joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a9b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x45a9e3
push esi
call fcn.00468d50
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45a9dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x45aa69
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45aa52
mov eax, dword [esi + 8]
test eax, eax
je 0x45aa07
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45aa4e
cmp eax, 2
je 0x45aa52
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45a9fa
cmp eax, 3
je 0x45aa2d
cmp eax, 1
jne 0x45a9fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45a9fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45a9fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0045aa90
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45aa78
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0045aa90
add esp, 4
pop esi
ret

Function at 0x45b300
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x45b321
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x45b321
mov eax, dword [eax + 0x44]
test eax, eax
je 0x45b321
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x478800
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4e8e4c]
xor edx, edx
cmp eax, edx
jne 0x478826
xor eax, eax
mov byte [eax + 0x4e8d4c], al
inc eax
cmp eax, 0x100
jl 0x47880e
mov dword [0x4e8e4c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4e8d4c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4788b7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x47888a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x478858
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4788c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x478913
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4788fa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47f290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ab8ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0047fbb0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4b5be4
call fcn.0049d4d3
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x47f323
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0049d4d3
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x47f31c
push 0
mov ecx, eax
call fcn.00476430
mov dword [esi + 0xc], eax
jmp 0x47f325
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x47f325
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x49fb36
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49fb6e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049dbed
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049dbc5
jmp 0x49fb7a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a1227
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a1269
call fcn.004a6cdb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a1269
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a1260
xor eax, eax
jmp 0x4a1271
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a1277
pop edi
pop esi
pop ebx
ret 4
Function at 0x4a720b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a7239
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a7257
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a7171
jmp 0x4a7257
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a7257
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a7171
test edi, edi
mov eax, edi
jne 0x4a7241
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10011140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10043a41
call fcn.1001f59e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100111a1
call fcn.1000e50a
mov esi, eax
jmp 0x10011279
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100111bf
call fcn.1000e50a
jmp 0x10011270
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x100111b5
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100111f2
mov esi, 0x8007000e
jmp 0x10011272
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10033f11
mov dword [ebp - 4], 1
jmp 0x10011226
cmp dword [ebp - 0x418], 0
je 0x100111e8
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100111b5
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.10033f11
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10011292
lea ecx, [ebp - 0x418]
call fcn.10011348
mov eax, esi
call fcn.1001f5f7
ret 0x10
Function at 0x1001f1ed
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x100463b8
call fcn.10021546
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1001f27b
call fcn.10021514
test eax, eax
jne 0x1001f211
xor eax, eax
jmp 0x1001f347
call fcn.10020948
test eax, eax
jne 0x1001f221
call fcn.10021532
jmp 0x1001f20a
call fcn.100214c8
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10193274], eax
call fcn.10033f11
mov dword [0x101913dc], eax
call fcn.10033f11
test eax, eax
jns 0x1001f24b
call fcn.10020621
jmp 0x1001f21a
call fcn.10033f11
test eax, eax
js 0x1001f274
call fcn.10021100
test eax, eax
js 0x1001f274
push 0
call fcn.10033f11
pop ecx
test eax, eax
jne 0x1001f274
inc dword [0x101913d8]
jmp 0x1001f344
call fcn.100210ad
jmp 0x1001f244
xor edi, edi
cmp eax, edi
jne 0x1001f2da
cmp dword [0x101913d8], edi
jle 0x1001f20a
dec dword [0x101913d8]
mov dword [ebp - 4], edi
cmp dword [0x10191744], edi
jne 0x1001f29f
call fcn.10020e3b
cmp dword [ebp + 0x10], edi
jne 0x1001f2b3
call fcn.100210ad
call fcn.10020621
call fcn.10021532
mov dword [ebp - 4], 0xfffffffe
call fcn.1001f2c6
jmp 0x1001f344
cmp eax, 2
jne 0x1001f338
call fcn.100205ed
push 0x214
push 1
call fcn.10033f11
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x1001f20a
push esi
push dword [0x1004a940]
push dword [0x10191724]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x1001f32c
push edi
push esi
call fcn.10020662
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x1001f344
push esi
call fcn.10033f11
pop ecx
jmp 0x1001f20a
cmp eax, 3
jne 0x1001f344
push edi
call fcn.10033f11
pop ecx
xor eax, eax
inc eax
call fcn.1002158b
ret 0xc

Function at 0x1001f4a5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004a900]
jne 0x1001fc43
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10191500], eax
mov dword [0x101914fc], ecx
mov dword [0x101914f8], edx
mov dword [0x101914f4], ebx
mov dword [0x101914f0], esi
mov dword [0x101914ec], edi
mov word [0x10191518], ss
mov word [0x1019150c], cs
mov word [0x101914e8], ds
mov word [0x101914e4], es
mov word [0x101914e0], fs
mov word [0x101914dc], gs
pushfd
pop dword [0x10191510]
mov eax, dword [ebp]
mov dword [0x10191504], eax
mov eax, dword [ebp + 4]
mov dword [0x10191508], eax
lea eax, [ebp + 8]
mov dword [0x10191514], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10191450], 0x10001
mov eax, dword [0x10191508]
mov dword [0x10191404], eax
mov dword [0x101913f8], 0xc0000409
mov dword [0x101913fc], 1
mov eax, dword [0x1004a900]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1004a904]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10191448], eax
push 1
call fcn.10022bfb
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10003a64
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10191448], 0
jne 0x1001fd2f
push 1
call fcn.10022bfb
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10033620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x34], ebx
je 0x10033636
push dword [esi + 0x34]
call fcn.10033f11
mov dword [esi + 0x34], ebx
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10033646
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x44], ebx
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10033656
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x48], ebx
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10033666
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x50], ebx
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x10033676
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x4c], ebx
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x10033686
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x54], ebx
push edi
push 7
lea edi, [esi + 0x58]
pop ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x1003369c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [edi], 0
add edi, 4
dec ebx
jne 0x1003368d
mov ecx, dword [esi + 0x7c]
pop edi
test ecx, ecx
je 0x100336b5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x7c], ebx
jmp 0x100336b7
xor ebx, ebx
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x100336c7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x78], ebx
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x100336d7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x25c], ebx
mov dword [esi + 0x264], ebx
cmp dword [esi + 0x260], ebx
je 0x100336f1
mov dword [esi + 0x260], ebx
mov eax, dword [esi + 0x2d4]
test eax, eax
je 0x10033708
push eax
call fcn.10033f11
pop ecx
mov dword [esi + 0x2d4], ebx
mov eax, dword [esi + 0x150]
test eax, eax
je 0x1003371f
push eax
call fcn.10033f11
pop ecx
mov dword [esi + 0x150], ebx
mov ecx, esi
pop esi
pop ebx

Function at 0x10033f11
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10033f20
pop dword [ebp - 0x2c]
mov eax, 0x4c7af37a
sub eax, 0x3c77b45a
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x41cb3
push 0
mov eax, 0x508e6e05
sub eax, 0x408e5c85
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x159fa4d4
add ecx, 0xea60a702
mov edx, eax
mov ebx, 0x721b9013
add ebx, 0x9dfe67ed
add ebx, dword [ebp - 0x2c]
mov esi, 0xb8ea0311
add dword [ebp - 0x18], 0xb38bf251
mov edi, dword [ebx]
xor dword [ebp - 0x10], esi
sub edi, esi
xor dword [ebp - 0x14], ecx
mov dword [edx], edi
mov dword [ebp - 4], 0x2bf9fe7c
add edx, 0xbd66f9fc
add edx, 0x42990608
add ebx, 4
loop 0x10033f79
add eax, 0x1222b
xor ebx, ebx
add ebx, eax
add eax, 0x880096d5
add eax, 0x77ff6930
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x403424
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4d8008], 0x8088405
inc edx
mov dword [ebx + 0x4d8008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4040d8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40415f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x104]
mov eax, ebx
call fcn.004040c4
lea edx, [ebp - 0x104]
lea eax, [ebp - 4]
call fcn.00405328
mov eax, esi
call fcn.00405384
push eax
mov eax, esi
call fcn.00405554
push eax
mov eax, dword [ebp - 4]
call fcn.00405384
push eax
mov eax, dword [ebp - 4]
call fcn.00405554
push eax
push 1
push 0x800
call sub.user32.dll_SetClipboardData
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404166
lea eax, [ebp - 4]
call fcn.004050c4
ret

Function at 0x4099c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x409a16
test eax, edx
je 0x409a19
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4099d9
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4099ff
add ecx, 4
js 0x4099ef
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4099fc
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x409a25
test edx, edx
jne 0x4099cc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40e128
Capabilities:
Get keyboard layout

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40dfa0
mov eax, dword [0x4ddbe4]
cmp byte [eax], 0
je 0x40e1a4
mov eax, dword [0x4dd83c]
call fcn.00403828
call fcn.0040310c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00407c08
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040a8dc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call fcn.004077e8
push eax
call fcn.00407940
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40e1ec
push 0xfffffffffffffff4
call fcn.004077e8
push eax
call fcn.00407940
jmp 0x40e1da
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
mov eax, dword [0x4dd7ac]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4e07f8]
call fcn.00406878
push eax
call sub.user32.dll_GetKeyboardLayout
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_GetLastActivePopup
add esp, 0x444
ret
Function at 0x40eac8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40eb9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040515c
lea eax, [ebp - 4]
call fcn.004055ac
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405554
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40eb88
mov eax, ebx
call fcn.00402fb0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40eb81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405554
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40eb6b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40ebb0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40eb6b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eb88
mov eax, dword [ebp - 0x10]
call fcn.00402fcc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eba5
lea eax, [ebp - 4]
call fcn.004050c4
ret

Function at 0x40fdd0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, eax
mov edx, esp
mov eax, dword [edi + 0x20]
call fcn.0040fb08
mov eax, dword [esp]
inc dword [eax + 0xc]
mov eax, dword [esp]
cmp dword [eax + 0xc], 1
seta bl
call fcn.00407780
cmp eax, dword [edi + 0x24]
je 0x40fe3a
test bl, bl
jne 0x40fe3a
mov eax, edi
call fcn.0040fcb4
jmp 0x40fe2e
lea eax, [edi + 0xc]
call fcn.0040fa6c
mov esi, eax
cmp esi, 0xffff
jne 0x40fe20
mov eax, edi
call fcn.0040fca8
push 0
call sub.KERNEL32.DLL_TlsSetValue
mov eax, edi
call fcn.0040fcb4
lea eax, [edi + 0xc]
call fcn.0040fa78
test eax, eax
jle 0x40fe07
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x427670
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x427676
ret

Function at 0x43f488
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
test dl, dl
je 0x43f49f
add esp, 0xfffffff0
call fcn.00404508
mov ebx, edx
mov esi, eax
push 0
xor edx, edx
mov eax, esi
call fcn.004630f4
mov dword [ebp - 0x154], 0x154
push 0
lea eax, [ebp - 0x154]
push eax
push 0
push 0x29
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x43f4e1
lea eax, [ebp - 0x3c]
push eax
call sub.gdi32.dll_CreateFontIndirectA
mov edx, eax
mov eax, dword [esi + 0x68]
call fcn.00428640
mov eax, esi
test bl, bl
je 0x43f4f6
call fcn.00404560
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f6c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43f883
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405848
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x43f89c
call fcn.004053dc
mov eax, ebx
call fcn.0042243c
mov edi, eax
dec edi
test edi, edi
jl 0x43f780
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00422410
mov edx, dword [0x433cf4]
call fcn.00404370
test al, al
je 0x43f77c
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.00422410
lea edx, [ebp - 0x14]
call fcn.0044e92c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405848
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405458
inc esi
dec edi
jne 0x43f72e
movzx eax, byte [0x43f8a0]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43f8ac
mov eax, dword [ebp - 8]
call fcn.0040f620
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0040515c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044e92c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43f89c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.0044e92c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43f89c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43f89c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43f8b8
call fcn.0040b3a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f88a
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004050e8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004050e8
lea eax, [ebp - 0x14]
call fcn.004050c4
lea eax, [ebp - 0x10]
call fcn.004050c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050e8
ret

Function at 0x4428d4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004050c4
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_GetKeyboardLayoutList
shl eax, 0x10
test eax, eax
je 0x442922
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_BeginPaint
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00405334
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444f8c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
mov dword [ebp - 0x154], 0x154
push 0
lea eax, [ebp - 0x154]
push eax
push 0
push 0x29
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x444fd1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xbc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xb8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret