joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d40
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x404d9b
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_WriteFile
dec eax
pop eax
pop ecx
jne 0x404d8d
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x404d82
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x404d7d
mov eax, 0x65
jmp 0x404d92
call sub.kernel32.dll_GetLastError
call fcn.0040275c
xor eax, eax
jmp 0x404d7d
mov eax, 0x67
jmp 0x404d92

Function at 0x404de0
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x404e23
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x404e1a
push eax
push 1
push 0
push 0
push dword [ebx]
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x404e1a
pop edx
cmp eax, edx
setae al
pop ebx
ret
call fcn.0040276c
mov al, 1
jmp 0x404e18
mov eax, 0x67
call fcn.0040275c
mov al, 0xff
jmp 0x404e18

Function at 0x404e34
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x404e64
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x404e5a
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.0040276c
or eax, 0xffffffff
jmp 0x404e58
mov eax, 0x67
call fcn.0040275c
or eax, 0xffffffff
jmp 0x404e58

Function at 0x404e74
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
mov ecx, dword [ebx + 4]
sub ecx, 0xd7b1
je 0x404e87
sub ecx, 2
jne 0x404eb0
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x404ea4
cmp edx, dword [ebx + 8]
jne 0x404eb7
pop ebx
ret
call sub.kernel32.dll_GetLastError
call fcn.0040275c
jmp 0x404ea2
mov eax, 0x67
jmp 0x404ea9
mov eax, 0x64
jmp 0x404ea9

Function at 0x405048
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x405083
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x405077
cmp edx, dword [ebx + 8]
jne 0x40508a
mov eax, ebx
pop ebx
ret
call sub.kernel32.dll_GetLastError
call fcn.0040275c
jmp 0x405073
mov eax, 5
jmp 0x40507c
mov eax, 0x65
jmp 0x40507c

Function at 0x407e94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407ecd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403a18
jmp 0x407ed6
mov eax, ebx
mov edx, esi
call fcn.004039cc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407ee0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407f01
mov al, byte [esp]
jmp 0x407f03
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x410650
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
dec eax
jne 0x410663
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x412138
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41213e
ret

Function at 0x4147e4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x414835
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41481c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jne 0x41480c
jmp 0x414835
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jne 0x41481d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e7b0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x114], 0
je 0x41e7cc
cmp dword [esi + 4], 0
je 0x41e7f3
mov eax, ebx
call fcn.0041d9e4
test eax, eax
jne 0x41e7e5
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x41e903
mov edx, esi
mov eax, ebx
call fcn.0041e454
jmp 0x41e903
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41e8fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0041fdb0
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0041c8ec
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0041e7b0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0041fdb0
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e903
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422b4c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403934
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x422bad
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x422bad
cmp byte [ebp - 0x102], 0
je 0x422bad
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403b60
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423f3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x28], 0
je 0x423fbd
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x423f6e
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x423f80
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x423f8c
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.00423dc8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x423fb1
push ebp
mov eax, dword [ebp - 4]
call fcn.00423eac
pop ecx
mov ebx, eax
cmp bl, 2
je 0x423f8c
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x425e90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4606e4
cmp dword [edi], 0
jne 0x425f0c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4606e0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45a780
mov ecx, 2
call fcn.00402824
mov edx, 0x425e68
lea eax, [esi + 5]
call fcn.00425e88
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00425e88
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x425ee1
mov dword [0x4606e0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x426030
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x426080]
test si, 4
je 0x426044
or bl, 1
test si, 8
je 0x42604e
or bl, 4
test si, 1
je 0x426058
or bl, 8
test si, 2
je 0x426062
or bl, 0x10
test si, 0x10
je 0x42606c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42607b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x426084
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4260bc]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42609d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4260ac
or bl, 4
test esi, 0x20000000
je 0x4260b7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x42a4b8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42a65d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40afd8]
call fcn.00402db4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403934
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x42a633
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004222ec
test al, al
je 0x42a626
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x42a66c
lea eax, [ebp - 0x254]
call fcn.00407870
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x42a626
xor eax, eax
push ebp
push 0x42a61f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x42a6a4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x42a608
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403b60
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x42a608
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403b60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a626
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x42a529
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0040daa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a664
lea eax, [ebp - 0x260]
call fcn.00403934
ret

Function at 0x42a8d8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4606b8]
cmp byte [eax + 0x85], 0
jne 0x42a949
cmp dword [0x4606f0], 0
jne 0x42a90a
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x42a894
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4606f0], eax
cmp dword [0x4606ec], 0
jne 0x42a925
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4606ec], eax
cmp dword [0x4606f4], 0
jne 0x42a949
push esp
push 0
push 0
push 0x42a838
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4606f4], eax
pop edx
ret
Function at 0x42aa38
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x42aa4f
add esp, 0xfffffff0
call fcn.00403018
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004106cc
mov dl, 1
mov eax, dword [0x40ad1c]
call fcn.00402db4
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, dword [0x40ad1c]
call fcn.00402db4
mov dword [ebx + 0x88], eax
xor eax, eax
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x40], 0x80000018
mov dword [ebx + 0x58], 0x1f4
mov dword [ebx + 0x5c], 0x32
mov dword [ebx + 0x60], 0x9c4
mov byte [ebx + 0x68], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, dword [0x412008]
call fcn.00419054
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x42aba8
mov eax, dword [0x45ed04]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004193ec
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x42c21c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45ed04]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040928c
test eax, eax
je 0x42ab30
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004072b0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.004092b4
test eax, eax
je 0x42ab44
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403b60
mov eax, dword [0x45eb6c]
cmp byte [eax], 0
jne 0x42ab75
mov eax, ebx
call fcn.0042ac8c
mov byte [ebx + 0x3d], 1
mov byte [ebx + 0x3e], 1
mov byte [ebx + 0x3f], 1
mov byte [ebx + 0x7e], 1
xor eax, eax
mov dword [ebx + 0x80], eax
cmp byte [ebp - 1], 0
je 0x42ab9d
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42aee0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4606b8]
cmp dword [eax + 0x24], 0
je 0x42af70
cmp dword [ebx + 0x74], 0
jne 0x42af6d
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x42ae74
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x70]
cmp dword [eax + 8], 0
je 0x42af6d
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x42af3c
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x70]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x42af6d
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x70]
call fcn.0040bf18
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x42af48
inc dword [ebx + 0x74]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x42b858
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x84], 0
je 0x42b88d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403a18
jmp 0x42b897
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.004039cc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x42c48c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x64]
test esi, esi
je 0x42c4c4
mov eax, esi
call fcn.0041ff48
test al, al
je 0x42c4c4
mov eax, dword [ebx + 0x64]
call fcn.0041fdb0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42c4c4
push 0
mov eax, dword [ebx + 0x64]
call fcn.0041fdb0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x43988c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call fcn.00403d74
push eax
push 0x400
lea eax, [ebp - 0x400]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00403d74
push eax
mov eax, edi
call fcn.00403d74
push eax
mov eax, esi
call fcn.00403d74
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x400]
mov eax, dword [ebp + 8]
call fcn.00403a18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44aa40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], eax
mov ebx, 0x460a0c
mov esi, 0x460d08
mov edi, 0x4609b4
xor eax, eax
push ebp
push 0x44ad3a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004529dc
mov byte [0x460a63], 0
mov ecx, 0x44ad48
xor edx, edx
xor eax, eax
call fcn.00452e28
mov byte [esi], 0
mov word [ebx], 0
mov al, byte [ebx]
call fcn.0043be04
lea eax, [ebp - 0x108]
mov edx, esi
call fcn.00403b54
push dword [ebp - 0x108]
lea ecx, [ebp - 0x10c]
movzx eax, word [edi]
mov edx, 4
call fcn.00406fac
push dword [ebp - 0x10c]
push 0x44ad68
lea eax, [ebp - 0x104]
mov edx, 3
call fcn.00403c70
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00403b8c
lea edx, [ebp - 0x100]
mov eax, esi
mov cl, 0x28
call fcn.004029fc
inc word [ebx]
cmp word [ebx], 4
jne 0x44aa9f
mov dl, 2
xor eax, eax
call fcn.004526c8
call fcn.00452ab8
mov byte [esi], 0
mov word [ebx], 4
mov al, byte [ebx]
call fcn.0043be04
lea eax, [ebp - 0x108]
mov edx, esi
call fcn.00403b54
push dword [ebp - 0x108]
lea ecx, [ebp - 0x10c]
movzx eax, word [edi]
mov edx, 4
call fcn.00406fac
push dword [ebp - 0x10c]
push 0x44ad68
lea eax, [ebp - 0x104]
mov edx, 3
call fcn.00403c70
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00403b8c
lea edx, [ebp - 0x100]
mov eax, esi
mov cl, 0x28
call fcn.004029fc
inc word [ebx]
cmp word [ebx], 8
jne 0x44ab2b
mov dl, 3
xor eax, eax
call fcn.004526c8
call fcn.00452ab8
movzx eax, word [0x460dee]
add eax, eax
lea eax, [eax + eax*4]
mov ecx, 0x52
cdq
idiv ecx
sub ax, 0x96
mov word [edi], ax
mov edx, 0x44ad6c
lea eax, [ebp - 0x128]
call fcn.004029e0
lea ecx, [ebp - 0x130]
xor edx, edx
mov ax, word [edi]
call fcn.00441d04
lea edx, [ebp - 0x130]
lea eax, [ebp - 0x128]
mov cl, 0x18
call fcn.004029b0
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x14c]
call fcn.004029e0
call fcn.0043f2c0
mov edx, eax
lea eax, [ebp - 0x150]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov cl, 0x19
call fcn.004029b0
lea ecx, [ebp - 0x14c]
mov dl, 4
xor eax, eax
call fcn.00452e28
push 0x44ad88
lea edx, [ebp - 0x108]
movzx eax, word [0x460dc0]
call fcn.00406f7c
push dword [ebp - 0x108]
push 0x44ad98
lea eax, [ebp - 0x104]
mov edx, 3
call fcn.00403c70
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00403b8c
lea ecx, [ebp - 0x100]
mov dl, 5
xor eax, eax
call fcn.00452e28
push 0x44ada4
lea edx, [ebp - 0x108]
movzx eax, word [edi]
add eax, 0x1dd
call fcn.00406f7c
push dword [ebp - 0x108]
push 0x44adc0
lea eax, [ebp - 0x104]
mov edx, 3
call fcn.00403c70
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00403b8c
lea ecx, [ebp - 0x100]
mov dl, 6
xor eax, eax
call fcn.00452e28
jmp 0x44ad02
call fcn.004408d0
cmp byte [0x4609b6], 0
ja 0x44ad1c
cmp byte [0x460db7], 0
je 0x44acf4
mov byte [0x460db7], 0
call fcn.004412d8
jmp 0x44aa89
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ad41
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.00403958
ret
Function at 0x454ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 2], cl
mov byte [ebp - 1], al
mov ebx, 0x464abf
mov byte [0x464bd0], 0x82
mov eax, edx
xor al, 0xa5
mov byte [0x464bd1], dl
mov dl, byte [ebp - 1]
mov byte [0x464bd2], dl
xor al, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 1]
add dx, 3
dec edx
sub dx, 3
jb 0x45503e
inc edx
mov esi, 0x464bd3
xor al, byte [esi]
inc esi
dec dx
jne 0x455036
xor edx, edx
mov dl, byte [ebp - 1]
mov byte [edx + 0x464bd3], al
mov byte [edx + 0x464bd4], 0x83
mov eax, dword [0x45eecc]
cmp byte [eax], 0
jbe 0x455070
mov eax, dword [0x45ee74]
mov eax, dword [eax]
call fcn.0042ba88
mov eax, dword [0x45eecc]
cmp byte [eax], 0
ja 0x45505a
mov byte [ebx], 0
xor esi, esi
jmp 0x4550ec
mov al, byte [ebp + 8]
mov byte [0x464abb], al
cmp byte [0x464ac6], 0
je 0x4550a7
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 1]
add eax, 5
push eax
push 0x464bd0
mov eax, dword [0x885fac]
push eax
call sub.SIUSBXP.DLL_SI_Write
jmp 0x4550c4
xor ecx, ecx
mov cl, byte [ebp - 1]
add ecx, 5
mov edx, 0x464bd0
mov eax, dword [0x4639b4]
mov eax, dword [eax + 0x20c]
call fcn.0043a958
cmp byte [ebp - 2], 0
je 0x4550f7
jmp 0x4550d8
mov eax, dword [0x45ee74]
mov eax, dword [eax]
call fcn.0042ba88
cmp byte [0x464abb], 0
jbe 0x4550e6
cmp byte [ebx], 0
je 0x4550cc
cmp byte [ebx], 0
jne 0x4550f7
inc esi
cmp si, 5
jae 0x4550f7
cmp byte [ebx], 0
je 0x455077
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x40d935
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 4]
push edi
mov edi, ecx
test esi, esi
jns 0x40d963
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
and eax, 0xfffffffe
and esi, 0x7fffffff
push eax
add esi, edx
push esi
call fcn.0040d9e4
add esp, 0xc
jmp 0x40d9e0
push ebx
mov ecx, 0x7fffffff
and esi, ecx
add esi, edx
lea eax, [ebp + 8]
mov ebx, dword [esi]
and dword [ebp + 8], 0
push eax
push 4
push dword [esi + 4]
and ebx, ecx
add ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40d9df
mov eax, dword [ebp + 0x10]
push 0xffffffffffffffff
mov ecx, dword [eax + 0x1c]
push 0
sub ecx, edi
test byte [ebp + 0xc], 0x40
pop eax
setne al
lea eax, [eax*2 - 1]
push eax
mov eax, dword [0x4ffd84]
imul eax, dword [esi]
push eax
mov eax, dword [0x4ffd8c]
imul eax, dword [esi]
push eax
mov eax, dword [0x4ffd80]
mov edx, dword [esi + 4]
xor eax, ecx
push eax
mov ecx, ebx
call fcn.0040df63
add esp, 0x14
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x40df13
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
mov ebx, dword [ecx + 0x3c]
add ebx, ecx
push ebp
movzx eax, word [ebx + 0x14]
lea ebp, [ebx + 0x18]
add ebp, eax
push esi
xor eax, eax
xor esi, esi
push edi
mov dword [esp + 0x10], edx
cmp ax, word [ebx + 6]
jae 0x40df53
mov edi, ebp
push edi
push edx
call fcn.0041db96
pop ecx
pop ecx
test eax, eax
je 0x40df5b
movzx eax, word [ebx + 6]
mov edx, dword [esp + 0x10]
inc esi
add edi, 0x28
cmp esi, eax
jb 0x40df36
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
imul esi, esi, 0x28
lea eax, [esi + ebp]
jmp 0x40df55