joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b400
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7931
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x4d404c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x264]
push eax
call fcn.00475db0
add esp, 4
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x270], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x270]
push edx
mov ecx, dword [ebp + 8]
call fcn.00407520
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x264]
call fcn.004074c0
push str.config.ini
lea ecx, [ebp - 0x24c]
call fcn.00407560
mov dword [ebp - 4], 1
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x234]
push edx
call fcn.0040e420
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24c]
call fcn.004074c0
lea eax, [ebp - 0x234]
push eax
call fcn.0040ac50
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x46b4eb
mov byte [ebp - 0x265], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.004074c0
mov al, byte [ebp - 0x265]
jmp 0x46b55c
push 0x20a
push 0
lea edx, [ebp - 0x21c]
push edx
call fcn.0047a110
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.00407400
push eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x4b8ea0
push str.VersionNew
push str.Pdf2Word
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00407460
mov byte [ebp - 0x266], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.004074c0
mov al, byte [ebp - 0x266]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477254
mov esp, ebp
pop ebp
ret
Function at 0x46d680
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8061
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x4d404c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2b0], 0
lea eax, [ebp - 0x24c]
push eax
call fcn.0046db60
add esp, 4
mov dword [ebp - 4], 1
push str.config.ini
lea ecx, [ebp - 0x264]
call fcn.00407560
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x264]
push ecx
lea edx, [ebp - 0x24c]
push edx
lea eax, [ebp - 0x234]
push eax
call fcn.0040e420
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x264]
call fcn.004074c0
lea ecx, [ebp - 0x234]
push ecx
call fcn.0040ac50
add esp, 4
movzx edx, al
test edx, edx
jne 0x46d763
push 0x4b8ea0
mov ecx, dword [ebp + 8]
call fcn.00407560
mov eax, dword [ebp - 0x2b0]
or eax, 1
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.004074c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.004074c0
mov eax, dword [ebp + 8]
jmp 0x46d8ec
push 0x20a
push 0
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0047a110
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.00407400
push eax
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0x4b8ea0
push str.Version
push str.Upgrade
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x2b4], eax
mov ecx, dword [ebp - 0x2b4]
add ecx, 2
mov dword [ebp - 0x2bc], ecx
mov edx, dword [ebp - 0x2b4]
mov ax, word [edx]
mov word [ebp - 0x2b6], ax
add dword [ebp - 0x2b4], 2
cmp word [ebp - 0x2b6], 0
jne 0x46d7c1
mov ecx, dword [ebp - 0x2b4]
sub ecx, dword [ebp - 0x2bc]
sar ecx, 1
mov dword [ebp - 0x2c0], ecx
jne 0x46d83a
push 0x4b8ea0
mov ecx, dword [ebp + 8]
call fcn.00407560
mov edx, dword [ebp - 0x2b0]
or edx, 1
mov dword [ebp - 0x2b0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.004074c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.004074c0
mov eax, dword [ebp + 8]
jmp 0x46d8ec
lea eax, [ebp - 0x2ac]
push eax
call fcn.0046d5a0
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x27c]
call fcn.00407560
mov byte [ebp - 4], 6
lea edx, [ebp - 0x27c]
push edx
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x294]
push ecx
call fcn.0040e420
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x27c]
call fcn.004074c0
lea edx, [ebp - 0x294]
push edx
mov ecx, dword [ebp + 8]
call fcn.00408220
mov eax, dword [ebp - 0x2b0]
or eax, 1
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x294]
call fcn.004074c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2ac]
call fcn.004074c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.004074c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.004074c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477254
mov esp, ebp
pop ebp
ret
Function at 0x4729d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8dca
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4d404c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x234]
push ecx
call fcn.004712b0
add esp, 8
mov dword [ebp - 4], 1
lea edx, [ebp - 0x234]
push edx
call fcn.0040ac50
add esp, 4
movzx eax, al
test eax, eax
jne 0x472a65
push 0x4b8ea0
mov ecx, dword [ebp + 8]
call fcn.00407560
mov ecx, dword [ebp - 0x238]
or ecx, 1
mov dword [ebp - 0x238], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.004074c0
mov eax, dword [ebp + 8]
jmp 0x472ad8
push 0x20a
push 0
lea edx, [ebp - 0x21c]
push edx
call fcn.0047a110
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.00407400
push eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x4b8ea0
push str.Version
push str.Upgrade
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407560
mov edx, dword [ebp - 0x238]
or edx, 1
mov dword [ebp - 0x238], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.004074c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477254
mov esp, ebp
pop ebp
ret
Function at 0x475760
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4d404c]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x118
lea eax, [esp + 8]
mov dword [esp + 4], 0x11c
push 0
push eax
call fcn.0047a110
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4757d6
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x4757bf
jne 0x4757d6
mov eax, dword [esp + 8]
cmp eax, 1
ja 0x4757bf
jne 0x4757d6
cmp word [esp + 0x114], 1
jb 0x4757d6
mov al, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00477254
add esp, 0x120
ret
mov ecx, dword [esp + 0x11c]
xor al, al
xor ecx, esp
call fcn.00477254
add esp, 0x120
ret
Function at 0x476270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4d404c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x410
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.0047a110
add esp, 0xc
mov dword [ebp - 0x418], 0
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4762be
xor al, al
jmp 0x476317
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x4762f0
cmp dword [ebp - 0x418], 0
je 0x4762ec
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor al, al
jmp 0x476317
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00407460
cmp dword [ebp - 0x418], 0
je 0x476315
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477254
mov esp, ebp
pop ebp
ret

Function at 0x48763a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004872fa

Function at 0x4012a3
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403df4], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403df0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x4011a6
mov dword [ebp - 0x24], str.cognomen
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403df0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.invocatory
push str.cognomen
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403df8], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40136d
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401354
mov eax, dword [0x403df4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10
Function at 0x42fde4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00405228
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42fe32
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00405498
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433eb4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x433fe7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x421ca8]
call fcn.00421da8
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x433fbd
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00421e48
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00405498
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x433ffc
call fcn.00405540
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00421fd0
lea ecx, [ebp - 4]
mov edx, 0x434038
mov eax, dword [ebp - 0xc]
call fcn.00422248
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040e918
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x433fa0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x434044
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4734a4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433fa7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x434094
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x4340db
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4340be
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4340cf
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x4340db
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4560a0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45624b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45622c
mov dl, 1
mov eax, dword [0x416500]
call fcn.004043cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00405228
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45621b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004485c4
test al, al
je 0x45620e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45625c
lea eax, [ebp - 0x254]
call fcn.0040a344
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45620e
xor eax, eax
push ebp
push 0x456207
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x456294
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4561f0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00405498
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4561f0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00405498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45620e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x456111
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041a314
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456252
lea eax, [ebp - 0x260]
call fcn.00405228
ret

Function at 0x456bc4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x479c94]
cmp byte [eax + 0xad], 0
jne 0x456c35
cmp dword [0x479cb0], 0
jne 0x456bf6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x456b80
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x479cb0], eax
cmp dword [0x479cac], 0
jne 0x456c11
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x479cac], eax
cmp dword [0x479cb4], 0
jne 0x456c35
push esp
push 0
push 0
push 0x456b24
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x479cb4], eax
pop edx
ret
Function at 0x456e08
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x456e1f
add esp, 0xfffffff0
call fcn.00404720
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e468
mov eax, dword [0x47429c]
cmp word [eax + 2], 0
jne 0x456e47
mov eax, dword [0x47429c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458a20
mov eax, dword [0x47434c]
cmp word [eax + 2], 0
jne 0x456e61
mov eax, dword [0x47434c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458c2c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4160dc]
call fcn.004043cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4160dc]
call fcn.004043cc
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x4160dc]
call fcn.004043cc
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x423284]
call fcn.0042ad68
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x457018
mov eax, dword [0x4741b8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042b13c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x459300
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4741b8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040dc14
test eax, eax
je 0x456f68
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409cfc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040dc48
test eax, eax
je 0x456f7c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00405498
mov byte [ebx + 0xd4], 0
push ebx
push 0x458530
call fcn.0041fc04
mov dword [ebx + 0xc8], eax
mov eax, dword [0x47409c]
cmp byte [eax], 0
jne 0x456fcd
mov eax, ebx
call fcn.0045715c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004594d8
mov eax, ebx
call fcn.0045a03c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45700d
call fcn.00404778
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458284
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4582ee
mov eax, ebx
call fcn.0045a4a8
test al, al
jne 0x4582ee
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405318
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4582db
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4582fb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040527c
jmp 0x4582fb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040527c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4596bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45972a
mov eax, esi
call fcn.00443484
test al, al
je 0x45972a
mov eax, dword [ebx + 0x84]
call fcn.00443178
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45972a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45971e
push 0
mov eax, dword [ebx + 0x84]
call fcn.00443178
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043b334
jmp 0x45972a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004594f8
pop esi
pop ebx
ret
Function at 0x76ed31
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x913e0082
mov esi, dword [ebp]
push 0x8894640a
mov edx, 0x313ab316
mov edx, dword [ebp + edx*2 - 0x62756628]
inc dword [esp]
add ebp, 4
sar byte [esp + 2], 0xa7
xor eax, eax
test edx, edx
lea esp, [esp + 8]
je 0x76edb3
push 0xcb9e711b
mov dword [esp], ebx
movzx ebx, byte [esi]
xor ebx, eax
and ebx, 0xff
push 0x3bab260f
mov ebx, dword [ebx*4 + 0x79e89c]
sar word [esp], 0xed
shr eax, 8
xor eax, ebx
inc esi
xor eax, 0xe3bb0b2e
dec edx
push 0x220946a6
lea esp, [esp + 8]
jne 0x76ed6f
push 0x1ca72905
mov ebx, dword [esp + 4]
lea esp, [esp + 8]
not eax
mov dword [ebp], eax
jmp fcn.00851aa4

Function at 0x77557a
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov esi, dword [esp + ecx - 0x1662d088]
dec esi
mov dword [esp + ecx*2 - 0x2cc5a1a8], ecx
inc ecx
pop esp
dec esi
mov esp, dword [esp + ecx - 0x1662d088]
dec edx
mov dword [esp + ecx - 0x1662d0f0], 0xf99c4038
dec esi
mov ecx, dword [esp + ecx - 0x1662d080]
call fcn.007961eb
mov ecx, 0x19843b15
movzx eax, cl
sar cx, 0x61
mov ecx, dword [esi + ecx*4 - 0x66107628]
sar eax, 0x4f
adc eax, dword [esi + eax*4 + 4]
add esi, 4
jmp 0x68f8e6

Function at 0x790ac0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x7e5b38
mov esi, dword [ebp + 0xc]
cmp di, 0xb185
cmp si, bx
test esi, esi
je 0x7e5b38
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x7e5b32
mov eax, dword [edx + 0x3c]
add eax, edx
stc
cmp esp, 0x6c832f10
cmc
cmp dword [eax], 0x4550
jmp 0x7da46d
push ebp
sbb bp, dx
mov ebp, esp
bsr edx, eax
adc dl, cl
cmp ax, bp
mov edx, dword [ebp + 8]
cmp ax, 0xa72d
stc
lea esp, [esp - 0x114]
push esi
stc
cmp bp, 0x2118
clc
test edx, edx
jmp 0x714a9c
jne 0x7e5b38
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
jmp 0x82a25c
cmp esi, 0xffff
jmp 0x75057f
je 0x771dfa
sub eax, eax
bswap si
xchg esi, esi
pop esi
jmp 0x6908c2
je 0x7e5b38
mov eax, dword [eax + 0x7c]
push ebx
push edi
cmp esi, 0xeb038c37
test cl, ch
mov dword [ebp - 0x10], eax
stc
clc
mov dword [ebp - 8], 0xffffffff
jmp 0x7e3ba9
test ecx, ecx
jmp 0x7e5d90

Function at 0x7a1e85
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, dword [edi]
sub ecx, ecx
sbb cl, ch
adc cl, byte [edi + ecx*2 + 4]
call fcn.007b660b
Function at 0x7a9d73
Capabilities:
Encode data using xor

Disassembly:
xor ecx, 0x31a796b8
sub ecx, 0x4b0cbb6
mov dword [esp], 0xef0018b0
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
xor dword [ecx - 0x4f344917], eax
add al, 0xc7
add al, 0x24
mov al, 0x18
add bh, ch
add dword [esp], 0x6f250c2c
not ecx
mov dword [esp + 4], 0x313d7994
jbe 0x7c31a7
cmp al, 0x44
push ebp
shl dword [ebp + 0x2deab450], 1
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
push ecx
lodsb al, byte [esi]
shl ebp, 0x7a
push ss
pop edi
aaa
jne 0x70f40f
xor al, byte [ebx + 0x781bc136]
pop ss
adc byte [edi + 0x37], ah
cmp edi, dword [eax - 0x4b25ae5d]
ret
call fcn.007904f2
jmp 0x80e064
jmp 0x70f40c
inc ecx
xor ebx, ecx
shr byte [esp + 7], 0x85
dec word [esp + 3]
call fcn.0080563b
dec ecx
mov ebp, dword [ebx]
mov edi, 0x3b3bdebb
dec eax
rol edi, 0x57
dec ecx
mov edi, dword [ebx + 8]
jae 0x7fd995
mov eax, 0x18890eb6
mov edi, dword [ebp + eax*4 - 0x62243ad8]
not al
sar al, 0xa3
shr eax, 0xaf
mov ax, word [ebp + eax*8 - 0x1888c]
jns 0x7a7ee0
mov edx, dword [ebp]
jmp 0x95ed2f
shrd edi, edx, cl
dec ecx
adc ebx, 0x10
push 0x390daaa0
call fcn.0095fe29
sysenter
call fcn.0075170b
cmpsb byte [esi], byte es:[edi]
lodsb al, byte [esi]
dec eax
push 0xc
pushfd
sahf
adc ch, ch
sub al, 0x69
or dword [esi], esp
jnp 0x7d0fb5
ret
push 0x89afe90b
mov dword [ebp], esi
lea esp, [esp + 4]
jmp fcn.007742d3
jae 0x7d0fbd
lea esp, [esp + 8]
jmp fcn.0068ed84
mov esi, 0x191bf19d
bswap esi
mov esi, dword [edx]
jmp 0x7ed4c8

Function at 0x7c800b
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + edx*8 - 0x1ac0e28], edx
xor al, 0x35
bswap edx
bswap edx
neg al
dec edx
call fcn.00852f35
mov dword [esp], ebx
mov ebx, 0x7daf6507
movsx ecx, bx
cpuid
call fcn.007d6764
movzx edx, byte [esi]
mov eax, 0x63bdc700
lea esi, [esi + eax - 0x63bdc6ff]
or ax, ax
shl eax, 0x76
xor dl, bl
add eax, eax
sar al, 5
rol dl, 1
jmp 0x851edb
jne 0x7f8a52
mov dword [ebp], edx
lea esp, [esp + 4]
jmp fcn.00725d00
mov dword [esp + edx - 0x6b038a0f], edx
sar edx, 9
not al
jne 0x775144
fnstenv [edi + 0x45]
ja 0x7c8065
sub esi, dword [ebx + 0x45f618dd]
cmp ebp, esi
sbb byte [edi + 0x617243b0], ah
inc edx
cmp al, 0xf1
not byte [ebx]
mov fs, word [edi - 0x437f0d6]
xor eax, 0x70f7dc28
push edi
dec edi
mov ebp, 0x58fd7336
adc esi, dword [esi]
xor byte [0x5f190ad4], ah
cdq
test ch, bh
pop eax
adc ebp, dword [ebx - 0x29]
std
std
mov ah, 2
cmpsd dword [esi], dword es:[edi]
in al, dx
jp 0x7c801e
sub byte [bp + si], al
cmpsd dword [esi], dword es:[edi]
in al, dx
hlt
fincstp
jle 0x7c8055
xchg edx, eax
sub al, 0x6f
or esp, ebp
ficom word [eax - 0x3a]
mov ecx, 0x77b01a9f
mov dl, 0xad
bound ebx, qword [ecx - 0x3cfde280]
out dx, al
dec edx
popal
xchg edi, eax
xor byte [ebx + 0x68], 0x7d
pop esp
sub al, 0xf7
xchg edx, eax
push ecx
rcl byte [esi + ebp*8 - 0x1d], cl
std
pop eax
adc esp, dword [esi + 0x62]
retf 0x3bdd
ror al, 1
dec word [esp + edx - 0x3581c4]
ror dword [esp + edx - 0x3581c5], 0xe8
adc al, 0xae
jmp 0x70cc5c
add eax, 0xd48a89b7
inc dl
shr al, 0x41
not al
call fcn.00767009
cld
mov ebp, 0xd90cffdc
invalid