joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10084426
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008e330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100728b4
mov dword [ebp - 0x14], eax
cmp dword [0x1067b5d4], esi
jne 0x10084519
push 0x800
push esi
push 0x10008218
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100844a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100845f9
push esi
push esi
push 0x10008218
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100845f9
push 0x10008230
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100845f9
push eax
call ebx
push 0x1000823c
push edi
mov dword [0x1067b5d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000824c
push edi
mov dword [0x1067b5d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008260
push edi
mov dword [0x1067b5dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067b5e4], eax
test eax, eax
je 0x10084516
push 0x1000827c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067b5e0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1008453e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10084531
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10084553
push 4
pop eax
jmp 0x100845fb
cmp dword [ebp - 0x14], esi
je 0x10084553
push dword [0x1067b5d4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10084538
mov eax, dword [0x1067b5e0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100845b1
cmp dword [0x1067b5e4], edi
je 0x100845b1
push eax
call ebx
push dword [0x1067b5e4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100845b1
test eax, eax
je 0x100845b1
call ecx
test eax, eax
je 0x100845a6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100845a6
test byte [ebp - 8], 1
jne 0x100845b1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100845e1
mov eax, dword [0x1067b5d8]
cmp eax, edi
je 0x100845de
push eax
call ebx
test eax, eax
je 0x100845de
call eax
mov esi, eax
test esi, esi
je 0x100845de
mov eax, dword [0x1067b5dc]
cmp eax, edi
je 0x100845de
push eax
call ebx
test eax, eax
je 0x100845de
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067b5d4]
call ebx
test eax, eax
je 0x100845f9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100845fb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x40597e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40598c
or eax, eax
ret

Function at 0x406031
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push edi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40605b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40605b
xor al, al
jmp 0x40607b
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004259a0
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop edi
leave
ret 4
Function at 0x40cd93
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x427391
call fcn.004256c0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0040f16e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00401bcc
push dword [esi + 0x24]
call fcn.00403a73
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00401f34
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040d321
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x419f95
Capabilities:
Encode data using xor

Disassembly:
loop 0x419fae
sahf
mov al, 0x90
add byte [esi - 0x6be1f42d], 0x44
mov ebp, edi
das
das
cmc
sub byte [eax + 0x3c8b994c], dh
jo 0xc09ecc3c
mov edx, 0xb67cb840
or bl, byte [edi + 0x59]
jge 0x41a034
push es
push cs
add al, 0x48
xlatb
mov ecx, 0x83ff8201
invalid

Function at 0x41e7e0
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x41e81d
push str.SetDefaultDllDirectories
push 0x429a14
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41e81d
push 0xc00
call eax
test eax, eax
jne 0x41e8b6
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41e8b6
cmp eax, 0x104
ja 0x41e8b6
cmp word [esp + eax*2 + 6], 0x5c
je 0x41e84c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x41e8b6
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x41e88b
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x41e877
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x41e86c
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x4220b2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x42211b
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x42215c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x422141
mov ecx, ebx
call fcn.00421da0
add ebx, 0x28
dec ebp
jne 0x422135
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x422157
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.00421cd0
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.00422200
mov ebx, eax
cmp ebx, edi
jne 0x4221bf
lea ecx, [ebp + 0x20]
call fcn.00424320
mov ebx, eax
cmp ebx, edi
jne 0x4221bf
lea ecx, [ebp + 0x1c]
call fcn.00424320
mov ebx, eax
cmp ebx, edi
jne 0x4221bf
push ebp
call fcn.00422240
mov ebx, eax
cmp ebx, edi
je 0x4221d4
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.00422220
cmp ebx, edi
jle 0x4221cf
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x4221d4
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x4221e6
cmp dword [esi + 0x40], edi
jne 0x4221e6
cmp dword [esi + 0x3c], edi
jne 0x4221e6
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x423270
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push edi
push 0x98
xor ebx, ebx
lea eax, [esi + 0x110]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 0x34]
add eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
lea edi, [ecx + eax]
mov dword [esi + 0x40], eax
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esi + 0x18]
shr edx, 3
imul edx, edx, 0x54
mov ecx, edi
sub ecx, edx
add esp, 0xc
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0xc], eax
mov edx, eax
cmp eax, 0xc
jb 0x4232cb
mov edx, 0xc
or eax, 0xffffffff
sub eax, edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
lea eax, [edi - 0xc]
lea edx, [ecx + 0x600]
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 8], ecx
mov edx, 0x100
mov word [eax], dx
mov edx, 0x101
mov word [eax + 2], dx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
xor edx, edx
lea eax, [ecx + 2]
lea esp, [esp]
xor ecx, ecx
mov byte [eax - 2], dl
mov byte [eax - 1], 1
mov word [eax], cx
mov word [eax + 2], cx
inc edx
add eax, 6
cmp edx, 0x100
jb 0x423310
lea edx, [esi + 0x9fc]
mov dword [esp + 8], edx
push ebp
jmp 0x423340
mov edi, dword [esp + 0xc]
xor ebp, ebp
jmp 0x423350
movzx eax, word [ebp + 0x42b800]
xor edx, edx
lea ecx, [ebx + 2]
div ecx
mov edx, 0x4000
sub edx, eax
movzx ecx, dx
xor eax, eax
lea ebx, [ebx]
mov word [edi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x423370
add ebp, 2
add edi, 2
cmp ebp, 0x10
jb 0x423350
sub dword [esp + 0xc], 0xffffff80
inc ebx
cmp ebx, 0x80
jb 0x423340
mov ecx, 0x50
lea edi, [esi + 0x3bc]
lea ebx, [ecx - 0x4c]
pop ebp
mov eax, edi
mov edx, 0x10
jmp 0x4233b0
mov word [eax], cx
mov word [eax + 2], 0x403
add eax, ebx
dec edx
jne 0x4233b0
add ecx, 0x28
add edi, 0x40
cmp ecx, 0x438
jb 0x4233a4
pop edi
mov dword [esi + 0x3b8], 0x40070000
pop ebx
pop ecx
ret
Function at 0x425562
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
mov edi, edx
cmp eax, 0x38
jbe 0x4255a3
cmp eax, 0x40
je 0x425595
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
lea ecx, [esi + 0x20]
mov edx, 4
mov eax, dword [ecx + 4]
mov ebp, dword [ecx]
bswap ebp
bswap eax
mov dword [edi], ebp
mov dword [edi + 4], eax
add edi, 8
add ecx, 8
dec edx
jne 0x4255e8
xor eax, eax
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret

Function at 0x425a8c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bb98
push 0x425a86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x43466c], 0xffffffff
or dword [0x434670], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x432650]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x43264c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x434668], eax
call fcn.00425bcf
cmp dword [0x430240], 0
jne 0x425b0f
push 0x425bcc
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00425bba
push 0x430064
push 0x430060
call sub.MSVCRT.dll__initterm
mov eax, dword [0x432648]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x432644]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x43005c
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00411c13
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4062e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b508
cmp edx, dword [eax]
je 0x406307
add eax, 8
inc ecx
cmp eax, 0x40b598
jl 0x4062f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b508]
jne 0x406435
mov eax, dword [0x40ba54]
cmp eax, 1
je 0x40640f
test eax, eax
jne 0x406338
cmp dword [0x40b1b4], 1
je 0x40640f
cmp edx, 0xfc
je 0x406435
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40636f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004037b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004038a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4063b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004038a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40957c
push edi
call fcn.004077b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004037b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004037c0
lea eax, [ebp - 0xa0]
push 0x40955c
push eax
call fcn.004037c0
push dword [esi + 0x40b50c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004037c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407726
add esp, 0x2c
pop edi
jmp 0x406435
lea eax, [ebp + 8]
lea esi, [esi + 0x40b50c]
push 0
push eax
push dword [esi]
call fcn.004038a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4a39f8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4a39f8
add byte [esi], dh
cmp dh, byte [edi]
dec ecx
cmp dh, byte [0xc4835047]
add al, 0x81
jmp 0x4a7f6a
push es
pop es
pop es
pop es
pop es
push ss
xchg edx, eax
pushfd
lahf
add eax, 0xc98a0606
or byte [eax + 0x6059f9c], dl
push es
xchg edx, eax
mov word [ebx + 0xa0606ff], cs
mov word [edi + 0x16060605], ds
lds ecx, [edi]
mov eax, ss
push ss
mov esp, dword [edx - 0x6df8f8f9]
pushfd
lahf
add eax, 0xc5160606
mov ebx, dword [edi + ecx*2]
cld
push es
push es
mov edi, es
push ss
mov ecx, dword [edi + eax - 0x77a7f8f9]
clc
invalid
Function at 0x4ab3fc
Capabilities:
Encode data using xor

Disassembly:
or byte [edi], al
mov bh, dh
clc
xor dword [edi], eax
pop es
pop es
pop edi
imul edx, dword [edx + 0x7071f14], 7
pop es
pop es
pop es
pop es
nop
xchg esp, eax
jecxz 0x4ab3ee
push es
push es
xchg edx, eax
pushfd
jecxz 0x4ab3f4
push es
push es
xchg edx, eax
dec ecx
aaa
nop
mov edi, ds
in al, dx
push es
push es
xchg edx, eax
xchg esp, eax
fucompi st(4)
push es
push es
nop
xchg esp, eax
xor ebp, 6
push es
pop eax
pop eax
mov cl, bl
or ecx, dword [eax + 0x766c2e8]
pop es
mov al, ch
mov dl, 0x29
pop es
pop es
mov al, dh
pop es
adc byte [edi], al
pop es
pushal
pop esi
pop ebp
mov cl, bl
or ecx, dword [eax + 0x736fcfe]
pop es
mov dh, cl
xor edi, dword [edx + 7]
pop es
pop dx
mov dl, dl
jl 0x4ab465
pop es
pop es
bound ecx, qword [edx + 0x6f583c4]
push es
pop es
jl 0x4ab470
into
mov word [edi + 4], ss
push es
push es
pop es
pop es
pop es
pop es
invalid
scasb al, byte es:[edi]
or dword [edi], eax
pop es
xchg edx, eax
pushfd
xor ebp, 6
push es
xchg edx, eax
dec ecx
adc edx, dword [edx - 0x6b6fecb1]
sar ecx, cl
push es
push es
pop ecx
pop eax
mov cl, bl
or ecx, dword [eax + 0x70fc8e9]
pop es
mov cl, bh
xchg byte [edi + eax + 7], bl
mov cl, dl
jecxz 0x4ab498
or byte [edi], al
mov cl, dh
sub dword [esi + 0x5a610707], ebp
popal
pop edx
mov dl, dh
and byte [ebp + 7], dh
pop es
mov dl, dh
pop es
mov dword [edi], eax
pop es
mov dl, ch
arpl word [eax + 8], sp
pop es
bound ecx, qword [edx + 0x6f9d3c4]
push es
pop es
jl 0x4ab4cc
into
mov word [edi + 4], ss
push es
push es
pop es
pop es
pop es
pop es
invalid
pushfd
iretd

Function at 0x4c7814
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c78b2
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4c7876
cmp byte [ebx + 0x11], 0
jne 0x4c7876
cmp byte [ebx + 0x3c], 0
jne 0x4c7876
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4c7897
lea edx, [ebp - 4]
mov eax, dword [0x69ca68]
call fcn.0040cfbc
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x496ec4]
call fcn.00427dfc
call fcn.00408ab8
jmp 0x4c7897
lea edx, [ebp - 8]
mov eax, dword [0x69ca68]
call fcn.0040cfbc
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x496ec4]
call fcn.00427dfc
call fcn.00408ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c78b9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409410
ret

Function at 0x4c8260
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4c82ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004c7694
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c82c7
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4c82d0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004c7694
dec esi
jne 0x4c82f2
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4cab14
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x6a2014
cmp dword [edi], 0
jne 0x4cab90
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x6a2010]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x6967ec
mov ecx, 2
call fcn.00406930
mov edx, 0x4caaec
lea eax, [esi + 5]
call fcn.004cab0c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004cab0c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4cab65
mov dword [0x6a2010], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x5d0548
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5d055a
add esp, 0xfffffff0
call fcn.00407d44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c8584
mov eax, dword [0x69c69c]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d0a10
mov eax, dword [0x69c6ac]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d0a1c
mov eax, ebx
call fcn.005d0a28
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x48b86c]
call fcn.00407710
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x48b86c]
call fcn.00407710
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x48b86c]
call fcn.00407710
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x48b86c]
call fcn.00407710
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x48b86c]
call fcn.00407710
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5cb2a8
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4fee08]
call fcn.00505104
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4fee08]
call fcn.00505104
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4fee08]
call fcn.00505104
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4fee08]
call fcn.00505104
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4fee08]
call fcn.00505104
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005d1018
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d0e34
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d0e34
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d0e34
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d0e34
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d0e34
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d06da
call fcn.00407d9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x5d1940
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x6a233c]
cmp byte [eax + 0xc1], 0
jne 0x5d19b2
cmp dword [0x6a235c], 0
jne 0x5d1972
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x69b404]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x6a235c], eax
cmp dword [0x6a2358], 0
jne 0x5d198d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x6a2358], eax
cmp dword [0x6a2360], 0
jne 0x5d19b2
push esp
push 0
push 0
mov eax, dword [0x69b400]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x6a2360], eax
pop edx
ret
Function at 0x4059f2
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x405a06
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x405a02
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret