joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484178
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x48418f
add esp, 0xfffffff0
call fcn.00403b08
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00426428
mov eax, dword [0x663b34]
cmp word [eax + 2], 0
jne 0x4841b7
mov eax, dword [0x663b34]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004858f8
mov eax, dword [0x663ccc]
cmp word [eax + 2], 0
jne 0x4841d1
mov eax, dword [0x663ccc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00485af0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41a8a0]
call fcn.00403774
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41a8a0]
call fcn.00403774
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x428ad4]
call fcn.00430f08
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x484358
mov eax, dword [0x663960]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00431314
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4860a0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x663960]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040defc
test eax, eax
je 0x4842c6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409b1c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040df24
test eax, eax
je 0x4842da
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404848
mov eax, dword [0x6636e0]
cmp byte [eax], 0
jne 0x48430e
mov eax, ebx
call fcn.00484480
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0048627c
mov eax, ebx
call fcn.00486c40
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x48434e
call fcn.00403b60
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484700
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x664bf4]
cmp dword [eax + 0x30], 0
je 0x4847aa
cmp dword [ebx + 0x94], 0
jne 0x4847a4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x484690
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4847a4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x48476a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4847a4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d28c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x484779
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x48530c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x485341
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004046c8
jmp 0x48534e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040462c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x486458
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x486499
mov eax, esi
call fcn.0046bee8
test al, al
je 0x486499
mov eax, dword [ebx + 0x84]
call fcn.0046bbe4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x486499
push 0
mov eax, dword [ebx + 0x84]
call fcn.0046bbe4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x489f3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a880
cmp ebx, dword [ebp - 8]
jge 0x489f9f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042ac9c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042ac9c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042acc8
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x489f65
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x489fa8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a880
cmp ebx, dword [ebp - 8]
jge 0x48a00b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042ac9c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042ac9c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042acc8
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x489fd1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x48eb04
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x48eb33
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x48ebb2
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0048d3c0
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48eb80
mov cx, word [esp]
sub cx, si
jmp 0x48eb82
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48eb69
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48eba8
mov cx, word [esp]
sub cx, si
jmp 0x48ebaa
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48eb91
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x48ec0f
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0048e7d8
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x48ebfa
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x48ec0f
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48eb0e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x495144
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x664c34
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x495166
shr eax, 1
xor eax, 0xedb88320
jmp 0x495168
shr eax, 1
dec edx
jne 0x495154
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x49514d
mov byte [0x665034], 1
pop esi
pop ebx
ret

Function at 0x495184
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x665034], 0
jne 0x49519b
call fcn.00495144
mov eax, edi
dec eax
test eax, eax
jl 0x4951c4
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x664c34]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4951a5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a016c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x419e20]
call fcn.00404f90
xor eax, eax
push ebp
push 0x4a02b0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x593d40], 0
jne 0x4a01bf
mov ecx, dword [0x663714]
mov dl, 1
mov eax, dword [0x407f24]
call fcn.0040cfa8
call fcn.00403f70
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403178
mov eax, ebx
call fcn.00404e40
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4a02c0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406268
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404e50
test eax, eax
jle 0x4a0257
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a0250
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404860
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404848
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408ecc
test eax, eax
jne 0x4a0250
mov ebx, 0x15
jmp 0x4a025c
mov ebx, 0x10
jmp 0x4a025c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x593d40]
call fcn.004a00c4
mov eax, dword [ebp - 8]
call fcn.004a00c4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a02b7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004045fc
lea eax, [ebp - 0x10]
mov edx, dword [0x419e20]
call fcn.00405060
ret

Function at 0x4a4fec
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004078b0
ret
Function at 0x4a5188
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a88
xor eax, eax
push ebp
push 0x4a52d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004a4fec
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404a98
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4a52b5
xor eax, eax
push ebp
push 0x4a52ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a5297
xor eax, eax
push ebp
push 0x4a5290
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4a5279
xor eax, eax
push ebp
push 0x4a5272
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004a5020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5279
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5297
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a52b5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.004a50a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a52dd
lea eax, [ebp - 4]
call fcn.004045d8
ret

Function at 0x4bacd4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4bad02
mov eax, ebx
call fcn.004bb788
cmp dword [ebx + 0x40], 0
je 0x4bacfb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4bad73
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4bad65
cmp dword [ebx + 8], 0
je 0x4bad24
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4bad36
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4bad65
cmp dword [ebx + 8], 0
je 0x4bad17
cmp eax, 3
je 0x4bad49
dec eax
jne 0x4bad17
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4bad17
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4bad17
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4bad91
cmp dword [ebx + 0x14], 0xcc
je 0x4bad91
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004bad9c
pop ebx
ret
Function at 0x4cce18
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ccf89
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ccf64
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004047c0
lea eax, [ebp - 0x118]
mov edx, 0x4ccfa0
call fcn.004048a0
mov eax, dword [ebp - 0x118]
call fcn.00404a98
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4cced6
lea eax, [ebp - 0x111]
call fcn.00409ae0
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004046c8
jmp 0x4ccedd
mov eax, esi
call fcn.004045d8
cmp bl, 0x61
jae 0x4ccefe
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040ddd0
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.0040462c
jmp 0x4ccf18
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040dd44
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.0040462c
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4ccfac
call fcn.0040a1bc
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.0040462c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccf6b
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4f9708
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004f96f4
test eax, eax
jne 0x4f9729
mov eax, esi
call fcn.004045d8
jmp 0x4f97ba
mov eax, ebx
call fcn.004f9850
test al, al
je 0x4f976f
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004046c8
test edi, edi
je 0x4f9766
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4f97ba
mov eax, esi
call fcn.004045d8
jmp 0x4f97ba
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x4f97b3
mov eax, dword [ebp + 0x208]
call fcn.0041e2ec
test eax, eax
jle 0x4f97a1
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.00447f88
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.0040462c
jmp 0x4f97ba
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x210]
call fcn.0040462c
jmp 0x4f97ba
mov eax, esi
call fcn.004045d8
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4fb48c
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.00406a7c
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret

Function at 0x4fda24
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4fdade
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404ce4
mov eax, dword [0x663f74]
cmp dword [eax], 2
jne 0x4fda93
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404f2c
mov eax, dword [ebx]
call fcn.00404e50
push eax
mov eax, dword [ebx]
call fcn.00404e40
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404e50
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404f2c
jmp 0x4fdac5
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409ccc
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdae5
lea eax, [ebp - 0x3f0]
call fcn.004045d8
ret
Function at 0x5086dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x6653cc
test esi, esi
jne 0x5086f6
xor eax, eax
jmp 0x5087f8
cmp dword [ebp], 0
jne 0x508701
call fcn.0050866c
xor ebx, 0xffffffff
cmp edi, 8
jb 0x5087d1
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x50870d
test edi, edi
jbe 0x5087f3
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x5087d5
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5334c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x533684
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f804
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.00477b38
call fcn.005155f8
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x53354c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.00429c64
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f804
mov eax, dword [eax + 0xc]
pop edx
call fcn.00429c6c
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429b4c
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.00409b78
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f804
call fcn.0042ad10
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429bc0
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429bfc
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429bfc
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429bfc
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429c64
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f804
mov eax, dword [eax + 0xc]
pop edx
call fcn.00429af8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042f804
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x54]
mov ecx, edx
shl edx, 6
add edx, ecx
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xa8]
mov edx, dword [ecx + edx*4 + 0xb0]
call fcn.0042993c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53368b
lea eax, [ebp - 4]
call fcn.004045d8
ret