joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459818
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45982a
add esp, 0xfffffff0
call fcn.00403e88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b348
mov eax, dword [0x48f494]
mov dword [eax + 4], ebx
mov dword [eax], 0x459bbc
mov eax, dword [0x48f4a0]
mov dword [eax + 4], ebx
mov dword [eax], 0x459bc8
mov eax, ebx
call fcn.00459bd4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412f24]
call fcn.00403b34
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412f24]
call fcn.00403b34
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412f24]
call fcn.00403b34
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412f24]
call fcn.00403b34
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412f24]
call fcn.00403b34
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45566c
push eax
push 0
push 0
mov eax, dword [0x48f62c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x420ab0]
call fcn.00422304
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x420ab0]
call fcn.00422304
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x420ab0]
call fcn.00422304
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045a004
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459ed4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459ed4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459ed4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459967
call fcn.00403ee0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x459cb8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459e63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x459e44
mov dl, 1
mov eax, dword [0x413348]
call fcn.00403b34
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004049f0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x459e33
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044cbc0
test al, al
je 0x459e26
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x459e74
lea eax, [ebp - 0x254]
call fcn.00409c54
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x459e26
xor eax, eax
push ebp
push 0x459e1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x459eac
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x459e08
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404c60
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x459e08
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404c60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459e26
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x459d29
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041719c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459e6a
lea eax, [ebp - 0x260]
call fcn.004049f0
ret

Function at 0x45a7dc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x493584]
cmp byte [eax + 0xad], 0
jne 0x45a84d
cmp dword [0x49359c], 0
jne 0x45a80e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45a798
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49359c], eax
cmp dword [0x493598], 0
jne 0x45a829
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x493598], eax
cmp dword [0x4935a0], 0
jne 0x45a84d
push esp
push 0
push 0
push 0x45a73c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4935a0], eax
pop edx
ret
Function at 0x45aa20
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45aa37
add esp, 0xfffffff0
call fcn.00403e88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b348
mov eax, dword [0x48f614]
cmp word [eax + 2], 0
jne 0x45aa5f
mov eax, dword [0x48f614]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045c578
mov eax, dword [0x48f6e0]
cmp word [eax + 2], 0
jne 0x45aa79
mov eax, dword [0x48f6e0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045c784
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412f24]
call fcn.00403b34
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412f24]
call fcn.00403b34
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x412f24]
call fcn.00403b34
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x4215c0]
call fcn.00428d48
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45ac30
mov eax, dword [0x48f508]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042911c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45ce44
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48f508]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d66c
test eax, eax
je 0x45ab80
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040960c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d6a0
test eax, eax
je 0x45ab94
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404c60
mov byte [ebx + 0xd4], 0
push ebx
push 0x45c0c0
call fcn.0041c4c4
mov dword [ebx + 0xc8], eax
mov eax, dword [0x48f3d4]
cmp byte [eax], 0
jne 0x45abe5
mov eax, ebx
call fcn.0045ad74
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045d020
mov eax, ebx
call fcn.0045db80
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45ac25
call fcn.00403ee0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45aff4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x493584]
cmp dword [eax + 0x30], 0
je 0x45b09e
cmp dword [ebx + 0x94], 0
jne 0x45b098
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45af84
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45b098
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45b05e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45b098
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004152d0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45b06d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45bdb8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45bded
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404ae0
jmp 0x45bdfa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a44
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45d204
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45d272
mov eax, esi
call fcn.004478a0
test al, al
je 0x45d272
mov eax, dword [ebx + 0x84]
call fcn.00447500
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45d272
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45d266
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447500
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043f8ec
jmp 0x45d272
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045d040
pop esi
pop ebx
ret

Function at 0x4600f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46019a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
je 0x460135
cmp eax, 0x105
jl 0x46014b
mov ecx, 0x4601b0
mov dl, 1
mov eax, dword [0x4078d8]
call fcn.0040c7dc
call fcn.004043d8
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404c60
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 4]
call fcn.0040d4b0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404a44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4601a1
lea eax, [ebp - 0x110]
call fcn.004049f0
lea eax, [ebp - 4]
call fcn.004049f0
ret
Function at 0x4601d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x46023f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004049f0
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 4], eax
mov esi, 1
mov bl, 0x41
test dword [ebp - 4], esi
je 0x460221
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404bd8
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00404cbc
add esi, esi
inc ebx
cmp bl, 0x5b
jne 0x460208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460246
lea eax, [ebp - 8]
call fcn.004049f0
ret

Function at 0x460250
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4602fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004049f0
mov eax, dword [ebp - 4]
test eax, eax
je 0x460289
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x4602e2
mov edi, 1
mov eax, dword [ebp - 4]
movzx ebx, byte [eax + edi - 1]
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404bd8
lea eax, [ebp - 0xc]
mov edx, 0x460314
call fcn.00404cbc
mov eax, dword [ebp - 0xc]
call fcn.00404eb4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4602de
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404bd8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00404cbc
mov eax, dword [ebp - 8]
inc edi
dec esi
jne 0x460294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460304
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404a14
ret

Function at 0x46033c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4603f7
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x460410
lea eax, [ebp - 0x18]
call fcn.00460428
lea eax, [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.00408548
push dword [ebp - 8]
push 0x460424
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404d74
xor edx, edx
push ebp
push 0x4603d0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x413548]
call fcn.0041778c
call fcn.00403b64
mov eax, dword [ebp - 4]
call fcn.00404eb4
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4603dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4603fe
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a14
ret

Function at 0x462784
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov ebx, 0x4868f4
test edx, edx
jne 0x462797
xor eax, eax
jmp 0x4628ac
mov dword [esp], 1
cmp byte [esp], 0
je 0x4627b4
push ecx
push edx
push eax
call fcn.004628b0
add esp, 0xc
jmp 0x4628ac
push ecx
push edx
push eax
call fcn.00462bb4
add esp, 0xc
jmp 0x4628ac
pop edx
pop esi
pop ebx
ret
Function at 0x4644b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x4644f3
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x464574
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.0046200c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x464541
mov cx, word [ebp - 4]
sub cx, si
jmp 0x464543
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x46452a
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x464569
mov cx, word [ebp - 4]
sub cx, si
jmp 0x46456b
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x464552
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x4645d6
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.00464184
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4645c1
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4645d6
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4644c7
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x46a26c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x493604
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x46a28e
shr eax, 1
xor eax, 0xedb88320
jmp 0x46a290
shr eax, 1
dec edx
jne 0x46a27c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x46a275
mov byte [0x493a04], 1
pop esi
pop ebx
ret

Function at 0x46a2ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x493a04], 0
jne 0x46a2c3
call fcn.0046a26c
mov eax, edi
dec eax
test eax, eax
jl 0x46a2eb
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x493604]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x46a2cd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x46c7cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45d]
movzx ecx, dl
cmp ecx, 6
ja case.0x46c866.0
jmp dword [ecx*4 + 0x46c7ff]
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x46c831
sub dl, 8
je 0x46c840
jmp case.0x46c866.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c4f8
jmp case.0x46c866.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c550
jmp case.0x46c866.0
movzx ecx, byte [eax + 0x45c]
cmp ecx, 0x10
ja case.0x46c866.0
movzx ecx, byte [ecx + 0x46c86d]
jmp dword [ecx*4 + 0x46c87e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c5a8
jmp case.0x46c866.0
cmp dl, 3
jne 0x46c8ab
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c5fc
jmp case.0x46c866.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c5b8
jmp case.0x46c866.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c640
jmp case.0x46c866.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x46c8d6
sub dl, 8
je 0x46c8e2
jmp case.0x46c866.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c66c
jmp case.0x46c866.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c6d8
jmp case.0x46c866.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x46c901
sub dl, 8
je 0x46c90d
jmp case.0x46c866.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c748
jmp case.0x46c866.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x46c788
mov esi, dword [eax + 0x448]
mov edx, dword [ebx + 0x1c]
dec edx
imul esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0xc], esi
mov eax, dword [eax + 0x450]
mov dword [ebp - 8], eax
mov esi, edx
test esi, esi
jb 0x46c99d
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046bac0
test eax, eax
je 0x46c99d
mov eax, ebx
call fcn.0046c9a8
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x448]
sub dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x46c93d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46c9a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x46c9d9
dec al
je 0x46ca14
dec al
je 0x46ca59
dec al
je 0x46cac2
jmp 0x46cb4c
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x46cb4c
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x46c9e9
jmp 0x46cb4c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46cb4c
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x46ca24
jmp 0x46cb4c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46cb4c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x46ca88
xor ebp, ebp
jmp 0x46ca98
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x46caa1
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x46ca69
jmp 0x46cb4c
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46cb4c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x46cb1b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0046a2f4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x46cad6
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x471cd4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
push 0
push esi
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x471d03
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404c60
jmp 0x471d0a
mov eax, ebx
call fcn.004049f0
add esp, 0x108
pop esi
pop ebx
ret

Function at 0x4721f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x88]
xor ecx, ecx
mov edx, 0x80
call fcn.00403418
xor ecx, ecx
push ebp
push 0x4722bc
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 8], 0x40
cmp ebx, dword [ebp - 8]
jg 0x472247
lea edx, [ebp - 0x88]
mov eax, esi
mov ecx, ebx
call fcn.00402f08
jmp 0x47226c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, ebx
cdq
push edx
push eax
mov edx, esi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [ebp - 8]
dec edx
test edx, edx
jl 0x472282
inc edx
lea eax, [ebp - 0x88]
xor byte [eax], 0x36
inc eax
dec edx
jne 0x47227b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, dword [ebp - 8]
cdq
push edx
push eax
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4722c3
lea eax, [ebp - 0x88]
mov edx, 0x80
call fcn.0047240c
ret