joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4370e0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004370ac
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004370ac
mov esi, eax
xor eax, eax
mov ecx, dword [0x4bc5cc]
mov edx, dword [0x4bc5d0]
mov dword [esp + 4], edx
mov edx, dword [0x4bc5d4]
mov dword [esp + 8], edx
mov edx, dword [0x4bc5d8]
mov dword [esp + 0xc], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
add ebx, edi
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
add esi, edi
dec edx
jne 0x43712c
mov eax, ebx
call fcn.004370ac
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.004370ac
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x437190
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004370ac
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004370ac
mov esi, eax
mov eax, 0xc6ef3720
mov ecx, dword [0x4bc5cc]
mov edx, dword [0x4bc5d0]
mov dword [esp + 4], edx
mov edx, dword [0x4bc5d4]
mov dword [esp + 8], edx
mov edx, dword [0x4bc5d8]
mov dword [esp + 0xc], edx
mov edx, 0x20
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
sub esi, edi
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
sub ebx, edi
sub eax, 0x9e3779b9
dec edx
jne 0x4371df
mov eax, ebx
call fcn.004370ac
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.004370ac
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x44dd74
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404a2c
add esp, 0x104
pop ebx
ret

Function at 0x44f754
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00404a2c
add esp, 0x104
pop ebx
ret

Function at 0x44f788
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00404a2c
add esp, 0x104
pop ebx
ret
Function at 0x4502d8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450434
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call fcn.0044da48
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.0040aea0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.0040aea0
mov edx, dword [ebp - 0xc]
pop eax
call fcn.00404aa0
mov eax, dword [ebp - 8]
call fcn.00404c98
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x450419
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x45037a
cmp esi, 4
jne 0x45037a
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x450419
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x4503fb
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.0044da48
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.0040aea0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.0040aea0
mov edx, dword [ebp - 0x14]
pop eax
call fcn.00404aa0
mov eax, dword [ebp - 0x10]
call fcn.00404c98
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45043b
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004047e0
ret
Function at 0x451670
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45176b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4bc7a8], bl
mov eax, 0x4bc7ac
mov edx, esi
call fcn.00404810
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov dl, bl
mov eax, dword [0x44c91c]
call fcn.004144f4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
call fcn.00402804
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.0040aea0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x451780
call fcn.0040c0bc
mov eax, dword [ebp - 4]
call fcn.00404c98
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp byte [0x4b791c], 0
jne 0x45171e
mov eax, ebx
add al, 0xfd
sub al, 7
jb 0x451748
cmp dword [0x4bd044], 0
je 0x451748
add bl, 0xfb
sub bl, 5
jae 0x451748
push 0x242010
push 0x4517b4
mov eax, esi
call fcn.00404c98
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451772
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004047e0
lea eax, [ebp - 4]
call fcn.004047bc
ret

Function at 0x451a9c
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x451a64
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x451b98
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x451bba
mov dword [esp], eax
mov byte [esp + 4], 0
mov eax, esp
push eax
push 0x451b08
call sub.user32.dll_EnumWindows
mov dl, byte [esp + 4]
mov eax, edx
pop ecx
pop edx
ret

Function at 0x451c38
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, edx
mov dword [esp], eax
push 0x80000001
lea eax, [esp + 0x18]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.004169e4
lea esi, [esp + 0x14]
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, esp
push eax
push 0x451bc0
call sub.user32.dll_EnumWindows
mov edi, ebx
lea esi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x451c9d
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.004169e4
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x451d20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
test ebx, ebx
je 0x451dfe
mov eax, ebx
call fcn.00404a98
mov esi, eax
inc esi
push 0
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x451df7
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451ddd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x451dbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c98
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.00402a48
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451dc6
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x451e04
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x451ecb
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x451ea0
cmp byte [0x4b7914], 0
je 0x451e49
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x5c]
call fcn.004049b4
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 4]
call fcn.00423664
jmp 0x451e58
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.004049b4
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.004031a8
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [0x4bc798]
call fcn.00404c98
push eax
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404c98
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ed2
lea eax, [ebp - 0x5c]
call fcn.004047bc
lea eax, [ebp - 4]
call fcn.004047bc
ret
Function at 0x452064
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x4b88dc]
mov dl, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x44cfe0]
call fcn.00451ed8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x452134
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00451f50
test al, al
je 0x45211e
cmp word [ebp - 4], 0x5a4d
jne 0x45211e
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0041a4d8
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00451f50
test al, al
je 0x45211e
cmp dword [ebp - 8], 0
je 0x45211e
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0041a4d8
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00451f50
test al, al
je 0x45211e
cmp dword [ebp - 0xc], 0x4550
jne 0x45211e
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.00451f50
test al, al
je 0x45211e
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45213b
mov eax, dword [ebp - 0x10]
call fcn.00403904
ret
Function at 0x452144
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4522db
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x44cfe0]
call fcn.00451ed8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4522be
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00451f50
test al, al
je 0x4522a8
cmp word [ebp - 4], 0x5a4d
jne 0x4522a8
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0041a4d8
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00451f50
test al, al
je 0x4522a8
cmp dword [ebp - 8], 0
je 0x4522a8
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0041a4d8
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00451f50
test al, al
je 0x4522a8
cmp dword [ebp - 0xc], 0x4550
jne 0x4522a8
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.00451f50
test al, al
je 0x4522a4
test byte [ebp - 0x15], 0x20
je 0x4522a4
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0044d8f0
mov eax, dword [ebp - 0x2c]
call fcn.00404c98
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45229d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x4522ec
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x452282
push 0xa
push 0x4522f8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x452282
mov byte [ebp - 1], 2
jmp 0x452286
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4522a8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4522c5
mov eax, dword [ebp - 0x10]
call fcn.00403904
ret
Function at 0x452514
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x45251d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x452740
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004047bc
mov eax, esi
call fcn.004047bc
test ebx, ebx
je 0x452725
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.00404c98
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x452725
mov eax, dword [ebp - 4]
call fcn.0040271c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45271e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.00404c98
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x452705
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x452750
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45264f
push 0x452774
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.0040ae78
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0040ae78
push dword [ebp - 0x24]
push 0x452790
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404b58
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404c98
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45264f
cmp dword [ebp - 0xc], 1
jbe 0x45264f
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0040b9a0
mov ecx, eax
mov eax, edi
mov edx, ebx
call fcn.004048ac
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4527a4
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x452705
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call fcn.004078b4
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov di, word [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
call fcn.004078b4
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0xc]
mov word [ebp - 0x10], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.0040ad64
push dword [ebp - 0x28]
push 0x4527b0
lea edx, [ebp - 0x2c]
movzx eax, di
call fcn.0040ad64
push dword [ebp - 0x2c]
push 0x4527b0
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0xe]
call fcn.0040ad64
push dword [ebp - 0x30]
push 0x4527b0
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x10]
call fcn.0040ad64
push dword [ebp - 0x34]
mov eax, esi
mov edx, 7
call fcn.00404b58
mov eax, dword [esi]
mov edx, 0x4527bc
call fcn.00404be4
jne 0x452705
mov eax, esi
call fcn.004047bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452725
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0040273c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452747
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.004047e0
ret
Function at 0x452990
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4529f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404c98
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4529c8
and ebx, 0xfffffffe
push ebx
push edi
call sub.kernel32.dll_SetFileAttributesA
mov edx, edi
lea eax, [ebp - 4]
call fcn.004049b4
mov eax, dword [ebp - 4]
call fcn.0040b380
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4529f9
lea eax, [ebp - 4]
call fcn.004047bc
ret

Function at 0x4535f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov byte [ebp - 0x15], 0
mov eax, dword [0x4b7e48]
mov edx, dword [eax]
call dword [edx + 8]
push 0x453708
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x28], eax
push 0x453714
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
xor eax, eax
push ebp
push 0x4536fb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x453724
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
push 0x45373c
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x14], eax
push 0x453754
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x24], eax
push 0x453764
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
push 0x453780
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
push 0x453790
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x10], eax
push 0x4537a0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x1c], eax
push 0x4537b0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x20], eax
call fcn.0044f228
test al, al
je 0x4536bb
push ebp
call fcn.00453594
pop ecx
jmp 0x4536c2
push ebp
call fcn.0045345c
pop ecx
mov edx, 0x452d90
mov eax, dword [0x4b7e48]
call fcn.00418104
cmp byte [ebp - 0x15], 0
jne 0x4536de
push ebp
call fcn.00452e4c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453702
cmp dword [ebp - 0x28], 0
je 0x4536fa
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
Function at 0x454a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x454bf6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f6
jb 0x454aa2
cmp byte [ebp - 5], 0x80
jb 0x454aa2
and byte [ebp - 5], 0x7f
mov byte [ebp - 6], 1
xor edx, edx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.00402c74
xor ecx, ecx
mov cl, byte [ebp - 5]
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f4
jb 0x454bc9
cmp byte [esi + 0x3b], 0
je 0x454b05
mov eax, dword [0x4bc9b8]
mov edx, dword [esi + 0x37]
call fcn.00404be4
je 0x454af4
mov eax, dword [esi + 0x37]
call fcn.00437240
mov eax, 0x4bc9b8
mov edx, dword [esi + 0x37]
call fcn.00404810
xor ecx, ecx
mov cl, byte [ebx]
lea edx, [ebx + 1]
lea eax, [ebx + 1]
call fcn.004372e0
jmp 0x454b57
cmp byte [ebx], 0
je 0x454b57
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404a20
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004376bc
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, 0xff
call fcn.00404a74
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404a20
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x454c0c
call fcn.00404ae4
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, 0xff
call fcn.00404a74
cmp byte [ebp - 6], 0
je 0x454bdb
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404a20
lea eax, [ebp - 0x1c]
mov edx, 0x454c18
call fcn.00404aa0
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, 0xff
call fcn.00404a74
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00404a20
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x124]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00454a40
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x24]
call fcn.00404a20
mov edx, dword [ebp - 0x24]
pop eax
call fcn.00404aa0
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0xff
call fcn.00404a74
jmp 0x454bdb
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x454bdb
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x454bd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454bfd
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.004047e0
ret

Function at 0x45a7e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov ebp, edx
mov edi, eax
push 0
push 0
push 0xe
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
inc esi
mov eax, ebx
mov edx, esi
call fcn.00404e24
mov eax, ebx
call fcn.00404cf0
push eax
push esi
push 0xd
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebx]
call fcn.00404a98
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.00404d38
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45b7a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov al, byte [ebp - 0xe5]
and al, 0x80
cmp al, 0x80
sete al
mov esp, ebp
pop ebp
ret
Function at 0x462448
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
cmp byte [0x4b7e8c], 0
jne 0x462495
xor esi, esi
mov edx, 0x4bd094
mov eax, esi
mov ebx, 8
test al, 1
je 0x46247b
shr eax, 1
xor eax, 0xedb88320
jmp 0x46247d
shr eax, 1
dec ebx
jne 0x46246e
mov dword [edx], eax
inc esi
add edx, 4
cmp esi, 0x100
jne 0x462467
mov byte [0x4b7e8c], 1
mov eax, dword [esp + 4]
dec eax
test eax, eax
jl 0x4624c2
inc eax
xor esi, esi
mov edx, dword [esp]
movzx edx, byte [edx + esi]
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x4bd094]
shr edi, 8
xor edx, edi
mov edi, edx
inc esi
dec eax
jne 0x4624a1
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret