joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e764
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [ebp + 8], 0
je 0x41e7d5
cmp dword [ebp + 0x10], 0
jne 0x41e77a
cmp dword [ebp + 0xc], 0
je 0x41e7d5
cmp dword [ebp + 0x14], 0
je 0x41e7d5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x33
call fcn.0041e795
pop ecx
pop ecx
pop ebp
ret

Function at 0x41e7dc
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
cmp dword [ebp + 8], 0
je 0x41e860
cmp dword [ebp + 0x10], 0
jne 0x41e7f4
cmp dword [ebp + 0xc], 0
je 0x41e860
cmp dword [ebp + 0x14], 0
je 0x41e860
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x33
call fcn.0041e813
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x41e868
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.0041e883

Function at 0x41f04c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x42953a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f09b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
jmp 0x41f0ba
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f12c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f115
test esi, esi
jbe 0x41f12c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f107
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f12c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0e4
jmp 0x41f12c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f12c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429541
ret
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x42a89f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0x447348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0x447348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0x446178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a8a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x3fc86cc8
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x71035cad
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x5d8e6f
Capabilities:
Encode data using xor

Disassembly:
push 0x5d8b64
pop eax
and ebx, edx
add edx, ebx
add edx, 0xb28d41c2
call fcn.005d8ec5
add edx, 0x566a62e8
add edx, 0x303b7789
or edx, ebx
xor dword [ecx], eax
push edx
mov edx, dword [esp]
add esp, 4
add edx, edx
add edx, 1
add ecx, 2
mov ebx, 0x8aa44f36
cmp ecx, edi
jl fcn.005d8e6f
sub ebx, 0xf147e5aa
add ebx, 1
or ebx, ebx
ret
Function at 0x402b50
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
test dword [esp + 0x4c], 0x100
je 0x402b73
mov ebx, edi
test bl, bl
je 0x402ba8
cmp si, 0x58
jbe 0x402be0
mov eax, dword [esp + 0x50]
test eax, eax
je 0x402b90
mov ebx, 0xffffffff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
movzx ebx, al
test al, al
je 0x402b81
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, esi
mov edx, 0x1c
xor eax, eax
jmp 0x402bc3
lea edx, [eax + eax*4]
movzx edx, word [edx + edx + 0x41c340]
cmp cx, dx
je 0x402c90
add eax, 1
cmp eax, 0xc
jne 0x402bb8
jmp 0x402b81
movzx esi, si
movzx eax, ax
mov dword [esp + 4], 2
lea ecx, [esi*8 + 0x41c060]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ebp, ax
sub esp, 8
mov dword [esp], ebp
mov ebx, ebp
call dword [sym.imp.msvcrt.dll_isupper]
mov dword [esp], ebp
test eax, eax
jne 0x402c70
call dword [sym.imp.msvcrt.dll_islower]
mov ecx, eax
mov eax, ebp
test ecx, ecx
je 0x402c31
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll_toupper]
test byte [esp + 0x4c], 3
je 0x402c7d
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 6]
cmp ebx, 0xff
jle 0x402b79
mov ecx, edi
movzx ecx, cl
cmp ecx, ebp
je 0x402c5d
cmp eax, ecx
jne 0x402b79
or bl, 0xff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll_tolower]
test byte [esp + 0x4c], 3
jne 0x402c38
test byte [esp + 0x4c], 0xc
je 0x402cd0
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 4]
jmp 0x402c40
lea eax, [eax + eax*4]
lea eax, [eax + eax + 0x41c340]
test byte [esp + 0x4c], 3
jne 0x402cf0
test byte [esp + 0x4c], 0xc
je 0x402d10
movzx ebx, word [eax + 6]
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x402b81
cmp ebx, 0xff
jle 0x402b86
or bl, 0xff
jmp 0x402c60
test byte [esp + 0x4c], 0x10
jne 0x402d00
mov ecx, edi
test cl, cl
jne 0x402c40
movzx ebx, word [esi*8 + 0x41c060]
jmp 0x402c40
movzx ebx, word [eax + 8]
xor eax, eax
test ebx, ebx
setne al
jmp 0x402cb3
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 2]
jmp 0x402c40
test byte [esp + 0x4c], 0x10
je 0x402d24
movzx ebx, word [eax + 4]
xor eax, eax
test ebx, ebx
setne al
jmp 0x402cb3
movzx ebx, word [eax + 2]
jmp 0x402cbb
Function at 0x402d30
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov edx, dword [ebx]
mov eax, dword [eax + 0xc]
test edx, edx
jne 0x402df0
test al, 0x1c
jne 0x402d4f
test al, 3
jne 0x402de2
mov ebx, dword [0x421328]
test ebx, ebx
je 0x402de2
movsx eax, bl
mov dword [esp], eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
sub esp, 4
movzx ecx, al
cwde
mov dword [esp + 0x28], 0
mov edx, eax
mov byte [esp + 0x2a], bl
mov ebx, eax
sar edx, 4
sar ebx, 6
and edx, 0x10
sar eax, 9
mov dword [esp], ecx
and ebx, 8
and eax, 2
mov dword [esp + 0x24], 0
or edx, ebx
mov word [esp + 0x26], cx
or eax, edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
mov word [esp + 0x28], ax
movzx eax, byte [0x421328]
lea edx, [esp + 0x20]
call fcn.00402a20
mov dword [0x421328], 0
add esp, 0x38
pop ebx
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 6]
mov dword [esp + 8], eax
movzx eax, word [ebx + 8]
mov dword [esp + 4], eax
movsx eax, byte [ebx + 0xa]
mov dword [esp], eax
call fcn.00402b50
mov edx, dword [ebx + 0xc]
test dl, 0x1c
je 0x402e3f
cmp eax, 0xffffffff
je 0x402d4f
mov dword [0x421328], 0
mov edx, ebx
call fcn.00402a20
add esp, 0x38
pop ebx
ret
and dl, 3
je 0x402e20
movzx edx, word [ebx + 6]
lea ecx, [edx - 0x60]
cmp cx, 9
ja 0x402e74
mov ecx, dword [ebx]
test ecx, ecx
je 0x402e6a
mov ecx, dword [0x421328]
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*2 - 0x60]
mov dword [0x421328], edx
cmp eax, 0xffffffff
jne 0x402e33
jmp 0x402de2
cmp eax, 0xffffffff
jne 0x402e29
jmp 0x402de2

Function at 0x4031a0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x4c]
test ebx, ebx
js 0x403240
test ebp, ebp
js 0x403230
shl ebp, 0x10
movzx ebx, bx
or ebx, ebp
test edi, edi
js 0x40320a
mov dword [esp], 0
lea ebp, [esp + 0x18]
call fcn.004028b0
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor eax, eax
sub esp, 8
test edi, edi
setne al
mov dword [esp + 4], ebp
mov dword [esp + 0x1c], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [0x42e5ac], 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.00405360
mov ebp, eax
jmp 0x4031c3
mov dword [esp], esi
call fcn.004052c0
mov ebx, eax
jmp 0x4031bf
Function at 0x403b90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
sub esp, 0x10
mov eax, dword [0x41b118]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x9908b0df
test eax, eax
je 0x403caa
cmp eax, 0x41badc
jae 0x403bed
mov ebx, dword [eax]
mov edx, ebx
add eax, 4
shr edx, 0xb
mov dword [0x41b118], eax
add esp, 0x10
xor edx, ebx
pop ebx
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor edx, eax
mov eax, edx
shl eax, 0xf
and eax, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
ret
xor eax, eax
nop
mov ecx, dword [eax*4 + 0x41b11c]
add eax, 1
mov edx, dword [eax*4 + 0x41b11c]
and ecx, 0x80000000
and edx, 0x7fffffff
or edx, ecx
mov ecx, edx
and edx, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0x41b74c]
xor ecx, dword [esp + edx*4 + 8]
mov dword [eax*4 + 0x41b118], ecx
cmp eax, 0xe3
jne 0x403bf0
nop
mov ecx, dword [eax*4 + 0x41b11c]
add eax, 1
mov edx, dword [eax*4 + 0x41b11c]
and ecx, 0x80000000
and edx, 0x7fffffff
or edx, ecx
mov ecx, edx
and edx, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0x41ad8c]
xor ecx, dword [esp + edx*4 + 8]
mov dword [eax*4 + 0x41b118], ecx
cmp eax, 0x26f
jne 0x403c30
mov ebx, dword [0x41b11c]
mov ecx, dword [0x41bad8]
mov eax, ebx
and ecx, 0x80000000
and eax, 0x7fffffff
or ecx, eax
mov eax, ecx
and ecx, 1
shr eax, 1
xor eax, dword [0x41b74c]
xor eax, dword [esp + ecx*4 + 8]
mov dword [0x41bad8], eax
mov eax, 0x41b11c
jmp 0x403bba
mov eax, 0x50000
xor edx, edx
call fcn.00403b20
mov eax, dword [0x41b118]
jmp 0x403bb1

Function at 0x4041e0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, dword [0x41b118]
cmp eax, 0x41badc
je 0x404200
lea edx, [eax + 4]
mov eax, dword [eax]
mov dword [0x41b118], edx
ret
push ebx
sub esp, 0x38
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
sub esp, 0x14
cmp eax, 1
je 0x404268
mov dword [esp + 8], 3
fld1
fchs
fstp qword [esp]
call fcn.00403e40
sub esp, 0xc
call fcn.00403b90
add esp, 0x38
pop ebx
ret
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], 0x41b11c
mov dword [esp + 4], 0x9c0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
sub esp, 0xc
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
test ebx, ebx
je 0x404241
mov eax, 0x41b11c
lea edx, [eax + 4]
mov eax, dword [eax]
mov dword [0x41b118], edx
jmp 0x40425d
Function at 0x40c5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
mov esi, 0x41dc54
push ebx
sub esp, 0x8c
fld dword [0x41dcbc]
mov edx, dword [0x42ea14]
mov dword [esp + 0x38], 0
lea ebp, [esp + 0x38]
lea edi, [esp + 0x44]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x3c], 0
mov ebx, dword [esp + 0xa0]
mov dword [esp + 0x44], eax
mov eax, dword [0x42ea10]
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], eax
mov eax, dword [0x42ea10]
mov dword [esp + 0x7c], 0
mov dword [esp + 0x54], 0
shl eax, 2
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x50], 2
mov dword [esp + 0x4c], edx
mov dword [esp + 0x64], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x6c], 3
fst dword [esp + 0x74]
mov dword [esp + 0x2c], eax
mov eax, 0x57
fstp dword [esp + 0x70]
lea esi, [esi]
nop
mov dword [esp + 0x68], eax
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x64]
add esi, 4
mov edx, dword [eax]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x38]
sub esp, 0x10
test eax, eax
jns 0x40c69f
mov eax, dword [esi]
test eax, eax
jne 0x40c670
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x40c800
mov eax, dword [esp + 0x68]
mov esi, dword [ecx]
mov dword [esp + 0xc], 0
mov edx, dword [esp + 0x6c]
fld dword [0x41dcbc]
mov dword [esp], ecx
mov dword [esp + 0x54], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
fst dword [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
fstp dword [esp + 0x5c]
call dword [esi + 0x10]
sub esp, 0x1c
test eax, eax
js 0x40c7c0
mov eax, dword [esp + 0x68]
cmp eax, 0x56
jbe 0x40c721
mov edx, dword [0x425914]
cmp dword [edx + 0x20], 0x17
jg 0x40c75d
cmp eax, 0x56
mov dword [esp], 0x20
setbe al
movzx eax, al
mov dword [esp + 4], eax
call fcn.00413920
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x4c]
mov dword [esp], 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_calloc
mov dword [ebx + 0x24], eax
test eax, eax
je 0x40c7c0
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x41dc60
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
js 0x40c7c0
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x18], 0x40b800
mov dword [ebx + 0x1c], fcn.0040c5b0
mov dword [ebx + 0x12c], eax
mov eax, dword [esp + 0x3c]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x14], eax
add esp, 0x8c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
test eax, eax
je 0x40c7d3
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40c7e6
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
add esp, 0x8c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x40c7c8
jmp 0x40c7e6
Function at 0x40ec50
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push ebx
sub esp, 0x114
mov eax, dword [0x42ea0c]
test eax, eax
jne 0x40ec70
call fcn.00409e40
add esp, 0x114
pop ebx
pop esi
ret
lea eax, [esp + 0x10]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
movzx eax, byte [0x41e520]
mov edx, 0x41e521
sub esp, 4
test al, al
jne 0x40ecac
jmp 0x40ec61
or cl, byte [esp + ebx + 0x10]
shr cl, 7
mov byte [eax], cl
movzx eax, byte [edx + 2]
add edx, 3
test al, al
je 0x40ec61
movzx ecx, byte [edx]
mov esi, dword [0x425914]
movzx ebx, byte [edx + 1]
movzx ecx, byte [esp + ecx + 0x10]
add eax, dword [esi + 0x64]
test bl, bl
jne 0x40ec98
shr cl, 7
mov byte [eax], cl
jmp 0x40eca1
Function at 0x410060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov eax, 0x1018
push edi
push esi
push ebx
call fcn.004149a8
sub esp, eax
mov ebx, dword [esp + 0x102c]
mov eax, dword [esp + 0x1034]
mov byte [esp + 0xd], 1
lea ebp, [esp + 0x1019]
mov ecx, dword [esp + 0x1038]
lea edx, [ebx + 1]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 1]
movzx ebx, byte [ebx]
shl edx, 8
and dx, 0xf00
mov esi, edx
mov edx, dword [esp + 0x1030]
or esi, ebx
lea edi, [edx - 1]
mov ebx, esi
mov edx, esi
mov word [esp + 0x12], si
mov byte [eax], bl
mov ebx, 0x100
mov byte [esp + 0x11], dl
lea edx, [eax + 1]
mov eax, dword [ecx]
mov dword [esp + 4], edi
add eax, edx
mov dword [ecx], 1
mov dword [esp + 0x14], eax
mov word [esp + 0xe], bx
test edi, edi
jle 0x4101e0
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
sub ebx, 1
cmp byte [esp + 0xd], 0
movzx edi, byte [esi]
movzx eax, byte [esi + 1]
je 0x4101f8
add esi, 2
sub dword [esp + 4], 2
mov dword [esp + 8], esi
movzx esi, al
mov eax, edi
shr al, 4
shl esi, 4
movzx edi, al
or esi, edi
xor byte [esp + 0xd], 1
cmp si, 0xfff
je 0x41028b
cmp si, word [esp + 0xe]
jb 0x410220
movzx eax, byte [esp + 0x11]
movzx ebx, word [esp + 0x12]
mov byte [esp + 0x19], al
lea eax, [esp + 0x1a]
jmp 0x410174
lea ebx, [ebx + ebx*2]
add eax, 1
lea edi, [ebx + ebx + 0x42ea80]
movzx ebx, byte [edi + 4]
mov byte [eax - 1], bl
movzx ebx, word [edi + 2]
cmp eax, ebp
je 0x4101e0
cmp ebx, 0xff
jg 0x410158
mov byte [esp + 0x11], bl
mov byte [eax], bl
mov edi, dword [esp + 0x14]
cmp edi, edx
jbe 0x4101e0
mov ebx, edx
sub ebx, edi
lea edi, [esp + 0x19]
add ebx, eax
mov dword [esp], ebx
jmp 0x4101a5
cmp dword [esp], eax
je 0x4101e0
movzx ebx, byte [eax]
sub eax, 1
add edx, 1
mov byte [edx - 1], bl
add dword [ecx], 1
cmp eax, edi
jae 0x4101a0
movzx edi, word [esp + 0xe]
cmp di, 0xffe
jbe 0x410260
mov eax, dword [esp + 4]
test eax, eax
jle 0x4101e0
mov word [esp + 0x12], si
jmp 0x4100eb
mov eax, 0xffffffff
add esp, 0x1018
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov esi, eax
mov eax, edi
add dword [esp + 8], 1
shl esi, 8
movzx edi, al
mov dword [esp + 4], ebx
and si, 0xf00
or esi, edi
jmp 0x410124
movzx ebx, si
lea eax, [esp + 0x19]
jmp 0x410253
lea ebx, [ebx + ebx*2]
add eax, 1
lea edi, [ebx + ebx + 0x42ea80]
movzx ebx, byte [edi + 4]
mov byte [eax - 1], bl
movzx ebx, word [edi + 2]
lea edi, [esp + 0x1018]
cmp eax, edi
je 0x4101e0
cmp ebx, 0xff
jg 0x410230
jmp 0x41017c
movzx eax, di
movzx ebx, word [esp + 0x12]
add edi, 1
lea eax, [eax + eax*2]
mov word [esp + 0xe], di
lea eax, [eax + eax + 0x42ea80]
mov word [eax + 2], bx
movzx ebx, byte [esp + 0x11]
mov byte [eax + 4], bl
jmp 0x4101c8
xor eax, eax
jmp 0x4101e5

Function at 0x414eb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00414b80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00414b80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]