joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc188
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x4bc1ae
mov eax, esp
push eax
push 0x4bc150
call sub.user32.dll_EnumWindows
jmp 0x4bc1c1
mov eax, esp
push eax
push 0x4bc130
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x4bc284
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x4bc2d4]
test bl, 4
je 0x4bc298
or si, 1
test bl, 8
je 0x4bc2a1
or si, 4
test bl, 1
je 0x4bc2aa
or si, 8
test bl, 2
je 0x4bc2b3
or si, 0x10
test bl, 0x10
je 0x4bc2bc
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4bc2cc
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4bc2d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x4bc314]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4bc2f3
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4bc303
or bx, 4
test esi, 0x20000000
je 0x4bc30f
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4c4ed8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4c4eea
add esp, 0xfffffff0
call fcn.004052dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043ef08
mov eax, dword [0x4d43d0]
mov dword [eax + 4], ebx
mov dword [eax], 0x4c5334
mov eax, dword [0x4d43dc]
mov dword [eax + 4], ebx
mov dword [eax], 0x4c5340
mov eax, ebx
call fcn.004c534c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x4283f8]
call fcn.00404d78
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4283f8]
call fcn.00404d78
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4283f8]
call fcn.00404d78
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4283f8]
call fcn.00404d78
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x4283f8]
call fcn.00404d78
mov dword [ebx + 0x78], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x44], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x4bfc80
push eax
push 0
push 0
mov eax, dword [0x4d45a4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x44988c]
call fcn.0044fb60
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x44988c]
call fcn.0044fb60
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x44988c]
call fcn.0044fb60
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x44988c]
call fcn.0044fb60
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x44988c]
call fcn.0044fb60
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.004c58a4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c5714
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c5714
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c5714
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c5714
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c5714
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4c5065
call fcn.00405334
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c54b4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c5661
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4c5642
mov dl, 1
mov eax, dword [0x42aaf8]
call fcn.00436980
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.00406844
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4c5631
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004a7b14
test al, al
je 0x4c5624
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4c5670
lea eax, [ebp - 0x394]
call fcn.00413548
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4c5624
xor eax, eax
push ebp
push 0x4c561d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4c56e0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4c5606
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406a2c
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4c5606
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5624
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4c5527
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.004368bc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5668
lea eax, [ebp - 0x3a0]
call fcn.00406834
ret

Function at 0x4c61c0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4da2bc]
cmp byte [eax + 0xad], 0
jne 0x4c6232
cmp dword [0x4da2d4], 0
jne 0x4c61f2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4d4278]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4da2d4], eax
cmp dword [0x4da2d0], 0
jne 0x4c620d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4da2d0], eax
cmp dword [0x4da2d8], 0
jne 0x4c6232
push esp
push 0
push 0
mov eax, dword [0x4d4274]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4da2d8], eax
pop edx
ret
Function at 0x4c6558
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4c656f
add esp, 0xfffffff0
call fcn.004052dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043ef08
mov eax, dword [0x4d42e4]
cmp byte [eax], 0
jne 0x4c659c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4d4574]
cmp word [eax + 2], 0
jne 0x4c65b6
mov eax, dword [0x4d4574]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004c8650
mov eax, dword [0x4d467c]
cmp word [eax + 2], 0
jne 0x4c65d0
mov eax, dword [0x4d467c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004c8860
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44988c]
call fcn.0044fb60
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4c8e10
mov dl, 1
mov eax, dword [0x4283f8]
call fcn.00404d78
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4283f8]
call fcn.00404d78
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x44dd24]
call fcn.00458fd0
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4c67b0
mov eax, dword [0x4d4454]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00459464
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4c90f8
mov dl, 1
mov eax, dword [0x4283f8]
call fcn.00404d78
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4d4454]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00413380
test eax, eax
je 0x4c66e1
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00413164
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00413364
test eax, eax
je 0x4c66f9
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406a2c
push ebx
push 0x4c8020
call fcn.004bc268
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4d42e4]
cmp byte [eax], 0
jne 0x4c674a
mov eax, ebx
call fcn.004c6924
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004c9324
mov eax, ebx
call fcn.004c9f58
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4c67a7
call fcn.00405334
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c6bf8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4c6c9a
cmp dword [ebx + 0x94], 0
jne 0x4c6c94
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4c6b44
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4c6c94
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4c6c5a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4c6c94
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00433314
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4c6c69
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4c6eb8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4da2bc]
cmp dword [eax + 0x170], 0
je 0x4c701d
test bl, bl
jne 0x4c6f6b
cmp dword [esi + 0x9c], 0
jne 0x4c6f60
mov eax, esi
call fcn.004c9da8
push eax
push 0x4c6dc4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4c6f31
mov eax, dword [0x4da2bc]
cmp byte [eax + 0xd3], 0
je 0x4c6f31
mov eax, dword [esi + 0xd8]
call fcn.00407e50
mov edi, eax
cmp edi, 0
jl 0x4c6f31
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4c6f1a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4c6f60
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00433314
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4c6f40
inc dword [esi + 0x9c]
jmp 0x4c701d
cmp dword [esi + 0x9c], 0
jle 0x4c701d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4c701d
cmp dword [esi + 0x44], 0
je 0x4c6fc8
mov eax, dword [0x4da2bc]
cmp byte [eax + 0xd3], 0
je 0x4c6fc8
mov eax, dword [esi + 0xd8]
call fcn.00407e50
mov edi, eax
cmp edi, 0
jl 0x4c6fc8
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4c6fb1
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4c6ff7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00433314
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4c6fd7
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4ba140]
call fcn.00408010
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4c7c6c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4c7cd7
cmp byte [ebx + 0xd3], 0
jne 0x4c7cd7
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406980
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4c7cc4
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4c7ce4
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406844
jmp 0x4c7ce4
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406844
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4c950c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4c957a
mov eax, esi
call fcn.004a1a20
test al, al
je 0x4c957a
mov eax, dword [ebx + 0x84]
call fcn.004a1674
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4c957a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4c956e
push 0
mov eax, dword [ebx + 0x84]
call fcn.004a1674
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00498648
jmp 0x4c957a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004c9344
pop esi
pop ebx
ret
Function at 0x4013bd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
cmp dword [0x19f9870], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x2c], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x4013f3
push 0
lea eax, [ebp - 0x44c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x4182e8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [0x4182ec]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x28], eax
call fcn.004013b3
mov ecx, dword [0x4182f0]
mov eax, dword [0x4182f4]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x19f9870], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x19f986c]
cmove eax, edx
xor edx, edx
cmp dword [0x19f9870], 0x3eb
mov dword [0x19f986c], eax
mov eax, dword [0x19f925c]
cmove eax, edx
add ecx, ebx
mov dword [0x19f925c], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x1c]
mov ecx, dword [0x19f9870]
xor eax, edx
mov dword [0x19f9868], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x401527
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea eax, [ebp - 0xc4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x19f9870]
sub edi, eax
cmp ecx, 0xc
jne 0x401535
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.004013ba
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x401581
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
jmp 0x401431
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d332
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408727
mov dword [ebp - 0x14], eax
cmp dword [0x433678], esi
jne 0x40d425
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d505
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d505
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d505
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x433678], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43367c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x433680], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x433688], eax
test eax, eax
je 0x40d422
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x433684], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d44a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d43d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d45f
push 4
pop eax
jmp 0x40d507
cmp dword [ebp - 0x14], esi
je 0x40d45f
push dword [0x433678]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d444
mov eax, dword [0x433684]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d4bd
cmp dword [0x433688], edi
je 0x40d4bd
push eax
call ebx
push dword [0x433688]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d4bd
test eax, eax
je 0x40d4bd
call ecx
test eax, eax
je 0x40d4b2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4b2
test byte [ebp - 8], 1
jne 0x40d4bd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4ed
mov eax, dword [0x43367c]
cmp eax, edi
je 0x40d4ea
push eax
call ebx
test eax, eax
je 0x40d4ea
call eax
mov esi, eax
test esi, esi
je 0x40d4ea
mov eax, dword [0x433680]
cmp eax, edi
je 0x40d4ea
push eax
call ebx
test eax, eax
je 0x40d4ea
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x433678]
call ebx
test eax, eax
je 0x40d505
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d507
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040407e
mov esp, ebp
pop ebp
ret
Function at 0x405646
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x405655
pop dword [ebp - 0x50]
mov eax, 0xdb79bb42
sub eax, 0xdb3964ed
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xa5142a57
sub dword [ebp - 0x60], 0x56c1e50c
mov dword [ebp - 0x5c], 0x217eff20
sub dword [ebp - 0x5c], 0xef4bb2db
mov dword [ebp - 0x58], 0x733d6267
sub dword [ebp - 0x58], 0x26f11e39
mov dword [ebp - 0x54], 0x53e27011
sub dword [ebp - 0x54], 0x53e27011
lea eax, [ebp - 0x60]
push eax
mov eax, 0x2d7d93ba
sub eax, 0x2d3d2276
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb3db1869
add dword [ebp - 0x60], 0xc09750ed
mov dword [ebp - 0x5c], 0x44f67e72
add dword [ebp - 0x5c], 0xfc75e303
mov dword [ebp - 0x58], 0x2e2985b9
sub dword [ebp - 0x58], 0xcaba194d
mov dword [ebp - 0x54], 0xa3e3578d
sub dword [ebp - 0x54], 0xa3e3578d
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xea8a92ea
add eax, 0x15b5de26
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x34b33
push 0
call eax
mov ecx, 0xfca133d0
sub ecx, 0xfca0f4b1
xor edi, edi
add edi, eax
mov ebx, 0x1d878d8f
add ebx, 0xe2bbd271
add ebx, dword [ebp - 0x50]
mov esi, 0x7bbd13fb
xor dword [ebp - 0x30], eax
mov edx, dword [ebx]
add dword [ebp - 4], 0x1408d556
sub edx, esi
add dword [ebp - 0x30], 0x83660ec5
mov dword [edi], edx
add dword [ebp - 0x18], eax
add edi, 0x95cab07
sub edi, 0x95cab03
add ebx, 0xb8098af4
add ebx, 0x47f67510
loop 0x405773
add eax, 0xdf2222d1
sub eax, 0xdf213382
mov ebx, eax
add eax, 0x3f1b21ad
add eax, 0xc0e4de58
mov ecx, 0x97c595ca
sub ecx, 0x978595ca
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x4058f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421968
push esi
call fcn.00405d21
push esi
call fcn.004058a8
mov edi, eax
test edi, edi
jne 0x405916
xor eax, eax
jmp 0x405968
push edi
call fcn.00405f83
test byte [0x423f78], 0x80
je 0x40592f
mov al, byte [edi]
test al, al
je 0x405912
cmp al, 0x5c
je 0x405912
sub edi, esi
jmp 0x405947
call fcn.0040601c
test eax, eax
je 0x405941
test byte [eax], 0x10
je 0x405912
push esi
call fcn.0040585b
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405933
call fcn.00405814
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4059d9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4059f5
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
ret 4

Function at 0x4059f8
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileA]
ret 0xc