joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bcb24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4bcb95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5936bc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4bcb7f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004bcb14
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ba924]
call fcn.004bd9e4
mov dword [0x593724], eax
mov eax, dword [ebp - 4]
call fcn.004bc9a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcb9c
lea eax, [ebp - 8]
call fcn.00405e14
ret

Function at 0x4bcc34
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x4bcc47
or esi, 2
test dl, dl
je 0x4bcc50
or esi, 0
jmp 0x4bcc53
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x4bd870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004047d8
xor eax, eax
push ebp
push 0x4bd9c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x4ba70c]
call fcn.00416308
test eax, eax
jl 0x4bd8d7
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.004bcc18
and eax, 0x7f
mov eax, dword [eax*4 + 0x5936bc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x4bd93a
mov eax, dword [ebx]
call fcn.004045e8
test eax, eax
jle 0x4bd93a
mov eax, dword [ebx]
call fcn.004045e8
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x4bd8fe
mov eax, ebx
mov edx, 0x4bd9e0
call fcn.004045f0
mov eax, dword [ebx]
call fcn.004045e8
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.00405298
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.004bcb14
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x4bd985
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x5995bc]
call fcn.004062f4
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040a110
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040437c
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x407cd4]
call fcn.0040cb48
call fcn.00403cc4
mov eax, dword [ebp - 8]
call fcn.004bd7e8
mov ebx, eax
test edi, edi
je 0x4bd99a
mov eax, edi
call fcn.004034f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd9cf
lea eax, [ebp - 0x1c]
call fcn.00404328
lea eax, [ebp - 0x18]
call fcn.00405e14
lea eax, [ebp - 0x14]
call fcn.00404328
lea eax, [ebp - 4]
call fcn.00404328
ret

Function at 0x4be5ac
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00402e14
mov dword [esp], 0x3c
mov eax, dword [0x599b60]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.shell32.dll_ShellExecuteExA
add esp, 0x3c
pop ebx
ret
Function at 0x4bf0c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bf232
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x599eec]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x599eec]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00483eb8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00445590
xor edx, edx
push ebp
push 0x4bf215
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4bf185
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00405e14
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.004bd230
push eax
mov eax, dword [0x599b60]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x4bf17b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403d70
jmp 0x4bf21c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf1c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00445170
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004bef58
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x4bf19d
push 0
mov edx, 0x4beef0
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00444d28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf21c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004455dc
mov eax, dword [0x599eec]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.00483eb8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf239
lea eax, [ebp - 0x10]
call fcn.00405e14
ret
Function at 0x4caf18
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4caf46
mov eax, ebx
call fcn.004cb9cc
cmp dword [ebx + 0x40], 0
je 0x4caf3f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4cafb7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4cafa9
cmp dword [ebx + 8], 0
je 0x4caf68
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4caf7a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4cafa9
cmp dword [ebx + 8], 0
je 0x4caf5b
cmp eax, 3
je 0x4caf8d
dec eax
jne 0x4caf5b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4caf5b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4caf5b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4cafd5
cmp dword [ebx + 0x14], 0xcc
je 0x4cafd5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004cafe0
pop ebx
ret
Function at 0x4e9368
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e95c8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4e93cb
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004e9048
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d54c
cmp al, 1
jne 0x4e93cb
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004e9310
test al, al
je 0x4e9557
cmp dword [ebp - 8], 0
jge 0x4e93e9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004e9048
mov eax, dword [ebp - 0x210]
call fcn.004045e8
cmp ebx, eax
jge 0x4e9433
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004e9048
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x599f10]
and eax, 0xff
bt dword [edx], eax
jae 0x4e9433
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4e9447
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004e9344
cmp ebx, dword [ebp - 8]
je 0x4e9549
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4e9473
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004036f4
and eax, 0x7f
movzx eax, word [eax*2 + 0x5942cc]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4e9536
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004036f4
and eax, 0x7f
movzx eax, word [eax*2 + 0x5942cc]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0046c0bc
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004036f4
and eax, 0x7f
movzx eax, word [eax*2 + 0x5942cc]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0046c0bc
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e953d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4e95aa
cmp dword [ebp - 8], 0
jge 0x4e9562
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004e9048
mov eax, dword [ebp - 0x218]
call fcn.004045e8
cmp eax, dword [ebp - 8]
jg 0x4e959c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004e9048
mov eax, dword [ebp - 0x21c]
call fcn.004045e8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e9344
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e95cf
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040434c
ret
Function at 0x4ee650
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ee70a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404a34
mov eax, dword [0x599644]
cmp byte [eax], 0
je 0x4ee6bf
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404da4
mov eax, dword [ebx]
call fcn.00404bd0
push eax
mov eax, dword [ebx]
call fcn.00404bc0
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404bd0
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404da4
jmp 0x4ee6f1
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409c20
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee711
lea eax, [ebp - 0x3f0]
call fcn.00404328
ret

Function at 0x4ee718
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00409c20
add esp, 0x3ec
pop ebx
ret

Function at 0x4ee8d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov esi, edx
mov ebp, eax
mov edx, esi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
cmp dword [esi + 0xc], 0
jne 0x4ee99e
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0047cfd8
mov ebx, eax
mov dx, word [esi + 4]
mov eax, ebp
call fcn.004ee594
mov edi, eax
test edi, edi
je 0x4ee937
mov al, byte [0x4ee9ac]
cmp al, bl
jne 0x4ee937
mov edx, edi
mov eax, ebp
call fcn.004ee4cc
mov dword [esi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x4ee99e
cmp byte [ebp + 0x161], 2
jne 0x4ee962
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x599db0]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov edx, 0xb006
call fcn.00466a50
test eax, eax
jne 0x4ee99e
jmp 0x4ee999
mov edx, dword [0x599b60]
mov edx, dword [edx]
mov edx, dword [edx + 0x44]
mov eax, dword [ebp + 0x128]
cmp edx, eax
je 0x4ee999
test byte [eax + 0x2f4], 8
jne 0x4ee999
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x599b60]
mov eax, edx
mov edx, 0xb006
call fcn.00466a50
xor eax, eax
mov dword [esi + 0xc], eax
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f49f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x599db0]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x4f4a9e
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x4f4a3d
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4f4a79
jmp 0x4f4a41
pop edx
pop eax
jge 0x4f4a79
mov eax, dword [0x599db0]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004ef6c4
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x4f4a9e
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x4f4a9e
cmp dword [ebx + 0x11c], 0
je 0x4f4a9e
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00438728
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4fb92c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4fb9e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404a34
mov eax, dword [0x599644]
cmp byte [eax], 0
je 0x4fb99b
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404da4
mov eax, dword [ebx]
call fcn.00404bd0
push eax
mov eax, dword [ebx]
call fcn.00404bc0
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404bd0
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404da4
jmp 0x4fb9cd
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409c20
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb9ed
lea eax, [ebp - 0x3f0]
call fcn.00404328
ret

Function at 0x4febb8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4fec12
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.004fec1c
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fec19
ret

Function at 0x507910
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.0046c0bc
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.004657a4
pop ebx
ret
Function at 0x511b34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x511ca5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x9c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x511c8a
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409c20
mov dl, 1
mov eax, dword [0x4e6600]
call fcn.004e6658
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov dl, 1
mov eax, dword [0x4187e8]
call fcn.004034c8
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.004e66d4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x511c87
mov dl, 1
mov eax, dword [0x4e79f0]
call fcn.004e7a58
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov edx, 0x511cbc
call fcn.004e6c98
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404634
xor eax, eax
push ebp
push 0x511c80
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004e7d58
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00511cc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511c87
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.004034f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004034f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004034f8
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511cac
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040434c
ret

Function at 0x513558
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
ja 0x513584
cmp dword [esp + 4], 5
jne 0x513580
cmp dword [esp + 8], 1
jae 0x513584
xor eax, eax
jmp 0x513586
mov al, 1
mov byte [0x59b32c], al
add esp, 0x94
ret
Function at 0x52d680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004284a8
cmp ebx, dword [ebp - 8]
jge 0x52d6e3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00428954
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00428954
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00428980
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x52d6a9
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x52d6ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004284a8
cmp ebx, dword [ebp - 8]
jge 0x52d74f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00428954
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00428954
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00428980
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x52d715
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x530a28
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x530adf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004047e8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x530a6a
call fcn.00403d70
jmp 0x530ae6
mov eax, ebx
call fcn.0040277c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.004047e8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x530a93
call fcn.00403d70
jmp 0x530ae6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x530af0
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x530ab4
call fcn.00403d70
jmp 0x530ae6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530ae6
mov eax, dword [ebp - 8]
call fcn.0040279c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x546ff4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x547010
cmp dword [esi + 4], 0
je 0x54703d
test byte [ebx + 0x55], 1
jne 0x54702f
mov eax, ebx
call fcn.00468db4
test eax, eax
jne 0x54702f
mov edx, esi
mov eax, ebx
call fcn.0046de10
jmp 0x54712e
mov edx, esi
mov eax, ebx
call fcn.00469d38
jmp 0x54712e
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00465224
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x547127
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0046c0bc
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, eax
mov edx, 0x14
mov eax, ebx
call fcn.00466a50
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00546ff4
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0046c0bc
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54712e
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret