joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ffa44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ffad1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00405d1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ffa8c
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405a8c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405d1c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004ff944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ffad8
lea eax, [ebp - 0x14]
call fcn.004055fc
ret

Function at 0x508114
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x508165
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x50814c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x50813c
jmp 0x508165
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x50814d
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51d9d4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x51da02
mov eax, ebx
call fcn.0051e488
cmp dword [ebx + 0x40], 0
je 0x51d9fb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x51da73
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x51da65
cmp dword [ebx + 8], 0
je 0x51da24
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x51da36
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x51da65
cmp dword [ebx + 8], 0
je 0x51da17
cmp eax, 3
je 0x51da49
dec eax
jne 0x51da17
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x51da17
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x51da17
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x51da91
cmp dword [ebx + 0x14], 0xcc
je 0x51da91
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0051da9c
pop ebx
ret
Function at 0x538054
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x5380a5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x53808c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x53807c
jmp 0x5380a5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x53808d
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53acc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x53acea
cmp dword [ebx + 0x64], 0
jne 0x53acea
cmp dword [ebx + 0x6c], 0
jne 0x53acea
mov edi, esi
jmp 0x53ad71
cmp edi, 0xffffffff
jne 0x53acf2
dec edi
jmp 0x53ad71
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x53ad71
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00539a84
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x53ad3f
mov cx, word [esp]
sub cx, si
jmp 0x53ad41
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x53ad28
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x53ad67
mov cx, word [esp]
sub cx, si
jmp 0x53ad69
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x53ad50
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x53adce
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0053aa5c
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x53adb9
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x53adce
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x53acca
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x543710
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x6606cc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x543732
shr eax, 1
xor eax, 0xedb88320
jmp 0x543734
shr eax, 1
dec edx
jne 0x543720
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x543719
mov dword [0x650b70], 1
pop esi
pop ebx
ret
Function at 0x543754
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [0x650b70]
test al, al
jne 0x543772
call fcn.00543710
mov eax, 4
lea edx, [ebp - 8]
movzx ebx, byte [edx]
mov ecx, dword [ebp - 4]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x6606cc]
shr ecx, 8
xor ebx, ecx
mov dword [ebp - 4], ebx
inc edx
dec eax
jne 0x54377a
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x5437c8
inc edx
xor eax, eax
movzx ebx, byte [esi + eax]
mov ecx, dword [ebp - 4]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x6606cc]
shr ecx, 8
xor ebx, ecx
mov dword [ebp - 4], ebx
inc eax
dec edx
jne 0x5437a6
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x57d8b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57da3f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [esi], eax
test ebx, ebx
je 0x57da29
cmp dword [ebx + 4], 0
je 0x57da29
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x57d905
cmp eax, 0x14
jae 0x57d90b
jmp 0x57da29
jl 0x57da29
push 0
push 0
mov eax, ebx
call fcn.00421e48
mov eax, dword [0x65a5e4]
cmp byte [eax], 0
je 0x57da1b
mov eax, dword [ebx + 4]
call fcn.0057d014
cmp al, 4
jne 0x57da1b
xor edx, edx
push ebp
push 0x57da0f
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10d]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405d1c
mov eax, dword [ebp - 4]
call fcn.00405a8c
push eax
mov eax, dword [0x6521f0]
push eax
push 0x57da50
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetTempFileNameA
inc dword [0x6521f0]
mov edx, dword [ebp - 4]
mov eax, 0x57da5c
call fcn.00405bd8
mov edx, eax
dec edx
lea eax, [ebp - 4]
call fcn.00405d1c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x25c]
call fcn.0040384c
mov edx, 1
lea eax, [ebp - 0x25c]
call fcn.00403e74
call fcn.00403108
push 0
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
lea eax, [ebp - 0x25c]
call fcn.004039a0
call fcn.00403108
lea eax, [ebp - 0x25c]
call fcn.004039c0
call fcn.00403108
push 1
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x536a60]
call fcn.00537058
mov dword [ebp - 8], eax
mov byte [edi], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57da29
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.0057d548
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57da46
lea eax, [ebp - 4]
call fcn.004055fc
ret
Function at 0x58f098
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x58f109
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x656360]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x58f0f3
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0058f080
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x58ee14]
call fcn.0058f134
mov dword [0x6563c4], eax
mov eax, dword [ebp - 4]
call fcn.0058f028
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58f110
lea eax, [ebp - 8]
call fcn.0040761c
ret

Function at 0x5923f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5924ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405ddc
mov eax, dword [0x65ab98]
cmp dword [eax], 2
jne 0x592463
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.0040623c
mov eax, dword [ebx]
call fcn.00405f64
push eax
mov eax, dword [ebx]
call fcn.00405f54
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405f64
mov edx, eax
dec edx
mov eax, ebx
call fcn.0040623c
jmp 0x592495
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040b7cc
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5924b5
lea eax, [ebp - 0x3f0]
call fcn.004055fc
ret
Function at 0x5a0b48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x660e5c
test esi, esi
jne 0x5a0b62
xor eax, eax
jmp 0x5a0c53
cmp dword [ebp], 0
jne 0x5a0b6d
call fcn.005a0ad8
xor ebx, 0xffffffff
cmp edi, 8
jb 0x5a0c2d
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x5a0b79
test edi, edi
jbe 0x5a0c4e
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x5a0c31
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c365c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x5c380f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043a318
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.0046c3b0
call fcn.005bf288
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x5c36e0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.00434138
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043a318
mov eax, dword [eax + 0xc]
pop edx
call fcn.00434140
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00434020
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.0040b630
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043a318
call fcn.00435470
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00434094
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.004340d0
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.004340d0
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.004340d0
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00434138
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043a318
mov eax, dword [eax + 0xc]
pop edx
call fcn.00433fcc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043a318
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x13
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.00433d50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c3816
lea eax, [ebp - 4]
call fcn.004055fc
ret
Function at 0x5cabc0
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040b07c
test al, al
je 0x5cac47
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403cd0
or esi, 0x100
test esi, esi
jns 0x5cabfb
call fcn.00404584
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00405a8c
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x5cac47
mov dl, 1
mov eax, dword [0x432df0]
call fcn.0043ba6c
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.0043be90
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x5cac47
mov eax, esp
call fcn.0041069c
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x5f0a40
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.005f0a2c
test eax, eax
jne 0x5f0a61
mov eax, esi
call fcn.004055fc
jmp 0x5f0af2
mov eax, ebx
call fcn.005f0b88
test al, al
je 0x5f0aa7
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004056ec
test edi, edi
je 0x5f0a9e
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
jmp 0x5f0af2
mov eax, esi
call fcn.004055fc
jmp 0x5f0af2
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x5f0aeb
mov eax, dword [ebp + 0x250]
call fcn.00420200
test eax, eax
jle 0x5f0ad9
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x250]
mov edx, edi
call fcn.004c0d14
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00405650
jmp 0x5f0af2
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x258]
call fcn.00405650
jmp 0x5f0af2
mov eax, esi
call fcn.004055fc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x608a70
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x608a88
mov eax, ebx
call fcn.006082cc
cmp dword [ebx + 0x68], 0
jne 0x608a95
mov eax, ebx
call fcn.00608264
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.006080e4
lea eax, [esp + 0x10]
xor edx, edx
call fcn.005ca27c
cmp eax, dword [esp]
je 0x608b03
lea eax, [esp + 0x10]
xor edx, edx
call fcn.005ca290
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x608adf
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005ca27c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x608af8
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x608b1e
push 3
mov eax, dword [esi + 0x10]
call fcn.0047d6c4
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x608b2b
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.00492c94
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00492cd0
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00474d1c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00474d50
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00407cfc
mov eax, ebp
mov edx, dword [0x65a360]
mov byte [edx + 2], al
mov eax, dword [0x65a360]
mov byte [eax], 0
mov eax, dword [0x65a360]
mov byte [eax + 1], 0
mov eax, dword [0x65a360]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0047d6c4
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0047d6c4
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0047d6c4
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x65a360]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0043a318
call fcn.00435470
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0047d6c4
push eax
mov eax, dword [0x65a31c]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.0047d6c4
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x60c3dc
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.00407ce0
push esi
push 0
push 0x419
mov eax, ebx
call fcn.0047d6c4
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret

Function at 0x60f628
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x60f657
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x60f6d6
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0060debc
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x60f6a4
mov cx, word [esp]
sub cx, si
jmp 0x60f6a6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x60f68d
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x60f6cc
mov cx, word [esp]
sub cx, si
jmp 0x60f6ce
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x60f6b5
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x60f733
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0060f2fc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x60f71e
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x60f733
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x60f632
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x615c60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 1
test al, al
je 0x615c8f
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x615c92
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x615c76
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x661024], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x615c6b
mov byte [0x661424], 1
mov esp, ebp
pop ebp
ret

Function at 0x615cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp byte [0x661424], 0
jne 0x615ce3
call fcn.00615c60
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x615d22
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x661024]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x615cf6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret