joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f6c0
Capabilities:
Delete file
Delete registry key
Print debug messages
Terminate process

Disassembly:
sub esp, 0x608
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push str.ActiveX
call esi
mov eax, dword [0x1001e1f0]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x1001e1f4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call ebx
push 0x1001cb50
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
push edx
call fcn.1000d860
add esp, 4
lea eax, [esp + 0xc]
push eax
call esi
lea ecx, [esp + 0xc]
lea edx, [esp + 0x110]
push ecx
push str._s_lang.ini
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
xor esi, esi
lea eax, [esp + 0xc]
push eax
call edi
test eax, eax
je 0x1000f770
lea ecx, [esp + 0x110]
push ecx
call edi
test eax, eax
jne 0x1000f776
inc esi
cmp esi, 0xa
jl 0x1000f757
push 0x1001e314
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x218]
push str.SoftwareMicrosoftActive_SetupInstalled_Components_
lea edx, [esp + 0x21c]
push str._s_s
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x214]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x3e8
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000f7d0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x114], eax
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.1000f890
test al, al
je 0x1000f84b
lea esi, [esp + 0x10]
lea eax, [esp + 0x11c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000f833
test cl, cl
je 0x1000f82f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000f833
add eax, 2
add esi, 2
test cl, cl
jne 0x1000f80b
xor eax, eax
jmp 0x1000f838
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000f84b
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0x108
push 0x1001cb7c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 0x108
mov ecx, 0x42
lea esi, [esp + 0x224]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
call fcn.1000f990
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x108
ret 0x108
Function at 0x1000fc50
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x444
xor eax, eax
lea edx, [esp]
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x111
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x454]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebx
call fcn.1000faa0
test al, al
je 0x1000fcb4
mov ecx, 0x111
lea edi, [esp + 0xc]
lea esi, [esp + 0x454]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x1000fcdc
push 0x1001cb7c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 0x444
mov ecx, 0x111
lea esi, [esp + 0x898]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.1000fcf0
pop edi
pop esi
pop ebx
add esp, 0x444
ret 0x444

Function at 0x1000ff20
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0x1000fea0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov edx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x10010130
Capabilities:
Simulate ctrl alt del

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push str.Winlogon
mov esi, eax
call fcn.100100e0
add esp, 4
test eax, eax
jne 0x10010153
pop esi
ret
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
test esi, esi
je 0x10010177
push esi
call fcn.10010070
add esp, 4
mov eax, 1
pop esi
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x571d0f05
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x2ca06955
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x668657ef
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x4fa21c7b
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40f760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
add byte [eax], al
push ebx
push esi
or ecx, 0xffffffff
mov ebx, 0x484ea8
call fcn.0040f6f0
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413650
push esi
call fcn.004111dc
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f820
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f850
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f7b4
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x488120
push eax
call fcn.004149c2
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x427c2a
push edi
call fcn.0040f5c0
cmp eax, ebx
je 0x427c34
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414a46
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x40f813
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.00414d04
add esp, 0x10
push 0x99f2
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044afef
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x427c60
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00414fe2
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x40f813

Function at 0x40f820
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00412f40
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret
Function at 0x432233
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x432286
call 0xb7522a88
dec eax
add dl, byte [esi + 0xf]
mov bh, 0x30
push edi
xor edi, edi
test ebx, ebx
jle 0x43227d
lea ecx, [ecx - 0x73]
call 0xb6522e9d
add al, 7
add eax, esi
xor edx, edx
mov esi, 0xe400fff1
div esi
inc edi
mov esi, edx
lea eax, [ecx + esi]
xor edx, edx
mov ecx, 0xe400fff1
div ecx
mov ecx, edx
cmp edi, ebx
jl 0x432253
call 0xe2042ac4
adc byte [ebx], al
into
shl ecx, 0x10
add ecx, esi
pop edi
mov dword [eax], ecx
pop esi
pop ebx
call 0x55432ed7
mov ebp, esp
call 0x40e62ad8
jne 0x4322df
btr dword [edi + 0x77], 4
add byte [eax + 0xf4a7540], bh
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
insd dword es:[edi], dx
clc
add dword [edx + 0x3d], 0xfffffffc
jle 0x432307
add byte [ecx - 0x39], bh
add eax, 0xf00205c
add eax, ebp
jmp 0x1048ea72
sbb cl, bl
rcl byte [ebx - 0x27], 0xee
jnp 0xc3f932c0
fxch st(1)
fst qword [ebp - 0x18]
fld st(0)
call 0x2b5ac0
mov edi, dword [ebp - 0x18]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
fild qword [ebp + 8]
fst qword [ebp - 0x10]
fxch st(1)
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 5
jp 0x43237b
fsub qword [0xc483cd28]
call dword [edx + 0x50]
sbb dword [ebp - 0xc], 0xffffff8b
jne 0x432330
fstp qword [ebp - 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
sub ecx, edx
sbb eax, ebx
sub ecx, 0xa
sbb eax, 0
sub edi, edx
sbb esi, ebx
cmp esi, eax
jl 0x4323b3
jg 0x432365
cmp edi, ecx
jb 0x4323b3
or eax, 0xffffffff
add dword [ebp + 8], eax
adc dword [ebp + 0xc], eax
add al, byte [ebp + 8]
call 0x5ea2300b
pop ebx
add esp, 4
ret
fadd qword [0xc483cd28]
push dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
fstp qword [ebp - 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
sub ecx, esi
sbb eax, edx
sub ecx, 0xa
sbb eax, 0
sub edi, esi
mov esi, dword [ebp - 0x14]
sbb esi, edx
cmp esi, eax
jl 0x4323b3
jg 0x4323ab
cmp edi, ecx
jb 0x4323b3
add dword [ebp + 8], 1
adc dword [ebp + 0xc], 0
add al, byte [ebp + 8]
call 0x5ea23050
pop ebx
add esp, 4
ret
Function at 0x442e16
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a7f10], 0
push esi
push edi
mov esi, 0x4a7540
jne 0x442e36
push 0
call fcn.004148bd
push eax
call 0x7443228b
and byte [edx - 0x1f], dh
mov dword [0x49205c], 0x700270
mov dword [0x4a753c], esi
mov edx, 0xf67500e3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x8080634]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x442e4b
mov edx, 0x18c
lea esp, [esp]
dec dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x7400038c]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x442e86
mov ecx, dword [0x4a7540]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x7400038c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
inc edx
Function at 0x44aff9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660300e0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xae16dc]
push eax
call 0x2d2c64
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xae16dc]
push edx
call 0xff962bbe
xor esi, esi
test edi, edi
je 0x44b041
lea eax, [ebp - 0xae16dc]
push eax
call 0xff962c33
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44b02d
pop edi
pop esi
pop ebx
add byte [ecx + 0x55000cc2], cl
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 2
push edi
xor esi, esi
call fcn.00442cb9
cmp eax, 3
jne 0x44b0bf
push eax
push edi
mov esi, eax
call fcn.00442cb9
cmp eax, 7
jne 0x44b0bf
push 5
push edi
lea esi, [eax + 3]
call fcn.00442cb9
cmp eax, 0x1f
jne 0x44b0bf
push 8
push edi
lea esi, [eax + 0xa]
call fcn.00442cb9
cmp eax, 0xff
jne 0x44b0bf
push 8
push edi
lea esi, [eax + 0x29]
call fcn.00442cb9
cmp eax, 0xff
jne 0x44b0bf
lea esp, [esp + 0x70e900]
push 8
push edi
add esi, 0xff
call fcn.00442cb9
cmp eax, 0xff
je 0x44b0aa
pop edi
lea eax, [eax + esi + 3]
pop esi
popal
ret 4

Function at 0x44b30e
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
dec dword [0x49205c]
jne 0x44b31f
call fcn.00442e16
mov ecx, dword [0x4a753c]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a753c], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
jns 0x44b366
fadd qword [0x48cd18]
fmul qword [0x48cd20]
mov ecx, dword [ecx + 0x5c0dffc3]
dec dword [0x49205c]
jne 0x44b37d
call fcn.00442e16
mov eax, dword [0x4a753c]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4a753c], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
Function at 0x44c51e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a520120
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + 0x20]
push edi
mov edi, dword [ebp + 0xc]
movzx edx, word [edi + 8]
mov al, byte [edi]
mov cl, byte [edi + 7]
mov byte [ebp + 0xc], al
mov byte [ebp + 8], cl
mov dword [ebp - 4], edx
test esi, esi
je 0x44c64e
cmp al, 0x14
je 0x45364e
cmp al, 0x90
je 0x45364e
cmp al, 0x91
je 0x45364e
push edi
call fcn.00434886
test al, al
je 0x8d44c62c
lea eax, [ebp - 0x120]
push eax
call dword [0x4825c4]
test eax, eax
je 0x44c5a4
movzx eax, byte [ebp + 0xc]
or byte [ebp + eax - 0x74000120], 0x80
lea ecx, [ebp - 0x74000120]
lea eax, [ebp + eax - 0x74000120]
push ecx
call dword [0x4825c0]
movzx esi, byte [ebp + 8]
shl esi, 0x10
push edi
or esi, 1
call fcn.0044498a
cmp al, 1
jne 0x44c5be
or esi, 0x1000000
cmp byte [ebx + 0x17], 0
jne 0x44c5f4
cmp byte [ebx + 0x1d], 0
jne 0x44c5f4
mov al, byte [ebp + 0xc]
cmp al, 0x12
je 0x44c5f7
mov edx, dword [ebx + 0x20]
push esi
movzx ecx, al
push ecx
push 0x100
push edx
call dword [0x48265c]
push ebx
call fcn.00434786
pop edi
pop esi
pop ebx
add byte [ecx - 0x75fff73e], cl
inc ebp
or al, 0x80
jnp 0x44c610
mov al, byte [ebp + 0xc]
cmp byte [ebx + 0x16], 0
jne 0x44c5d1
add byte [ebp - 0x2c], dh
cmp byte [ebx + 0x1c], 0
jne 0x44c5d1
movzx edx, al
mov eax, dword [ebx + 0x20]
or esi, 0x20000000
push esi
push edx
push 0x66030104
push eax
call dword [0x48265c]
push ebx
call fcn.00434786
pop edi
pop esi
pop ebx
add byte [ecx + 0xf0008c2], cl
mov bh, 0x45
cld
push 1
push eax
push 0x66030102
push esi
call dword [0x48265c]
push ebx
call fcn.00434786
pop edi
pop esi
pop ebx
add byte [ecx + 0x570008c2], cl
push edi
call fcn.00434886
test al, al
je 0x44c6a0
push edi
call fcn.0044498a
cmp al, 1
jne 0x44c681
mov ecx, dword [ebp + 8]
call 0x1aed2bf
push ecx
push edx
push ebx
call fcn.00434727
push ebx
call fcn.00434786
pop edi
pop esi
pop ebx
add byte [ecx - 0x74fff73e], cl
inc ebp
or byte [ebx + 0x52000c4d], cl
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add byte [edx + 0x50], dl
push ecx
push ebx
call fcn.00434727
push ebx
call fcn.00434786
pop edi
pop esi
pop ebx
add byte [ecx + 0x660008c2], cl
inc dword [ebp - 4]
inc word [ebp - 4]
push 0x1c
lea ecx, [ebp - 0x20]
mov word [ebp - 0x1a], ax
xor eax, eax
push ecx
xor edx, edx
push 1
mov dword [ebp - 0x20], 0x77401
mov word [ebp - 0x1c], dx
mov dword [ebp - 0x18], 0x8080804
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call dword [0x4825b8]
push ebx
call fcn.00434786
pop edi
pop esi
pop ebx
invalid
mov word [ecx - 0x3e], fs
or byte [eax], al
Function at 0x46203e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7008ac
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x74a8]
call 0x841062a
mov eax, dword [esi]
push eax
push 0x28
lea ecx, [ebp - 0x74a8]
push ecx
call fcn.004343b7
mov edx, dword [esi]
push edx
mov edi, eax
push 0x70e90800
lea eax, [ebp - 0x74a8]
push eax
call fcn.004343b7
mov ecx, dword [ebp + 0x10]
push 0x28
push edi
mov ebx, eax
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x74a8]
push eax
mov dword [ebp - 0x10], 0x77000400
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ebx
call fcn.00434323
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi]
push edi
push ecx
push 0x1073
push edx
call dword [0x482654]
push 0x70e90800
lea eax, [ebp - 0x8a8]
push eax
push ebx
lea ecx, [ebp - 0x74a8]
push ecx
call fcn.004342e7
mov eax, dword [ebp + 0x14]
lea ebx, [ebp - 0x8a8]
call fcn.0040216a
lea edi, [ebp - 0x74a8]
call fcn.0041064a
pop edi
pop esi
mov al, 1
pop ebx
add byte [ecx + 0x550010c2], cl
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x10]
push 0x10000
call 0x84115e1
test eax, eax
add al, 0x50
lea eax, [ebp - 8]
push eax
call fcn.00436539
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
dec ecx
push ecx
mov dword [ebx], 0x8087fff
mov eax, dword [edx]
push 0x6603c4
push eax
call dword [0x482654]
mov eax, 0x33207401
leave
mov word [ebx + eax*2], cx
mov eax, esi
call fcn.0040216a
lea edx, [ebp - 8]
push edx
call fcn.00436512
mov al, 1
pop esi
pop ebx
add byte [ecx - 0x44fff33e], cl
test al, 0x4e
dec eax
add byte [ebx + 0x4e8c6], cl
cli
dec dword [ebp - 0x17af07bb]
mov dword [0x5efffd43], eax
xor al, al
pop ebx
add byte [ecx + 0x55000cc2], cl
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi]
push edi
mov edi, dword [0x482654]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x70e9b0
push edx
call edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jb 0x4621ae
pop edi
xor al, al
pop esi
add byte [ecx - 0x74fff73e], cl
push cs
mov ecx, dword [esi]
push 0xffffffffffffffdb
xor bl, bl
xor cl, byte [esi]
push ecx
call edi
mov edi, eax
test edi, edi
je 0x4621a4
cmp edi, dword [ebp - 8]
jb 0x4621a4
cmp edi, dword [ebp - 4]
jb 0x4621a4
push ebx
xor ecx, ecx
lea ebx, [edi + 1]
Function at 0x401b10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
movzx edi, dx
push esi
mov esi, eax
push ebx
mov ebx, ecx
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.user32.dll_VkKeyScanW]
xor ecx, ecx
sub esp, 4
cmp ax, 0xffff
je 0x401b58
mov edx, ebx
movzx ecx, al
or edx, 0x10
test ah, 1
cmovne ebx, edx
mov edx, ebx
or edx, 8
test ah, 2
cmovne ebx, edx
mov edx, ebx
or edx, 2
test ah, 4
cmovne ebx, edx
mov dword [esp], ebx
mov edx, edi
mov eax, esi
call sym._key_press
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
lea edx, [ebx + 0x8c]
sub esp, 0x8c
cmp dword [ebx + 0x68], 1
movsx eax, word [eax + 0x7e]
sbb edi, edi
and edi, 0x20
mov dword [ebp - 0x1c], eax
movsx eax, word [ebx + 0x7c]
add edi, 0x51
cmp dword [ebx + 0x60], 1
sbb esi, esi
mov dword [ebp - 0x20], eax
mov eax, 1
and esi, 0x20
add esi, 0x49
cmp dword [ebx + 0x5c], 1
adc eax, 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x80]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x74]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x6c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x88]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x84]
mov dword [ebp - 0x3c], eax
mov eax, edx
shr eax, 0x10
je 0x403280
mov dword [esp + 4], 0xffffffff
mov dword [esp], edx
mov dword [ebp - 0x40], edx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x4031df
mov edx, dword [ebp - 0x40]
mov eax, edx
call sym._wine_dbgstr_wn.part.0.constprop.0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
mov dword [esp + 0x34], edi
mov dword [esp + 0x54], ecx
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x34]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov dword [esp + 0x30], esi
mov dword [esp + 0x48], ecx
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x4c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x48]
mov dword [esp], str.cell__u__u__cursor__d__d__attr_02x_pop_up_02x_font_s__u__u_hist_u__d_flags_c_c_msk_08x_sb__u__u__win__u__u_x__u__u__edit_u
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x44]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x40]
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, dx
mov dword [esp], str._04x
mov dword [esp + 4], edx
call sym._wine_dbg_sprintf_1
jmp 0x4031df