joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c1af0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x7c1c46
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0xf003f
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040ca18
mov edx, eax
mov eax, esi
call fcn.007c1168
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.007c1240
test eax, eax
sete bl
test bl, bl
je 0x7c1c1e
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
cmp dword [ebp - 0x14], 0
je 0x7c1bf2
mov edi, dword [ebp - 0x14]
dec edi
cmp edi, 0
jb 0x7c1bf2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040cbac
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ca18
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040ca18
call fcn.0040be88
lea edx, [ebp - 4]
xchg edx, eax
call fcn.0040cbac
push dword [ebp - 8]
push 0x7c1c64
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040cd0c
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.007c1af0
mov ebx, eax
test bl, bl
je 0x7c1bf2
dec edi
cmp edi, 0xffffffff
jne 0x7c1b7d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
test bl, bl
je 0x7c1c28
mov eax, dword [ebp - 8]
call fcn.0040ca18
mov edx, eax
mov eax, esi
call fcn.007c1168
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
sete bl
jmp 0x7c1c28
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.007c0fdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c1c4d
lea eax, [ebp - 0x1c]
call fcn.0040b964
lea eax, [ebp - 4]
call fcn.0040b964
ret

Function at 0x7c1c68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040ca18
mov edx, eax
mov eax, ebx
call fcn.007c1168
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.007c1240
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x7c1cda
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040ca18
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x7c3018
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x7c302d
add esp, 0xfffffff0
call fcn.0040a184
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00409acc
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.0040bd44
mov eax, esi
call fcn.0040ca18
push eax
cmp byte [ebp + 0xc], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CreateMutexW
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x7c3084
mov ecx, dword [0x883770]
mov dl, 1
mov eax, dword [0x7c2d74]
call fcn.007b5384
call fcn.0040afe4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x7c30ab
call fcn.0040a1dc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x7c45f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040ca18
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x7c460d
test al, 0x10
jne 0x7c4611
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x7c4720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x7c473e
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x7c4736
test al, 0x10
je 0x7c473a
xor eax, eax
jmp 0x7c4740
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x7c4d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040ca18
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x7c4d59
test al, 0x10
jne 0x7c4d5d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x7c53ac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x7c545e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040ca18
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x7c5448
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040cbac
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040ca18
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x7c5448
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x7c5470
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x7c5448
cmp dword [ebp - 0xc], 0x34
jne 0x7c5448
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c5465
lea eax, [ebp - 4]
call fcn.0040b964
ret
Function at 0x7c54dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x7c54f1
add esp, 0xfffffff0
call fcn.0040a184
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, edi
call fcn.007c4720
test al, al
jne 0x7c5527
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0x11
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x882ec4]
mov dl, 1
mov eax, dword [0x7c324c]
call fcn.0042ed44
call fcn.0040afe4
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040ca18
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x7c555a
mov ecx, dword [0x8830ec]
mov dl, 1
mov eax, dword [0x7c324c]
call fcn.0042ec74
call fcn.0040afe4
lea eax, [ebx + 4]
xor ecx, ecx
mov edx, esi
call fcn.0040c4fc
mov eax, dword [ebx + 4]
call fcn.0040c3c8
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.0040ca18
push eax
call sub.version.dll_GetFileVersionInfoW
call fcn.004310e4
mov eax, ebx
call fcn.007c5dd0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x7c55a4
call fcn.0040a1dc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7c6d80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 5], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7c6e04
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x23]
mov edx, 0x1e
call fcn.007c6bcc
mov dword [ebp - 0x23], ebx
mov dword [ebp - 0x1f], 3
lea eax, [ebp - 4]
mov ecx, 0x7c6e20
mov edx, esi
call fcn.0040cc84
mov eax, dword [ebp - 4]
call fcn.0040ca18
mov dword [ebp - 0x1b], eax
movzx eax, byte [ebp - 5]
call fcn.007c6d58
mov word [ebp - 0x13], ax
lea eax, [ebp - 0x23]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c6e0b
lea eax, [ebp - 4]
call fcn.0040b964
ret
Function at 0x7c7938
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7c7b92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.007c6bcc
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x882350], eax
mov eax, dword [ebp - 0xc]
mov dword [0x882354], eax
mov eax, dword [ebp - 0x24]
mov dword [0x882358], eax
mov eax, dword [0x883a5c]
cmp dword [eax], 2
sete byte [0x881b2d]
push 0x7c7ba0
call sub.KERNEL32.DLL_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.007c4d10
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x881b2d], 0
jne 0x7c79c7
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.007c53ac
test al, al
je 0x7c79c7
mov eax, dword [ebp - 0x4c]
mov dword [0x90be40], eax
jmp 0x7c79ce
xor eax, eax
mov dword [0x90be40], eax
call fcn.007c6f4c
and eax, 0x7f
cmp eax, 0x1a
ja case.0x7c79df.0
jmp dword [eax*4 + 0x7c79e6]
mov byte [0x881b28], 1
jmp case.0x7c79df.0
mov byte [0x881b29], 1
jmp case.0x7c79df.0
mov byte [0x881b2a], 1
jmp case.0x7c79df.0
mov byte [0x881b2b], 1
jmp case.0x7c79df.0
mov byte [0x881b2c], 1
jmp case.0x7c79df.0
mov byte [0x881b2e], 1
mov byte [0x881b2f], 1
jmp case.0x7c79df.0
mov byte [0x881b2e], 1
mov byte [0x881b30], 1
jmp case.0x7c79df.0
mov byte [0x881b2e], 1
mov byte [0x881b30], 1
mov byte [0x881b31], 1
jmp case.0x7c79df.0
mov byte [0x881b32], 1
jmp case.0x7c79df.0
mov byte [0x881b33], 1
jmp case.0x7c79df.0
mov byte [0x881b34], 1
jmp case.0x7c79df.0
mov byte [0x881b35], 1
jmp case.0x7c79df.0
mov byte [0x881b36], 1
jmp case.0x7c79df.0
mov byte [0x881b37], 1
jmp case.0x7c79df.0
mov byte [0x881b38], 1
jmp case.0x7c79df.0
mov byte [0x881b39], 1
jmp case.0x7c79df.0
mov byte [0x881b3a], 1
jmp case.0x7c79df.0
mov byte [0x881b3b], 1
jmp case.0x7c79df.0
mov byte [0x881b3c], 1
jmp case.0x7c79df.0
mov byte [0x881b3d], 1
jmp case.0x7c79df.0
mov byte [0x881b3e], 1
jmp case.0x7c79df.0
mov byte [0x881b3f], 1
jmp case.0x7c79df.0
mov byte [0x881b40], 1
jmp case.0x7c79df.0
mov byte [0x881b41], 1
jmp case.0x7c79df.0
mov byte [0x881b42], 1
jmp case.0x7c79df.0
mov byte [0x881b43], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c7b99
lea eax, [ebp - 4]
call fcn.0040b964
ret

Function at 0x7cdb04
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x90c254], 0
jne 0x7cdb1b
call fcn.007cdac0
mov eax, edi
dec eax
test eax, eax
jl 0x7cdb43
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x90be54]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x7cdb25
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x7d0b6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x7d0b9d
dec al
je 0x7d0bd8
dec al
je 0x7d0c1c
dec al
je 0x7d0c8e
jmp 0x7d0d29
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x7d0d29
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x7d0bad
jmp 0x7d0d29
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x7d0d29
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x7d0be8
jmp 0x7d0d29
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x7d0d29
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x7d0c4f
xor edx, edx
mov dword [esp + 4], edx
jmp 0x7d0c64
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x7d0c7c
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x7d0c2c
jmp 0x7d0d29
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x7d0d29
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x7d0cf5
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.007cdb4c
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x7d0caa
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x7e566c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], edx
mov edi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp dword [esp], 0
je 0x7e5769
mov ebx, eax
mov eax, dword [esp]
mov esi, 3
cdq
idiv esi
lea eax, [eax + eax*2]
mov dword [esp + 4], eax
mov esi, ebx
add esi, dword [esp + 4]
jmp 0x7e56f4
movzx eax, byte [ebx]
shl eax, 8
movzx edx, byte [ebx + 1]
or eax, edx
shl eax, 8
movzx edx, byte [ebx + 2]
or eax, edx
add ebx, 3
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 3], dl
shr eax, 6
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 2], dl
shr eax, 6
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 1], dl
shr eax, 6
movzx eax, byte [edi + eax]
mov byte [ecx], al
add ecx, 4
cmp esi, ebx
ja 0x7e56a0
mov eax, dword [esp]
sub eax, dword [esp + 4]
dec eax
je 0x7e5707
dec eax
je 0x7e572e
jmp 0x7e5769
movzx eax, byte [ebx]
shl eax, 4
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 1], dl
shr eax, 6
movzx eax, byte [edi + eax]
mov byte [ecx], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x7e5769
movzx eax, byte [ebx]
shl eax, 8
movzx edx, byte [ebx + 1]
or eax, edx
shl eax, 2
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 2], dl
shr eax, 6
mov edx, 0x3f
and edx, eax
movzx edx, byte [edi + edx]
mov byte [ecx + 1], dl
shr eax, 6
movzx eax, byte [edi + eax]
mov byte [ecx], al
mov byte [ecx + 3], 0x3d
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x7f30a8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov esi, eax
mov eax, esi
call fcn.0040be68
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, edx
add edx, edx
mov eax, dword [esp]
xor ecx, ecx
call fcn.0040c4fc
mov eax, esi
call fcn.0040be68
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x7f31ea
mov ebx, 1
mov eax, esi
call fcn.0040be68
lea edx, [ebx + ebx*2]
cmp eax, edx
jge 0x7f312a
mov eax, esi
call fcn.0040be68
mov ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
sub ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [esp + 4]
call fcn.004071e8
jmp 0x7f3141
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [esp + 4]
mov ecx, 3
call fcn.004071e8
movzx eax, byte [esp + 4]
mov edx, eax
and dl, 0xfc
movzx edx, dl
shr edx, 2
mov ecx, dword [0x882640]
movzx edx, byte [ecx + edx]
mov byte [esp + 7], dl
and al, 3
movzx ebp, al
shl ebp, 4
movzx edx, byte [esp + 5]
mov eax, edx
and al, 0xf0
movzx eax, al
shr eax, 4
or ebp, eax
mov eax, dword [0x882640]
movzx eax, byte [eax + ebp]
mov byte [esp + 8], al
and dl, 0xf
movzx ebp, dl
add ebp, ebp
add ebp, ebp
movzx eax, byte [esp + 6]
mov edx, eax
and dl, 0xc0
movzx edx, dl
shr edx, 6
or ebp, edx
mov edx, dword [0x882640]
movzx edx, byte [edx + ebp]
mov byte [esp + 9], dl
and al, 0x3f
movzx eax, al
mov edx, dword [0x882640]
movzx eax, byte [edx + eax]
mov byte [esp + 0xa], al
mov eax, dword [esp]
call fcn.0040bf2c
mov edx, ebx
dec edx
add edx, edx
add edx, edx
lea edx, [eax + edx]
lea eax, [esp + 7]
mov ecx, 4
call fcn.004071e8
inc ebx
dec edi
jne 0x7f30f7
mov eax, esi
call fcn.0040be68
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x7f3230
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.0040be68
mov ebx, eax
mov eax, dword [esp]
call fcn.0040bf2c
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.0040be68
mov ebx, eax
mov eax, dword [esp]
call fcn.0040bf2c
mov byte [eax + ebx - 1], 0x3d
jmp 0x7f325d
mov eax, esi
call fcn.0040be68
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x7f325d
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.0040be68
mov ebx, eax
mov eax, dword [esp]
call fcn.0040bf2c
mov byte [eax + ebx - 1], 0x3d
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x81aef4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, dword [0x91c28c]
test eax, eax
je 0x81af19
mov edx, dword [0x91c28c]
mov edx, dword [edx + 4]
sub edx, dword [0x91c28c]
lea ecx, [ebx + 0xc]
cmp edx, ecx
jg 0x81af44
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov edx, dword [0x91c28c]
mov dword [eax], edx
mov dword [0x91c28c], eax
mov edx, eax
add edx, 0x1000
mov dword [eax + 4], edx
mov edx, dword [eax + 4]
add ebx, 4
sub edx, ebx
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
lea eax, [edx + 4]
mov dword [esi], eax
pop esi
pop ebx
ret
Function at 0x840a6c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x50]
mov edx, dword [0x83c7b0]
call fcn.0040d658
xor eax, eax
push ebp
push 0x840c4f
push dword fs:[eax]
mov dword fs:[eax], esp
sub esi, 0x63
je 0x840abc
dec esi
je 0x840ba9
jmp 0x840c26
lea eax, [ebp - 0x50]
mov edx, dword [0x882ba4]
mov edx, dword [edx]
call fcn.0040bd8c
lea ecx, [ebp - 0x54]
mov edx, 0x840c68
mov eax, ebx
call fcn.00840648
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x4c]
call fcn.0040bd8c
lea ecx, [ebp - 0x58]
mov edx, 0x840ca4
mov eax, ebx
call fcn.00840648
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x48]
call fcn.0040bd8c
lea ecx, [ebp - 0x5c]
mov edx, 0x840e40
mov eax, ebx
call fcn.00840648
push dword [ebp - 0x5c]
push 0x840ea0
lea ecx, [ebp - 0x60]
mov edx, 0x840eb0
mov eax, ebx
call fcn.00840648
push dword [ebp - 0x60]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040cd0c
mov eax, dword [0x840ebc]
push eax
push 4
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x50]
mov ecx, 0x64
movzx edx, byte [0x840ec0]
call fcn.0083d9c0
sub eax, 0x64
jne 0x840c26
push 1
push 0
push 0
mov ecx, dword [0x883868]
mov ecx, dword [ecx]
lea eax, [ebp - 0x64]
mov edx, 0x840ed0
call fcn.0040cc84
mov eax, dword [ebp - 0x64]
call fcn.0040ca18
push eax
push 0x840f3c
mov eax, dword [0x883470]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x840c26
lea eax, [ebp - 0x50]
mov edx, dword [0x882ba4]
mov edx, dword [edx]
call fcn.0040bd8c
lea ecx, [ebp - 0x68]
mov edx, 0x840f54
mov eax, ebx
call fcn.00840648
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x4c]
call fcn.0040bd8c
lea eax, [ebp - 0x48]
mov edx, 0x840fac
call fcn.0040bd8c
lea ecx, [ebp - 0x6c]
mov edx, 0x840eb0
mov eax, ebx
call fcn.00840648
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x44]
call fcn.0040bd8c
mov eax, dword [0x84140c]
push eax
push 4
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x50]
mov ecx, 0x64
movzx edx, byte [0x840ec0]
call fcn.0083d9c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x840c56
lea eax, [ebp - 0x6c]
mov edx, 7
call fcn.0040b9c4
lea eax, [ebp - 0x50]
mov edx, dword [0x83c7b0]
call fcn.0040d734
ret
Function at 0x44b610
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push edx
mov dword [esi], 0
mov al, byte [0x65f049]
mov cl, byte [0x65f04c]
mov edi, dword [0x65f030]
and cl, al
mov eax, dword [0x65f034]
mov byte [0x65f04c], cl
mov bl, byte [0x65f043]
mov ecx, eax
shr ecx, 2
sub edi, ecx
mov ecx, dword [0x65f038]
or ecx, 7
mov dword [0x65f030], edi
imul ecx, ebx
and eax, ecx
mov dword [0x65f034], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44b673
or dword [esi], 0x2000000
invalid
invalid
lodsb al, byte [esi]

Function at 0x459466
Capabilities:
Encode data using xor

Disassembly:
xor byte [ebp - 0x45], bh
push edx
wait
sbb al, 0x18
insd dword es:[edi], dx
in eax, 0xde
cmp dword [eax - 0x35], ecx
adc ebx, edx
out dx, al
cmp esp, ebp
adc eax, 0x2bf1eb2
cmp al, 0xc4
lodsb al, byte [esi]
dec edx
cmp byte [edx - 0x5594a5c3], 0xfc
xchg edx, eax
xchg dword cs:[edx + 0x3caa51ec], esp
std
fmul st(5)
int 0xe
adc al, 0xee
mov cl, 0xfc
imul eax, dword [ebx + 0x3b5b8e1b], 0xe53365f7
sbb ecx, dword [esi + 0x65f73b5b]
xor esp, ebp
sbb ecx, dword [esi + 0x65f73b5b]
xor esp, ebp
dec ebx
nop
jp 0x4594de
cmpsd dword [esi], dword es:[edi]
test edx, ebx
int1
cwde
or al, 0xe2
jo 0x459430
cmp eax, 0x33283318
xchg dword [esi - 0x55e603c8], esp
cld
mov eax, 0x3305b4c5
or esp, dword [ecx + 0xd969b5e]
pop esp
sbb dword [edx - 0x7c2514f9], ebx
add dword [esi - 0x359198ed], edi
pop ss
dec ebp
in eax, 0xe9
pop edi
fiadd dword [edx - 0x566411dd]
popal
mov ebx, 0x7bc05fc
ret 0x5d5c
mov cl, 4
and edi, 0x121e9994
add al, 0xba
cdq
push ds
adc al, byte [edx + edi*4]
jl 0x4594e3
cmp bh, byte [ebp - 0x4a944afc]
invalid

Function at 0x5bfe3e
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
xor eax, 0x62477640
bound ebx, qword [0xab223be0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jb 0x5bfe33
xchg edi, eax
inc byte [ebx - 0x48c69e51]
mov bh, 0x1a
call 0x7750e674
lds edi, [esi + 0x47]
push ebx
add al, 0xf5
invalid