joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456b4c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x5d00b0]
cmp byte [eax + 0xc], 0
je 0x456cb9
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456cb2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5d3d98], 0
jne 0x456ba0
push 0x456cc0
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x456cc8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3d98], eax
cmp dword [0x5b7510], 0
jne 0x456c9b
push 0x456cd8
call sub.kernel32.dll_LoadLibraryA
mov dword [0x5b7510], eax
cmp dword [0x5b7510], 0
je 0x456c9b
push 0x456ce4
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3d9c], eax
push 0x456cf4
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3da0], eax
push 0x456d08
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3da4], eax
push 0x456d20
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3da8], eax
push 0x456d38
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3dac], eax
push 0x456d4c
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3db0], eax
push 0x456d64
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3db4], eax
push 0x456d7c
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3db8], eax
push 0x456d98
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3dbc], eax
push 0x456da4
mov eax, dword [0x5b7510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d3dc0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456cb9
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x45b59c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404cd4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x45b5eb
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404f44
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x463854
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4638a4]
test si, 4
je 0x463868
or bl, 1
test si, 8
je 0x463872
or bl, 4
test si, 1
je 0x46387c
or bl, 8
test si, 2
je 0x463886
or bl, 0x10
test si, 0x10
je 0x463890
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46389f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4638a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4638e0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4638c1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4638d0
or bl, 4
test esi, 0x20000000
je 0x4638db
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x46a35c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x46a36e
add esp, 0xfffffff0
call fcn.00404120
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00427900
mov eax, dword [0x5cfa9c]
mov dword [eax + 4], ebx
mov dword [eax], 0x46a700
mov eax, dword [0x5cfaac]
mov dword [eax + 4], ebx
mov dword [eax], 0x46a70c
mov eax, ebx
call fcn.0046a718
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41b4b4]
call fcn.00403d78
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41b4b4]
call fcn.00403d78
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41b4b4]
call fcn.00403d78
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41b4b4]
call fcn.00403d78
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41b4b4]
call fcn.00403d78
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x466a98
push eax
push 0
push 0
mov eax, dword [0x5cfcfc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x429394]
call fcn.0042abf0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x429394]
call fcn.0042abf0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x429394]
call fcn.0042abf0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0046ac1c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46aa9c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46aa9c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46aa9c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46a4ab
call fcn.00404178
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x46a880
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46aa2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46aa0c
mov dl, 1
mov eax, dword [0x41bc08]
call fcn.00403d78
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404cd4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x46a9fb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00456eac
test al, al
je 0x46a9ee
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x46aa3c
lea eax, [ebp - 0x254]
call fcn.0040d570
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46a9ee
xor eax, eax
push ebp
push 0x46a9e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x46aa74
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46a9d0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404f44
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46a9d0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a9ee
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x46a8f1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0042117c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46aa32
lea eax, [ebp - 0x260]
call fcn.00404cd4
ret

Function at 0x46b484
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5d3de4]
cmp byte [eax + 0xa5], 0
jne 0x46b4f5
cmp dword [0x5d3dfc], 0
jne 0x46b4b6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x46b440
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x5d3dfc], eax
cmp dword [0x5d3df8], 0
jne 0x46b4d1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x5d3df8], eax
cmp dword [0x5d3e00], 0
jne 0x46b4f5
push esp
push 0
push 0
push 0x46b3e4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5d3e00], eax
pop edx
ret
Function at 0x46bb88
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x5d3de4]
cmp dword [eax + 0x30], 0
je 0x46bc32
cmp dword [ebx + 0x94], 0
jne 0x46bc2c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46bb18
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46bc2c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46bbf2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46bc2c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e178
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46bc01
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46c790
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46c7c5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404dc4
jmp 0x46c7d2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404d28
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46d99c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46d9dd
mov eax, esi
call fcn.00452474
test al, al
je 0x46d9dd
mov eax, dword [ebx + 0x84]
call fcn.00452170
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46d9dd
push 0
mov eax, dword [ebx + 0x84]
call fcn.00452170
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x476108
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5d3e14
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x47612a
shr eax, 1
xor eax, 0xedb88320
jmp 0x47612c
shr eax, 1
dec edx
jne 0x476118
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x476111
mov byte [0x5d4214], 1
pop esi
pop ebx
ret

Function at 0x476148
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5d4214], 0
jne 0x47615f
call fcn.00476108
mov eax, edi
dec eax
test eax, eax
jl 0x476188
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5d3e14]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x476169
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x478ca4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x478cd5
dec al
je 0x478d11
dec al
je 0x478d55
dec al
je 0x478dc0
jmp 0x478e4a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x478e4a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x478ce5
jmp 0x478e4a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x478e4a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x478d21
jmp 0x478e4a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x478e4a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x478d83
xor ebp, ebp
jmp 0x478d94
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x478d9d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x478d65
jmp 0x478e4a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x478e4a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x478e18
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00476190
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x478dd4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47da94
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41a794]
call fcn.004058b8
xor eax, eax
push ebp
push 0x47dbd8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5bafcc], 0
jne 0x47dae7
mov ecx, dword [0x5cf940]
mov dl, 1
mov eax, dword [0x40b104]
call fcn.004102c0
call fcn.0040464c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040362c
mov eax, ebx
call fcn.00405574
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x47dbe8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406c20
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405584
test eax, eax
jle 0x47db7f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x47db78
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404f5c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404f44
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040c0bc
test eax, eax
jne 0x47db78
mov ebx, 0x15
jmp 0x47db84
mov ebx, 0x10
jmp 0x47db84
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5bafcc]
call fcn.0047d9ec
mov eax, dword [ebp - 8]
call fcn.0047d9ec
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dbdf
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404cf8
lea eax, [ebp - 0x10]
mov edx, dword [0x41a794]
call fcn.00405988
ret

Function at 0x4952b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4952e8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4952c6
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4952d5
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4952e4
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4a5f70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4a5fd4
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404f44
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040c6ac
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5fdb
lea eax, [ebp - 0xc]
call fcn.00404cd4
ret
Function at 0x4c03ec
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c041a
mov eax, ebx
call fcn.004c0ea0
cmp dword [ebx + 0x40], 0
je 0x4c0413
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c048b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c047d
cmp dword [ebx + 8], 0
je 0x4c043c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c044e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c047d
cmp dword [ebx + 8], 0
je 0x4c042f
cmp eax, 3
je 0x4c0461
dec eax
jne 0x4c042f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c042f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c042f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c04a9
cmp dword [ebx + 0x14], 0xcc
je 0x4c04a9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c04b4
pop ebx
ret
Function at 0x4e53e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0xc]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4e5416
test bl, bl
je 0x4e540b
mov eax, esi
call fcn.004e541c
push 4
mov eax, dword [esi + 0xc]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4e5416
push 0
mov eax, dword [esi + 0xc]
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4efdf0
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x5ccf9c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x4efeb4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4efe28
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x4efecb
dec edx
je 0x4eff0c
jmp 0x4eff69
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4eff69
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4effcc
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4effe9
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4f00fb
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4f001c
je 0x4f0068
sub ecx, 0x2b
je 0x4f005e
sub ecx, 4
je 0x4f0063
dec ecx
sub ecx, 0xa
jb 0x4f004d
jmp 0x4f006b
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4f002e
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4f003c
jmp 0x4f006b
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4f006b
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4f006b
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4f006b
mov byte [eax], 0x3e
jmp 0x4f006b
mov byte [eax], 0x3f
jmp 0x4f006b
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4efffb
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4f00bb
cmp byte [esp + 3], 0xff
jne 0x4f00bb
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4f00f3
cmp dl, 0xff
je 0x4f00f3
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4efff4
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x4f09e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4f0a04
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4f09f2
pop edi
pop esi
pop ebx
ret

Function at 0x4f2ecc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.0040840c
ret