joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1088474
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x1088480
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.010886e4

Function at 0x10884d4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5a4e3050]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x108], edx
test edi, edi
jg 0x1088510
jl 0x10884fe
test edx, edx
jne 0x1088510
mov eax, dword [ebp + 8]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0109237e
mov esp, ebp
pop ebp
ret
mov ecx, 1
mov dword [ebp - 0x84], 0xedb88320
mov eax, ecx
lea ecx, [ecx]
mov dword [ebp + eax*4 - 0x84], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x1088524
push ebx
push esi
xor esi, esi
jmp 0x1088544
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x1088564
test al, 1
je 0x108855d
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x1088557
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x1088544
xor esi, esi
jmp 0x1088584
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x10885a4
test al, 1
je 0x108859d
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x1088597
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x1088584
mov ebx, dword [ebp + 8]
jmp 0x10885c4
xor esi, esi
jmp 0x10885d4
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x10885f4
test al, 1
je 0x10885ed
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x10885e7
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x10885d4
mov edx, dword [ebp - 0x108]
mov eax, edx
and eax, 1
or eax, 0
je 0x1088634
xor ecx, ecx
lea eax, [ebp - 0x104]
test ebx, ebx
je 0x1088632
mov edi, edi
test bl, 1
je 0x108862b
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x1088624
mov ebx, ecx
shrd edx, edi, 1
sar edi, 1
mov eax, edx
or eax, edi
mov dword [ebp - 0x108], edx
je 0x10886ca
xor esi, esi
jmp 0x1088654
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x1088674
test al, 1
je 0x108866d
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x1088667
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x1088654
mov edx, dword [ebp - 0x108]
mov eax, edx
and eax, 1
or eax, 0
je 0x10886b4
xor ecx, ecx
lea eax, [ebp - 0x84]
test ebx, ebx
je 0x10886b2
mov edi, edi
test bl, 1
je 0x10886ab
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x10886a4
mov ebx, ecx
shrd edx, edi, 1
sar edi, 1
mov ecx, edx
or ecx, edi
mov dword [ebp - 0x108], edx
jne 0x10885c4
xor ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0109237e
mov esp, ebp
pop ebp
ret
Function at 0x108bb54
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esi], 0
mov eax, edi
sub eax, dword [esi]
push eax
mov eax, dword [ebp + 0xc]
add eax, dword [esi]
push eax
push dword [ebx + 0x14]
call fcn.01097bbd
add esp, 0xc
test eax, eax
jle 0x108bb8b
add dword [esi], eax
cmp dword [esi], edi
jb 0x108bb69
test eax, eax
jns 0x108bbad
call fcn.0109391f
push dword [eax]
call fcn.01093a47
push eax
push 0xffffffffffffffff
push ebx
call fcn.0108af14
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
test eax, eax
jne 0x108bbb8
mov dword [ebx + 0x40], 1
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10920e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x1092109
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x1092121
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x1092150
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x1092192
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x1092266
sub edx, 0x10000
js 0x1092266
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x1092178
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x1092178
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x10921e9
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x10921e6
add edx, 8
jne 0x10921cd
jmp 0x1092257
add edx, 4
test eax, 0xffff
jne 0x10921f6
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x1092257
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x109222a
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x1092178
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x1092266
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x1092178
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x1092277
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401430
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4048e6
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x407018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x13c], eax
cmp eax, 0xffffffff
je 0x4015f6
lea ecx, [ebp - 0x138]
push ecx
push eax
mov dword [ebp - 0x138], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4015f6
jmp 0x4014a0
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov edi, 7
mov eax, str.PointBl
mov dword [ebp - 0x140], esp
mov byte [esi], bl
call fcn.00403570
sub esp, 0x1c
mov dword [ebp - 4], ebx
mov esi, esp
lea eax, [ebp - 0x114]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x144], esp
mov byte [esi], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4014f0
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x114]
call fcn.00403570
mov dword [ebp - 4], 0xffffffff
call fcn.004013a0
add esp, 0x38
cmp al, bl
jne 0x4015fb
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov edi, 7
mov eax, str.pointbl
mov dword [ebp - 0x144], esp
mov byte [esi], bl
call fcn.00403570
sub esp, 0x1c
mov dword [ebp - 4], 1
mov esi, esp
lea eax, [ebp - 0x114]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x140], esp
mov byte [esi], bl
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x401570
sub eax, ecx
mov edi, eax
lea eax, [ebp - 0x114]
call fcn.00403570
mov dword [ebp - 4], 0xffffffff
call fcn.004013a0
add esp, 0x38
cmp al, bl
jne 0x4015fb
mov ecx, str.PointBlank.exe
lea eax, [ebp - 0x114]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4015c4
cmp dl, bl
je 0x4015c0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4015c4
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x4015a4
xor eax, eax
jmp 0x4015c9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4015fb
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4014a0
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x40160b
mov edx, dword [ebp - 0x130]
push edx
push ebx
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403d60
mov esp, ebp
pop ebp
ret
Function at 0x403220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404958
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x407018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x4033b2
cmp byte [ebx + 0x49], 0
je 0x4033b2
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x4033a6
lea esi, [ebp - 0x2c]
call fcn.00402ed0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x403293
lea edx, [ebp - 0x2c]
mov eax, edx
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, edx
push ecx
mov ecx, dword [ebx + 0x44]
push eax
lea eax, [ebx + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x4032cb
dec eax
je 0x4032cf
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x4033ad
call fcn.00402280
xor al, al
jmp 0x4033b4
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x4032df
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x40330d
cmp edi, 0x10
jae 0x4032ee
lea eax, [ebp - 0x2c]
mov edx, dword [ebx + 0x54]
push edx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x40339e
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x4033aa
test esi, esi
jne 0x403287
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x4033cf
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x4033cf
cmp edi, esi
jae 0x403387
push ecx
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.00403640
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x403287
mov ecx, eax
cmp edi, 0x10
jae 0x403363
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x40337e
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x403281
test esi, esi
jne 0x403359
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x403396
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x403281
lea esi, [ebp - 0x2c]
call fcn.00402280
xor al, al
jmp 0x4033b4
lea esi, [ebp - 0x2c]
call fcn.00402280
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403d60
mov esp, ebp
pop ebp
ret
push str.string_too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3

Function at 0x403d60
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407018]
jne 0x403d6a
repz ret
jmp fcn.0040417d
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x70492f83
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0xf476a48
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4aa540
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x90000]
push edi
jmp 0x4aa55a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4aa561
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aa550
mov eax, 1
add ebx, ebx
jne 0x4aa573
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4aa584
jne 0x4aa5a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aa5a3
dec eax
add ebx, ebx
jne 0x4aa590
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4aa568
add ebx, ebx
jne 0x4aa59f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4aa5f5
xor ecx, ecx
sub eax, 3
jb 0x4aa5bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4aa62a
sar eax, 1
mov ebp, eax
jmp 0x4aa5c6
add ebx, ebx
jne 0x4aa5c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aa594
inc ecx
add ebx, ebx
jne 0x4aa5d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aa594
add ebx, ebx
jne 0x4aa5e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4aa5d6
jne 0x4aa5f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4aa5d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4aa614
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4aa606
jmp 0x4aa556
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4aa614
add edi, ecx
jmp 0x4aa556
pop esi
mov edi, esi
mov ecx, 0x4c8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4aa632
cmp byte [edi], 7
jne 0x4aa632
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4aa637
lea edi, [esi + 0xa8000]
mov eax, dword [edi]
or eax, eax
je 0x4aa6a6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf090c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf0948]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4aa664
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf0950]
or eax, eax
je 0x4aa6a0
mov dword [ebx], eax
add ebx, 4
jmp 0x4aa681
call dword [esi + 0xf094c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4aa6d7
cmp al, 0xef
ja 0x4aa6ca
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4aa6ac
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4aa6b9
mov ebp, dword [esi + 0xf0954]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4aa70b
sub esp, 0xffffff80
jmp 0x401b29
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x40ad2ee8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x67397f5f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0xe0e28f6
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xca47a41
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x510335da
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x15b657ec
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x402344
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov ebx, ecx
mov esi, dword [edi]
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
mov dword [edi + 0x16c], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x170], eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp ecx, dword [edi + 0x174]
jne 0x4023eb
cmp eax, dword [edi + 0x178]
jne 0x4023eb
push dword [ebx + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
push dword [ebx + 0x1c]
movzx eax, ax
shr eax, 0xf
mov dword [ebp + 8], eax
call esi
movzx esi, ax
mov eax, dword [ebp + 8]
shr esi, 0xf
cmp eax, dword [edi + 0x17c]
jne 0x43c12e
cmp dword [ebp + 0xc], 0
je 0x4023ca
mov dword [edi + 0x17c], eax
cmp esi, dword [edi + 0x180]
jne 0x43c19a
cmp dword [ebp + 0xc], 0
je 0x4023e2
mov dword [edi + 0x180], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 1
mov dword [edi + 0x174], ecx
mov dword [edi + 0x178], eax
jl 0x402390
jmp 0x43c11d
push eax
push ecx
push edi
push 0xfffffffffffffff5
mov ecx, ebx
call fcn.00486193
jmp 0x402390
cmp dword [ebp + 0xc], 1
jl 0x4023be
cmp byte [edi + 0x1a8], 0
je 0x4023be
mov ecx, ebx
push dword [ebp - 4]
push dword [ebp - 8]
push edi
test eax, eax
je 0x43c156
push 0xfffffffffffffff9
jmp 0x43c186
push 0xfffffffffffffff8
call fcn.00486193
cmp byte [edi + 0x184], 0
je 0x43c18b
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, ebx
push dword [ebp - 4]
push dword [ebp - 8]
push edi
test eax, 0x1000000
je 0x43c184
push 0xfffffffffffffffa
jmp 0x43c186
push 0xfffffffffffffff4
call fcn.00486193
mov eax, dword [ebp + 8]
mov byte [edi + 0x184], 0
jmp 0x4023be
cmp dword [ebp + 0xc], 1
jl 0x4023d6
mov ecx, ebx
push dword [ebp - 4]
push dword [ebp - 8]
push edi
test esi, esi
je 0x43c1b5
push 0xfffffffffffffff7
jmp 0x43c1b7
push 0xfffffffffffffff6
call fcn.00486193
jmp 0x4023d6
Function at 0x402a5b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push edi
mov edi, 0x4c57b0
jne 0x43c34c
mov ecx, dword [0x4c581c]
cmp ecx, 0xffffffff
je 0x402af4
mov eax, dword [0x4c5810]
xor edx, edx
push esi
mov eax, dword [eax + ecx*4]
mov esi, dword [eax]
mov ecx, dword [esi]
mov dword [ebp + 0xc], ecx
cmp byte [esi + 0x3a], dl
je 0x402a9f
mov byte [esi + 0x3a], dl
cmp dword [esi + 0x18c], edx
jge 0x43c363
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x43c3a5
je 0x402ac7
test edi, edi
je 0x402b15
cmp edi, 1
je 0x402ac7
cmp edi, 2
je 0x402b0c
cmp edi, 3
je 0x402b03
jle 0x402aeb
cmp edi, 5
jg 0x402af8
cmp byte [esi + 0x38], 0
jne 0x402b23
push edi
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 8
je 0x402ae7
cmp edi, 4
je 0x402ae7
push dword [ebp + 0xc]
call fcn.00404a35
mov byte [esi + 0x38], 1
xor eax, eax
inc eax
pop esi
pop edi
pop ebp
ret 8
xor eax, eax
jmp 0x402aef
cmp edi, 6
je 0x43c38d
jmp 0x402aeb
mov byte [esi + 0x38], 1
jmp 0x43c3fa
mov byte [esi + 0x38], 1
jmp 0x43c38d
push edx
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x38], 0
jmp 0x402aeb
xor eax, eax
jmp 0x402aee
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00402612
mov ecx, eax
mov dword [0x4c581c], ecx
jmp 0x402a74
cmp byte [esi + 0x198], dl
je 0x402a9f
push dword [esi + 0x194]
mov ecx, edi
push esi
call fcn.0048b6d2
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov byte [esi + 0x198], dl
jmp 0x402a9f
cmp byte [esi + 0x38], 0
je 0x402b23
push 6
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x402aeb
mov eax, edi
sub eax, 9
je 0x43c3fa
sub eax, 0x37
je 0x43c3ec
dec eax
je 0x43c3e9
dec eax
je 0x43c3d9
dec eax
jne 0x402aeb
push edx
mov byte [esi + 0x39], dl
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push 1
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x402aeb
push ecx
mov byte [esi + 0x39], 1
call dword [sym.imp.USER32.dll_LockWindowUpdate]
jmp 0x402aeb
push edx
jmp 0x43c3ee
push 1
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x402aeb
cmp byte [esi + 0x38], 0
je 0x402b23
push edi
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 0xc]
call fcn.00404a35
jmp 0x402aeb