joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d2e90
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x50b490
jmp 0x401020

Function at 0x4d5f80
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
mov ecx, 0x50b4f0
jmp 0x401020

Function at 0x4d94b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6c18
push 0x4d965e
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT40.dll___set_app_type]
add esp, 4
mov dword [0x50b568], 0xffffffff
mov eax, dword [0x50b568]
mov dword [0x50b56c], eax
call dword [sym.imp.MSVCRT40.dll___p__fmode]
mov ecx, dword [0x500390]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT40.dll___p__commode]
mov ecx, dword [0x50038c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT40.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x50b564], eax
call fcn.004d96b0
cmp dword [0x500388], 0
jne 0x4d9540
push 0x4d96a0
call dword [sym.imp.MSVCRT40.dll___setusermatherr]
add esp, 4
call fcn.004d9680
push 0x4fc424
push 0x4fc420
call sub.MSVCRT40.dll__initterm
add esp, 8
mov eax, dword [0x500384]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x500380]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVCRT40.dll___getmainargs]
add esp, 0x14
push 0x4fc41c
push section..data
call sub.MSVCRT40.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT40.dll___p__acmdln]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4d95b4
mov al, byte [ebp - 0x40]
inc esi
mov al, byte [esi]
test al, al
je 0x4d95ac
cmp al, 0x22
jne 0x4d95a1
cmp byte [esi], 0x22
jne 0x4d95be
inc esi
jmp 0x4d95be
cmp al, 0x20
jbe 0x4d95be
inc esi
cmp byte [esi], 0x20
ja 0x4d95b8
cmp byte [esi], 0
je 0x4d95ce
cmp byte [esi], 0x20
ja 0x4d95ce
inc esi
cmp byte [esi], 0
jne 0x4d95c3
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x5c], 1
mov eax, 0xa
je 0x4d95f5
mov eax, dword [ebp - 0x58]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.MSVCRT40.dll_exit]
jmp 0x4d9638
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4072f4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4bd7b1
call fcn.004bd308
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0x70fc
cmp dword [ebp - 0x20], 0x73f4
jle 0x407250
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
mov ecx, ebx
sar eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0x40]
call fcn.004057cc
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x40721f
mov eax, dword [eax]
push eax
call fcn.00491288
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00403651
inc ebx
cmp ebx, 0x5980
jl 0x407203
inc edi
cmp edi, 0x1468
jl 0x407201
inc esi
cmp esi, 0x30c3
jl 0x4071ff
mov eax, dword [ebp - 0x1c]
cmp eax, 0x4003258a
jae 0x4072f8
mov dword [ebp - 0x1c], 0x1346
cmp dword [ebp - 0x1c], 0x16ce
jle 0x4072d2
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], 0x10de
mov eax, esi
and eax, ebx
cdq
push edx
push eax
lea ecx, [ebp - 0x58]
call fcn.004057cc
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x407297
mov eax, dword [eax]
push eax
call fcn.00491288
pop ecx
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00403651
add esi, edi
dec dword [ebp - 0x14]
jne 0x40727e
inc edi
cmp edi, 0x4ff1
mov esi, dword [ebp - 0x18]
jl 0x407274
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x74ce
jl 0x407272
inc ebx
cmp ebx, 0x68c9
jl 0x40726d
sub dword [str.p7X2], 0x728df465
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x128c
jge 0x4072f4
push str.kpgcvvi_pep_ikv_zcfpexk_wywpgmgk_hgyc_ruimqubj_iwpk_nkamsdvjr_ypjbb_gjjfqyt
call fcn.00491288
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x6f45
jge 0x407313
push str.igzwa_saw_cmlfwb_lhoolbq_ebtpqu
call fcn.00491288
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [0xac01b8]
test al, 1
jne 0x407345
or eax, 1
mov dword [0xac01b8], eax
mov edx, dword [str.p7X2]
mov ecx, edx
and ecx, 0x32583740
mov eax, 0x192c1ba0
sub eax, ecx
lea eax, [edx + eax*2]
mov dword [0xac01f0], eax
mov dword [ebp - 0x1c], 0x7da7
cmp dword [ebp - 0x1c], 0x8064
jle 0x40739b
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, esi
mov ecx, edi
shl ebx, cl
mov esi, dword [ebp - 0x24]
mov eax, ebx
xor eax, esi
cdq
push edx
push eax
mov ecx, 0xabcc58
call fcn.0042b8cd
inc esi
cmp esi, 0x5eac
jl 0x407369
inc edi
cmp edi, 0xb72
mov esi, dword [ebp - 0x20]
jl 0x40735c
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7b97
jl 0x40735a
mov eax, dword [0xac01f0]
mov ecx, dword fs:[eax]
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov dword [ebp - 4], 4
cmp dword [ebp - 0x1c], 0x7c38
jge 0x4073c7
mov edx, str.hiln_ofuvahl_ejyclucfg_ysqpmlzbe_myhbov_bpljj_vnb_znhlk
mov ecx, 0xabcc58
call fcn.0042d10d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435a77
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x435b65
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x435ad0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x435ac5
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
jmp 0x435acb
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x435b63
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x435b38
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x435b36
push 0x4c54
push 0xd50
push 0x7b4c
push 0
push 0x4d8d
push 0x6be
push 0x55c2
push 0
push 1
push 0x4d7f
push 1
push 0x44fd
push 1
call fcn.00437cba
add esp, 0x34
jmp 0x435b63
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x435b63
push 0x12ab
push 0
push 0xbed
push 0
push 0
push 1
push 0x67a4
call fcn.0043d06d
add esp, 0x1c
jmp 0x435b8e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
push 0x36fd
push dword [ebp - 0x2c]
push 0x52cc
push 0x7d7f
push 1
push 0
push 0x741a
call fcn.00442f2f
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x436265
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4362dd
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x436293
push 1
call fcn.00436324
pop ecx
jmp 0x4362db
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4362af
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x4362db
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4362db
push 0
push 0x16a4
push 0x1bd9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
jmp 0x436320
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x436312
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push 0x4e39
push dword [ebp - 0x1c]
push 0x1de5
call fcn.00435fef
add esp, 0x10
jmp 0x436320
push 0x6d1e
push 0
call fcn.0043eb28
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43be24
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43beba
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43be93
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43be72
push 0x15cc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x43be91
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43be91
push 0x7da9
push 1
push 1
push 1
call fcn.00435669
add esp, 0x10
jmp 0x43beb8
push 0x7d46
push 0x55a4
push 0x471e
push 0x40f8
push 1
push 0x7a62
push 1
call fcn.00439c68
add esp, 0x1c
jmp 0x43bf0f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43beea
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 0x71fb
push 0
push dword [ebp - 0x1c]
call fcn.0043ccab
add esp, 0xc
jmp 0x43bf0f
push 0x3de2
push 0
push 0x810
push 0x1a93
push 0x416f
push 0
push 0x1f35
call fcn.0043ad94
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x4480f9
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x44812b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 1
push dword [ebp - 4]
push 0x9d3
push 0x1f48
push 0x558d
call fcn.004481a0
add esp, 0x14
jmp 0x44819c
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x448157
push 0x2c45
push 1
push 0x68c9
call fcn.00446030
add esp, 0xc
jmp 0x44819c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x448174
push 0x2fc
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x44819c
push 0x118
push 0x1c30
push 0x1c43
push 0x1bf0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov esp, ebp
pop ebp
ret
Function at 0x452fde
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x45304d
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x453012
push 0
push 0x64f
call fcn.0045fd68
pop ecx
pop ecx
jmp 0x45304b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x453041
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x45303f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x45304b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x453069
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0
call fcn.00459355
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x454970
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x454a83
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x454a53
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x454a31
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x454a10
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x454a2f
push 0x506b
push dword [ebp - 0x3c]
push 0
push dword [ebp - 0x40]
call fcn.00460389
add esp, 0x10
jmp 0x454a05
jmp 0x454a51
push 0
push 0x2035
push 0x15a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x454a81
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x454a6d
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x454a81
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x454a81
push 0
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x454a91
push 0x91d
push 0
call fcn.0045cb06
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x456e95
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x456ec4
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x1fcc
push dword [ebp - 8]
push 1
push 0x4bfa
push 1
call fcn.00456f36
add esp, 0x14
jmp 0x456f32
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x456f1d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x456efa
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x456f1b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x456f1b
push 0
push 0
push 1
push 0x6341
push 1
call fcn.0045d11c
add esp, 0x14
jmp 0x456f32
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push 0
push dword [ebp - 0x1c]
call fcn.0045cfff
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x45bc28
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x45bd1f
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x45bca4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x45bc9a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x45bc98
push 0x15cc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x45bca2
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x45bd1d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x45bcf5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x45bd1d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x45bd1d
push 0
push 0x1bed
push 0xf1f
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x45bd59
lea eax, [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
push 0x5634
push 0x5432
push 0x3a29
push 1
push dword [ebp - 0x50]
push 1
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
push eax
call fcn.0045a1d7
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x45c5ef
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x45c6bb
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x45c643
push 0x6110
push 0x6b81
push 1
push 0x4962
push 0x3b46
call fcn.0045c6d9
add esp, 0x14
jmp 0x45c6b9
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x45c68f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x45c68d
push 0
push 0
push 1
push 0x14a2
push 0x49a
call fcn.00452fde
add esp, 0x14
jmp 0x45c6b9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x45c6b9
push 0x15cc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x45c6d5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0
push 1
push 0x21dd
call fcn.0045e513
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x45e431
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x45e455
push 0x46e7
push 0x3ee3
push 0
call fcn.004636f4
add esp, 0xc
jmp 0x45e4a7
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45e47b
push 0x1832
push 1
call fcn.0045483e
pop ecx
pop ecx
jmp 0x45e4a7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x45e49f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x45e49d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x45e4a7
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov esp, ebp
pop ebp
ret
Function at 0x46006a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x460092
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
push 1
push dword [ebp - 0x4c]
call fcn.0046024d
pop ecx
pop ecx
jmp 0x460249
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x460224
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x460207
mov dword [ebp - 0x60], 0x8c08
mov dword [ebp - 0x5c], 0x8c08
mov dword [ebp - 0x58], 0x8c08
mov dword [ebp - 0x54], 0x8c08
mov dword [ebp - 0x1c], 0xa6957688
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x48], 0xb101aae4
mov dword [ebp - 0x64], 0xe34b64b5
mov dword [ebp - 0x34], 0xe505
mov dword [ebp - 0x78], 0xefa5f9c7
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x8c], 0x4e630971
mov dword [ebp - 0x88], 0x4e630971
mov dword [ebp - 0x84], 0x4e630971
mov dword [ebp - 0x80], 0x4e630971
mov dword [ebp - 0xc], 0xce9b
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 8], 0
jmp 0x460163
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x460176
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x70], 0xfffffffc
jmp 0x46015c
imul eax, dword [ebp - 0xc], 0x4227
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
test eax, eax
jne 0x46018e
cmp dword [ebp - 0x44], 0
je 0x4601a6
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x34], eax
je 0x4601a6
mov dword [ebp - 0x50], 1
jmp 0x4601aa
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x68], eax
push 3
pop eax
cmp eax, 0xa4575f7f
jbe 0x4601c3
mov dword [ebp - 0x10], 1
jmp 0x4601c7
and dword [ebp - 0x10], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp + eax - 0x70], ecx
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x10], eax
jge 0x4601e5
mov dword [ebp - 0x14], 1
jmp 0x4601e9
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0x7894
jl 0x4601fb
mov dword [ebp - 0x18], 1
jmp 0x4601ff
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
jmp 0x460222
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x460222
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
jmp 0x460249
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
push 1
push 0
push 1
push dword [ebp - 0x28]
push 0x39ce
push dword [ebp - 0x30]
call fcn.00459397
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x460757
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x460837
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4607fb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4607da
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x4e6d
push 1
push 0x2ad1
push 0x123c
push 1
push 1
push 0x6882
push 1
push 0x4f69
push 1
push 0x78a
push 0x3990
call fcn.00457267
add esp, 0x34
jmp 0x4607f9
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x4607f9
push 1
push 1
push 0x3363
push 1
call fcn.00452f27
add esp, 0x10
jmp 0x460835
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x46082a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x460835
push 0x2fc
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x460858
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 1
push 0x34df
push dword [ebp - 0x30]
call fcn.0045378b
add esp, 0x10
mov esp, ebp
pop ebp
ret