joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484401
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [eax + 0x190]
test al, al
jns 0x484423
or eax, 0xffffffff
jmp 0x484428
mov eax, dword [0x56e084]
mov edx, dword [esi]
lea ecx, [ebp - 4]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x290]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x56f5c8
call fcn.004114bb
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x4844c5
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x4844c5
cmp edi, ebx
je 0x48447a
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x200]
push eax
push 0x56fda8
call fcn.004114bb
pop ecx
pop ecx
mov ebx, eax
cmp dword [ebp - 8], 2
jne 0x4844ce
test ebx, ebx
je 0x4844b1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x198]
test al, 0x40
je 0x4844c5
cmp dword [ebp - 4], 0
je 0x4844b1
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x224]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, esi
jmp 0x4844c7
mov eax, dword [esi]
push 5
push 0
push edi
mov ecx, esi
call dword [eax + 0x1d0]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 8], 3
jne 0x4844c5
test edi, edi
je 0x4844c5
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x15c]
test eax, eax
je 0x4844c5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x164]
test eax, eax
je 0x4844c5
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x218]
mov eax, dword [esi]
push 0
push 1
push 5
push edi
mov ecx, esi
call dword [eax + 0x328]
mov edx, dword [ebp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
jmp 0x4844c7
Function at 0x487dbc
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [0x576ab4], 1
push ebx
push esi
push edi
mov ebx, ecx
jne 0x487deb
or dword [0x576ab4], 1
mov ecx, 0x576ab0
call fcn.00402a74
push 0x527c35
call fcn.005003df
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x487df7
call fcn.00410b22
mov eax, dword [ebx + 0x318]
test eax, eax
je 0x487e70
cmp dword [eax + 0x20], 0
je 0x487e70
test eax, eax
je 0x487e0e
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x487e70
mov eax, dword [edi + 4]
dec eax
je 0x487e4f
dec eax
je 0x487e25
dec eax
jne 0x487e70
mov esi, 0x428e
jmp 0x487e54
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x487e54
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x31c]
test eax, eax
je 0x487e54
add esi, 3
jmp 0x487e54
mov esi, 0x3ea0
push esi
mov ecx, 0x576ab0
call fcn.00401650
test eax, eax
je 0x487df2
mov eax, dword [0x576ab0]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x487e72
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x488ce0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
xor ecx, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebx + 0x9c], ecx
cmp dword [ebx + 0x90], ecx
je 0x488d60
cmp dword [ebp + 0xc], ecx
jne 0x488d60
cmp dword [ebx + 0x94], ecx
jne 0x488d60
mov eax, dword [ebx + 0x20]
cmp eax, ecx
je 0x488d56
cmp eax, 0xffffffff
je 0x488d56
lea eax, [ebp - 8]
push eax
call esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call edi
push dword [ebp - 4]
lea ecx, [ebx + 0xc8]
push dword [ebp - 8]
call fcn.0040a09c
mov dword [ebx + 0x9c], eax
test eax, eax
jne 0x488d60
xor eax, eax
jmp 0x488ea0
mov dword [ebx + 0x9c], 1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xec]
test eax, eax
je 0x488d9b
cmp dword [ebp + 0xc], 0
jne 0x488d9b
lea eax, [ebp - 8]
push eax
call esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call edi
push dword [ebp - 4]
lea ecx, [ebx + 0xd8]
push dword [ebp - 8]
call fcn.0040a09c
test eax, eax
jne 0x488d4f
xor ecx, ecx
cmp dword [ebx + 0x9c], ecx
jne 0x488dc1
mov eax, dword [ebx + 0x20]
cmp eax, ecx
jbe 0x488dc1
cmp eax, 0xffffffff
je 0x488dc1
cmp dword [ebx + 0x90], ecx
jne 0x488dc1
cmp dword [ebx + 0xa8], ecx
je 0x488d4f
push dword [ebx + 0x6c]
push 0x56f444
call fcn.004114bb
lea esi, [ebx + 0x8c]
mov dword [ebp - 4], eax
mov eax, dword [esi]
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x488dfa
mov dword [eax + 0xf8], edi
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x60]
mov ecx, dword [ebp - 4]
mov dword [esi], edi
cmp ecx, edi
je 0x488e60
push edi
jmp 0x488e5b
push dword [ebx + 0x6c]
push 0x56f084
call fcn.004114bb
pop ecx
pop ecx
cmp dword [ebp + 0xc], edi
je 0x488e26
cmp eax, edi
je 0x488e26
cmp dword [0x57513c], edi
jne 0x488e26
push 1
push ebx
mov ecx, eax
call fcn.00470fa9
jmp 0x488e53
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x488e3e
push edi
call fcn.0041f8fd
cmp eax, edi
je 0x488e3e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x58]
push dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test eax, eax
je 0x488d4f
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x488e60
push ebx
call fcn.00422515
cmp dword [ebx + 0x6c], edi
je 0x488e9d
lea esi, [ebx + 0x54]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00412643
mov eax, dword [eax + 0x94]
push eax
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push 0x401
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x6c]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x49d4f6
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x521561
call fcn.00500aae
xor edi, edi
cmp dword [0x56ef64], edi
je 0x49d5bf
cmp dword [0x56fc54], 0xfffffffe
jne 0x49d5ac
cmp dword [ebp + 8], 0xffffffff
je 0x49d5bf
test byte [0x576e80], 1
mov esi, 0x576e60
jne 0x49d555
or dword [0x576e80], 1
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.004311a4
push 0x527cb5
call fcn.005003df
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, esi
call fcn.004311fb
cmp dword [0x576e5c], edi
je 0x49d569
call fcn.00410b22
push edi
push edi
push 0x49d49e
call fcn.00504f9a
add esp, 0xc
mov dword [0x576e5c], eax
cmp eax, edi
jbe 0x49d599
cmp eax, 0xffffffff
je 0x49d599
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
mov dword [0x56fc54], eax
jmp 0x49d59f
mov dword [0x576e5c], edi
push 0x576e68
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x49d5bf
mov eax, dword [ebp + 8]
mov dword [0x56fc54], eax
cmp eax, 0xffffffff
jne 0x49d5bf
mov dword [0x576e5c], edi
call fcn.00500b86
ret
Function at 0x4d9823
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x523c49
call fcn.00500b17
mov esi, ecx
mov dword [ebp - 0x22c], esi
call fcn.004df354
push 0x15c
call fcn.00401af3
pop ecx
mov ecx, eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x4d9867
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.004e0c30
jmp 0x4d9869
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.004df326
call fcn.00407d07
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
xor eax, eax
mov dword [ebp - 0x228], esi
mov word [ebp + esi*2 - 0x218], ax
mov dword [ebp - 0x224], ebx
cmp edi, ebx
je 0x4d9a09
cmp dword [edi + 4], ebx
jle 0x4d9a09
lea ecx, [ebp - 0x21c]
call fcn.00402a74
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x4d99ed
lea ecx, [ebp - 0x220]
call fcn.00402a74
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x4d993e
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__s
push eax
call fcn.00402dac
add esp, 0xc
jmp 0x4d9970
jge 0x4d995e
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push str._d__s
push eax
call fcn.00402dac
add esp, 0x10
jmp 0x4d9970
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.004036ce
push 0x15c
call fcn.00401af3
pop ecx
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4d9994
mov ecx, eax
call fcn.004b24fa
mov esi, eax
jmp 0x4d9996
xor esi, esi
push dword [ebp - 0x220]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.00406f58
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x22c]
push esi
call fcn.004df326
mov ecx, dword [ebp - 0x220]
inc dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00401510
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401510
inc ebx
cmp ebx, dword [edi + 4]
jl 0x4d98d7
call fcn.00500b9a
ret
Function at 0x4de4b7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4de4cf
mov edi, dword [esi + 0xc]
jmp 0x4de50f
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4de4e8
call fcn.00408139
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4de4fd
call fcn.00408139
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4de50f
call fcn.00408139
call fcn.00407d07
cmp dword [eax + 0x3c], 0
je 0x4de524
push edi
mov ecx, ebx
call fcn.004dd308
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004de3dd
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4de542
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4de54e
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4e5a37
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x4e5a81
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e5a81
call fcn.004e52f2
test eax, eax
je 0x4e5a81
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.00401350
xor eax, eax
inc eax
jmp 0x4e5c99
cmp dword [ebx + 4], 0x100
push edi
jne 0x4e5c90
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x4e5b7e
push 0x11
call edi
test ax, ax
jl 0x4e5b7e
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e5b7e
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x4e5af1
cmp eax, 0x20
jbe 0x4e5b7e
cmp eax, 0x24
jbe 0x4e5ae4
cmp eax, 0x26
je 0x4e5ae4
cmp eax, 0x28
jne 0x4e5b7e
call fcn.004e52f2
test eax, eax
je 0x4e5b7e
mov ecx, esi
call fcn.0040faa6
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.004e52f2
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x4e5b26
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00401350
jmp 0x4e5c8b
call fcn.0040d999
test eax, eax
je 0x4e5c8b
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.0040da25
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4e5b54
xor edi, edi
jmp 0x4e5b57
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.0040d999
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4e5c8b
mov eax, dword [ebx + 8]
sub eax, 9
je 0x4e5c5a
sub eax, 0x12
je 0x4e5c32
sub eax, 0xb
je 0x4e5ba0
dec eax
dec eax
jne 0x4e5c90
push 0x12
call edi
test ax, ax
jl 0x4e5c90
push 0x11
call edi
test ax, ax
jl 0x4e5c90
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e5c90
call fcn.004e52f2
test eax, eax
jne 0x4e5c8b
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.004e526c
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0040c307
test eax, eax
je 0x4e5c8b
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.0040c307
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4e5c8b
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e5c46
push 0
call fcn.004e526c
mov ecx, esi
call fcn.0040d462
test eax, eax
je 0x4e5c90
mov ecx, esi
call fcn.0040d462
jmp 0x4e5c84
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0040c307
test eax, eax
je 0x4e5c90
push dword [esi + 0x20]
call edi
push eax
call fcn.0040c307
push 0
push esi
mov ecx, eax
call fcn.00405366
mov ecx, eax
call fcn.0040faa6
xor eax, eax
inc eax
jmp 0x4e5c98
push ebx
mov ecx, esi
call fcn.0040a110
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4f2d60
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x51b3fe
call fcn.00500aae
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0x100
jne 0x4f2e39
mov ebx, dword [esi + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x4f2e39
cmp ebx, 0x43
je 0x4f2da2
cmp ebx, 0x2d
jne 0x4f2e39
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4f2e39
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x10]
call fcn.00402a74
movzx ecx, byte [edi + 0xae]
and dword [ebp - 4], 0
push ecx
lea eax, [edi + 0xac]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push eax
lea eax, [ebp - 0x10]
push str.RGB__d___d___d_
push eax
call fcn.00402dac
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
add esp, 0x14
lea eax, [eax + eax + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00401510
mov esi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.0046fce9
call fcn.00500b86
ret 4

Function at 0x4faf1c
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x4faf61
test edi, edi
jl 0x4faf61
cmp ax, 0x20
je 0x4faf56
cmp word [ebp + 8], 0x71
jne 0x4faf61
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x5002a9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x571978]
jne 0x5002b3
repz ret
jmp fcn.005072a6
Function at 0x512b98
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00506c0a
and dword [ebp - 4], 0
cmp dword [0x578c28], 0
mov ebx, eax
jne 0x512c49
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x512cfa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x512cfa
push eax
call fcn.00506b98
mov dword [esp], 0x54fe84
push edi
mov dword [0x578c28], eax
call esi
push eax
call fcn.00506b98
mov dword [esp], 0x54fe70
push edi
mov dword [0x578c2c], eax
call esi
push eax
call fcn.00506b98
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x578c30], eax
call esi
push eax
call fcn.00506b98
pop ecx
mov dword [0x578c38], eax
test eax, eax
je 0x512c49
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00506b98
pop ecx
mov dword [0x578c34], eax
mov eax, dword [0x578c34]
cmp eax, ebx
je 0x512ca1
cmp dword [0x578c38], ebx
je 0x512ca1
push eax
call fcn.00506c13
push dword [0x578c38]
mov esi, eax
call fcn.00506c13
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x512ca1
test edi, edi
je 0x512ca1
call esi
test eax, eax
je 0x512c98
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x512c98
test byte [ebp - 0xc], 1
jne 0x512ca1
or dword [ebp + 0x10], 0x200000
jmp 0x512cda
mov eax, dword [0x578c2c]
cmp eax, ebx
je 0x512cda
push eax
call fcn.00506c13
pop ecx
test eax, eax
je 0x512cda
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x512cda
mov eax, dword [0x578c30]
cmp eax, ebx
je 0x512cda
push eax
call fcn.00506c13
pop ecx
test eax, eax
je 0x512cda
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x578c28]
call fcn.00506c13
pop ecx
test eax, eax
je 0x512cfa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x512cfc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410ace
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp - 0x30]
pushal
xchg ecx, eax
lea esp, [esp + 0x24]
call fcn.00410cf1
xchg dword [esp - 4], ebx
dec ebx
movzx ecx, bx
loop 0x410ae5
mov bx, cx
add edx, eax
lea edi, [0x20d6b940]
mov ecx, dword [ebx + 0x3c]
not ah
nop
xchg edi, edi
sub ecx, 0x7fffffff
ja 0x410ae1
mov dh, ch
not edi
cmp ecx, 0x1191
setno al
test dl, ah
cmp al, 1
jge 0x410ae1
nop
mov al, 0x53
cdq
mov ecx, dword [ecx + ebx - 0x80000000]
add cx, 0xffbb
setne al
cmp al, 0
jg 0x410ae1
xor edi, ebp
mov cl, 0x54
push 0x2c6192f4
mov dl, 0x87
call fcn.00410d1a
mov dh, 0
xchg dh, al
mov cl, 0x75
sbb eax, 0x168b012d
mov dword [esp + 0x44], esi
call fcn.00410a78
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], 4
xchg dl, cl
lea edx, [ebp - 0x1a9c6031]
jb 0x410c97
mov eax, dword fs:[0x18]
or eax, eax
js 0x410c66
jmp 0x410c5a
inc esi
mov eax, dword [eax + 0x34]
jmp 0x410c74
push 0x9d75b380
not cl
call fcn.00410d1a
call esi
add al, 0
lea ecx, [edi]
jne 0x410c83
inc edx
dec eax
and al, 0xff
call fcn.00410c08
push 0xe10b3884
call fcn.00410d1a
xchg ecx, ecx
xchg ah, al
push dword [esp + 0x34]
call esi
pop edi
jmp 0x410c9d
pop esi
pop ebp
mov ebx, dword [esp + 4]
xchg cl, al
add esp, 8
pop edx
pop ecx
pop eax
ret 0x2c
Function at 0x4b38d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x9dd3a0]
xor edx, edx
cmp eax, edx
jne 0x4b38f6
xor eax, eax
mov byte [eax + 0x9dd2a0], al
inc eax
cmp eax, 0x100
jl 0x4b38de
mov dword [0x9dd3a0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x9dd2a0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4b3987
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4b395a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4b3928
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4b3a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4b3a53
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4b3a3a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b7cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x4b7f11
cmp eax, 8
jg 0x4b7f11
cmp dword [esp + 0x8c], 2
jl 0x4b7f11
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4b7f11
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4b7f11
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4b7d77
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x4b7efa
mov ebp, dword [0x5495f4]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x4b7da9
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x4b7ee1
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x4b7dc9
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x5495e0]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4b7e08
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x5495e8]
lea ecx, [esp + 0x28]
push ecx
call dword [0x549628]
test eax, eax
jne 0x4b7ec8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.004b7300
cmp eax, 1
jne 0x4b7ef2
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004b7bb0
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x4b7dbd
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x4b7efa
jmp 0x4b7d94
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.004b6f00
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c