joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42eb64
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42eb81
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42eb8f
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42ecb1
test ebx, ebx
jl 0x42ecb1
test esi, esi
jle 0x42ecb1
mov eax, dword [ebp - 8]
call fcn.0040b6dc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040b6dc
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42ec4e
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42ecb1
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42ec33
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42ec02
inc dword [ebp - 0x14]
jmp 0x42ec12
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42ec12
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42ec1d
or eax, 0xffffffff
jmp 0x42ec33
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42ec30
inc eax
jmp 0x42ec33
or eax, 0xffffffff
test eax, eax
jl 0x42ec3b
cmp esi, eax
jg 0x42ebf0
cmp esi, eax
jg 0x42ec46
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42ecb4
inc edx
dec dword [ebp - 0x1c]
jne 0x42ebec
jmp 0x42ecb1
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42ecb1
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42ec98
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42ec77
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42ec82
or eax, 0xffffffff
jmp 0x42ec98
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42ec95
inc eax
jmp 0x42ec98
or eax, 0xffffffff
test eax, eax
jl 0x42eca0
cmp esi, eax
jg 0x42ec60
cmp esi, eax
jg 0x42ecab
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42ecb4
inc edx
dec dword [ebp - 0x1c]
jne 0x42ec5c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43f66c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43f674
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4422e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4422ff
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4422ef
mov eax, ecx
pop ebx
ret
Function at 0x4567d4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4567e8
add esp, 0xfffffff0
call fcn.00409414
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x450758]
call fcn.00474eec
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x4557a4]
call fcn.00477ca0
mov dword [esi + 8], eax
mov dl, 1

Function at 0x4b9ba0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4b9be3
cmp byte [ebx + 0x11], 0
jne 0x4b9be3
cmp byte [ebx + 0x24], 0
jne 0x4b9be3
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b9bfa
mov ecx, dword [0x4deed4]
mov dl, 1
mov eax, dword [0x48c9dc]
call fcn.00429330
call fcn.0040a2e4
pop ebx
ret
mov ecx, dword [0x4deed4]
mov dl, 1
mov eax, dword [0x48c9dc]
call fcn.00429330
call fcn.0040a2e4
pop ebx
ret

Function at 0x4ba568
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4ba5b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b9a4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ba5cf
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4ba5d8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b9a4c
dec esi
jne 0x4ba5fa
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4d4c5c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
xor edx, edx
mov dword [ebp - 0x274], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x26c], edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d4e92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [0x4dec3c]
call fcn.0040b0d4
sub bx, 0x30
je 0x4d4cd5
dec bx
je 0x4d4d1f
dec bx
je 0x4d4d66
jmp 0x4d4dab
movzx eax, byte [0x4d4ea0]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
mov edx, dword [ebp - 4]
call fcn.0040b794
mov eax, dword [ebp - 0x260]
mov ecx, 0x4d4eb0
mov edx, 0x4d4ed0
call fcn.0042af4c
mov edx, dword [ebp - 0x25c]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040b518
jmp 0x4d4dab
movzx eax, byte [0x4d4ea0]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 4]
call fcn.0040b794
mov eax, dword [ebp - 0x268]
mov ecx, 0x4d4f00
mov edx, 0x4d4ed0
call fcn.0042af4c
mov edx, dword [ebp - 0x264]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040b518
jmp 0x4d4dab
movzx eax, byte [0x4d4ea0]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 4]
call fcn.0040b794
mov eax, dword [ebp - 0x270]
mov ecx, 0x4d4f38
mov edx, 0x4d4ed0
call fcn.0042af4c
mov edx, dword [ebp - 0x26c]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040b518
mov edx, 0x4d4f68
mov al, 1
call fcn.004d4490
lea edx, [ebp - 0x278]
xor eax, eax
call fcn.00407574
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x274]
call fcn.004226c0
mov edx, dword [ebp - 0x274]
lea eax, [ebp - 8]
mov ecx, 0x4d4fa4
call fcn.0040b928
mov eax, dword [ebp - 8]
call fcn.0040b6dc
push eax
call sub.kernel32.dll_DeleteFileW
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x258]
call fcn.00407ec4
call fcn.00406fd8
mov edx, 1
lea eax, [ebp - 0x258]
call fcn.0040829c
call fcn.00406fd8
lea eax, [ebp - 4]
call fcn.0040b1c8
mov edx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4d4e32
mov eax, dword [eax - 4]
push 0
mov ecx, eax
lea eax, [ebp - 0x258]
call fcn.00408018
call fcn.00406fd8
lea eax, [ebp - 0x258]
call fcn.00408038
call fcn.00406fd8
mov edx, 0x4d4f68
xor eax, eax
call fcn.004d4490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4e99
lea eax, [ebp - 0x278]
mov edx, 8
call fcn.0040ac5c
lea eax, [ebp - 8]
call fcn.0040abfc
lea eax, [ebp - 4]
call fcn.0040ac20
pop eax
jmp eax
Function at 0x4017c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x558658
mov eax, dword fs:[0]
push eax
sub esp, 0x748
mov eax, dword [0x5ad634]
xor eax, esp
mov dword [esp + 0x740], eax
push ebx
push esi
push edi
mov eax, dword [0x5ad634]
xor eax, esp
push eax
lea eax, [esp + 0x758]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004265c1
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.00424cef
xor ebx, ebx
push ebx
call fcn.00426e42
add esp, 4
push str.EISC_Handy_of_ADChips
mov ecx, edi
call fcn.00427315
call fcn.00422db9
xor ecx, ecx
cmp eax, ebx
setne cl

Function at 0x40184c
Capabilities:
Check mutex on windows

Disassembly:
cmp ecx, ebx
jne 0x40185a
push 0x80004005
call fcn.004016d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x20
push 0x457
push 2
push 1
lea ecx, [esp + 0x24]
push str.EISC_Handy_Configurator___V__d._d._d._d_
push ecx
mov dword [esp + 0x778], ebx
call fcn.004016b0
mov esi, dword [esp + 0x2c]
add esp, 0x18
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4018b2
mov ebx, 1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4018c1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
je 0x4018e2
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call fcn.0042a3f1
mov edx, dword [eax + 0x20]
push 1
push edx
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x401914
lea ecx, [esp + 0x24]
push ecx
call fcn.00401dc0
lea edx, [esp + 0x24]
mov byte [esp + 0x760], 1
mov ecx, edx
mov dword [edi + 0x20], edx
call fcn.0042ded4
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x764], 0
call fcn.00401960
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x760], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401937
invalid
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax

Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x41b8f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5577fb
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebp
push esi
push edi
mov eax, dword [0x5ad634]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
push ebx
lea ecx, [esp + 0x34]
call fcn.00433cc1
push 0x584118
mov dword [esp + 0xc4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x41ba74
push 0xa
push 0x9f
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x41ba6d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41ba6d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x41ba6d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebp
push eax
call dword [sym.imp.GDI32.dll_SetEnhMetaFileBits]
mov edi, eax
lea eax, [esp + 0x44]
push eax
push 0x6c
push edi
mov dword [esp + 0x54], 0x6c
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
fild dword [esp + 0x60]
call fcn.00526630
fild dword [esp + 0x5c]
mov dword [esp + 0x18], eax
call fcn.00526630
fild dword [esp + 0x64]
mov dword [esp + 0x1c], eax
call fcn.00526630
fild dword [esp + 0x68]
mov esi, eax
call fcn.00526630
sub esi, dword [esp + 0x1c]
mov ecx, eax
sub ecx, dword [esp + 0x18]
mov eax, 0xea0ea0eb
imul esi
add edx, esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
lea edx, [edx + eax + 0xfa]
mov dword [esp + 0x28], edx
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
push 0xffff
shr eax, 0x1f
lea ecx, [edx + eax + 0x32]
mov edx, dword [ebx + 0x74]
mov edx, dword [edx + 0x13c]
push ebx
lea eax, [esp + 0x28]
mov dword [esp + 0x34], ecx
push eax
lea ecx, [ebx + 0x74]
push 0x5000020f
push str.Freq_PLL_Formula
mov dword [esp + 0x34], 0xfa
mov dword [esp + 0x38], 0x32
call edx
mov eax, dword [ebx + 0x94]
push edi
push 3
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebp
call fcn.00422d71
mov esi, dword [esp + 0x18]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x30]
mov dword [esp + 0xc0], 0xffffffff
call fcn.00433d15
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xb4
ret
Function at 0x426a5f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x426aa7
call fcn.004322fa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x426aa7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x426aea
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x426ad3
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x426ad3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x426ae7
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42d75c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42d7a3
call fcn.004322fa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42d7a3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42d7bf
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042d2d6
mov esi, eax
test edi, edi
je 0x42d7bd
test ebx, ebx
je 0x42d7bd
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42e0cd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.004322fa
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42e106
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0042dd1e
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x42e164
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x42e188
cmp dword [edi + 0x54], 0
jne 0x42e188
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004322fa
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042e125
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43159a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x54c5c4
call fcn.005237ce
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4315bf
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x431605
lea ecx, [ebp - 0x10]
call fcn.00401760
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004236b3
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401720
mov eax, esi
call fcn.005238a6
ret 8
Function at 0x43d4cb
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5ad634]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
mov ebx, 0x8000
cmp eax, 9
ja 0x43d504
push 0x12
call esi
mov ecx, ebx
test cx, ax
je 0x43d52b
cmp dword [0x5b6aa8], 0
jne 0x43d52b
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x43d51e
push 0x12
call esi
test bx, ax
je 0x43d522
mov eax, edi
jmp 0x43d596
push edi
call fcn.005273cb
pop ecx
jmp 0x43d596
and dword [ebp - 0x10c], 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
call fcn.0042fc2d
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push edi
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov al, byte [ebp - 0x10c]
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 0x107], 0
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, byte [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00521840
leave
ret 4
Function at 0x44d499
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
movzx ebx, word [ebp + 8]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x44d4b3
call fcn.004241ad
call fcn.004322fa
mov esi, dword [eax + 0xc]
push 0xf1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x44d4d3
xor eax, eax
jmp 0x44d5ee
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x44d4cc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x44d4cc
movzx eax, word [esi + 6]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00422d42
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x44d4ae
cmp dword [ebp + 0x10], 0
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
push eax
lea ebx, [ecx + 6]
lea edx, [eax + 6]
push ebx
push edx
je 0x44d530
mov ecx, edi
call fcn.0044601a
jmp 0x44d535
call fcn.00445f04
mov eax, dword [ebp + 0xc]
xor ebx, ebx
inc ebx
cmp dword [eax + 4], 0
jne 0x44d547
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
cmp dword [edi + 0xbe0], 0
jne 0x44d562
push dword [ebp + 0x10]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x310]
test eax, eax
je 0x44d5da
mov eax, dword [edi + 0xad0]
mov dword [ebp + 0xc], eax
xor eax, eax
xor ebx, ebx
cmp ax, word [esi + 6]
jae 0x44d5b1
lea eax, [esi + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 8]
mov dword [ecx + ebx*4], eax
jne 0x44d5a4
test eax, eax
jbe 0x44d5a4
push eax
mov ecx, 0x5aa12c
call fcn.0047d4f7
mov ecx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
mov dword [eax], ecx
movzx eax, word [esi + 6]
add dword [ebp - 4], 2
inc ebx
cmp ebx, eax
jl 0x44d57b
mov eax, dword [ebp + 8]
mov dword [edi + 0xbe0], eax
movzx ecx, word [esi + 6]
mov eax, dword [edi]
push 1
push ecx
push dword [ebp - 8]
mov ecx, edi
call dword [eax + 0x318]
mov ebx, eax
test ebx, ebx
jne 0x44d5da
and dword [edi + 0xbe0], eax
push dword [ebp - 8]
call fcn.00422d71
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x452f97
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x4530d8
push esi
push edi
push 0x562ef8
call fcn.00435cf5
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp + 8], 0
je 0x453027
mov esi, dword [ebx + 0x168]
jmp 0x453013
mov eax, esi
mov edi, dword [eax + 8]
mov esi, dword [esi]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x453013
push edi
call fcn.0042a3f1
push eax
push 0x5aafe0
call fcn.00435d13
pop ecx
pop ecx
test eax, eax
je 0x453013
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x178]
test eax, eax
jle 0x453013
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
jne 0x452fd3
lea ecx, [ebx + 0x164]
call fcn.004ef96e
jmp 0x4530d6
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 8], eax
test eax, eax
je 0x4530d6
jmp 0x45303d
mov ebx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 0xc8]
call fcn.0048edcf
mov esi, dword [eax]
test esi, esi
jne 0x453056
xor ebx, ebx
jmp 0x453059
mov ebx, dword [esi + 0x20]
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4530cc
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4530cc
test edi, edi
je 0x45309e
push esi
push 0x5aafe0
call fcn.00435d13
mov edx, dword [eax]
pop ecx
pop ecx
mov ecx, eax
call dword [edx + 0x180]
push eax
push 0x56b99c
call fcn.00435d13
pop ecx
pop ecx
test eax, eax
je 0x4530cc
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 4]
push 0
lea eax, [ebp + 8]
add esi, 0x164
push eax
mov ecx, esi
call fcn.004524e9
test eax, eax
jne 0x4530cc
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.004524b9
cmp dword [ebp - 8], 0
jne 0x45303a
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4576f2
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5ad634]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x108], esi
call fcn.004571b2
mov ebx, eax
cmp ebx, esi
je 0x45775f
lea ecx, [ebp - 0x10c]
call fcn.004275b2
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00521840
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x45777d
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x10c]
call fcn.004576f2
cmp eax, esi
jne 0x4577c4
lea eax, [ebp - 0x11c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x100
call ebx
test eax, eax
je 0x457767
lea ecx, [ebp - 0x10c]
call fcn.004275b2
push dword [ebp - 0x114]
mov ecx, edi
call fcn.00457153
lea ecx, [ebp - 0x10c]
mov esi, eax
call fcn.004275b2
mov eax, esi
jmp 0x45774e
Function at 0x45abaa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x5b6810], 0
mov dword [ebp - 4], ecx
jne 0x45abc0
xor eax, eax
jmp 0x45abfa
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x45abd0
call fcn.004322fa
mov esi, dword [eax + 0xc]
push edi
push dword [0x5b7590]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x45abf6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x45abfe
xor eax, eax
pop edi
pop esi
leave
ret 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x45ac1c
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x45abf8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0045aacc
mov esi, eax
jmp 0x45ac0e