joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45db38
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor edx, edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45dd03
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45dce1
mov dl, 1
mov eax, dword [0x413658]
call fcn.00403634
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004043d8
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x45dcca
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
call fcn.0044802c
test al, al
je 0x45dcbe
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea ecx, [ebp - 0x264]
mov edx, 0x45dd14
lea eax, [ebp - 0x25c]
call fcn.004097c0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45dcbe
xor eax, eax
push ebp
push 0x45dcb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x45dd4c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45dca0
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.00404648
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45dca0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.00404648
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dcbe
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x45dbad
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dl, 1
call fcn.00417d74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dd0a
lea eax, [ebp - 0x268]
call fcn.004043d8
ret
Function at 0x45e83c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x46cbb0]
cmp byte [eax + 0xa5], 0
jne 0x45e8b3
cmp dword [0x46cbc8], 0
jne 0x45e871
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45e7f8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x46cbc8], eax
cmp dword [0x46cbc4], 0
jne 0x45e88c
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x46cbc4], eax
cmp dword [0x46cbcc], 0
jne 0x45e8b3
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x45e798
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x46cbcc], eax
pop ecx
pop ebp
ret

Function at 0x45e97c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.0045e914
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x45e99d
xor eax, eax
call fcn.0045e94c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x45e9b7
mov al, 1
call fcn.0045e94c
mov esp, ebp
pop ebp
ret

Function at 0x45f080
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x46cbb0]
cmp dword [eax + 0x30], 0
je 0x45f14a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x45f141
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x45f000
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
cmp dword [eax + 8], 0
je 0x45f141
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45f0fb
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x45f141
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
call fcn.00415a44
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x45f110
mov eax, dword [ebp - 4]
inc dword [eax + 0x94]
mov esp, ebp
pop ebp
ret

Function at 0x45fe60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa4], 0
je 0x45fea5
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.004044c8
jmp 0x45feb6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x8c]
call fcn.0040442c
mov esp, ebp
pop ebp
ret
Function at 0x4613e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x46143b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.004423f0
test al, al
je 0x46143b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00441f20
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46143b
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00441f20
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x461ee8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 1
push 0
mov eax, esi
call fcn.00404898
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
xor eax, eax
push ebp
push 0x461f60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp + 0x14]
call fcn.00404898
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461f67
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
Function at 0x462088
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
xor eax, eax
push ebp
push 0x462268
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.00404698
mov edx, dword [ebp + 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x14], 1
jl 0x462245
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4620f7
lea eax, [ebp - 4]
mov edx, 0x462284
call fcn.004046a0
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x10]
mov edx, 0x462284
mov eax, dword [ebp - 4]
call fcn.004622dc
mov eax, dword [ebp - 0x10]
call fcn.00404898
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
xor eax, eax
push ebp
push 0x46223e
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x462227
xor esi, esi
mov eax, edi
mov edx, 0x104
call fcn.00404a24
mov eax, dword [edi]
call fcn.00404698
mov edx, dword [ebp + 8]
mov dword [edx - 8], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
push 0
push 0
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [edi]
call fcn.00404898
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4621b4
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, edi
call fcn.00404a24
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [edi]
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x14]
call fcn.00462088
pop ecx
test al, al
je 0x46221e
dec esi
jmp 0x46221e
mov eax, dword [ebp + 8]
add eax, 0xffffffe4
mov edx, dword [ebp - 4]
call fcn.00404470
mov eax, dword [0x46b8d0]
cmp dword [eax], 2
je 0x462200
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x1c]
cmp byte [edx + eax - 1], 0x5c
jne 0x462200
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
mov edx, 0x462284
call fcn.004622dc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, 0xffffffe4
call fcn.00404470
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
call fcn.00404898
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 5]
inc esi
test ebx, ebx
je 0x462141
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462245
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46226f
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004043fc
lea eax, [ebp - 4]
call fcn.004043d8
ret
Function at 0x4623cc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov esi, eax
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 4], eax
push 0
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 8], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_AttachThreadInput
xor eax, eax
push ebp
push 0x46247f
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_SetForegroundWindow
push esi
call sub.user32.dll_SetActiveWindow
push esi
call sub.user32.dll_SetFocus
test bl, bl
je 0x46242b
call sub.user32.dll_WaitMessage
push 0x43
push 0
push 0
push 0
push 0
push 0
push esi
call sub.user32.dll_SetWindowPos
push esi
call sub.user32.dll_IsIconic
test eax, eax
je 0x462459
push 0
push 0xf120
push 0x112
push esi
call sub.user32.dll_SendMessageA
test bl, bl
je 0x462462
call sub.user32.dll_WaitMessage
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462486
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_AttachThreadInput
ret

Function at 0x462614
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x46261c
push ecx
push ebx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x462765
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402dec
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.00402dec
mov eax, dword [ebp - 0x10]
mov edx, 0x46277c
call fcn.004047e4
sete bl
test bl, bl
je 0x46268d
mov eax, dword [ebp - 0xc]
call fcn.004627ac
cmp byte [ebp - 1], 0
je 0x46274a
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.00402dec
mov eax, dword [ebp - 0x14]
call fcn.004627ac
jmp 0x46274a
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00404a24
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 8]
call fcn.00404698
push eax
call sub.kernel32.dll_GetTempPathA
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404a24
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00408f60
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0040d634
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
pop ecx
call fcn.004046e4
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x46b778]
mov eax, dword [eax]
call fcn.00460c44
mov eax, dword [ebp - 0x20]
call fcn.00404898
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x46274a
push 0x46278c
push dword [ebp - 8]
push 0x462798
push 0x4627a8
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00462524
push dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 5
call fcn.00404758
push 5
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46276c
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.004043fc
ret
Function at 0x4627ac
Capabilities:
Delete file
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4627b4
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x462a83
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x46b8d0]
cmp dword [eax], 2
jne 0x4627f0
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x462a60
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00404a24
mov eax, dword [ebp - 8]
call fcn.00404698
push eax
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
push 0x462a90
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x462a60
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004084c8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00404470
mov dl, 1
mov eax, dword [0x413658]
call fcn.00403634
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x462a59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00408d44
test al, al
je 0x46294e
mov dl, 1
mov eax, dword [0x413658]
call fcn.00403634
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x462947
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov edx, 0x462ab0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov ebx, eax
test ebx, ebx
jge 0x4628ae
call fcn.00403e98
call fcn.00403e98
jmp 0x462a60
inc ebx
jmp 0x4628e8
lea ecx, [ebp - 0x24]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004084c8
cmp dword [ebp - 0x20], 0
je 0x4628e7
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp ebx, eax
jge 0x462931
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x34]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.004084c8
mov eax, dword [ebp - 0x30]
mov ecx, 1
mov edx, 1
call fcn.004048f8
mov eax, dword [ebp - 0x2c]
mov edx, 0x462ac4
call fcn.004047e4
jne 0x4628b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46294e
mov eax, dword [ebp - 0x10]
call fcn.00403664
ret
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x42ae38]
call fcn.0042aee8
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4629a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x462ad0
mov eax, dword [ebp - 0x14]
call fcn.0042af30
test al, al
je 0x46298c
mov edx, 0x462ad0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4629a9
mov eax, dword [ebp - 0x14]
call fcn.00403664
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462a8a
lea eax, [ebp - 0x3c]
mov edx, 9
call fcn.004043fc
lea eax, [ebp - 8]
call fcn.004043d8
ret
Function at 0x462bb4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x462d22
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00462b14
mov ebx, eax
test ebx, ebx
je 0x462cff
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.user32.dll_GetWindowRect
push 0
push 0x462d30
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x462c2e
push 0
push 0
push 0x132f
push esi
call sub.user32.dll_SendMessageA
inc eax
lea edx, [ebp - 0x70]
call fcn.0040878c
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 8]
mov edx, 0x462d48
call fcn.004046e4
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00406e90
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
xor eax, eax
push ebp
push 0x462cd9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 8]
mov edx, 0x462d54
call fcn.004046e4
mov eax, dword [ebp - 0x74]
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x462cae
call fcn.00403e98
jmp 0x462cff
push 0xffffffffffffffff
mov eax, dword [ebp - 0x6c]
push eax
call sub.user32.dll_WaitForInputIdle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462ce0
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462d29
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004043fc
lea eax, [ebp - 8]
call fcn.004043d8
ret
Function at 0x463094
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
mov edi, eax
xor eax, eax
push ebp
push 0x46324f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x46b8b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
test eax, eax
jne 0x4630c9
xor esi, esi
jmp 0x4630d6
mov edx, dword [0x46b8b8]
call fcn.00441f20
mov esi, eax
xor ebx, ebx
test byte [ebp - 4], 4
je 0x4630eb
xor ebx, ebx
test byte [ebp - 4], 8
je 0x4630eb
mov ebx, 1
mov ax, word [ebp - 4]
not eax
and ax, word [0x463264]
jne 0x4630ff
mov ebx, 5
mov ax, word [ebp - 4]
not eax
and ax, word [0x463268]
jne 0x463113
mov ebx, 2
mov ax, word [ebp - 4]
not eax
and ax, word [0x46326c]
jne 0x463132
mov ebx, 4
test byte [ebp - 4], 8
je 0x463132
mov ebx, 3
lea edx, [ebp - 8]
mov eax, dword [0x46b778]
mov eax, dword [eax]
call fcn.0045fe60
mov eax, dword [0x46b4fc]
cmp byte [eax], 0
je 0x463191
lea eax, [ebp - 8]
mov edx, pe_nt_image_headers32
call fcn.00404a24
mov eax, dword [ebp - 8]
call fcn.00404698
dec eax
push eax
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404a24
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004084c8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404470
or ebx, dword [ebp + 8]
xor eax, eax
mov al, byte [ebp - 1]
or ebx, dword [eax*4 + 0x469e28]
or ebx, 0
or ebx, 0x10000
or ebx, 0x40000
push ebx
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, edi
call fcn.00404898
push eax
push esi
call sub.user32.dll_MessageBoxA_1
xor ebx, ebx
cmp eax, 0xb
ja case.0x4631ce.0
jmp dword [eax*4 + 0x4631d5]
mov ebx, 3
jmp case.0x4631ce.0
mov ebx, 2
jmp case.0x4631ce.0
mov ebx, 5
jmp case.0x4631ce.0
mov ebx, 7
jmp case.0x4631ce.0
mov ebx, 1
jmp case.0x4631ce.0
mov ebx, 4
jmp case.0x4631ce.0
mov ebx, 6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463256
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004043fc
ret
Function at 0x4639b4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.0046393c
mov eax, esi
call fcn.00408d44
test al, al
je 0x463acf
mov dl, 1
mov eax, dword [0x413948]
call fcn.00403634
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x463ac8
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004187e0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 4]
push eax
push 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x463488]
call fcn.00463db8
mov esi, eax
mov dword [ebx + 8], esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x3c]
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4634ec]
call fcn.00463e38
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00417ec4
mov edi, eax
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x463a96
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4635b8]
call fcn.00463f04
mov esi, eax
mov eax, dword [ebx + 0x10]
mov edx, esi
call fcn.00415844
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x14]
cmp eax, dword [ebp - 8]
jae 0x463a8e
mov dword [ebp - 8], eax
add edi, 0x28
dec dword [ebp - 0xc]
jne 0x463a61
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 8]
sub eax, edi
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x463550]
call fcn.00463ea4
mov dword [ebx + 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463acf
mov eax, dword [ebp - 4]
call fcn.00403664
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x467274
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov ebp, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.0040442c
mov eax, dword [esi]
call fcn.00404698
mov edi, eax
test edi, edi
jle 0x4672b0
mov ebx, 1
mov eax, esi
call fcn.004048f0
mov edx, ebp
mov ecx, dword [esi]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x467299
pop ebp
pop edi
pop esi
pop ebx
ret