joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467493
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4674d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404804
mov eax, dword [ebp - 0x10]
call fcn.00466f10
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x4673be
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404cbc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004676c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x467493
xor eax, eax
push ebp
push 0x46748c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0046708c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004674e4
test al, al
je 0x46746a
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.0040485c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x46746a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404c1c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x467464
mov eax, dword [ebp - 0x14]
call fcn.00404c1c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040495c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0046736c
dec ebx
cmp ebx, 0xffffffff
jne 0x46741d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467493
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0046708c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404c1c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00467078
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4674dc
lea eax, [ebp - 0x3c]
call fcn.0040476c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404790
ret

Function at 0x4674e4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00403230
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x52cec8]
cmp byte [edx + 0xc], 0
je 0x467548
mov edx, dword [0x52cebc]
cmp dword [edx], 2
jne 0x467548
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x46763c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404c1c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x467694
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x52ced4]
mov dl, 1
mov eax, dword [0x466e1c]
call fcn.0040ca58
call fcn.00404148
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00466f24
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46fe74
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46ff4c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x52dcb4], 0
jne 0x46ff30
lea eax, [ebp - 4]
mov edx, 0x46ff64
call fcn.00404804
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c1c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x46ff30
mov eax, ebx
call fcn.00402780
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46ff29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46ff13
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x46ff74
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46ff13
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x52dcb4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ff30
mov eax, dword [ebp - 0xc]
call fcn.004027a0
ret
mov ebx, dword [0x52dcb4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ff53
lea eax, [ebp - 4]
call fcn.0040476c
ret

Function at 0x47d8d4
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x52dcd8], 0
jne 0x47d8f7
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x47d848
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x52dcd8], eax
ret

Function at 0x483b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483b98
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x103]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x103]
call fcn.00409a50
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004832c4
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 4]
call fcn.004047c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483b9f
lea eax, [ebp - 0x108]
call fcn.0040476c
ret
Function at 0x483ba4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483c1c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x103]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x103]
call fcn.00409a50
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004832c4
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 4]
call fcn.004047c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483c23
lea eax, [ebp - 0x108]
call fcn.0040476c
ret
Function at 0x4853f4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
xor ecx, ecx
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x18c], ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c0c
mov eax, dword [ebp - 8]
call fcn.00404c0c
lea eax, [ebp - 0x170]
mov edx, dword [0x407f74]
call fcn.00405194
xor eax, eax
push ebp
push 0x485684
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.0040d4c8
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 4]
call fcn.00404804
lea edx, [ebp - 0x178]
mov eax, dword [ebp - 8]
call fcn.0040d4c8
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 8]
call fcn.00404804
lea eax, [ebp - 0x17c]
mov ecx, 0x48569c
mov edx, dword [ebp - 4]
call fcn.00404a70
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x170]
mov edx, 0x3f
call fcn.00409518
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x48562d
mov eax, dword [ebp - 0x164]
mov edx, 0x4856a8
call fcn.00404b68
je 0x485615
mov eax, dword [ebp - 0x164]
mov edx, 0x4856b4
call fcn.00404b68
je 0x485615
mov eax, dword [ebp - 0x168]
and eax, 0x10
cmp eax, 0x10
jne 0x485584
lea eax, [ebp - 0x180]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 8]
call fcn.00404a70
mov eax, dword [ebp - 0x180]
call fcn.0040934c
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 8]
call fcn.00404a70
mov eax, dword [ebp - 0x184]
push eax
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 4]
call fcn.00404a70
mov eax, dword [ebp - 0x188]
pop edx
call fcn.004853f4
test al, al
jne 0x485615
mov byte [ebp - 0x11], 1
jmp 0x485615
lea eax, [ebp - 0x18c]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 8]
call fcn.00404a70
mov eax, dword [ebp - 0x18c]
mov dl, 1
call fcn.00485234
push 0
lea eax, [ebp - 0x190]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 8]
call fcn.00404a70
mov eax, dword [ebp - 0x190]
call fcn.00404c1c
push eax
lea eax, [ebp - 0x194]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 4]
call fcn.00404a70
mov eax, dword [ebp - 0x194]
call fcn.00404c1c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x485615
mov byte [ebp - 0x11], 1
call sub.kernel32.dll_GetLastError_1
test eax, eax
jns 0x485602
call fcn.004038bc
lea edx, [ebp - 0x18]
call fcn.0040c16c
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x18]
call fcn.00404804
lea eax, [ebp - 0x170]
call fcn.00409568
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4854df
lea eax, [ebp - 0x170]
call fcn.0040958c
cmp byte [ebp - 0x11], 0
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48568b
lea eax, [ebp - 0x194]
mov edx, 9
call fcn.00404790
lea eax, [ebp - 0x170]
mov edx, dword [0x407f74]
call fcn.00405264
lea eax, [ebp - 0x18]
call fcn.0040476c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404790
ret
Function at 0x489954
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x489982
mov eax, ebx
call fcn.0048a40c
cmp dword [ebx + 0x3c], 0
je 0x48997b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4899f3
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4899e5
cmp dword [ebx + 8], 0
je 0x4899a4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4899b6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4899e5
cmp dword [ebx + 8], 0
je 0x489997
cmp eax, 3
je 0x4899c9
dec eax
jne 0x489997
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x489997
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x489997
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x489a11
cmp dword [ebx + 0x10], 0xcc
je 0x489a11
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00489a1c
pop ebx
ret
Function at 0x49eb4c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49edac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49ebaf
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0049e614
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d1e4
cmp al, 1
jne 0x49ebaf
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0049e92c
test al, al
je 0x49ed3b
cmp dword [ebp - 8], 0
jge 0x49ebcd
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0049e614
mov eax, dword [ebp - 0x210]
call fcn.00404a24
cmp ebx, eax
jge 0x49ec17
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0049e614
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x52cea8]
and eax, 0xff
bt dword [edx], eax
jae 0x49ec17
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x49ec2b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049eb28
cmp ebx, dword [ebp - 8]
je 0x49ed2d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x49ec57
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403b78
and eax, 0x7f
movzx eax, word [eax*2 + 0x52c78c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x49ed1a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403b78
and eax, 0x7f
movzx eax, word [eax*2 + 0x52c78c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00445548
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403b78
and eax, 0x7f
movzx eax, word [eax*2 + 0x52c78c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00445548
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ed21
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49ed8e
cmp dword [ebp - 8], 0
jge 0x49ed46
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0049e614
mov eax, dword [ebp - 0x218]
call fcn.00404a24
cmp eax, dword [ebp - 8]
jg 0x49ed80
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0049e614
mov eax, dword [ebp - 0x21c]
call fcn.00404a24
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049eb28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49edb3
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404790
ret
Function at 0x4b0d08
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b0dc2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e88
mov eax, dword [0x52cebc]
cmp dword [eax], 2
jne 0x4b0d77
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405130
mov eax, dword [ebx]
call fcn.00404ff4
push eax
mov eax, dword [ebx]
call fcn.00404fe4
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404ff4
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405130
jmp 0x4b0da9
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409a50
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404fd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0dc9
lea eax, [ebp - 0x3f0]
call fcn.0040476c
ret
Function at 0x4ce974
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004ce960
test eax, eax
jne 0x4ce995
mov eax, esi
call fcn.0040476c
jmp 0x4cea26
mov eax, ebx
call fcn.004ceabc
test al, al
je 0x4ce9db
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.0040485c
test edi, edi
je 0x4ce9d2
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4cea26
mov eax, esi
call fcn.0040476c
jmp 0x4cea26
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x4cea1f
mov eax, dword [ebp + 0x208]
call fcn.00417fa4
test eax, eax
jle 0x4cea0d
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.004725fc
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.004047c0
jmp 0x4cea26
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x210]
call fcn.004047c0
jmp 0x4cea26
mov eax, esi
call fcn.0040476c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e2bc8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x52e200
test esi, esi
jne 0x4e2be2
xor eax, eax
jmp 0x4e2ce4
cmp dword [ebp], 0
jne 0x4e2bed
call fcn.004e2b58
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4e2cbd
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4e2bf9
test edi, edi
jbe 0x4e2cdf
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4e2cc1
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f82b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x4f8467
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283f4
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.00450f28
call fcn.004ef654
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x4f8338
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.00422e2c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283f4
mov eax, dword [eax + 0xc]
pop edx
call fcn.00422e34
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422d14
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.004098c8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283f4
call fcn.00423c84
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422d88
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422dc4
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422dc4
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422dc4
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422e2c
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283f4
mov eax, dword [eax + 0xc]
pop edx
call fcn.00422cc0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283f4
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x13
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.00422b04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f846e
lea eax, [ebp - 4]
call fcn.0040476c
ret
Function at 0x50fc18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x50fc30
mov eax, ebx
call fcn.0050f474
cmp dword [ebx + 0x68], 0
jne 0x50fc3d
mov eax, ebx
call fcn.0050f40c
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.0050f28c
lea eax, [esp + 0x10]
xor edx, edx
call fcn.005103e4
cmp eax, dword [esp]
je 0x50fcab
lea eax, [esp + 0x10]
xor edx, edx
call fcn.005103f8
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x50fc87
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005103e4
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x50fca0
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x50fcc6
push 3
mov eax, dword [esi + 0x10]
call fcn.00445548
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x50fcd3
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.0043e474
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.0043e498
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0043e4c0
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0043e4e4
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00415bf8
mov eax, ebp
mov edx, dword [0x52ca3c]
mov byte [edx + 2], al
mov eax, dword [0x52ca3c]
mov byte [eax], 0
mov eax, dword [0x52ca3c]
mov byte [eax + 1], 0
mov eax, dword [0x52ca3c]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00445548
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00445548
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00445548
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x52ca3c]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.004283f4
call fcn.00423c84
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00445548
push eax
mov eax, dword [0x52ca18]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.00445548
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5107c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x52cce4]
mov eax, dword [eax]
call fcn.0045f9b4
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, esi
jb 0x5107cb
pop esi
pop ebx
ret