joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406abc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, 6
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x406ac7
push esi
push edi
mov dword [ebp - 0xc], 0
push 0x540681
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
jne 0x406afc
mov eax, 0
jmp 0x406be6
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 8], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x406b34
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 8]
mov dword [edi], esi
jmp 0x406b88
push dword [ebp - 4]
push 8
push 1
lea edi, [ebp - 0x14]
push edi
call sub.CRTDLL.DLL_fread
add esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 8
jne 0x406b81
mov edi, dword [ebp - 0x10]
shl edi, 4
shr edi, 4
add edi, 8
cmp edi, dword [ebp - 8]
jne 0x406b81
cmp word [ebp - 0x12], 0x301
je 0x406b88
cmp word [ebp - 0x12], 0x401
je 0x406b88
cmp word [ebp - 0x12], 0x501
je 0x406b88
cmp word [ebp - 0x12], 0x602
je 0x406b88
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
je 0x406bd8
push dword [ebp - 8]
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
cmp eax, 0
je 0x406bd8
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_fread
add esp, 0x10
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 8]
cmp dword [ebp - 0x18], edi
je 0x406bd8
push dword [ebp - 0xc]
call sub.KERNEL32.dll_GlobalFree
mov dword [ebp - 0xc], 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret

Function at 0x406c73
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov ecx, 0x201
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x406c81
push edi
mov word [ebp - 2], 0x800
jmp 0x406cd8
cmp dword [ebp + 0xc], 0x800
jae 0x406ca4
mov edi, dword [ebp + 0xc]
mov word [ebp - 2], di
movzx edi, word [ebp - 2]
sub dword [ebp + 0xc], edi
push dword [ebp + 8]
push 1
movzx edi, word [ebp - 2]
push edi
lea edi, [ebp - 0x802]
push edi
call sub.CRTDLL.DLL_fread
add esp, 0x10
movzx edi, word [ebp - 2]
push edi
lea edi, [ebp - 0x802]
push edi
call fcn.00406bea
add esp, 8
cmp dword [ebp + 0xc], 0
jne 0x406c94
pop edi
leave
ret
Function at 0x406ce1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88c
mov ecx, 0x223
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x406cef
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0x800
jbe 0x406d13
mov dword [ebp + 0xc], 0x800
push dword [ebp + 8]
push 1
push dword [ebp + 0xc]
lea edi, [ebp - 0x804]
push edi
call sub.CRTDLL.DLL_fread
add esp, 0x10
cmp byte [ebp - 0x804], 0x11
jne 0x406e08
movzx ebx, byte [ebp - 0x803]
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x802]
mov dword [ebp - 0x808], edi
mov edi, dword [ebp - 4]
add edi, 3
cmp edi, dword [ebp + 0xc]
je 0x406d7b
push 0x30
push str.EA_uniTFTs_simulator
push str.wrong_Smallprotocol_length_
push dword [0x4aec44]
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 4], 0
jmp 0x406f08
mov byte [ebp - 0x889], 0
mov edi, dword [ebp - 4]
add edi, 2
push edi
lea edi, [ebp - 0x889]
push edi
lea edi, [ebp - 0x804]
push edi
call fcn.00470d38
add esp, 0xc
mov bl, byte [ebp - 0x889]
mov edi, dword [ebp - 4]
add edi, 2
cmp bl, byte [ebp + edi - 0x804]
je 0x406f08
movzx ebx, byte [ebp - 0x889]
push ebx
mov edi, dword [ebp - 4]
add edi, 2
movzx ebx, byte [ebp + edi - 0x804]
push ebx
push str.Smallprotocol_bcc_error___02X_____02X
lea edi, [ebp - 0x888]
push edi
call fcn.00491c0d
add esp, 0x10
push 0x30
push str.EA_uniTFTs_simulator
lea edi, [ebp - 0x888]
push edi
push dword [0x4aec44]
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 4], 0
jmp 0x406f08
cmp byte [ebp - 0x804], 0x13
jne 0x406f08
movzx edi, byte [ebp - 0x802]
shl edi, 8
movzx ebx, byte [ebp - 0x803]
add edi, ebx
mov dword [ebp - 4], edi
lea edi, [ebp - 0x801]
mov dword [ebp - 0x808], edi
mov edi, dword [ebp - 4]
add edi, 5
cmp edi, dword [ebp + 0xc]
je 0x406e65
push 0x30
push str.EA_uniTFTs_simulator
push str.wrong_Shortprotocol_length_
push dword [0x4aec44]
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 4], 0
jmp 0x406f08
mov edi, dword [ebp - 4]
mov esi, edi
add esi, 4
movzx esi, byte [ebp + esi - 0x804]
shl esi, 8
add edi, 3
movzx ebx, byte [ebp + edi - 0x804]
mov edi, esi
add edi, ebx
mov word [ebp - 0x88c], di
mov word [ebp - 0x88a], 0xffff
mov edi, dword [ebp - 4]
add edi, 3
push edi
lea edi, [ebp - 0x88a]
push edi
lea edi, [ebp - 0x804]
push edi
call fcn.00470dfb
add esp, 0xc
mov di, word [ebp - 0x88c]
cmp di, word [ebp - 0x88a]
je 0x406f08
movzx edi, word [ebp - 0x88a]
push edi
movzx edi, word [ebp - 0x88c]
push edi
push str.Shortprotocol_crc_error___04X_____04X
lea edi, [ebp - 0x888]
push edi
call fcn.00491c0d
add esp, 0x10
push 0x30
push str.EA_uniTFTs_simulator
lea edi, [ebp - 0x888]
push edi
push dword [0x4aec44]
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x406f1f
push dword [ebp - 4]
push dword [ebp - 0x808]
call fcn.00406bea
add esp, 8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406f24
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x406f2f
push ebx
push edi
push 0x540681
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
jne 0x406f58
jmp 0x407003
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 8], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
cmp dword [ebp - 8], 0
je 0x406ff8
mov byte [ebp - 0xc], 0
cmp dword [ebp - 8], 2
jbe 0x406fcc
push dword [ebp - 4]
push 1
push 2
lea edi, [ebp - 0xc]
push edi
call sub.CRTDLL.DLL_fread
add esp, 0x10
movzx ebx, byte [ebp - 0xc]
cmp ebx, 0xff
jne 0x406fc1
movzx ebx, byte [ebp - 0xb]
cmp ebx, 0xfe
jne 0x406fc1
sub dword [ebp - 8], 2
jmp 0x406fcc
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
movzx ebx, byte [ebp - 0xc]
cmp ebx, 0x11
je 0x406fda
cmp ebx, 0x13
jne 0x406fea
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00406ce1
add esp, 8
jmp 0x406ff8
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00406c73
add esp, 8
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
pop edi
pop ebx
leave
ret
Function at 0x41c86d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, 7
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x41c878
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov word [ebp + 0x10], di
mov edi, dword [ebp + 0x14]
mov word [ebp + 0x14], di
mov edi, dword [ebp + 0x18]
mov word [ebp + 0x18], di
mov edi, dword [ebp + 0x1c]
mov word [ebp + 0x1c], di
mov edi, dword [ebp + 0x20]
mov word [ebp + 0x20], di
mov edi, dword [ebp + 0x24]
mov word [ebp + 0x24], di
mov edi, dword [ebp + 0x28]
mov word [ebp + 0x28], di
mov edi, dword [ebp + 8]
movsx esi, word [ebp + 0x1c]
movzx ebx, word [edi + 0xa]
imul esi, ebx
movzx ebx, byte [edi + 1]
lea edi, [edi + ebx*4 + 0x14]
add esi, edi
mov dword [ebp - 0x1c], esi
movzx edi, word [0x4bf28c]
movsx esi, word [ebp + 0x14]
sub edi, esi
sub edi, 1
movzx esi, word [0x4bf284]
imul edi, esi
shl edi, 1
add edi, dword [0x4bf6b0]
mov dword [ebp - 0x18], edi
jmp 0x41ca40
movsx edi, word [ebp + 0x18]
and edi, 1
mov word [ebp - 2], di
movsx eax, word [ebp + 0x18]
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add edi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x14]
mov esi, edi
add esi, 1
mov dword [ebp - 0x14], esi
movzx ebx, byte [edi]
mov edi, ebx
mov word [ebp - 6], di
movsx edi, word [ebp + 0x10]
shl edi, 1
add edi, dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov word [ebp - 0xa], 0
jmp 0x41ca17
cmp word [ebp - 2], 0
jne 0x41c952
movzx ebx, word [ebp - 6]
jmp 0x41c95b
movzx edi, word [ebp - 6]
mov ebx, edi
sar ebx, 4
mov edi, ebx
and edi, 0xf
mov word [ebp - 4], di
movzx edi, word [ebp - 4]
cmp edi, 0
jle 0x41c9e9
movzx edi, word [ebp - 4]
shl edi, 2
mov esi, dword [ebp + 0xc]
movzx ebx, byte [edi + esi + 2]
mov edi, ebx
mov word [ebp - 8], di
movzx edi, word [ebp - 8]
cmp edi, 0
jle 0x41c9b2
movsx edi, word [ebp + 0x28]
cmp edi, 0xff
jge 0x41c9b2
movzx edi, word [ebp - 8]
movsx esi, word [ebp + 0x28]
mov eax, edi
imul eax, esi
mov ecx, 0xff
cdq
idiv ecx
mov edi, eax
mov word [ebp - 8], di
cmp word [ebp - 8], 0xff
jne 0x41c9cd
mov edi, dword [ebp - 0x10]
movzx esi, word [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov si, word [ebx + esi*4]
mov word [edi], si
jmp 0x41c9e9
movzx edi, word [ebp - 8]
push edi
movzx edi, word [ebp - 4]
mov esi, dword [ebp + 0xc]
movzx edi, word [esi + edi*4]
push edi
push dword [ebp - 0x10]
call fcn.0041b9fb
add esp, 0xc
movzx edi, word [ebp - 2]
xor edi, 1
mov word [ebp - 2], di
cmp word [ebp - 2], 0
jne 0x41ca0f
mov edi, dword [ebp - 0x14]
mov esi, edi
add esi, 1
mov dword [ebp - 0x14], esi
movzx ebx, byte [edi]
mov edi, ebx
mov word [ebp - 6], di
add dword [ebp - 0x10], 2
inc word [ebp - 0xa]
movzx edi, word [ebp - 0xa]
movsx esi, word [ebp + 0x20]
cmp edi, esi
jl 0x41c945
mov edi, dword [ebp + 8]
movzx edi, word [edi + 0xa]
add edi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
movzx edi, word [0x4bf284]
shl edi, 1
sub dword [ebp - 0x18], edi
movsx edi, word [ebp + 0x24]
mov esi, edi
sub esi, 1
mov word [ebp + 0x24], si
cmp edi, 0
jg 0x41c8fb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420c97
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov ecx, 0xb
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x420ca2
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x14]
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x2c]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp + 8]
movsx esi, word [edi + 0x4e]
shl esi, 1
movzx ebx, word [0x4bf28c]
movsx edi, word [edi + 0x50]
sub ebx, edi
mov edi, ebx
sub edi, 1
movzx ebx, word [0x4bf284]
imul edi, ebx
shl edi, 1
add edi, dword [0x4bf2a0]
add esi, edi
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x2c]
add edi, 0x14
mov dword [ebp - 0x24], edi
mov edi, dword [ebp - 0xc]
add edi, 0x14
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 8]
test dword [edi + 0x44], 0x100000
je 0x420d18
mov ebx, 0xff
jmp 0x420d1d
mov ebx, 0
mov byte [ebp - 0x11], bl
mov word [ebp - 0x26], 0
jmp 0x420dbe
mov word [ebp - 6], 0
mov word [ebp - 4], 0
jmp 0x420d90
mov edi, dword [ebp - 0x10]
mov esi, edi
add esi, 1
mov dword [ebp - 0x10], esi
movzx ebx, byte [edi]
movzx edx, byte [ebp - 0x11]
mov edi, ebx
xor edi, edx
mov ebx, edi
mov byte [ebp - 1], bl
movzx ebx, byte [ebp - 1]
movzx edx, byte [ebp + 0xc]
cmp ebx, edx
jb 0x420d88
movzx edx, byte [ebp + 0x10]
cmp ebx, edx
ja 0x420d88
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x18], edi
movzx edi, word [ebp - 6]
shl edi, 1
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
mov bx, word [ebx + edi]
mov word [esi + edi], bx
inc word [ebp - 6]
inc word [ebp - 4]
movzx edi, word [ebp - 4]
mov esi, dword [ebp - 0xc]
movzx esi, word [esi + 2]
cmp edi, esi
jl 0x420d39
mov edi, dword [ebp - 0x2c]
movzx edi, word [edi + 2]
shl edi, 1
add edi, dword [ebp - 0x24]
mov dword [ebp - 0x24], edi
movzx edi, word [0x4bf284]
shl edi, 1
sub dword [ebp - 0x20], edi
inc word [ebp - 0x26]
movzx edi, word [ebp - 0x26]
mov esi, dword [ebp - 0xc]
movzx esi, word [esi + 4]
cmp edi, esi
jl 0x420d2b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b41d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
mov ecx, 2
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x42b427
push esi
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp + 0xc], di
mov edi, dword [ebp + 8]
cmp word [edi], 0
jne 0x42b44d
mov eax, 1
jmp 0x42b50d
mov word [ebp - 4], 0
mov word [ebp - 6], 0x20
jmp 0x42b4ea
cmp word [ebp - 2], 0x2d
jne 0x42b48a
cmp word [ebp - 4], 0
je 0x42b47d
cmp word [ebp + 0xc], 0x2d
jne 0x42b47d
mov eax, 1
jmp 0x42b50d
movzx edi, word [ebp - 4]
xor edi, 1
mov word [ebp - 4], di
jmp 0x42b4db
cmp word [ebp - 4], 0
je 0x42b4c8
movzx edi, word [ebp + 0xc]
movzx esi, word [ebp - 6]
cmp esi, edi
ja 0x42b4a5
movzx esi, word [ebp - 2]
cmp edi, esi
jle 0x42b4b9
movzx edi, word [ebp + 0xc]
movzx esi, word [ebp - 6]
cmp esi, edi
jb 0x42b4c0
movzx esi, word [ebp - 2]
cmp edi, esi
jb 0x42b4c0
mov eax, 1
jmp 0x42b50d
mov word [ebp - 4], 0
jmp 0x42b4db
movzx edi, word [ebp + 0xc]
movzx esi, word [ebp - 2]
cmp edi, esi
jne 0x42b4db
mov eax, 1
jmp 0x42b50d
cmp word [ebp - 4], 0
jne 0x42b4ea
mov di, word [ebp - 2]
mov word [ebp - 6], di
mov edi, dword [ebp + 8]
mov esi, edi
add esi, 2
mov dword [ebp + 8], esi
mov di, word [edi]
mov word [ebp - 2], di
movzx edi, di
cmp edi, 0
jg 0x42b45e
mov eax, 0
pop edi
pop esi
leave
ret

Function at 0x430ad5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
mov ecx, 2
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x430adf
push ebx
push esi
push edi
test dword [0x4bf93c], 0x20
jne 0x430ba7
lea edi, [0x4c0954]
mov dword [ebp - 4], edi
movzx edi, word [0x4bf92e]
movzx esi, word [0x4bf920]
imul edi, esi
movzx esi, word [0x4bf922]
movzx ebx, word [0x4bf92a]
sub esi, ebx
imul edi, esi
add edi, dword [ebp - 4]
mov dword [ebp - 4], edi
movzx edi, word [0x4bf928]
sub edi, 1
add edi, dword [ebp - 4]
mov dword [ebp - 4], edi
mov word [ebp - 6], 0
jmp 0x430b66
mov edi, dword [ebp - 4]
movzx ebx, byte [edi]
mov esi, ebx
not esi
mov ebx, esi
mov byte [edi], bl
movzx edi, word [0x4bf920]
add edi, dword [ebp - 4]
mov dword [ebp - 4], edi
inc word [ebp - 6]
movzx edi, word [ebp - 6]
movzx esi, word [0x4bf92e]
cmp edi, esi
jl 0x430b47
mov edi, dword [0x4bf93c]
mov esi, edi
and esi, 0xffffffef
shl edi, 0x1b
shr edi, 0x1f
xor edi, 1
and edi, 1
shl edi, 4
and edi, 0x10
or esi, edi
mov dword [0x4bf93c], esi
mov edi, dword [0x4ae7ec]
mov word [0x4bf92c], di
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4377b9
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
mov ecx, 2
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4377c3
push edi
cmp dword [ebp + 0xc], 0
jle 0x43780d
cmp dword [0x4b4adc], 0
je 0x4377f3
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x4b4adc]
call fcn.0040170c
add esp, 0xc
jmp 0x43780d
mov edi, dword [ebp + 8]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
lea edi, [ebp - 8]
push edi
push 0x437704
call sub.USER32.DLL_EnumWindows
pop edi
leave
ret
Function at 0x47394a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 4
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x473955
push edi
cmp dword [ebp + 8], 0
jne 0x47396d
mov eax, 0xffffffff
jmp 0x4739cf
call fcn.00473614
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
push 0
lea edi, [ebp - 4]
push edi
push 1
lea edi, [ebp - 9]
push edi
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 1
je 0x4739b2
call fcn.00473614
mov dword [ebp - 8], eax
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 8], edi
je 0x4739b2
dec dword [ebp + 0xc]
mov edi, dword [ebp - 8]
mov dword [ebp - 0x10], edi
push 0
call sub.KERNEL32.dll_Sleep
cmp dword [ebp - 4], 1
je 0x4739be
cmp dword [ebp + 0xc], 0
jg 0x473978
cmp dword [ebp - 4], 1
je 0x4739cb
mov eax, 0xffffffff
jmp 0x4739cf
movzx eax, byte [ebp - 9]
pop edi
leave
ret

Function at 0x473d95
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov ecx, 0x44
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x473da3
push ebx
push esi
push edi
lea edi, [0x4f7686]
mov dword [ebp - 0xc], edi
push 0x28
push 0
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_memset
add esp, 0xc
push 0x4a24a4
push 0xff
lea edi, [ebp - 0x110]
push edi
push 0x54318e
push str.data
push str.RTCRAM
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edi, [ebp - 0x110]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 0
jmp 0x473e3e
lea edi, [ebp - 8]
push edi
push 0x54318b
push dword [ebp - 4]
call fcn.00491acc
add esp, 0xc
mov edi, dword [ebp - 0xc]
mov esi, edi
add esi, 1
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 8]
mov ebx, esi
mov byte [edi], bl
push 0x2c
push dword [ebp - 4]
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
je 0x473e3e
add dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x473e54
mov edi, dword [ebp - 0x10]
mov esi, edi
add esi, 1
mov dword [ebp - 0x10], esi
cmp edi, 0x28
jl 0x473dff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x474f83
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push 0xdb6
push dword [0x4a4bf0]
call sub.USER32.DLL_GetDlgItem
cmp dword [ebp + 8], eax
jne 0x474fca
push 0xff
push 0x4a1518
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowTextA
push 0x4a14f4
call fcn.00474e05
add esp, 4
push 0x4a14f4
call fcn.0047483a
add esp, 4
jmp 0x47500b
push 0xdc0
push dword [0x4a4bf0]
call sub.USER32.DLL_GetDlgItem
cmp dword [ebp + 8], eax
jne 0x47500b
push 0xff
push 0x4a40d8
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowTextA
push 0x4a40b4
call fcn.00474e05
add esp, 4
push 0x4a40b4
call fcn.0047483a
add esp, 4
pop edi
leave
ret
Function at 0x477db8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 1
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x477dc1
push ebx
push esi
push edi
movzx eax, byte [ebp + 8]
mov ecx, 8
cdq
idiv ecx
mov ebx, eax
mov byte [ebp - 2], bl
movzx ebx, byte [ebp + 8]
cmp ebx, 8
jge 0x477df3
mov bl, byte [0x50b7e4]
mov byte [ebp - 1], bl
jmp 0x477e42
movzx ebx, byte [ebp + 8]
cmp ebx, 0x88
jge 0x477e42
sub byte [ebp + 8], 8
movzx eax, byte [ebp + 8]
mov ecx, 0x10
cdq
idiv ecx
cmp edx, 8
jge 0x477e2c
movzx eax, byte [ebp + 8]
mov ecx, 0x10
cdq
idiv ecx
mov bl, byte [eax*8 + 0x50b866]
mov byte [ebp - 1], bl
jmp 0x477e42
movzx eax, byte [ebp + 8]
mov ecx, 0x10
cdq
idiv ecx
mov bl, byte [eax*8 + 0x50b867]
mov byte [ebp - 1], bl
movzx ebx, byte [ebp - 2]
cmp ebx, 0x11
jge 0x477edf
cmp byte [ebp + 0xc], 0
jne 0x477e7b
movzx ebx, byte [ebp - 1]
mov edi, 1
movzx eax, byte [ebp + 8]
mov ecx, 8
cdq
idiv ecx
mov ecx, edx
shl edi, cl
not edi
mov esi, ebx
and esi, edi
mov ebx, esi
mov byte [ebp - 1], bl
jmp 0x477ecd
cmp byte [ebp + 0xc], 1
jne 0x477ea5
movzx ebx, byte [ebp - 1]
mov edi, 1
movzx eax, byte [ebp + 8]
mov ecx, 8
cdq
idiv ecx
mov ecx, edx
shl edi, cl
mov esi, ebx
or esi, edi
mov ebx, esi
mov byte [ebp - 1], bl
jmp 0x477ecd
cmp byte [ebp + 0xc], 2
jne 0x477ecd
movzx ebx, byte [ebp - 1]
mov edi, 1
movzx eax, byte [ebp + 8]
mov ecx, 8
cdq
idiv ecx
mov ecx, edx
shl edi, cl
mov esi, ebx
xor esi, edi
mov ebx, esi
mov byte [ebp - 1], bl
movzx ebx, byte [ebp - 1]
push ebx
movzx ebx, byte [ebp - 2]
push ebx
call fcn.00477b18
add esp, 8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x477ee4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 1
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x477eed
push ebx
push esi
push edi
movzx eax, byte [ebp + 8]
mov ecx, 8
cdq
idiv ecx
mov ebx, eax
mov byte [ebp - 2], bl
movzx ebx, byte [ebp + 8]
cmp ebx, 8
jge 0x477f1f
mov bl, byte [0x50b8a4]
mov byte [ebp - 1], bl
jmp 0x477f6e
movzx ebx, byte [ebp + 8]
cmp ebx, 0x88
jge 0x477f6e
sub byte [ebp + 8], 8
movzx eax, byte [ebp + 8]
mov ecx, 0x10
cdq
idiv ecx
cmp edx, 8
jge 0x477f58
movzx eax, byte [ebp + 8]
mov ecx, 0x10
cdq
idiv ecx
mov bl, byte [eax*8 + 0x50b868]
mov byte [ebp - 1], bl
jmp 0x477f6e
movzx eax, byte [ebp + 8]
mov ecx, 0x10
cdq
idiv ecx
mov bl, byte [eax*8 + 0x50b869]
mov byte [ebp - 1], bl
movzx ebx, byte [ebp - 2]
cmp ebx, 0x11
jge 0x47800b
cmp byte [ebp + 0xc], 0
jne 0x477fa7
movzx ebx, byte [ebp - 1]
mov edi, 1
movzx eax, byte [ebp + 8]
mov ecx, 8
cdq
idiv ecx
mov ecx, edx
shl edi, cl
not edi
mov esi, ebx
and esi, edi
mov ebx, esi
mov byte [ebp - 1], bl
jmp 0x477ff9
cmp byte [ebp + 0xc], 1
jne 0x477fd1
movzx ebx, byte [ebp - 1]
mov edi, 1
movzx eax, byte [ebp + 8]
mov ecx, 8
cdq
idiv ecx
mov ecx, edx
shl edi, cl
mov esi, ebx
or esi, edi
mov ebx, esi
mov byte [ebp - 1], bl
jmp 0x477ff9
cmp byte [ebp + 0xc], 2
jne 0x477ff9
movzx ebx, byte [ebp - 1]
mov edi, 1
movzx eax, byte [ebp + 8]
mov ecx, 8
cdq
idiv ecx
mov ecx, edx
shl edi, cl
mov esi, ebx
xor esi, edi
mov ebx, esi
mov byte [ebp - 1], bl
movzx ebx, byte [ebp - 1]
push ebx
movzx ebx, byte [ebp - 2]
push ebx
call fcn.00477b76
add esp, 8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4780b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, 9
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4780bb
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0
call sub.USER32.DLL_OpenClipboard
cmp eax, 0
je 0x478282
call sub.USER32.DLL_EmptyClipboard
mov edi, dword [ebp + 0x10]
shl edi, 2
push edi
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp eax, 0
je 0x47827d
imul edi, dword [ebp + 0x10], 3
add edi, 3
and edi, 0xfffc
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
imul edi, dword [ebp + 0x14]
add edi, 0x28
push edi
push 2
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp eax, 0
je 0x478275
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x24]
mov dword [edi], 0x28
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp + 0x10]
mov dword [edi + 4], esi
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp + 0x14]
mov dword [edi + 8], esi
mov edi, dword [ebp - 0x24]
mov word [edi + 0xc], 1
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0xc]
imul esi, dword [ebp + 0x14]
mov dword [edi + 0x14], esi
mov edi, dword [ebp - 0x24]
mov dword [edi + 0x18], 0x1388
mov edi, dword [ebp - 0x24]
mov dword [edi + 0x1c], 0x1388
mov edi, dword [ebp - 0x24]
mov dword [edi + 0x20], 0
mov edi, dword [ebp - 0x24]
mov dword [edi + 0x24], 0
mov edi, dword [ebp - 0x24]
mov word [edi + 0xe], 0x18
mov edi, dword [ebp - 0x24]
mov dword [edi + 0x10], 0
mov dword [ebp - 0x20], 0
jmp 0x478250
mov edi, dword [ebp - 8]
mov dword [ebp - 0x14], edi
push 1
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
push edi
push dword [ebp + 8]
push 0
push 0
push dword [ebp - 0x14]
call dword [0x50bacc]
mov edi, dword [ebp - 0xc]
imul edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
lea edi, [edi + esi + 0x28]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
jmp 0x478245
add dword [ebp - 0x14], 1
mov edi, dword [ebp - 0x18]
mov esi, edi
add esi, 1
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x14]
mov ebx, esi
add ebx, 1
mov dword [ebp - 0x14], ebx
mov bl, byte [esi]
mov byte [edi], bl
mov edi, dword [ebp - 0x18]
mov esi, edi
add esi, 1
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x14]
mov ebx, esi
add ebx, 1
mov dword [ebp - 0x14], ebx
mov bl, byte [esi]
mov byte [edi], bl
mov edi, dword [ebp - 0x18]
mov esi, edi
add esi, 1
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x14]
mov ebx, esi
add ebx, 1
mov dword [ebp - 0x14], ebx
mov bl, byte [esi]
mov byte [edi], bl
inc dword [ebp - 0x1c]
mov edi, dword [ebp + 0x10]
cmp dword [ebp - 0x1c], edi
jl 0x4781f0
inc dword [ebp - 0x20]
mov edi, dword [ebp + 0x14]
cmp dword [ebp - 0x20], edi
jl 0x4781af
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GlobalUnlock
push dword [ebp - 0x10]
push 8
call sub.USER32.DLL_SetClipboardData
mov dword [ebp - 4], 1
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalFree
call sub.USER32.DLL_CloseClipboard
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret