joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d798
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x47d7b7
add edx, 3
sar edx, 2
test edx, edx
jle 0x47d8c4
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x47d7ed
je 0x47d82d
sub ecx, 0x2b
je 0x47d823
sub ecx, 4
je 0x47d828
dec ecx
sub ecx, 0xa
jb 0x47d816
jmp 0x47d830
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x47d7ff
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x47d809
jmp 0x47d830
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x47d830
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x47d830
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x47d830
mov byte [eax], 0x3e
jmp 0x47d830
mov byte [eax], 0x3f
jmp 0x47d830
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x47d7cf
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x47d881
cmp byte [esp + 7], 0xff
jne 0x47d881
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x47d8b9
cmp dl, 0xff
je 0x47d8b9
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x47d7c6
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x47fc94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x47fcbe
mov ecx, 0x47fd1c
mov dl, 1
mov eax, dword [0x47ef40]
call fcn.0040bc64
call fcn.00403a9c
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x47fd0b
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x38]
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebx + 0x14]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x18]
dec ecx
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x10]
inc eax
call fcn.00402900
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
dec eax
mov dl, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x47fcce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x47fd34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x47fd5e
mov ecx, 0x47fdc4
mov dl, 1
mov eax, dword [0x47ef40]
call fcn.0040bc64
call fcn.00403a9c
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x47fdb3
mov dword [ebp - 0x10], eax
mov al, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x38]
mov eax, dword [ebx + 0x14]
mov al, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x18]
dec ecx
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x10]
inc eax
call fcn.00402900
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
dec eax
mov dl, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x47fd70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x480350
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x480370
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x48035e
pop edi
pop esi
pop ebx
ret
Function at 0x495f3c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4960a9
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x3a4]
cmp eax, 0xc8
jb 0x49608e
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x3a4], eax
xor eax, eax
push ebp
push 0x496087
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x3a8], 1
xor eax, eax
push ebp
push 0x496014
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49d780]
mov eax, dword [eax]
call fcn.0042cb54
mov eax, dword [0x49d3ec]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x495fee
inc ebx
xor esi, esi
lea ecx, [ebp - 8]
mov eax, dword [0x49d3ec]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x495fc8
mov eax, dword [0x49d3ec]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49601b
mov eax, dword [0x49d780]
mov eax, dword [eax]
call fcn.0042cb5c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4960b0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404108
ret
Function at 0x497e4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404594
xor eax, eax
push ebp
push 0x497fc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49d5f0]
mov eax, dword [eax]
call fcn.004859f8
xor eax, eax
push ebp
push 0x497fa4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov byte [ebp - 6], 0
mov eax, dword [ebp - 4]
call fcn.004045a4
push eax
call sub.wsock32.dll_inet_addr
mov edi, eax
mov eax, dword [0x49d5f0]
mov eax, dword [eax]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x497f4d
mov eax, dword [0x49d5f0]
mov eax, dword [eax]
mov edx, esi
call fcn.00418eac
mov ebx, eax
cmp edi, dword [ebx]
jne 0x497f43
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 4]
mov edx, dword [0x49d2c8]
cmp eax, dword [edx]
ja 0x497f12
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 4], eax
inc dword [ebx + 8]
mov eax, dword [ebx + 8]
mov edx, dword [0x49d78c]
cmp eax, dword [edx]
jl 0x497f3d
mov edx, 0x10
mov eax, ebx
call fcn.00402724
mov eax, dword [0x49d5f0]
mov eax, dword [eax]
mov edx, esi
call fcn.00418d9c
mov byte [ebp - 5], 1
jmp 0x497f3d
mov eax, dword [ebx + 8]
mov edx, dword [0x49d78c]
cmp eax, dword [edx]
jle 0x497f23
mov byte [ebp - 5], 1
mov edx, 0x10
mov eax, ebx
call fcn.00402724
mov eax, dword [0x49d5f0]
mov eax, dword [eax]
mov edx, esi
call fcn.00418d9c
mov byte [ebp - 6], 1
jmp 0x497f4d
dec esi
cmp esi, 0xffffffff
jne 0x497eb4
cmp byte [ebp - 6], 0
jne 0x497f8a
mov eax, 0x10
call fcn.00402704
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x10
call fcn.00402ce0
mov dword [ebx], edi
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 8], eax
mov eax, dword [0x49d5f0]
mov eax, dword [eax]
mov edx, ebx
call fcn.00418d50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497fab
mov eax, dword [0x49d5f0]
mov eax, dword [eax]
call fcn.00485a04
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401148
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.004011d0
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x401180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push 7
push dword [ebp - 4]
call sub.kernel32.dll_SetConsoleMode
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
mov edx, dword [ebp + 8]
sub edx, 1
add edx, 1
cmp byte [edx], 0
je 0x4011c4
cmp byte [edx], 0xd
jne 0x4011b4
mov byte [edx], 0
mov eax, dword [ebp - 8]
sub eax, 2
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402140
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40217f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40217f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40217f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40217f
cmp dword [ecx + 0x74], 0xe
jbe 0x40217f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42b2e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
cmp dword [0x490738], 0
je 0x42b53a
mov eax, dword [0x490738]
cmp byte [eax + 0x2c], 0
jne 0x42b53a
xor edx, edx
push ebp
push 0x42b533
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x490738]
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push fcn.0042b506
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x490738]
mov byte [eax + 0x2c], 1
mov edx, dword [0x490740]
mov eax, dword [0x490738]
call fcn.0042a2d4
cmp byte [0x490754], 2
jne 0x42b37a
mov eax, dword [0x490738]
mov edx, dword [0x42806c]
call fcn.00403110
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
cmp dword [ebx + 4], 0
sete al
mov byte [ebx + 0x60], al
mov eax, dword [0x490738]
cmp dword [eax + 4], 0
je 0x42b3af
mov eax, dword [0x490738]
mov eax, dword [eax + 4]
mov edx, dword [0x428a8c]
call fcn.004030f8
test al, al
je 0x42b3af
mov eax, dword [0x490738]
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x10], edx
jmp 0x42b3c0
mov eax, dword [0x490738]
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edx
push ebp
call fcn.0042b270
pop ecx
test al, al
je 0x42b3f4
cmp byte [0x490754], 2
jne 0x42b3da
cmp byte [ebx + 0x60], 0
jne 0x42b3ee
cmp byte [0x490754], 0
je 0x42b3f4
mov al, 1
call fcn.0042ab94
test al, al
je 0x42b3f4
cmp byte [ebp - 1], 0
jne 0x42b3f8
xor eax, eax
jmp 0x42b3fa
mov al, 1
mov byte [ebp - 9], al
cmp byte [0x490754], 2
jne 0x42b449
cmp byte [ebp - 9], 0
je 0x42b469
cmp byte [ebx + 0x60], 0
je 0x42b469
mov eax, dword [ebx + 0x30]
call fcn.00440b6c
test eax, eax
je 0x42b430
mov edx, dword [eax + 0x200]
cmp edx, dword [ebx + 0x30]
jne 0x42b430
xor edx, edx
call fcn.0044459c
mov eax, dword [0x490738]
push eax
xor ecx, ecx
mov edx, 0xb03a
mov eax, dword [0x490734]
call fcn.0042daa0
jmp 0x42b469
cmp dword [0x490758], 0
je 0x42b45e
mov eax, dword [0x490758]
call fcn.004342a8
jmp 0x42b469
mov eax, dword [0x49074c]
push eax
invalid
adc eax, ecx

Function at 0x42b8b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
xchg ebp, eax
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
invalid
inc ebp
wait
Function at 0x42bd2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0042b506
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042b4bb
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99

Function at 0x42bdfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0042b506
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042b4bb
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
invalid
test dword [esp + edi*8], ebx
invalid
invalid

Function at 0x42c03c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ecx + edi*8 - 0x39460001], esp
test dword [ebp - 0x6b000007], esp
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.0042b506
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042b4bb
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
cli
invalid
dec dword [edi - 0x5187a3a]
invalid
dec dword [edi - 0x5177a3a]
invalid
invalid
ljmp 0xffff
push eax
call fcn.0042b506
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042b4bb
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.0042b4f6
invalid
Function at 0x42c114
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.0042b506
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042b4bb
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.0042b4f6
int 0xd6
mov al, 0x33
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x42c1ea
cmp dword [ebp - 0x398], 0
je 0x42c3b4
cmp dword [ebp + 0xc], 1
je 0x42c3b4
cmp dword [ebp + 0xc], 8
jne 0x42c37c
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
test dword [ebp - 7], edx
invalid
inc dword [ecx]
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
pop edx
stc
invalid
dec dword [ecx]
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
inc esp
stc
invalid
and al, 0xc8
call fcn.0042b4f6
push cs
jl 0x42c37a
ja 0x42c306
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0042b4f6
lahf
or edi, dword [ebx - 0x2f5a7f42]
std
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
invalid
invalid

Function at 0x42c448
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor dh, al
test dword [edx + 0x21fffffc], ebx
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
invalid
invalid
sahf
Function at 0x42d0c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.0042b506
or ah, ah
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.0042b467
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x42d46e
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.0042b4f6
insd dword es:[edi], dx
add byte [eax - 0xa], al
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x42d4d9
lea eax, [ebp - 0x714]
push eax
call fcn.0042b506
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.0042b4bb
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x42d4d9
jmp fcn.0042ce98
cmp dword [ebp - 0x37c], 0
je 0x42d4e7
jmp fcn.0042d59c
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x42d540
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x42d545
jmp fcn.0042ce98
invalid
movsd dword es:[edi], dword [esi]
invalid
Function at 0x447120
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4472c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f5d4]
call fcn.00402f50
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403b74
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44729b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00437034
test al, al
je 0x44728e
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4472d4
lea eax, [ebp - 0x254]
call fcn.004094dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44728e
xor eax, eax
push ebp
push 0x447287
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44730c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x447270
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403da0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x447270
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44728e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x447191
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.004130c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4472cc
lea eax, [ebp - 0x260]
call fcn.00403b74
ret
Function at 0x448a80
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x448ab5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c58
jmp 0x448abf
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.00403c0c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4499ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4499e4
mov eax, esi
call fcn.00432c74
test al, al
je 0x4499e4
mov eax, dword [ebx + 0x6c]
call fcn.0043284c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4499e4
push 0
mov eax, dword [ebx + 0x6c]
call fcn.0043284c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x463ad7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x48e8ae
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x463b2f
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x48e8cf
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x463b25
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x463b33
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8