joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21a902f
Capabilities:
Get number of processors

Disassembly:
jge 0x2222bb1
movzx ecx, byte [edi]
jmp 0x1a795f8
inc eax
rol dh, 1
push ebp
inc esi
xchg byte [esp + esi - 0x2cbc5799], dh
sal bp, 0xe8
inc eax
adc dh, 0xb9
call fcn.0215a269
jb 0x22477e7
mov edx, 0x753a6427
mov dx, word [ebp + edx - 0x753a6427]
push 0x6c242fbc
mov ax, word [ebp + 2]
mov cl, byte [ebp + 4]
add ebp, 4
jmp 0x21abf62
shld dx, ax, cl
mov word [ebp], dx
mov ecx, dword [edi]
push 0xf924f038
mov edx, 0xce3dcc9b
add edi, 4
xor ecx, ebx
movzx eax, dl
dec ecx
pop edx
neg ecx
shl dword [esp + edx + 0x6db0fc8], 0xde
jns 0x22b7813
pop edx
xor ebx, ecx
sub dx, 0xf800
add esi, ecx
rol dl, 0x83
jmp esi
mov dword [ebp + edx - 0x80000000], ecx
movzx ecx, dl
cmovne ecx, edx
jmp esi
add byte [esp + edx + 0x6db0fc8], 0x31
ror ecx, 3
and dword [esp + edx*8 + 0x36d87e40], eax
not ecx
lea edx, [edx - 0x4afb8552]
lea ecx, [ecx + edx*2 + 0x3b9f6c95]
jg 0x1ab8d23
sub ebp, 4
mov eax, 0x679b653a
movzx ecx, al
mov edx, ecx
mov edx, dword [ebp + eax - 0x679b653a]
call fcn.013c0f77
and eax, eax
dec cl
ror eax, 0xbe
not cl
inc ax
dec cl
xor ax, ax
xor bl, cl
or eax, 0x72101983
setae al
adc ecx, esp
or dx, dx
mov dx, word [ecx + edx - 0x2ab6b786]
lea ebp, [ebp + eax - 0x7ab11903]
movsx ecx, ax
and ecx, 0xb0a0ff88
jg 0x2320654
mov word [eax + ebp - 0x7ab11901], dx
seto cl
lea edx, [eax + ecx - 0x11619f6b]
mov eax, dword [esi + ecx - 0x1900]
push edx
lea esi, [esi + ecx*2 - 0x31fc]
xchg dword [esp + ecx - 0x1900], ecx
inc edx
xor eax, ebx
mov byte [esp + edx - 0x694f9294], 0x81
shr word [esp + ecx - 0x694f9296], 0xf
sbb eax, 0xc1256232
xor eax, 0x3b123215
neg eax
not dword [esp + ecx - 0x694f9296]
sub eax, 0x699bfeaf
ror dx, 0xc
adc edx, dword [esp + edx - 0x694f2979]
adc ecx, ecx
bswap eax
xor ebx, eax
jmp 0x14841f2

Function at 0x21a9150
Capabilities:
Encode data using xor

Disassembly:
not edx
jnp 0x13fff12
push ebx
call fcn.0214f389
push 0x1083c326
sal dword [esp], 0x7a
setns byte [esp]
mov eax, dword [edi]
mov ecx, 0x7e95ec27
call fcn.0224e833
xor ecx, dword [esp + ecx - 0x4bea298a]
sbb dword [esp + ecx*4 - 0x280], ecx
mov edx, dword [ebp + ecx*4 - 0x280]
not word [esp + ecx - 0x9e]
xor edx, ebx
sal cl, 4
adc edx, 0xa02b3fbd
mov eax, 0xe2bab21d
ror edx, 3
and al, ch
jno 0x210426b
movsx edx, cx
inc eax
ror ecx, 0x68
sal edx, cl
xor ebx, eax
add edi, eax
mov eax, dword [esi + edx - 0x58000000]
shr dx, 0x45
movzx cx, byte ss:[edx + eax - 0x58000000]
shl edx, 0xd9
xor dl, dh
lea esi, [esi + edx*2 + 2]
mov word [edx + esi], cx
mov ecx, edx
movsx eax, cl
rol ecx, 0x3b
add edx, edi
jmp edx
dec edx
xor cx, ax
not dword [esp + ecx*2 - 0x16400]
adc ax, 0x888f
neg edx
rol edx, 2
xor ebx, edx
add edi, edx
dec ecx
rol byte [esp + ecx*8 - 0x58ff5], 0x66
mov dword [esp + ecx - 0xb1ff], edi
ret
xor bl, al
mov dword [esp + edx - 0x6108fff9], edx
shr dl, 0xe1
mov dword [esp + edx - 0x6108ff7c], ebp
push esi
jl 0x13a41f4
lea ebp, [ebp + ecx - 0x4bea298e]
jae 0x1a8da1c
lea edx, [eax*4 + 0x3db2bba3]
xor ebx, ecx
add esi, ecx
pop eax
call fcn.01353d8a
Function at 0x21ada59
Capabilities:
Encode data using xor

Disassembly:
add edx, esp
shr al, 0x21
mov word [edx], cx
aam 0xc0
call 0xc9ecf68
mov edx, eax
neg ax
sub ebp, 4
mov ecx, edx
xadd ax, cx
dec ecx
mov ecx, dword [ebp]
xor ecx, ebx
dec ecx
ror ecx, 1
bswap ecx
or edx, 0xaa176d17
ror ecx, 3
dec edx
shr edx, 0xfb
add dx, dx
inc ecx
add eax, eax
xor ebx, ecx
ror edx, 0x82
add esi, ecx
call fcn.02102644
and esi, dword [esi - 0x34ddbc63]
pop esi
scasb al, byte es:[edi]
add al, 0x22
jecxz 0x2156940
inc eax
clc
sbb dword [esi + esi*8 + 0x58165da2], esi
xchg esp, eax
or dword [ebx], ebp
add al, 0xa9
fstp dword [eax]
iretd
rol edx, 2
call fcn.0228325b
or edx, 0x8f927f2d
neg edx
movzx edx, byte [edx + ebp - 0x6400d1]
mov eax, 0xa73c9937
xor dl, bl
rol dl, 1
jmp 0x2222da6
rol al, 0x46
setae al
inc dl
not dl
not al
add dl, 0x29
xor bl, dl
jmp 0x215693f

Function at 0x2237a41
Capabilities:
Encode data using base64

Disassembly:
seta byte [esp + edx - 0x4650863f]
neg ecx
add eax, edx
sbb ax, dx
push edx
ror ecx, 2
call fcn.0142cb50

Function at 0x224cf93
Capabilities:
Execute syscall

Disassembly:
neg ax
ror edx, 3
call fcn.0209dedd

Function at 0x225e5bd
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xf63d272f
sub eax, 0xd29fc583
mov word [ebp + eax*2 - 0x2333510e], cx
neg eax
mov eax, dword [edi]
mov edx, dword [esp]
movsx ecx, dx
mov byte [esp + ecx - 0x272f], dl
lea edi, [edi + ecx*8 - 0x13974]
add edx, 0x8c1dfa36
sbb dx, word [esp + ecx - 0x272d]
xor eax, ebx
xadd ecx, edx
and word [esp + edx*2 - 0x4e5e], 0x1fa6
bswap eax
lea edx, [ecx + edx*8 + 0x6932871c]
jae 0x225a325
push edx
adc ebp, 2
lea edx, [edx*8 - 0x76ce14c1]
xor word [esp + edx - 0x4db2344b], dx
sal al, cl
movzx ecx, byte [esp + edx - 0x4db2344b]
push ecx
push edx
mov word [ebp + edx - 0x4db2344f], ax
movzx eax, dx
sal eax, cl
mov ecx, dword [edi + edx - 0x4db2344f]
shl dword [esp + edx - 0x4db23443], 0x77
ja 0x22ca88b
lea edi, [eax + edi - 0x689dffc]
call fcn.020dc6b4
xor cx, 0xf6a0
xor edx, ebx
shl al, 0xc6
xadd cl, al
or eax, eax
lea edx, [edx + ecx - 0x5843421c]
neg cl
sal eax, 0x3f
sbb eax, 0x38275f08
ror edx, 1
sal ecx, cl
lea edx, [edx + ecx*4 - 0x72ebcd77]
not eax
rol edx, 1
sal al, 0xa4
shl ecx, 0xd6
lea edx, [edx + ecx - 0xd9bbea3]
shr eax, 0x16
push ecx
xor ebx, edx
xadd eax, ecx
ror ax, 0x63
adc esi, edx
lea edx, [ecx + ecx*4 + 0x3b81f03]
pop ecx
mov eax, dword [edi + ecx*2]
or cl, byte [edi + ecx*2 + 4]
ror dx, 0xcb
ror edx, 0xbb
lea edi, [edi + edx - 0x770d8c7e]
sar edx, 0xc7
shr edx, 0xe7
sal eax, cl
movsx ecx, dl
mov dword [edx + edi - 0x1dc36], eax
dec ecx
seto cl
add ecx, esi
jmp ecx

Function at 0x226b030
Capabilities:
Encode data using xor

Disassembly:
shr dword [esp + 4], 0xb8
xor eax, 0xec1c60b2
dec edx
call fcn.02131f1f
mov ecx, 0x819c94af
movzx eax, cl
lea edi, [edi + eax*4 - 0x2c0]
shl ax, cl
movsx edx, cx
mov eax, dword [eax + edi - 0x8000]
bswap ecx
xor eax, ebx
shl dl, cl
lea eax, [eax + ecx - 0x3af8be80]
ror edx, cl
ror eax, cl
neg eax
or dl, dl
add dl, 0x23
inc eax
call fcn.02259322
Function at 0x227ca41
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 0xc]
je 0x227ca67
mov eax, 0xda843129
sar eax, 0x4b
xor al, ah
mov eax, dword [ebp + ebx*4]
push eax
dec ebx
jne 0x227ca51
call fcn.0148a119

Function at 0x2284845
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov edi, dword [esp + 4]
mov esi, 0xad13f1ba
mov ebx, dword [esp + 8]
mov dword [esp], esi
sal dword [esp], 0x2b
mov dword [esp + 8], esi
mov esi, dword [esp + 0xc]
mov ecx, 0x11a72dac
js 0x212ff4a

Function at 0x229209a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x22fbd65
int1
xchg ebx, eax
out 0xa3, eax
outsb dx, byte [esi]
not ecx
ror ecx, 2
add eax, edx
rol dx, 0xe
add ecx, 0xbd093a11
call fcn.02130d26
call fcn.0231d563
adc esi, eax
ror edx, cl
movzx ax, byte [edi + ecx - 0x6b2f1a2e]
call fcn.02141d06
xor bl, byte [ebp - 0x18]
cmpsb byte [esi], byte es:[edi]
sbb edi, 0xffffffe1
sbb dl, bh
pop edx
or al, 0x8f
fistp dword [ebp + 0x1a84e7cb]
wait
sbb dword [ebp - 0x2125dbb4], ecx
jns 0x146c675
fidivr word [ecx - 0x7f]
loope 0x146c692
loopne 0x146c6a7
dec eax
xlatb
push edi
stc
enter 0x4721, 0x41
jg 0x146c6f1
xor dword [ecx], esp
push edi
push esp
invalid
call fcn.02262090
mov dword [esp], edx
lea ecx, [edx + edx*2 - 0x8e4e5cf]
sub eax, 0x8b191c88
ror eax, 1
shr dword [esp + ecx - 0x6b2f1a2e], cl
xor ebx, eax
xor byte [esp + ecx - 0x6b2f1a2d], ch
jne 0x146c6c7
mov dword [esp], edx
mov edx, dword [ebp + 4]
neg cx
or ecx, 0x492c570f
adc ebp, 4
not cx
sal dword [esp], cl
or eax, edx
pop edx
dec edx
not eax
rol ecx, 0x25
mov dword [ebp + ecx*2 - 0x4ba03c36], eax
mov ecx, dword [edi + ecx*2 - 0x4ba03c36]
add edi, 4
xor ecx, ebx
jmp 0x1a7ca00
add eax, 0x1400a00c
movzx edx, byte [ebp]
call fcn.020ef682

