joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bffc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffac8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x528], ebx
mov dword [ebp - 0x524], ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0x510], ebx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x308]
push ecx
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x208]
push ecx
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov esi, ecx
lea edi, [ebp - 0x108]
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c1ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x510]
lea edx, [ebp - 0x208]
call fcn.00405d10
mov edx, dword [ebp - 0x510]
lea eax, [ebp - 0x50a]
call fcn.0040a7d0
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x50a]
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
je 0x45c0ef
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x51c], eax
mov byte [ebp - 0x518], 4
lea edx, [ebp - 0x51c]
xor ecx, ecx
mov eax, 0x45c208
call fcn.0040ae40
mov edx, dword [ebp - 0x514]
mov eax, dword [ebp - 4]
call fcn.00405b00
jmp 0x45c1bf
lea eax, [ebp - 0x520]
lea edx, [ebp - 0x308]
call fcn.00405d10
mov edx, dword [ebp - 0x520]
lea eax, [ebp - 0x409]
call fcn.0040a7d0
mov ebx, 1
movzx esi, byte [ebp - 0x308]
lea eax, [ebp - 0x524]
lea edx, [ebp - 0x108]
call fcn.00405d10
mov edx, dword [ebp - 0x524]
lea eax, [ebp - 0x50a]
call fcn.0040a7d0
push esi
lea eax, [ebp - 0x409]
push eax
push ebx
push 0
lea eax, [ebp - 0x50a]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x45c1b0
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x538], eax
mov byte [ebp - 0x534], 4
lea eax, [ebp - 0x108]
mov dword [ebp - 0x530], eax
mov byte [ebp - 0x52c], 4
lea edx, [ebp - 0x538]
mov ecx, 1
mov eax, 0x45c234
call fcn.0040ae40
mov edx, dword [ebp - 0x528]
mov eax, dword [ebp - 4]
call fcn.00405b00
jmp 0x45c1bf
cmp dword [ebp - 8], 0
je 0x45c1bf
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c1f4
lea eax, [ebp - 0x528]
mov edx, 3
call fcn.00405ad0
lea eax, [ebp - 0x514]
mov edx, 2
call fcn.00405ad0
ret
Function at 0x45c260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x314], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x20c]
push ecx
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov esi, ecx
lea edi, [ebp - 0x10c]
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c419
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x314]
lea edx, [ebp - 0x20c]
call fcn.00405d10
mov edx, dword [ebp - 0x314]
lea eax, [ebp - 0x30d]
call fcn.0040a7d0
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x30d]
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
je 0x45c33c
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x320], eax
mov byte [ebp - 0x31c], 4
lea edx, [ebp - 0x320]
xor ecx, ecx
mov eax, 0x45c434
call fcn.0040ae40
mov edx, dword [ebp - 0x318]
mov eax, dword [ebp - 4]
call fcn.00405b00
jmp 0x45c3eb
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ebx, 4
mov esi, 4
lea eax, [ebp - 0x324]
lea edx, [ebp - 0x10c]
call fcn.00405d10
mov edx, dword [ebp - 0x324]
lea eax, [ebp - 0x30d]
call fcn.0040a7d0
push esi
lea eax, [ebp - 8]
push eax
push ebx
push 0
lea eax, [ebp - 0x30d]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x45c3dc
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x338], eax
mov byte [ebp - 0x334], 4
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x330], eax
mov byte [ebp - 0x32c], 4
lea edx, [ebp - 0x338]
mov ecx, 1
mov eax, 0x45c460
call fcn.0040ae40
mov edx, dword [ebp - 0x328]
mov eax, dword [ebp - 4]
call fcn.00405b00
jmp 0x45c3eb
cmp dword [ebp - 0xc], 0
je 0x45c3eb
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c420
lea eax, [ebp - 0x328]
mov edx, 2
call fcn.00405ad0
lea eax, [ebp - 0x318]
mov edx, 2
call fcn.00405ad0
ret
Function at 0x45c48c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x414], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x20c]
push ecx
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov esi, ecx
lea edi, [ebp - 0x10c]
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x45c66b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x20c]
call fcn.00405d10
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0x40e]
call fcn.0040a7d0
mov eax, ebx
call fcn.00405aac
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x40e]
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x45c569
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x420], eax
mov byte [ebp - 0x41c], 4
lea edx, [ebp - 0x420]
xor ecx, ecx
mov eax, 0x45c684
call fcn.0040ae40
mov edx, dword [ebp - 0x418]
mov eax, esi
call fcn.00405b00
jmp 0x45c63d
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x101
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x10c]
call fcn.00405d10
mov edx, dword [ebp - 0x424]
lea eax, [ebp - 0x40e]
call fcn.0040a7d0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x30d]
push eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x40e]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45c60f
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x438], eax
mov byte [ebp - 0x434], 4
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x430], eax
mov byte [ebp - 0x42c], 4
lea edx, [ebp - 0x438]
mov ecx, 1
mov eax, 0x45c6b0
call fcn.0040ae40
mov edx, dword [ebp - 0x428]
mov eax, esi
call fcn.00405b00
jmp 0x45c621
mov eax, ebx
lea edx, [ebp - 0x30d]
mov ecx, 0x101
call fcn.00405d1c
cmp dword [ebp - 4], 0
jne 0x45c62e
mov eax, ebx
call fcn.00405aac
cmp dword [ebp - 0xc], 0
je 0x45c63d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c672
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00405ad0
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.00405ad0
ret
Function at 0x45c6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x414], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x20c]
push ecx
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov esi, ecx
lea edi, [ebp - 0x10c]
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x45c8af
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x20c]
call fcn.00405d10
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0x40e]
call fcn.0040a7d0
mov eax, ebx
call fcn.00405aac
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x40e]
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x45c7ad
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x420], eax
mov byte [ebp - 0x41c], 4
lea edx, [ebp - 0x420]
xor ecx, ecx
mov eax, 0x45c8c8
call fcn.0040ae40
mov edx, dword [ebp - 0x418]
mov eax, esi
call fcn.00405b00
jmp 0x45c881
mov dword [ebp - 8], 2
mov dword [ebp - 4], 0x101
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x10c]
call fcn.00405d10
mov edx, dword [ebp - 0x424]
lea eax, [ebp - 0x40e]
call fcn.0040a7d0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x30d]
push eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x40e]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45c853
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x438], eax
mov byte [ebp - 0x434], 4
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x430], eax
mov byte [ebp - 0x42c], 4
lea edx, [ebp - 0x438]
mov ecx, 1
mov eax, 0x45c8f4
call fcn.0040ae40
mov edx, dword [ebp - 0x428]
mov eax, esi
call fcn.00405b00
jmp 0x45c865
mov eax, ebx
lea edx, [ebp - 0x30d]
mov ecx, 0x101
call fcn.00405d1c
cmp dword [ebp - 4], 0
jne 0x45c872
mov eax, ebx
call fcn.00405aac
cmp dword [ebp - 0xc], 0
je 0x45c881
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c8b6
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00405ad0
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.00405ad0
ret
Function at 0x45c914
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x318], ebx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x210]
push ecx
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov esi, ecx
lea edi, [ebp - 0x110]
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45cacc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x318]
lea edx, [ebp - 0x210]
call fcn.00405d10
mov edx, dword [ebp - 0x318]
lea eax, [ebp - 0x311]
call fcn.0040a7d0
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x311]
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x45c9e9
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x324], eax
mov byte [ebp - 0x320], 4
lea edx, [ebp - 0x324]
xor ecx, ecx
mov eax, 0x45cae8
call fcn.0040ae40
mov edx, dword [ebp - 0x31c]
mov eax, esi
call fcn.00405b00
jmp 0x45ca9e
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 0x328]
lea edx, [ebp - 0x110]
call fcn.00405d10
mov edx, dword [ebp - 0x328]
lea eax, [ebp - 0x311]
call fcn.0040a7d0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x311]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45ca8c
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x33c], eax
mov byte [ebp - 0x338], 4
lea eax, [ebp - 0x110]
mov dword [ebp - 0x334], eax
mov byte [ebp - 0x330], 4
lea edx, [ebp - 0x33c]
mov ecx, 1
mov eax, 0x45cb14
call fcn.0040ae40
mov edx, dword [ebp - 0x32c]
mov eax, esi
call fcn.00405b00
jmp 0x45ca8f
mov ebx, dword [ebp - 4]
cmp dword [ebp - 0x10], 0
je 0x45ca9e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cad3
lea eax, [ebp - 0x32c]
mov edx, 2
call fcn.00405ad0
lea eax, [ebp - 0x31c]
mov edx, 2
call fcn.00405ad0
ret
Function at 0x45cc7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 1], dl
mov edi, eax
test edi, edi
setb byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x45cca4
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
movzx edx, bl
lea eax, [ebp - 0x105]
call fcn.0040325c
movzx eax, bl
mov word [ebp - 4], ax
test bl, bl
jbe 0x45cd04
movzx eax, byte [ebp - 1]
push eax
mov eax, edi
pop edx
mov ecx, edx
xor edx, edx
div ecx
mov esi, edx
cmp si, 9
jbe 0x45cce5
mov eax, esi
add al, 0x40
sub al, 9
movzx edx, bl
mov byte [ebp + edx - 0x105], al
jmp 0x45ccf3
mov eax, esi
add al, 0x30
movzx edx, bl
mov byte [ebp + edx - 0x105], al
movzx ecx, byte [ebp - 1]
mov eax, edi
xor edx, edx
div ecx
mov edi, eax
dec ebx
test bl, bl
ja 0x45ccbd
test edi, edi
jne 0x45cd17
cmp byte [ebp - 5], 0
je 0x45cd34
cmp byte [ebp - 0x104], 0x30
je 0x45cd34
movzx eax, byte [ebp - 0x105]
test al, al
jbe 0x45cd34
mov bl, 1
movzx edx, bl
mov byte [ebp + edx - 0x105], 0x2a
inc ebx
dec al
jne 0x45cd24
cmp byte [ebp + 0xc], 0
je 0x45cd52
cmp byte [ebp - 5], 0
je 0x45cd8e
cmp byte [ebp - 0x104], 0x30
jne 0x45cd8e
mov byte [ebp - 0x104], 0x2d
jmp 0x45cd8e
mov ax, 1
jmp 0x45cd64
movzx edx, ax
mov byte [ebp + edx - 0x105], 0x20
inc eax
cmp ax, word [ebp - 4]
jae 0x45cd77
movzx edx, ax
cmp byte [ebp + edx - 0x105], 0x30
je 0x45cd58
cmp byte [ebp - 5], 0
je 0x45cd8e
cmp ax, 1
jbe 0x45cd8e
movzx eax, ax
mov byte [ebp + eax - 0x106], 0x2d
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x105]
call fcn.00405d10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45cff8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov byte [ebp - 1], dl
mov ebx, eax
mov byte [ebp - 2], bl
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
mov edx, eax
cmp byte [ebp - 1], 0
je 0x45d01f
mov eax, 2
jmp 0x45d021
xor eax, eax
push 0
push eax
mov eax, dword [ebp + 8]
or dl, byte [eax - 4]
push edx
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_keybd_event
pop ebx
pop ecx
pop ebp
ret

Function at 0x45d888
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, edx
push eax
call sub.user32.dll_VkKeyScanA
movzx edx, ax
shr edx, 8
dec dx
je 0x45d8b4
add edx, 0xfffffffe
sub dx, 3
jb 0x45d8b4
je 0x45d8b9
dec dx
je 0x45d8c4
jmp 0x45d8d0
mov byte [ebx], 1
jmp 0x45d8d0
mov byte [esi], 1
mov edx, dword [ebp + 8]
mov byte [edx], 1
jmp 0x45d8d0
mov byte [ebx], 1
mov byte [esi], 1
mov edx, dword [ebp + 8]
mov byte [edx], 1
and ax, 0xff
pop esi
pop ebx
pop ebp
ret 4
Function at 0x45f3d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x45f3f5
inc edi
cmp byte [esi + edi - 1], 0x20
jne 0x45f407
mov eax, esi
call fcn.00405d6c
cmp edi, eax
jle 0x45f3f4
mov eax, esi
test eax, eax
je 0x45f412
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x45f4d4
cmp byte [esi + edi - 1], 0x2e
je 0x45f4f8
jmp 0x45f4d4
cmp byte [esi + edi - 1], 0x2e
jne 0x45f47c
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x45f4f8
cmp dword [esp + 8], 0xff
jg 0x45f4f8
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x45f460
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x45f468
mov bl, 1
jmp 0x45f476
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x45f4f8
jmp 0x45f4d3
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x45f4a1
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x45f4d3
inc edi
cmp byte [esi + edi - 1], 0x20
jne 0x45f4b3
mov eax, esi
call fcn.00405d6c
cmp edi, eax
jle 0x45f4a0
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x45f4cb
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x45f4f8
jmp 0x45f4e3
inc edi
mov eax, esi
call fcn.00405d6c
cmp edi, eax
jle 0x45f42a
cmp dword [esp + 4], 3
jne 0x45f4f8
cmp dword [esp + 8], 0xff
jg 0x45f4f8
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46c7b8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405f60
xor eax, eax
push ebp
push 0x46c85e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x424e88
mov edx, 0x46c870
mov ecx, ebx
mov eax, dword [0x4dc7f4]
call fcn.0040860c
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405f70
push eax
push ebx
call sub.user32.dll_SetWindowTextA
push 4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
push 0
push ebx
call sub.user32.dll_SetWindowPos
push 1
push ebx
call sub.user32.dll_ShowWindow
mov eax, dword [0x4d8f08]
mov dword [eax], 0x3e8
mov eax, dword [0x4d895c]
cmp byte [eax], 0
je 0x46c848
push 1
mov eax, dword [0x4d8f94]
mov eax, dword [eax]
push eax
push 0x30
push ebx
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c865
lea eax, [ebp - 4]
call fcn.00405aac
ret

Function at 0x46cf68
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x46cf70
mov eax, dword [esp + 0x8000]
add esp, 4
mov ebx, edx
mov edx, esp
push edx
push 0x7fff
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
mov edx, ebx
mov eax, esp
call fcn.0040a99c
mov eax, ebx
mov edx, esi
call fcn.004061f8
add esp, 0x8000
pop esi
pop ebx
ret
Function at 0x479ddc
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x479def
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x479dfe
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x47a904
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff4c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f60
mov eax, dword [ebp - 8]
call fcn.00405f60
xor eax, eax
push ebp
push 0x47aa73
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
test eax, eax
je 0x47a953
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x40
jle 0x47a974
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 8]
call fcn.0047a8d4
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 8]
call fcn.00405b44
lea ecx, [ebp - 0xc]
mov edx, 0x40
mov al, 0x36
call fcn.0040625c
lea ecx, [ebp - 0x10]
mov edx, 0x40
mov al, 0x5c
call fcn.0040625c
mov eax, dword [ebp - 8]
test eax, eax
je 0x47a99e
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x47a9e3
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00405fc8
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
lea eax, [ebp - 0x10]
call fcn.00405fc8
mov edx, dword [ebp - 0x10]
movzx edx, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x47a9a9
lea eax, [ebp - 0xb0]
call fcn.00479ddc
lea eax, [ebp - 0xb0]
mov edx, dword [ebp - 0xc]
call fcn.0047a620
lea eax, [ebp - 0xb0]
mov edx, dword [ebp - 4]
call fcn.0047a620
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xb0]
call fcn.0047a750
lea eax, [ebp - 0xb0]
call fcn.00479ddc
lea eax, [ebp - 0xb0]
mov edx, dword [ebp - 0x10]
call fcn.0047a620
lea eax, [ebp - 0xb0]
mov edx, dword [ebp - 0x14]
call fcn.0047a620
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xb0]
call fcn.0047a750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47aa7a
lea eax, [ebp - 0xb4]
call fcn.00405aac
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405ad0
ret
Function at 0x47dae4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x47db7f
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jle 0x47db69
call fcn.00478ec4
cmp eax, dword [esi]
jae 0x47db48
mov edx, dword [esi]
sub edx, eax
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jbe 0x47db48
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00409d70
mov ecx, dword [ebp - 0xc]
mov dl, 0xc
mov eax, edi
call fcn.0047f560
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_Sleep_1
fild dword [ebp - 4]
mov dword [ebp - 0x10], ebx
fild dword [ebp - 0x10]
fdivp st(1)
fmul dword [0x47db90]
call fcn.004033c8
mov ebx, eax
call fcn.00478ec4
add ebx, eax
mov dword [esi], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47db86
lea eax, [ebp - 0xc]
call fcn.00405aac
ret
Function at 0x48d6cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405f70
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x48d6e5
test al, 0x10
jne 0x48d6e9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x48f480
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x48f4dc
call fcn.004cce34
mov ebx, dword [0x4d8a88]
mov ebx, dword [ebx]
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x48f4e0
call fcn.004cce34
mov eax, dword [0x4d8bc8]
cmp ebx, dword [eax]
jg 0x48f4cf
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
call fcn.00405f70
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [0x4d8af0]
mov byte [eax], 1
pop ebx
pop ebp
ret

Function at 0x490378
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
call fcn.0045914c
mov eax, dword [0x4d8c88]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x4d8c78]
cmp byte [eax], 0
je 0x4903ac
mov edx, 0x4904e0
mov eax, 0xdd
call fcn.00457e90
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x4904f0
call fcn.004cce34
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x4904f4
call fcn.004cce34
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x4904f0
call fcn.004cce34
mov edi, dword [0x4d8a88]
mov edi, dword [edi]
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x4904f8
call fcn.004cce34
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, dword [0x4d8dd4]
mov esi, dword [esi]
push esi
call sub.gdi32.dll_CreateCompatibleDC
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
push edi
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov edx, dword [0x4d8c88]
mov dword [edx], eax
mov eax, dword [0x4d8c88]
mov eax, dword [eax]
push eax
push ebx
call sub.gdi32.dll_SelectObject
mov dword [ebp - 4], eax
push 0xcc0020
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x2c]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
push edi
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
mov eax, dword [0x4d88d8]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4904aa
call sub.user32.dll_EmptyClipboard
mov eax, dword [0x4d8c88]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalLock
mov eax, dword [0x4d8c88]
mov eax, dword [eax]
push eax
push 2
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.gdi32.dll_SelectObject
push ebx
call sub.gdi32.dll_DeleteDC
mov eax, dword [0x4d8c88]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [0x4d8af0]
mov byte [eax], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret