joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444574
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040660c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0043f3b4
test ebx, ebx
jne 0x4445c7
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.004444b0
mov ebx, eax
test ebx, ebx
je 0x4446b2
cmp esi, ebx
je 0x4445f0
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x444605
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x44463d
add eax, 0xffffff5f
sub eax, 2
jb 0x444655
dec eax
sub eax, 2
jb 0x444669
dec eax
sub eax, 2
jb 0x44465f
jmp 0x444673
add eax, 0xfffffdff
sub eax, 2
jb 0x444655
dec eax
sub eax, 2
jb 0x444669
dec eax
sub eax, 2
jb 0x44465f
jmp 0x444673
mov byte [esp + 0x120], 0
jmp 0x44467b
mov byte [esp + 0x120], 2
jmp 0x44467b
mov byte [esp + 0x120], 1
jmp 0x44467b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004524b4
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00440b30
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4446b4
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x445320
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x44533c
cmp dword [esi + 4], 0
je 0x445369
test byte [ebx + 0x55], 1
jne 0x44535b
mov eax, ebx
call fcn.00443708
test eax, eax
jne 0x44535b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x445479
mov edx, esi
mov eax, ebx
call fcn.00444d28
jmp 0x445479
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x445472
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00447378
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00440b30
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00445320
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00447378
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445479
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c788
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4ea2d8]
cmp byte [eax + 0xc], 0
je 0x44c8f5
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44c8ee
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ee54c], 0
jne 0x44c7dc
push 0x44c8fc
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44c904
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee54c], eax
cmp dword [0x47767c], 0
jne 0x44c8d7
push 0x44c914
call sub.kernel32.dll_LoadLibraryA
mov dword [0x47767c], eax
cmp dword [0x47767c], 0
je 0x44c8d7
push 0x44c920
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee550], eax
push 0x44c930
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee554], eax
push 0x44c944
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee558], eax
push 0x44c95c
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee55c], eax
push 0x44c974
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee560], eax
push 0x44c988
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee564], eax
push 0x44c9a0
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee568], eax
push 0x44c9b8
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee56c], eax
push 0x44c9d4
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee570], eax
push 0x44c9e0
mov eax, dword [0x47767c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ee574], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c8f5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x45241c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x452470]
test si, 4
je 0x452431
or bl, 1
test si, 8
je 0x45243b
or bl, 4
test si, 1
je 0x452445
or bl, 8
test si, 2
je 0x45244f
or bl, 0x10
test si, 0x10
je 0x452459
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x452468
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x452474
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4524b0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45248e
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45249d
or bl, 4
test esi, 0x20000000
je 0x4524a8
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x459b64
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x459b76
add esp, 0xfffffff0
call fcn.00403c20
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a6b4
mov eax, dword [0x4e9f40]
mov dword [eax + 4], ebx
mov dword [eax], 0x459f08
mov eax, dword [0x4e9f4c]
mov dword [eax + 4], ebx
mov dword [eax], 0x459f14
mov eax, ebx
call fcn.00459f20
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412498]
call fcn.004038cc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412498]
call fcn.004038cc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412498]
call fcn.004038cc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412498]
call fcn.004038cc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412498]
call fcn.004038cc
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4559b8
push eax
push 0
push 0
mov eax, dword [0x4ea0b8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41e304]
call fcn.0041fa80
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41e304]
call fcn.0041fa80
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41e304]
call fcn.0041fa80
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045a350
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45a220
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45a220
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45a220
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459cb3
call fcn.00403c78
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45a004
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a1af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45a190
mov dl, 1
mov eax, dword [0x4128bc]
call fcn.004038cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404728
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45a17f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044cae4
test al, al
je 0x45a172
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45a1c0
lea eax, [ebp - 0x254]
call fcn.004094d4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45a172
xor eax, eax
push ebp
push 0x45a16b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45a1f8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45a154
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404998
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45a154
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404998
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a172
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45a075
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.004165b4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a1b6
lea eax, [ebp - 0x260]
call fcn.00404728
ret

Function at 0x45ab28
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4ee584]
cmp byte [eax + 0xad], 0
jne 0x45ab99
cmp dword [0x4ee59c], 0
jne 0x45ab5a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45aae4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4ee59c], eax
cmp dword [0x4ee598], 0
jne 0x45ab75
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4ee598], eax
cmp dword [0x4ee5a0], 0
jne 0x45ab99
push esp
push 0
push 0
push 0x45aa88
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4ee5a0], eax
pop edx
ret
Function at 0x45ad6c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45ad83
add esp, 0xfffffff0
call fcn.00403c20
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a6b4
mov eax, dword [0x4ea09c]
cmp word [eax + 2], 0
jne 0x45adab
mov eax, dword [0x4ea09c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045c81c
mov eax, dword [0x4ea154]
cmp word [eax + 2], 0
jne 0x45adc5
mov eax, dword [0x4ea154]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045ca28
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412498]
call fcn.004038cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412498]
call fcn.004038cc
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x412498]
call fcn.004038cc
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41ed3c]
call fcn.0042643c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45af7c
mov eax, dword [0x4e9fa8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00426810
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45d0e8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4e9fa8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cf58
test eax, eax
je 0x45aecc
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408e78
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cf8c
test eax, eax
je 0x45aee0
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404998
mov byte [ebx + 0xd4], 0
push ebx
push 0x45c37c
call fcn.0041b830
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4e9e78]
cmp byte [eax], 0
jne 0x45af31
mov eax, ebx
call fcn.0045b0c0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045d2c4
mov eax, ebx
call fcn.0045de24
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45af71
call fcn.00403c78
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b340
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4ee584]
cmp dword [eax + 0x30], 0
je 0x45b3ea
cmp dword [ebx + 0x94], 0
jne 0x45b3e4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45b2d0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45b3e4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45b3aa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45b3e4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414844
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45b3b9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45c104
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45c139
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404818
jmp 0x45c146
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040477c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45d4a8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45d516
mov eax, esi
call fcn.00447718
test al, al
je 0x45d516
mov eax, dword [ebx + 0x84]
call fcn.00447378
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45d516
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45d50a
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447378
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043f7a4
jmp 0x45d516
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045d2e4
pop esi
pop ebx
ret
Function at 0x46e388
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00447718
test al, al
je 0x46e3ea
cmp bl, 7
jne 0x46e3bf
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x46e3c4
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xe0]
test eax, eax
je 0x46e3ea
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xe0]
push edi
push 0
push 0x100f
push eax
call sub.user32.dll_SendMessageA
mov byte [esi + 0x268], bl
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x7ac47dd4
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x12ea6696
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x414cc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x414cda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414ce1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414cd0
mov eax, 1
add ebx, ebx
jne 0x414cf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414ce8
jne 0x414d04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ce8
xor ecx, ecx
sub eax, 3
jb 0x414d18
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414d8a
mov ebp, eax
add ebx, ebx
jne 0x414d23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414d30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414d54
inc ecx
add ebx, ebx
jne 0x414d40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414d35
jne 0x414d51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414d35
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414d74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414d65
jmp 0x414cd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414d74
add edi, ecx
jmp 0x414cd6
pop esi
mov edi, esi
mov ecx, 0x197
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414d92
cmp byte [edi], 9
jne 0x414d92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414d97
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414e06
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x187d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414dc4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1884c]
or eax, eax
je 0x414e00
mov dword [ebx], eax
add ebx, 4
jmp 0x414de1
call dword [esi + 0x18848]
mov ebp, dword [esi + 0x18850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414e3a
sub esp, 0xffffff80
jmp 0x402540
Function at 0x5dd0bf
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x44]
inc eax
jmp 0x5dc2a3

Function at 0x5e34ba
Capabilities:
Encrypt data using aes

Disassembly:
mov bl, ch
jmp 0x5e33e3
bsr bp, di
lea esp, [esp + 4]
movzx esi, byte [eax + 0xe]
mov di, 0xd22c
setl bl
jmp 0x5e343f
xor edx, esi
mov si, 0x2cb0
mov bl, 0x8f
mov ebp, dword [esp]
neg si
jmp 0x5e3465
xor edx, eax
pushfd
sbb bp, bp
lea esp, [esp + 3]
lea esp, [esp]
jmp 0x5e344f
movzx eax, byte [eax + 0xf]
lea edi, [eax*4]
shl edx, 8
jmp 0x5e3414
lea esp, [esp + 1]
jmp 0x5e34ba
shl edx, 8
mov bl, byte [esp]
lea ebp, [ebx*4]
bsr si, ax
jmp 0x5e3424
mov dword [esi], edx
pop esi
setge bl
mov ah, 0x51
mov eax, edx
jmp 0x5e34f3
push esi
mov esi, ecx
lea esi, [esi + 0xc]
jmp 0x5e349c
xor eax, 0x1000000
bts di, cx
jmp 0x5e3515
mov eax, dword [eax*4 + 0x5c0dc0]
dec bh
mov bx, sp
jmp 0x5e34c2
shr eax, 0x10
mov esi, 0xff
and eax, esi
jmp 0x5e34d8
bsr bp, bp
dec ebp
mov bx, word [esp]
mov bh, 0x9c
jmp 0x5e3522
pushal
mov dword [esp], edx
push di
lea esp, [esp + 2]
popal
jmp 0x5e34ff
shr edi, 8
stc
call 0x5e352c
test al, 0x66
mov ebp, dword [esp + 2]
mov bl, byte [esp]
jmp 0x5e3580
mov bp, 0x661b
mov ebp, edi
lea esp, [esp + 4]
and edi, 0xff0000
jmp 0x5e35ab
and edi, esi
lea ebp, [0x19079fd0]
mov edi, dword [edi*4 + 0x5c0dc0]
mov bp, word [esp]
jmp 0x5e355e
clc
mov bp, 0xda6e
jmp 0x5e35bd
mov ebx, dword [ecx + 4]
not ebp
lea ebp, [esi + 0xbf0c]
and eax, 0xff000000
jmp 0x5e3595
xor eax, edi
mov edi, edx
mov bp, word [esp]
not ebp
jmp 0x5e3631
bswap edi
mov di, word [esp]
jmp 0x5e3616
mov ebp, 0xa7fcab04
mov bp, 0xd79e
xor eax, edi
lea ebp, [ebx*4]
mov ebp, 0x8b47f612
jmp 0x5e35e7
mov edi, edx
mov bp, word [esp]
jmp 0x5e3694
mov bp, word [esp]
shr edi, 0x18
clc
movzx edi, byte [edi*4 + 0x5c0dc0]
jmp 0x5e35fd
lea esp, [esp + 8]
mov ebp, 0xff00
and edi, ebp
push dx
add esp, 1
jmp 0x5e3676
lea esp, [esp + 3]
mov edi, dword [edi*4 + 0x5c0dc0]
mov ebp, dword [esp]
lea ebp, [eax + ecx]
jmp 0x5e3643
mov byte [esp], al
lea esp, [esp + 1]
xor eax, edi
lea edi, [edx + ebx]
jmp 0x5e36a7
and edi, esi
mov ebp, 0x4d9ad097
bsf bp, ax
mov ebp, dword [esp]
sub esp, 0xb
jmp 0x5e3663
xor eax, dword [ecx]
lea edi, [edx*4]
jmp 0x5e3841
lea edi, [ecx + 0x10]
xor ebx, eax
call fcn.005e37a5