joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3460
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x642741
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x721970]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x20], 0
je 0x4c349c
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x20]
call fcn.004c5da0
mov ecx, dword [ebp - 0x14]
add ecx, 0x2c
call fcn.00407940
movzx edx, al
test edx, edx
jne 0x4c34c4
mov ecx, dword [ebp - 0x14]
add ecx, 0x2c
call fcn.004a7500
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c34f9
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
call fcn.004a7500
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + 0x10]
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x20]
call fcn.004c5da0
push 0
lea ecx, [ebp - 0x18]
call fcn.00435240
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x2c
call fcn.004a7500
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.00467e30
lea ecx, [ebp - 0x38]
call fcn.0047bdd0
push 0
lea ecx, [ebp - 0x18]
call fcn.0040c0e0
movzx eax, al
test eax, eax
je 0x4c3557
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00468ec0
mov al, byte [ebp - 0xd]
jmp 0x4c35f5
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.__nodes
call fcn.0040bfc0
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
call fcn.004db440
mov byte [ebp - 4], 0
mov ecx, eax
call fcn.0040ca30
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp - 0x1c]
call fcn.0040c0e0
movzx eax, al
test eax, eax
je 0x4c35c7
mov byte [ebp - 0xe], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00468ec0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00468ec0
mov al, byte [ebp - 0xe]
jmp 0x4c35f5
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0040c0c0
mov byte [ebp - 0xf], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00468ec0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00468ec0
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c5dd0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x642e05
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x721970]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0xc]
test ecx, ecx
jne 0x4c5e2a
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004068c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004068c0
jmp 0x4c5eb1
mov edx, dword [ebp - 0x14]
add edx, 8
push edx
lea ecx, [ebp - 0x10]
call fcn.004064e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.004078a0
test eax, eax
je 0x4c5e8a
lea ecx, [ebp + 8]
call fcn.004a7500
push eax
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00407830
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00407e70
push 0
lea ecx, [ebp - 0x10]
call fcn.004a7500
push eax
lea ecx, [ebp + 0xc]
call fcn.004a7500
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004068c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004068c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004068c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c9200
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6432bf
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x721970]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x18]
test ecx, ecx
je 0x4c924c
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004a7500
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x10], 0
je 0x4c9264
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.004ca750
add esp, 4
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x54], 0
je 0x4c92a2
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x54]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c929b
push 1
mov ecx, dword [ebp - 0x14]
call fcn.004ca570
mov dword [ebp - 0x1c], eax
jmp 0x4c92a2
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x54], 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x50], 0
je 0x4c92ca
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.004e69f4
add esp, 4
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00482f10
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00482f10
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004068c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004068c0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004068c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.004068c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4cacc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x4cacd4
xor eax, eax
jmp 0x4cad26
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 4]
sub eax, dword [edx + 8]
cmp dword [ebp + 0xc], eax
jbe 0x4cacf4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 4]
sub eax, dword [edx + 8]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00616ff6
add esp, 0x10
imul eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x4d30d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0
cmp dword [ebp + 0xc], 0x104
jbe 0x4d3183
call fcn.00408620
mov dword [ebp - 0x18], eax
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00419160
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4d3183
mov dword [ebp - 8], 0x104
cmp dword [ebp + 8], 0
je 0x4d3179
mov eax, dword [ebp - 8]
add eax, 1
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0060f700
add esp, 0xc
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4d3179
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jne 0x4d3179
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004d3300
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8
Function at 0x4da030
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 4], 0
jmp 0x4da049
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x4da091
mov dword [ebp - 8], 0
jmp 0x4da061
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x100
jge 0x4da08f
mov edx, dword [ebp - 4]
shl edx, 0xa
mov eax, dword [ebp - 4]
shl eax, 0xa
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax + 0x48]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov edx, dword [edx + esi*4 + 0x6a6400]
mov dword [eax + ecx*4], edx
jmp 0x4da058
jmp 0x4da040
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x4da0aa
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x4da115
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x4da0c9
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 4
jge 0x4da0fd
mov edx, dword [ebp - 0x18]
shl edx, 8
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
or edx, ecx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jl 0x4da0fb
mov dword [ebp - 8], 0
jmp 0x4da0c0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x6a63b8]
xor edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + eax*4], edx
jmp 0x4da0a1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
jmp 0x4da135
mov edx, dword [ebp - 4]
add edx, 2
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x12
jge 0x4da16a
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004da1f0
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax*4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx + eax*4 + 4], edx
jmp 0x4da12c
mov dword [ebp - 4], 0
jmp 0x4da17c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x4da1e2
mov dword [ebp - 8], 0
jmp 0x4da194
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x100
jge 0x4da1e0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004da1f0
add esp, 0xc
mov edx, dword [ebp - 4]
shl edx, 0xa
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x48]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xa
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x48]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax + ecx*4 + 4], edx
jmp 0x4da18b
jmp 0x4da173
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e6c5c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004e7c4c
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4e6c93
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004e6cb4
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ea177
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4ea1bc
call fcn.004e7c4c
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4ea1bc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4ea1d8
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00508ff2
mov ebx, eax
test edi, edi
je 0x4ea1d6
test esi, esi
je 0x4ea1d6
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4f6d3c
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x64796e
call fcn.00617a96
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004f6eac
and dword [ebp - 4], 0
mov dword [ebx], vtable.CHttpConnection.0
call fcn.004f1bf6
push eax
lea ecx, [ebx + 0x18]
call fcn.004063c0
push dword [ebp + 0xc]
lea ecx, [ebx + 0x18]
mov byte [ebp - 4], 1
call fcn.00408030
push dword [ebx + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x4f6db2
push eax
push dword [ebx + 8]
call fcn.004f73c7
push dword [ebx + 0xc]
mov ecx, 0x72cb7c
push eax
call fcn.004f7ea5
mov eax, ebx
call fcn.00617a64
ret 0x18
Function at 0x4f6dca
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x64796e
call fcn.00617a96
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x20]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.004f6eac
and dword [ebp - 4], 0
mov dword [ebx], vtable.CHttpConnection.0
call fcn.004f1bf6
push eax
lea ecx, [ebx + 0x18]
call fcn.004063c0
push dword [ebp + 0xc]
lea ecx, [ebx + 0x18]
mov byte [ebp - 4], 1
call fcn.00408030
push dword [ebx + 8]
push dword [ebp + 0x10]
push 3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x4f6e41
push eax
push dword [ebx + 8]
call fcn.004f73c7
push dword [ebx + 0xc]
mov ecx, 0x72cb7c
push eax
call fcn.004f7ea5
mov eax, ebx
call fcn.00617a64
ret 0x1c

Function at 0x4f6fb2
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x4f6fdb
call fcn.004e7c4c
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x4f7008
push esi
push eax
mov ecx, 0x72cb7c
call fcn.004f7ea5
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.004f73c7
int3

Function at 0x516064
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.004eede7
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x5160a0
call fcn.00516283
mov dword [esi + 0xc], 1
jmp 0x5160a5
call fcn.00516283
cmp dword [esi], 0
je 0x5160ee
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x5160c8
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.004ea54f
jmp 0x5160d9
push 0xff
mov ecx, esi
call fcn.00407d60
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00407e70
jmp 0x516112
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x516112
push dword [esi]
push dword [ebp - 4]
call fcn.00509686
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5161d8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00516283
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x516220
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004ea54f
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00407e70
jmp 0x51622b
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00509686
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x5b60bf
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x651abb
call fcn.00617ac9
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00407220
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x6abee4
call fcn.00407530
cmp eax, 0xffffffff
jne 0x5b6173
push 0
push 0x6b6c10
lea ecx, [ebp - 0x4d0]
call fcn.00407530
cmp eax, 0xffffffff
jne 0x5b6173
push 0
push 0x6ad734
lea ecx, [ebp - 0x4d0]
call fcn.00407530
cmp eax, 0xffffffff
jne 0x5b6173
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00407220
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x5b614f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00407e30
jmp 0x5b61a2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00408030
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00407e30
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x5b6199
mov ebx, dword [ebp - 0x4cc]
jmp 0x5b61a2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00407e30
mov eax, ebx
call fcn.00617a78
ret
Function at 0x626fc8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x721970]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0061af33
mov dword [ebp - 0x14], eax
cmp dword [0x731480], esi
jne 0x6270bb
push 0x800
push esi
push 0x6dc270
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x627048
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x62719b
push esi
push esi
push 0x6dc270
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x62719b
push 0x6dc288
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x62719b
push eax
call ebx
push 0x6dc294
push edi
mov dword [0x731480], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x6dc2a4
push edi
mov dword [0x731484], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x731488], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x731490], eax
test eax, eax
je 0x6270b8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x73148c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x6270e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6270d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x6270f5
push 4
pop eax
jmp 0x62719d
cmp dword [ebp - 0x14], esi
je 0x6270f5
push dword [0x731480]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x6270da
mov eax, dword [0x73148c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x627153
cmp dword [0x731490], edi
je 0x627153
push eax
call ebx
push dword [0x731490]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x627153
test eax, eax
je 0x627153
call ecx
test eax, eax
je 0x627148
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x627148
test byte [ebp - 8], 1
jne 0x627153
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x627183
mov eax, dword [0x731484]
cmp eax, edi
je 0x627180
push eax
call ebx
test eax, eax
je 0x627180
call eax
mov esi, eax
test esi, esi
je 0x627180
mov eax, dword [0x731488]
cmp eax, edi
je 0x627180
push eax
call ebx
test eax, eax
je 0x627180
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x731480]
call ebx
test eax, eax
je 0x62719b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x62719d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0060f7c8
mov esp, ebp
pop ebp
ret
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x7a6d4cb2
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x77a76199
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x78354f6d
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x5dd0312b
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x28ed
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1c584655
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219