joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a880
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a9b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x427c10]
call fcn.00427ce0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x44a989
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00427d80
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00405638
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x44a9c8
call fcn.004056e0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00427de4
lea ecx, [ebp - 4]
mov edx, 0x44aa04
mov eax, dword [ebp - 0xc]
call fcn.0042802c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040f210
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x44a96c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x44aa10
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x48d8f0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a973
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x44aa60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x44aaa7
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44aa8a
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44aa9b
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x44aaa7
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x44f598
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x639e90], 0
je 0x44f6e1
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x633e18]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x44f6e1
mov eax, dword [0x639e94]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x639e90]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44f6b0
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x639e90]
call fcn.00418d70
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x44f6a8
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x44f6a8
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x44f6a8
mov eax, dword [ebp - 0x14]
call fcn.00459c54
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44f6a8
push ebp
call fcn.0044f554
pop ecx
test al, al
jne 0x44f6a8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.004046d4
test al, al
je 0x44f6a8
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.004046d4
cmp byte [ebp - 1], 0
je 0x44f6a8
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x44f6a8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x639e94]
call fcn.0044ecc4
inc edi
dec ebx
jne 0x44f5fd
mov eax, dword [0x639e94]
cmp dword [eax + 8], 0
jle 0x44f6c8
mov eax, dword [0x639e94]
call fcn.0044ed7c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44f6e1
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044f3b8
pop ecx
test al, al
jne 0x44f6e1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456b28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004076bc
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00451920
test ebx, ebx
jne 0x456b7b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00456a64
mov ebx, eax
test ebx, ebx
je 0x456c66
cmp esi, ebx
je 0x456ba4
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x456bb9
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x456bf1
add eax, 0xffffff5f
sub eax, 2
jb 0x456c09
dec eax
sub eax, 2
jb 0x456c1d
dec eax
sub eax, 2
jb 0x456c13
jmp 0x456c27
add eax, 0xfffffdff
sub eax, 2
jb 0x456c09
dec eax
sub eax, 2
jb 0x456c1d
dec eax
sub eax, 2
jb 0x456c13
jmp 0x456c27
mov byte [esp + 0x120], 0
jmp 0x456c2f
mov byte [esp + 0x120], 2
jmp 0x456c2f
mov byte [esp + 0x120], 1
jmp 0x456c2f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00437e60
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00453090
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x456c68
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x45edbc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x634140]
cmp byte [eax + 0xc], 0
je 0x45ef29
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ef22
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x639ea0], 0
jne 0x45ee10
push 0x45ef30
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x45ef38
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639ea0], eax
cmp dword [0x48da38], 0
jne 0x45ef0b
push 0x45ef48
call sub.kernel32.dll_LoadLibraryA
mov dword [0x48da38], eax
cmp dword [0x48da38], 0
je 0x45ef0b
push 0x45ef54
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639ea4], eax
push 0x45ef64
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639ea8], eax
push 0x45ef78
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639eac], eax
push 0x45ef90
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639eb0], eax
push 0x45efa8
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639eb4], eax
push 0x45efbc
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639eb8], eax
push 0x45efd4
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639ebc], eax
push 0x45efec
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639ec0], eax
push 0x45f008
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639ec4], eax
push 0x45f014
mov eax, dword [0x48da38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x639ec8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ef29
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4637b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405848
mov eax, dword [ebp - 8]
call fcn.00405848
xor eax, eax
push ebp
push 0x4638c2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 1
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403aec
push 1
call sub.kernel32.dll_Sleep_2
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], 0x540
cmp byte [0x48dc14], 0
je 0x46382e
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x463836
mov eax, 0x4638d4
mov dword [ebp - 0x38], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00463730
mov eax, dword [ebp - 0x48]
call fcn.00405d34
mov dword [ebp - 0x34], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00463730
mov eax, dword [ebp - 0x4c]
call fcn.00405d34
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x46389a
push 1
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcessId
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4638c9
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00405bbc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret

Function at 0x4638ec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x463990
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x463975
mov eax, dword [ebp - 0xc]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4639a0
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x463975
mov eax, edi
mov edx, dword [ebp - 0x14]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463997
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x463ab0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x463c64
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x134]
mov eax, 0x463c7c
call fcn.004638ec
mov eax, dword [ebp - 0x134]
mov edx, 0x463c94
call fcn.004057f0
setne byte [ebp - 5]
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x463c30
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.004639c8
cmp dword [ebp - 4], 0
je 0x463c23
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040e23c
mov eax, dword [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
call fcn.004638e0
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0040e23c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
jne 0x463c02
lea eax, [ebp - 0x14c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.004651dc
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004095e0
mov eax, dword [ebp - 0x144]
mov edx, 0x463cac
call fcn.004057f0
sete al
and al, byte [ebp - 5]
je 0x463c02
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
lea eax, [ebp - 0x150]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 4]
call fcn.00405694
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x463b4c
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463c6b
lea eax, [ebp - 0x150]
mov edx, 8
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x463da4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x463dd9
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x48ddf4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x463db9
pop edi
pop esi
pop ebx
ret
Function at 0x463e0c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463e96
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
jne 0x463e70
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x110]
call fcn.0040cce0
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x408910]
call fcn.0040d4f4
call fcn.00404d34
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a5e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463e9d
lea eax, [ebp - 0x110]
call fcn.004053c8
ret

Function at 0x464084
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x46420a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4641d6
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a29c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409558
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409558
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
je 0x4641a9
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409558
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409558
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004057f0
jne 0x4641c3
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x464104
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464211
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x4644f0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x464654
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x464624
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
nop
add eax, 0
add eax, 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x10]
call fcn.00409f68
test al, al
je 0x46455b
nop
add eax, 0
add eax, 0
push ebx
call sub.kernel32.dll_DeleteFileA
nop
add eax, 0
add eax, 0
nop
add eax, 0
add eax, 0
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
xor edx, edx
call fcn.00463730
mov eax, dword [ebp - 0x14]
call fcn.00405d34
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x464613
push dword fs:[eax]
mov dword fs:[eax], esp
nop
add eax, 0
add eax, 0
cmp dword [ebp - 8], 0
je 0x4645f5
nop
add eax, 0
add eax, 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
nop
add eax, 0
add eax, 0
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
nop
add eax, 0
add eax, 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46461a
nop
add eax, 0
add eax, 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x464b10
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464baa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x90]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x90]
call fcn.00409f68
test al, al
je 0x464b91
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x8c]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464b91
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.0042578c
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425818
mov eax, ebx
call fcn.00425658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464bb1
lea eax, [ebp - 0x90]
call fcn.004053c8
ret
Function at 0x464bbc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464c55
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8c]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x8c]
call fcn.00409f68
test al, al
je 0x464c3c
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x88]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464c3c
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.0042578c
mov edx, edi
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425818
mov eax, ebx
call fcn.00425658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464c5c
lea eax, [ebp - 0x8c]
call fcn.004053c8
ret
Function at 0x465218
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov eax, ebp
mov edx, esi
call fcn.0040541c
mov eax, esi
test eax, eax
je 0x465234
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jbe 0x465269
mov ebx, 1
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 4
mov byte [eax + ebx - 1], dl
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 0xc
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x46523f
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4669ac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x466a75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x466a5a
mov eax, dword [ebp - 0x10]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x466a84
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x466a39
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004055c0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x466aac
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x466a5a
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466a7c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret

Function at 0x466ad0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x466b74
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x466b59
mov eax, dword [ebp - 0xc]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x466b84
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x466b59
mov eax, edi
mov edx, dword [ebp - 0x14]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466b7b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret