joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430bf0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x84], 0
je 0x430c25
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403a54
jmp 0x430c2f
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.00403a08
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4318b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x64]
test esi, esi
je 0x4318e8
mov eax, esi
call fcn.004249c8
test al, al
je 0x4318e8
mov eax, dword [ebx + 0x64]
call fcn.00424830
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4318e8
push 0
mov eax, dword [ebx + 0x64]
call fcn.00424830
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x43d708
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call fcn.00403db0
push eax
push 0x400
lea eax, [ebp - 0x400]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00403db0
push eax
mov eax, edi
call fcn.00403db0
push eax
mov eax, esi
call fcn.00403db0
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x400]
mov eax, dword [ebp + 8]
call fcn.00403a54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44c364
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x44c392
mov eax, ebx
call fcn.0044ce08
cmp dword [ebx + 0x3c], 0
je 0x44c38b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x44c403
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x44c3f5
cmp dword [ebx + 8], 0
je 0x44c3b4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x44c3c6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x44c3f5
cmp dword [ebx + 8], 0
je 0x44c3a7
cmp eax, 3
je 0x44c3d9
dec eax
jne 0x44c3a7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x44c3a7
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x44c3a7
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x44c421
cmp dword [ebx + 0x10], 0xcc
je 0x44c421
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0044c42c
pop ebx
ret
Function at 0x460108
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403db0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x460144
push ebp
call fcn.00460098
pop ecx
mov eax, dword [ebp - 8]
call fcn.0045fb24
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4609cc
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x460a05
mov eax, dword [0x4de210]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x4609f8
push ebx
push 0x460a0c
call fcn.0042b0d8
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret

Function at 0x460a2c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x460b0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004609cc
xor edx, edx
push ebp
push 0x460aed
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x460ab6
mov edx, ebx
mov eax, dword [0x414580]
call fcn.00418eec
test al, al
je 0x460aa6
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00418dc0
call fcn.00403468
jmp 0x460af4
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x460a71
lea edx, [ebp - 8]
mov eax, dword [0x4de0b4]
call fcn.00404a74
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4062e0]
call fcn.00408dc8
call fcn.004033c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460af4
mov eax, dword [ebp - 4]
call fcn.004609a0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460b11
lea eax, [ebp - 8]
call fcn.00403970
ret

Function at 0x460b18
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004609cc
xor eax, eax
push ebp
push 0x460b70
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460b77
mov eax, dword [ebp - 4]
call fcn.004609a0
ret
Function at 0x460b80
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004609cc
xor edx, edx
push ebp
push 0x460bd5
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460bdc
mov eax, dword [ebp - 4]
call fcn.004609a0
ret

Function at 0x460c4c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004609cc
xor eax, eax
push ebp
push 0x460cc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00460984
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00418ec0
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x460cab
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460cc8
mov eax, dword [ebp - 4]
call fcn.004609a0
ret

Function at 0x460cd0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004609cc
xor eax, eax
push ebp
push 0x460d45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00460984
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x460d2f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460d4c
mov eax, dword [ebp - 4]
call fcn.004609a0
ret

Function at 0x460da0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004609cc
xor eax, eax
push ebp
push 0x460de4
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460deb
mov eax, dword [ebp - 4]
call fcn.004609a0
ret
Function at 0x4698d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403da0
xor eax, eax
push ebp
push 0x4699c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, pe_nt_image_headers32
call fcn.00402b08
mov dword [ebp - 8], eax
mov eax, edi
mov dl, byte [ebp - 8]
call fcn.00403b14
mov eax, dword [ebp - 4]
call fcn.00403bec
test eax, eax
jle 0x469971
mov eax, dword [ebp - 4]
call fcn.00403bec
test eax, eax
jle 0x469971
mov dword [ebp - 0x10], eax
mov esi, 1
mov eax, dword [ebp - 8]
add eax, esi
mov ecx, 0x112
cdq
idiv ecx
mov bl, byte [edx + 0x4d70e8]
mov eax, dword [ebp - 4]
mov al, byte [eax + esi - 1]
xor bl, al
xor byte [ebp - 9], bl
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403b14
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00403bf4
inc esi
dec dword [ebp - 0x10]
jne 0x469938
mov eax, dword [ebp - 4]
call fcn.00403bec
add eax, dword [ebp - 8]
inc eax
mov ecx, 0x112
cdq
idiv ecx
mov dl, byte [edx + 0x4d70e8]
mov al, byte [ebp - 9]
xor dl, al
lea eax, [ebp - 0x14]
call fcn.00403b14
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00403bf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4699c7
lea eax, [ebp - 0x14]
call fcn.00403970
lea eax, [ebp - 4]
call fcn.00403970
ret

Function at 0x4699d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403da0
xor eax, eax
push ebp
push 0x469ae6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403970
mov eax, dword [ebp - 4]
call fcn.00403bec
dec eax
jle 0x469abc
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.00403bec
cmp eax, 2
jle 0x469a7c
mov eax, dword [ebp - 4]
call fcn.00403bec
mov edi, eax
dec edi
sub edi, 2
jl 0x469a7c
inc edi
mov ebx, 2
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
xor byte [ebp - 9], al
mov eax, dword [ebp - 8]
add eax, ebx
dec eax
mov ecx, 0x112
cdq
idiv ecx
mov dl, byte [edx + 0x4d70e8]
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
xor dl, al
lea eax, [ebp - 0x10]
call fcn.00403b14
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00403bf4
inc ebx
dec edi
jne 0x469a3f
mov eax, dword [ebp - 4]
call fcn.00403bec
add eax, dword [ebp - 8]
dec eax
mov ecx, 0x112
cdq
idiv ecx
mov bl, byte [edx + 0x4d70e8]
mov al, byte [ebp - 9]
xor bl, al
mov eax, dword [ebp - 4]
call fcn.00403bec
mov edx, dword [ebp - 4]
mov al, byte [edx + eax - 1]
cmp bl, al
je 0x469ac8
mov eax, esi
mov edx, 0x469afc
call fcn.00403a08
jmp 0x469ac8
mov eax, esi
mov edx, 0x469afc
call fcn.00403a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469aed
lea eax, [ebp - 0x10]
call fcn.00403970
lea eax, [ebp - 4]
call fcn.00403970
ret
Function at 0x469b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x469bf9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor edi, edi
xor eax, eax
push ebp
push 0x469bd9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [0x4df7d4]
call fcn.00406fdc
mov edx, dword [ebp - 8]
mov eax, 0x4df7d4
call fcn.004039c4
mov eax, dword [0x4df7d4]
call fcn.00403bec
test eax, eax
jle 0x469bab
mov eax, dword [0x4df7d4]
call fcn.00403bec
mov esi, eax
test esi, esi
jle 0x469bab
mov ebx, 1
mov eax, dword [0x4e086c]
add eax, ebx
mov ecx, 0x112
cdq
idiv ecx
mov al, byte [edx + 0x4d70e8]
mov edx, dword [0x4df7d4]
mov dl, byte [edx + ebx - 1]
xor al, dl
and eax, 0xff
mov ecx, ebx
dec ecx
and ecx, 0x8000000f
jns 0x469ba3
dec ecx
or ecx, 0xfffffff0
inc ecx
shl eax, cl
add edi, eax
inc ebx
dec esi
jne 0x469b6d
cmp edi, dword [0x4e0880]
jne 0x469bc6
mov eax, dword [0x4df7d4]
call fcn.00403bec
cmp eax, 0xa
jl 0x469bc6
test edi, edi
jg 0x469bca
xor eax, eax
jmp 0x469bcc
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x469be3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469c00
lea eax, [ebp - 8]
call fcn.00403970
ret

Function at 0x4942c4
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10], 0xca
jne 0x4942fb
push edi
call fcn.0049952f
cmp dword [edi + 0x3c], 0
je 0x4942f4
mov dword [edi + 0x10], 0xcf
mov eax, 1
jmp 0x494394
mov dword [edi + 0x10], 0xcb
cmp dword [edi + 0x10], 0xcb
jne 0x494371
mov eax, dword [edi + 0x1ac]
cmp dword [eax + 0x10], 0
je 0x494363
cmp dword [edi + 8], 0
je 0x494321
mov eax, dword [edi + 8]
mov esi, dword [eax]
push edi
mov dword [ebp - 4], eax
call esi
mov eax, dword [edi + 0x1ac]
mov esi, dword [eax]
push edi
call esi
mov ebx, eax
test ebx, ebx
jne 0x494336
xor eax, eax
jmp 0x494394
cmp ebx, 2
je 0x494363
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x494310
cmp ebx, 3
je 0x49434c
cmp ebx, 1
jne 0x494310
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
cmp eax, dword [ecx + 8]
jl 0x494310
mov eax, dword [edi + 0x138]
add dword [ecx + 8], eax
jmp 0x494310
mov eax, dword [edi + 0x8c]
mov dword [edi + 0x94], eax
jmp 0x49438e
cmp dword [edi + 0x10], 0xcc
je 0x49438e
mov eax, dword [edi]
mov dword [eax + 0x14], 0x12
mov edx, dword [edi + 0x10]
mov dword [eax + 0x18], edx
mov esi, dword [eax]
push edi
call esi
push edi
call fcn.0049439d
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6faa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push esi
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 0x20]
mov eax, dword [ecx + 0x30]
sub eax, dword [ecx + 0x68]
mov edx, eax
sub edx, dword [ecx + 0x60]
jne 0x4a6fd9
cmp dword [ecx + 0x60], 0
jne 0x4a6fd9
cmp dword [ecx + 0x68], 0
jne 0x4a6fd9
mov edx, esi
jmp 0x4a708b
cmp edx, 0xffffffff
jne 0x4a6fe4
dec edx
jmp 0x4a708b
mov eax, dword [ecx + 0x60]
mov ebx, dword [ecx + 0x20]
sub ebx, 0x106
add ebx, esi
cmp ebx, eax
ja 0x4a708b
mov dword [ebp - 4], edx
mov eax, dword [ecx + 0x2c]
lea edx, [eax + esi]
push esi
push edx
push eax
call fcn.0047d854
add esp, 0xc
mov ecx, dword [ebp + 8]
sub dword [ecx + 0x64], esi
sub dword [ecx + 0x60], esi
sub dword [ecx + 0x50], esi
mov ebx, dword [ecx + 0x40]
mov eax, dword [ecx + 0x38]
lea edx, [ebx + ebx]
lea edi, [eax + edx]
sub edi, 2
movzx ecx, word [edi]
cmp esi, ecx
ja 0x4a7044
mov dword [ebp - 8], ebx
mov ax, cx
mov dx, si
sub dx, ax
neg dx
mov ebx, dword [ebp - 8]
jmp 0x4a7047
xor dx, dx
mov word [edi], dx
sub ebx, 1
jne 0x4a7026
mov ebx, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x34]
lea edx, [esi + esi]
lea edi, [eax + edx]
sub edi, 2
movzx ecx, word [edi]
cmp esi, ecx
ja 0x4a7078
mov dword [ebp - 8], ebx
mov ax, si
mov dx, cx
sub dx, ax
mov ebx, dword [ebp - 8]
jmp 0x4a707b
xor dx, dx
mov word [edi], dx
sub ebx, 1
jne 0x4a705d
mov edx, dword [ebp - 4]
add edx, esi
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
cmp dword [eax + 4], 0
je 0x4a70f1
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x2c]
add ebx, dword [ecx + 0x60]
add ebx, dword [ecx + 0x68]
push edx
push ebx
push eax
call fcn.004a6c89
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x68]
mov dword [ecx + 0x68], eax
cmp eax, 3
jb 0x4a70dc
mov eax, dword [ecx + 0x2c]
mov edx, dword [ecx + 0x60]
movzx ebx, byte [eax + edx]
mov dword [ecx + 0x3c], ebx
mov ecx, dword [ecx + 0x4c]
shl ebx, cl
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x2c]
mov edx, dword [ecx + 0x60]
inc edx
movzx eax, byte [eax + edx]
xor ebx, eax
and ebx, dword [ecx + 0x48]
mov dword [ecx + 0x3c], ebx
cmp dword [ecx + 0x68], 0x106
jae 0x4a70f1
mov eax, dword [ecx]
cmp dword [eax + 4], 0
jne 0x4a6fb9
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ad1ee
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push esi
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4ad205
xor eax, eax
jmp 0x4ad38b
mov edx, dword [ebp + 8]
xor edx, 0xffffffff
mov eax, dword [ebp + 0x10]
cmp eax, 8
jb 0x4ad363
movzx ebx, byte [ecx]
mov esi, edx
xor esi, ebx
mov edi, esi
and edi, 0xff
mov dword [ebp - 4], ebx
mov ebx, edx
shr ebx, 8
mov dword [ebp - 8], esi
mov esi, dword [edi*4 + 0x4ddb14]
xor esi, ebx
mov dword [ebp - 0xc], ebx
movzx ebx, byte [ecx + 1]
mov dword [ebp - 0x10], edi
mov edi, esi
xor edi, ebx
mov dword [ebp - 4], ebx
mov ebx, edi
and ebx, 0xff
mov dword [ebp - 8], edi
mov edi, esi
shr edi, 8
mov esi, dword [ebx*4 + 0x4ddb14]
xor esi, edi
mov dword [ebp - 0x10], ebx
movzx ebx, byte [ecx + 2]
mov dword [ebp - 0xc], edi
mov edi, esi
xor edi, ebx
mov dword [ebp - 4], ebx
mov ebx, edi
and ebx, 0xff
mov dword [ebp - 8], edi
mov edi, esi
shr edi, 8
mov esi, dword [ebx*4 + 0x4ddb14]
xor esi, edi
mov dword [ebp - 0x10], ebx
movzx ebx, byte [ecx + 3]
mov dword [ebp - 0xc], edi
mov edi, esi
xor edi, ebx
mov dword [ebp - 4], ebx
mov ebx, edi
and ebx, 0xff
mov dword [ebp - 8], edi
mov edi, esi
shr edi, 8
mov esi, dword [ebx*4 + 0x4ddb14]
xor esi, edi
mov dword [ebp - 0x10], ebx
movzx ebx, byte [ecx + 4]
mov dword [ebp - 0xc], edi
mov edi, esi
xor edi, ebx
mov dword [ebp - 4], ebx
mov ebx, edi
and ebx, 0xff
mov dword [ebp - 8], edi
mov edi, esi
shr edi, 8
mov esi, dword [ebx*4 + 0x4ddb14]
xor esi, edi
mov dword [ebp - 0x10], ebx
movzx ebx, byte [ecx + 5]
mov dword [ebp - 0xc], edi
mov edi, esi
xor edi, ebx
mov dword [ebp - 4], ebx
mov ebx, edi
and ebx, 0xff
mov dword [ebp - 8], edi
mov edi, esi
shr edi, 8
mov esi, dword [ebx*4 + 0x4ddb14]
xor esi, edi
mov dword [ebp - 0x10], ebx
movzx ebx, byte [ecx + 6]
mov dword [ebp - 0x14], esi
xor esi, ebx
mov dword [ebp - 4], ebx
mov ebx, esi
and ebx, 0xff
mov edi, dword [ebp - 0x14]
shr edi, 8
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebx*4 + 0x4ddb14]
xor ebx, edi
mov dword [ebp - 0x14], ebx
movzx ebx, byte [ecx + 7]
xor ebx, dword [ebp - 0x14]
and ebx, 0xff
mov edi, dword [ebp - 0x14]
shr edi, 8
mov edx, dword [ebx*4 + 0x4ddb14]
xor edx, edi
add ecx, 8
sub eax, 8
cmp eax, 8
jae 0x4ad217
test eax, eax
je 0x4ad386
movzx ebx, byte [ecx]
xor ebx, edx
and ebx, 0xff
mov esi, edx
shr esi, 8
mov edx, dword [ebx*4 + 0x4ddb14]
xor edx, esi
inc ecx
sub eax, 1
jne 0x4ad367
mov eax, edx
xor eax, 0xffffffff
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4af1c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x4af1ef
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4af378
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4af371
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x4af23e
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
test edi, edi
je 0x4af234
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.user32.dll_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 4
je 0x4af356
mov edx, dword [ebp - 4]
test al, 8
je 0x4af2ba
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x4af29f
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0041fee0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x14
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x4af2dc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0041fee0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x318
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0041fee0
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 0x10
je 0x4af334
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x28], 0x1e
lea eax, [ebp - 0x34]
push eax
push 0x4af104
push ebx
call sub.user32.dll_EnumChildWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x20
je 0x4af356
mov byte [ebp - 0x34], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x4af104
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af378
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bce70
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403db0
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
setne al
pop ebx
ret
Function at 0x4cfeec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
xor edx, edx
mov dword [ebp - 0x404], edx
mov dword [ebp - 0x408], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cffa7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x404]
lea eax, [ebp - 0x400]
call fcn.004079fc
push dword [ebp - 0x404]
push 0x4cffbc
lea edx, [ebp - 0x408]
mov eax, dword [0x4e235c]
call fcn.0040715c
push dword [ebp - 0x408]
push 0x4cffc8
mov eax, ebx
mov edx, 4
call fcn.00403cac
lea edx, [ebp - 0x404]
lea eax, [ebp - 0x400]
call fcn.004079fc
mov edx, dword [ebp - 0x404]
mov eax, 0x4e2358
call fcn.004039c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cffae
lea eax, [ebp - 0x408]
mov edx, 2
call fcn.00403994
ret
Function at 0x10016e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0xa
pop esi
jmp 0x100170a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2747
jne 0x100171f
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esi + esi*4]
shl esi, 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10016f1
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx