joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409894
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069cc
xor eax, eax
push ebp
push 0x409954
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004074e0
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407690
mov eax, dword [ebx]
call fcn.0040975c
test al, al
jne 0x409931
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004074e0
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407690
mov eax, dword [ebx]
call fcn.0040975c
test al, al
jne 0x409931
mov eax, ebx
call fcn.004068e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40995b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406948
lea eax, [ebp - 4]
call fcn.004068e8
ret

Function at 0x40a364
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x418f88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x418fe1
test eax, edx
je 0x418fe4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x418f9f
movzx eax, word [eax]
sub eax, ecx
jmp 0x418fc6
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x418fc7
add ecx, 4
js 0x418fb7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x418fc4
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x418fc6
xor eax, eax
ret
test eax, eax
je 0x418ff0
test edx, edx
jne 0x418f90
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41a070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x41a09d
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x41a170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040743c
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41a1da
test ah, 4
je 0x41a1d3
test bl, bl
jne 0x41a198
mov al, 1
jmp 0x41a201
test al, 0x10
je 0x41a1a0
xor eax, eax
jmp 0x41a201
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x41a1c4
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x41a201
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x41a201
test al, 0x10
sete al
jmp 0x41a201
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x41a1fb
cmp ebx, 3
je 0x41a1fb
cmp ebx, 0x7b
je 0x41a1fb
mov eax, esi
call fcn.0041a130
test al, al
jne 0x41a1ff
xor eax, eax
jmp 0x41a201
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x41a208
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.0040743c
mov ebp, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x41a2af
test esi, 0x400
jne 0x41a244
test esi, 0x10
setne bl
jmp 0x41a2d3
cmp byte [esp], 0
je 0x41a278
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x41a2d3
push eax
call sub.kernel32.dll_CloseHandle_1
test esi, 0x10
setne bl
jmp 0x41a2d3
test esi, 0x10
je 0x41a284
mov bl, 1
jmp 0x41a2d3
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x41a2ab
push eax
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x41a2d3
mov bl, 1
jmp 0x41a2d3
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x41a2cd
cmp eax, 3
je 0x41a2cd
cmp eax, 0x7b
je 0x41a2cd
cmp eax, 0x35
je 0x41a2cd
cmp eax, 0x15
jne 0x41a2d1
xor ebx, ebx
jmp 0x41a2d3
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41deb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41deed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406a70
jmp 0x41def6
mov eax, ebx
mov edx, esi
call fcn.00406cc8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41df00
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41df22
movzx eax, word [esp]
jmp 0x41df24
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x420194
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00406de4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a344
mov edi, eax
cmp edi, 0x104
jbe 0x42013b
mov eax, edi
add eax, eax
call fcn.004048d4
mov esi, eax
jmp 0x42013d
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a344
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x420178
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x420162
mov eax, esp
cmp esi, eax
je 0x420185
mov eax, esi
call fcn.004048f0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4201c0
cmp bl, 0
je 0x4201bc
cmp bl, 0x41
jl 0x4201b7
cmp bl, 0x5a
jg 0x4201b7
or bl, 0x20
xor al, bl
inc esi
jmp 0x42019b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4200fc

Function at 0x420a14
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.004074e0
add esp, 0x800
pop ebx
ret

Function at 0x42b3d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x42b426
test eax, edx
je 0x42b429
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x42b3e9
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42b40f
add ecx, 4
js 0x42b3ff
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x42b40c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x42b435
test edx, edx
jne 0x42b3dc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x48e7dc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4baffc
cmp dword [edi], 0
jne 0x48e858
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4baff8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b55e2
mov ecx, 2
call fcn.00404a78
mov edx, 0x48e7b4
lea eax, [esi + 5]
call fcn.0048e7d4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0048e7d4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x48e82d
mov dword [0x4baff8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x49f1a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov byte [ebp - 1], 7
xor edx, edx
push ebp
push 0x49f2a8
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x49f263
mov byte [ebp - 1], 5
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x49f23f
mov byte [ebp - 1], 0xa
cmp byte [ebp - 6], 1
jne 0x49f21f
mov eax, dword [ebp - 0x118]
cmp eax, 2
jb 0x49f210
mov byte [ebp - 1], 0xe
jmp 0x49f29e
cmp eax, 1
jb 0x49f29e
mov byte [ebp - 1], 0xd
jmp 0x49f29e
mov byte [ebp - 1], 0xb
mov eax, dword [ebp - 0x118]
cmp eax, 2
jb 0x49f234
mov byte [ebp - 1], 0xf
jmp 0x49f29e
cmp eax, 1
jb 0x49f29e
mov byte [ebp - 1], 0xc
jmp 0x49f29e
cmp eax, 5
jb 0x49f29e
mov byte [ebp - 1], 6
cmp dword [ebp - 0x118], 1
jb 0x49f29e
cmp byte [ebp - 6], 1
jne 0x49f25d
mov byte [ebp - 1], 7
jmp 0x49f29e
mov byte [ebp - 1], 9
jmp 0x49f29e
cmp eax, 1
jne 0x49f29a
mov byte [ebp - 1], 1
cmp dword [ebp - 0x11c], 4
jne 0x49f282
cmp dword [ebp - 0x118], 0xa
jne 0x49f282
mov byte [ebp - 1], 2
cmp dword [ebp - 0x11c], 4
jne 0x49f29e
cmp dword [ebp - 0x118], 0x5a
jne 0x49f29e
mov byte [ebp - 1], 3
jmp 0x49f29e
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f2b2
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a200c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004069cc
mov eax, dword [ebp - 8]
call fcn.004069cc
xor eax, eax
push ebp
push 0x4a214c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x4b57bc]
cmp byte [eax], 0
je 0x4a2082
call fcn.0040a570
cmp byte [eax + 0x11], 0
je 0x4a206f
mov ebx, pe_nt_image_headers32
jmp 0x4a2082
call fcn.0040a570
cmp byte [eax + 0x10], 0
je 0x4a2082
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.0040743c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a2131
cmp dword [ebp - 8], 0
jne 0x4a20b3
xor ebx, ebx
jmp 0x4a20bd
mov eax, dword [ebp - 8]
call fcn.0040743c
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a2128
mov eax, dword [ebp - 0x20]
call fcn.004048d4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a2120
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x4a2116
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x4a2128
mov eax, dword [ebp - 0x1c]
call fcn.004048f0
jmp 0x4a2128
mov eax, dword [ebp - 0x1c]
call fcn.004048f0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2153
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406948
ret

Function at 0x4a2464
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004068e8
xor edx, edx
push ebp
push 0x4a24e5
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x402]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x4a24db
mov edx, ebx
lea eax, [ebp - 0x402]
call fcn.0041a764
cmp dword [ebx], 0
je 0x4a24db
mov eax, dword [ebx]
test eax, eax
je 0x4a24c5
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4a24db
mov eax, ebx
mov edx, 0x4a2504
call fcn.00407638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a24ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2508
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a2689
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x4a265c
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0049f2c0
cmp al, 0xa
jb 0x4a25e0
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004075b8
xor edx, edx
push ebp
push 0x4a25d9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.0040743c
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x4a25c1
mov eax, dword [ebp - 4]
call fcn.0040743c
mov edx, dword [ebp - 8]
call fcn.0041a764
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
je 0x4a2593
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4a25af
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0041fd70
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00406cc8
call fcn.00406124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2666
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a25e0
lea eax, [ebp - 4]
xor edx, edx
call fcn.004075b8
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4b58b8]
mov eax, dword [eax]
mov ecx, 0x4a26a4
mov edx, 0x4a26c0
call fcn.004a2160
test al, al
je 0x4a2652
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004a2418
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00406cc8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
test eax, eax
je 0x4a2626
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4a2652
mov eax, edx
test eax, eax
je 0x4a2635
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4a2652
mov eax, dword [ebp - 8]
mov edx, 0x4a2750
call fcn.00407638
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2666
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2690
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406948
lea eax, [ebp - 4]
call fcn.004068e8
ret

Function at 0x4a4d5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.004069cc
xor eax, eax
push ebp
push 0x4a4dc0
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.0040743c
push eax
mov eax, esi
call fcn.0040743c
push eax
mov eax, ebx
call fcn.0040743c
push eax
push 0x4a4dd0
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4dc7
lea eax, [ebp + 8]
call fcn.004068e8
ret
Function at 0x4a5058
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x4a506a
add esp, 0xfffffff0
call fcn.00405650
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp + 0x10]
call fcn.004069cc
mov eax, dword [ebp + 0xc]
call fcn.004069cc
xor eax, eax
push ebp
push 0x4a5148
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [edi + 4], esi
lea eax, [edi + 0x10]
mov edx, dword [ebp + 0x10]
call fcn.00406cc8
lea eax, [edi + 0x14]
mov edx, dword [ebp + 0xc]
call fcn.00406cc8
mov eax, dword [ebp + 8]
mov dword [edi + 0x18], eax
xor eax, eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
xor eax, eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
xor eax, eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
xor eax, eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
xor eax, eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
push 0x4a5170
call sub.user32.dll_RegisterWindowMessageW
mov dword [edi + 0x50], eax
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push 0
mov eax, dword [edi + 0x10]
call fcn.0040743c
push eax
call sub.user32.dll_FindWindowW
mov esi, eax
mov dword [edi + 0xc], esi
push esi
call sub.user32.dll_IsWindow
test eax, eax
je 0x4a5128
mov eax, dword [edi + 4]
test eax, eax
je 0x4a512d
push eax
push 6
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0xc]
push eax
call sub.user32.dll_PostMessageW
jmp 0x4a512d
xor eax, eax
mov dword [edi + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a514f
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00406948
ret
Function at 0x4a5858
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a59aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebx], 0
je 0x4a5987
xor eax, eax
push ebp
push 0x4a597d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x46a4e8]
call fcn.00484a18
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a596c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004191fc
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00418ee8
mov edx, dword [ebp - 0x14]
mov ecx, 1
mov eax, 0x4a59c8
call fcn.00407958
mov esi, eax
cmp esi, 1
jl 0x4a5956
mov edi, dword [ebp - 4]
test edi, edi
je 0x4a5903
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x1c]
push eax
lea edx, [esi + 9]
mov ecx, edi
mov eax, dword [ebp - 4]
call fcn.00407800
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004191fc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00406d10
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00419cf4
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.00406cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5973
mov eax, dword [ebp - 0xc]
call fcn.004050f4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a59b1
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00406948
lea eax, [ebp - 4]
call fcn.004068e8
ret
Function at 0x4a9140
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4a9158
add esp, 0xfffffff0
call fcn.00405650
mov esi, ecx
mov byte [ebp - 5], dl
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.004069cc
mov eax, dword [ebp + 8]
call fcn.004069cc
xor eax, eax
push ebp
push 0x4a9298
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.004050c4
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0041a3c4
lea eax, [ebp - 0xc]
call fcn.004a28dc
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
mov ecx, 0x4a92d0
call fcn.00407690
lea eax, [ebx + 0x10]
mov ecx, 0x4a92fc
mov edx, dword [ebp - 4]
call fcn.00407690
mov edx, dword [ebx + 0xc]
lea eax, [ebx + 0x14]
mov ecx, 0x4a931c
call fcn.00407690
mov edx, dword [ebx + 0xc]
lea eax, [ebx + 0x18]
mov ecx, 0x4a9340
call fcn.00407690
lea eax, [ebx + 0x1c]
mov ecx, 0x4a9364
mov edx, dword [ebp - 4]
call fcn.00407690
mov edi, esi
mov dword [ebx + 4], edi
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x42b
mov ecx, edi
mov dl, 1
mov eax, dword [0x4a4e18]
call fcn.004a5058
mov esi, eax
mov dword [ebx + 0x20], esi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], 0x4aab50
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], 0x4aaea8
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], 0x4aa950
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], 0x4aa754
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], 0x4ab038
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], 0x4ab230
mov eax, esi
call fcn.004a56e0
push 0x4a9380
call sub.user32.dll_RegisterWindowMessageW
mov dword [ebx + 8], eax
push ebx
push 0x4a93a4
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_SetPropW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a929f
lea eax, [ebp - 0xc]
call fcn.004068e8
lea eax, [ebp - 4]
call fcn.004068e8
lea eax, [ebp + 8]
mov edx, 2
call fcn.00406948
ret
Function at 0x406106
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x406115
pop dword [ebp - 0x20]
mov eax, 0x406115
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x28f1b314
sub dword [ebp - 0x30], 0xda9f6dc9
mov dword [ebp - 0x2c], 0xf81fa410
sub dword [ebp - 0x2c], 0xc5ec57cb
mov dword [ebp - 0x28], 0x31460f77
add dword [ebp - 0x28], 0x1b0634b7
mov dword [ebp - 0x24], 0x2209b1a8
sub dword [ebp - 0x24], 0x2209b1a8
lea eax, [ebp - 0x30]
push eax
mov eax, 0x7292ec6e
sub eax, 0x72526b6a
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x5f69388a
add dword [ebp - 0x30], 0x150930cc
mov dword [ebp - 0x2c], 0x6877ceed
add dword [ebp - 0x2c], 0xd8f49288
mov dword [ebp - 0x28], 0x50065628
sub dword [ebp - 0x28], 0xec96e9bc
mov dword [ebp - 0x24], 0x90a04fa7
add dword [ebp - 0x24], 0x6f5fb059
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3529b
push 0
call eax
mov ecx, 0x5f9efe8e
add ecx, 0xa0614210
xor edi, edi
add edi, eax
mov edx, 0x450400
add edx, dword [ebp - 0x20]
mov esi, 0x7b51a641
sub dword [ebp - 4], 0x6086dd57
mov ebx, dword [edx]
xor dword [ebp - 0x18], 0xd288dc21
sub ebx, esi
sub dword [ebp - 0x18], 0xa603d158
mov dword [edi], ebx
mov dword [ebp - 0x14], 0xa73f9a3c
add edi, 0x2824947b
add edi, 0xd7db6b89
add edx, 0x2534d2a8
add edx, 0xdacb2d5c
loop 0x406223
add eax, 0xf54b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbf2d9242
add ecx, 0x41126dbe
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x40656f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x4065a6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406580
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x40657b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065d7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x4065b9
pop edi
not eax
pop esi
ret 0xc