joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d559
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x47cc38
call fcn.004620f1
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xc], 0
je 0x41d575
xor al, al
jmp 0x41d661
lea esi, [ebx + 0x14]
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
cmp byte [ebx + 4], 0
mov dword [ebx + 0xc], 1
je 0x41d59c
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x41d56e
mov edi, dword [ebp + 0xc]
lea esi, [ebx + 0x2c]
mov byte [ebx + 4], 1
call fcn.0041be41
mov eax, dword [ebp + 0xc]
xor edi, edi
cmp dword [eax + 8], edi
jne 0x41d5e1
push 0x130
call fcn.00460dab
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 1
cmp eax, edi
je 0x41d5d3
push eax
call fcn.0041bfec
jmp 0x41d5d5
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebx + 0x88], eax
jmp 0x41d61e
push 0xf0
call fcn.00460dab
mov esi, eax
pop ecx
mov dword [ebp + 0xc], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x41d612
call fcn.0041b7db
mov dword [esi], vtable.CLocalScreenWatermarkPrinter.0
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
jmp 0x41d614
xor esi, esi
mov byte [ebp - 4], 0
mov dword [ebx + 0x88], esi
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push edi
push edi
push ebx
push 0x41d3e0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
push str.thread_handle:_d
mov dword [ebx + 8], eax
call fcn.00424529
pop ecx
pop ecx
lea eax, [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xffffffffffffffff
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebx + 0xc], edi
mov al, 1
call fcn.004621c9
ret 8

Function at 0x41d6ac
Capabilities:
Terminate thread

Disassembly:
push 4
mov eax, 0x47c02e
call fcn.004620f1
lea edi, [esi + 0x14]
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [esi + 4], bl
jne 0x41d6e9
push str.close_err1
call fcn.00424529
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
call fcn.004621c9
ret
mov eax, dword [esi + 0x84]
cmp eax, ebx
jne 0x41d709
push str.close_err2
call fcn.00424529
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x41d6e3
push ebx
push ebx
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [esi + 8]
push str.wait_thread:_d
call fcn.00424529
pop ecx
pop ecx
push 0x1388
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41d74d
push str.wait_time_out
call fcn.00424529
pop ecx
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov byte [esi + 4], bl
mov dword [esi + 0x88], ebx
mov bl, 1
jmp 0x41d6fe
Function at 0x41e291
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x498040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor eax, eax
push eax
push eax
push 3
push eax
push 3
mov ebx, 0xc0000000
push ebx
mov edi, 0x4857ac
push edi
call esi
cmp eax, 0xffffffff
jne 0x41e394
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00462d50
add esp, 0xc
call fcn.0041e219
lea ecx, [ebp - 0x210]
push ecx
push eax
mov dword [ebp - 0x214], eax
call fcn.0040e530
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41e342
cmp word [0x49cc60], ax
je 0x41e342
push 0x49cc60
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.0040e658
mov dword [ebp - 0x214], 0x482014
test eax, eax
jne 0x41e35f
mov dword [ebp - 0x214], 0x481ffc
push 0x4857c8
call fcn.0040ff98
push dword [ebp - 0x214]
test eax, eax
lea eax, [ebp - 0x210]
push eax
call fcn.00424c17
push 0x4857c8
call fcn.0040ff31
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push ebx
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c7e
leave
ret
Function at 0x42089d
Capabilities:
Check if file exists
Create service

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x498040]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x78], ax
xor esi, esi
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.00462d50
add esp, 0xc
call fcn.00420825
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x42093d
lea eax, [ebp - 0x78]
push eax
call fcn.00420825
push eax
call fcn.0040e530
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x42093d
cmp word [0x49ce70], si
je 0x42092f
push 0x104
push 0x49ce70
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
call fcn.00420825
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x4209dc
push ebx
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x4209d9
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, eax
cmp ebx, esi
je 0x4209d9
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x482d7c
push ebx
call edi
test eax, eax
jne 0x420973
xor edi, edi
inc edi
jmp 0x420982
push 0x482d88
push ebx
call edi
test eax, eax
jne 0x4209d9
push 0x10
pop edi
push 0xf003f
push esi
push esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x80], eax
cmp eax, esi
je 0x4209d1
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
push 1
push 3
push edi
push 0xf01ff
mov eax, 0x48585c
push eax
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x80]
call fcn.0040fe4e
xor eax, eax
cmp dword [ebp - 0x7c], esi
setne al
jmp 0x4209db
lea eax, [ebp - 0x80]
call fcn.0040fe4e
xor eax, eax
pop ebx
mov ecx, dword [ebp + 0x190]
pop edi
xor ecx, ebp
pop esi
call fcn.00460c7e
add ebp, 0x194
leave
ret
Function at 0x421290
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0x134
mov eax, dword [0x498040]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
push 0x110
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
xor edi, edi
mov dword [ebp - 0x64], 0x114
call fcn.00462d50
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp + 0xbc], 0x8000
jne 0x4212e8
mov edi, 0x100
jmp 0x421311
cmp dword [ebp + 0xbc], 0x8004
je 0x42130c
cmp dword [ebp - 0x60], 6
jb 0x421311
cmp dword [ebp - 0x5c], 1
jb 0x421311
cmp dword [ebp + 0xbc], 0x8003
jne 0x421311
mov edi, 0x80
mov ecx, dword [ebp + 0xc0]
xor esi, esi
inc esi
shl esi, cl
cmp edi, ebx
je 0x421353
xor eax, eax
inc eax
mov ecx, ebx
shl eax, cl
test esi, eax
je 0x42134d
mov al, bl
add al, 0x41
push 0
mov byte [ebp - 0x68], al
lea eax, [ebp - 0x68]
push eax
push 5
push edi
mov byte [ebp - 0x67], 0x3a
mov byte [ebp - 0x66], 0x5c
mov byte [ebp - 0x65], 0
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
inc ebx
cmp ebx, 0x1a
jl 0x421320
and dword [ebp - 0x78], 0
xor ecx, ecx
cmp dword [ebp - 0x60], 6
push 2
pop eax
mov word [ebp - 0x70], cx
mov dword [ebp - 0x80], 0x14
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], esi
mov ecx, 0x3e8
jb 0x42137b
push 0x64
pop ecx
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea edx, [ebp - 0x6c]
push edx
push ecx
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xbc]
mov ebx, 0x219
push ebx
mov edi, 0xffff
push edi
call esi
cmp dword [ebp - 0x60], 6
jae 0x4213c6
mov eax, 0x8000
cmp dword [ebp + 0xbc], eax
jne 0x4213c6
lea ecx, [ebp - 0x6c]
push ecx
push 0xc8
push 2
lea ecx, [ebp - 0x80]
push ecx
push eax
push ebx
push edi
call esi
mov ecx, dword [ebp + 0xb0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c7e
add ebp, 0xb4
leave
ret 8
Function at 0x421cbc
Capabilities:
Check if file exists

Disassembly:
push 0x15c
mov eax, 0x47b240
call fcn.0046215a
push 0x118
xor ebx, ebx
lea eax, [ebp - 0x164]
push ebx
push eax
mov dword [ebp - 0x168], 0x11c
call fcn.00462d50
add esp, 0xc
call fcn.0040e658
mov edi, 0x48585c
test eax, eax
je 0x421da8
push edi
call fcn.0040ff98
test eax, eax
je 0x421da8
push edi
call fcn.00410052
test eax, eax
jne 0x421da8
lea esi, [ebp - 0x168]
call fcn.0040e6aa
test eax, eax
je 0x421da8
cmp dword [ebp - 0x164], 6
jne 0x421da8
push edi
push 0x485928
lea ecx, [ebp - 0x48]
call fcn.0040fbbe
pop ecx
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x421d51
lea eax, [ebp - 0x44]
push str.ImagePath
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x2c]
call fcn.0040fce9
add esp, 0xc
cmp dword [ebp - 0x18], ebx
je 0x421d8e
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x421d78
lea eax, [ebp - 0x28]
push str.swvv64_win7.sys
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x421d8e
push edi
call fcn.0040fffc
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.0040144b
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.0040144b
push edi
call fcn.0040ff98
test eax, eax
je 0x421dde
push edi
call fcn.0040ff31
test eax, eax
je 0x421dc1
xor eax, eax
inc eax
jmp 0x421df3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x421dd8
cmp eax, 3
je 0x421dd8
cmp eax, 0x241
jne 0x421df1
push edi
call fcn.0040fffc
call fcn.0042089d
test eax, eax
je 0x421df1
push edi
call fcn.0040ff31
test eax, eax
jne 0x421dbc
xor eax, eax
call fcn.004621dd
ret
Function at 0x424224
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x498040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x128], 0
push esi
push edi
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0xc]
push 0x3f
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0xab]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0xac], 0
call fcn.00462d50
lea edi, [ebp - 0xac]
add esp, 0xc
movsd dword es:[edi], dword [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0xac]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [ebp + eax - 0x104], dl
mov byte [ebp + eax - 0x6c], cl
inc eax
cmp eax, 0x40
jb 0x424277
lea eax, [ebp - 0xc4]
call fcn.004261fa
lea eax, [ebp - 0x104]
push eax
push 0x40
pop eax
lea esi, [ebp - 0xc4]
call fcn.0042621e
push dword [ebp - 0x124]
mov eax, dword [ebp + 0x10]
call fcn.0042621e
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.004262b4
lea eax, [ebp - 0x11c]
call fcn.004261fa
lea eax, [ebp - 0x6c]
push eax
push 0x40
pop eax
lea esi, [ebp - 0x11c]
call fcn.0042621e
lea eax, [ebp - 0x18]
push eax
push 0x10
pop eax
call fcn.0042621e
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.004262b4
mov esi, dword [ebp - 0x120]
add esp, 0x18
push 0x10
lea eax, [ebp - 0x28]
push eax
call fcn.004106be
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00460c7e
leave
ret

Function at 0x424529
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.0046c7f0
mov eax, dword [0x498040]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
call fcn.0042460c
test al, al
je 0x4245ff
xor eax, eax
mov word [ebp - 0x80c], ax
mov word [ebp - 0x100c], ax
push str.__ls__ls
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x485c04
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x2028]
push eax
call fcn.0042444c
cmp dword [eax + 0x18], 8
pop ecx
jb 0x42459a
mov eax, dword [eax + 4]
jmp 0x42459d
add eax, 4
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x100c]
push 0x400
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push 0
push 1
lea esi, [ebp - 0x2028]
call fcn.0040144b
xor eax, eax
mov word [ebp - 0x200c], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0x800
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.00460c7e
leave
ret
Function at 0x4246e5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea eax, [ebp - 0x30]
push 0x486018
push eax
call fcn.0040da3d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
lea edi, [ebp - 0x10]
lea esi, [ebp - 8]
mov dword [ebp - 0x10], eax
call fcn.0041daac
test al, al
jne 0x42474a
call fcn.0041facf
cmp dword [eax + 0x18], 8
jb 0x424736
mov eax, dword [eax + 4]
jmp 0x424739
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 8]
call fcn.004031f2
jmp 0x42470b
lea eax, [ebp - 0x30]
push eax
call fcn.00402e09
pop edi
pop esi
leave
ret
Function at 0x424aba
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x498040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
call fcn.0040eac0
mov dword [ebp - 0x234], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00462d50
add esp, 0xc
push 0x104
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x48603c
lea eax, [ebp - 0x214]
push eax
call esi
lea ecx, [ebp - 0x214]
call fcn.004246e5
push ebx
lea eax, [ebp - 0x214]
push eax
call esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x424b6a
push eax
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x424bfb
push edi
lea ecx, [ebp - 0x214]
call fcn.0040e28f
test eax, eax
jne 0x424bf9
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x214]
push eax
push edi
call esi
test eax, eax
jne 0x424bf9
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.004246bf
cmp dword [ebp - 0x218], 8
mov eax, dword [ebp - 0x22c]
pop ecx
pop ecx
jae 0x424bbb
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x424be6
push ebx
lea eax, [ebp - 0x214]
push eax
push edi
call esi
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x424be9
push 9
pop edi
push ebx
push 1
lea esi, [ebp - 0x230]
call fcn.0040144b
jmp 0x424bfb
xor edi, edi
push dword [ebp - 0x234]
call fcn.0040eb00
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c7e
leave
ret

Function at 0x424f96
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x424fb0
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x424fac
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4250d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x498040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.0042529f
mov bl, al
mov al, dl
call fcn.0042529f
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.0042529f
mov bl, al
mov al, byte [esi - 4]
call fcn.0042529f
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.0042529f
mov bl, al
mov al, byte [esi]
call fcn.0042529f
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.0042529f
mov bl, al
mov al, byte [esi - 0xc]
call fcn.0042529f
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x425101
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c7e
leave
ret 4

Function at 0x42518e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x498040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.0042531b
push ebx
mov dl, al
call fcn.004252f4
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.004252af
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.004252cd
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.004252af
push ebx
mov byte [ebp - 0x15], al
call fcn.004252cd
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.004252f4
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.0042531b
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.004252f4
mov bl, al
mov al, byte [edi + 4]
call fcn.0042531b
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.004252cd
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.004252af
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.004252cd
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.004252af
xor bl, al
mov al, dl
call fcn.0042531b
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.004252f4
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x4251ba
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c7e
leave
ret 4
Function at 0x42599f
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x47a186
call fcn.0046215a
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, ebx
mov dword [ebp - 0x30], esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4259be
sub eax, edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.00403572
and dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0
jbe 0x425ac4
jmp 0x4259ed
mov ebx, dword [ebp + 0xc]
movsx eax, byte [esi + ebx]
mov al, byte [eax + 0x484cf8]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x425a01
cmp al, 0xff
je 0x4259ed
cmp al, 0xff
je 0x425ac4
movsx ecx, byte [esi + ebx]
mov cl, byte [ecx + 0x484cf8]
inc esi
mov byte [ebp - 0x31], cl
cmp esi, dword [ebp - 0x30]
jae 0x425a21
cmp cl, 0xff
je 0x425a09
cmp cl, 0xff
je 0x425ac4
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
push 1
lea edi, [ebp - 0x2c]
call fcn.00410ca2
jmp 0x425a48
mov ebx, dword [ebp + 0xc]
mov bl, byte [esi + ebx]
inc esi
cmp bl, 0x3d
je 0x425ac4
movsx eax, bl
mov bl, byte [eax + 0x484cf8]
cmp esi, dword [ebp - 0x30]
jae 0x425a64
cmp bl, 0xff
je 0x425a45
cmp bl, 0xff
je 0x425ac4
mov al, byte [ebp - 0x31]
mov cl, bl
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
push 1
lea edi, [ebp - 0x2c]
call fcn.00410ca2
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x425ac4
movsx eax, al
mov al, byte [eax + 0x484cf8]
cmp esi, dword [ebp - 0x30]
jae 0x425aa4
cmp al, 0xff
je 0x425a87
cmp al, 0xff
je 0x425ac4
shl bl, 6
or bl, al
movzx eax, bl
push eax
push 1
lea edi, [ebp - 0x2c]
call fcn.00410ca2
cmp esi, dword [ebp - 0x30]
jb 0x4259ea
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.00402d36
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004030c2
mov eax, dword [ebp - 0x38]
call fcn.004621dd
ret

Function at 0x4261fa
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4267b3
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c8
mov eax, 0x47b813
call fcn.0046215a
mov eax, dword [ebp + 8]
mov edi, ecx
mov esi, edi
mov dword [ebp - 0x2d4], edi
mov dword [ebp - 0x2cc], eax
call fcn.004269dc
push 0x49a038
lea eax, [ebp - 0x98]
call fcn.00427982
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x49a0c0]
cmp word [eax], bx
jne 0x4268f2
push dword [ebp - 0x2cc]
lea eax, [ebp - 0x98]
push eax
call fcn.00427ba3
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push ebx
cmp eax, 0xffffffff
jne 0x42685a
push str.Error_opening_file
mov eax, edi
call fcn.0042721e
mov bl, al
lea ecx, [ebp - 0x98]
call fcn.004279a2
mov al, bl
call fcn.004621dd
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
jne 0x42686f
push ebx
push 0x4861e8
jmp 0x42683c
cmp esi, 0x400000
jbe 0x42687f
push ebx
push 0x486204
jmp 0x42683c
push esi
mov dword [ebp - 0x2cc], ebx
call fcn.0046ccda
pop ecx
push ebx
mov edi, eax
lea eax, [ebp - 0x2cc]
push eax
push esi
push edi
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2cc], esi
je 0x4268d7
push edi
call fcn.0046d572
mov esi, dword [ebp - 0x2d4]
pop ecx
call fcn.004269dc
push ebx
push 0x486224
mov eax, esi
jmp 0x42683e
push esi
push edi
push dword [ebp - 0x2d4]
call fcn.00426728
push edi
mov bl, al
call fcn.0046d572
pop ecx
jmp 0x426845
push eax
lea eax, [ebp - 0x98]
call fcn.004279b3
cmp byte [0x49963f], bl
je 0x42690e
mov esi, dword [0x49d354]
jmp 0x42691c
push dword [ebp - 0x98]
call fcn.0043df17
pop ecx
mov esi, eax
cmp esi, ebx
jne 0x42692b
push ebx
push 0x48624c
jmp 0x42683c
mov ecx, dword [ebp - 0x2cc]
lea eax, [ebp - 0x2c8]
push eax
push esi
lea edx, [ebp - 0x2d0]
call fcn.0043df6d
pop ecx
pop ecx
test eax, eax
je 0x426955
push ebx
push 0x48627c
jmp 0x42683c
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2cc], eax
cmp eax, ebx
je 0x426867
cmp eax, 0x400000
ja 0x426877
push eax
call fcn.0046ccda
pop ecx
push dword [ebp - 0x2cc]
mov edi, eax
push edi
push dword [ebp - 0x2d0]
mov eax, esi
call fcn.0043e03f
add esp, 0xc
cmp eax, ebx
je 0x4269c4
cmp eax, 0x600
je 0x4269c4
push edi
call fcn.0046d572
pop ecx
cmp byte [0x49963f], bl
jne 0x4269b3
call fcn.0043e071
mov eax, dword [ebp - 0x2d4]
push ebx
push 0x4862b0
jmp 0x42683e
cmp byte [0x49963f], bl
jne 0x4269d1
call fcn.0043e071
push dword [ebp - 0x2cc]
jmp 0x4268d8

Function at 0x42829d
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x4282b3
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x4282bf
or edi, 2
push 1
call esi
test ax, ax
jge 0x4282cb
or edi, 1
push 0x10
call esi
test ax, ax
jge 0x4282d7
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x4282e3
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret