joyce8/EMBER2024-capa huggingface dataset:
Function at 0x551640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x55166b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x55168f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x5516aa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x555411
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x555433
cmp dword [edi + 0x3c], 0
jne 0x555433
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0056bf2f
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00555460
pop edi
pop esi
pop ebx
ret 8

Function at 0x556aed
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x556b25
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00559f94
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00559f6c
jmp 0x556b31
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x556b35
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x5df4d8
mov ecx, edi
call fcn.00559c76
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x556b88
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x556b9b
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00559f94
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00559f6c
jmp 0x556b9b
mov ecx, esi
call fcn.00558f86
test eax, eax
je 0x556b9b
push edi
mov ecx, eax
call fcn.00556aed
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x558713
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x558755
call fcn.0056bf2f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x558755
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x55874c
xor eax, eax
jmp 0x55875d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00558763
pop edi
pop esi
pop ebx
ret 4
Function at 0x56c8f1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.0056bf2f
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x56c92e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x56c92e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x56c932
xor eax, eax
jmp 0x56c9b0
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.00555203
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x56c96a
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x56c954
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.0056caa1
push ebx
mov edi, eax
call fcn.0055522c
test edi, edi
pop ecx
je 0x56c9ac
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.0056c86a
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0056c9b5
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x56df50
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x56df7e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x56df9c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0056deb6
jmp 0x56df9c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x56df9c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0056deb6
test edi, edi
mov eax, edi
jne 0x56df86
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x571ff0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x572018
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x572029
push 2
call edi
test ax, ax
jge 0x572029
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.005560db
cmp dword [esi + 0x30], ebx
jne 0x572103
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.005560db
cmp eax, dword [esp + 0x34]
jne 0x572103
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x57209f
push 1
push pe_nt_image_headers32
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x5720e4
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x572103
cmp eax, 0x205
je 0x572103
cmp eax, 0x201
je 0x572103
cmp eax, 0x204
je 0x572103
cmp eax, ebx
jne 0x5720ca
cmp dword [esp + 0x1c], 0x1b
je 0x572103
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x5e0ef0]
jbe 0x5720f9
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x57205c
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x402b14
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
push ebx
mov edx, 0x10
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402b1b
mov dword [0x427001], 0x12
mov dword [0x427001], 0x13
lea eax, [esp]
mov dword [0x427001], 0x14
lea eax, [esp + 8]
mov dword [0x427001], 0x16
lea eax, [esp + 0x18]
push eax
push 0x28
call fcn.00404034
push eax
call fcn.004230c7
and eax, eax
je 0x402b74
xor eax, eax
jmp 0x402b79
mov eax, 1
and eax, eax
je 0x402b8e
mov dword [0x427001], 0x17
xor eax, eax
jmp 0x402cc4
mov dword [0x427001], 0x18
mov dword [0x427001], 0x1a
lea eax, [esp]
push eax
push str.SeDebugPrivilege
push 0x427045
call fcn.004230cd
and eax, eax
je 0x402bbd
xor eax, eax
jmp 0x402bc2
mov eax, 1
and eax, eax
je 0x402bea
mov dword [0x427001], 0x1b
push dword [esp + 0x18]
call fcn.0040403a
mov dword [0x427001], 0x1c
xor eax, eax
jmp 0x402cc4
mov dword [0x427001], 0x1d
mov dword [0x427001], 0x1e
lea eax, [esp + 0x1c]
mov dword [0x427001], 0x20
lea ebp, [esp + 0x1c]
mov dword [ebp], 1
mov dword [0x427001], 0x21
lea ebp, [esp]
push dword [ebp + 4]
lea ebp, [esp + 0x20]
push ebp
pop ebp
pop eax
mov dword [ebp + 8], eax
mov dword [0x427001], 0x22
lea ebp, [esp]
push dword [ebp]
lea ebp, [esp + 0x20]
push ebp
pop ebp
pop eax
mov dword [ebp + 4], eax
mov dword [0x427001], 0x23
push ebp
pop ebp
mov dword [ebp + 0xc], 2
mov dword [0x427001], 0x25
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
push 0x10
lea eax, [esp + 0x28]
push eax
push 0
push dword [esp + 0x2c]
call fcn.004230d3
mov dword [0x427001], 0x26
cmp dword [esp + 0x18], 0
je 0x402cae
mov dword [0x427001], 0x26
push dword [esp + 0x18]
call fcn.0040403a
mov dword [0x427001], 0x26
mov dword [0x427001], 0x27
xor eax, eax
add esp, 0x40
pop ebx
pop ebp
ret

Function at 0x40bf60
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x40bf8f
push esi
call fcn.0040b910
add esp, 4
cmp byte [esi + 0x40], 0
je 0x40bf88
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x40c009
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x40bff9
mov eax, dword [esi + 8]
test eax, eax
je 0x40bfb4
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
mov edx, dword [esi + 0x1a0]
mov eax, dword [edx]
push esi
call eax
add esp, 4
test eax, eax
je 0x40bff5
cmp eax, 2
je 0x40bff9
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40bfa5
cmp eax, 3
je 0x40bfdc
cmp eax, 1
jne 0x40bfa5
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x40bfa5
mov ecx, dword [esi + 0x120]
add dword [eax + 8], ecx
jmp 0x40bfa5
xor al, al
pop esi
ret
mov edx, dword [esi + 0x7c]
mov dword [esi + 0x84], edx
call fcn.0040bdf0
pop esi
ret
cmp eax, 0xcc
je 0x40c02b
mov eax, dword [esi]
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [esi]
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
call fcn.0040bdf0
pop esi
ret
Function at 0x40d440
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x20]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1b8]
mov dword [esp + 0x18], esi
jne 0x40d467
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x40d473
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0xc], ecx
cmp dword [edi + 0x64], ecx
jle 0x40d585
push ebx
push ebp
jmp 0x40d4bc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
mov edi, dword [esi + ecx*4 + 0x20]
cdq
idiv edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
je 0x40d4df
mov edx, dword [esi + 0x18]
add dword [edx + ecx*4], 0xff
lea eax, [edx + ecx*4]
mov eax, dword [esi + 0x18]
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi + edi - 2]
cdq
idiv ecx
xor ebx, ebx
xor ecx, ecx
mov esi, eax
cmp ecx, esi
jle 0x40d52e
mov edx, ebx
imul edx, edx, 0x1fe
lea edi, [edx + edi + 0xfe]
jmp 0x40d510
mov esi, dword [esp + 0x18]
add edi, 0x1fe
mov eax, edi
cdq
lea esi, [esi + esi - 2]
idiv esi
inc ebx
mov esi, eax
cmp ecx, esi
jg 0x40d510
mov edi, dword [esp + 0x18]
mov al, byte [esp + 0x1c]
imul bl
mov byte [ecx + ebp], al
inc ecx
cmp ecx, 0xff
jle 0x40d4f8
cmp dword [esp + 0x10], 0
je 0x40d56d
mov eax, 1
lea ecx, [ebp - 1]
nop
movzx edx, byte [ebp]
mov byte [ecx], dl
movzx edx, byte [ebp + 0xff]
mov byte [eax + ebp + 0xff], dl
inc eax
dec ecx
cmp eax, 0xff
jle 0x40d550
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [ecx + 0x64]
jl 0x40d4b0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x442b4f
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x461a88
call fcn.00458808
mov edi, 0x94
mov eax, edi
call fcn.00458250
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x46b4a4], ecx
mov eax, dword [esi + 4]
mov dword [0x46b4b0], eax
mov edx, dword [esi + 8]
mov dword [0x46b4b4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x46b4a8], esi
cmp ecx, 2
je 0x442baf
or esi, 0x8000
mov dword [0x46b4a8], esi
shl eax, 8
add eax, edx
mov dword [0x46b4ac], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x442bea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x442bea
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x442c02
cmp eax, 0x20b
je 0x442bef
mov dword [ebp - 0x1c], esi
jmp 0x442c16
cmp dword [ecx + 0x84], 0xe
jbe 0x442bea
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x442c10
cmp dword [ecx + 0x74], 0xe
jbe 0x442bea
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0043edbb
pop ecx
test eax, eax
jne 0x442c42
cmp dword [0x46b4f0], 1
jne 0x442c2f
call fcn.0043e116
push 0x1c
call fcn.0043e14f
push 0xff
call fcn.0043e033
pop ecx
pop ecx
call fcn.0043ee54
mov dword [ebp - 4], esi
call fcn.0043f27a
test eax, eax
jge 0x442c5b
push 0x1b
call fcn.00442b2a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x46ba84], eax
call fcn.0043d2d0
mov dword [0x46b4e8], eax
call fcn.00441dff
test eax, eax
jge 0x442c81
push 8
call fcn.00442b2a
pop ecx
call fcn.00441ea1
test eax, eax
jge 0x442c92
push 9
call fcn.00442b2a
pop ecx
push 1
call fcn.0043e081
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x442ca8
push eax
call fcn.00442b2a
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00442acd
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x442cc9
movzx eax, word [ebp - 0x40]
jmp 0x442ccc
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0044770d
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x442cea
push edi
call fcn.0043e0fc
call fcn.0043e072
jmp 0x442d1c
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00458843
ret
Function at 0x44cf96
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [0x465090]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x13], al
push edi
lea eax, [ebp - 0x14]
push eax
push esi
mov ebx, ecx
mov byte [ebp - 0x14], 0x20
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 9
mov byte [ebp - 0x10], 0x3c
mov byte [ebp - 0xf], 0x3e
mov byte [ebp - 0xe], 0x3a
mov byte [ebp - 0xd], 0x3d
mov byte [ebp - 0xc], 0x2b
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x2a
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x21
mov byte [ebp - 7], 0x7e
mov byte [ebp - 6], 0x26
mov byte [ebp - 5], 0x7c
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0
call fcn.00439b0d
test eax, eax
pop ecx
pop ecx
je 0x44d01a
cmp byte [eax], 0x3d
jne 0x44d013
cmp eax, esi
jbe 0x44d025
lea ecx, [eax - 1]
cmp byte [ecx], 0x2e
jne 0x44d013
mov eax, ecx
cmp eax, esi
jbe 0x44d025
dec eax
jmp 0x44d025
push esi
call fcn.00457cb0
pop ecx
lea eax, [eax + esi - 1]
push eax
push esi
call fcn.00439a59
mov edi, eax
sub eax, esi
inc eax
cmp eax, 0xfd
pop ecx
pop ecx
jbe 0x44d051
cmp byte [ebp + 0x10], 0
je 0x44d04d
push esi
push str.This_line_does_not_contain_a_recognized_action.
mov ecx, ebx
call fcn.0044c37d
xor eax, eax
jmp 0x44d061
inc eax
push eax
push esi
push dword [ebp + 8]
call fcn.00439851
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44fbdd
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8958
call fcn.00458250
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x44fc5e
lea ecx, [ebp - 0x8958]
call fcn.0043bb0e
mov al, byte [ebp + 8]
mov byte [ebp - 0x8114], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8110], eax
lea eax, [ebp - 0x8958]
push eax
push 0x45022c
mov dword [ebp - 0x8118], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x8128], 0
je 0x44fc5e
mov eax, dword [0x465108]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x44fc5e
cmp eax, 0x19
jge 0x44fc54
cmp byte [0x468399], 0
je 0x44fc54
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44fc5e
push 1
push eax
call fcn.0040de6e
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x4500e2
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x895c
call fcn.00458250
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x450223
push ebx
call fcn.00450437
test eax, eax
je 0x450226
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [0x465108]
mov ecx, edi
push eax
mov dword [ebp - 4], eax
call fcn.0044fe60
test eax, eax
je 0x450132
xor esi, esi
mov dword [0x46b480], esi
jmp 0x450138
mov esi, dword [0x46b480]
lea ecx, [ebp - 0x895c]
call fcn.0043bb0e
cmp byte [ebp + 8], bl
je 0x450152
cmp esi, ebx
mov byte [ebp - 0x8134], bl
je 0x450159
mov byte [ebp - 0x8134], 1
mov eax, dword [0x46b47c]
mov dword [ebp - 0x8124], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x811c], eax
lea eax, [ebp - 0x895c]
push eax
push 0x450338
mov dword [ebp - 0x8120], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x812c], ebx
je 0x4501f8
push dword [ebp - 0x812c]
call fcn.0043ca8c
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4501b1
push dword [ebp - 0x812c]
call fcn.00450405
pop ecx
mov dword [ebp - 0x812c], esi
push dword [ebp - 0x812c]
call fcn.0043c3f2
push dword [ebp - 0x812c]
call fcn.00450405
mov eax, dword [0x465108]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
pop ecx
pop ecx
jle 0x450222
cmp eax, 0x19
jge 0x4501ec
cmp byte [0x468399], bl
je 0x4501ec
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x450222
push 1
push eax
call fcn.0040de6e
pop ecx
pop ecx
jmp 0x450222
mov eax, dword [0x46b480]
cmp eax, ebx
je 0x450222
cmp eax, 1
setg al
cmp al, bl
mov dword [0x46b480], ebx
je 0x450222
push dword [ebp - 4]
call fcn.00450405
pop ecx
push ebx
mov ecx, edi
call fcn.004500e2
pop esi
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4

Function at 0x450529
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x469e60], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x4694a0
jne 0x450549
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00415fbd
pop ecx
mov dword [0x466208], 0x270
mov dword [0x469498], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x450568
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x45059e
mov edx, dword [0x4694a0]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x450782
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x494]
xor ebx, ebx
cmp eax, ebx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4ad], bl
mov byte [esi + 0x4ac], bl
je 0x4508ad
cmp byte [eax], bl
je 0x4508ad
push 0x10
call fcn.0044e80b
cmp eax, ebx
pop ecx
je 0x4507d0
mov dword [eax], 0x45a5d8
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x4507d2
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x240], eax
je 0x4508ad
push ebx
push ebx
push dword [esi + 0x494]
mov ecx, esi
call fcn.004481e0
cmp eax, 1
jne 0x4508ad
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.0044b395
test eax, eax
je 0x4508ad
push ebx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044deb1
test eax, eax
je 0x4508ad
push dword [0x467c84]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
inc dword [esi + 0x4c]
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.0044b395
test eax, eax
je 0x4508ad
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.0044b395
test eax, eax
je 0x4508ad
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x240]
push ebx
push ebx
push ebx
push ebx
mov dword [eax + 4], ecx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044e24c
test eax, eax
je 0x4508ad
push ebx
push ebx
push ebx
push str.ErrorLevel
mov ecx, esi
call fcn.0040c0f7
cmp eax, ebx
mov dword [0x467b78], eax
je 0x4508ad
push 1
push ebx
push 0xffffffffffffffff
push 0x45a734
mov ecx, eax
call fcn.0040184e
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 8]
call fcn.00415fbd
mov eax, dword [esi + 8]
pop ecx
jmp 0x4508b0
or eax, 0xffffffff
pop esi
pop ebx
leave
ret

Function at 0x450aba
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.00415fbd
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x450ae4
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.00415edb
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x450ace
pop esi
pop edi
ret 0xc

Function at 0x450f56
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x450f7f
add edx, edx
xor edx, 0x4c11db7
jmp 0x450f81
shl edx, 1
dec ecx
jne 0x450f6d
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x450f65
pop edi
pop esi
ret