joyce8/EMBER2024-capa huggingface dataset:
Function at 0x723811
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x718]
add eax, 1
mov dword [ebp - 0x718], eax
mov ecx, dword [ebp - 0x714]
mov edx, dword [ebp - 0x718]
cmp edx, dword [ecx + 0x18]
jae 0x7238d2
mov eax, dword [ebp - 0x718]
mov ecx, dword [ebp - 0x18e0]
mov edx, dword [ebp - 0x300]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x71c], edx
mov eax, dword [ebp - 0x718]
mov ecx, dword [ebp - 0x18e4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18e8]
mov ecx, dword [ebp - 0x300]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x18ec], ecx
mov dword [ebp - 0x188], 0
jmp 0x723736
mov edx, dword [ebp - 0x188]
add edx, 1
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
test ecx, ecx
je 0x7237e8
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
test eax, eax
je 0x7237e8
push ecx
push ecx
add esp, 4
xor ecx, 0xe191
sub ecx, 0x5e8b
call fcn.00723782
add byte [edi + 0x40], al
dec ebx
inc ebx
inc edx
xor eax, 0xc483323b
add esp, 4
jmp 0x72378d
inc edi
dec eax
xor al, 0x3c
cmp eax, dword [esi + 0x59]
add esp, 4
jmp 0x72378d
pop ecx
push eax
jmp 0x723794
pop eax
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
cmp edx, ecx
je 0x7237da
mov edx, dword [ebp - 0x71c]
add edx, dword [ebp - 0x188]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x188]
movsx edx, byte [ebp + ecx - 0x830]
cmp eax, edx
jne 0x7237e1
jmp 0x723727
jmp 0x7237e8
push ecx
push esi
add esp, 4
add ecx, 0x722a
or ecx, 0x25a0
xor ecx, 0xffdd
pop ecx
push eax
call 0x723811
add byte [eax + 0x38], al
dec edi
xor al, 0x36
dec ebp
inc ebx
xor eax, 0x4c4833f
jmp 0x723819
pop eax
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
cmp ecx, eax
jne 0x723847
mov dword [ebp - 0xc5c], 0
jmp 0x7238b6
push ecx
and ecx, 0x15a59
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x186a0
and edx, 0xbe02
sub edx, 0xa948
call 0x723875
add byte [edi + 0x3a374435], bh
inc ebx
xor dh, byte [0x5a04c483]
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
or ecx, 0x20
cmp edx, ecx
jge 0x7238ac
mov dword [ebp - 0xc5c], 0xffffffff
jmp 0x7238b6
mov dword [ebp - 0xc5c], 1
cmp dword [ebp - 0xc5c], 0
jne 0x7238cd
mov edx, dword [ebp - 0x18ec]
mov dword [ebp - 0x3c8], edx
jmp 0x7238de
jmp 0x7236b7
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
je 0x7239b9
push edx
push ebx
add esp, 4
add edx, 0x7bf5
xor edx, 0xe67d
pop edx
push esi
or esi, 0x15dfb
add esi, 0x14e9f
and esi, 0x513a
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x159b2
pop edi
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push ecx
push ecx
add esp, 4
jmp 0x723934
call fcn.00723944
add byte [ecx*2 + 0x453e3c43], bh
dec edi
dec esi
inc ebp
dec eax
Function at 0x723875
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x718]
add eax, 1
mov dword [ebp - 0x718], eax
mov ecx, dword [ebp - 0x714]
mov edx, dword [ebp - 0x718]
cmp edx, dword [ecx + 0x18]
jae 0x7238d2
mov eax, dword [ebp - 0x718]
mov ecx, dword [ebp - 0x18e0]
mov edx, dword [ebp - 0x300]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x71c], edx
mov eax, dword [ebp - 0x718]
mov ecx, dword [ebp - 0x18e4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18e8]
mov ecx, dword [ebp - 0x300]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x18ec], ecx
mov dword [ebp - 0x188], 0
jmp 0x723736
mov edx, dword [ebp - 0x188]
add edx, 1
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
test ecx, ecx
je 0x7237e8
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
test eax, eax
je 0x7237e8
push ecx
push ecx
add esp, 4
xor ecx, 0xe191
sub ecx, 0x5e8b
call fcn.00723782
add byte [edi + 0x40], al
dec ebx
inc ebx
inc edx
xor eax, 0xc483323b
add esp, 4
jmp 0x72378d
inc edi
dec eax
xor al, 0x3c
cmp eax, dword [esi + 0x59]
add esp, 4
jmp 0x72378d
pop ecx
push eax
jmp 0x723794
pop eax
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
cmp edx, ecx
je 0x7237da
mov edx, dword [ebp - 0x71c]
add edx, dword [ebp - 0x188]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x188]
movsx edx, byte [ebp + ecx - 0x830]
cmp eax, edx
jne 0x7237e1
jmp 0x723727
jmp 0x7237e8
push ecx
push esi
add esp, 4
add ecx, 0x722a
or ecx, 0x25a0
xor ecx, 0xffdd
pop ecx
push eax
call 0x723811
add byte [eax + 0x38], al
dec edi
xor al, 0x36
dec ebp
inc ebx
xor eax, 0x4c4833f
jmp 0x723819
pop eax
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
cmp ecx, eax
jne 0x723847
mov dword [ebp - 0xc5c], 0
jmp 0x7238b6
push ecx
and ecx, 0x15a59
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x186a0
and edx, 0xbe02
sub edx, 0xa948
call 0x723875
add byte [edi + 0x3a374435], bh
inc ebx
xor dh, byte [0x5a04c483]
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
or ecx, 0x20
cmp edx, ecx
jge 0x7238ac
mov dword [ebp - 0xc5c], 0xffffffff
jmp 0x7238b6
mov dword [ebp - 0xc5c], 1
cmp dword [ebp - 0xc5c], 0
jne 0x7238cd
mov edx, dword [ebp - 0x18ec]
mov dword [ebp - 0x3c8], edx
jmp 0x7238de
jmp 0x7236b7
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
je 0x7239b9
push edx
push ebx
add esp, 4
add edx, 0x7bf5
xor edx, 0xe67d
pop edx
push esi
or esi, 0x15dfb
add esi, 0x14e9f
and esi, 0x513a
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x159b2
pop edi
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push ecx
push ecx
add esp, 4
jmp 0x723934
call fcn.00723944
add byte [ecx*2 + 0x453e3c43], bh
dec edi
dec esi
inc ebp
dec eax
Function at 0x723944
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x723957
add byte [edi], bh
xor esi, dword [edi]
cmp eax, 0x4c323236
cmp eax, 0x5904c483
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x7239b9
push esi
sub esi, 0x6467
sub esi, 0x4f9f
call 0x723992
add byte [edi + 0x3e], al
inc ebp
xor esi, dword [0xc4833641]
add al, 0x5e
push edi
and edi, 0x7bfb
sub edi, 0x11a2e
and edi, 0x6d95
pop edi
mov dword [ebp - 0xa58], 0
jmp 0x7240a4
push ebx
push eax
add esp, 4
sub ebx, 0x4b44
jmp 0x7239ca
and ebx, 0x4fa7
add ebx, 0x92fd
pop ebx
push ecx
sub ecx, 0x16dc8
pop ecx
push ecx
push edx
add esp, 4
or ecx, 0x5e9d
pop ecx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push ebx
xor ebx, 0x2d94
jmp 0x723a20
or ebx, 0x13f68
pop ebx
push ebx
push edi
add esp, 4
and ebx, 0x3b7c
pop ebx
push esi
push eax
add esp, 4
add esi, 0x147ce
or esi, 0x432
pop esi
cmp dword [ebp - 0x1574], 0
jne 0x723a5d
mov dword [ebp - 0x2a8], 0
jmp 0x723d04
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push edi
push ecx
add esp, 4
xor edi, 0x17304
pop edi
push ebx
sub ebx, 0x14fd0
and ebx, 0x3dd9
add ebx, 0x109d3
pop ebx
push edx
push edx
add esp, 4
or edx, 0x1491
and edx, 0x15c1b
pop edx
cmp dword [ebp - 0xc68], 0
jne 0x723ab9
mov dword [ebp - 0x2a8], 0
jmp 0x723d04
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push ecx
call 0x723ad5
add byte [edx], dh
dec ecx
dec eax
xor al, byte [eax + 0x44]
dec eax
inc edi
dec esi
add esp, 4
jmp 0x723adf
pop ecx
push edx
push eax
add esp, 4
call 0x723af3
add byte [ebp + 0x36], al
xor al, 0x4b
cmp byte [ecx + 0x45], al
cmp eax, dword [ebx - 0x72a5fb3c]
test eax, ebx
jmp 0x85fc3afe
push esi
sub esi, 0x1595b
and esi, 0xf783
add esi, 0x11e3b
or esi, 0x210c
pop esi
push esi
push edx
add esp, 4
sub esi, 0x12c58
add esi, 0x368d
add esi, 0x8bc
pop esi
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push edi
push ecx
add esp, 4
and edi, 0x8abb
pop edi
push ecx
xor ecx, 0x17cf7
xor ecx, 0xc784
sub ecx, 0x137e9
and ecx, 0x5355
pop ecx
push edi
push esi
add esp, 4
add edi, 0x102cc
pop edi
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x723da7
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x724098
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x723dcf
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x724098
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x723e01
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x724098
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
invalid
Function at 0x723957
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x723957
add byte [edi], bh
xor esi, dword [edi]
cmp eax, 0x4c323236
cmp eax, 0x5904c483
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x7239b9
push esi
sub esi, 0x6467
sub esi, 0x4f9f
call 0x723992
add byte [edi + 0x3e], al
inc ebp
xor esi, dword [0xc4833641]
add al, 0x5e
push edi
and edi, 0x7bfb
sub edi, 0x11a2e
and edi, 0x6d95
pop edi
mov dword [ebp - 0xa58], 0
jmp 0x7240a4
push ebx
push eax
add esp, 4
sub ebx, 0x4b44
jmp 0x7239ca
and ebx, 0x4fa7
add ebx, 0x92fd
pop ebx
push ecx
sub ecx, 0x16dc8
pop ecx
push ecx
push edx
add esp, 4
or ecx, 0x5e9d
pop ecx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push ebx
xor ebx, 0x2d94
jmp 0x723a20
or ebx, 0x13f68
pop ebx
push ebx
push edi
add esp, 4
and ebx, 0x3b7c
pop ebx
push esi
push eax
add esp, 4
add esi, 0x147ce
or esi, 0x432
pop esi
cmp dword [ebp - 0x1574], 0
jne 0x723a5d
mov dword [ebp - 0x2a8], 0
jmp 0x723d04
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push edi
push ecx
add esp, 4
xor edi, 0x17304
pop edi
push ebx
sub ebx, 0x14fd0
and ebx, 0x3dd9
add ebx, 0x109d3
pop ebx
push edx
push edx
add esp, 4
or edx, 0x1491
and edx, 0x15c1b
pop edx
cmp dword [ebp - 0xc68], 0
jne 0x723ab9
mov dword [ebp - 0x2a8], 0
jmp 0x723d04
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push ecx
call 0x723ad5
add byte [edx], dh
dec ecx
dec eax
xor al, byte [eax + 0x44]
dec eax
inc edi
dec esi
add esp, 4
jmp 0x723adf
pop ecx
push edx
push eax
add esp, 4
call 0x723af3
add byte [ebp + 0x36], al
xor al, 0x4b
cmp byte [ecx + 0x45], al
cmp eax, dword [ebx - 0x72a5fb3c]
test eax, ebx
jmp 0x85fc3afe
push esi
sub esi, 0x1595b
and esi, 0xf783
add esi, 0x11e3b
or esi, 0x210c
pop esi
push esi
push edx
add esp, 4
sub esi, 0x12c58
add esi, 0x368d
add esi, 0x8bc
pop esi
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push edi
push ecx
add esp, 4
and edi, 0x8abb
pop edi
push ecx
xor ecx, 0x17cf7
xor ecx, 0xc784
sub ecx, 0x137e9
and ecx, 0x5355
pop ecx
push edi
push esi
add esp, 4
add edi, 0x102cc
pop edi
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x723da7
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x724098
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x723dcf
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x724098
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x723e01
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x724098
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
invalid
Function at 0x723ad5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x723957
add byte [edi], bh
xor esi, dword [edi]
cmp eax, 0x4c323236
cmp eax, 0x5904c483
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x7239b9
push esi
sub esi, 0x6467
sub esi, 0x4f9f
call 0x723992
add byte [edi + 0x3e], al
inc ebp
xor esi, dword [0xc4833641]
add al, 0x5e
push edi
and edi, 0x7bfb
sub edi, 0x11a2e
and edi, 0x6d95
pop edi
mov dword [ebp - 0xa58], 0
jmp 0x7240a4
push ebx
push eax
add esp, 4
sub ebx, 0x4b44
jmp 0x7239ca
and ebx, 0x4fa7
add ebx, 0x92fd
pop ebx
push ecx
sub ecx, 0x16dc8
pop ecx
push ecx
push edx
add esp, 4
or ecx, 0x5e9d
pop ecx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push ebx
xor ebx, 0x2d94
jmp 0x723a20
or ebx, 0x13f68
pop ebx
push ebx
push edi
add esp, 4
and ebx, 0x3b7c
pop ebx
push esi
push eax
add esp, 4
add esi, 0x147ce
or esi, 0x432
pop esi
cmp dword [ebp - 0x1574], 0
jne 0x723a5d
mov dword [ebp - 0x2a8], 0
jmp 0x723d04
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push edi
push ecx
add esp, 4
xor edi, 0x17304
pop edi
push ebx
sub ebx, 0x14fd0
and ebx, 0x3dd9
add ebx, 0x109d3
pop ebx
push edx
push edx
add esp, 4
or edx, 0x1491
and edx, 0x15c1b
pop edx
cmp dword [ebp - 0xc68], 0
jne 0x723ab9
mov dword [ebp - 0x2a8], 0
jmp 0x723d04
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push ecx
call 0x723ad5
add byte [edx], dh
dec ecx
dec eax
xor al, byte [eax + 0x44]
dec eax
inc edi
dec esi
add esp, 4
jmp 0x723adf
pop ecx
push edx
push eax
add esp, 4
call 0x723af3
add byte [ebp + 0x36], al
xor al, 0x4b
cmp byte [ecx + 0x45], al
cmp eax, dword [ebx - 0x72a5fb3c]
test eax, ebx
jmp 0x85fc3afe
push esi
sub esi, 0x1595b
and esi, 0xf783
add esi, 0x11e3b
or esi, 0x210c
pop esi
push esi
push edx
add esp, 4
sub esi, 0x12c58
add esi, 0x368d
add esi, 0x8bc
pop esi
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push edi
push ecx
add esp, 4
and edi, 0x8abb
pop edi
push ecx
xor ecx, 0x17cf7
xor ecx, 0xc784
sub ecx, 0x137e9
and ecx, 0x5355
pop ecx
push edi
push esi
add esp, 4
add edi, 0x102cc
pop edi
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x723da7
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x724098
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x723dcf
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x724098
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x723e01
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x724098
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
invalid
Function at 0x723af3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x723957
add byte [edi], bh
xor esi, dword [edi]
cmp eax, 0x4c323236
cmp eax, 0x5904c483
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x7239b9
push esi
sub esi, 0x6467
sub esi, 0x4f9f
call 0x723992
add byte [edi + 0x3e], al
inc ebp
xor esi, dword [0xc4833641]
add al, 0x5e
push edi
and edi, 0x7bfb
sub edi, 0x11a2e
and edi, 0x6d95
pop edi
mov dword [ebp - 0xa58], 0
jmp 0x7240a4
push ebx
push eax
add esp, 4
sub ebx, 0x4b44
jmp 0x7239ca
and ebx, 0x4fa7
add ebx, 0x92fd
pop ebx
push ecx
sub ecx, 0x16dc8
pop ecx
push ecx
push edx
add esp, 4
or ecx, 0x5e9d
pop ecx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push ebx
xor ebx, 0x2d94
jmp 0x723a20
or ebx, 0x13f68
pop ebx
push ebx
push edi
add esp, 4
and ebx, 0x3b7c
pop ebx
push esi
push eax
add esp, 4
add esi, 0x147ce
or esi, 0x432
pop esi
cmp dword [ebp - 0x1574], 0
jne 0x723a5d
mov dword [ebp - 0x2a8], 0
jmp 0x723d04
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push edi
push ecx
add esp, 4
xor edi, 0x17304
pop edi
push ebx
sub ebx, 0x14fd0
and ebx, 0x3dd9
add ebx, 0x109d3
pop ebx
push edx
push edx
add esp, 4
or edx, 0x1491
and edx, 0x15c1b
pop edx
cmp dword [ebp - 0xc68], 0
jne 0x723ab9
mov dword [ebp - 0x2a8], 0
jmp 0x723d04
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push ecx
call 0x723ad5
add byte [edx], dh
dec ecx
dec eax
xor al, byte [eax + 0x44]
dec eax
inc edi
dec esi
add esp, 4
jmp 0x723adf
pop ecx
push edx
push eax
add esp, 4
call 0x723af3
add byte [ebp + 0x36], al
xor al, 0x4b
cmp byte [ecx + 0x45], al
cmp eax, dword [ebx - 0x72a5fb3c]
test eax, ebx
jmp 0x85fc3afe
push esi
sub esi, 0x1595b
and esi, 0xf783
add esi, 0x11e3b
or esi, 0x210c
pop esi
push esi
push edx
add esp, 4
sub esi, 0x12c58
add esi, 0x368d
add esi, 0x8bc
pop esi
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push edi
push ecx
add esp, 4
and edi, 0x8abb
pop edi
push ecx
xor ecx, 0x17cf7
xor ecx, 0xc784
sub ecx, 0x137e9
and ecx, 0x5355
pop ecx
push edi
push esi
add esp, 4
add edi, 0x102cc
pop edi
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x723da7
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x724098
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x723dcf
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x724098
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x723e01
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x724098
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
invalid
Function at 0x7341d0
Capabilities:
Execute syscall

Disassembly:
inc ebx
dec edi
push edx
mov cl, cl
or dword [esi + 0x52600c6], eax
add eax, 0x8a906b5e
fyl2x
add al, 4
imul ecx, dword [esi + 0x4ffad8a], 4
nop
push edx
stc
mov ss, word [edx + 0x404009d]
push ebp
in eax, dx
syscall
add eax, 0x38420505
inc edx
inc ebp
push ebx
aaa
push ebx
push eax
dec ebp
mov cl, cl
or ebp, ebp
syscall
add eax, 0x46550505
cmp byte [0x38494c49], bh
dec eax
mov cl, cl
or dword [ebp + 0x55], ebx
pop ebx
mov cl, cl
or dword [esi + 0x6383de5], eax
add eax, 0x518acc5d
sti
add al, 4
add eax, 0xf0050505
adc al, 0x90
lcall 0xc788, 0x404fb51
push es
mov ds, word [edx + 0x404fb51]
nop
mov dl, byte [ecx - 5]
add al, 4
inc eax
mov bl, byte [ebp + 0x78040400]
sub edx, dword [eax + 0x4fb5192]
add al, 0x14
mov esp, 0xf9655299
add al, 4
adc al, 0xbc
mov ch, byte [ebp + 0x400404ff]
aad 0x7a
adc byte [eax + 0x4009d92], dl
add al, 0x8e
push edx
stc
invalid

Function at 0x73ca9c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbe8
mov ebp, edx
push esp
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x73cae7
lea eax, [esp + 0x20c]
push eax
push 0
push 0x73cb2c
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
je 0x73cae7
mov eax, ebp
lea edx, [esp + 0x20c]
mov ecx, 0x106
call fcn.00409cc8
xor ebx, ebx
mov eax, dword [0x7a6990]
mov eax, dword [eax]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x73cb15
inc edi
xor esi, esi
mov eax, dword [0x7a6990]
mov eax, dword [eax]
mov edx, esi
call fcn.00447f1c
cmp byte [eax + 0x15], 0
je 0x73cb11
mov bl, 1
inc esi
dec edi
jne 0x73cafb
mov eax, dword [ebp]
mov edx, ebx
call fcn.00738ad4
add esp, 0x418
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x73d044
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov edi, ecx
mov esi, edx
lea ebp, [esp + 4]
xor ebx, ebx
mov eax, ebp
xor ecx, ecx
mov edx, 0x3c
call fcn.004052e4
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x40
mov eax, dword [0x7a6b6c]
mov eax, dword [eax]
call fcn.0056f5e8
mov dword [ebp + 8], eax
mov eax, esi
call fcn.00409c0c
mov dword [ebp + 0x10], eax
mov eax, edi
call fcn.00409c0c
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x1c], 5
mov eax, 0x73d100
mov dword [ebp + 0x18], eax
push ebp
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x73d0f4
jmp 0x73d0c9
mov ebx, 0xa
push 1
push 0
push 0
push 0
lea eax, [esp + 0x50]
push eax
call sub.user32.dll_PeekMessageW
dec ebx
jne 0x73d0b4
push 0x64
mov eax, dword [ebp + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x73d0af
push esp
mov eax, dword [ebp + 0x38]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp + 0x38]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, dword [esp]
and ebx, 0xff
mov eax, ebx
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x74f600
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov esi, dword [0x7a6368]
mov eax, dword [esp]
mov dword [ebx], eax
mov eax, dword [esp + 4]
mov dword [ebx + 4], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov edx, dword [esi]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fadd dword [ebx]
fcomp dword [0x74f7ac]
wait
fnstsw ax
sahf
jae 0x74f683
neg edx
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fstp dword [esp + 8]
wait
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x74f67d
lea edx, [esp + 0x14]
lea eax, [esp + 8]
call fcn.0063881c
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [ebx], eax
mov edx, dword [esi + 8]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fadd dword [ebx]
mov eax, dword [0x7a6434]
fild dword [eax]
fcompp
wait
fnstsw ax
sahf
jae 0x74f6e4
mov eax, dword [0x7a6434]
mov eax, dword [eax]
sub eax, edx
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp dword [esp + 8]
wait
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x74f6de
lea edx, [esp + 0x14]
lea eax, [esp + 8]
call fcn.0063881c
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [ebx], eax
mov edx, dword [esi + 0xc]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fadd dword [ebx + 4]
fcomp dword [0x74f7ac]
wait
fnstsw ax
sahf
jbe 0x74f73d
neg edx
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fstp dword [esp + 0xc]
wait
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x74f736
lea edx, [esp + 0x14]
lea eax, [esp + 8]
call fcn.0063881c
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 4], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fadd dword [ebx + 4]
mov edx, dword [0x7a62f8]
mov edx, dword [edx]
neg edx
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
fcompp
wait
fnstsw ax
sahf
jbe 0x74f7a4
sub edx, ecx
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fstp dword [esp + 0xc]
wait
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x74f79d
lea edx, [esp + 0x14]
lea eax, [esp + 8]
call fcn.0063881c
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 4], eax
add esp, 0x20
pop edi
pop esi
pop ebx
ret