joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d640
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x60c
mov eax, dword [esp + 0x618]
mov ecx, dword [esp + 0x614]
push ebx
push ebp
push esi
push edi
push 0
push 0x200
push eax
push ecx
call fcn.004b08b0
mov edi, edx
push 0
mov ebx, eax
lea edx, [esp + 0x14]
push edx
or eax, 0xffffffff
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x62c]
lea ebp, [esp + 0x228]
push ebx
and ebp, 0xfffffe00
push eax
mov dword [esp + 0x63c], edi
mov dword [esp + 0x2c], 0
lea esi, [ebp + 0x200]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
jne 0x44d7a0
mov edx, dword [esp + 0x14]
cmp edx, edi
jne 0x44d7a0
mov ecx, dword [esp + 0x620]
push 0
lea eax, [esp + 0x1c]
push eax
push 0x200
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44d7a0
mov eax, dword [esp + 0x630]
cmp eax, 1
mov ecx, 0x80
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x44d721
mov ecx, dword [esp + 0x62c]
mov esi, dword [ecx]
lea edx, [ebp + 0x3ce]
mov dword [edx], esi
mov esi, dword [ecx + 4]
mov dword [edx + 4], esi
mov esi, dword [ecx + 8]
mov dword [edx + 8], esi
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x628]
mov edi, dword [esp + 0x620]
xor edx, edx
cmp eax, 1
setne dl
or eax, 0xffffffff
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push ecx
dec edx
push ebx
and edx, 0xaa55
lea esi, [ebp + 0x200]
push edi
mov word [esi + 0x1fe], dx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [esp + 0x10]
cmp edx, ebx
jne 0x44d7a0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x628]
jne 0x44d7a0
mov eax, 0x200
mov edx, esi
mov ecx, ebp
call fcn.004465f0
test eax, eax
jne 0x44d7a0
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x200
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x60c
ret
Function at 0x44ef30
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e67c8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [esp + 0x28]
mov eax, dword [edi]
push eax
mov eax, 0x26a
call fcn.00445f60
xor esi, esi
add esp, 4
cmp eax, esi
mov dword [edi], eax
je 0x44ef6e
mov word [eax + 0x268], si
push 0x196
call fcn.00445f00
mov ebx, eax
add esp, 4
cmp ebx, esi
mov dword [esp + 0x10], ebx
je 0x44ef88
mov word [ebx], si
push ebp
mov eax, dword [esp + 0x3c]
mov ecx, eax
and ecx, 0x100
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ecx
movzx esi, al
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [edi]
test esi, esi
sete dl
neg esi
sbb esi, esi
mov ebp, eax
mov eax, dword [esp + 0x38]
and esi, 0x19
test eax, eax
lea edx, [edx + edx - 1]
mov byte [esp + 0x3c], 0
mov byte [esp + 0x13], dl
mov ecx, esi
je 0x44efd7
cmp eax, 1
not ebp
jle 0x44efd7
and ebp, 0xfffffffc
cmp ecx, 0x1a
jge 0x44f066
mov esi, dword [esp + 0x34]
jmp 0x44eff0
mov dl, byte [esp + 0x13]
lea ebx, [ebx]
test ecx, ecx
jl 0x44f066
mov eax, 1
shl eax, cl
movsx edx, dl
mov bl, cl
add ecx, edx
add bl, 0x41
test ebp, eax
mov dword [esp + 0x38], ecx
je 0x44f05d
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44f02a
movsx ax, bl
push eax
call fcn.004abc30
mov ecx, dword [esp + 0x3c]
add esp, 4
test eax, eax
je 0x44f05d
mov al, byte [esp + 0x3c]
test al, al
je 0x44f042
mov ax, word [esp + 0x30]
test ax, ax
je 0x44f042
mov word [edi], ax
add edi, 2
movsx dx, bl
mov word [edi], dx
add edi, 2
test esi, esi
mov byte [esp + 0x3c], 1
je 0x44f05d
mov word [edi], 0x3a
add edi, 2
cmp ecx, 0x1a
mov ebx, dword [esp + 0x14]
jl 0x44efe6
test ebx, ebx
mov eax, dword [esp + 0x2c]
mov word [edi], 0
mov esi, dword [eax]
pop ebp
je 0x44f089
mov ecx, dword [0x51927c]
add ebx, 0xfffffff8
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x44f0d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
cmp byte [esi], 0x23
sete al
test al, al
push edi
mov byte [esp + 0x14], al
je 0x44f0e7
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx]
inc eax
lea edi, [eax + eax*2]
lea eax, [edi + 1]
push ecx
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [ebx], eax
je 0x44f10e
mov byte [eax + edi], 0
mov edi, dword [ebx]
mov byte [edi], 0
mov al, byte [esi]
xor edx, edx
xor cl, cl
test al, al
mov ebp, edi
je 0x44f139
nop
mov al, byte [esi]
cmp al, 0x3d
jne 0x44f178
test cl, cl
jle 0x44f131
mov byte [edi], dl
inc edi
xor edx, edx
xor cl, cl
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x44f120
push ebp
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov al, byte [esp + 0x14]
test al, al
je 0x44f171
xor ecx, ecx
test esi, esi
jle 0x44f171
xor edx, edx
mov eax, ecx
mov edi, 0x14
div edi
mov al, byte [ecx + ebp]
mov dl, byte [edx + 0x4f3864]
xor al, dl
mov byte [ecx + ebp], al
inc ecx
cmp ecx, esi
jl 0x44f153
mov eax, dword [ebx]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp al, 0x2b
jne 0x44f180
xor al, al
jmp 0x44f19e
cmp al, 0x2f
jne 0x44f188
mov al, 1
jmp 0x44f19e
cmp al, 0x39
ja 0x44f190
add al, 0xd2
jmp 0x44f19e
cmp al, 0x5a
ja 0x44f198
add al, 0xcb
jmp 0x44f19e
cmp al, 0x7a
ja 0x44f1d1
add al, 0xc5
movzx eax, al
test eax, eax
jl 0x44f1d1
shl eax, cl
or edx, eax
add cl, 6
lea esp, [esp]
cmp cl, 8
jge 0x44f1c6
test cl, cl
jle 0x44f131
cmp byte [esi], 0
jne 0x44f131
mov byte [edi], dl
inc edi
shr edx, 8
add cl, 0xf8
jmp 0x44f1b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x44f4b0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call ebp
inc eax
lea eax, [eax + eax*2]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], edi
jl 0x44f4e6
inc eax
push eax
call fcn.00445f00
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
mov edi, eax
je 0x44f4e6
mov byte [eax], 0
mov byte [edi], 0x20
lea edx, [edi + 1]
mov byte [edx], 0
mov al, byte [esi]
xor ebx, ebx
xor cl, cl
test al, al
je 0x44f51d
lea esp, [esp]
mov al, byte [esi]
cmp al, 0x3d
jne 0x44f5a1
test cl, cl
jle 0x44f515
mov byte [edx], bl
inc edx
xor ebx, ebx
xor cl, cl
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x44f500
push edi
mov byte [edx], 0
call ebp
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push ecx
call fcn.00445f60
xor ebx, ebx
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x44f548
mov word [eax + edi*2 + 2], bx
mov edx, dword [esi]
push edi
push edx
push ebp
mov ebp, dword [esp + 0x20]
push ebp
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp edi, ebx
jge 0x44f566
xor edi, edi
mov eax, dword [esi]
mov word [eax + edi*2], bx
mov ecx, dword [esi]
lea eax, [edi + edi + 4]
push ecx
call fcn.00445f60
add esp, 4
cmp eax, ebx
mov dword [esi], eax
je 0x44f586
mov word [eax + edi*2 + 2], bx
mov edx, dword [0x51927c]
mov esi, dword [esi]
add ebp, 0xfffffff8
push ebp
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
cmp al, 0x41
jb 0x44f5ad
cmp al, 0x5a
ja 0x44f5ad
sub al, 0x41
jmp 0x44f5d3
cmp al, 0x61
jb 0x44f5b9
cmp al, 0x7a
ja 0x44f5b9
sub al, 0x47
jmp 0x44f5d3
cmp al, 0x30
jb 0x44f5c5
cmp al, 0x39
ja 0x44f5c5
add al, 4
jmp 0x44f5d3
cmp al, 0x2b
jne 0x44f5cd
mov al, 0x3e
jmp 0x44f5d3
cmp al, 0x2f
jne 0x44f601
mov al, 0x3f
movzx eax, al
shl eax, cl
or ebx, eax
add cl, 6
lea ecx, [ecx]
cmp cl, 8
jge 0x44f5f6
test cl, cl
jle 0x44f515
cmp byte [esi], 0
jne 0x44f515
mov byte [edx], bl
inc edx
shr ebx, 8
add cl, 0xf8
jmp 0x44f5e0
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
add edi, 0xfffffff8
push edi
mov word [edx], 0
mov eax, dword [0x51927c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x450c90
Capabilities:
Clear file content

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
or eax, 0xffffffff
push 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
add esp, 8
ret
Function at 0x453300
Capabilities:
Parse credit card information
Query environment variable

Disassembly:
mov al, byte [ecx + 0x8a]
test al, al
jne 0x453315
test byte [ecx + 0xb], 0xf
jne 0x453315
jmp fcn.004531a0
jmp fcn.00451c30

Function at 0x4536e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e5d88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov eax, dword [esp + 0x20]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], esi
call fcn.004167bc
mov edi, dword [esp + 8]
cmp edi, esi
jne 0x453741
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push ebp
mov ebp, dword [esp + 0x28]
cmp ebp, esi
mov dword [esp + 0xc], esi
jne 0x453752
lea ebp, [esp + 0xc]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x30]
xor ecx, ecx
cmp ebx, esi
setne cl
mov dword [ebp], eax
push eax
mov esi, ecx
test esi, esi
je 0x4537a8
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebx], eax
jne 0x45379f
cmp edi, 0xffffffff
je 0x45378a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x4537b0
call fcn.00445f00
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x45377e
mov eax, dword [ebp]
push 0
lea edx, [esp + 0x18]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test esi, esi
je 0x4537da
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp edi, 0xffffffff
je 0x4537e6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
mov eax, ebx
pop ebx
pop ebp
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x453ba0
Capabilities:
Check mutex on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, ebx
push edi
push 0x10
je 0x453c27
call fcn.004c86a5
add esp, 4
cmp eax, ebx
je 0x453bd0
mov byte [eax + 8], bl
mov dword [eax + 0xc], ebx
mov dword [eax], 0x4f4648
mov dword [eax + 4], ebx
mov esi, eax
jmp 0x453bd2
xor esi, esi
push 0x5194ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push edi
push ebx
push ebx
call ebp
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x5194ec
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 4], ebx
je 0x453c60
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 0xb7
mov ecx, dword [esp + 0x20]
sete al
mov dword [ecx], eax
jmp 0x453c5a
call fcn.004c86a5
mov edi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x453c58
push edi
push ebx
push ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [esi + 0xc], ebx
mov dword [esi], 0x4f4648
call ebp
mov dword [esi + 4], eax
jmp 0x453c5a
xor esi, esi
cmp dword [esi + 4], ebx
jne 0x453c78
nop
push 1
mov ecx, 0x519150
call fcn.0041ecf1
push edi
push ebx
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 4], eax
je 0x453c60
cmp byte [esp + 0x1c], bl
je 0x453c8e
mov edx, dword [esi + 4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [esi + 8], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4543d0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push edi
push eax
mov eax, 0x20a
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x4543f7
mov word [eax + 0x208], 0
mov ecx, dword [esi]
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov word [ecx], 0
mov eax, dword [esi]
push 0x104
push eax
push ebx
call ebp
mov edi, eax
test edi, edi
jle 0x454443
mov ecx, dword [esi]
cmp word [ecx], 0
jne 0x454443
lea eax, [edi + edi + 6]
push ecx
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x45443b
mov word [eax + edi*2 + 4], 0
mov edx, dword [esi]
inc edi
push edi
push edx
push ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x454570
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
sub esp, 0x244
cmp ax, 0x61
jb 0x454587
cmp ax, 0x7a
ja 0x454587
and eax, 0xffdf
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 3
mov ecx, 0x5c
mov word [esp + 0x2c], ax
mov word [esp + 0x3c], ax
mov edx, 0x3a
push edi
lea eax, [esp + 0x38]
push eax
mov word [esp + 0x36], dx
mov word [esp + 0x38], cx
mov word [esp + 0x3a], di
mov word [esp + 0x3c], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x40], 0x2e
mov word [esp + 0x42], cx
mov word [esp + 0x46], dx
mov word [esp + 0x48], di
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4545f6
pop edi
mov eax, 1
pop esi
add esp, 0x244
ret
push ebx
push edi
lea ecx, [esp + 0x38]
push ecx
push 0xc
lea edx, [esp + 0x48]
push edx
push edi
push edi
push 0x2d1080
push esi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
je 0x45462c
mov esi, dword [esp + 0x40]
cmp esi, 0xffffffff
jne 0x45463b
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x244
ret
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push eax
push esi
mov dword [esp + 0x18], edi
call fcn.004441a0
add esp, 8
cmp eax, edi
je 0x45462c
push ebp
push edi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
mov edx, dword [esp + 0x14]
push edi
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.SETUPAPI.dll_CM_Request_Device_EjectW]
shr eax, 0xe
and al, 1
mov byte [esp + 0x13], al
mov esi, 1
mov ecx, dword [esp + 0x14]
push edi
push 0x208
lea edx, [esp + 0x54]
push edx
test al, al
lea eax, [esp + 0x24]
push eax
mov word [esp + 0x5c], di
push ecx
je 0x4546c6
call ebp
jmp 0x4546cc
call dword [sym.imp.SETUPAPI.dll_CM_Query_And_Remove_SubTreeW]
cmp eax, edi
jne 0x4546d6
cmp dword [esp + 0x18], edi
je 0x4546f3
push 0xc8
mov ecx, 0x519150
xor bl, bl
call fcn.0041ecf1
inc esi
cmp esi, 3
jg 0x4546f5
mov al, byte [esp + 0x13]
jmp 0x4546a4
mov bl, 1
xor eax, eax
test bl, bl
setne al
pop ebp
pop ebx
pop edi
pop esi
dec eax
and eax, 2
add esp, 0x244
ret
Function at 0x454fd0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x454fe3
xor eax, eax
pop esi
add esp, 0x28
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dl, byte [esp + 0x34]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
mov dword [esp + 0x14], eax
movsx eax, byte [esp + 0x38]
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 4], esi
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0
je 0x455051
lea eax, [esp + 4]
push eax
push 0x449ae0
push ecx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [esp + 8]
pop esi
add esp, 0x28
ret
lea ecx, [esp + 4]
push ecx
push 0x449ae0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 8]
pop esi
add esp, 0x28
ret
Function at 0x455070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 0x40
jae 0x45507c
xor eax, eax
ret
push edi
mov edi, dword [esp + 8]
cmp word [edi], 0x5a4d
je 0x45508c
xor eax, eax
pop edi
ret
push esi
mov esi, dword [edi + 0x3c]
lea ecx, [esi + 0xf8]
cmp eax, ecx
jge 0x45509f
pop esi
xor eax, eax
pop edi
ret
mov ecx, dword [esi + edi]
add esi, edi
cmp ecx, 0x4550
jne 0x45509a
mov cx, word [esi + 0x16]
test ch, 0x20
jne 0x45509a
test cl, 2
je 0x45509a
cmp word [esi + 0x14], 0xe0
jne 0x45509a
push ebx
lea ebx, [esi + 0xf8]
push ebx
push esi
push eax
push edi
call fcn.00444ab0
mov edx, dword [esp + 0x34]
add esp, 0x10
test eax, eax
mov dword [edx], eax
jne 0x4550e3
pop ebx
pop esi
pop edi
ret
movzx ecx, word [esi + 6]
test ecx, ecx
push ebp
mov ebp, dword [esi + 0x54]
jle 0x455106
lea edx, [ebx + 0x14]
mov esi, ecx
mov ecx, dword [edx]
test ecx, ecx
je 0x455100
cmp ecx, ebp
jae 0x455100
mov ebp, ecx
add edx, 0x28
dec esi
jne 0x4550f4
mov ecx, dword [edi + 0x3c]
mov ecx, dword [ecx + edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x40
push 0x1000
push eax
push ecx
call ebx
test eax, eax
mov esi, dword [esp + 0x24]
mov dword [esi], eax
jne 0x455145
mov edx, dword [esp + 0x28]
mov eax, dword [edx]
push 0x40
push 0x1000
push eax
push 0
call ebx
test eax, eax
mov dword [esi], eax
jne 0x455145
pop ebp
pop ebx
pop esi
pop edi
ret
mov ecx, dword [esi]
push ebp
push edi
push ecx
call fcn.004aee50
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
mov ebp, dword [esp + 0x28]
add eax, edx
mov dword [ebp], eax
lea ecx, [eax + 0xf8]
mov eax, dword [esp + 0x2c]
mov dword [eax], ecx
mov edi, dword [ebp]
mov ebx, dword [edi + 0x38]
mov edx, dword [edi + 0x54]
lea eax, [edx + ebx - 1]
xor edx, edx
div ebx
add esp, 0xc
mov dword [esp + 0x18], 0
mov esi, eax
mov eax, dword [esp + 0x24]
imul esi, ebx
add esi, dword [eax]
cmp word [edi + 6], 0
jbe 0x455219
xor edi, edi
lea ecx, [ecx]
mov eax, dword [edi + ecx + 0xc]
test eax, eax
je 0x4551b0
mov edx, dword [esp + 0x24]
mov esi, dword [edx]
add esi, eax
mov eax, dword [edi + ecx + 0x10]
test eax, eax
je 0x4551eb
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edi + ecx + 0x14]
add eax, edx
push eax
push esi
call fcn.004aee50
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov eax, dword [edi + ecx + 0x10]
mov edx, dword [edi + ecx + 8]
add esp, 0xc
cmp edx, eax
jae 0x4551eb
mov edx, dword [ebp]
mov ebx, dword [edx + 0x38]
lea eax, [eax + ebx - 1]
jmp 0x4551f9
mov eax, dword [ebp]
mov ebx, dword [eax + 0x38]
mov edx, dword [edi + ecx + 8]
lea eax, [edx + ebx - 1]
xor edx, edx
div ebx
mov edx, dword [ebp]
movzx edx, word [edx + 6]
add edi, 0x28
imul eax, ebx
add esi, eax
mov eax, dword [esp + 0x18]
inc eax
cmp eax, edx
mov dword [esp + 0x18], eax
jl 0x4551a0
pop ebp
pop ebx
pop esi
mov eax, 1
pop edi
ret
Function at 0x455710
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x10
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x455737
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x10
ret
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 8]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x455771
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0xc]
push 0
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
add esp, 0x10
ret
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 8]
push 0
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4557b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push edi
push 0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push edx
push 4
push eax
mov dword [esp + 0x1c], 4
call esi
mov eax, dword [esp + 0x14]
xor edi, edi
test eax, eax
jl 0x4557f4
inc eax
push eax
call fcn.00445f00
mov edi, eax
add esp, 4
test edi, edi
je 0x4557f4
mov byte [edi], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push ebx
push 0
lea edx, [esp + 0x10]
push edx
push edi
push 2
push eax
mov dword [esp + 0x20], ecx
call esi
mov ebx, dword [esp + 0x2c]
push 0x4ec037
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0xc]
xor esi, esi
test eax, eax
jbe 0x45584d
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
nop
movzx ecx, byte [esi + edi]
push ecx
push str._02X
push ebx
call ebp
mov eax, dword [esp + 0x1c]
add esp, 0xc
add ebx, 2
inc esi
cmp esi, eax
jb 0x455830
pop ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
pop ebx
je 0x45587d
mov ecx, dword [0x51927c]
add edi, 0xfffffff8
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x455890
Capabilities:
Hash data with crc32

Disassembly:
push 0x400
call fcn.00445f00
add esp, 4
mov dword [0x519470], eax
xor edx, edx
mov ecx, edx
shr ecx, 1
test dl, 1
je 0x4558b3
xor ecx, 0xedb88320
test cl, 1
je 0x4558c2
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4558c4
shr ecx, 1
test cl, 1
je 0x4558d3
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4558d5
shr ecx, 1
test cl, 1
je 0x4558e4
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4558e6
shr ecx, 1
test cl, 1
je 0x4558f5
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4558f7
shr ecx, 1
test cl, 1
je 0x455906
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x455908
shr ecx, 1
test cl, 1
je 0x455917
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x455919
shr ecx, 1
test cl, 1
je 0x455928
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x45592a
shr ecx, 1
mov dword [eax + edx*4], ecx
inc edx
cmp edx, 0x100
jl 0x4558a4
ret

Function at 0x455940
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [0x519470]
test esi, esi
jne 0x455956
call fcn.00455890
mov esi, dword [0x519470]
mov edx, dword [esp + 0xc]
or eax, 0xffffffff
test edx, edx
je 0x45598b
mov ecx, dword [esp + 8]
push ebx
push edi
jmp 0x455970
movzx ebx, byte [ecx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [esi + edi*4]
shr eax, 8
xor eax, ebx
inc ecx
dec edx
jne 0x455970
pop edi
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4559a7
push esi
push str._08X
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x455ca0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x18]
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, dword [esp + 0x10]
mov ecx, dword [edi]
mov esi, eax
lea eax, [esi + esi + 6]
push ecx
call fcn.00445f60
add esp, 4
test eax, eax
mov dword [edi], eax
je 0x455cd1
mov word [eax + esi*2 + 4], 0
mov edx, dword [edi]
mov word [edx], 0
mov eax, dword [edi]
mov ecx, dword [ebx + 0x18]
inc esi
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop edi
pop esi
pop ebx
ret 4