joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d400
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d422
movzx eax, byte [esp]
jmp 0x40d424
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40dab4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d92c
mov eax, dword [0x4d8e84]
cmp byte [eax], 0
je 0x40db30
mov eax, dword [0x4d8a8c]
call fcn.0040378c
call fcn.00402e00
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040a728
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40db78
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40db66
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4d8a1c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4dc7f4]
call fcn.00406f74
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x4203c8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x18
add esp, 0xfffff004
push eax
dec eax
jne 0x4203d1
mov eax, dword [ebp - 4]
add esp, 0xffffff9c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 8], eax
lea esi, [ebp - 0x18065]
xor eax, eax
push ebp
push 0x42053a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1000d]
mov edx, ebx
call fcn.0040a764
mov edx, 0x42054c
lea eax, [ebp - 0x1000d]
call fcn.0040a948
test eax, eax
je 0x42046b
mov edx, 0x42054c
lea eax, [ebp - 0x1000d]
call fcn.0040a7f8
lea eax, [ebp - 0x1000d]
call fcn.0040a728
mov edx, eax
test edx, edx
jl 0x420459
inc edx
lea eax, [ebp - 0x1000d]
cmp byte [eax], 0x7c
jne 0x420455
mov byte [eax], 0
inc eax
dec edx
jne 0x42044d
mov edx, 0x420550
lea eax, [ebp - 0x800d]
call fcn.0040a764
jmp 0x420478
lea eax, [ebp - 0x800d]
mov edx, ebx
call fcn.0040a764
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402edc
mov eax, dword [ebp - 4]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x1800d]
call fcn.0040a764
mov dword [esi], 0x4c
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
lea eax, [ebp - 0x1000d]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 1
lea eax, [ebp - 0x800d]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xff
xor eax, eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x1800d]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov word [esi + 0x38], 0
mov word [esi + 0x3a], 0
mov eax, 0x420554
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x34], 0x81804
push esi
call sub.comdlg32.dll_GetOpenFileNameA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov edx, dword [esi + 0x1c]
mov eax, ebx
call fcn.0040a764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420541
lea eax, [ebp - 4]
call fcn.00405aac
ret
Function at 0x422d54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov edi, esp
push 0x70
call sub.user32.dll_GetAsyncKeyState
cmp ax, 0x8001
jne 0x422e38
mov al, 5
call fcn.00422d00
jmp 0x422e38
mov ebx, dword [edi + 4]
cmp ebx, 0x100
jb 0x422d8d
cmp ebx, 0x109
jbe 0x422da0
mov esi, dword [edi + 4]
cmp esi, 0x200
jb 0x422da7
cmp esi, 0x20a
ja 0x422da7
mov byte [0x4fd6bc], 1
cmp dword [edi + 4], 0x12
jne 0x422db2
call fcn.00422c44
push edi
mov eax, dword [0x4d8edc]
mov eax, dword [eax]
push eax
mov eax, dword [0x4d2be4]
push eax
call sub.user32.dll_TranslateAcceleratorA
test eax, eax
jne 0x422e32
mov eax, edi
call fcn.00422ca4
test al, al
jne 0x422e38
mov ebp, dword [edi + 4]
cmp ebp, 0x104
je 0x422de8
cmp ebp, 0x112
jne 0x422df1
cmp byte [0x4d2c00], 0
jne 0x422e11
cmp dword [edi + 4], 0x112
jne 0x422e03
cmp byte [0x4d2c04], 0
jne 0x422e11
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
jmp 0x422e38
mov dword [edi + 4], 0x111
xor eax, eax
mov dword [edi + 0xc], eax
and dword [edi + 8], 0xffff
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
jmp 0x422e38
push edi
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x422d7a
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x427c14
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f60
xor eax, eax
push ebp
push 0x427cd9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b50
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], si
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x15c]
call fcn.0040a764
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x427cc3
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeThread
push 0x64
call sub.kernel32.dll_Sleep_2
cmp dword [ebp - 8], 0x103
je 0x427c92
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427ce0
lea eax, [ebp - 4]
call fcn.00405aac
ret
Function at 0x427ce8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f60
xor eax, eax
push ebp
push 0x427d91
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b50
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x158]
call fcn.0040a764
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x427d7b
mov ebx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427d98
lea eax, [ebp - 4]
call fcn.00405aac
ret

Function at 0x428a44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405f70
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x428a9c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4d90c4]
mov dl, 1
mov eax, dword [0x428568]
call fcn.0040dc98
call fcn.004054f4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00428670
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x429b54
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x429b5a
ret
Function at 0x4342bc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4342ea
mov eax, ebx
call fcn.00434d70
cmp dword [ebx + 0x40], 0
je 0x4342e3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x43435b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x43434d
cmp dword [ebx + 8], 0
je 0x43430c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x43431e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x43434d
cmp dword [ebx + 8], 0
je 0x4342ff
cmp eax, 3
je 0x434331
dec eax
jne 0x4342ff
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4342ff
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4342ff
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x434379
cmp dword [ebx + 0x14], 0xcc
je 0x434379
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00434384
pop ebx
ret

Function at 0x445fd4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x446003
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x446082
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00444890
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x446050
mov cx, word [esp]
sub cx, si
jmp 0x446052
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x446039
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x446078
mov cx, word [esp]
sub cx, si
jmp 0x44607a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x446061
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4460df
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00445ca8
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4460ca
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4460df
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x445fde
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44c4d4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4fe910
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x44c4f6
shr eax, 1
xor eax, 0xedb88320
jmp 0x44c4f8
shr eax, 1
dec edx
jne 0x44c4e4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x44c4dd
mov byte [0x4fed10], 1
pop esi
pop ebx
ret

Function at 0x44c514
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4fed10], 0
jne 0x44c52b
call fcn.0044c4d4
mov eax, edi
dec eax
test eax, eax
jl 0x44c553
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4fe910]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x44c535
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x44ed98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45e]
movzx ecx, dl
cmp ecx, 6
ja case.0x44ee32.0
jmp dword [ecx*4 + 0x44edcb]
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x44edfd
sub dl, 8
je 0x44ee0c
jmp case.0x44ee32.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ea44
jmp case.0x44ee32.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ea9c
jmp case.0x44ee32.0
movzx ecx, byte [eax + 0x45d]
cmp ecx, 0x10
ja case.0x44ee32.0
movzx ecx, byte [ecx + 0x44ee39]
jmp dword [ecx*4 + 0x44ee4a]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44eb48
jmp case.0x44ee32.0
cmp dl, 3
jne 0x44ee77
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44eb9c
jmp case.0x44ee32.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44eb58
jmp case.0x44ee32.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ebe0
jmp case.0x44ee32.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x44eea2
sub dl, 8
je 0x44eeae
jmp case.0x44ee32.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ec0c
jmp case.0x44ee32.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ec78
jmp case.0x44ee32.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x44eecd
sub dl, 8
je 0x44eed9
jmp case.0x44ee32.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ed34
jmp case.0x44ee32.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ed5c
mov edx, dword [eax + 0x462]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x44d]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x451]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x449]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x44ef7d
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x49]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0044dfc4
test eax, eax
je 0x44ef7d
mov eax, ebx
call fcn.0044ef88
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x462]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x44ef16
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44ef88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x44efb9
dec al
je 0x44eff4
dec al
je 0x44f039
dec al
je 0x44f0a2
jmp 0x44f12c
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x44f12c
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x44efc9
jmp 0x44f12c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x44f12c
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x44f004
jmp 0x44f12c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x44f12c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x44f068
xor ebp, ebp
jmp 0x44f078
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x44f081
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x44f049
jmp 0x44f12c
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x44f12c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x44f0fb
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0044c55c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x44f0b6
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4529a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f60
xor eax, eax
push ebp
push 0x452b4d
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
jmp 0x4529dc
lea eax, [ebp - 4]
mov edx, 0x452b64
call fcn.00405d78
inc esi
mov eax, dword [ebp - 4]
call fcn.00405d6c
cmp eax, 3
jl 0x4529ce
jmp 0x4529f9
lea eax, [ebp - 4]
mov edx, 0x452b64
call fcn.00405d78
inc esi
mov eax, dword [ebp - 4]
call fcn.00405d6c
mov ecx, 3
cdq
idiv ecx
test edx, edx
jne 0x4529eb
mov eax, edi
call fcn.00405aac
mov ebx, 1
jmp 0x452ae5
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
shr eax, 2
and al, 0x3f
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
shl eax, 4
and al, 0x3f
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
shr edx, 4
or al, dl
mov byte [ebp - 6], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
add eax, eax
add eax, eax
and al, 0x3f
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx + 1]
shr edx, 6
or al, dl
mov byte [ebp - 7], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx + 1]
and al, 0x3f
mov byte [ebp - 8], al
push dword [edi]
lea eax, [ebp - 0xc]
movzx edx, byte [ebp - 5]
mov ecx, 0x452b70
movzx edx, byte [ecx + edx]
call fcn.00405c94
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
movzx edx, byte [ebp - 6]
mov ecx, 0x452b70
movzx edx, byte [ecx + edx]
call fcn.00405c94
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
movzx edx, byte [ebp - 7]
mov ecx, 0x452b70
movzx edx, byte [ecx + edx]
call fcn.00405c94
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
movzx edx, byte [ebp - 8]
mov ecx, 0x452b70
movzx edx, byte [ecx + edx]
call fcn.00405c94
push dword [ebp - 0x18]
mov eax, edi
mov edx, 5
call fcn.00405e30
add ebx, 3
mov eax, dword [ebp - 4]
call fcn.00405d6c
sub eax, 2
cmp ebx, eax
jle 0x452a1e
test esi, esi
jle 0x452b2a
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x452b0d
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
cmp ebx, 1
jl 0x452b2a
mov eax, edi
call fcn.00405fc8
mov byte [eax + ebx - 1], 0x3d
dec esi
test esi, esi
je 0x452b2a
dec ebx
test ebx, ebx
jne 0x452b14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452b54
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405ad0
lea eax, [ebp - 4]
call fcn.00405aac
ret
Function at 0x458e84
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], eax
mov eax, dword [esp]
push eax
call sub.user32.dll_GetWindowDC
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x458eae
xor edx, edx
mov eax, 0xf2
call fcn.00457e90
call fcn.00458778
mov ebx, eax
test ebx, ebx
jne 0x458ec5
xor edx, edx
mov eax, 0xeb
call fcn.00457e90
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindowRect
mov edi, dword [esp + 0x18]
sub edi, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
sub esi, dword [esp + 0x14]
lea ebp, [edi + edi*2]
sar ebp, 1
jns 0x458eee
adc ebp, 0
mov dword [esp + 4], edi
cmp ebp, esi
jge 0x458f08
mov eax, esi
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov dword [esp + 4], eax
mov ebp, esi
mov dword [0x4fed18], 0x14
mov eax, 0x45903c
mov dword [0x4fed1c], eax
xor eax, eax
mov dword [0x4fed20], eax
push 0x4fed18
push ebx
call sub.gdi32.dll_StartDocA
push ebx
call sub.gdi32.dll_StartPage
push 8
push ebx
call sub.gdi32.dll_SetMapMode
push 0
push ebp
mov eax, dword [esp + 0xc]
push eax
push ebx
call sub.gdi32.dll_SetWindowExtEx
call fcn.00422d54
push 0
fld dword [0x459048]
fmul qword [0x4fed34]
call fcn.004033bc
push eax
fld dword [0x45904c]
fmul qword [0x4fed2c]
call fcn.004033bc
push eax
push ebx
call sub.gdi32.dll_SetViewportExtEx
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_GetDC
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov ebp, eax
push esi
push edi
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_GetDC
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push eax
push ebp
call sub.gdi32.dll_SelectObject
push 0xcc0020
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
push esi
push edi
push 0
push 0
push ebp
call sub.gdi32.dll_BitBlt
test eax, eax
jne 0x458fda
xor edx, edx
mov eax, 0xec
call fcn.004584b4
push 0xcc0020
push 0
push 0
push ebp
push esi
push edi
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
test eax, eax
jne 0x459000
xor edx, edx
mov eax, 0xec
call fcn.004584b4
push ebx
call sub.gdi32.dll_EndPage
push ebx
call sub.gdi32.dll_EndDoc
push ebx
call sub.gdi32.dll_DeleteDC
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_ReleaseDC
mov eax, dword [esp + 0xc]
push eax
call sub.gdi32.dll_DeleteObject
push ebp
call sub.gdi32.dll_DeleteDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45b7c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x45b7cd
mov eax, dword [ebp - 4]
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10030], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x45b8fb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402edc
lea eax, [ebp - 4]
mov edx, 0x45b918
call fcn.00405d78
lea eax, [ebp - 0x1000c]
mov edx, dword [ebp - 4]
call fcn.0040a7d0
mov eax, edi
call fcn.00405aac
mov eax, edi
mov edx, 0x104
call fcn.004061f8
lea eax, [ebp - 0xc]
push eax
movzx eax, byte [ebp + 0xc]
call fcn.0045b738
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderLocation
mov dword [ebp - 0x1002c], esi
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10028], eax
lea eax, [ebp - 0x800c]
mov dword [ebp - 0x10024], eax
mov eax, dword [ebp - 8]
call fcn.00405f70
mov dword [ebp - 0x10020], eax
movzx eax, byte [ebp + 8]
call fcn.0045b744
mov dword [ebp - 0x1001c], eax
mov eax, 0x45b774
mov dword [ebp - 0x10018], eax
lea eax, [ebp - 0x1000c]
mov dword [ebp - 0x10014], eax
lea eax, [ebp - 0x1002c]
push eax
call sub.shell32.dll_SHBrowseForFolder
test eax, eax
je 0x45b8da
lea edx, [ebp - 0x800c]
push edx
push eax
call sub.shell32.dll_SHGetPathFromIDList
lea edx, [ebp - 0x10030]
lea eax, [ebp - 0x800c]
call fcn.0040a99c
mov edx, dword [ebp - 0x10030]
mov eax, edi
call fcn.00405b00
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b902
lea eax, [ebp - 0x10030]
call fcn.00405aac
lea eax, [ebp - 4]
call fcn.00405aac
ret