaa
add esp, 0xc
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret