joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446a00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00406940
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00441834
test ebx, ebx
jne 0x446a53
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0044693c
mov ebx, eax
test ebx, ebx
je 0x446b3e
cmp esi, ebx
je 0x446a7c
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x446a91
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x446ac9
add eax, 0xffffff5f
sub eax, 2
jb 0x446ae1
dec eax
sub eax, 2
jb 0x446af5
dec eax
sub eax, 2
jb 0x446aeb
jmp 0x446aff
add eax, 0xfffffdff
sub eax, 2
jb 0x446ae1
dec eax
sub eax, 2
jb 0x446af5
dec eax
sub eax, 2
jb 0x446aeb
jmp 0x446aff
mov byte [esp + 0x120], 0
jmp 0x446b07
mov byte [esp + 0x120], 2
jmp 0x446b07
mov byte [esp + 0x120], 1
jmp 0x446b07
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00454418
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00442fbc
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x446b40
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x4477ac
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x4477c8
cmp dword [esi + 4], 0
je 0x4477f5
test byte [ebx + 0x55], 1
jne 0x4477e7
mov eax, ebx
call fcn.00445b94
test eax, eax
jne 0x4477e7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x447905
mov edx, esi
mov eax, ebx
call fcn.004471b4
jmp 0x447905
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4478fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00449804
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00442fbc
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004477ac
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00449804
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447905
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44eb88
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x47eec4]
cmp byte [eax + 0xc], 0
je 0x44ecf5
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44ecee
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48254c], 0
jne 0x44ebdc
push 0x44ecfc
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44ed04
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48254c], eax
cmp dword [0x47a73c], 0
jne 0x44ecd7
push 0x44ed14
call sub.kernel32.dll_LoadLibraryA
mov dword [0x47a73c], eax
cmp dword [0x47a73c], 0
je 0x44ecd7
push 0x44ed20
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482550], eax
push 0x44ed30
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482554], eax
push 0x44ed44
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482558], eax
push 0x44ed5c
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48255c], eax
push 0x44ed74
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482560], eax
push 0x44ed88
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482564], eax
push 0x44eda0
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482568], eax
push 0x44edb8
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48256c], eax
push 0x44edd4
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482570], eax
push 0x44ede0
mov eax, dword [0x47a73c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482574], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ecf5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x454380
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4543d4]
test si, 4
je 0x454395
or bl, 1
test si, 8
je 0x45439f
or bl, 4
test si, 1
je 0x4543a9
or bl, 8
test si, 2
je 0x4543b3
or bl, 0x10
test si, 0x10
je 0x4543bd
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4543cc
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4543d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x454414]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4543f2
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x454401
or bl, 4
test esi, 0x20000000
je 0x45440c
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45bac8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45bada
add esp, 0xfffffff0
call fcn.00403c78
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004209b8
mov eax, dword [0x47ea1c]
mov dword [eax + 4], ebx
mov dword [eax], 0x45be6c
mov eax, dword [0x47ea2c]
mov dword [eax + 4], ebx
mov dword [eax], 0x45be78
mov eax, ebx
call fcn.0045be84
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41874c]
call fcn.0040393c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41874c]
call fcn.0040393c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41874c]
call fcn.0040393c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41874c]
call fcn.0040393c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41874c]
call fcn.0040393c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45791c
push eax
push 0
push 0
mov eax, dword [0x47ec24]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4245e0]
call fcn.00425b00
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4245e0]
call fcn.00425b00
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4245e0]
call fcn.00425b00
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045c2b4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45c184
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45c184
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45c184
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45bc17
call fcn.00403cd0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45bf68
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c113
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45c0f4
mov dl, 1
mov eax, dword [0x418b70]
call fcn.0040393c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404780
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45c0e3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044eee4
test al, al
je 0x45c0d6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45c124
lea eax, [ebp - 0x254]
call fcn.004096b8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45c0d6
xor eax, eax
push ebp
push 0x45c0cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45c15c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45c0b8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004049f0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45c0b8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004049f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c0d6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45bfd9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041c8b8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c11a
lea eax, [ebp - 0x260]
call fcn.00404780
ret

Function at 0x45ca8c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x482584]
cmp byte [eax + 0xad], 0
jne 0x45cafd
cmp dword [0x48259c], 0
jne 0x45cabe
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45ca48
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x48259c], eax
cmp dword [0x482598], 0
jne 0x45cad9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x482598], eax
cmp dword [0x4825a0], 0
jne 0x45cafd
push esp
push 0
push 0
push 0x45c9ec
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4825a0], eax
pop edx
ret
Function at 0x45ccd0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45cce7
add esp, 0xfffffff0
call fcn.00403c78
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004209b8
mov eax, dword [0x47ec04]
cmp word [eax + 2], 0
jne 0x45cd0f
mov eax, dword [0x47ec04]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045e780
mov eax, dword [0x47ecf0]
cmp word [eax + 2], 0
jne 0x45cd29
mov eax, dword [0x47ecf0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045e98c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41874c]
call fcn.0040393c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41874c]
call fcn.0040393c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41874c]
call fcn.0040393c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x424dbc]
call fcn.0042ac4c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45cee0
mov eax, dword [0x47eac4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042b020
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45f04c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47eac4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d140
test eax, eax
je 0x45ce30
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409070
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d174
test eax, eax
je 0x45ce44
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004049f0
mov byte [ebx + 0xd4], 0
push ebx
push 0x45e2e0
call fcn.00421b34
mov dword [ebx + 0xc8], eax
mov eax, dword [0x47e914]
cmp byte [eax], 0
jne 0x45ce95
mov eax, ebx
call fcn.0045d024
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045f228
mov eax, ebx
call fcn.0045fd88
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45ced5
call fcn.00403cd0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d2a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x482584]
cmp dword [eax + 0x30], 0
je 0x45d34e
cmp dword [ebx + 0x94], 0
jne 0x45d348
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45d234
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45d348
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45d30e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45d348
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041aaf8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45d31d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45e068
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45e09d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404870
jmp 0x45e0aa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004047d4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45f40c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45f47a
mov eax, esi
call fcn.00449ba4
test al, al
je 0x45f47a
mov eax, dword [ebx + 0x84]
call fcn.00449804
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45f47a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45f46e
push 0
mov eax, dword [ebx + 0x84]
call fcn.00449804
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00441c24
jmp 0x45f47a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045f248
pop esi
pop ebx
ret

Function at 0x4664bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46652c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00404ecc
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x4664f6
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.00404c44
push eax
push esi
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
xchg edx, eax
call fcn.00404ecc
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.004663c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466533
lea eax, [ebp - 8]
call fcn.00404780
ret
Function at 0x46a830
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00449ba4
test al, al
je 0x46a892
cmp bl, 7
jne 0x46a867
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x46a86c
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xe0]
test eax, eax
je 0x46a892
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xe0]
push edi
push 0
push 0x100f
push eax
call sub.user32.dll_SendMessageA
mov byte [esi + 0x268], bl
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x46dacd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov ecx, 3
push ebx
push esi
push edi
lea edi, [ebp - 0x20]
mov dword [ebp - 0x10], 0x2710
mov esi, 0x47b094
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x20], 0x5c
mov byte [ebp - 0x1f], 0x5c
mov byte [ebp - 0x1e], 0x2e
mov byte [ebp - 0x1d], 0x5c
mov byte [ebp - 0x1c], 0x4c
mov byte [ebp - 0x1b], 0x50
mov byte [ebp - 0x1a], 0x54
mov byte [ebp - 0x19], 0x4d
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
call fcn.0046d14f
mov edi, eax
call fcn.0046d14f
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x46dc18
call fcn.0046d14f
mov edi, eax
mov esi, 1
mov eax, esi
add al, 0x30
mov byte [ebp - 0x17], al
push 0
push 0x80
push 3
push 0
push 7
push 0xc0000000
lea edx, [ebp - 0x20]
push edx
call fcn.0046ce68
add esp, 0x1c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46dbf2
push 0
lea eax, [ebp - 4]
push eax
push 0x120
push dword [ebp + 0x10]
push 0x130
push dword [ebp + 0xc]
push 0x860021b0
push ebx
call fcn.0046cef1
add esp, 0x20
test eax, eax
je 0x46dbd8
push ebx
call fcn.0046d0d8
pop ecx
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00473620
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x46dbc3
mov eax, ebx
jmp 0x46dc2b
inc dword [ebp - 8]
push 1
call fcn.0046cf8d
cmp dword [ebp - 8], 0xa
pop ecx
jle 0x46dc04
mov eax, ebx
jmp 0x46dc2b
push ebx
call fcn.0046d0d8
pop ecx
call fcn.0046d1c5
mov ebx, eax
cmp ebx, 0x57
jne 0x46dc04
mov eax, 0x753c
jmp 0x46dc2b
call fcn.0046d1c5
cmp eax, 5
jne 0x46dc04
push 0x32
call fcn.0046cf8d
pop ecx
inc esi
cmp esi, 4
jb 0x46db50
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
cmp edi, edx
jae 0x46dc26
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
cmp edi, ecx
jb 0x46db44
mov eax, 0x4f1a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4701fd
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x470dc5
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x52
mov edx, dword [ebp + 0xc]
mov byte [edx + 1], 0x43
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 2], 0x36
mov eax, dword [ebp + 0xc]
mov byte [eax + 3], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 4], 0xb8
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 4
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0xb7e15163
mov ebx, 1
mov eax, dword [ebp + 0xc]
add eax, 8
mov edx, dword [eax]
inc ebx
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
cmp ebx, 0x2b
jle 0x470e15
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov edi, ecx
cmp dword [ebp - 8], 0x2c
mov esi, ecx
mov ebx, eax
jle 0x470e41
mov eax, dword [ebp - 8]
jmp 0x470e46
mov eax, 0x2c
lea edx, [eax + eax*2]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jg 0x470ec0
push 3
mov eax, dword [ebp + 0xc]
add esi, dword [eax + ebx*4 + 8]
add esi, edi
push esi
call fcn.00471123
mov edx, dword [ebp + 0xc]
mov esi, eax
add esp, 8
mov dword [edx + ebx*4 + 8], eax
lea edx, [edi + esi]
push edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov edx, dword [ecx + eax*4]
add edx, esi
add edi, edx
push edi
call fcn.00471123
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edi, eax
add esp, 8
mov dword [ecx + edx*4], eax
lea eax, [ebx + 1]
cdq
mov ecx, 0x2c
idiv ecx
mov eax, dword [ebp - 0xc]
mov ebx, edx
inc eax
cdq
idiv dword [ebp - 8]
mov dword [ebp - 0xc], edx
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jle 0x470e5b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004b4e
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x1005b145
call fcn.10039c9b
mov eax, 0x100a2de4
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
lea eax, [ebp + 0xc]
push eax
push ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push ebx
push ebx
call fcn.100048c9
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.1004159e
mov esi, eax
lea ecx, [ebp - 0x1c]
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
add esp, 0x18
inc esi
push esi
call fcn.10004c74
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
mov edx, esi
push eax
push dword [ebp + 8]
call fcn.10004919
mov ecx, dword [0x100a2e0c]
mov eax, dword fs:[0x2c]
mov edi, dword [eax + ecx*4]
mov esi, dword [edi + 4]
test esi, esi
jne 0x10004bf5
mov esi, dword [ebp - 0x1c]
push 2
call fcn.10042b47
push eax
push esi
call fcn.100431ef
push 2
call fcn.10042b47
push eax
push 0xa
call fcn.100430b2
add esp, 0x18
jmp 0x10004c03
push dword [ebp - 0x1c]
mov ecx, esi
call dword [0x1005d208]
call esi
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x100a2e00], 0
je 0x10004c39
push 2
call fcn.10042b47
pop ecx
cmp dword [0x100a2dfc], eax
jne 0x10004c2d
cmp dword [edi + 4], ebx
je 0x10004c39
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.100048f2
lea ecx, [ebp - 0x1c]
call fcn.10004c52
push 0x100a2de4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10039c78
ret