joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453d58
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453e91
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x42308c]
call fcn.0042315c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x453e67
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004231fc
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.004058d4
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x453ea8
call fcn.0040598c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00423260
lea ecx, [ebp - 4]
mov edx, 0x453ee4
mov eax, dword [ebp - 0xc]
call fcn.004234a8
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.004106fc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x453e4a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x453ef0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
call ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x488e08]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453e51
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret

Function at 0x453f3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov bl, byte [esp + 4]
test bx, bx
je 0x453f84
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x453f67
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x453f78
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x453f84
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x457940
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
test bl, bl
je 0x457961
test edi, 0x40000
je 0x457977
test bl, bl
jne 0x4579f6
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x4579f6
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
mov al, byte [esp + 1]
or al, byte [esp + 2]
je 0x4579a9
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x4579be
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x4579cd
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
mov al, byte [esp]
and al, byte [esp + 1]
jne 0x4579dd
cmp byte [esp + 2], 0
je 0x4579f6
cmp byte [esp + 2], 0
je 0x4579ee
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x4579f6
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x457cb0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x457cd6
mov eax, esp
push eax
push 0x457c78
call sub.user32.dll_EnumWindows
jmp 0x457ce9
mov eax, esp
push eax
push 0x457c58
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
mov al, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x457d74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x457dc4]
test si, 4
je 0x457d88
or bl, 1
test si, 8
je 0x457d92
or bl, 4
test si, 1
je 0x457d9c
or bl, 8
test si, 2
je 0x457da6
or bl, 0x10
test si, 0x10
je 0x457db0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457dbf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x457dc8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x457e00]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457de1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457df0
or bl, 4
test esi, 0x20000000
je 0x457dfb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x46003c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x46004e
add esp, 0xfffffff0
call fcn.00404b4c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421bf0
mov eax, dword [0x492914]
mov dword [eax + 4], ebx
mov dword [eax], 0x4603e0
mov eax, dword [0x492920]
mov dword [eax + 4], ebx
mov dword [eax], 0x4603ec
mov eax, ebx
call fcn.004603f8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4199e0]
call fcn.004047e4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4199e0]
call fcn.004047e4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4199e0]
call fcn.004047e4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4199e0]
call fcn.004047e4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4199e0]
call fcn.004047e4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45b6a8
push eax
push 0
push 0
mov eax, dword [0x492a94]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x423d44]
call fcn.004255b8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x423d44]
call fcn.004255b8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x423d44]
call fcn.004255b8
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004608c8
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x460790
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x460790
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x460790
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46018b
call fcn.00404ba4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x460574
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46071f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x460700
mov dl, 1
mov eax, dword [0x419e04]
call fcn.004047e4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00405664
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4606ef
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044a6dc
test al, al
je 0x4606e2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x460730
lea eax, [ebp - 0x254]
call fcn.0040c29c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4606e2
xor eax, eax
push ebp
push 0x4606db
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x460768
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4606c4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004058d4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4606c4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004058d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4606e2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4605e5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041daf0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460726
lea eax, [ebp - 0x260]
call fcn.00405664
ret

Function at 0x461098
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x497f68]
cmp byte [eax + 0xad], 0
jne 0x461109
cmp dword [0x497f84], 0
jne 0x4610ca
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x461054
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x497f84], eax
cmp dword [0x497f80], 0
jne 0x4610e5
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x497f80], eax
cmp dword [0x497f88], 0
jne 0x461109
push esp
push 0
push 0
push 0x460ff8
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread_1
mov dword [0x497f88], eax
pop edx
ret
Function at 0x4618ec
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46198b
cmp dword [ebx + 0x94], 0
jne 0x461985
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x461874
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x461985
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46194b
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x461985
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bd94
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46195a
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x461ba4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x497f68]
cmp dword [eax + 0x30], 0
je 0x461d01
test bl, bl
jne 0x461c52
cmp dword [esi + 0x9c], 0
jne 0x461c47
mov eax, esi
call fcn.00464534
push eax
push 0x461ad0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x461c18
mov eax, dword [0x497f68]
call fcn.00464744
test al, al
je 0x461c18
mov eax, dword [0x497f8c]
call fcn.004067ac
mov edi, eax
cmp edi, 0
jl 0x461c18
push 0
mov eax, dword [0x497f8c]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x461c02
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x461c47
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041bd94
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x461c27
inc dword [esi + 0x9c]
jmp 0x461d01
cmp dword [esi + 0x9c], 0
jle 0x461d01
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x461d01
cmp dword [esi + 0x44], 0
je 0x461cad
mov eax, dword [0x497f68]
call fcn.00464744
test al, al
je 0x461cad
mov eax, dword [0x497f8c]
call fcn.004067ac
mov edi, eax
cmp edi, 0
jl 0x461cad
push 5
mov eax, dword [0x497f8c]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x461c97
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x461cdc
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041bd94
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x461cbc
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x497f8c
mov ecx, 1
mov edx, dword [0x461ab0]
call fcn.00406980
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4627e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x462840
mov eax, ebx
call fcn.00464744
test al, al
jne 0x462840
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405754
mov eax, dword [esi]
call fcn.00405940
test eax, eax
jne 0x46284d
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004056b8
jmp 0x46284d
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004056b8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x463d1c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x463d8a
mov eax, esi
call fcn.004452fc
test al, al
je 0x463d8a
mov eax, dword [ebx + 0x84]
call fcn.00444f5c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x463d8a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x463d7e
push 0
mov eax, dword [ebx + 0x84]
call fcn.00444f5c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043cf40
jmp 0x463d8a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00463b68
pop esi
pop ebx
ret

Function at 0x464e40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov esi, edx
lea edi, [esp + 0xc]
push ecx
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, ecx
mov dword [esp], eax
lea ebp, [esp + 8]
mov eax, dword [esi]
push eax
call fcn.00464dd8
mov dword [ebp], eax
mov eax, dword [esi]
movzx ebx, word [eax + 6]
dec ebx
test ebx, ebx
jl 0x464f3e
inc ebx
mov eax, dword [ebp]
cmp dword [eax + 0x10], 0
jne 0x464ed4
mov edi, dword [esp + 0x44]
test edi, edi
jle 0x464ec7
push 0x40
push 0x1000
push edi
mov eax, dword [ebp]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esi + 4]
call fcn.00464d28
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov edx, dword [ebp]
mov dword [edx + 8], eax
mov edx, edi
mov eax, dword [esp + 4]
call fcn.00408548
push 0
push 0x28
mov eax, ebp
call fcn.00464cf8
jmp 0x464f37
push 0x40
push 0x1000
mov eax, dword [ebp]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esi + 4]
call fcn.00464d28
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esp + 4], eax
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 8]
call fcn.00464d28
mov edx, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x10]
mov eax, dword [esp + 4]
call fcn.00408540
mov eax, dword [esp + 4]
mov edx, dword [ebp]
mov dword [edx + 8], eax
push 0
push 0x28
mov eax, ebp
call fcn.00464cf8
dec ebx
jne 0x464e7d
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x465348
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x46535d
or edx, 0x200
test eax, 0x20000000
