joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48009c
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov dword [esp], 0x67452301
mov dword [esp + 4], 0xefcdab89
mov dword [esp + 8], 0x98badcfe
mov dword [esp + 0xc], 0x10325476
lea edx, [ebx + 0x10ac]
mov eax, esp
mov ecx, 4
call fcn.00402910
lea eax, [ebx + 0x10ac]
mov dword [ebx + 0x10cc], eax
lea edx, [ebx + 0x10b0]
lea eax, [esp + 4]
mov ecx, 4
call fcn.00402910
lea eax, [ebx + 0x10b0]
mov dword [ebx + 0x10d0], eax
lea edx, [ebx + 0x10b4]
lea eax, [esp + 8]
mov ecx, 4
call fcn.00402910
lea eax, [ebx + 0x10b4]
mov dword [ebx + 0x10d4], eax
lea edx, [ebx + 0x10b8]
lea eax, [esp + 0xc]
mov ecx, 4
call fcn.00402910
lea eax, [ebx + 0x10b8]
mov dword [ebx + 0x10d8], eax
xor eax, eax
mov dword [ebx + 0x1048], eax
xor eax, eax
mov dword [ebx + 0x1050], eax
mov dword [ebx + 0x1054], eax
add esp, 0x10
pop ebx
ret

Function at 0x481528
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], edx
mov dword [esp], eax
mov esi, 0x30
mov ecx, 0x4b9288
mov edi, dword [esp + 4]
lea edx, [esp + 0xc]
xor eax, eax
mov al, byte [ecx]
mov ebx, dword [esp]
mov al, byte [ebx + eax + 0xa17]
xor al, byte [edi]
mov byte [edx], al
inc edx
inc edi
inc ecx
dec esi
jne 0x481548
mov esi, 1
mov ecx, 0x4b9318
mov eax, esi
dec eax
mov edx, eax
add edx, edx
lea edx, [edx + edx*2]
mov edi, eax
shl edi, 2
xor eax, eax
mov al, byte [esp + edx + 0xc]
add eax, eax
xor ebx, ebx
mov bl, byte [esp + edx + 0x11]
add eax, ebx
xor ebx, ebx
mov bl, byte [esp + edx + 0xd]
shl ebx, 3
movzx ebp, byte [esp + edx + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + edx + 0xf]
add ebp, ebp
add ebx, ebp
movzx edx, byte [esp + edx + 0x10]
add ebx, edx
mov dword [esp + 8], ebx
mov edx, 1
mov ebx, edx
dec ebx
je 0x4815c8
dec ebx
je 0x4815ec
dec ebx
je 0x481610
dec ebx
je 0x481633
jmp 0x48164c
mov ebx, eax
add ebx, ebx
lea ebx, [ecx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [edx + edi]
mov byte [esp + ebp + 0x3b], bl
jmp 0x48164c
mov ebx, eax
add ebx, ebx
lea ebx, [ecx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [edx + edi]
mov byte [esp + ebp + 0x3b], bl
jmp 0x48164c
mov ebx, eax
add ebx, ebx
lea ebx, [ecx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [edx + edi]
mov byte [esp + ebp + 0x3b], bl
jmp 0x48164c
mov ebx, eax
add ebx, ebx
lea ebx, [ecx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [edx + edi]
mov byte [esp + ebp + 0x3b], bl
inc edx
cmp edx, 5
jne 0x4815b5
inc esi
add ecx, 0x40
cmp esi, 9
jne 0x48156a
mov esi, 1
mov edx, 0x4b92b8
mov eax, dword [esp]
xor ecx, ecx
mov cl, byte [edx]
mov cl, byte [esp + ecx + 0x3b]
mov byte [eax + esi + 0xa37], cl
inc esi
inc edx
cmp esi, 0x21
jne 0x48166d
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4816b0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x4b953f]
test bl, bl
jbe 0x4816e4
lea edx, [esi + 0x940]
mov eax, esi
call fcn.00481690
lea edx, [esi + 0x95c]
mov eax, esi
call fcn.00481690
dec bl
jne 0x4816c6
mov cl, 0x30
mov ebp, 0x4b9510
mov eax, edi
mov dl, byte [ebp]
cmp dl, 0x1c
ja 0x481706
and edx, 0xff
mov dl, byte [esi + edx + 0x93f]
mov byte [eax], dl
jmp 0x481715
and edx, 0xff
mov dl, byte [esi + edx + 0x93f]
mov byte [eax], dl
inc eax
inc ebp
dec cl
jne 0x4816ed
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48182c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 8
call fcn.00402910
mov dl, 8
lea esi, [ebp - 0x10]
mov al, byte [esi]
mov ecx, eax
add ecx, ecx
and eax, 0xff
shr eax, 7
add cl, al
mov byte [esi], cl
inc esi
dec dl
jne 0x481851
mov bl, 1
mov esi, 0x4b94d8
mov cl, byte [esi]
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004812a8
mov edi, ebx
and edi, 0xff
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov byte [edx + edi + 0x93f], al
mov cl, byte [esi + 0x1c]
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004812a8
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov byte [edx + edi + 0x95b], al
inc ebx
inc esi
cmp bl, 0x1d
jne 0x48186f
mov bl, 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xa68]
shl eax, 5
lea eax, [eax + eax*2]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
lea eax, [edx + eax*8]
xor edx, edx
mov dl, bl
add edx, edx
lea edx, [edx + edx*2]
lea ecx, [eax + edx*8 - 0x2f0]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
call fcn.004816b0
inc ebx
cmp bl, 0x11
jne 0x4818bb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4821dc
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
mov esi, eax
mov bl, 1
lea edx, [esi + 0x1a8d]
mov ecx, ebx
mov eax, esi
call fcn.004812a8
xor edx, edx
mov dl, bl
mov byte [esi + edx + 0x977], al
inc ebx
cmp bl, 0x41
jne 0x4821e6
mov bl, 1
mov eax, 0x4b9208
cmp bl, 0x20
ja 0x48222a
xor edx, edx
mov dl, byte [eax]
mov dl, byte [esi + edx + 0x977]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9f7], dl
jmp 0x482240
xor edx, edx
mov dl, byte [eax]
mov dl, byte [esi + edx + 0x977]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9f7], dl
inc ebx
inc eax
cmp bl, 0x41
jne 0x48220d
mov byte [esp], 1
xor eax, eax
mov al, byte [esp]
add eax, eax
lea eax, [eax + eax*2]
mov edx, edi
shl edx, 5
lea edx, [edx + edx*2]
lea edx, [esi + edx*8]
lea edx, [edx + eax*8 - 0x2f0]
mov eax, esi
call fcn.00481528
mov bl, 1
xor eax, eax
mov al, bl
mov dl, byte [esi + eax + 0x9f7]
xor byte [esi + eax + 0xa37], dl
inc ebx
cmp bl, 0x21
jne 0x482270
push esi
push edi
lea edi, [esi + 0x9f8]
add esi, 0xa18
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [esi + 0xa18]
add esi, 0xa38
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
inc byte [esp]
cmp byte [esp], 0x11
jne 0x48224b
mov bl, 1
mov eax, 0x4b9248
mov dl, byte [eax]
cmp dl, 0x20
ja 0x4822e7
and edx, 0xff
mov dl, byte [esi + edx + 0xa17]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9b7], dl
jmp 0x4822ff
and edx, 0xff
mov dl, byte [esi + edx + 0x9d7]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9b7], dl
inc ebx
inc eax
cmp bl, 0x41
jne 0x4822c6
mov bl, 1
xor eax, eax
mov al, bl
mov al, byte [esi + eax + 0x9b7]
push eax
lea edx, [esi + 0x1a8d]
mov ecx, ebx
mov eax, esi
call fcn.004812d4
inc ebx
cmp bl, 0x41
jne 0x482308
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x482364
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
mov esi, eax
mov bl, 1
lea edx, [esi + 0x1a8d]
mov ecx, ebx
mov eax, esi
call fcn.004812a8
xor edx, edx
mov dl, bl
mov byte [esi + edx + 0x977], al
inc ebx
cmp bl, 0x41
jne 0x48236e
mov bl, 1
mov eax, 0x4b9208
cmp bl, 0x20
ja 0x4823b2
xor edx, edx
mov dl, byte [eax]
mov dl, byte [esi + edx + 0x977]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9f7], dl
jmp 0x4823c8
xor edx, edx
mov dl, byte [eax]
mov dl, byte [esi + edx + 0x977]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9f7], dl
inc ebx
inc eax
cmp bl, 0x41
jne 0x482395
mov byte [esp], 1
xor eax, eax
mov al, byte [esp]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
mov edx, edi
shl edx, 5
lea edx, [edx + edx*2]
lea edx, [esi + edx*8]
lea edx, [edx + eax*8 - 0x2f0]
mov eax, esi
call fcn.00481528
mov bl, 1
xor eax, eax
mov al, bl
mov dl, byte [esi + eax + 0x9f7]
xor byte [esi + eax + 0xa37], dl
inc ebx
cmp bl, 0x21
jne 0x482401
push esi
push edi
lea edi, [esi + 0x9f8]
add esi, 0xa18
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [esi + 0xa18]
add esi, 0xa38
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
inc byte [esp]
cmp byte [esp], 0x11
jne 0x4823d3
mov bl, 1
mov eax, 0x4b9248
mov dl, byte [eax]
cmp dl, 0x20
ja 0x482478
and edx, 0xff
mov dl, byte [esi + edx + 0xa17]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9b7], dl
jmp 0x482490
and edx, 0xff
mov dl, byte [esi + edx + 0x9d7]
xor ecx, ecx
mov cl, bl
mov byte [esi + ecx + 0x9b7], dl
inc ebx
inc eax
cmp bl, 0x41
jne 0x482457
mov bl, 1
xor eax, eax
mov al, bl
mov al, byte [esi + eax + 0x9b7]
push eax
lea edx, [esi + 0x1a8d]
mov ecx, ebx
mov eax, esi
call fcn.004812d4
inc ebx
cmp bl, 0x41
jne 0x482499
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x482508
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
mov eax, dword [esi + 0xa88]
mov dword [esp], eax
xor edx, edx
mov dl, byte [esi + 0x1acd]
mov ecx, dword [esp]
mov eax, esi
call fcn.00481ccc
mov ebx, eax
mov eax, dword [esi + 0xa80]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
test bl, bl
jbe 0x4825fd
xor ecx, ecx
mov cl, byte [esi + 0x1acd]
lea edx, [esi + 0x1a8d]
mov eax, dword [esi + 0xa60]
call fcn.00402910
mov eax, esi
call fcn.00482330
mov edi, ebx
and edi, 0xff
dec edi
test di, di
jb 0x48259d
inc edi
xor eax, eax
movzx edx, ax
mov ecx, edx
add ecx, dword [esp + 4]
mov cl, byte [esi + ecx + 0xa8c]
xor cl, byte [esi + edx + 0x1a8d]
push ecx
mov ecx, dword [esp + 0xc]
add ecx, edx
pop edx
mov byte [ecx], dl
inc eax
dec di
jne 0x482576
mov al, byte [esi + 0x1acd]
cmp bl, al
jne 0x4825bc
xor ecx, ecx
mov cl, al
mov edx, dword [esi + 0xa60]
mov eax, dword [esp + 8]
call fcn.00402910
jmp 0x4825d2
xor eax, eax
mov al, bl
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0xa60]
mov eax, esi
call fcn.00481cd8
xor eax, eax
mov al, bl
sub dword [esp], eax
add dword [esp + 8], eax
add dword [esp + 4], eax
xor edx, edx
mov dl, byte [esi + 0x1acd]
mov ecx, dword [esp]
mov eax, esi
call fcn.00481ccc
mov ebx, eax
test bl, bl
ja 0x482545
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x482604
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
mov eax, dword [esi + 0xa88]
mov dword [esp], eax
xor edx, edx
mov dl, byte [esi + 0x1acd]
mov ecx, dword [esp]
mov eax, esi
call fcn.00481ccc
mov ebx, eax
mov eax, dword [esi + 0xa80]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
test bl, bl
jbe 0x482707
xor ecx, ecx
mov cl, byte [esi + 0x1acd]
lea edx, [esi + 0x1a8d]
mov eax, dword [esi + 0xa60]
call fcn.00402910
mov eax, esi
call fcn.00482330
mov al, byte [esi + 0x1acd]
cmp bl, al
jne 0x482687
xor ecx, ecx
mov cl, al
mov edx, dword [esi + 0xa60]
mov eax, dword [esp + 4]
lea eax, [esi + eax + 0xa8c]
call fcn.00402910
jmp 0x4826a4
xor eax, eax
mov al, bl
push eax
mov eax, dword [esp + 8]
lea ecx, [esi + eax + 0xa8c]
mov edx, dword [esi + 0xa60]
mov eax, esi
call fcn.00481cd8
mov edi, ebx
and edi, 0xff
dec edi
test di, di
jb 0x4826dc
inc edi
xor eax, eax
movzx edx, ax
mov ecx, edx
add ecx, dword [esp + 4]
mov cl, byte [esi + ecx + 0xa8c]
xor cl, byte [esi + edx + 0x1a8d]
push ecx
mov ecx, dword [esp + 0xc]
add ecx, edx
pop edx
mov byte [ecx], dl
inc eax
dec di
jne 0x4826b5
xor eax, eax
mov al, bl
sub dword [esp], eax
add dword [esp + 4], eax
add dword [esp + 8], eax
xor edx, edx
mov dl, byte [esi + 0x1acd]
mov ecx, dword [esp]
mov eax, esi
call fcn.00481ccc
mov ebx, eax
test bl, bl
ja 0x482641
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x482828
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov eax, dword [ebx + 0xa80]
mov dword [esp], eax
xor esi, esi
jmp 0x482849
mov byte [ebx + ecx + 0xa8c], 0
inc dword [ebx + 0xa88]
xor eax, eax
mov al, byte [ebx + 0x1acd]
push eax
mov ecx, dword [ebx + 0xa88]
mov eax, ecx
pop edx
mov edi, edx
cdq
idiv edi
test edx, edx
jne 0x48283b
xor ecx, ecx
mov cl, byte [ebx + 0x1acd]
lea edx, [ebx + 0x1a8d]
lea eax, [ebx + esi + 0xa8c]
call fcn.00402910
xor edx, edx
mov dl, byte [ebx + 0x1acd]
dec edx
test dx, dx
jb 0x4828a8
inc edx
xor eax, eax
movzx edi, ax
mov ecx, dword [ebx + 0xa60]
mov cl, byte [ecx + edi]
xor byte [ebx + edi + 0x1a8d], cl
inc eax
dec dx
jne 0x48288f
mov eax, ebx
call fcn.00482330
xor ecx, ecx
mov cl, byte [ebx + 0x1acd]
mov edx, dword [ebx + 0xa60]
lea eax, [ebx + 0x1a8d]
call fcn.00402910
mov eax, dword [esp]
lea edx, [eax + esi]
xor ecx, ecx
mov cl, byte [ebx + 0x1acd]
lea eax, [ebx + 0x1a8d]
call fcn.00402910
xor eax, eax
mov al, byte [ebx + 0x1acd]
add esi, eax
cmp esi, dword [ebx + 0xa88]
jne 0x482864
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4828fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov eax, dword [ebx + 0xa80]
mov dword [esp], eax
xor esi, esi
jmp 0x48291d
mov byte [ebx + ecx + 0xa8c], 0
inc dword [ebx + 0xa88]
xor eax, eax
mov al, byte [ebx + 0x1acd]
push eax
mov ecx, dword [ebx + 0xa88]
mov eax, ecx
pop edx
mov edi, edx
cdq
idiv edi
test edx, edx
jne 0x48290f
xor ecx, ecx
mov cl, byte [ebx + 0x1acd]
lea edx, [ebx + 0x1a8d]
lea eax, [ebx + esi + 0xa8c]
call fcn.00402910
mov eax, ebx
call fcn.004824c0
xor edx, edx
mov dl, byte [ebx + 0x1acd]
dec edx
test dx, dx
jb 0x482983
inc edx
xor eax, eax
movzx edi, ax
mov ecx, dword [ebx + 0xa60]
mov cl, byte [ecx + edi]
xor byte [ebx + edi + 0x1a8d], cl
inc eax
dec dx
jne 0x48296a
xor ecx, ecx
mov cl, byte [ebx + 0x1acd]
mov edx, dword [ebx + 0xa60]
lea eax, [ebx + esi + 0xa8c]
call fcn.00402910
mov eax, dword [esp]
lea edx, [eax + esi]
xor ecx, ecx
mov cl, byte [ebx + 0x1acd]
lea eax, [ebx + 0x1a8d]
call fcn.00402910
xor eax, eax
mov al, byte [ebx + 0x1acd]
add esi, eax
cmp esi, dword [ebx + 0xa88]
jne 0x482938
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4888d4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x488902
mov eax, ebx
call fcn.00489388
cmp dword [ebx + 0x40], 0
je 0x4888fb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x488973
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x488965
cmp dword [ebx + 8], 0
je 0x488924
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x488936
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x488965
cmp dword [ebx + 8], 0
je 0x488917
cmp eax, 3
je 0x488949
dec eax
jne 0x488917
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x488917
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x488917
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x488991
cmp dword [ebx + 0x14], 0xcc
je 0x488991
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048899c
pop ebx
ret
Function at 0x49daf4
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x4bbc58]
call fcn.00463870
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4a0c00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x100]
call fcn.004092a4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a3718
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x4bbca4]
mov eax, dword [eax + 0x2fc]
xor edx, edx
call fcn.0045d0b8
mov eax, dword [0x4bace8]
mov eax, dword [eax]
call fcn.004798e4
mov eax, dword [0x4bbca4]
call fcn.004798e4
xor edx, edx
mov eax, dword [0x4bbca4]
call fcn.004a3bb4
push 0
mov eax, dword [0x4bb668]
push eax
push 0x4a3608
push 0xd
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4ba8fc], eax
mov eax, dword [0x4bbca4]
mov eax, dword [eax + 0x2fc]
mov edx, dword [eax]
call dword [edx + 0xc4]
mov eax, dword [0x4bbca4]
mov eax, dword [eax + 0x308]
mov dl, 1
call fcn.00433448
mov eax, dword [0x4bac54]
mov eax, dword [eax]
xor edx, edx
call fcn.004763d0
ret

Function at 0x4a398c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4a3a90
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x4ba8f4], eax
push 0
push 0x4a367c
call sub.user32.dll_EnumWindows
mov esi, dword [0x4ba8f4]
dec esi
test esi, esi
jl 0x4a3a7a
inc esi
mov ebx, 0x4bbca8
mov eax, dword [ebx]
cdq
push edx
push eax
mov eax, dword [0x4bad68]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4a39e3
cmp eax, dword [esp]
pop edx
pop eax
je 0x4a3a70
mov eax, dword [0x4bac54]
mov eax, dword [eax]
call fcn.00463870
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x4a3a07
cmp eax, dword [esp]
pop edx
pop eax
je 0x4a3a70
mov eax, dword [0x4bbca4]
call fcn.00463870
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x4a3a25
cmp eax, dword [esp]
pop edx
pop eax
je 0x4a3a70
mov eax, dword [0x4bace8]
mov eax, dword [eax]
call fcn.00463870
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x4a3a45
cmp eax, dword [esp]
pop edx
pop eax
je 0x4a3a70
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.00408764
mov edx, dword [ebp - 4]
mov eax, dword [0x4ba9f4]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x4a3a70
push 0xffffffffffffffff
mov eax, dword [ebx]
push eax
call sub.user32.dll_EnableWindow
add ebx, 4
dec esi
jne 0x4a39c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3a97
lea eax, [ebp - 4]
call fcn.004041ac
ret
Function at 0x4a3a9c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4a3ba7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x4ba8f4], eax
push 0
push 0x4a367c
call sub.user32.dll_EnumWindows
mov esi, dword [0x4ba8f4]
dec esi
test esi, esi
jl 0x4a3b8a
inc esi
mov ebx, 0x4bbca8
mov eax, dword [ebx]
cdq
push edx
push eax
mov eax, dword [0x4bad68]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4a3af3
cmp eax, dword [esp]
pop edx
pop eax
je 0x4a3b80
mov eax, dword [0x4bac54]
mov eax, dword [eax]
call fcn.00463870
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x4a3b17
cmp eax, dword [esp]
pop edx
pop eax
je 0x4a3b80
mov eax, dword [0x4bbca4]
call fcn.00463870
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x4a3b35
cmp eax, dword [esp]
pop edx
pop eax
je 0x4a3b80
mov eax, dword [0x4bace8]
mov eax, dword [eax]
call fcn.00463870
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x4a3b55
cmp eax, dword [esp]
pop edx
pop eax
je 0x4a3b80
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.00408764
mov edx, dword [ebp - 4]
mov eax, dword [0x4ba9f4]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x4a3b80
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_EnableWindow
add ebx, 4
dec esi
jne 0x4a3ad9
xor eax, eax
mov dword [0x4ba8f8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3bae
lea eax, [ebp - 4]
call fcn.004041ac
ret

Function at 0x4a3bb4
Capabilities:
Hide graphical window

Disassembly:
push ecx
push 0
push 0x4a3c04
call sub.user32.dll_FindWindowA
push 0
push eax
call sub.user32.dll_ShowWindow
push 0
push 0x4a3c0c
call sub.user32.dll_FindWindowA
push 0
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
mov dword [esp], eax
push 0
lea eax, [esp + 4]
push eax
push 1
push 0x24
call sub.user32.dll_SystemParametersInfoA
push 0
lea eax, [esp + 4]
push eax
push 1
push 0x61
call sub.user32.dll_SystemParametersInfoA
pop edx
ret

Function at 0x4a3c1c
Capabilities:
Hide graphical window

Disassembly:
push ecx
push 0
push 0x4a3c78
call sub.user32.dll_FindWindowA
push 9
push eax
call sub.user32.dll_ShowWindow
push 0
push 0x4a3c80
call sub.user32.dll_FindWindowA
push 9
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4bbca4]
call fcn.004798dc
xor eax, eax
mov dword [esp], eax
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x24
call sub.user32.dll_SystemParametersInfoA
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x61
call sub.user32.dll_SystemParametersInfoA
pop edx
ret
Function at 0x4a5634
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push esi
xor esi, esi
lea ecx, [ebp - 0x400]
mov eax, esi
mov edx, 8
test eax, 1
jbe 0x4a565e
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a5660
shr eax, 1
dec edx
jne 0x4a564d
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a5646
mov eax, 8
mov edx, dword [ebp + 0xc]
dec edx
test edx, edx
jl 0x4a56a6
inc edx
xor esi, esi
mov ecx, dword [ebp + 8]
mov cl, byte [ecx + esi]
xor cl, al
and ecx, 0xff
mov ecx, dword [ebp + ecx*4 - 0x400]
shr eax, 8
and eax, 0xffffff
xor ecx, eax
mov eax, ecx
inc esi
dec edx
jne 0x4a5681
not eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4a7e08
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], eax
xor eax, eax
push ebp
push 0x4a7efd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00463870
push eax
call sub.user32.dll_GetWindow
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x4a7ebe
push 0xff
lea eax, [ebp - 0xff]
push eax
push esi
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4a7eb0
lea edx, [ebp - 0x104]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0045d088
mov eax, dword [ebp - 0x104]
push eax
lea edx, [ebp - 0x108]
lea eax, [ebp - 0xff]
call fcn.004092a4
mov edx, dword [ebp - 0x108]
pop eax
call fcn.004045d4
jne 0x4a7ea6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00463870
cmp esi, eax
jne 0x4a7eaa
xor ebx, ebx
jmp 0x4a7eac
mov bl, 1
test bl, bl
jne 0x4a7ebe
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x4a7e4a
xor bl, 1
test bl, bl
je 0x4a7ed9
call fcn.00402b00
mov eax, 3
call fcn.00402db0
test eax, eax
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7f04
lea eax, [ebp - 0x108]
call fcn.004041ac
lea eax, [ebp - 0x104]
call fcn.004041ac
ret