joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a5a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
add eax, eax
mov dword [ebp + 0xc], eax
lea edx, [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047e7f8
shr dword [ebp + 0xc], 1
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00402c44
lea edx, [ebp - 0xc]
mov eax, ebx
mov ecx, dword [ebp + 0xc]
call fcn.00402998
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 8
call fcn.00402c44
lea edx, [ebp - 0x14]
mov eax, esi
mov ecx, dword [ebp + 0xc]
call fcn.00402998
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
push 0
lea edx, [ebp - 0xc]
mov ecx, 7
mov eax, dword [ebp - 4]
call fcn.00489ac4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
add eax, 0x80
push eax
push 1
lea edx, [ebp - 0xc]
mov ecx, 7
mov eax, dword [ebp - 4]
call fcn.00489ac4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
lea edx, [eax + 0x100]
lea eax, [ebp - 0x14]
mov ecx, 8
call fcn.00402998
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 8
call fcn.00402c44
mov edi, 8
lea esi, [ebp - 0xc]
mov bl, byte [ebp - 0x1c]
xor bl, byte [ebp - 0x1b]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x1b]
mov ecx, 7
call fcn.00402998
xor eax, eax
mov al, bl
mov al, byte [eax + 0x4d0348]
xor al, byte [esi]
mov byte [ebp - 0x15], al
inc esi
dec edi
jne 0x48a66d
mov edi, 8
lea esi, [ebp - 0x14]
mov bl, byte [ebp - 0x1c]
xor bl, byte [ebp - 0x1b]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x1b]
mov ecx, 7
call fcn.00402998
xor eax, eax
mov al, bl
mov al, byte [eax + 0x4d0348]
xor al, byte [esi]
mov byte [ebp - 0x15], al
inc esi
dec edi
jne 0x48a69e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
lea edx, [eax + 0x108]
lea eax, [ebp - 0x1c]
mov ecx, 8
call fcn.00402998
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48a738
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ecx, 0x4d0218
mov esi, 8
mov bl, byte [eax]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 4], bl
inc edx
mov bl, byte [eax + 1]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 5], bl
inc edx
mov bl, byte [eax + 2]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 6], bl
inc edx
mov bl, byte [eax + 3]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 7], bl
inc edx
mov bl, byte [eax + 4]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 1], bl
inc edx
mov bl, byte [eax + 5]
xor bl, byte [eax + 4]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 2], bl
mov bl, byte [eax + 6]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 3], bl
inc edx
mov bl, byte [eax + 7]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax], bl
inc edx
dec esi
jne 0x48a744
mov bl, byte [eax]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 4], bl
inc edx
mov bl, byte [eax + 1]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 5], bl
inc edx
mov bl, byte [eax + 2]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 6], bl
inc edx
mov bl, byte [eax + 3]
xor bl, byte [edx]
xor edx, edx
mov dl, bl
mov dl, byte [ecx + edx]
xor byte [eax + 7], dl
pop esi
pop ebx
ret
Function at 0x54982a
Capabilities:
Parse pe header

Disassembly:
jmp 0x57e2c2
lea esp, [esp + 4]
jmp fcn.0057e299

Function at 0x549851
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x57e2d0
lea esp, [esp + 4]
jmp fcn.0057e3f3

Function at 0x54c57c
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
jmp 0x54c5b4
jmp 0x54c598
lea esp, [esp + 4]
jmp 0x54c55f
jmp 0x54c5d0
jmp 0x54c5ec
push ebx
jmp 0x54c608
jmp 0x54c624
push ebp
jmp 0x54c640
jmp 0x54c65c
push esi
jmp 0x54c678
jmp 0x583727
push edi
movzx edx, byte [eax]
jmp 0x5839ba
shl edx, 8
movzx esi, byte [eax + 1]
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
jmp 0x583a40
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
jmp 0x583afd
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
jmp 0x583a21
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x555efc]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x555efc]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x555efc]
jmp 0x583b4f
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
jmp 0x583a90
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x555efc]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.0056ff66
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x555efc]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x555efc]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x555efc]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x555efc]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x557724
jne 0x583b84
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x54e6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x58610d
lea esp, [esp + 4]
jmp fcn.00585f17
Function at 0x5714f9
Capabilities:
Enumerate pe sections

Disassembly:
call fcn.0054982a
jmp 0x54984c
Function at 0x572b43
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x54e63c
jmp 0x54e6bb
Function at 0x5e2bd3
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
std
invalid
push eax
jmp 0x5dff33
call 0x5dff38
jmp 0x5dff9e
inc dword [eax + 0x545d19]
push 0xae1b5dad
add dword [esp], 0x52386331
push 0
push 0
push 0xa3d77c3f
add dword [esp], 0x5c7c43eb
call fcn.005532b6
jmp 0x5e2abd
call 0x5dff80
jmp 0x5e2b11
pop eax
sub eax, 0x5dff38
cmp dword [eax + 0x545d19], 0
je 0x5dff4f
lea esp, [esp + 8]
jmp 0x5e0002
popal
jmp 0x5df7f3
call 0x5e2ac2
jmp 0x5e2af4
add dword [esp], 0xffffdbd5
call fcn.0055106c
call fcn.00552687
popal
jmp 0x5df7f3
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x5e2b57
je 0x5e2b80
sub eax, 0x10000
jmp 0x5e2b15
movzx ebx, word [eax + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
je 0x5dff14
jmp 0x5e2b59
call 0x5e2bd3
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0x5e2c32
jb 0x5e2be5
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
lea esp, [esp + 4]
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x5dff7b
sub dword [eax + 0xfb04126], esi
rcr dword [ebp - 0x33], 0x94
int3
Function at 0x401790
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x40d000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
push esi
call fcn.004015f0
push esi
call fcn.004014c0
add esp, 8
xor ebx, ebx
push 0x100
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x54], ebx
call dword [eax + 0xa0]
mov edx, dword [esp + 0x14]
push edx
call fcn.00403fa5
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, eax
push edi
call ebp
push 0x4100c4
call ebp
push edi
call fcn.00403aa0
mov eax, dword [esi]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], ebx
push ecx
push esi
mov dword [esp + 0x18], ebx
mov word [esp + 0x3c], 9
mov word [esp + 0x2c], 3
call dword [eax + 0x5c]
test eax, eax
jl 0x401906
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x401906
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [edx + 0x20]
cmp eax, ebx
jl 0x4018fc
mov eax, dword [esp + 0x1c]
xor esi, esi
cmp eax, ebx
jle 0x4018fc
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x30], esi
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x1c]
test eax, eax
jne 0x4018ef
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x54]
push ecx
push 0x40e2c0
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl 0x4018ef
mov eax, dword [esp + 0x54]
push ecx
mov ecx, esp
cmp eax, ebx
mov dword [esp + 0x24], esp
mov dword [ecx], eax
je 0x4018ac
mov eax, dword [esp + 0x58]
push eax
mov edx, dword [eax]
call dword [edx + 4]
lea eax, [esp + 0x1c]
push eax
call fcn.00403350
add esp, 8
mov eax, dword [esp + 0x18]
mov byte [esp + 0x4c], 1
cmp eax, ebx
je 0x4018cf
push eax
call fcn.00401790
add esp, 4
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x54], ebx
cmp eax, ebx
mov byte [esp + 0x4c], bl
je 0x4018ef
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x40185e
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret
Function at 0x402520
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
jbe 0x402547
mov ecx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
lea ecx, [ecx + esi - 1]
mov dl, byte [eax + edi]
xor dl, 0x83
inc eax
mov byte [ecx], dl
dec ecx
cmp eax, esi
jb 0x402538
pop edi
pop esi
ret

Function at 0x402550
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
push 0x4101cc
push 0x68
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x40259e
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x108
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov edi, 0x4101bc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x80
and ecx, 3
push 2
rep movsb byte es:[edi], byte [esi]
push 0
push 0
lea ecx, [esp + 0x28]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4025ff
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x108
ret
push 0x100000
call fcn.00404255
mov edi, eax
push ebx
push ebp
push edi
call fcn.00402520
add esp, 0x10
lea edx, [esp + 0x10]
push 0
push edx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
xor eax, eax
pop edi
cmp ecx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 0x108
ret
Function at 0x402650
Capabilities:
Check if file exists
Create process on windows
Create thread
Read .ini file
Set current directory

Disassembly:
sub esp, 0x460
lea eax, [esp + 0x58]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push eax
push 0
call esi
lea ecx, [esp + 0x5c]
push 0x5c
push ecx
call fcn.00404670
add esp, 8
lea edx, [esp + 0x5c]
mov byte [eax], 0
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x160]
push eax
push 0x410188
push ecx
call fcn.004046cb
mov eax, dword [0x410050]
add esp, 0xc
lea edx, [esp + 0x160]
push edx
push eax
push 0x41017c
push 0x41017c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, dword [0x410050]
jle 0x4027a7
push 0x410198
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4027a7
mov ecx, dword [0x410050]
push edi
push ecx
lea edx, [esp + 0x26c]
push 0x410184
push edx
call fcn.004046cb
add esp, 0xc
lea eax, [esp + 0x164]
lea ecx, [esp + 0x268]
push eax
push ecx
push 0x41017c
push 0x41017c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.00402550
lea edx, [esp + 0x60]
push 0x104
push edx
push 0
call esi
lea eax, [esp + 0x60]
push 0x5c
push eax
call fcn.00404670
add esp, 8
inc eax
lea ecx, [esp + 0x368]
push eax
push 0x4101e8
push ecx
call fcn.004046cb
xor edx, edx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x14], edx
add esp, 0xc
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 8]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], edx
push eax
push ecx
push edx
push edx
push edx
push edx
push edx
mov dword [esp + 0x30], edx
push edx
lea edx, [esp + 0x388]
push edx
push 0
mov dword [esp + 0x44], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
xor eax, eax
pop esi
add esp, 0x460
ret
push 0x4101dc
call fcn.0040498b
push 0x4101d0
call fcn.0040498b
push 0x410198
call fcn.0040498b
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x402290
push 0
push 0
call fcn.00404828
add esp, 0x24
mov eax, 1
pop esi
add esp, 0x460
ret
Function at 0x402b70
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x414
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x31c]
mov dword [esp + 0xc], eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402bed
lea ecx, [esp + 0x114]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x402bed
lea edx, [esp + 0x31c]
push 0x104
lea eax, [esp + 0x118]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [esp + 0x218]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x218]
push 0x5c
push edx
call fcn.00404670
or ecx, 0xffffffff
lea edi, [esp + 0x11c]
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x41020c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x413310
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x410218
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [esp + 0x218]
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402cf1
test cl, cl
je 0x402ced
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402cf1
add eax, 2
add esi, 2
test cl, cl
jne 0x402ccd
xor eax, eax
jmp 0x402cf6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402d0f
lea eax, [esp + 0x10]
push 1
lea ecx, [esp + 0x21c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x413104
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x414
ret
Function at 0x4039d0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov esi, ecx
push ebp
push ebp
mov ecx, 0x40000
xor eax, eax
mov edi, esi
push ebp
push ebp
push 0x410240
rep stosd dword es:[edi], eax
mov byte [esp + 0x27], 0
mov dword [esi + 0x100000], ebp
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
cmp ebx, ebp
je 0x403a91
mov eax, dword [esp + 0x18]
push ebp
push 0x4000000
push ebp
push ebp
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
cmp edi, ebp
je 0x403a8a
mov eax, dword [esi + 0x100000]
mov dword [esp + 0x18], ebp
cmp eax, 0x100000
jae 0x403a7c
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esi + 0x100000]
mov edx, 0x100000
lea ecx, [esp + 0x18]
sub edx, eax
push ecx
add eax, esi
push edx
push eax
push edi
call ebp
test eax, eax
je 0x403a7c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403a77
mov ecx, dword [esi + 0x100000]
add ecx, eax
mov eax, ecx
mov dword [esi + 0x100000], ecx
cmp eax, 0x100000
jb 0x403a39
jmp 0x403a7c
mov byte [esp + 0x13], 1
push edi
mov byte [esi + 0xfffff], 0
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x403d90
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x403dc5
pop edi
xor al, al
pop esi
ret 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esi + 4]
push 0
push 0
push 0
push 2
push 0
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
jne 0x403df2
pop edi
xor al, al
pop esi
ret 4
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x403e0f
pop edi
xor al, al
pop esi
ret 4
push ebx
xor bl, bl
cmp word [eax], 0x5a4d
jne 0x403e62
mov edx, dword [eax + 0x3c]
cmp edx, edi
jae 0x403e62
cmp dword [edx + eax], 0x4550
jne 0x403e62
xor ecx, ecx
mov cx, word [edx + eax + 4]
cmp ecx, 0x14c
je 0x403e51
cmp ecx, 0x8664
jne 0x403e62
mov bl, 1
mov dword [esi + 0x10], 0x40
mov al, bl
pop ebx
pop edi
pop esi
ret 4
mov bl, 1
mov dword [esi + 0x10], 0x20
mov al, bl
pop ebx
pop edi
pop esi
ret 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov al, bl
pop ebx
pop edi
pop esi
ret 4

Function at 0x411200
Capabilities:
Log keystrokes via polling

Disassembly:
mov edx, dword [esp + 4]
push esi
cmp edx, 0x41
jb 0x41121a
cmp edx, 0x5a
ja 0x41121a
mov esi, dword [esp + 0x14]
lea eax, [edx + 0x20]
mov dword [esi], eax
jmp 0x411220
mov esi, dword [esp + 0x14]
mov dword [esi], edx
push edi
mov byte [esi + 4], 0
xor ecx, ecx
mov eax, 0x4a67a8
cmp edx, dword [eax]
je 0x41123d
add eax, 8
inc ecx
cmp eax, 0x4a6960
jb 0x41122c
jmp 0x411247
mov cl, byte [ecx*8 + 0x4a67ac]
mov byte [esi + 4], cl
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov byte [esi + 5], 0
call edi
test ah, 0x80
je 0x41125e
or byte [esi + 5], 1
push 0x11
call edi
test ah, 0x80
je 0x41126b
or byte [esi + 5], 8
push 0x12
call edi
test ah, 0x80
pop edi
je 0x411279
or byte [esi + 5], 2
pop esi
ret 0x10
Function at 0x414060
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x58
push esi
mov esi, ecx
push edi
mov ecx, 0x15
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0
test esi, esi
rep stosd dword es:[edi], eax
je 0x414145
mov eax, dword [esi + 0x20]
test eax, eax
je 0x414145
mov eax, dword [0x4ab174]
test eax, eax
jne 0x4140bc
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0xc]
push 0x8000
push 0x10
push 0x10
push 1
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [0x4ab174], eax
cmp dword [esp + 0x64], 0x80
jne 0x414145
mov ecx, dword [esi + 0x20]
mov edi, eax
lea eax, [esp + 0x20]
push 0x40
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 0x68]
mov eax, ecx
sub eax, 0
je 0x414106
dec eax
je 0x4140fc
dec eax
jne 0x414112
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
jmp 0x414112
mov dword [esp + 0x14], 4
jmp 0x41410e
mov dword [esp + 0x14], 7
mov dword [esp + 0x1c], edi
mov edx, dword [esi + 0x20]
lea eax, [esp + 8]
push eax
push ecx
mov dword [esp + 0x18], 0x80
mov dword [esp + 0x10], 0x58
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], 0xb89
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop edi
pop esi
add esp, 0x58
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x58
ret 8