je 0x465390
test eax, 0x40000000
je 0x46537c
test eax, 0x80000000
je 0x465377
or edx, 0x40
jmp 0x4653b7
or edx, 0x20
jmp 0x4653b7
test eax, 0x80000000
je 0x46538b
or edx, 0x80
jmp 0x4653b7
or edx, 0x10
jmp 0x4653b7
test eax, 0x40000000
je 0x4653a8
test eax, 0x80000000
je 0x4653a3
or edx, 4
jmp 0x4653b7
or edx, 2
jmp 0x4653b7
test eax, 0x80000000
je 0x4653b4
or edx, 8
jmp 0x4653b7
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x4835b0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
lea eax, [ebp - 0x160]
mov edx, dword [0x40a0ac]
call fcn.004060a0
xor eax, eax
push ebp
push 0x4837c1
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x483785
mov eax, ebx
mov edx, 0x4837d8
call fcn.00405a8c
je 0x483785
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0048381c
call sub.KERNEL32.DLL_GetTickCount
mov edi, eax
or ebx, 0xffffffff
lea eax, [ebp - 0x164]
mov ecx, 0x4837e4
mov edx, dword [ebp - 8]
call fcn.0040598c
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x160]
mov edx, 0x3f
call fcn.0040b904
mov esi, eax
test esi, esi
jne 0x48377a
mov eax, dword [ebp - 0x154]
mov edx, 0x4837f0
call fcn.00405a8c
je 0x483765
mov eax, dword [ebp - 0x154]
mov edx, 0x4837fc
call fcn.00405a8c
je 0x483765
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.004058d4
cmp dword [ebp - 0x168], 0
je 0x4836c6
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.004058d4
mov ecx, dword [ebp - 0x16c]
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040598c
jmp 0x4836d7
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 8]
call fcn.0040598c
test dword [ebp - 0x158], 1
jle 0x4836fe
dec dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
push eax
mov eax, dword [ebp - 4]
call fcn.00405b40
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test dword [ebp - 0x158], 0x10
jle 0x48371c
mov eax, dword [ebp - 4]
call fcn.004835b0
mov eax, dword [ebp - 4]
call fcn.0040bbc0
jmp 0x483724
mov eax, dword [ebp - 4]
call fcn.0040b994
mov edx, 0x3e8
mov eax, edi
call fcn.00483870
test al, al
je 0x483765
cmp bl, 0xff
jne 0x48374e
call sub.KERNEL32.DLL_GetCurrentThreadId
mov edx, dword [0x492cb8]
cmp eax, dword [edx]
je 0x48374c
mov bl, 1
jmp 0x48374e
xor ebx, ebx
test bl, bl
jne 0x48375e
mov eax, dword [0x492b1c]
mov eax, dword [eax]
call fcn.00462c8c
push 0
call sub.KERNEL32.DLL_Sleep_2
lea eax, [ebp - 0x160]
call fcn.0040b954
mov esi, eax
test esi, esi
je 0x483658
lea eax, [ebp - 0x160]
call fcn.0040b978
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4837c8
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00405688
lea eax, [ebp - 0x160]
mov edx, dword [0x40a0ac]
call fcn.00406170
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405688
ret

Function at 0x4838a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
cmp dword [ebx], 0
jne 0x4838b6
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebx], eax
mov dl, 1
jmp 0x4838dc
call sub.KERNEL32.DLL_GetTickCount
cmp eax, dword [ebx]
jae 0x4838cd
or edx, 0xffffffff
sub edx, dword [ebx]
add edx, eax
cmp esi, edx
setb dl
jmp 0x4838d6
mov edx, eax
sub edx, dword [ebx]
cmp esi, edx
setb dl
test dl, dl
je 0x4838dc
mov dword [ebx], eax
mov eax, edx
pop esi
pop ebx
ret
Function at 0x483d58
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00405ebc
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
jne 0x483d7a
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x484f80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4850c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov dl, 1
mov eax, dword [0x419e04]
call fcn.004047e4
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x48509f
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00484dfc
pop ecx
mov eax, ebx
call fcn.00405940
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
sub esi, 1
jno 0x484ff2
call fcn.004046e0
test esi, esi
jl 0x485089
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, 1
call fcn.00405be0
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040598c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.0040ba34
mov eax, dword [ebp - 0x18]
call fcn.0040b780
mov edx, 0x20
mov eax, dword [ebp - 0x10]
call fcn.0040b868
push 0
mov eax, dword [ebp - 0x10]
call fcn.00405b40
push eax
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.00405b40
push eax
call sub.KERNEL32.DLL_CopyFileA
mov eax, dword [0x492b1c]
mov eax, dword [eax]
call fcn.00462c8c
push 1
call sub.KERNEL32.DLL_Sleep_2
inc ebx
dec esi
jne 0x484ffd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4850a6
mov eax, dword [ebp - 0x14]
call fcn.00404814
ret
Function at 0x4229ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x4229bd
pop dword [ebp - 0xc]
mov eax, 0x20322964
sub eax, 0x1fefffa7
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x54309
push 0
mov eax, 0x567c653d
sub eax, 0x5637b281
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x592b
mov ebx, eax
mov esi, 0x6cebaea1
add esi, 0x935ccf5f
add esi, dword [ebp - 0xc]
mov edi, 0x75c0f2a3
add edi, 0x5359d066
add dword [ebp - 4], 0x16ca0a35
mov edx, dword [esi]
add dword [ebp - 8], edi
xor edx, edi
mov dword [ebx], edx
sub dword [ebp - 8], ebx
add ebx, 0x73fd30fb
sub ebx, 0x73fd30f7
add esi, 4
loop 0x422a16
add eax, 0xca7de5e7
add eax, 0x35837198
xor ebx, ebx
add ebx, eax
add eax, 0x46e4ca6b
sub eax, 0x46e4ca66
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret