joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5daa7d
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x5dabd1
cmp dword [ebp + 0xc], 0
jne 0x5dabd1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5daac4
sub eax, dword [ebp + 0x10]
js 0x5dabd1
je 0x5dabd1
cmp eax, dword [ebp + 0x14]
jl 0x5dabd1
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5dabd1
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5dabd1
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d2d2f]
pop edi
test eax, eax
je 0x5dabd1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x1249ee34]
push eax
call fcn.005d9ae5
pop edi
test eax, eax
je 0x5dabd1
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x1249ee38]
push eax
call fcn.005d9ae5
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5dabc4
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5dabd1
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5dabb1
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5dab7f
push dword [ebp + 8]
call fcn.005db973
jmp 0x5dabd8
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5daf63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5db052
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5db052
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5daffe
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5db052
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x1249ef94]
pop edi
pop ecx
test eax, eax
jne 0x5dafb7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5db004
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5db052
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5db052
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5db052
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5db052
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005daeac
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x7ffe544c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
pushf
popf
push es
pop ds
add al, 4
sub al, 4
cld
call 0x7ffe5462
pop edx
not eax
not eax
xor dx, dx
push es
pop ds
lea esp, [esp]
add edx, 0xd5e0
xor ecx, ecx
add al, 0
clc
mov cl, 0x1e
and al, 0xff
add al, 0
xor byte [ecx + edx], 0xff
loop 0x7ffe5480
push eax
pop eax
nop
push dword fs:[0x24]
add al, 0
pop dword [edx + 0xa]
stc
mov cl, 0xff
push edx
loop 0x7ffe5498
cld
mov dword [edx + 0x11], 0xffffacbb
xor eax, ecx
xor eax, ecx
mov ecx, dword [eax + 0x2c]
add al, 0
add al, 0
cld
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
push eax
pop eax
clc
mov dword [eax + 0x2c], esp
push 0
push eax
pop eax
nop
push 0
push 0
add al, 4
sub al, 4
nop
push 0
push 0x30
nop
push 0x20
push eax
pop eax
add al, 0
push 0
push eax
pop eax
clc
add al, 0
push 0
xor eax, ecx
xor eax, ecx
add edx, 0xffff7f33
cld
and al, 0xff
push edx
push eax
pop eax
push edx
cld
push 0
call dword [edx + 0x8210]
push eax
pop eax
clc
add esp, 0x3f8
push es
pop ds
xor eax, eax
stc
push es
pop ds
inc eax
ret 0xc
Function at 0x423aa4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419328
and dword [ebp - 4], 0
cmp dword [0x43879c], 0
mov ebx, eax
jne 0x423b55
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x423c06
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x423c06
push eax
call fcn.004192b6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43879c], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4387a0], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4387a4], eax
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387ac], eax
test eax, eax
je 0x423b55
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387a8], eax
mov eax, dword [0x4387a8]
cmp eax, ebx
je 0x423bad
cmp dword [0x4387ac], ebx
je 0x423bad
push eax
call fcn.00419331
push dword [0x4387ac]
mov esi, eax
call fcn.00419331
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423bad
test edi, edi
je 0x423bad
call esi
test eax, eax
je 0x423ba4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423ba4
test byte [ebp - 0xc], 1
jne 0x423bad
or dword [ebp + 0x10], 0x200000
jmp 0x423be6
mov eax, dword [0x4387a0]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x423be6
mov eax, dword [0x4387a4]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43879c]
call fcn.00419331
pop ecx
test eax, eax
je 0x423c06
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423c08
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x42977b66
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x70be36a7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x403a38
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x403a66
cmp al, 0xc
je 0x403a7d
cmp al, 0xd
je 0x403a8c
cmp al, 0xe
je 0x403aa8
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004026c8
cmp ecx, 1
mov eax, ebx
jg 0x403a74
call fcn.00403400
jmp 0x403abc
mov edx, ecx
call fcn.00403420
jmp 0x403abc
mov eax, ebx
add ebx, 0x10
call fcn.004047e0
dec edi
jg 0x403a7d
jmp 0x403abc
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [esi + ebp + 0xa]
call fcn.00403a38
dec edi
jg 0x403a8f
pop ebp
jmp 0x403abc
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00403a10
dec edi
jg 0x403aab
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403ac0
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00403a38

Function at 0x403d6c
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.004026c8
cmp eax, edx
je 0x403ddc
cmp word [eax], 8
jb 0x403d91
push eax
push edx
cmp word [eax], 0x100
je 0x403d87
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x403d8f
add eax, 8
call fcn.00403400
pop edx
pop eax
cmp word [edx], 8
jae 0x403da8
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
jne 0x403dc8
mov edx, dword [edx + 8]
or edx, edx
je 0x403dbf
mov ecx, dword [edx - 8]
inc ecx
jle 0x403dbf
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x403d30
ret

Function at 0x4044f4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov ebx, ecx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x4042d1
cmp eax, 0x100
jne 0x404323
mov eax, 8
cmp edx, 0x11
jbe 0x4042e3
cmp edx, 0x100
jne 0x404323
mov edx, 8
mov al, byte [eax + 0x49b01c]
mov dl, byte [edx + 0x49b01c]
movzx ecx, byte [edx + eax*8 + 0x49b030]
call dword [ecx*4 + 0x404302]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp 0x403d30
mov ecx, 0
jmp 0x4042a8

Function at 0x404500
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp 0x4042a8

Function at 0x406340
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040632c
add esp, 0x104
pop ebx
ret
Function at 0x44050c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
jmp 0x4403ce
pop edi
push esi
and esi, 0xe120
pop esi
push esi
xor esi, 0x130f9
jmp 0x4403e6
and esi, 0xdbf5
xor esi, 0xc8b2
pop esi
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push edx
push ebx
add esp, 4
add edx, 0x17ef6
add edx, 0xbd9e
call fcn.0044046a
add byte [esp + edi + 0x49], cl
xor eax, dword [edx + esi + 0x49]
cmp esi, dword [0x8104c483]
add esp, 4
invalid
retf 0x19e0
add esp, 4
or edx, 0x119e0
pop edx
push edx
add edx, 0x30b8
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x440499
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x4404f3
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4403c1
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4403c1
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4404dd
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x4404e7
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x44053c
push esi
call 0x44050c
add byte [edi], bh
cmp eax, dword [esi + 0x3b]
dec ebx
cmp dword [eax + 0x47], edx
cmp eax, 0x8104c483
out 0x2b, al
je 0x440514
add byte [ecx + 0x84c7ee], al
add byte [ecx + 0xc4aff6], al
add byte [esi + 0x56], bl
push eax
add esp, 4
or esi, 0xe160
pop esi
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x4405a4
push ebx
xor ebx, 0x1339f
and ebx, 0x74ee
call 0x440558
add byte [ebx], dh
push eax
dec ebx
xor ecx, dword [eax + 0x44]
cmp byte [edi], bh
dec edx
add esp, 4
call 0x44056a
add byte [0x3f323f32], bh
dec ecx
xor eax, 0xc4834032
add al, 0x5b
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x44059a
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x440365
mov dword [ebp - 0x2e0], 0
Function at 0x44056a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
jmp 0x4403ce
pop edi
push esi
and esi, 0xe120
pop esi
push esi
xor esi, 0x130f9
jmp 0x4403e6
and esi, 0xdbf5
xor esi, 0xc8b2
pop esi
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push edx
push ebx
add esp, 4
add edx, 0x17ef6
add edx, 0xbd9e
call fcn.0044046a
add byte [esp + edi + 0x49], cl
xor eax, dword [edx + esi + 0x49]
cmp esi, dword [0x8104c483]
add esp, 4
invalid
retf 0x19e0
add esp, 4
or edx, 0x119e0
pop edx
push edx
add edx, 0x30b8
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x440499
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x4404f3
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4403c1
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4403c1
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4404dd
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x4404e7
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x44053c
push esi
call 0x44050c
add byte [edi], bh
cmp eax, dword [esi + 0x3b]
dec ebx
cmp dword [eax + 0x47], edx
cmp eax, 0x8104c483
out 0x2b, al
je 0x440514
add byte [ecx + 0x84c7ee], al
add byte [ecx + 0xc4aff6], al
add byte [esi + 0x56], bl
push eax
add esp, 4
or esi, 0xe160
pop esi
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x4405a4
push ebx
xor ebx, 0x1339f
and ebx, 0x74ee
call 0x440558
add byte [ebx], dh
push eax
dec ebx
xor ecx, dword [eax + 0x44]
cmp byte [edi], bh
dec edx
add esp, 4
call 0x44056a
add byte [0x3f323f32], bh
dec ecx
xor eax, 0xc4834032
add al, 0x5b
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x44059a
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x440365
mov dword [ebp - 0x2e0], 0
Function at 0x441aa3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x441a91
add byte [ecx], bh
dec esp
xor al, 0x4d
aaa
cmp al, 0x83
les eax, [eax + ebp*8]
or al, byte [eax]
add byte [eax], al
add byte [edi + 0x3c], al
push eax
inc esp
inc ebp
cmp edi, dword [ebx]
inc ebx
add esp, 4
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x441ad3
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x44189e
mov dword [ebp - 0x2a8], 0

Function at 0x4519d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebp
xchg bh, al
pop es
out dx, al
or byte [edx + 0x52], al
push eax
cmp cl, byte [eax - 0x15]
or eax, 0x3030303
dec ecx
cmp al, byte [ecx + 0x35]
inc esp
cmp bh, byte [0xc7864c4d]
pop es
pop ebp
pop ecx
push esi
xchg bh, al
pop es
out dx, al
or byte [esi], dh
inc ecx
aaa
push ebx
inc eax
out dx, al
pop es
dec edx
xor eax, 0x8e614e4f
cwde
jg 0x451a02
add al, byte [edx]
imul ecx, dword [esi - 0x777396fb], 0x202f73d
mov ss, word [eax + 0x202f47f]
xchg ah, al
add eax, 0xf47f908c
add al, byte [edx]
imul ecx, dword [esi + 0x2f73d98], 0x988c6902
push ebx
add dword [edx], eax
add cl, byte [esi + 0x2f47b88]
add ch, byte [ecx - 0x72]
or ebp, dword [ecx - 0x74]
nop
invalid
Function at 0x479934
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4799ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x4792c8
call fcn.00479a20
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4799d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x479a18
call fcn.00407d44
mov edx, dword [ebp - 8]
mov eax, dword [reloc.user32.dll_MessageBeep]
call fcn.00424714
call fcn.004792d8
call sub.user32.dll_GetFocus
mov edx, dword [reloc.user32.dll_MessageBeep]
cmp eax, dword [edx + 0x20]
jne 0x4799bb
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4799c2
call sub.user32.dll_WaitMessage
jmp 0x47999a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4799df
mov eax, dword [ebp - 4]
call fcn.00402b58
ret

Function at 0x48483c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x484868
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x484871
call fcn.00483894
mov eax, 0xa
call fcn.0042f0c4
call fcn.00483894
call fcn.00484808
test al, al
jne 0x484846
pop ebx
ret

Function at 0x484d28
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x49e0ac], 0
je 0x484dbf
mov eax, dword [0x49e0ac]
call fcn.004187c8
test al, al
je 0x484dbf
mov eax, dword [0x49e0ac]
cmp byte [eax + 0xc7], 0
je 0x484d6f
cmp byte [ebx + 0x1b9], 0
jne 0x484d6f
mov eax, dword [reloc.user32.dll_MessageBeep]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x484d73
xor eax, eax
jmp 0x484d75
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x49e0ac]
call fcn.00418630
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0x10000000
setne al
cmp bl, al
je 0x484dbf
test bl, bl
je 0x484dad
push 5
mov eax, dword [0x49e0ac]
call fcn.00418630
push eax
call sub.user32.dll_ShowWindow
jmp 0x484dbf
push 0
mov eax, dword [0x49e0ac]
call fcn.00418630
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x499644
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4998a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4998c0
mov eax, dword [reloc.user32.dll_MessageBeep]
call fcn.00424714
push 5
mov eax, dword [reloc.user32.dll_MessageBeep]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x499875
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00480610
lea eax, [ebp - 0x10]
call fcn.0042dd14
mov eax, dword [ebp - 0x10]
call fcn.004076f8
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0042d89c
mov edx, dword [ebp - 0x10]
mov eax, 0x49e540
call fcn.00403450
call fcn.00497f30
lea ecx, [ebp - 0x10]
mov edx, 0x4998d4
mov eax, dword [0x49e540]
call fcn.0042c948
mov edx, dword [ebp - 0x10]
mov eax, 0x49e544
call fcn.00403450
lea ecx, [ebp - 0x10]
mov edx, 0x4998e4
mov eax, dword [0x49e540]
call fcn.0042c948
mov edx, dword [ebp - 0x10]
mov eax, 0x49e548
call fcn.00403450
push 2
push 0
push 1
mov ecx, dword [0x49e540]
mov dl, 1
mov eax, 0x450c14
call fcn.00450e70
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49978c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x18]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.00450e34
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.00450e0c
cmp dword [ebp - 0xc], 0x67734d49
je 0x499767
mov cl, 1
xor edx, edx
mov eax, dword [0x49e548]
call fcn.00451cf4
jmp 0x499776
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x49e540]
call fcn.00451cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499793
mov eax, dword [ebp - 4]
call fcn.00402b58
ret
Function at 0x5f84e3
Capabilities:
Encode data using xor

Disassembly:
adc byte [edi], cl
mov dh, 0xa0
mov ebx, 0xd3f73ead
cmp eax, dword [edx - 0x69fab032]
xchg edx, eax
add ebp, dword [ebx + 0x624ac476]
mov bl, 0xa2
mov esi, 0x360e427b
dec edx
rcl byte [esi + 0x3701efcd]
pop ds
salc
xchg ebp, eax
xor eax, 0xc7a84bdd
push esi
dec esp
push esp
clc
add dword [ebx], 0xd6022f8d
das
add dl, dh
das
add dl, dh
test al, 0x51
sub dword ss:[edi + 0x5e], 0xffffff84
sub esi, 0xeeb7f378
dec eax
les edi, [esi - 0xf]
loope 0x5f84e4
bound ebp, qword [esi]
jae 0x5f84ae
scasd eax, dword es:[edi]
pop edi
push es
adc dl, byte [eax]
mov dword [0xba510ae7], eax
ffree st(6)
imul edi, dword [eax], 0x1f
cmpsb byte [esi], byte es:[edi]
out dx, al
sal byte [ebx - 0x48], cl
in al, 0xa0
xor al, 0x99
or eax, 0xa7a5562a
out 0x5e, al
invalid