Function at 0x22a924f
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebx
call fcn.0139aaff
mov ax, word [edx + edi - 0x12b1200]
and ecx, ecx
shl word [esp + edx - 0x12b11f6], 0xcf
call fcn.0215febc
mov edx, 0x3a082d95
lea ebp, [ebp + edx - 0x3a082d91]
lea eax, [edx - 0x5dc30f5f]
jmp 0x2249080

Function at 0x22ae064
Capabilities:
Execute syscall

Disassembly:
shld eax, edx, cl
mov dword [edi], eax
call fcn.01368b9a

Function at 0x22af377
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
je 0x1435b89
push 0xbea5bb22
sar word [esp + 2], 0xaf
mov dword [esp], ebx
Function at 0x22bcbc9
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jne 0x218646a
pop edi
mov eax, 0x4f097a32
not edx
mov dword [ebp + eax - 0x4f097a32], edx
movzx ecx, ax
lea edi, [eax + edi - 0x4f097a36]
mov ecx, dword [edi + eax - 0x4f097a32]
add al, al
xor ecx, ebx
xor ecx, 0x1a14e3b3
movsx edx, ax
bswap ecx
not eax
shl dl, 0xe1
ror eax, 0xbc
dec ecx
or dl, 0x3a
or ax, dx
xor ecx, 0x7613ae2f
add dl, dl
sal ax, 0x23
push eax
xor ebx, ecx
add esi, ecx
sub al, byte [esp + eax*4 - 0x3da37f5e]
call fcn.01364dff
push 0xfffffffffffffffd
add byte [esp + edi*4 - 0xf], ch
mov edi, 0x64c3ecb5
mov byte [eax], bl
insb byte es:[edi], dx
or byte [ebp - 0x3d225017], ch
lea edi, [ebp + edi*8 + 0xb248b31]
sti
or eax, 0x4a0d6bf3
in al, 0xd2
add eax, 0xd1ec37af
xchg ch, bh
imul dword [edi - 0x6a62808f]
jns 0x14934e3
mov ecx, 0xa3dccdfb
invalid
dec eax
jmp 0x14934ca

Function at 0x22c8c81
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 8]
je 0x13dd98a

Function at 0x22d046d
Capabilities:
Encode data using xor

Disassembly:
shl dx, 0x6e
mov dword [esp + edx - 0x8000], edx
not eax
sar edx, cl
inc eax
pop edx
or edx, edx
add cx, dx
bswap eax
push edx
or dword [esp + edx*2 - 0x10000], edx
sbb eax, 0x9f2f903e
jmp 0x2157267

Function at 0x22d06ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, eax
sal ecx, 8
sar cl, 0x41
adc esi, eax
or ecx, esi
jmp ecx
not dx
pop edx
neg eax
sub ecx, ecx
mov edx, 0x8b16cfba
sbb eax, 0xcbbdc809
rol dx, 0xcb
jb 0x2263978

Function at 0x22dbe5c
Capabilities:
Encode data using xor

Disassembly:
shl dword [esp + 4], 0x21
test ecx, ecx
lea esp, [esp + 8]
je 0x212832a
push 0xae05738c
mov dword [esp], edi
movzx edi, byte [edx]
push 0xfc0ed78f
xor edi, eax
and edi, 0xff
mov edi, dword [edi*4 + 0x13b9978]
call fcn.0223cb7d
invalid
mov edx, 0x188b49aa
not eax
sal edx, 0xaf
call fcn.022f7556
test eax, 0xf11010bc
xor byte [ecx], cl
adc dword [ecx], ecx
mov esp, 0x30f11010
or dword [ecx], edx
or dword [esi - 0x7acf93fa], esp
popfd
mov dl, 0x5f
mov eax, dword [0x95d3e820]
jp 0x212835e
cmpsb byte [esi], byte es:[edi]
push es
insb byte es:[edi], dx
xor byte [ebp - 0x5ea04d63], al
and al, ch
rcl dword [ebp - 0x1619f286], cl
out 0xe9, al
xlatb
xchg ebx, eax
xor al, 0x7b
push ebp
pop ds
adc dword [ecx + 0x24], 0x2a1d7568
mov ds, word [ecx]
jae 0x212833a
sbb eax, 0x73198e2a
salc
fdivr qword [ebx]
ja 0x2128342
sar byte [esp + edi*2], cl
rcl dword [esi + 0x4d7ab432], cl
jle 0x21283c2
jns 0x2128351
aas
nop
sbb dword [esi + 0x48], edi
mov word [esi + 0x56], ss
ljmp 0x4dd9
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0x29c8e5a1]
inc edi
cmp byte [ecx + ecx*4 - 0x33], dh
jle 0x2128327
sub eax, 0x40027baf
or al, 0x5b
mov ch, 0xbe
xchg edi, eax
jns 0x21283b2
adc al, 0xde
fisub word [edi + 8]
test eax, 0x31f3e659
mov dword [ecx], esi
mov ch, 0x64
xchg byte [edi + 0x4c], ch
or byte [bx + di - 0x19a7], ch
xor dword [ecx - 0x799b4acf], ecx
outsd dx, dword [esi]
dec esp
adc esi, dword [edi]
jg 0x2128396
loopne 0x212839c
ret 0xee2b
xor eax, eax
jmp 0x1acc4c1
Function at 0x22e007f
Capabilities:
Encode data using xor

Disassembly:
call fcn.013cd5ff
sub eax, 0xec119e8b
ror eax, 3
mov dword [esp + 4], 0xd0cb1ad
xor ebx, eax
inc dword [esp + 6]
add esi, eax
lea esp, [esp + 0x10]
jmp 0x1a45991
Function at 0x4031be
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4151e4
call fcn.00414bc0
sub esp, 0x2a4
push ebx
push esi
push edi
push 3
call fcn.00402fe8
push 2
mov dword [0x41c268], eax
call fcn.00402fe8
push 5
mov dword [0x41c264], eax
call fcn.00402fe8
push 0x15
mov dword [0x41c260], eax
call fcn.00402fe8
push 0x16
mov dword [0x41c25c], eax
call fcn.00402fe8
push 0x17
mov dword [0x41c258], eax
call fcn.00402fe8
xor edi, edi
add esp, 0x18
mov dword [0x41c254], eax
mov dword [0x41c24c], edi
mov dword [0x41c250], edi
xor ebx, ebx
mov esi, 0x41c218
push edi
lea eax, [ebp - 0x2b0]
push ebx
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4032eb
push ebx
lea eax, [ebp - 0xa4]
push 0x41b9e0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.00403304
lea eax, [ebp - 0xa4]
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 4], edi
call fcn.0040154d
lea eax, [ebp - 0x2b0]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040154d
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00402d6b
mov edi, 0x41b93c
cmp dword [edi - 4], ebx
jne 0x4032c1
push dword [edi]
lea ecx, [ebp - 0x24]
call fcn.0040154d
lea eax, [ebp - 0x2b0]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040154d
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00402d6b
add edi, 8
cmp edi, 0x41b964
jb 0x403298
push dword [ebp - 0x18]
mov dword [ebp - 4], 1
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor edi, edi
pop ecx
inc ebx
cmp ebx, 0x40
jl 0x403231
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xa72fc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0xa7301b
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
sub dword [ebp + 8], 1
mov byte [edi - 1], dl
jne 0xa72fe0
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x402037
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [0x5873e5]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40206f
push 0x24
push 0x4024a88
push 6
call fcn.004eed57
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4020cc
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [0x5873e9]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4020ab
push 0x74
push 0x4024a88
push 6
call fcn.004eed57
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4020cc
pushal
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
rep movsb byte es:[edi], byte [esi]
popal
mov eax, dword [ebp + 0x10]
leave
ret 0xc
mov eax, 0
jmp 0x4020d6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406b0a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jle 0x406b3f
push dword [ebp + 8]
call fcn.00401ee1
mov dword [ebp - 0x10], eax
cmp word [ebp - 0x10], 0x5a4d
jne 0x406b3f
xor eax, eax
jmp 0x406b44
mov eax, 1
test eax, eax
je 0x406b56
mov eax, 0
jmp 0x406d1f
fild dword [ebp + 8]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x5626f0]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.00401495
push eax
call fcn.00401f41
mov dword [ebp - 0x18], eax
fild dword [ebp + 8]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild dword [ebp - 0x18]
fstp qword [ebp - 0x28]
fadd qword [ebp - 0x28]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
call fcn.00401495
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.00401f41
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x4550
jne 0x406c0f
fild dword [ebp - 4]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x562708]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00401495
push eax
call fcn.00401ee1
mov dword [ebp - 0x24], eax
push 0x80000301
push 0
push 0x2000
mov eax, dword [ebp - 0x24]
cwde
push 0x80000301
push 0
push eax
push 2
mov ebx, 0xc4
call fcn.004efa70
add esp, 0x1c
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x406c0f
xor eax, eax
jmp 0x406c14
mov eax, 1
test eax, eax
je 0x406c26
mov eax, 0
jmp 0x406d1f
fild dword [ebp - 4]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x562718]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.00401495
push eax
call fcn.00401f41
mov dword [ebp - 0x18], eax
fild dword [ebp + 8]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild dword [ebp - 0x18]
fstp qword [ebp - 0x28]
fadd qword [ebp - 0x28]
fstp qword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
mov dword [ebp - 0x54], 0
push 0
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0
push 0
push dword [ebp - 0x58]
mov dword [ebp - 0x5c], 0
push 0
push dword [ebp - 0x5c]
mov dword [ebp - 0x60], 0
push 0
push dword [ebp - 0x60]
push 1
push 0
push 1
push 0
push 1
push 0
fld qword [ebp - 0x30]
call fcn.00401495
push eax
call fcn.00402990
lea eax, [ebp + 8]
push eax
call fcn.004021c0
jmp 0x406d1f
mov esp, ebp
pop ebp
ret 4

Function at 0x412bc5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0x562691
push 0x562691
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x412c15
push 0
push 0x4014cd8
push 6
call fcn.004eed57
add esp, 0xc
mov esp, ebp
pop ebp
ret 4
Function at 0x4153b7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.004effd0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4153fc
push ebx
call fcn.004eed45
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415439
push 0x36
push 0x4014cf1
push 6
call fcn.004eed57
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x415455
push eax
mov ebx, eax
call fcn.0040106b
inc eax
push eax
call fcn.004eed3f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41545a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41546b
push ebx
call fcn.004eed45
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42aee9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov eax, 0x57cb15
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405f79
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x42af37
push ebx
call fcn.004eed45
add esp, 4
mov dword [ebp - 0x1c], esp
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42af44
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x42af6b
push 0x48
push 0x4024a86
push 6
call fcn.004eed57
add esp, 0xc
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x42af7e
push ebx
call fcn.004eed45
add esp, 4
mov eax, str.GetNativeSystemInfo
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00402974
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x42afa2
push ebx
call fcn.004eed45
add esp, 4
mov dword [ebp - 0x2c], esp
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x42afd1
push 0x6e
push 0x4024a86
push 6
call fcn.004eed57
add esp, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x42afe8
mov eax, 0
jmp 0x42b086
push 0x80000301
push 0
push 0x2c
push 1
mov ebx, 0x1bc
call fcn.004effa0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x42b01d
push ebx
call fcn.004eed45
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040146e
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42b059
push 0x128
push 0x4024a86
push 6
call fcn.004eed57
add esp, 0xc
push dword [ebp - 8]
call fcn.00401f41
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 6
je 0x42b07c
cmp dword [ebp - 0xc], 9
je 0x42b07c
xor eax, eax
jmp 0x42b081
mov eax, 1
jmp 0x42b086
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x42b097
push ebx
call fcn.004eed45
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x433242
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x433287
push 0x59
push 0x4024a8c
push 6
call fcn.004eed57
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004efa70
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4332ea
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004efa90
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x433318
push 0xfb
push 0x4024a8c
push 6
call fcn.004eed57
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004efa70
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43337b
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004efa90
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4333a9
push 0x19d
push 0x4024a8c
push 6
call fcn.004eed57
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004efa70
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43340c
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004efa90
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x433414
mov esp, ebp
pop ebp
ret

Function at 0x45ba36
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x20], 0
jne 0x45ba50
mov dword [ebp + 0x1c], 1
mov dword [ebp - 4], esp
push dword [ebp + 0x1c]
push 0x562691
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x45ba95
push 0x76
push 0x4024cc6
push 6
call fcn.004eed57
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
mov eax, 0
setg al
jmp 0x45baa9
mov esp, ebp
pop ebp
ret 0x1c