joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52cb7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x52cbb6
neg eax
js 0x52cb91
xchg al, ah
mov edx, 0xafb571dc
bswap edx
pushfd
shr eax, cl
call fcn.0052cc1f
invalid
mov word [esp + 1], ax
pop edx
bsr ax, bp
jbe 0x52cb5e
pushfd
lea edx, [ebp + 0xe7608d9]
jmp 0x52cbbd
xchg al, ah
mov edx, 0xafb571dc
jmp 0x52cb9f
bswap edx
pushfd
shr eax, cl
jmp 0x52cbc2
pushfd
lea edx, [ebp + 0xe7608d9]
ror cl, 0
jmp 0x52cb60
bsr ax, di
lea esp, [esp + 8]
inc cl
mov ah, 0xe2
call fcn.0052cd77
xchg esi, eax
adc dword [ecx + 0x18a613e0], eax
xchg edx, eax
add byte [edi - 0x6e], ah
and bl, byte [edx + 0x11e28717]
lodsd eax, dword [esi]
or ah, byte [ebp + 0xfc1fed4]
xor dword [esi - 0x75], esp
lds ecx, [edx + 0xf]
mov dl, byte [0xffffffe]
mov eax, dword [ecx + 0x66fffffd]
mov edx, dword [esp]

Function at 0x52cd77
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x52ccfa
pop eax
xchg dl, dh
mov eax, ebp
setbe ah
and dh, al
jge 0x52cc5a
sub esp, 0
not edx
jmp 0x52ccff
bt ax, ax
push di
inc dh
jmp 0x52cca4
mov dx, 0x82a1
rdtsc
jmp 0x52cc86
not eax
add esp, 1
jno 0x52ccd1
lea edx, [ebx*4]
jmp 0x52cce2
cmc
jne 0x52cc9c
mov dx, 0x82a1
rdtsc
bt ax, ax
push di
inc dh
jmp 0x52cca4
lea edx, [ebx*4]
lea esp, [esp + 1]
jmp 0x52cd25
lea esp, [esp + 1]
jmp 0x52cd25
sub esp, 0
not edx
dec cl
jmp 0x52ccbe
mov dx, word [esp]
jmp 0x52cd0d
sub esp, 0xe
lea eax, [edx - 0x13]
lea esp, [esp + 2]
jmp 0x52cd56
rol cl, 0
dec dx
ja 0x52cd03
mov dx, word [esp]
sub esp, 0xe
lea eax, [edx - 0x13]
lea esp, [esp + 2]
jmp 0x52cd56
bt eax, ebp
je 0x52cd92
bsr ax, si
jmp 0x52cd96
and ecx, 0x3c
xchg dx, ax
mov dl, 0x7e
sub ebp, 4
jmp 0x52cd3c
jmp 0x52cc73
sub esp, 0x16
je 0x52cde6
mov edx, ebp
push dword [esp + 0xa]
cmc
lea esp, [esp + 2]
jmp 0x52cdb9
bsr ax, si
mov eax, dword [ecx + edi]
jmp 0x52cd7c
mov eax, dword [esp]
bswap ecx
not ah
jmp 0x52cdbe
cmc
lea esp, [esp + 2]
mov dword [ebp], eax
jmp 0x52cd9b
rol dx, 0xa
jmp 0x52ce04
mov cx, 0xfe26
lea eax, [edi + 0x50]
sub esp, 5
jmp 0x52ce22
mov edx, ebp
push dword [esp + 0xa]
jmp 0x52cdb4
xchg ecx, edx
mov cx, 0x2ee8
stc
lea esp, [esp + 1]
jmp 0x52ce2c
jno 0x52cdc8
mov cx, 0xfe26
jmp 0x52cdcc
stc
lea esp, [esp + 1]
jmp 0x52ce2c
je 0x52cdee
xchg ecx, edx
mov cx, 0x2ee8
jmp 0x52ce0c
cmp ebp, eax
jmp 0x52d5a6
mov ecx, edi
lea edx, [esp + ebx]
call fcn.0052d495
sub edx, ecx
call fcn.0052d4ee
jmp [bx + 0xa]
ja 0x52ce34
mov eax, 0xc2b38f94
mov ecx, esp
setl al
lea ecx, [esi*4]
jmp 0x52d4b2

Function at 0x5340b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
mov dword [esp + 7], ecx
mov cx, bp
mov ecx, edx
mov ecx, dword [esp]
jmp 0x534103
mov ecx, 0xa82cd23e
mov dword [esp + 1], esi
mov si, cx
mov si, dx
mov ecx, ebx
jmp 0x5341a2
mov esi, dword [esp + 1]
call fcn.00534146
mov si, 0x46fa
lea ecx, [ebx + esi]
mov si, word [esp]
xchg ch, cl
lea esi, [ebp*4]
mov cl, byte [esp]
jmp 0x534168

Function at 0x534146
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.00518c67
mov byte [esp + 2], ah
bswap ecx
bswap ecx
xchg word [esp], cx
mov ecx, dword [esp + 0xb]
jmp 0x534130
Function at 0x534354
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push word [esp]
pop word [esp]
lea esp, [esp + 2]
push ecx
call fcn.00533c04
pushal
lea esp, [esp + 0x20]
push bx
jmp 0x53411e

Function at 0x5603be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test edi, edi
push ebx
lea esp, [esp + 2]
jmp 0x560859
jmp 0x560792
lea esp, [esp + 4]
mov cl, byte [ecx]
jmp 0x560710
inc dword [ebp + 8]
call fcn.005606cf
jne 0x517d3b
inc cx
cpuid
xor ecx, ecx
jmp 0x5607e3
dec edi
mov byte [eax + esi + 0x18], cl
inc eax
jmp 0x5606e5
shl edx, 8
push cx
lea esp, [esp]
sub esp, 0x1d
lea esp, [esp + 3]
jmp 0x56076f
bsr bx, dx
btc ebx, esi
movzx ebx, byte [eax]
push ax
lea esp, [esp + 2]
jmp 0x560718
mov dword [esp + 0x10], eax
popal
add ebx, 1
movzx edx, byte [ebx]
pop ebx
jmp 0x56072e
shl edx, 8
jmp 0x56077b
or edx, ebx
neg bl
neg bl
movzx ebx, byte [eax - 1]
jmp 0x560759
or edx, ebx
mov bx, word [esp]
bsr bx, cx
mov bl, 0x4e
jmp 0x5607b1
push ebx
pushal
not bl
rol ebx, 0xa
jmp 0x56074b
or edx, ebx
jmp 0x5607bb
movzx ebx, byte [eax - 2]
clc
shl edx, 8
jmp 0x56079b
mov dword [ebp + ecx*4 - 0x40], edx
stc
lea esp, [esp + 0x1c]
inc ecx
jmp 0x5607cb
sub esp, 0x1d
mov dword [esp + 0xe], edx
lea esp, [esp + 1]
jmp 0x56080c
bt edx, ecx
not ah
xchg dx, ax
btr edx, ebp
lea eax, [esi + 0x1a]
jmp 0x517df5
lea esp, [esp + 4]
cmp ecx, 0x10
push esp
jmp 0x560831
lea esp, [esp + 0x1c]
add eax, 4
sub esp, 4
mov dword [esp], ecx
jmp 0x5607f6
lea esp, [esp + 4]
jb 0x517df5
call fcn.0056081b
pop ds
pushfd
xor dl, byte [ebp - 0x5c]
popal
imul ecx, dword [eax - 0x17c87ff1], 0x48bffff
and al, 0x8d
inc ecx
or ch, cl
arpl si, di
invalid
lea esp, [esp + 2]
jne 0x517da1
mov ebx, dword [esp]
jmp 0x56089c
lea esp, [esp + 4]
jmp fcn.00517d51

Function at 0x5606cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 4]
cmp eax, 0x40
jmp 0x5606ed
Function at 0x563dd3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x563e9a
mov bx, dx
movzx ebx, byte [eax - 1]
sub esp, 0x1e
mov dword [esp + 0x14], edi
lea esp, [esp + 2]
jmp 0x563d9e
or edx, ebx
mov bl, byte [esp]
dec bl
bswap ebx
jmp 0x563d7b
movzx ebx, byte [eax]
shl edx, 8
or edx, ebx
neg ebx
jmp 0x563d2d
mov word [esp], sp
push ebx
jmp 0x563d86
movzx ebx, byte [eax - 2]
shl edx, 8
stc
push esi
jmp 0x563d65
or edx, ebx
mov dword [ebp + ecx*4 + 0x34], edx
jmp 0x563dad
shl edx, 8
pushal
pop word [esp + 0xe]
lea esp, [esp + 2]
jmp 0x563d41
lea esp, [esp + 0x44]
inc ecx
cmc
sub esp, 8
jmp 0x563e41
cmp ecx, 0xe
pushal
push dword [esp + 0xb]
jmp 0x563df5
mov bx, 0xc043
mov bx, bp
jmp 0x563d59
lea ecx, [esi + 8]
push bp
mov ax, word [esp + 1]
lea esp, [esp + 2]
jmp 0x563e1f
lea esp, [esp + 0x24]
jb 0x561a75
lea eax, [0x40cf8de9]
mov eax, ebp
jmp 0x563ddf
mov eax, 0x8dc8d86f
jmp 0x563e2b
lea eax, [ebp + 0x34]
call fcn.00517f18
push 4
jmp 0x563e09
lea ecx, [esi + 0x59]
sub esp, 9
mov byte [esp + 2], bl
lea esp, [esp + 1]
jmp 0x563e6e
lea esp, [esp + 8]
add eax, 4
sub esp, 0x15
lea esp, [esp + 1]
lea esp, [esp + 0x14]
jmp 0x563dbb
xor esi, 0x20e2cc53
jmp 0x563eb0
lea esp, [esp + 8]
lea eax, [esi + 0xa]
mov si, di
not esi
mov esi, dword [esp]
jmp 0x563e58
pop esi
mov bx, sp
not ebx
pop ebx
jmp 0x561ab9

Function at 0x592510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x591d35
call 0x592547
std
clc
invalid
mov ecx, dword [edx + 0xc]
jmp 0x51b68b
add ebx, esi
cmp ecx, dword [eax + 0x50]
jmp 0x591d43
add edx, 0x14
jmp 0x5924e3
pop edi
pop ebx
jmp 0x51b66c
stc
bsf bx, cx
mov bx, sp
jmp 0x591cd1
lea esp, [esp + 0xc]
test ebx, ebx
jmp 0x591cf8
mov ebx, dword [edx]
sub esp, 0xf
lea esp, [esp]
mov byte [esp], cl
lea esp, [esp + 3]
jmp 0x591cbb
cmp ebx, dword [eax + 0x54]
jmp 0x591dba
je 0x51b645
push di
add esp, 1
lea esp, [esp + 1]
jmp 0x591ce2
je 0x591a8b
cmc
jmp 0x591d59
mov ebx, dword [edx + 0x10]
sub esp, 2
lea esp, [esp + 2]
test ebx, ebx
jmp 0x591d1f
jae 0x591a75
sub esp, 0x1d
mov di, 0xacef
jmp 0x591d80
cmp dword [ebp + 0xc], 0
je 0x591a75
jne 0x51b682
lea esp, [esp + 2]
jmp 0x591d92
bsr di, cx
lea esp, [esp + 1]
mov edi, dword [ebx]
pushal
pop word [esp + 0x16]
jmp 0x591d69
add ecx, esi
stc
lea esp, [esp + 0x38]
push ecx
jmp 0x591da0
cmc
add edi, esi
call fcn.00591e2d
pop ds
xchg cx, ax
adc dl, ah
sub dword [eax], eax
add byte [eax], al
jbe 0x591d41
fisubr word [eax - 0x2b5af56d]
inc edi
jb 0x51b645
cmp ebx, dword [eax + 0x50]
jb 0x51b682
jae 0x51b645
mov dword [ebp - 4], edx
jmp 0x591e80
jmp 0x592567
lea esp, [esp + 4]
jne 0x591c4f
je 0x591a8b

Function at 0x592577
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x51bb73
xor eax, eax
lea esp, [esp + 0x28]
je 0x51bb6a
jne 0x5925bb
rol byte [ebx - 0xb60b4b], 0xff
add eax, 0x9ff2d540
push ebp
cmp dl, byte [0xce0f3784]
pop esi
leave
ret 8
Function at 0x6005d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, 0xdc4c
bsf ebp, esi
lea ebp, [edx + 0x46]
push word [esp + 0xa]
mov ebx, ebp
xchg edi, ecx
jmp 0x6005e9
jmp 0x6005b2
mov ch, byte [esp + 0x12]
not edx
popal
cpuid
mov bx, word [esp + 1]
xchg ebx, eax
jmp 0x600607
pop word [esp + 0xe]
mov bx, word [esp + 6]
mov dword [esp + 0x20], eax
mov byte [esp + 0x15], dl
mov word [esp + 4], bx
xchg word [esp + 0x15], dx
jmp 0x6005d3
mov byte [esp + 4], al
mov si, dx
xchg ch, bh
bsr ax, si
mov ax, word [esp + 3]
rol ebx, 0x1d
jmp 0x600657
lea edi, [eax + edx]
rdtsc
mov di, 0x977
push edx
bt edx, eax
xchg dword [esp + 6], ebp
jmp 0x600639

Function at 0x6019b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, 0xc3
lea edx, [0xdceaa78]
bsf edi, ecx
bswap edi
mov edi, eax
jmp 0x601abc
mov byte [esp + 7], al
mov si, bp
rdtsc
mov ch, dh
jmp 0x60199b
bsf di, sp
mov word [esp + 0x1f], dx
lea eax, [esp - 0x81]
jmp 0x6019fd
mov ecx, dword [esp + 4]
sub esp, 0x1d
mov edx, eax
mov eax, ecx
mov dh, bl
pop edx
jmp 0x6019be
mov al, byte [esp + 8]
pop word [esp + 0x1d]
setae dh
pop ebp
cmc
cpuid
jmp 0x601a51
lea esp, [esp + 1]
rcr ax, 0xc
xchg dword [esp + 0xb], ebp
mov dword [esp + 0x17], ebp
bts edx, edx
std
jmp 0x6019e7
mov bh, byte [esp + 0x15]
lea edx, [edx + ebx]
lea eax, [edx + ebx]
push dword [esp + 5]
setge ah
add esp, 0x20
jmp 0x6019d7
rdtsc
xchg dword [esp], edi
lea ecx, [0x857cdf9a]
mov cx, word [esp + 5]
jmp 0x601a7f
lea esi, [0xd7697994]
mov ch, 0xf4
add esp, 2
bsf cx, ax
xchg dword [esp + 0xb], edi
add esp, 0x14
jmp 0x601a3b
or bh, al
lea ebx, [ecx + 0x3fc733da]
mov al, byte [esp + 2]
ror ebx, cl
lea ecx, [ebp*4]
call fcn.00601a69
xchg byte [esp + 0x1e], cl
mov dword [esp + 0x1f], edx
sete dl
mov cx, di
std
mov bp, word [esp + 6]
jmp 0x601a25

Function at 0x601b8f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x601bfe
mov al, 5
cpuid
xchg edx, ebx
rdtsc
setnp ch
lea esp, [esp + 8]
jmp 0x601be8

Function at 0x601f55
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
inc si
xchg byte [esp + 4], al
mov ax, 0x7fa2
lea ebp, [edx*4]
jmp 0x601f1a

Function at 0x602231
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00602019
mov dword [esp], esp
jmp 0x6022e5
mov eax, dword [eax]
jmp 0x6022b3
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x602279
mov eax, dword [eax + 8]
push eax
jmp 0x602014
pop word [esp]
mov byte [esp], ah
lea esp, [esp + 2]
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
jmp 0x60228f
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10007073
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10007073
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10007073
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10007073
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10007073
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10007073
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10007073
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10007073
push 0xd008
push edi
call fcn.10007073
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10007073
int3

Function at 0x10007073
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10007082
pop dword [ebp - 0x24]
mov eax, 0xa5f94c9a
sub eax, 0x95f8dc18
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x39aed
push 0
mov eax, 0xabd25ca6
sub eax, 0x9bd11c42
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xa4069410
add ecx, 0x5bf9b68d
xor esi, esi
add esi, eax
mov edx, 0xc7488c56
add edx, 0x48b8f9aa
add edx, dword [ebp - 0x24]
mov edi, 0xb5608138
xor dword [ebp - 0x18], 0xb52167aa
mov ebx, dword [edx]
sub dword [ebp - 0x14], 0x7f847d08
add ebx, edi
mov dword [esi], ebx
sub dword [ebp - 0x14], edi
add esi, 0x89eab4c4
add esi, 0x76154b40
add edx, 0xd5cc73fb
add edx, 0x2a338c09
loop 0x100070dd
add eax, 0xa4c84416
sub eax, 0xa4c726cf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x127f082
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x127f0ce
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x127f0c8
mov ecx, dword [0x12bf7f8]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x127f0bc
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x127f0a1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x127f0ca
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1280c53
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x1280cbf
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x1280d08
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0129a100
add esp, 8
test eax, eax
jne 0x1280d06
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x1280d0a
jmp 0x1280cb6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x12898fa
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.01283337
add esp, 4
and eax, 0xff
test eax, eax
je 0x1289983
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.01294820
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1289981
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x1289981
jmp 0x1289983
jmp 0x1289903
mov esp, ebp
pop ebp
ret

Function at 0x1289df3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x12c0404]
test eax, eax
jne 0x1289e07
call fcn.01289d24
xor ecx, ecx
mov cl, byte [0x12c0401]
test ecx, ecx
jne 0x1289e8e
xor edx, edx
mov dl, byte [0x12c0400]
test edx, edx
jne 0x1289e8e
cmp dword [0x12c060c], 0
je 0x1289e69
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0x12c060c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0x12c060c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x12c060c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x1289e8e
push 0x10001
push 0x12c0404
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x1289e8e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x128cf9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x128cfaa
xor eax, eax
jmp 0x128d173
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x128d12b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x12bdeac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x12bdeac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x12bdeac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x12bdeac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x12bdeac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x12bdeac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x12bdeac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x12bdeac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x128cfb3
cmp dword [ebp + 0x10], 0
je 0x128d16d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x12bdeac]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x128d131
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x12969b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x12bb4c8
cmp edx, dword [eax]
je 0x12969d2
add eax, 8
inc ecx
cmp eax, 0x12bb558
jl 0x12969c3
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x12bb4c8]
jne 0x1296b00
mov eax, dword [0x12c0688]
cmp eax, 1
je 0x1296ada
test eax, eax
jne 0x1296a03
cmp dword [0x12bb204], 1
je 0x1296ada
cmp edx, 0xfc
je 0x1296b00
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1296a3a
lea eax, [ebp - 0x1a4]
push 0x12bf2c8
push eax
call fcn.01294980
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.01294b30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1296a7d
lea eax, [ebp - 0x1a4]
push eax
call fcn.01294b30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x12bf2c4
push edi
call fcn.01294bb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x12bf2a8
push eax
call fcn.01294980
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.01294990
lea eax, [ebp - 0xa0]
push 0x12bf2a4
push eax
call fcn.01294990
push dword [esi + 0x12bb4cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.01294990
push 0x12010
lea eax, [ebp - 0xa0]
push 0x12bf27c
push eax
call fcn.01298f78
add esp, 0x2c
pop edi
jmp 0x1296b00
lea eax, [ebp + 8]
lea esi, [esi + 0x12bb4cc]
push 0
push eax
push dword [esi]
call fcn.01294b30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x401000
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, 0x5bfe
mov eax, ecx
mov dword [0x4b4752], eax
mov dword [0x4b4739], 0
mov eax, dword [0x4b4739]
mov dword [0x4b48ef], eax
mov dword [0x4b49c1], 0
mov eax, dword [0x4b49c1]
mov eax, ebx
xor ebx, eax
test dword [0x4b428b], eax
jne 0x401045
mov ebx, 0x19c2
sub eax, ebx
dec eax
shl eax, 1
ror eax, 1
or eax, dword [0x4b43b9]
je 0x401077
sub eax, dword [0x4b47dd]
dec eax
mov ebx, 0x11e8
add eax, ebx
dec eax
or eax, ebx
mov ebx, 0x1dd0
sub eax, ebx
add eax, dword [0x4b4a1d]
xor ebx, eax
sub eax, dword [0x4b46db]
shr eax, 1
add dword [0x4b42db], eax
jmp fcn.00402754