joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f668
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44f752
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4cc798], bl
mov eax, 0x4cc79c
mov edx, esi
call fcn.00404824
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov dl, bl
mov eax, dword [0x44b490]
call fcn.00414490
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
call fcn.00402804
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.0040ae54
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x44f768
call fcn.0040c06c
mov eax, dword [ebp - 4]
call fcn.00404cac
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp dword [0x4cd038], 0
je 0x44f72f
add bl, 0xfb
sub bl, 5
jae 0x44f72f
push 0x242010
push 0x44f79c
mov eax, esi
call fcn.00404cac
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f759
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004047f4
lea eax, [ebp - 4]
call fcn.004047d0
ret

Function at 0x44fa84
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x44fa4c
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x44fb80
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x44fba2
mov dword [esp], eax
mov byte [esp + 4], 0
mov eax, esp
push eax
push 0x44faf0
call sub.user32.dll_EnumWindows
mov dl, byte [esp + 4]
mov eax, edx
pop ecx
pop edx
ret

Function at 0x44fc20
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, edx
mov dword [esp], eax
push 0
lea eax, [esp + 0x18]
push eax
xor ecx, ecx
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.00416970
lea esi, [esp + 0x14]
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, esp
push eax
push 0x44fba8
call sub.user32.dll_EnumWindows
mov edi, ebx
lea esi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x44fc7f
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.00416970
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x44fd04
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
test ebx, ebx
je 0x44fde2
mov eax, ebx
call fcn.00404aac
mov esi, eax
inc esi
push 0
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x44fddb
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44fdc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x44fda3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404cac
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.00402a48
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44fdaa
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x44fde8
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x44feaf
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x44fe84
cmp byte [0x4c6fe4], 0
je 0x44fe2d
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x5c]
call fcn.004049c8
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 4]
call fcn.00422ce4
jmp 0x44fe3c
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.004049c8
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.004031bc
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [0x4cc788]
call fcn.00404cac
push eax
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404cac
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44feb6
lea eax, [ebp - 0x5c]
call fcn.004047d0
lea eax, [ebp - 4]
call fcn.004047d0
ret
Function at 0x450048
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x4c85d4]
mov dl, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x44b554]
call fcn.0044febc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x450118
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0044ff34
test al, al
je 0x450102
cmp word [ebp - 4], 0x5a4d
jne 0x450102
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0041a4ac
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044ff34
test al, al
je 0x450102
cmp dword [ebp - 8], 0
je 0x450102
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0041a4ac
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044ff34
test al, al
je 0x450102
cmp dword [ebp - 0xc], 0x4550
jne 0x450102
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0044ff34
test al, al
je 0x450102
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45011f
mov eax, dword [ebp - 0x10]
call fcn.00403918
ret
Function at 0x450128
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4502bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x44b554]
call fcn.0044febc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4502a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0044ff34
test al, al
je 0x45028c
cmp word [ebp - 4], 0x5a4d
jne 0x45028c
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0041a4ac
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044ff34
test al, al
je 0x45028c
cmp dword [ebp - 8], 0
je 0x45028c
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0041a4ac
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044ff34
test al, al
je 0x45028c
cmp dword [ebp - 0xc], 0x4550
jne 0x45028c
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0044ff34
test al, al
je 0x450288
test byte [ebp - 0x15], 0x20
je 0x450288
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0044bdf8
mov eax, dword [ebp - 0x2c]
call fcn.00404cac
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x450281
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x4502d0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x450266
push 0xa
push 0x4502dc
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x450266
mov byte [ebp - 1], 2
jmp 0x45026a
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45028c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4502a9
mov eax, dword [ebp - 0x10]
call fcn.00403918
ret
Function at 0x4504f8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x450501
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45071b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004047d0
mov eax, esi
call fcn.004047d0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.00404cac
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x450700
mov eax, dword [ebp - 4]
call fcn.0040271c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4506f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.00404cac
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4506e0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x45072c
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45062a
push 0x450750
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.0040ae2c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0040ae2c
push dword [ebp - 0x24]
push 0x45076c
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404b6c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404cac
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45062a
cmp dword [ebp - 0xc], 1
jbe 0x45062a
mov eax, dword [ebp - 0x18]
call fcn.0040b97c
mov ecx, eax
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.004048c0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x450780
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4506e0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call fcn.00407818
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov di, word [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
call fcn.00407818
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0xc]
mov word [ebp - 0x10], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.0040ad18
push dword [ebp - 0x28]
push 0x45078c
lea edx, [ebp - 0x2c]
movzx eax, di
call fcn.0040ad18
push dword [ebp - 0x2c]
push 0x45078c
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0xe]
call fcn.0040ad18
push dword [ebp - 0x30]
push 0x45078c
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x10]
call fcn.0040ad18
push dword [ebp - 0x34]
mov eax, esi
mov edx, 7
call fcn.00404b6c
mov eax, dword [esi]
mov edx, 0x450798
call fcn.00404bf8
jne 0x4506e0
mov eax, esi
call fcn.004047d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450700
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0040273c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450722
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.004047f4
ret
Function at 0x450964
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4509c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404cac
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45099c
and ebx, 0xfffffffe
push ebx
push edi
call sub.kernel32.dll_SetFileAttributesA
mov edx, edi
lea eax, [ebp - 4]
call fcn.004049c8
mov eax, dword [ebp - 4]
call fcn.0040b374
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4509cd
lea eax, [ebp - 4]
call fcn.004047d0
ret

Function at 0x4515c8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov byte [ebp - 0x15], 0
mov eax, dword [0x4c74f0]
mov edx, dword [eax]
call dword [edx + 8]
push 0x4516dc
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x28], eax
push 0x4516e8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
xor eax, eax
push ebp
push 0x4516cf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4516f8
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
push 0x451710
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x14], eax
push 0x451728
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x24], eax
push 0x451738
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
push 0x451754
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
push 0x451764
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x10], eax
push 0x451774
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x1c], eax
push 0x451784
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x20], eax
call fcn.0044d500
test al, al
je 0x45168f
push ebp
call fcn.00451568
pop ecx
jmp 0x451696
push ebp
call fcn.00451430
pop ecx
mov edx, 0x450d64
mov eax, dword [0x4c74f0]
call fcn.00418090
cmp byte [ebp - 0x15], 0
jne 0x4516b2
push ebp
call fcn.00450e20
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4516d6
cmp dword [ebp - 0x28], 0
je 0x4516ce
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
Function at 0x452a14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x452b93
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f6
jb 0x452a73
cmp byte [ebp - 5], 0x80
jb 0x452a73
and byte [ebp - 5], 0x7f
mov byte [ebp - 6], 1
xor edx, edx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.00402c14
xor ecx, ecx
mov cl, byte [ebp - 5]
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f4
jb 0x452b66
cmp byte [esi + 0x3b], 0
je 0x452ad6
mov eax, dword [0x4cc9ac]
mov edx, dword [esi + 0x37]
call fcn.00404bf8
je 0x452ac5
mov eax, dword [esi + 0x37]
call fcn.0043616c
mov eax, 0x4cc9ac
mov edx, dword [esi + 0x37]
call fcn.00404824
xor ecx, ecx
mov cl, byte [ebx]
lea edx, [ebx + 1]
lea eax, [ebx + 1]
call fcn.0043620c
jmp 0x452b0f
cmp byte [ebx], 0
je 0x452b0f
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404a34
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00436568
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x452bac
call fcn.00404af8
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, 0xff
call fcn.00404a88
cmp byte [ebp - 6], 0
je 0x452b78
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404a34
push dword [ebp - 0x1c]
push 0x452bb8
lea ecx, [ebp - 0x120]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00452a14
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x20]
call fcn.00404a34
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404b6c
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, 0xff
call fcn.00404a88
jmp 0x452b78
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x452b78
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x452b71
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452b9a
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004047f4
ret

Function at 0x4586d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov ebp, edx
mov edi, eax
push 0
push 0
push 0xe
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
inc esi
mov eax, ebx
mov edx, esi
call fcn.00404e38
mov eax, ebx
call fcn.00404d04
push eax
push esi
push 0xd
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebx]
call fcn.00404aac
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.00404d4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x459648
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov al, byte [ebp - 0xe5]
and al, 0x80
cmp al, 0x80
sete al
mov esp, ebp
pop ebp
ret
Function at 0x460298
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
cmp byte [0x4c752c], 0
jne 0x4602e5
xor esi, esi
mov edx, 0x4cd084
mov eax, esi
mov ebx, 8
test al, 1
je 0x4602cb
shr eax, 1
xor eax, 0xedb88320
jmp 0x4602cd
shr eax, 1
dec ebx
jne 0x4602be
mov dword [edx], eax
inc esi
add edx, 4
cmp esi, 0x100
jne 0x4602b7
mov byte [0x4c752c], 1
mov eax, dword [esp + 4]
dec eax
test eax, eax
jl 0x460312
inc eax
xor esi, esi
mov edx, dword [esp]
movzx edx, byte [edx + esi]
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x4cd084]
shr edi, 8
xor edx, edi
mov edi, edx
inc esi
dec eax
jne 0x4602f1
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4633ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x11
push 0
push 0
dec ecx
jne 0x4633b5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c9c
mov eax, dword [ebp - 8]
call fcn.00404c9c
mov eax, dword [ebp - 0xc]
call fcn.00404c9c
xor eax, eax
push ebp
push 0x4635e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 8]
call fcn.00422be8
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 8]
call fcn.00404868
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0xc]
call fcn.00422be8
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0xc]
call fcn.00404868
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, 0x4635f8
mov eax, 0x80000000
call fcn.0042371c
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x14]
call fcn.00422be8
mov edx, dword [ebp - 0x80]
lea eax, [ebp - 0x14]
call fcn.00404868
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.004031bc
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0x10
call fcn.004031bc
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 1
mov word [ebp - 0x34], 3
lea eax, [ebp - 0x1c]
mov ecx, dword [0x4cc774]
mov edx, 0x46361c
call fcn.00404af8
push 0x46362c
push dword [ebp - 4]
push 0x46363c
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.004632c8
push dword [ebp - 0x84]
push 0x463650
lea eax, [ebp - 0x8c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00404af8
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.004632c8
push dword [ebp - 0x88]
lea eax, [ebp - 0x10]
mov edx, 6
call fcn.00404b6c
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, 0x463660
mov eax, dword [ebp - 0x14]
call fcn.004234e8
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x4000020
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404cac
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x463598
xor ebx, ebx
mov eax, dword [ebp - 0x74]
mov esi, eax
push 0x2710
push eax
call sub.user32.dll_WaitForInputIdle
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0x6c]
call fcn.0044fa84
test eax, eax
je 0x463567
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call sub.user32.dll_SetWindowPos
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0xffffffff
je 0x463584
lea eax, [ebp - 0x20]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4635b5
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x90]
call fcn.0040e6b0
mov edx, dword [ebp - 0x90]
mov al, 4
call fcn.0044f668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4635e7
lea eax, [ebp - 0x90]
mov edx, 7
call fcn.004047f4
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004047f4
ret
Function at 0x464868
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x464870
push ebx
push esi
mov esi, 0x4cc6a8
xor eax, eax
push ebp
push 0x464aef
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov byte [0x4cc954], 1
mov eax, dword [0x4cc9b0]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x4cc9b4]
mov edx, dword [eax]
call dword [edx + 0x44]
call fcn.0044f7a4
call fcn.00463164
xor eax, eax
push ebp
push 0x464ac0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4cd054]
call fcn.00454530
xor eax, eax
push ebp
push 0x464a9b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004545fc
xor eax, eax
push ebp
push 0x464a6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x464916
mov al, 1
call fcn.004647a8
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x464916
push ebp
call fcn.00463a2c
pop ecx
and bl, al
mov eax, dword [esi]
cmp byte [eax + 0x30d], 0
je 0x464952
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x464937
mov eax, dword [esi]
cmp byte [eax + 0x2ee], 0
je 0x46493e
xor eax, eax
call fcn.004647a8
mov eax, dword [esi]
cmp byte [eax + 0x30d], 0
je 0x464952
push ebp
call fcn.0046465c
pop ecx
and bl, al
test bl, bl
jne 0x46496b
mov eax, dword [esi]
test byte [eax + 0x331], 0x10
je 0x46496b
mov eax, dword [0x4cc774]
call fcn.0044fd04
mov eax, dword [esi]
test byte [eax + 0x2f1], 2
je 0x4649ee
cmp byte [ebp - 0xd], 0
jne 0x4649ee
test bl, bl
je 0x4649b8
push 0x242040
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, dword [esi]
call fcn.00424408
mov eax, dword [ebp - 0x14]
call fcn.00404cac
push eax
lea ecx, [ebp - 0x18]
mov dl, 0x90
mov eax, dword [esi]
call fcn.00424408
mov eax, dword [ebp - 0x18]
call fcn.00404cac
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x4649ee
push 0x242010
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [esi]
call fcn.00424408
mov eax, dword [ebp - 0x1c]
call fcn.00404cac
push eax
lea ecx, [ebp - 0x20]
mov dl, 0x91
mov eax, dword [esi]
call fcn.00424408
mov eax, dword [ebp - 0x20]
call fcn.00404cac
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [esi]
test byte [eax + 0x331], 0x20
je 0x464a3f
test bl, bl
jne 0x464a3f
lea eax, [ebp - 0x24]
call fcn.00463820
mov eax, dword [ebp - 0x24]
call fcn.00404cac
push eax
lea eax, [ebp - 0x28]
call fcn.004542cc
mov eax, dword [ebp - 0x28]
call fcn.00404cac
push eax
call sub.kernel32.dll_MoveFileA
lea eax, [ebp - 0x30]
call fcn.00463820
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040b4a0
mov eax, dword [ebp - 0x2c]
call fcn.004638a8
lea eax, [ebp - 0x34]
call fcn.004542cc
mov eax, dword [ebp - 0x34]
call fcn.00450964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464a74
lea eax, [ebp - 0x38]
call fcn.00454478
mov eax, dword [ebp - 0x38]
call fcn.00450964
ret