joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4537f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f30d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ba030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push esi
call dword [eax + 0x28]
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x30]
call eax
mov bl, al
test esi, esi
je 0x45385c
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x454b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f4f5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4ba030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
push 0x40
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], esi
call fcn.004021fb
movups xmm0, xmmword [str.Integer:_no_integer_satisfies_the_given_parameters]
mov edi, eax
mov dword [ebp - 0x18], 0x32
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], 0x3f
movups xmmword [edi], xmm0
movups xmm0, xmmword [0x4a03cc]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [0x4a03dc]
movups xmmword [edi + 0x20], xmm0
mov ax, word [0x4a03ec]
mov word [edi + 0x30], ax
mov byte [edi + 0x32], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
mov dword [esi], vtable.CryptoPP::Exception.0
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 6
push 0x40
mov byte [ebp - 4], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0xf
call fcn.004021fb
mov dword [esi + 0x10], eax
mov dword [esi + 0x20], 0x32
mov dword [esi + 0x24], 0x3f
movups xmm0, xmmword [edi]
push 0x40
push edi
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [eax + 0x20], xmm0
mov cx, word [edi + 0x30]
mov word [eax + 0x30], cx
mov cl, byte [edi + 0x32]
mov byte [eax + 0x32], cl
call fcn.00426cb3
mov eax, esi
add esp, 8
mov dword [eax], vtable.CryptoPP::Integer::RandomNumberNotFound.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426ca5
mov esp, ebp
pop ebp
ret
Function at 0x46f4f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x1c]
mov eax, esi
shr eax, 2
mov dword [esp + 0xc], eax
push edi
test eax, eax
je 0x46f5a8
mov edi, ebp
sub edi, ecx
cmp eax, 8
jb 0x46f584
mov ebx, eax
xorps xmm3, xmm3
and ebx, 0xfffffff8
lea eax, [ecx + 0x10]
xorps xmm2, xmm2
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edx*4]
add edx, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + edi - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, ebx
jb 0x46f530
mov eax, dword [esp + 0x10]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edx, eax
jae 0x46f5a8
mov ebp, eax
lea ecx, [ecx + edx*4]
sub ebp, edx
mov edx, eax
nop dword [eax]
mov eax, dword [ecx + edi]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or ebx, eax
sub ebp, 1
jne 0x46f590
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
shl edx, 2
sub esi, edx
jne 0x46f5ba
pop edi
pop esi
test ebx, ebx
pop ebp
sete al
pop ebx
pop ecx
ret
add ecx, edx
add ebp, edx
mov edx, ebx
mov dword [esp + 0x1c], ecx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
xor ecx, ecx
or dl, al
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
test esi, esi
je 0x46f684
mov ebx, dword [esp + 0x1c]
mov edi, ebp
sub edi, ebx
cmp esi, 0x20
jb 0x46f66f
mov eax, esi
xorps xmm3, xmm3
and eax, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ecx + ebp]
add ecx, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + edi - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp ecx, dword [esp + 0x10]
jb 0x46f604
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
cmp ecx, esi
jae 0x46f684
lea eax, [ecx + ebx]
sub esi, ecx
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x46f674
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
pop ecx
ret
Function at 0x46f690
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
mov esi, edx
xor ebp, ebp
shr esi, 2
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x18], edi
test esi, esi
je 0x46f772
cmp esi, 0x10
jb 0x46f752
lea eax, [ebx - 4]
lea eax, [eax + esi*4]
lea ecx, [edi - 4]
lea ecx, [ecx + esi*4]
cmp edi, eax
ja 0x46f6d7
cmp ecx, ebx
jae 0x46f752
mov eax, esi
lea ecx, [ebx + 0x30]
and eax, 0xfffffff0
mov edx, ebx
sub edx, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
lea eax, [edi + 0x10]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x1c]
movups xmm0, xmmword [eax - 0x10]
add ebp, 0x10
lea eax, [eax + 0x40]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [esi + eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebp, dword [esp + 0x20]
jb 0x46f6f6
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], ebp
cmp ebp, esi
jae 0x46f772
mov edx, ebx
lea ecx, [edi + ebp*4]
sub edx, edi
sub esi, ebp
mov ebp, dword [esp + 0x10]
nop
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub esi, 1
jne 0x46f760
mov edx, dword [esp + 0x30]
shl ebp, 2
sub edx, ebp
je 0x46f831
add edi, ebp
add ebx, ebp
xor ecx, ecx
test edx, edx
je 0x46f831
cmp edx, 0x40
jb 0x46f816
lea eax, [ebx - 1]
lea esi, [edi - 1]
add eax, edx
add esi, edx
cmp edi, eax
ja 0x46f7a6
cmp esi, ebx
jae 0x46f816
mov ebp, dword [esp + 0x2c]
lea eax, [edi + 0x10]
mov esi, edx
add ebx, 0x30
and esi, 0xffffffc0
sub ebp, dword [esp + 0x18]
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
add ecx, 0x40
lea ebx, [ebx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ebx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebx - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [ebx - 0x40]
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, esi
jb 0x46f7c0
mov dword [esp + 0x20], ecx
cmp ecx, edx
jae 0x46f831
mov ebx, dword [esp + 0x2c]
lea eax, [ecx + edi]
sub ebx, dword [esp + 0x18]
sub edx, ecx
mov cl, byte [ebx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x46f823
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x476800
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47682d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47682d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4788ce
Capabilities:
Accept command line arguments

Disassembly:
push 0x9c
mov eax, 0x491f48
call fcn.004277f1
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x88]
call fcn.00401cb7
mov byte [ebp - 4], 1
call fcn.0047a192
push eax
lea ecx, [ebp - 0x70]
call fcn.00406212
push 0x37
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 2
push eax
mov ecx, 0x4be0fc
call fcn.004089db
mov esi, eax
push 0x4a9828
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00401d12
pop ecx
push esi
push eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
push dword [ebp - 0xa4]
call fcn.0040829b
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401c80
lea ecx, [ebp - 0x58]
call fcn.004015ac
lea ecx, [ebp - 0x40]
call fcn.004015ac
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.004015ac
push 8
pop edi
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push 0x4a2c60
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00433ab3
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x478a2b
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x58]
call fcn.0040a9f2
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
cmp dword [ebp - 0x44], 0x10
push esi
push dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x58]
push 1
push ecx
call fcn.00433d92
push esi
push 1
push 1
push 0x4a9880
call fcn.00433d92
add esp, 0x20
lea ecx, [ebp - 0x40]
mov edx, 0x4e468c
call fcn.0040a9f2
cmp dword [ebp - 0x30], 0
je 0x478a14
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push esi
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
push 1
push eax
call fcn.00433d92
add esp, 0x10
push esi
call fcn.00433ef1
pop ecx
lea ecx, [ebp - 0x40]
call fcn.00402429
lea ecx, [ebp - 0x58]
call fcn.00402429
lea ecx, [ebp - 0x70]
call fcn.004015ac
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0
call fcn.004015ac
call fcn.00479f9b
cmp dword [0x4e46e8], edi
mov esi, 0x4e46d4
push ecx
mov eax, esi
mov ecx, esp
cmovae eax, dword [0x4e46d4]
push eax
call fcn.0040756b
mov ecx, dword [0x4e4978]
call fcn.0047c68b
pop ecx
test eax, eax
je 0x478a7a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4e46e8], edi
cmovae esi, dword [0x4e46d4]
push esi
call fcn.00439792
cmp dword [ebp - 0x18], 0
pop ecx
je 0x478ac0
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
call fcn.00408f89
test al, al
je 0x478ac0
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00439792
pop ecx
mov eax, dword [ebp - 0x14]
cmp eax, edi
jb 0x478b0e
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], ecx
cmp eax, 0x1000
jb 0x478b05
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0040155c
mov eax, dword [ebp - 0xa8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xa4]
push eax
push ecx
call fcn.00426cb3
pop ecx
pop ecx
call fcn.004277a0
ret
Function at 0x479248
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push 0x464
mov eax, 0x4920f1
call fcn.004277f1
mov esi, ecx
mov ecx, dword [esi]
call fcn.0047c57e
mov edx, dword [esi]
lea ecx, [ebp - 0x448]
mov ebx, eax
call fcn.0047c59c
lea eax, [ebp - 0x470]
xor esi, esi
push eax
mov dword [ebp - 4], esi
push ebx
mov dword [ebp - 0x470], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x464], esi
push 0x1c
lea eax, [ebp - 0x460]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x4be0fc
call fcn.004089db
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x4792bb
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x468]
lea edi, [ebp - 0x42c]
cmp dword [ebp - 0x46c], eax
cmovne eax, dword [ebp - 0x46c]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x430], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x418], 7
mov word [ebp - 0x42c], ax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x414], eax
test ecx, ecx
je 0x479325
push ecx
lea ecx, [ebp - 0x42c]
call fcn.00402454
lea eax, [ebp - 0x430]
push eax
push 0x4119f7
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x468]
lea ecx, [ebp - 0x42c]
sub esi, dword [ebp - 0x46c]
sar esi, 2
call fcn.004015ac
lea ecx, [ebp - 0x460]
call fcn.004015ac
cmp esi, 1
jle 0x4793f1
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00428be0
mov esi, dword [ebp - 0x46c]
add esp, 0xc
jmp 0x4793e3
push 0x200
lea eax, [ebp - 0x410]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp - 0x434], 8
lea eax, [ebp - 0x448]
lea ecx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x448]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4793d7
test dx, dx
je 0x4793d3
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4793d7
add ecx, 4
add eax, 4
test dx, dx
jne 0x4793b1
xor eax, eax
jmp 0x4793dc
sbb eax, eax
or eax, 1
test eax, eax
je 0x4793ed
add esi, 4
cmp esi, dword [ebp - 0x468]
jne 0x479383
jmp 0x479408
mov ebx, dword [esi]
jmp 0x479408
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x46c]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x479408
mov ebx, dword [ecx]
lea ecx, [ebp - 0x46c]
call fcn.00402f97
lea ecx, [ebp - 0x448]
call fcn.004015ac
mov eax, ebx
call fcn.004277a0
ret
Function at 0x479906
Capabilities:
Create thread

Disassembly:
push 0x5c
mov eax, 0x49221f
call fcn.0042785d
cmp byte [0x4e4a35], 0
jne 0x479983
xor esi, esi
lea eax, [ebp - 0x48]
push eax
push esi
push 0x4e4640
push 0x403571
push esi
push esi
mov dword [0x4e49a0], esi
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], esi
call fcn.00480a00
or dword [ebp - 4], 0xffffffff
mov dword [0x4e49a0], eax
jmp 0x47995c
cmp dword [ebp - 0x48], 0
je 0x47997a
push esi
push esi
push 0x502
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4e49a0], 0
je 0x479989
call fcn.004277af
ret
lea ecx, [ebp - 0x2c]
call fcn.004022c3
mov dword [ebp - 4], 2
call fcn.00407bb0
test al, al
lea eax, [ebp - 0x44]
je 0x4799c9
push 0x2b
push 0x13
push eax
call fcn.00478fbd
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402034
lea ecx, [ebp - 0x44]
call fcn.0040244f
lea ecx, [ebp - 0x2c]
call fcn.0047f346
jmp 0x4799e4
push 0x29
push 0x11
push eax
call fcn.00478fbd
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402034
lea ecx, [ebp - 0x44]
call fcn.0040244f
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00406142
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x68]
call fcn.00405794
push 0x4b6674
lea eax, [ebp - 0x68]
push eax
call fcn.0042a96e
int3

Function at 0x479a0f
Capabilities:
Create thread

Disassembly:
push esi
call fcn.004340ff
cmp byte [0x4e4a35], 0
mov esi, eax
jne 0x479a6c
cmp dword [0x4e499c], 0
jne 0x479a6c
cmp word [0x4e4ab6], 3
push edi
mov edi, 0x4e4ab0
jne 0x479a50
mov ecx, edi
call fcn.004023fa
test al, 1
je 0x479a50
mov eax, dword [0x4e4750]
shr eax, 9
test al, 1
je 0x479a6b
push 0x4e49a4
xor eax, eax
push eax
push edi
push 0x4064a1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e49a8], eax
pop edi
mov eax, esi
pop esi
ret
Function at 0x479c76
Capabilities:
Check mutex on windows

Disassembly:
push 0x64
mov eax, 0x4922bf
call fcn.004277f1
mov eax, dword [0x4e4750]
shr eax, 0xe
test al, 1
je 0x479d19
push 0x4e4658
lea ecx, [ebp - 0x28]
call fcn.00406212
and dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 0x4a9858
call fcn.00401cb7
push 0x4a9828
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00401cb7
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x28]
call fcn.0040ac6a
pop ecx
lea ecx, [ebp - 0x58]
call fcn.004015ac
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.004015ac
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4e49ac], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x479d1f
lea ecx, [ebp - 0x28]
call fcn.004015ac
call fcn.004277a0
ret
push 0x2e
push 0x29
lea eax, [ebp - 0x70]
push eax
call fcn.00478fbd
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.0047f346
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406142
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x50]
call fcn.00405794
push 0x4b6674
lea eax, [ebp - 0x50]
push eax
call fcn.0042a96e
int3

Function at 0x47a192
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4ba030]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4e4680], 0
push esi
mov esi, 0x4e4670
jne 0x47a2ad
push ebx
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x804]
mov ecx, esi
push eax
call fcn.00402454
cmp dword [0x4e4684], 8
mov eax, esi
cmovae eax, dword [0x4e4670]
xor ebx, ebx
push ebx
push eax
call fcn.00439309
pop ecx
pop ecx
test eax, eax
je 0x47a20b
push 0x4a2cec
mov ecx, esi
call fcn.00402454
mov ecx, esi
call fcn.00409368
cmp dword [0x4e4680], ebx
je 0x47a230
cmp dword [0x4e4684], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4e4670]
push eax
call fcn.00439309
pop ecx
pop ecx
test eax, eax
je 0x47a243
push str.TEMP
call fcn.00439ca3
pop ecx
push eax
mov ecx, esi
call fcn.00402454
cmp dword [0x4e4680], ebx
je 0x47a268
cmp dword [0x4e4684], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4e4670]
push eax
call fcn.00439309
pop ecx
pop ecx
test eax, eax
je 0x47a27b
push 0x4a9850
call fcn.00439ca3
pop ecx
push eax
mov ecx, esi
call fcn.00402454
cmp dword [0x4e4680], ebx
je 0x47a2a0
cmp dword [0x4e4684], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4e4670]
push eax
call fcn.00439309
pop ecx
pop ecx
test eax, eax
je 0x47a2ac
push 0x4e4640
mov ecx, esi
call fcn.00406248
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00426ca5
leave
ret
Function at 0x47e575
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4ba030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [esi + 0xc], 0x201
jne 0x47e666
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00428be0
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x218]
push eax
push edi
push 0x44b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x244], eax
xor eax, eax
push 7
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
lea edi, [ebp - 0x234]
pop ecx
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebx + 0xb8]
pop edi
cmp eax, dword [ebx + 0xbc]
je 0x47e669
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x47e669
and dword [eax], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00426ca5
leave
ret 0xc

Function at 0x47f650
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov dword [0x4e4bb4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xfffffffffffffffa
push dword [0x4e4bb4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
push eax
push 0x47f370
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
test eax, eax
mov dword [0x4e4bb8], eax
pop esi
setne al
pop ebp
ret 4
Function at 0x48a160
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor bl, bl
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x48a17d
mov eax, dword [esi]
test eax, eax
je 0x48a2a1
cmp word [eax], 0
je 0x48a2a1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48a2a1
test al, 0x10
jne 0x48a2a1
cmp dword [esi + 0x14], 8
jb 0x48a1af
mov esi, dword [esi]
push 0x4a9878
push esi
call fcn.00433ab3
mov esi, eax
add esp, 8
test esi, esi
je 0x48a2a1
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x18], xmm0
call fcn.0043b74b
push 2
push 0
push esi
call fcn.0043add2
lea eax, [esp + 0x24]
push eax
push esi
call fcn.0043b74b
lea eax, [esp + 0x34]
push eax
push esi
call fcn.0043bbcc
add esp, 0x24
cmp dword [esp + 0x10], 0x28
jbe 0x48a298
xor eax, eax
mov dword [esp + 0x20], 0x48535844
push esi
push 1
mov word [esp + 0x40], ax
xorps xmm0, xmm0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
push 0x28
push eax
mov dword [esp + 0x34], 0x28
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
movsd qword [esp + 0x40], xmm0
call fcn.0043a3bb
add esp, 0x10
test eax, eax
je 0x48a298
mov eax, dword [esp + 0x2c]
not eax
ror eax, 3
cmp eax, dword [esp + 0xc]
jne 0x48a298
cmp dword [esp + 0x20], 0x48535844
jne 0x48a298
cmp dword [esp + 0x24], 0x28
jne 0x48a298
movzx ecx, word [esp + 0x38]
add ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
add ecx, dword [esp + 0x40]
add eax, 0x28
add eax, ecx
cmp eax, dword [esp + 0x10]
sete bl
push esi
call fcn.00433ef1
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx