joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439708
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x49bef4]
cmp byte [eax + 0xc], 0
je 0x439875
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43986e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49cb68], 0
jne 0x43975c
push 0x43987c
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x439884
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb68], eax
cmp dword [0x496b24], 0
jne 0x439857
push 0x439894
call sub.kernel32.dll_LoadLibraryA
mov dword [0x496b24], eax
cmp dword [0x496b24], 0
je 0x439857
push 0x4398a0
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb6c], eax
push 0x4398b0
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb70], eax
push 0x4398c4
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb74], eax
push 0x4398dc
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb78], eax
push 0x4398f4
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb7c], eax
push 0x439908
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb80], eax
push 0x439920
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb84], eax
push 0x439938
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb88], eax
push 0x439954
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb8c], eax
push 0x439960
mov eax, dword [0x496b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49cb90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439875
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x43d700
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404698
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43d74f
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404908
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x444ef8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x444f48]
test si, 4
je 0x444f0c
or bl, 1
test si, 8
je 0x444f16
or bl, 4
test si, 1
je 0x444f20
or bl, 8
test si, 2
je 0x444f2a
or bl, 0x10
test si, 0x10
je 0x444f34
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x444f43
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x444f4c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x444f84]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x444f65
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x444f74
or bl, 4
test esi, 0x20000000
je 0x444f7f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44b648
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44b65a
add esp, 0xfffffff0
call fcn.00403b18
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b43c
mov eax, dword [0x49b8ec]
mov dword [eax + 4], ebx
mov dword [eax], 0x44b9ec
mov eax, dword [0x49b8f8]
mov dword [eax + 4], ebx
mov dword [eax], 0x44b9f8
mov eax, ebx
call fcn.0044ba04
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412d90]
call fcn.004037c8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412d90]
call fcn.004037c8
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412d90]
call fcn.004037c8
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412d90]
call fcn.004037c8
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412d90]
call fcn.004037c8
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x447e1c
push eax
push 0
push 0
mov eax, dword [0x49bb60]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41d1ac]
call fcn.0041e614
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41d1ac]
call fcn.0041e614
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41d1ac]
call fcn.0041e614
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044be54
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44bd1c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44bd1c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44bd1c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44b797
call fcn.00403b70
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44bb00
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44bcab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44bc8c
mov dl, 1
mov eax, dword [0x4131ac]
call fcn.004037c8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404698
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44bc7b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00439a68
test al, al
je 0x44bc6e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44bcbc
lea eax, [ebp - 0x254]
call fcn.00409e04
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44bc6e
xor eax, eax
push ebp
push 0x44bc67
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44bcf4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44bc50
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404908
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44bc50
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bc6e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44bb71
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00417124
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bcb2
lea eax, [ebp - 0x260]
call fcn.00404698
ret

Function at 0x44c5f4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x49cbb4]
cmp byte [eax + 0xa5], 0
jne 0x44c665
cmp dword [0x49cbcc], 0
jne 0x44c626
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44c5b0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49cbcc], eax
cmp dword [0x49cbc8], 0
jne 0x44c641
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x49cbc8], eax
cmp dword [0x49cbd0], 0
jne 0x44c665
push esp
push 0
push 0
push 0x44c554
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x49cbd0], eax
pop edx
ret
Function at 0x44ccf8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x49cbb4]
cmp dword [eax + 0x30], 0
je 0x44cda2
cmp dword [ebx + 0x94], 0
jne 0x44cd9c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44cc88
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44cd9c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44cd62
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44cd9c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00415154
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44cd71
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44d900
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44d935
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404788
jmp 0x44d942
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046ec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44e8f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44e939
mov eax, esi
call fcn.00435270
test al, al
je 0x44e939
mov eax, dword [ebx + 0x84]
call fcn.00435010
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44e939
push 0
mov eax, dword [ebx + 0x84]
call fcn.00435010
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4503e4
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00450fc8
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x450ebc
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff1c
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0xc]
cmp esi, 0x40
jle 0x450f03
lea eax, [ebp - 0x64]
call fcn.004503e4
mov edx, ebx
lea eax, [ebp - 0x64]
mov ecx, esi
call fcn.0045040c
lea edx, [ebp - 0x64]
mov eax, dword [ebp + 8]
call fcn.004504dc
mov esi, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x450f06
mov dword [ebp - 0xc], ebx
xor ecx, ecx
lea eax, [ebp - 0xa4]
lea edx, [ebp - 0xe4]
lea ebx, [ecx + 1]
cmp esi, ebx
jl 0x450f34
mov ebx, dword [ebp - 0xc]
mov bl, byte [ebx]
xor bl, 0x36
mov byte [eax], bl
mov ebx, dword [ebp - 0xc]
mov bl, byte [ebx]
xor bl, 0x5c
mov byte [edx], bl
inc dword [ebp - 0xc]
jmp 0x450f3a
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x450f14
lea eax, [ebp - 0x64]
call fcn.004503e4
lea edx, [ebp - 0xa4]
lea eax, [ebp - 0x64]
mov ecx, 0x40
call fcn.0045040c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 8]
call fcn.00450d90
lea edx, [ebp - 0x64]
mov eax, dword [ebp + 8]
call fcn.004504dc
lea eax, [ebp - 0x64]
call fcn.004503e4
lea edx, [ebp - 0xe4]
lea eax, [ebp - 0x64]
mov ecx, 0x40
call fcn.0045040c
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x64]
mov ecx, 0x10
call fcn.0045040c
lea edx, [ebp - 0x64]
mov eax, dword [ebp + 8]
call fcn.004504dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x457bb8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
xor esi, esi
mov ebx, dword [esp]
jmp 0x457bcc
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x457bcb
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
shl eax, 2
mov ebx, eax
mov eax, edi
mov edx, ebx
call fcn.00404ce4
xor ebx, ebx
cmp esi, dword [esp]
jge 0x457d35
inc ebx
mov eax, edi
call fcn.00404bb0
mov dl, byte [ebp + esi]
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov dl, byte [edx + 0x496f64]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jge 0x457ced
inc ebx
mov eax, edi
call fcn.00404bb0
mov dl, byte [ebp + esi]
and dl, 3
and edx, 0xff
shl edx, 4
mov cl, byte [ebp + esi + 1]
and cl, 0xf0
and ecx, 0xff
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x496f64]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jge 0x457cbc
inc ebx
mov eax, edi
call fcn.00404bb0
mov dl, byte [ebp + esi + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov cl, byte [ebp + esi + 2]
and cl, 0xc0
and ecx, 0xff
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x496f64]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00404bb0
mov dl, byte [ebp + esi + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x496f64]
mov byte [eax + ebx - 1], dl
jmp 0x457d29
inc ebx
mov eax, edi
call fcn.00404bb0
mov dl, byte [ebp + esi + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov dl, byte [edx + 0x496f64]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00404bb0
mov byte [eax + ebx - 1], 0x3d
jmp 0x457d29
inc ebx
mov eax, edi
call fcn.00404bb0
mov dl, byte [ebp + esi]
and dl, 3
and edx, 0xff
shl edx, 4
mov dl, byte [edx + 0x496f64]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00404bb0
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.00404bb0
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jl 0x457bfd
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x459068
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x4970b4
mov ecx, dword [esp]
lea edx, [esp + 0xc]
xor ebx, ebx
mov bl, byte [edi]
mov bl, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x459087
mov esi, 1
mov edx, 0x4971bc
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
xor ebx, ebx
mov bl, byte [esp + eax + 0x11]
add edi, ebx
xor ebx, ebx
mov bl, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x459101
dec ebx
je 0x459125
dec ebx
je 0x459149
dec ebx
je 0x45916c
jmp 0x459185
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x459185
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x459185
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x459185
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4590ee
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4590a3
mov esi, 0x20
mov eax, 0x4970e4
mov edx, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4591aa
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4591e4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x49716b]
test bl, bl
jbe 0x459215
lea eax, [esi + 0x3e0]
call fcn.004591c4
lea eax, [esi + 0x3fc]
call fcn.004591c4
dec bl
jne 0x4591fb
mov cl, 0x30
mov edi, 0x49713c
mov eax, dword [esp]
mov dl, byte [edi]
cmp dl, 0x1c
ja 0x459237
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x459246
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x45921f
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x459254
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.00458ffc
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x459270
mov bl, 0x1c
mov esi, 0x497104
lea edi, [ebp - 0x41]
mov dl, byte [esi]
mov eax, dword [ebp - 8]
call fcn.00458ffc
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.00458ffc
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x45928c
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004591e4
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4592b4
mov bl, 1
mov eax, 0x497034
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4592ed
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4592fa
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4592d9
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x459324
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.00459068
jmp 0x45934c
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.00459068
mov bl, 0x20
lea eax, [ebp - 0xa1]
mov dl, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x459354
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x45930c
mov bl, 0x40
mov esi, 0x497074
lea eax, [ebp - 0x3e1]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x4593ba
and edx, 0xff
mov dl, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4593c9
and edx, 0xff
mov dl, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4593a2
mov bl, 1
lea esi, [ebp - 0x3e1]
mov cl, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.00459024
inc ebx
inc esi
cmp bl, 0x41
jne 0x4593d7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4595ac
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x459658
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x459653
mov eax, ebp
mov edx, 8
call fcn.00404ce4
push 1
mov eax, ebp
call fcn.00404bb0
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.00459254
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x468c34
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x1000c871
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp esi, 0x7ff80000
jbe 0x1000c892
lea edi, [esi - 0x7ff80000]
cmp esi, 0x80000000
jb 0x1000c897
mov ebx, 0xfff80000
jmp 0x1000c89d
mov edi, 0x10000
lea ebx, [esi + 0x7ff80000]
mov edx, dword [0x10013e68]
mov eax, dword [0x10013e60]
test edx, edx
jne 0x1000c8b8
test eax, eax
je 0x1000c8cb
mov edx, eax
mov dword [0x10013e68], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x1000c8cb
cmp ecx, edi
jb 0x1000c8cb
cmp ecx, ebx
jbe 0x1000c9ab
mov edx, eax
test eax, eax
jmp 0x1000c8ed
test edx, edx
je 0x1000c8e8
mov eax, dword [edx + 8]
test eax, eax
je 0x1000c8e8
cmp eax, edi
jb 0x1000c8e8
cmp eax, ebx
jbe 0x1000c9ab
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x10013e68], edx
jne 0x1000c8d1
and esi, 0xffff0000
mov eax, 0x40000000
cmp esi, eax
jbe 0x1000c9d0
lea edx, [esi - 0x40000000]
mov ecx, edi
call fcn.10007073
mov edx, eax
test edx, edx
jne 0x1000c971
mov eax, 0x40000000
cmp esi, eax
jbe 0x1000c93e
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.10007073
mov edx, eax
test edx, edx
jne 0x1000c971
mov eax, 0x40000000
cmp esi, eax
jae 0x1000c953
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.10007073
mov edx, eax
test edx, edx
jne 0x1000c971
mov edx, esi
mov ecx, edi
call fcn.10007073
mov edx, eax
test edx, edx
jne 0x1000c971
mov edx, ebx
mov ecx, esi
call fcn.10007073
mov edx, eax
test edx, edx
je 0x1000c9ee
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x10013e60]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10013e68], edx
mov dword [0x10013e60], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x1000c99b
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, edi
jb 0x1000c9ee
cmp esi, ebx
ja 0x1000c9ee
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.1000ec20
add esp, 0xc
mov eax, esi
jmp 0x1000c9f0
jae 0x1000c920
lea ecx, [esi + 0x40000000]
mov edx, ebx
call fcn.10007073
mov edx, eax
test edx, edx
jne 0x1000c971
jmp 0x1000c940
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1000ca7b
Capabilities:
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [0x10013e58]
xor ebx, ebx
test edi, edi
je 0x1000cab8
push esi
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1000caa9
mov esi, dword [edi]
push edi
call fcn.1000dd99
mov edi, esi
pop ecx
test esi, esi
jne 0x1000ca8a
jmp 0x1000cab7
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
mov dword [0x10013e70], ebx
pop esi
mov dword [0x10013e58], edi
mov eax, ebx
pop edi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx