joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a2cc
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x42a218
call sub.user32.dll_EnumWindows
ret

Function at 0x42a3ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42a469
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00429e4c
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42a411
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00429a4c
cmp dword [ebp - 4], 0
je 0x42a453
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404a24
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a470
lea eax, [ebp - 4]
call fcn.00404564
ret

Function at 0x42d10c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x468ff4], 0
je 0x42d25b
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x46726c]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42d25b
mov eax, dword [0x468ff8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x468ff4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42d22a
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x468ff4]
call fcn.00416c5c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42d222
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42d222
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42d222
mov eax, dword [ebp - 0x14]
call fcn.00435c70
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42d222
push ebp
call fcn.0042d0c8
pop ecx
test al, al
jne 0x42d222
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42d1de
mov eax, dword [ebp - 0x14]
call fcn.004347a0
dec eax
jle 0x42d222
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004039ac
cmp byte [ebp - 1], 0
je 0x42d222
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42d222
mov edx, dword [ebp - 0x14]
mov eax, dword [0x468ff8]
call fcn.0042c894
inc edi
dec ebx
jne 0x42d171
mov eax, dword [0x468ff8]
cmp dword [eax + 8], 0
jle 0x42d242
mov eax, dword [0x468ff8]
call fcn.0042c924
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42d25b
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042cf30
pop ecx
test al, al
jne 0x42d25b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4307f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x430840
mov eax, esi
call fcn.00445c10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x430840
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x430840
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x43097f
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x430880
cmp eax, 0x108
ja 0x430880
mov eax, esi
call fcn.00445c10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x430976
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x43097f
jmp 0x430976
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x43095f
cmp eax, 0x20a
ja 0x43095f
test byte [esi + 0x50], 0x80
jne 0x4308b2
sub eax, 0x203
je 0x4308af
sub eax, 3
je 0x4308af
sub eax, 3
jne 0x4308b2
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x4308c6
dec eax
je 0x4308db
dec eax
je 0x4308f8
dec eax
je 0x4308db
jmp 0x4308ff
mov ecx, ebx
mov eax, dword [0x46726c]
mov eax, dword [eax]
mov edx, esi
call fcn.0044f238
jmp 0x430976
cmp byte [esi + 0x5d], 1
jne 0x4308f1
mov eax, esi
mov si, 0xffed
call fcn.004039ac
jmp 0x43097f
or word [esi + 0x54], 1
jmp 0x430976
and word [esi + 0x54], 0xfffe
jmp 0x430976
mov eax, dword [0x468fb0]
cmp byte [eax + 0x20], 0
je 0x430976
mov eax, dword [0x468fb0]
cmp dword [eax + 0x1c], 0
je 0x430976
mov eax, dword [ebx]
mov edx, dword [0x468fb0]
cmp eax, dword [edx + 0x1c]
jne 0x430976
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00445b54
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004039ac
jmp 0x43097f
cmp eax, 0xb00b
jne 0x430976
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042f15c
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433e00
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x433e1c
cmp dword [esi + 4], 0
je 0x433e49
test byte [ebx + 0x55], 1
jne 0x433e3b
mov eax, ebx
call fcn.00432a0c
test eax, eax
jne 0x433e3b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x433f59
mov edx, esi
mov eax, ebx
call fcn.00433924
jmp 0x433f59
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
invalid
Function at 0x44d864
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x469050]
cmp dword [eax + 0x30], 0
je 0x44d90e
cmp dword [ebx + 0x94], 0
jne 0x44d908
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44d7f4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44d908
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44d8ce
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44d908
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00416c5c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44d8dd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44e470
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44e4a5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404654
jmp 0x44e4b2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004045b8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44f380
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44f3c1
mov eax, esi
call fcn.00435ed0
test al, al
je 0x44f3c1
mov eax, dword [ebx + 0x84]
call fcn.00435c70
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44f3c1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00435c70
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x450cec
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x450cf4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
xor eax, eax
push ebp
push 0x451afc
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00450734
mov eax, dword [ebp - 8]
call fcn.00404564
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x4690b4
mov edx, 0x451b10
call fcn.004045b8
mov eax, dword [ebp - 4]
call fcn.00404824
cmp eax, 0x7f
jge 0x450d71
push 0
push 0x469180
mov eax, dword [ebp - 4]
call fcn.00404a24
push eax
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404a24
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x46912c], eax
cmp dword [0x46912c], 0xffffffff
jne 0x450da6
mov dword [ebp - 0xc], 2

Function at 0x451319
Capabilities:
Read file on windows

Disassembly:
ror byte [edi], 0x84
add al, byte ss:[eax]
add bh, bh
xor eax, 0x46915c

Function at 0x451818
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x46920c]
mov edx, dword [0x469140]
mov al, byte [eax + edx]
and eax, 0xff
bt dword [0x466e80], eax
jae 0x45183f
inc byte [0x469209]
jmp 0x4519b4
mov byte [0x469209], 0
jmp 0x4519b4
Function at 0x4528b0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x31
push 0
push 0
dec ecx
jne 0x4528b8
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
xor eax, eax
push ebp
push 0x452ecb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4690b4
mov edx, 0x452ee0
call fcn.004045b8
call fcn.00450734
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x452f94
mov edx, dword [ebp - 4]
call fcn.00404870
mov eax, dword [ebp - 0x15c]
call fcn.00404a24
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x452e80

Function at 0x4532a0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453592
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4690b4
mov edx, 0x4535a8
call fcn.004045b8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x453577
mov dword [ebp - 0x10], 0x7e0
mov eax, 0x4690b4
mov edx, 0x4535e4
call fcn.004045b8
mov eax, dword [ebp - 0x10]
call fcn.00402714
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0040308c
mov dword [ebp - 0xc], 0x3f
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
invalid

Function at 0x45335f
Capabilities:
Enumerate network shares

Disassembly:
add byte [ebp - 0x74af0fbb], cl
inc ebp
in al, 0x50
sar byte [esi + eax*8 + 0x40], 0x89
inc ebp
loopne 0x45332e
inc ebp
in al, dx
add byte [eax], al
add byte [eax], al

Function at 0x453e94
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x43
push 0
push 0
dec ecx
jne 0x453e9c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4544d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4690b4
mov edx, 0x4544ec
call fcn.004045b8
call fcn.00460070
cmp byte [0x466f14], 0
jne 0x453ef2
lea eax, [ebp - 0x1b4]
mov ecx, dword [0x469128]
mov edx, 0x454518
call fcn.00404870
mov eax, dword [ebp - 0x1b4]
call fcn.0045a4c4
mov byte [ebp - 9], 0
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, 0x4690b4
mov edx, 0x45452c
call fcn.004045b8
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
mov word [ebp - 0x1b0], 2
push 0x19
call sub.wsock32.dll_htons
mov word [ebp - 0x1ae], ax
lea edx, [ebp - 0x1b8]
mov eax, dword [0x469118]
call fcn.00408948
mov edx, dword [ebp - 0x1b8]
mov eax, 0x46911c
call fcn.004045b8
invalid
Function at 0x454c70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4690b4
mov edx, 0x454d08
call fcn.004045b8
push 0
push 0
mov eax, dword [0x469338]
call fcn.00404a24
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x4690b4
mov edx, 0x454d60
call fcn.004045b8
push 0
push 0
mov eax, dword [0x46933c]
call fcn.00404a24
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x4690b4
mov edx, 0x454dc0
call fcn.004045b8
push 0
push 0
mov eax, dword [0x469340]
call fcn.00404a24
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x4690b4
mov edx, 0x454e38
call fcn.004045b8
pop ebp
ret
Function at 0x456b84
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x456e0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402a48
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00407a50
mov edx, dword [ebp - 0x10]
mov eax, 0x469088
call fcn.004045b8
mov eax, 0x4690b4
mov edx, 0x456e20
call fcn.004045b8
cmp byte [0x4690f5], 0
jne 0x456bf6
mov eax, dword [0x469088]
push eax
mov ecx, dword [0x469234]
mov edx, dword [0x469260]
mov eax, 0x80000002
call fcn.004092dc
mov eax, 0x4690b4
mov edx, 0x456e64
call fcn.004045b8
cmp byte [0x4690f5], 0
je 0x456c18
call fcn.004574c4
jmp 0x456df0
mov eax, 0x4690b4
mov edx, 0x456f14
call fcn.004045b8
xor eax, eax
mov dword [ebp - 4], eax
push 0
mov eax, dword [0x46936c]
call fcn.00404a24
push eax
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x456c53
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x456c2c
mov eax, 0x4690b4
mov edx, 0x456fec
call fcn.004045b8
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x457024
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
mov eax, 0x4690b4
mov edx, 0x457034
call fcn.004045b8
mov eax, dword [0x469248]
call fcn.00404a24
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x456cbc
mov eax, dword [0x469250]
call fcn.00404a24
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x456da9
mov eax, 0x4690b4
mov edx, 0x4570f8
call fcn.004045b8
mov eax, dword [0x469370]
call fcn.00404a24
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
mov eax, 0x4690b4
mov edx, 0x4571a4
call fcn.004045b8
cmp dword [ebp - 0xc], 0
je 0x456da9
call dword [ebp - 0xc]
mov eax, 0x4690b4
mov edx, 0x457248
call fcn.004045b8
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x4690b4
mov edx, 0x45726c
call fcn.004045b8
push 0x1f4
call sub.kernel32.dll_Sleep
cli
jmp [edx]
push 0xd
push 0x101
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x4690b4
mov edx, 0x457340
call fcn.004045b8
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x4573b8
call fcn.00409814
mov eax, 0x4690b4
mov edx, 0x4573c8
call fcn.004045b8
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, 0x4690b4
mov edx, 0x457428
call fcn.004045b8
mov eax, dword [0x46925c]
call fcn.00404a24
mov edx, eax
mov eax, 0x469108
mov ecx, 0xbb8
call fcn.00409000
test al, al
je 0x456df0
mov eax, 0x4690b4
mov edx, 0x45745c
call fcn.004045b8
call fcn.004574c4
mov eax, 0x4690b4
mov edx, 0x4574a8
call fcn.004045b8
call fcn.0045a7dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456e12
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404588
ret
Function at 0x4579da
Capabilities:
Get disk information
Write file on windows

Disassembly:
push 0x96
push 0x7a120
lea eax, [ebp - 0x48]
mov ecx, dword [0x469238]
mov edx, dword [0x46907c]
call fcn.00404870
mov edx, dword [ebp - 0x48]
mov cl, 1
mov eax, dword [0x469088]
call fcn.00407e84
mov byte [0x4690f7], al
lea eax, [ebp - 0x4c]
mov ecx, dword [0x469238]
mov edx, dword [0x46907c]
call fcn.00404870
mov eax, dword [ebp - 0x4c]
call fcn.0040907c
mov byte [0x4690f7], al
mov eax, 0x4690b4
mov edx, 0x4593d8
call fcn.004045b8
mov eax, dword [0x4672a4]
push eax
mov ecx, dword [0x469218]
mov edx, dword [0x469260]
mov eax, 0x80000002
call fcn.00409148
mov dword [0x4690ec], eax
cmp dword [0x4690ec], 0x9c
jge 0x457b77
cmp byte [0x4690f7], 0
jne 0x457ad7
lea eax, [ebp - 0x50]
mov ecx, dword [0x469238]
mov edx, dword [0x46907c]
call fcn.00404870
mov edx, dword [ebp - 0x50]
mov eax, dword [0x469088]
call fcn.00404970
je 0x457ad7
mov eax, dword [0x469238]
call fcn.004082dc
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x54]
mov ecx, dword [0x469238]
mov edx, dword [0x46907c]
call fcn.00404870
mov edx, dword [ebp - 0x54]
mov cl, 1
mov eax, dword [0x469088]
call fcn.00407e84
mov byte [0x4690f7], al
mov eax, 0x4690b4
mov edx, 0x45943c
call fcn.004045b8
cmp byte [0x4690f7], 0
je 0x457b77
push 0x9c
mov ecx, dword [0x469218]
mov edx, dword [0x469260]
mov eax, 0x80000002
call fcn.004093d0
mov byte [0x4690f7], al
cmp dword [0x4690ec], 0
jle 0x457b3d
lea edx, [ebp - 0x58]
mov eax, dword [0x4690ec]
call fcn.0040799c
mov ecx, dword [ebp - 0x58]
mov eax, 0x469084
mov edx, 0x4594f4
call fcn.00404870
jmp 0x457b47
mov eax, 0x469084
call fcn.00404564
push 0x459504
lea edx, [ebp - 0x60]
mov eax, 0x9c
call fcn.0040799c
push dword [ebp - 0x60]
push dword [0x469084]
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.004048e4
mov eax, dword [ebp - 0x5c]
call fcn.0045a4c4
mov eax, 0x4690b4
mov edx, 0x459518
call fcn.004045b8
call fcn.004567d0
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x64]
mov ecx, dword [0x46923c]
mov edx, dword [0x46907c]
call fcn.00404870
mov edx, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [0x469088]
call fcn.00407e84
mov byte [0x4690f7], al
lea eax, [ebp - 0x68]
mov ecx, dword [0x46923c]
mov edx, dword [0x46907c]
call fcn.00404870
mov eax, dword [ebp - 0x68]
call fcn.0040907c
mov byte [0x4690f7], al
mov eax, 0x4690b4
mov edx, 0x4595d4
call fcn.004045b8
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x6c]
mov ecx, dword [0x469240]
mov edx, dword [0x46907c]
call fcn.00404870
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x469088]
call fcn.00407e84
mov byte [0x4690f7], al
lea eax, [ebp - 0x70]
mov ecx, dword [0x469240]
mov edx, dword [0x46907c]
call fcn.00404870
mov eax, dword [ebp - 0x70]
invalid
invalid
invalid

Function at 0x45a4bc
Capabilities:
Write file on windows

Disassembly:
lea eax, [esp + ebx]
sar byte [edi], cl
and ebp, dword [esi]
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
Function at 0x45a4c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
xor eax, eax
push ebp
push 0x45a5ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4690b4
mov edx, 0x45a5e0
call fcn.004045b8
cmp dword [0x4690fc], 0
jne 0x45a505
call fcn.0045a2d4
push 2
push 0
push 0
mov eax, dword [0x4690fc]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x45a520
call fcn.0045a2d4
mov eax, 0x4690b4
mov edx, 0x45a650
call fcn.004045b8
lea edx, [ebp - 0xc]
mov al, byte [0x4690f6]
call fcn.00407abc
push dword [ebp - 0xc]
push 0x45a6a8
push dword [ebp - 4]
push 0x45a6b4
lea eax, [ebp - 4]
mov edx, 4
call fcn.004048e4
mov eax, 0x4690b4
mov edx, 0x45a6c0
call fcn.004045b8
mov al, byte [0x5c6fffa]
not byte [eax + 0x6a000046]
add byte [ebp - 0x74af07bb], cl
inc ebp
cld
call fcn.00404824
push eax
lea eax, [ebp - 4]
call fcn.00404a7c
push eax
mov eax, dword [0x4690fc]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x45a59d
mov dword [ebp - 8], 0xffffffff
mov eax, 0x4690b4
mov edx, 0x45a750
call fcn.004045b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a5d1
lea eax, [ebp - 0xc]
call fcn.00404564
lea eax, [ebp - 4]
call fcn.00404564
ret

Function at 0x45a565
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
xor eax, eax
push ebp
push 0x45a5ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4690b4
mov edx, 0x45a5e0
call fcn.004045b8
cmp dword [0x4690fc], 0
jne 0x45a505
call fcn.0045a2d4
push 2
push 0
push 0
mov eax, dword [0x4690fc]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x45a520
call fcn.0045a2d4
mov eax, 0x4690b4
mov edx, 0x45a650
call fcn.004045b8
lea edx, [ebp - 0xc]
mov al, byte [0x4690f6]
call fcn.00407abc
push dword [ebp - 0xc]
push 0x45a6a8
push dword [ebp - 4]
push 0x45a6b4
lea eax, [ebp - 4]
mov edx, 4
call fcn.004048e4
mov eax, 0x4690b4
mov edx, 0x45a6c0
call fcn.004045b8
mov al, byte [0x5c6fffa]
not byte [eax + 0x6a000046]
add byte [ebp - 0x74af07bb], cl
inc ebp
cld
call fcn.00404824
push eax
lea eax, [ebp - 4]
call fcn.00404a7c
push eax
mov eax, dword [0x4690fc]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x45a59d
mov dword [ebp - 8], 0xffffffff
mov eax, 0x4690b4
mov edx, 0x45a750
call fcn.004045b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a5d1
lea eax, [ebp - 0xc]
call fcn.00404564
lea eax, [ebp - 4]
call fcn.00404564
ret
Function at 0x462740
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4670c0]
cmp byte [eax], 0
jne 0x462783
push 0x462788
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x462772
push 0x4627a0
push 0
call sub.user32.dll_FindWindowA