joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4635a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4635b3
xor eax, eax
pop esi
pop ebx
ret
cmp byte [0x540be0], 0
jne 0x4635c1
call fcn.00463548
or eax, 0xffffffff
movzx edx, byte [ebx]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x5508a4]
shr eax, 8
xor edx, eax
mov eax, edx
inc ebx
dec esi
test esi, esi
jne 0x4635c4
xor eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x4635ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004072a0
xor eax, eax
push ebp
push 0x463683
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x46362c
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x46362c
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00406c98
test eax, eax
je 0x463635
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46366d
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
movzx esi, bx
shr esi, 8
xor ecx, esi
and ecx, 0xff
movzx ecx, word [ecx*2 + 0x5409e0]
shl ebx, 8
and bx, 0xffff
xor cx, bx
mov ebx, ecx
inc edx
dec eax
jne 0x46363e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46368a
lea eax, [ebp - 4]
call fcn.00406a7c
ret

Function at 0x463f68
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.00404e14
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.00404e14
mov dword [ebp - 0x50], 0x67452301
mov dword [ebp - 0x4c], 0xefcdab89
mov dword [ebp - 0x48], 0x98badcfe
mov dword [ebp - 0x44], 0x10325476
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x5c], eax
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
add dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x60]
jbe 0x463fdc
inc dword [ebp - 0x5c]
test ebx, ebx
jbe 0x464032
mov edi, 0x40
sub edi, dword [ebp - 0x54]
cmp ebx, edi
jb 0x464019
mov ecx, edi
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, esi
call fcn.0040450c
mov eax, 0x40
sub eax, dword [ebp - 0x54]
sub ebx, eax
mov eax, 0x40
sub eax, dword [ebp - 0x54]
add esi, eax
push ebp
call fcn.004636ac
pop ecx
jmp 0x46402e
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, esi
mov ecx, ebx
call fcn.0040450c
add dword [ebp - 0x54], ebx
xor ebx, ebx
test ebx, ebx
ja 0x463fe0
mov eax, dword [ebp - 0x54]
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x54], 0x38
jb 0x464047
push ebp
call fcn.004636ac
pop ecx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
push ebp
call fcn.004636ac
pop ecx
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
mov ecx, 0x10
call fcn.0040450c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464078
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x464099
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x464086
pop edi
pop esi
pop ebx
ret

Function at 0x4640d4
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004640a0
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004640a0
mov esi, eax
xor eax, eax
mov ecx, dword [0x550cac]
mov edx, dword [0x550cb0]
mov dword [esp + 4], edx
mov edx, dword [0x550cb4]
mov dword [esp + 8], edx
mov edx, dword [0x550cb8]
mov dword [esp + 0xc], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
add ebx, edi
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
add esi, edi
dec edx
jne 0x464120
mov eax, ebx
call fcn.004640a0
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.004640a0
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x464184
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004640a0
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004640a0
mov esi, eax
mov eax, 0xc6ef3720
mov ecx, dword [0x550cac]
mov edx, dword [0x550cb0]
mov dword [esp + 4], edx
mov edx, dword [0x550cb4]
mov dword [esp + 8], edx
mov edx, dword [0x550cb8]
mov dword [esp + 0xc], edx
mov edx, 0x20
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
sub esi, edi
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
sub ebx, edi
sub eax, 0x9e3779b9
dec edx
jne 0x4641d3
mov eax, ebx
call fcn.004640a0
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.004640a0
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x464488
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov esi, dword [eax]
mov edi, dword [ecx]
mov eax, ebx
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
lea ecx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
xor eax, eax
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 4], 0
je 0x4644ef
lodsw ax, word [esi]
mov bl, al
shr bl, 2
mov dl, byte [ebx + ecx]
mov bh, ah
and bh, 0xf
rol ax, 4
and ax, 0x3f
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
lodsb al, byte [esi]
mov bl, al
shr bx, 6
mov dl, byte [ebx + ecx]
and al, 0x3f
xor ah, ah
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
dec dword [ebp - 4]
jne 0x4644b5
cmp dword [ebp - 8], 0
je 0x46453f
xor eax, eax
xor ebx, ebx
xor edx, edx
lodsb al, byte [esi]
shl ax, 6
mov bl, ah
mov dl, byte [ebx + ecx]
dec dword [ebp - 8]
je 0x46452a
shl ax, 2
and ah, 3
lodsb al, byte [esi]
shl ax, 4
mov bl, ah
mov dh, byte [ebx + ecx]
shl edx, 0x10
shr al, 2
mov bl, al
mov dl, byte [ebx + ecx]
mov dh, 0x3d
jmp 0x464539
shr al, 2
mov bl, al
mov dh, byte [ebx + ecx]
shl edx, 0x10
mov dh, 0x3d
mov dl, 0x3d
mov eax, edx
ror eax, 0x10
stosd dword es:[edi], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x482d10
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
push 0
call fcn.00406de4
add esp, 0x104
pop ebx
ret

Function at 0x485158
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
push 0
call fcn.00406de4
add esp, 0x104
pop ebx
ret

Function at 0x485190
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
push 0
call fcn.00406de4
add esp, 0x104
pop ebx
ret
Function at 0x485dbc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x485f18
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call fcn.00482c14
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.004159d0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.004159d0
mov edx, dword [ebp - 0xc]
pop eax
call fcn.00407e80
mov eax, dword [ebp - 8]
call fcn.00407ae8
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
test ebx, ebx
je 0x485efd
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x485e5e
cmp esi, 4
jne 0x485e5e
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x485efd
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x485edf
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.00482c14
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.004159d0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.004159d0
mov edx, dword [ebp - 0x14]
pop eax
call fcn.00407e80
mov eax, dword [ebp - 0x10]
call fcn.00407ae8
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485f1f
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00407a54
ret
Function at 0x4875e8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4876fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x550e78], bl
mov eax, 0x550e7c
mov edx, esi
call fcn.00406ad0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x24]
movzx edx, bl
mov eax, dword [0x480e14]
call fcn.0042a390
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
call fcn.00404328
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x28]
mov eax, 8
call fcn.004159d0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x20]
mov ecx, 2
mov eax, 0x487718
call fcn.004171bc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00407cb0
mov eax, dword [ebp - 4]
call fcn.004072b0
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp byte [0x543bf0], 0
jne 0x4876a8
mov eax, ebx
add al, 0xfd
sub al, 7
jb 0x4876d2
cmp dword [0x551718], 0
je 0x4876d2
add bl, 0xfb
sub bl, 5
jae 0x4876d2
push 0x242010
push 0x487780
mov eax, esi
call fcn.004072b0
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487704
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00407a54
lea eax, [ebp - 8]
call fcn.00407a4c
lea eax, [ebp - 4]
call fcn.00406a7c
ret

Function at 0x487ac8
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x487a90
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x487bc8
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x487beb
mov dword [esp], eax
mov byte [esp + 4], 0
mov eax, esp
push eax
push 0x487b34
call sub.user32.dll_EnumWindows
movzx edx, byte [esp + 4]
mov eax, edx
pop ecx
pop edx
ret

Function at 0x487c68
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, edx
mov dword [esp], eax
push 0x80000001
lea eax, [esp + 0x18]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.00435230
lea esi, [esp + 0x14]
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, esp
push eax
push 0x487bf0
call sub.user32.dll_EnumWindows
mov edi, ebx
lea esi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x487ccd
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.00435230
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x487d50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004072a0
xor eax, eax
push ebp
push 0x487e95
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x487e7f
mov eax, dword [ebp - 4]
test eax, eax
je 0x487d99
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x487d99
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00406c98
test eax, eax
je 0x487da2
sub eax, 4
mov eax, dword [eax]
lea ebx, [eax + 1]
push 0
call sub.user32.dll_OpenClipboard
xor edx, edx
push ebp
push 0x487e78
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x487e5e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x487e40
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x487e0f
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x487e0f
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00406c98
mov edx, dword [ebp - 0xc]
mov ecx, ebx
call fcn.0040450c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487e47
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487e9c
lea eax, [ebp - 4]
call fcn.00406a7c
ret

Function at 0x487ea4
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x487f79
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x487f4e
cmp byte [0x543be8], 0
je 0x487ef2
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 0x5c]
mov ecx, 0
call fcn.00406d94
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 4]
call fcn.0044bc18
jmp 0x487f06
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00406d94
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00404e14
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [0x550e68]
call fcn.004072b0
push eax
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004072b0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487f80
lea eax, [ebp - 0x5c]
call fcn.00406a7c
lea eax, [ebp - 4]
call fcn.00406a7c
ret
Function at 0x488110
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x548a14]
movzx edx, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x480f7c]
call fcn.00487f84
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4881e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00487ffc
test al, al
je 0x4881cb
cmp word [ebp - 4], 0x5a4d
jne 0x4881cb
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0043af50
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00487ffc
test al, al
je 0x4881cb
cmp dword [ebp - 8], 0
je 0x4881cb
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0043af50
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00487ffc
test al, al
je 0x4881cb
cmp dword [ebp - 0xc], 0x4550
jne 0x4881cb
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.00487ffc
test al, al
je 0x4881cb
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4881e8
mov eax, dword [ebp - 0x10]
call fcn.004056d0
ret
Function at 0x4881f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x488387
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x480f7c]
call fcn.00487f84
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48836a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00487ffc
test al, al
je 0x488354
cmp word [ebp - 4], 0x5a4d
jne 0x488354
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0043af50
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00487ffc
test al, al
je 0x488354
cmp dword [ebp - 8], 0
je 0x488354
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0043af50
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00487ffc
test al, al
je 0x488354
cmp dword [ebp - 0xc], 0x4550
jne 0x488354
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.00487ffc
test al, al
je 0x488350
test byte [ebp - 0x15], 0x20
je 0x488350
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.00482a68
mov eax, dword [ebp - 0x2c]
call fcn.004072b0
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x488349
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x488398
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x48832e
push 0xa
push 0x4883a4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x48832e
mov byte [ebp - 1], 2
jmp 0x488332
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488354
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488371
mov eax, dword [ebp - 0x10]
call fcn.004056d0
ret
Function at 0x488b40
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x488bac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00407ae8
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x488b78
and ebx, 0xfffffffe
push ebx
push edi
call sub.kernel32.dll_SetFileAttributesW
mov edx, edi
lea eax, [ebp - 4]
call fcn.00407c18
mov eax, dword [ebp - 4]
call fcn.00407ae8
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488bb3
lea eax, [ebp - 4]
call fcn.00407a4c
ret

Function at 0x48b3c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48b54e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f6
jb 0x48b423
cmp byte [ebp - 5], 0x80
jb 0x48b423
and byte [ebp - 5], 0x7f
mov byte [ebp - 6], 1
movzx edx, byte [ebp - 5]
mov eax, ebx
call fcn.00404788
movzx ecx, byte [ebp - 5]
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f4
jb 0x48b522
cmp byte [esi + 0x3b], 0
je 0x48b483
mov eax, dword [0x551088]
mov edx, dword [esi + 0x37]
call fcn.0040722c
je 0x48b473
mov eax, dword [esi + 0x37]
call fcn.00464234
mov eax, 0x551088
mov edx, dword [esi + 0x37]
call fcn.00406ad0
movzx ecx, byte [ebx]
lea edx, [ebx + 1]
lea eax, [ebx + 1]
call fcn.00464358
jmp 0x48b4c1
cmp byte [ebx], 0
je 0x48b4c1
lea eax, [ebp - 0x14]
mov edx, ebx
mov ecx, 0
call fcn.00406dd4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0046473c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x48b568
call fcn.00406f5c
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, 0xff
call fcn.00406e3c
cmp byte [ebp - 6], 0
je 0x48b533
lea eax, [ebp - 0x1c]
mov edx, ebx
mov ecx, 0
call fcn.00406dd4
push dword [ebp - 0x1c]
push 0x48b578
lea ecx, [ebp - 0x120]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0048b3c4
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x20]
mov ecx, 0
call fcn.00406dd4
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040704c
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, 0xff
call fcn.00406e3c
jmp 0x48b533
movzx edx, byte [ebx]
test edx, edx
jle 0x48b533
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x48b52c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b555
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00406aa0
ret
Function at 0x491a00
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, ecx
mov ebp, edx
mov edi, eax
push 0
push 0
push 0xe
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
inc esi
mov eax, ebx
xor ecx, ecx
mov edx, esi
call fcn.00407594
mov eax, ebx
call fcn.00407328
push eax
push esi
push 0xd
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebx]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x491a55
sub eax, 4
mov eax, dword [eax]
mov edx, ebx
mov ecx, 1
xchg edx, eax
call fcn.00407394
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x492b28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
movzx eax, byte [ebp - 0xe5]
and al, 0x80
cmp al, 0x80
sete al
mov esp, ebp
pop ebp
ret
Function at 0x49a5f8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
cmp byte [0x54413c], 0
jne 0x49a645
xor esi, esi
mov edx, 0x551764
mov eax, esi
mov ebx, 8
test al, 1
je 0x49a62b
shr eax, 1
xor eax, 0xedb88320
jmp 0x49a62d
shr eax, 1
dec ebx
jne 0x49a61e
mov dword [edx], eax
inc esi
add edx, 4
cmp esi, 0x100
jne 0x49a617
mov byte [0x54413c], 1
mov eax, dword [esp + 4]
dec eax
test eax, eax
jl 0x49a672
inc eax
xor esi, esi
mov edx, dword [esp]
movzx edx, byte [edx + esi]
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x551764]
shr edi, 8
xor edx, edi
mov edi, edx
inc esi
dec eax
jne 0x49a651
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret