joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a7b8
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00405080
add esp, 0x104
pop ebx
ret

Function at 0x45b318
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b474
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call fcn.00458a74
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.00409e48
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.00409e48
mov edx, dword [ebp - 0xc]
pop eax
call fcn.004050f4
mov eax, dword [ebp - 8]
call fcn.004052ec
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x45b459
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x45b3ba
cmp esi, 4
jne 0x45b3ba
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x45b459
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x45b43b
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.00458a74
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.00409e48
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.00409e48
mov edx, dword [ebp - 0x14]
pop eax
call fcn.004050f4
mov eax, dword [ebp - 0x10]
call fcn.004052ec
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b47b
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404e34
ret
Function at 0x45c6b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45c7ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x58779c], bl
mov eax, 0x5877a0
mov edx, esi
call fcn.00404e64
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov dl, bl
mov eax, dword [0x457948]
call fcn.0041a310
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
call fcn.00402cdc
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.00409e48
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x45c7c0
call fcn.0040b314
mov eax, dword [ebp - 4]
call fcn.004052ec
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp byte [0x57bb5c], 0
jne 0x45c75e
mov eax, ebx
add al, 0xfd
sub al, 7
jb 0x45c788
cmp dword [0x588038], 0
je 0x45c788
add bl, 0xfb
sub bl, 5
jae 0x45c788
push 0x242010
push 0x45c7f4
mov eax, esi
call fcn.004052ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c7b2
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404e34
lea eax, [ebp - 4]
call fcn.00404e10
ret

Function at 0x45cadc
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x45caa4
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x45cbd8
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x45cbfa
mov dword [esp], eax
mov byte [esp + 4], 0
mov eax, esp
push eax
push 0x45cb48
call sub.user32.dll_EnumWindows
mov dl, byte [esp + 4]
mov eax, edx
pop ecx
pop edx
ret

Function at 0x45cc78
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, edx
mov dword [esp], eax
push 0x80000001
lea eax, [esp + 0x18]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.0041d27c
lea esi, [esp + 0x14]
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, esp
push eax
push 0x45cc00
call sub.user32.dll_EnumWindows
mov edi, ebx
lea esi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x45ccdd
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.0041d27c
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x45cd60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
test ebx, ebx
je 0x45ce3e
mov eax, ebx
call fcn.004050ec
mov esi, eax
inc esi
push 0
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x45ce37
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ce1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45cdff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004052ec
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.00402f34
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ce06
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x45ce44
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x45cf0b
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x45cee0
cmp byte [0x57bb54], 0
je 0x45ce89
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x5c]
call fcn.00405008
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 4]
call fcn.0042c49c
jmp 0x45ce98
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405008
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.0040374c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [0x58778c]
call fcn.004052ec
push eax
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004052ec
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cf12
lea eax, [ebp - 0x5c]
call fcn.00404e10
lea eax, [ebp - 4]
call fcn.00404e10
ret
Function at 0x45d0a8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x582d50]
mov dl, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x45800c]
call fcn.0045cf18
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45d178
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0045cf90
test al, al
je 0x45d162
cmp word [ebp - 4], 0x5a4d
jne 0x45d162
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.00421704
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045cf90
test al, al
je 0x45d162
cmp dword [ebp - 8], 0
je 0x45d162
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00421704
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045cf90
test al, al
je 0x45d162
cmp dword [ebp - 0xc], 0x4550
jne 0x45d162
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0045cf90
test al, al
je 0x45d162
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d17f
mov eax, dword [ebp - 0x10]
call fcn.00403ec0
ret
Function at 0x45d188
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d31f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x45800c]
call fcn.0045cf18
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45d302
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0045cf90
test al, al
je 0x45d2ec
cmp word [ebp - 4], 0x5a4d
jne 0x45d2ec
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.00421704
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045cf90
test al, al
je 0x45d2ec
cmp dword [ebp - 8], 0
je 0x45d2ec
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00421704
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045cf90
test al, al
je 0x45d2ec
cmp dword [ebp - 0xc], 0x4550
jne 0x45d2ec
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0045cf90
test al, al
je 0x45d2e8
test byte [ebp - 0x15], 0x20
je 0x45d2e8
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0045891c
mov eax, dword [ebp - 0x2c]
call fcn.004052ec
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45d2e1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x45d330
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x45d2c6
push 0xa
push 0x45d33c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x45d2c6
mov byte [ebp - 1], 2
jmp 0x45d2ca
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d2ec
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d309
mov eax, dword [ebp - 0x10]
call fcn.00403ec0
ret
Function at 0x45d558
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x45d561
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d784
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404e10
mov eax, esi
call fcn.00404e10
test ebx, ebx
je 0x45d769
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.004052ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x45d769
mov eax, dword [ebp - 4]
call fcn.00402be4
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45d762
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.004052ec
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x45d749
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x45d794
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45d693
push 0x45d7b8
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.00409e20
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00409e20
push dword [ebp - 0x24]
push 0x45d7d4
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004051ac
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.004052ec
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45d693
cmp dword [ebp - 0xc], 1
jbe 0x45d693
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0040abcc
mov ecx, eax
mov eax, edi
mov edx, ebx
call fcn.00404f00
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x45d7e8
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45d749
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call fcn.004083e0
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov di, word [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
call fcn.004083e0
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0xc]
mov word [ebp - 0x10], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.00409d0c
push dword [ebp - 0x28]
push 0x45d7f4
lea edx, [ebp - 0x2c]
movzx eax, di
call fcn.00409d0c
push dword [ebp - 0x2c]
push 0x45d7f4
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0xe]
call fcn.00409d0c
push dword [ebp - 0x30]
push 0x45d7f4
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x10]
call fcn.00409d0c
push dword [ebp - 0x34]
mov eax, esi
mov edx, 7
call fcn.004051ac
mov eax, dword [esi]
mov edx, 0x45d800
call fcn.00405238
jne 0x45d749
mov eax, esi
call fcn.00404e10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d769
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00402c14
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d78b
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00404e34
ret
Function at 0x45d9d4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x45da36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004052ec
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45da0c
and ebx, 0xfffffffe
push ebx
push edi
call sub.kernel32.dll_SetFileAttributesA
mov edx, edi
lea eax, [ebp - 4]
call fcn.00405008
mov eax, dword [ebp - 4]
call fcn.0040a584
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45da3d
lea eax, [ebp - 4]
call fcn.00404e10
ret

Function at 0x45e648
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov byte [ebp - 0x15], 0
mov eax, dword [0x57c068]
mov edx, dword [eax]
call dword [edx + 8]
push 0x45e75c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x28], eax
push 0x45e768
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
xor eax, eax
push ebp
push 0x45e74f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45e778
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
push 0x45e790
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x14], eax
push 0x45e7a8
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x24], eax
push 0x45e7b8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
push 0x45e7d4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
push 0x45e7e4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x10], eax
push 0x45e7f4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x1c], eax
push 0x45e804
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x20], eax
call fcn.0045a258
test al, al
je 0x45e70f
push ebp
call fcn.0045e5e8
pop ecx
jmp 0x45e716
push ebp
call fcn.0045e4ac
pop ecx
mov edx, 0x45ddd4
mov eax, dword [0x57c068]
call fcn.0041ec44
cmp byte [ebp - 0x15], 0
jne 0x45e732
push ebp
call fcn.0045de90
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e756
cmp dword [ebp - 0x28], 0
je 0x45e74e
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
Function at 0x45fac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45fc76
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f6
jb 0x45fb22
cmp byte [ebp - 5], 0x80
jb 0x45fb22
and byte [ebp - 5], 0x7f
mov byte [ebp - 6], 1
xor edx, edx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.0040317c
xor ecx, ecx
mov cl, byte [ebp - 5]
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f4
jb 0x45fc49
cmp byte [esi + 0x3b], 0
je 0x45fb85
mov eax, dword [0x5879ac]
mov edx, dword [esi + 0x37]
call fcn.00405238
je 0x45fb74
mov eax, dword [esi + 0x37]
call fcn.0043fc30
mov eax, 0x5879ac
mov edx, dword [esi + 0x37]
call fcn.00404e64
xor ecx, ecx
mov cl, byte [ebx]
lea edx, [ebx + 1]
lea eax, [ebx + 1]
call fcn.0043fcd0
jmp 0x45fbd7
cmp byte [ebx], 0
je 0x45fbd7
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00405074
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00440134
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, 0xff
call fcn.004050c8
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00405074
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x45fc8c
call fcn.00405138
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, 0xff
call fcn.004050c8
cmp byte [ebp - 6], 0
je 0x45fc5b
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00405074
lea eax, [ebp - 0x1c]
mov edx, 0x45fc98
call fcn.004050f4
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, 0xff
call fcn.004050c8
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00405074
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x124]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0045fac0
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x24]
call fcn.00405074
mov edx, dword [ebp - 0x24]
pop eax
call fcn.004050f4
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0xff
call fcn.004050c8
jmp 0x45fc5b
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x45fc5b
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x45fc54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fc7d
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404e34
ret

Function at 0x465a08
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov ebp, edx
mov edi, eax
push 0
push 0
push 0xe
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
inc esi
mov eax, ebx
mov edx, esi
call fcn.00405478
mov eax, ebx
call fcn.00405344
push eax
push esi
push 0xd
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebx]
call fcn.004050ec
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.0040538c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4669c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov al, byte [ebp - 0xe5]
and al, 0x80
cmp al, 0x80
sete al
mov esp, ebp
pop ebp
ret
Function at 0x46d688
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
cmp byte [0x57c0ac], 0
jne 0x46d6d5
xor esi, esi
mov edx, 0x588088
mov eax, esi
mov ebx, 8
test al, 1
je 0x46d6bb
shr eax, 1
xor eax, 0xedb88320
jmp 0x46d6bd
shr eax, 1
dec ebx
jne 0x46d6ae
mov dword [edx], eax
inc esi
add edx, 4
cmp esi, 0x100
jne 0x46d6a7
mov byte [0x57c0ac], 1
mov eax, dword [esp + 4]
dec eax
test eax, eax
jl 0x46d702
inc eax
xor esi, esi
mov edx, dword [esp]
movzx edx, byte [edx + esi]
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x588088]
shr edi, 8
xor edx, edi
mov edi, edx
inc esi
dec eax
jne 0x46d6e1
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x471e7c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x471e84
push ebx
push esi
mov esi, 0x5876ac
xor eax, eax
push ebp
push 0x472103
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov byte [0x587954], 1
mov eax, dword [0x5879b0]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x5879b4]
mov edx, dword [eax]
call dword [edx + 0x44]
call fcn.0045c7fc
call fcn.0047075c
xor eax, eax
push ebp
push 0x4720d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x588054]
call fcn.004616ac
xor eax, eax
push ebp
push 0x4720af
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00461778
xor eax, eax
push ebp
push 0x472081
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x471f2a
mov al, 1
call fcn.00471dbc
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x471f2a
push ebp
call fcn.00471038
pop ecx
and bl, al
mov eax, dword [esi]
cmp byte [eax + 0x30d], 0
je 0x471f66
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x471f4b
mov eax, dword [esi]
cmp byte [eax + 0x2ee], 0
je 0x471f52
xor eax, eax
call fcn.00471dbc
mov eax, dword [esi]
cmp byte [eax + 0x30d], 0
je 0x471f66
push ebp
call fcn.00471c70
pop ecx
and bl, al
test bl, bl
jne 0x471f7f
mov eax, dword [esi]
test byte [eax + 0x331], 0x10
je 0x471f7f
mov eax, dword [0x587778]
call fcn.0045cd60
mov eax, dword [esi]
test byte [eax + 0x2f1], 2
je 0x472002
cmp byte [ebp - 0xd], 0
jne 0x472002
test bl, bl
je 0x471fcc
push 0x242040
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, dword [esi]
call fcn.0042dbf8
mov eax, dword [ebp - 0x14]
call fcn.004052ec
push eax
lea ecx, [ebp - 0x18]
mov dl, 0x90
mov eax, dword [esi]
call fcn.0042dbf8
mov eax, dword [ebp - 0x18]
call fcn.004052ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x472002
push 0x242010
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [esi]
call fcn.0042dbf8
mov eax, dword [ebp - 0x1c]
call fcn.004052ec
push eax
lea ecx, [ebp - 0x20]
mov dl, 0x91
mov eax, dword [esi]
call fcn.0042dbf8
mov eax, dword [ebp - 0x20]
call fcn.004052ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [esi]
test byte [eax + 0x331], 0x20
je 0x472053
test bl, bl
jne 0x472053
lea eax, [ebp - 0x24]
call fcn.00470e2c
mov eax, dword [ebp - 0x24]
call fcn.004052ec
push eax
lea eax, [ebp - 0x28]
call fcn.00461448
mov eax, dword [ebp - 0x28]
call fcn.004052ec
push eax
call sub.kernel32.dll_MoveFileA
lea eax, [ebp - 0x30]
call fcn.00470e2c
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040a6b8
mov eax, dword [ebp - 0x2c]
call fcn.00470eb4
lea eax, [ebp - 0x34]
call fcn.00461448
mov eax, dword [ebp - 0x34]
call fcn.0045d9d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472088
lea eax, [ebp - 0x38]
call fcn.004615f4
mov eax, dword [ebp - 0x38]
call fcn.0045d9d4
ret