joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c0f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0x65c]
call fcn.00484b10
mov edi, dword [ebp + 8]
test eax, eax
jle 0x41c14b
nop
push esi
lea ecx, [ebx + 0x65c]
mov byte [ebp + 0xb], 0
call fcn.004154c0
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x41c299
lea ecx, [ebx + 0x65c]
inc esi
call fcn.00484b10
cmp esi, eax
jl 0x41c110
sub edi, 0x100
je 0x41c222
sub edi, 4
je 0x41c1b7
sub edi, 2
jne 0x41c217
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.00494b0a
mov ecx, dword [ebx + 0x554]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push reloc.WS2_32.dll_ioctlsocket
push edx
push 0x41e650
call dword [eax + 0x130]
mov esi, eax
test esi, esi
je 0x41c217
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xfc]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x558], 0
je 0x41c217
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movq qword [ebp - 0xc], xmm0
mov word [ebp - 0xc], ax
mov eax, dword [ebx + 0x568]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x56c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.0041a000
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x558]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x13c]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x41c217
mov ecx, dword [ebx + 0x558]
test ecx, ecx
je 0x41c280
mov eax, dword [ecx]
mov eax, dword [eax + 0xcc]
call eax
test al, al
je 0x41c280
mov ecx, dword [ebx + 0x558]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd8]
call eax
test al, al
je 0x41c280
mov ecx, dword [ebx + 0x558]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0048c8e4
add esp, 8
test eax, eax
je 0x41c280
mov ecx, dword [ebx + 0x558]
call fcn.00440e90
test al, al
jne 0x41c217
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, ebx
setns al
movzx eax, al
push eax
call fcn.0041d620
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41d370
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x41d3a1
cmp esi, dword [edi + 0x558]
je 0x41d3a1
cmp byte [edi + 0x5bd], 0
jne 0x41d3a1
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x558]
cmp esi, eax
je 0x41d496
test eax, eax
je 0x41d40d
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x20], 0x14
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x558]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x13c]
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0x558]
mov ecx, edi
call fcn.0041ce10
mov dword [edi + 0x558], 0
test esi, esi
je 0x41d496
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x41d496
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xcc]
call eax
test al, al
je 0x41d496
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xd8]
call eax
test al, al
je 0x41d496
xorps xmm0, xmm0
mov dword [edi + 0x558], esi
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 4], 0
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x558]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x13c]
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0x558]
mov ecx, edi
call fcn.0041ce10
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x443260
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x724], 0
je 0x4432d0
cmp dword [ebp + 8], 0x100
jne 0x4432c0
cmp word [ebp + 0xc], 0xd
jne 0x4432c0
cmp byte [esi + 0x72a], 0
je 0x44329e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4432c0
cmp byte [esi + 0x72b], 0
jne 0x4432c0
mov ecx, dword [esi + 0x170]
test ecx, ecx
je 0x4432b9
push 0
push 0
push 0
push str.return
push esi
call fcn.0041ce10
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x724]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x443640
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44366e
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
test eax, eax
jne 0x443687
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
push eax
mov dword [ebp - 4], 0
call fcn.00413c8d
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp eax, dword [ebx]
je 0x4436c3
push esi
call fcn.00413ca0
add esp, 4
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4436d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d46b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5490a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call fcn.00419ae0
push eax
lea ecx, [ebp - 0x94]
call fcn.00415190
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0
call fcn.004154f0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00415ba0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4437a4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x4437a4
push eax
mov dword [ebp - 0x98], 0
call fcn.00413c8d
add esp, 4
mov esi, eax
lea eax, [ebp - 0x98]
push 0
push eax
push dword [ebx]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebx]
je 0x4437a6
push esi
call fcn.00413ca0
add esp, 4
xor esi, esi
lea ecx, [ebp - 0x94]
call fcn.00415380
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret
Function at 0x4437d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00419ad0
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4437ef
pop edi
pop ebp
ret
push ebx
push edi
call fcn.00419ad0
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push edi
test ebx, ebx
jne 0x443810
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
xor eax, eax
pop edi
pop ebp
ret
call fcn.00419ad0
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
je 0x44380a
push esi
push eax
call fcn.00413c8d
add esp, 4
mov esi, eax
mov eax, dword [ebp + 0x10]
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call fcn.0048cfb0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x443a70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5490a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x443b6a
movzx eax, word [ebx]
test ax, ax
je 0x443b6a
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x443ab0
cmp ax, 0x5c
jne 0x443ab2
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x443aa4
cmp edi, ebx
je 0x443aff
sub edi, ebx
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push ebx
push eax
call fcn.00497bd3
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x443b7a
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00443a70
add esp, 8
lea ecx, [ebp - 0x414]
sub ecx, esi
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x443b10
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x443b22
lea edi, [ebp - 0x414]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x443b40
mov ecx, ebx
lea eax, [ebp - 0x414]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c46
mov esp, ebp
pop ebp
ret
call fcn.0041413a
int3
Function at 0x444250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4442e9
cmp dword [esi + 4], 0xffffffff
jne 0x4442e9
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x444280
cmp dword [ebp + 0x10], 1
mov eax, dword [0x50fa54]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x4442b3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4442b3
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00446be0
add esp, 0x10
test eax, eax
jne 0x4442d3
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.00447490
add esp, 4
mov dword [esi], eax
mov eax, dword [0x54fd58]
pop edi
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x446d20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x446d5e
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x446d52
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x446d6f
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.0048cfb0
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x446f50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x446f5e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x44701d
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5173a8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5173a8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5173a8]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5173a8]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5173a8]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5173a8]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5173a8]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5173a8]
sub edi, 1
jne 0x446f76
pop edi
test esi, esi
je 0x44703b
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5173a8]
sub esi, 1
jne 0x447021
not eax
pop esi
pop ebp
ret
Function at 0x458820
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bcb5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5490a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
mov word [edi], 0x101
lea ecx, [edi + 0x78]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 5
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 5
mov dword [edi + 0x1c], 1
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0x10
mov dword [edi + 0x2c], 0x19
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 2
mov dword [edi + 0x38], 0x3c
mov dword [edi + 0x3c], 0x16
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
movsd qword [edi + 0x50], xmm0
mov dword [edi + 0x58], 2
mov dword [edi + 0x5c], 2
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xff000000
call fcn.004151f0
push 0
lea ecx, [edi + 0x100]
mov dword [ebp - 4], 0
push 4
mov dword [edi + 0xfc], 0
mov dword [ebp - 0x14], ecx
call fcn.00415340
push 0
lea ecx, [edi + 0x110]
mov byte [ebp - 4], 1
push 4
mov dword [ebp - 0x14], ecx
call fcn.00415340
push 0
lea ecx, [edi + 0x120]
mov byte [ebp - 4], 2
push 0x84
mov dword [ebp - 0x14], ecx
call fcn.00415340
push 0x51c378
lea ecx, [edi + 0x78]
mov byte [ebp - 4], 3
call fcn.00415440
mov ecx, edi
mov dword [edi + 0x68], 5
mov dword [edi + 0x6c], 5
mov dword [edi + 0x70], 5
mov dword [edi + 0x74], 5
call fcn.00459930
push eax
mov ecx, edi
call fcn.004598e0
push eax
mov ecx, edi
call fcn.004598f0
push eax
mov ecx, edi
call fcn.004599b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45d360
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5490a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x38], 0
je 0x45d3ce
cmp dword [esi + 0x30], 0
je 0x45d3ce
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004b4c50
mov ebx, esp
test ebx, ebx
je 0x45d3ce
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x30]
push ebx
add ecx, 0x3f4
call fcn.00415440
mov ecx, dword [esi + 0x30]
push 0
push 0
push 0
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0041ce10
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45ee70
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x45f079
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x45f078
cmp eax, 0x29
jne 0x45eea8
cmp dword [esi + 0x10], 0
jne 0x45f078
test dword [esi + 0x50], 0x10000000
je 0x45f07d
cmp eax, 0x2e
jne 0x45eeff
push 5
lea ecx, [esi + 0x24]
call fcn.004617c0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x45eef3
cmp byte [eax], 0x5c
jne 0x45eef1
inc eax
cmp eax, ecx
je 0x45eef1
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x45eede
mov dl, byte [eax]
cmp dl, 0x28
je 0x45eeef
cmp dl, 0x29
je 0x45eeef
test cl, 0x10
jne 0x45eef1
mov cl, byte [eax]
cmp cl, 0x7b
je 0x45eeef
cmp cl, 0x7d
jne 0x45eef1
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.00461d10
jmp 0x45f065
cmp eax, 0x5c
jne 0x45efa4
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x45ef44
cmp byte [eax], 0x5c
jne 0x45ef42
inc eax
cmp eax, ecx
je 0x45ef42
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x45ef2f
mov dl, byte [eax]
cmp dl, 0x28
je 0x45ef40
cmp dl, 0x29
je 0x45ef40
test cl, 0x10
jne 0x45ef42
mov cl, byte [eax]
cmp cl, 0x7b
je 0x45ef40
cmp cl, 0x7d
jne 0x45ef42
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.00461d10
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x45ef71
cmp byte [esi + 0x48], 0x62
jne 0x45ef71
push 4
lea ecx, [esi + 0x24]
call fcn.004617c0
mov ecx, esi
call fcn.00461830
jmp 0x45f06c
test eax, eax
je 0x45ef98
cmp byte [esi + 0x48], 0x42
jne 0x45ef98
push 4
lea ecx, [esi + 0x24]
call fcn.004617c0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00461830
jmp 0x45f06c
mov ecx, esi
call fcn.0045f0a0
jmp 0x45f065
cmp eax, 0x5b
jne 0x45efc7
mov ecx, esi
call fcn.00461830
mov ecx, esi
call fcn.0045f6c0
push 4
push 0x5d
mov ecx, esi
call fcn.00460da0
jmp 0x45f065
cmp eax, 0x28
jne 0x45eff1
mov ecx, esi
call fcn.00461830
mov ecx, esi
call fcn.00461f50
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00460da0
test bl, bl
je 0x45f06c
jmp 0x45f065
cmp eax, 0x5e
jne 0x45f009
push 2
lea ecx, [esi + 0x24]
call fcn.004617c0
mov ecx, esi
call fcn.00461830
jmp 0x45f06c
cmp eax, 0x24
jne 0x45f021
push 3
lea ecx, [esi + 0x24]
call fcn.004617c0
mov ecx, esi
call fcn.00461830
jmp 0x45f06c
cmp eax, 0x2a
je 0x45f092
cmp eax, 0x2b
je 0x45f092
cmp eax, 0x3f
je 0x45f092
cmp eax, 0x7b
je 0x45f092
cmp eax, 0x7d
jne 0x45f043
test dword [esi + 0x50], 0x10000000
je 0x45f084
cmp eax, 0x5d
jne 0x45f051
test dword [esi + 0x50], 0x10000000
je 0x45f08b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0045e400
mov ecx, esi
call fcn.00461830
mov ecx, esi
call fcn.00461880
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x45ee80
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.00413a87
push 6
call fcn.00413a87
push 4
call fcn.00413a87
push 0xa
call fcn.00413a87
int3
Function at 0x4622a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4622d1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4622c0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x46bf00
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5490a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp ebx, 0x4e
jne 0x46bf48
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push dword [ebp + 0x10]
mov ecx, edi
push esi
push ebx
call fcn.00417050
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret 0xc
cmp ebx, 8
jne 0x46c036
push 0
push str.SysMonthCal32
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46bfcd
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
push eax
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x20
push eax
push 0
push 0x100e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x18]
cmp eax, 0x1010003
je 0x46bfb5
cmp eax, 0x2010003
jne 0x46c021
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x14]
jl 0x46bffb
cmp eax, dword [ebp - 0xc]
jg 0x46bffb
cmp eax, dword [ebp - 0x10]
jl 0x46bffb
cmp eax, dword [ebp - 8]
jle 0x46c021
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 8
call fcn.0046c250
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret 0xc
cmp ebx, 0x101
jne 0x46bf29
cmp esi, 0x2e
je 0x46c094
cmp esi, 8
je 0x46c094
cmp esi, 0x1b
jne 0x46bf29
push dword [ebp + 0x10]
push esi
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x30]
mov esi, eax
push 0
push 0
push 0x10
mov dword [ecx + 0x7dc], 3
mov ecx, edi
call fcn.00417440
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
push esi
push 0x101
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x30]
mov esi, eax
mov dword [ecx + 0x7dc], 2
mov ecx, dword [edi + 0x30]
call fcn.0046c2c0
push 0
push 0
push 0x10
mov ecx, edi
call fcn.00417440
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c46
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46c0e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ccfb
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x5490a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], eax
mov dword [eax + 0x7dc], 0
cmp dword [edi + 4], 0
jne 0x46c18d
lea eax, [ebp - 0xa4]
push eax
call fcn.0046bbe0
mov ecx, dword [edi + 0x30]
movups xmm0, xmmword [ebp - 0xa4]
push 0
push 0
sub esp, 0x10
mov eax, esp
push 0
movups xmmword [eax], xmm0
mov eax, dword [ecx]
push 0x40000000
push 0
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00415ba0
push eax
mov ecx, edi
call fcn.00416f00
mov esi, dword [edi + 0x30]
mov ecx, esi
call fcn.00430eb0
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00419610
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x30]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00415e70
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00415380
test bl, bl
je 0x46c1ca
mov eax, dword [edi + 0x30]
add eax, 0x7cc
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x30]
add eax, 0x7cc
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x38], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413c46
mov esp, ebp
pop ebp
ret 4