joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3374
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4e33df
cmp byte [ebx + 0xd3], 0
jne 0x4e33df
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004071c8
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4e33cc
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4e33ec
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040708c
jmp 0x4e33ec
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040708c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4e4c14
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4e4c82
mov eax, esi
call fcn.004bc0dc
test al, al
je 0x4e4c82
mov eax, dword [ebx + 0x84]
call fcn.004bbd30
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4e4c82
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4e4c76
push 0
mov eax, dword [ebx + 0x84]
call fcn.004bbd30
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004b2d04
jmp 0x4e4c82
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004e4a4c
pop esi
pop ebx
ret

Function at 0x4ed280
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ed336
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00407118
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x4ed320
lea eax, [ebp - 4]
mov edx, edi
call fcn.00407418
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00407118
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4ed320
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4ed348
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4ed320
cmp dword [ebp - 0xc], 0x34
jne 0x4ed320
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed33d
lea eax, [ebp - 4]
call fcn.0040707c
ret
Function at 0x4ee96c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4eeb6c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.004ed968
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x6932d0], eax
mov eax, dword [ebp - 0xc]
mov dword [0x6932d4], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6932d8], eax
mov eax, dword [0x6a15cc]
cmp dword [eax], 2
sete byte [0x692a80]
push 0x4eeb78
call sub.KERNEL32.DLL_GetModuleHandleW_2
lea edx, [ebp - 4]
call fcn.004ed06c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x692a80], 0
jne 0x4ee9fb
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004ed280
test al, al
je 0x4ee9fb
mov eax, dword [ebp - 0x4c]
mov dword [0x6a7880], eax
jmp 0x4eea02
xor eax, eax
mov dword [0x6a7880], eax
call fcn.004ee648
and eax, 0x7f
cmp eax, 0x14
ja case.0x4eea13.0
jmp dword [eax*4 + 0x4eea1a]
mov byte [0x692a6c], 1
jmp case.0x4eea13.0
mov byte [0x692a70], 1
jmp case.0x4eea13.0
mov byte [0x692a74], 1
jmp case.0x4eea13.0
mov byte [0x692a78], 1
jmp case.0x4eea13.0
mov byte [0x692a7c], 1
jmp case.0x4eea13.0
mov byte [0x692a84], 1
mov byte [0x692a88], 1
jmp case.0x4eea13.0
mov byte [0x692a84], 1
mov byte [0x692a8c], 1
jmp case.0x4eea13.0
mov byte [0x692a84], 1
mov byte [0x692a8c], 1
mov byte [0x692a90], 1
jmp case.0x4eea13.0
mov byte [0x692a94], 1
jmp case.0x4eea13.0
mov byte [0x692a98], 1
jmp case.0x4eea13.0
mov byte [0x692a9c], 1
jmp case.0x4eea13.0
mov byte [0x692aa0], 1
jmp case.0x4eea13.0
mov byte [0x692aa4], 1
jmp case.0x4eea13.0
mov byte [0x692aa8], 1
jmp case.0x4eea13.0
mov byte [0x692aac], 1
jmp case.0x4eea13.0
mov byte [0x692ab0], 1
jmp case.0x4eea13.0
mov byte [0x692ab4], 1
jmp case.0x4eea13.0
mov byte [0x692ab8], 1
jmp case.0x4eea13.0
mov byte [0x692abc], 1
jmp case.0x4eea13.0
mov byte [0x692ac0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eeb73
lea eax, [ebp - 4]
call fcn.0040707c
ret

Function at 0x4f2418
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x4f247c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040729c
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP_1
mov edx, eax
pop eax
call fcn.00414b14
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2483
lea eax, [ebp - 0x14]
call fcn.0040707c
ret
Function at 0x4f3718
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4f372d
add esp, 0xfffffff0
call fcn.004056e0
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.0040517c
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.0040708c
mov eax, esi
call fcn.00407118
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CreateMutexW
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x4f3781
mov ecx, dword [0x6a1344]
mov dl, 1
mov eax, dword [0x4f32ec]
call fcn.004e7fe0
call fcn.00405c84
call sub.KERNEL32.DLL_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4f37a8
call fcn.00405738
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x503fd8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x504006
mov eax, ebx
call fcn.00504a8c
cmp dword [ebx + 0x40], 0
je 0x503fff
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x504077
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x504069
cmp dword [ebx + 8], 0
je 0x504028
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x50403a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x504069
cmp dword [ebx + 8], 0
je 0x50401b
cmp eax, 3
je 0x50404d
dec eax
jne 0x50401b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x50401b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x50401b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x504095
cmp dword [ebx + 0x14], 0xcc
je 0x504095
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005040a0
pop ebx
ret

Function at 0x518c14
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x728a28
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x518c36
shr eax, 1
xor eax, 0xedb88320
jmp 0x518c38
shr eax, 1
dec edx
jne 0x518c24
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x518c1d
mov byte [0x728e28], 1
pop esi
pop ebx
ret

Function at 0x518c54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x728e28], 0
jne 0x518c6b
call fcn.00518c14
mov eax, edi
dec eax
test eax, eax
jl 0x518c93
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x728a28]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x518c75
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x51ba3c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x51bad6.0
jmp dword [ecx*4 + 0x51ba6f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x51baa1
sub dl, 8
je 0x51bab0
jmp case.0x51bad6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51b6e4
jmp case.0x51bad6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51b73c
jmp case.0x51bad6.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x51bad6.0
movzx ecx, byte [ecx + 0x51badd]
jmp dword [ecx*4 + 0x51baee]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51b7e8
jmp case.0x51bad6.0
cmp dl, 3
jne 0x51bb1b
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51b840
jmp case.0x51bad6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51b7fc
jmp case.0x51bad6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51b884
jmp case.0x51bad6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x51bb46
sub dl, 8
je 0x51bb52
jmp case.0x51bad6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51b8b0
jmp case.0x51bad6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51b91c
jmp case.0x51bad6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x51bb71
sub dl, 8
je 0x51bb7d
jmp case.0x51bad6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51b9d8
jmp case.0x51bad6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x51ba00
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x51bc1f
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0051abe8
test eax, eax
je 0x51bc1f
mov eax, ebx
call fcn.0051bc28
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x51bbb8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x51bc28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x51bc59
dec al
je 0x51bc94
dec al
je 0x51bcd9
dec al
je 0x51bd42
jmp 0x51bdcc
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x51bdcc
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x51bc69
jmp 0x51bdcc
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x51bdcc
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x51bca4
jmp 0x51bdcc
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x51bdcc
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x51bd08
xor ebp, ebp
jmp 0x51bd18
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x51bd21
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x51bce9
jmp 0x51bdcc
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x51bdcc
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x51bd9b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00518c9c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x51bd56
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x52bcd8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff828
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x7d8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x52bd92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406ce4
mov eax, dword [0x6a15cc]
cmp dword [eax], 2
jne 0x52bd47
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00406fd8
mov eax, dword [ebx]
call fcn.00406ec0
push eax
mov eax, dword [ebx]
call fcn.00406eb0
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00406ec0
mov edx, eax
dec edx
mov eax, ebx
call fcn.00406fd8
jmp 0x52bd79
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7d8]
lea eax, [ebp - 0x7d2]
call fcn.0041606c
mov edx, dword [ebp - 0x7d8]
mov eax, ebx
call fcn.00407318
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52bd99
lea eax, [ebp - 0x7d8]
call fcn.0040707c
ret
Function at 0x54c5c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffa4
mov esi, dword [ebp + 8]
add esi, 0xffffff9c
xor eax, eax
push ebp
push 0x54c77c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045ed68
mov eax, dword [eax + 0x40]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x78]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x68]
call fcn.004a0b24
call fcn.00547410
mov edx, dword [ebp + 8]
mov dword [edx - 0x6c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x6c], 0
je 0x54c644
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x6c]
mov eax, dword [eax + 0x64]
call fcn.00457bbc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045ed68
mov eax, dword [eax + 0x40]
pop edx
call fcn.00457bc4
mov eax, dword [ebp + 8]
mov dword [eax - 0x70], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00457a44
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.00415da4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x70]
push eax
push 0x5c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045ed68
call fcn.004594d0
push eax
call sub.gdi32.dll_GetObjectW
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00457af4
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00457b30
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00457b30
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00457b30
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00457bbc
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectW
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045ed68
mov eax, dword [eax + 0x40]
pop edx
call fcn.004579e0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045ed68
mov eax, dword [eax + 0x40]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x74]
mov ecx, edx
shl edx, 6
add edx, ecx
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xb0]
mov edx, dword [ecx + edx*4 + 0xb0]
call fcn.00457774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c783
lea eax, [ebp - 4]
call fcn.0040707c
ret
Function at 0x55a250
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x728ef0
test esi, esi
jne 0x55a26a
xor eax, eax
jmp 0x55a35b
cmp dword [ebp], 0
jne 0x55a275
call fcn.0055a1e0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x55a335
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x55a281
test edi, edi
jbe 0x55a356
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x55a339
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5635bc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], eax
lea edi, [esp + 0xc]
mov dl, 1
mov eax, dword [0x5546b4]
call fcn.0040517c
mov dword [esp + 8], eax
mov eax, dword [esp]
call fcn.0045ee68
cmp al, 7
jne 0x563698
mov edx, dword [esp]
mov eax, dword [esp + 8]
call fcn.00558be0
test al, al
je 0x563698
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x30]
dec eax
test eax, eax
jl 0x563698
inc eax
mov dword [esp + 0x10], eax
xor ebp, ebp
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x24]
mov esi, eax
dec esi
test esi, esi
jl 0x563691
inc esi
xor ebx, ebx
mov ecx, ebx
mov edx, ebp
mov eax, dword [esp + 8]
call fcn.00558ccc
mov dword [edi], eax
movzx eax, byte [edi]
movzx edx, byte [edi + 3]
imul edx
mov ecx, 0xff
xor edx, edx
div ecx
mov byte [edi], al
movzx eax, byte [edi + 1]
movzx edx, byte [edi + 3]
imul edx
mov ecx, 0xff
xor edx, edx
div ecx
mov byte [edi + 1], al
movzx eax, byte [edi + 2]
movzx edx, byte [edi + 3]
imul edx
mov ecx, 0xff
xor edx, edx
div ecx
mov byte [edi + 2], al
mov eax, dword [edi]
push eax
mov ecx, ebx
mov edx, ebp
mov eax, dword [esp + 0xc]
call fcn.00558cec
inc ebx
dec esi
jne 0x56362e
inc ebp
dec dword [esp + 0x10]
jne 0x56361c
lea eax, [esp + 8]
call fcn.0041d008
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5870b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.005870a0
test eax, eax
jne 0x5870d7
mov eax, esi
xor edx, edx
call fcn.0040708c
jmp 0x58716c
mov eax, ebx
call fcn.00587204
test al, al
je 0x58711f
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004071c8
test edi, edi
je 0x587114
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
jmp 0x58716c
mov eax, esi
xor edx, edx
call fcn.0040708c
jmp 0x58716c
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x587163
mov eax, dword [ebp + 0x270]
call fcn.004384b0
test eax, eax
jle 0x587151
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x270]
mov edx, edi
call fcn.0048cea4
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.0040708c
jmp 0x58716c
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x278]
call fcn.0040708c
jmp 0x58716c
mov eax, esi
xor edx, edx
call fcn.0040708c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x588ec8
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.0040aea8
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
pop esi
pop ebx
ret