joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434960
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov esi, dword [eax]
mov edi, dword [ecx]
mov eax, ebx
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
lea ecx, [0x65dfd0]
xor eax, eax
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 4], 0
je 0x4349c8
lodsw ax, word [esi]
mov bl, al
shr bl, 2
mov dl, byte [ecx + ebx]
mov bh, ah
and bh, 0xf
rol ax, 4
and ax, 0x3f
mov dh, byte [ecx + eax]
mov ax, dx
stosw word es:[edi], ax
lodsb al, byte [esi]
mov bl, al
shr bx, 6
mov dl, byte [ecx + ebx]
and al, 0x3f
xor ah, ah
mov dh, byte [ecx + eax]
mov ax, dx
stosw word es:[edi], ax
dec dword [ebp - 4]
jne 0x43498d
cmp dword [ebp - 8], 0
je 0x434a18
xor eax, eax
xor ebx, ebx
xor edx, edx
lodsb al, byte [esi]
shl ax, 6
mov bl, ah
mov dl, byte [ecx + ebx]
dec dword [ebp - 8]
je 0x434a03
shl ax, 2
and ah, 3
lodsb al, byte [esi]
shl ax, 4
mov bl, ah
mov dh, byte [ecx + ebx]
shl edx, 0x10
shr al, 2
mov bl, al
mov dl, byte [ecx + ebx]
mov dh, 0x3d
jmp 0x434a12
shr al, 2
mov bl, al
mov dh, byte [ecx + ebx]
shl edx, 0x10
mov dh, 0x3d
mov dl, 0x3d
mov eax, edx
ror eax, 0x10
stosd dword es:[edi], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x44ae68
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.0040430c
add esp, 0x104
pop ebx
ret

Function at 0x44c660
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040430c
add esp, 0x104
pop ebx
ret

Function at 0x44c694
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040430c
add esp, 0x104
pop ebx
ret
Function at 0x44d1e4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d340
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call fcn.0044ab38
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.0040c214
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.0040c214
mov edx, dword [ebp - 0xc]
pop eax
call fcn.00404380
mov eax, dword [ebp - 8]
call fcn.0040453c
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x44d325
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x44d286
cmp esi, 4
jne 0x44d286
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x44d325
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x44d307
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.0044ab38
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.0040c214
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.0040c214
mov edx, dword [ebp - 0x14]
pop eax
call fcn.00404380
mov eax, dword [ebp - 0x10]
call fcn.0040453c
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d347
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404100
ret
Function at 0x44e568
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44e663
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x667554], bl
mov eax, 0x667558
mov edx, esi
call fcn.00404130
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov dl, bl
mov eax, dword [0x449a70]
call fcn.00412d60
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
call fcn.0040fbc8
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.0040c214
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x44e678
call fcn.0040d7ac
mov eax, dword [ebp - 4]
call fcn.0040453c
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp byte [0x660fc8], 0
jne 0x44e616
mov eax, ebx
add al, 0xfd
sub al, 7
jb 0x44e640
cmp dword [0x667df0], 0
je 0x44e640
add bl, 0xfb
sub bl, 5
jae 0x44e640
push 0x242010
push 0x44e6ac
mov eax, esi
call fcn.0040453c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e66a
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404100
lea eax, [ebp - 4]
call fcn.004040dc
ret

Function at 0x44e994
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x44e95c
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x44ea90
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x44eab2
mov dword [esp], eax
mov byte [esp + 4], 0
mov eax, esp
push eax
push 0x44ea00
call sub.user32.dll_EnumWindows
mov dl, byte [esp + 4]
mov eax, edx
pop ecx
pop edx
ret

Function at 0x44eb30
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, edx
mov dword [esp], eax
push 0x80000001
lea eax, [esp + 0x18]
push eax
mov ecx, 0x80000001
add byte [eax], al
cmp byte [edx + 0x7fffffff], 0xb8
invalid
invalid
invalid
jg 0x44eb3d
xchg dword [edx - 4], esp
dec dword [ebp - 0x72ebdb8c]
jl 0x44eb84
add al, 0xb9
add al, 0
add byte [eax], al
rep movsd dword es:[edi], dword [esi]
mov eax, esp
push eax
push 0x44eab8
call sub.user32.dll_EnumWindows
mov edi, ebx
lea esi, [esp + 4]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x44eb9b
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.00414de0
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x44ec20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
test ebx, ebx
je 0x44ecfe
mov eax, ebx
call fcn.00404378
mov esi, eax
inc esi
push 0
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x44ecf7
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44ecdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x44ecbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040453c
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.00402b04
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ecc6
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x44ed04
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x44edcb
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x44eda0
cmp byte [0x660fc0], 0
je 0x44ed49
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x5c]
call fcn.00404294
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 4]
call fcn.00421380
jmp 0x44ed58
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00404294
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f28
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [0x667544]
call fcn.0040453c
push eax
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040453c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44edd2
lea eax, [ebp - 0x5c]
call fcn.004040dc
lea eax, [ebp - 4]
call fcn.004040dc
ret
Function at 0x44ef64
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x66384c]
mov dl, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x44a0e0]
call fcn.0044edd8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x44f031
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0044ee50
test al, al
je 0x44f01b
cmp word [ebp - 4], 0x5a4d
jne 0x44f01b
mov edx, 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0041810c
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044ee50
test al, al
je 0x44f01b
cmp dword [ebp - 8], 0
je 0x44f01b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0041810c
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044ee50
test al, al
je 0x44f01b
cmp dword [ebp - 0xc], 0x4550
jne 0x44f01b
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0044ee50
test al, al
je 0x44f01b
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f038
mov eax, dword [ebp - 0x10]
call fcn.004032b4
ret

Function at 0x44f040
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44f1d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x44a0e0]
call fcn.0044edd8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x44f1b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0044ee50
test al, al
je 0x44f1a1
cmp word [ebp - 4], 0x5a4d
jne 0x44f1a1
mov edx, 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0041810c
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044ee50
test al, al
je 0x44f1a1
cmp dword [ebp - 8], 0
je 0x44f1a1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0041810c
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044ee50
test al, al
je 0x44f1a1
cmp dword [ebp - 0xc], 0x4550
jne 0x44f1a1
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0044ee50
test al, al
je 0x44f19d
test byte [ebp - 0x15], 0x20
je 0x44f19d
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0044a9e0
mov eax, dword [ebp - 0x2c]
call fcn.0040453c
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x44f196
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x44f1e4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x44f17b
push 0xa
push 0x44f1f0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x44f17b
mov byte [ebp - 1], 2
jmp 0x44f17f
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f1a1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f1be
mov eax, dword [ebp - 0x10]
call fcn.004032b4
ret
Function at 0x44f40c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x44f415
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44f630
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004040dc
mov eax, esi
call fcn.004040dc
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.0040453c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x44f615
mov eax, dword [ebp - 4]
call fcn.004027dc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x44f60e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.0040453c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x44f5f5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x44f640
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x44f53f
push 0x44f664
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.0040c1d8
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0040c1d8
push dword [ebp - 0x24]
push 0x44f680
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404438
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.0040453c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x44f53f
cmp dword [ebp - 0xc], 1
jbe 0x44f53f
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0040cfa8
mov ecx, eax
mov eax, edi
mov edx, ebx
call fcn.004041c4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x44f694
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x44f5f5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call fcn.00408b24
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov di, word [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
call fcn.00408b24
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0xc]
mov word [ebp - 0x10], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.0040c174
push dword [ebp - 0x28]
push 0x44f6a0
lea edx, [ebp - 0x2c]
movzx eax, di
call fcn.0040c174
push dword [ebp - 0x2c]
push 0x44f6a0
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0xe]
call fcn.0040c174
push dword [ebp - 0x30]
push 0x44f6a0
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x10]
call fcn.0040c174
push dword [ebp - 0x34]
mov eax, esi
mov edx, 7
call fcn.00404438
mov eax, dword [esi]
mov edx, 0x44f6ac
call fcn.00404488
jne 0x44f5f5
mov eax, esi
call fcn.004040dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f615
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.004027f4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f637
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00404100
ret
Function at 0x44f878
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x44f8da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040453c
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44f8b0
and ebx, 0xfffffffe
push ebx
push edi
call sub.kernel32.dll_SetFileAttributesA
mov edx, edi
lea eax, [ebp - 4]
call fcn.00404294
mov eax, dword [ebp - 4]
call fcn.0040c50c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f8e1
lea eax, [ebp - 4]
call fcn.004040dc
ret

Function at 0x4504dc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov byte [ebp - 0x15], 0
mov eax, dword [0x6614d0]
mov edx, dword [eax]
call dword [edx + 8]
push 0x4505f0
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x28], eax
push 0x4505fc
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
xor eax, eax
push ebp
push 0x4505e3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45060c
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
push 0x450624
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x14], eax
push 0x45063c
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x24], eax
push 0x45064c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
push 0x450668
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
push 0x450678
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x10], eax
push 0x450688
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x1c], eax
push 0x450698
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x20], eax
call fcn.0044c318
test al, al
je 0x4505a3
push ebp
call fcn.0045047c
pop ecx
jmp 0x4505aa
push ebp
call fcn.00450344
pop ecx
mov edx, 0x44fc78
mov eax, dword [0x6614d0]
call fcn.00415d5c
cmp byte [ebp - 0x15], 0
jne 0x4505c6
push ebp
call fcn.0044fd34
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4505ea
cmp dword [ebp - 0x28], 0
je 0x4505e2
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
Function at 0x451928
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x451aa7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 4]
cmp word [esi + 0x19], 0x1f6
jb 0x451987
cmp byte [ebp - 5], 0x80
jb 0x451987
and byte [ebp - 5], 0x7f
mov byte [ebp - 6], 1
xor edx, edx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.00402cb4
xor ecx, ecx
mov cl, byte [ebp - 5]
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 4]
cmp word [esi + 0x19], 0x1f4
jb 0x451a7a
cmp byte [esi + 0x3b], 0
je 0x4519ea
mov eax, dword [0x667764]
mov edx, dword [esi + 0x37]
call fcn.00404488
je 0x4519d9
mov eax, dword [esi + 0x37]
call fcn.00434760
mov eax, 0x667764
mov edx, dword [esi + 0x37]
call fcn.00404130
xor ecx, ecx
mov cl, byte [ebx]
lea edx, [ebx + 1]
lea eax, [ebx + 1]
call fcn.00434800
jmp 0x451a23
cmp byte [ebx], 0
je 0x451a23
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404300
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00434b5c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x451ac0
call fcn.004043c4
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, 0xff
call fcn.00404354
cmp byte [ebp - 6], 0
je 0x451a8c
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404300
push dword [ebp - 0x1c]
push 0x451acc
lea ecx, [ebp - 0x120]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00451928
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x20]
call fcn.00404300
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404438
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, 0xff
call fcn.00404354
jmp 0x451a8c
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x451a8c
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x451a85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451aae
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00404100
ret

Function at 0x4575bc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov ebp, edx
mov edi, eax
push 0
push 0
push 0xe
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
inc esi
mov eax, ebx
mov edx, esi
call fcn.004046ac
mov eax, ebx
call fcn.00404548
push eax
push esi
push 0xd
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebx]
call fcn.00404378
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.004045c0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x45854c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov al, byte [ebp - 0xe5]
and al, 0x80
cmp al, 0x80
sete al
mov esp, ebp
pop ebp
ret
Function at 0x45f208
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
cmp byte [0x661514], 0
jne 0x45f255
xor esi, esi
mov edx, 0x667e3c
mov eax, esi
mov ebx, 8
test al, 1
je 0x45f23b
shr eax, 1
xor eax, 0xedb88320
jmp 0x45f23d
shr eax, 1
dec ebx
jne 0x45f22e
mov dword [edx], eax
inc esi
add edx, 4
cmp esi, 0x100
jne 0x45f227
mov byte [0x661514], 1
mov eax, dword [esp + 4]
dec eax
test eax, eax
jl 0x45f282
inc eax
xor esi, esi
mov edx, dword [esp]
movzx edx, byte [edx + esi]
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x667e3c]
shr edi, 8
xor edx, edi
mov edi, edx
inc esi
dec eax
jne 0x45f261
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret