joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456a70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x456aa8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x456a89
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x456a98
or bl, 4
test esi, 0x20000000
je 0x456aa3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45d0c4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45d0d6
add esp, 0xfffffff0
call fcn.00403b04
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423e84
mov eax, dword [0x49e840]
mov dword [eax + 4], ebx
mov dword [eax], 0x45d468
mov eax, dword [0x49e854]
mov dword [eax + 4], ebx
mov dword [eax], 0x45d474
mov eax, ebx
call fcn.0045d480
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4197e4]
call fcn.00403770
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4197e4]
call fcn.00403770
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4197e4]
call fcn.00403770
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4197e4]
call fcn.00403770
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4197e4]
call fcn.00403770
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x459948
push eax
push 0
push 0
mov eax, dword [0x49e9f4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4258bc]
call fcn.00426fd0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4258bc]
call fcn.00426fd0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4258bc]
call fcn.00426fd0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045d8a0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d77c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d77c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d77c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45d213
call fcn.00403b5c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45d560
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d70b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45d6ec
mov dl, 1
mov eax, dword [0x419cd4]
call fcn.00403770
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004045b4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45d6db
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044ab58
test al, al
je 0x45d6ce
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45d71c
lea eax, [ebp - 0x254]
call fcn.00409604
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45d6ce
xor eax, eax
push ebp
push 0x45d6c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45d754
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45d6b0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040481c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45d6b0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040481c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d6ce
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45d5d1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041df14
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d712
lea eax, [ebp - 0x260]
call fcn.004045b4
ret

Function at 0x45e040
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x49fc30]
cmp byte [eax + 0xa5], 0
jne 0x45e0b1
cmp dword [0x49fc48], 0
jne 0x45e072
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45dffc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49fc48], eax
cmp dword [0x49fc44], 0
jne 0x45e08d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x49fc44], eax
cmp dword [0x49fc4c], 0
jne 0x45e0b1
push esp
push 0
push 0
push 0x45dfa0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x49fc4c], eax
pop edx
ret
Function at 0x45e1a8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45e1bf
add esp, 0xfffffff0
call fcn.00403b04
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423e84
mov eax, dword [0x49e9e0]
cmp word [eax + 2], 0
jne 0x45e1e7
mov eax, dword [0x49e9e0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045f884
mov eax, dword [0x49eab4]
cmp word [eax + 2], 0
jne 0x45e201
mov eax, dword [0x49eab4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045fa7c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4197e4]
call fcn.00403770
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4197e4]
call fcn.00403770
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x42633c]
call fcn.0042de3c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45e388
mov eax, dword [0x49e8bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e20c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45ffec
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x49e8bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ce14
test eax, eax
je 0x45e2f6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408f4c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ce3c
test eax, eax
je 0x45e30a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040481c
mov eax, dword [0x49e73c]
cmp byte [eax], 0
jne 0x45e33e
mov eax, ebx
call fcn.0045e4b0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004601c8
mov eax, ebx
call fcn.00460b78
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45e37e
call fcn.00403b5c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e724
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x49fc30]
cmp dword [eax + 0x30], 0
je 0x45e7ce
cmp dword [ebx + 0x94], 0
jne 0x45e7c8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45e6b4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45e7c8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45e78e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45e7c8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bf50
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45e79d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45f2ac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45f2e1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004046a4
jmp 0x45f2ee
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404608
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4603a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4603e5
mov eax, esi
call fcn.00446250
test al, al
je 0x4603e5
mov eax, dword [ebx + 0x84]
call fcn.00445f4c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4603e5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445f4c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x463aec
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x463b1a
mov eax, ebx
call fcn.004645a4
cmp dword [ebx + 0x3c], 0
je 0x463b13
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x463b8b
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x463b7d
cmp dword [ebx + 8], 0
je 0x463b3c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x463b4e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x463b7d
cmp dword [ebx + 8], 0
je 0x463b2f
cmp eax, 3
je 0x463b61
dec eax
jne 0x463b2f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x463b2f
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x463b2f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x463ba9
cmp dword [ebx + 0x10], 0xcc
je 0x463ba9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00463bb4
pop ebx
ret
Function at 0x483708
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x221], 0
je 0x48372f
mov ecx, edi
mov dl, 1
mov eax, dword [0x4814b8]
call fcn.004825e8
mov dword [edi + 0x294], eax
jmp 0x483838
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x483770
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x483765
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.00482ca0
jmp 0x4837a6
xor edx, edx
mov eax, edi
call fcn.00482ca0
jmp 0x4837a6
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x48379d
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.00482ca0
jmp 0x4837a6
mov dl, 0x64
mov eax, edi
call fcn.00482ca0
cmp byte [edi + 0x22b], 0
je 0x4837b8
cmp byte [edi + 0x22a], 0
je 0x4837ca
cmp byte [edi + 0x22b], 0
jne 0x4837d5
cmp byte [edi + 0x22a], 0x64
jne 0x4837d5
mov bl, byte [edi + 0x223]
xor bl, 1
jmp 0x483805
mov eax, dword [0x49ea94]
mov eax, dword [eax]
call fcn.0045f5d8
call sub.kernel32.dll_GetTickCount
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x483805
cmp byte [edi + 0x223], 0
jne 0x483805
cmp byte [edi + 0x2a0], 0
je 0x4837d5
test bl, bl
jne 0x48381f
cmp byte [edi + 0x223], 0
jne 0x48381f
cmp byte [edi + 0x2a0], 0
je 0x483731
cmp byte [edi + 0x2a0], 0
jne 0x483831
cmp byte [edi + 0x223], 0
jne 0x483838
mov eax, edi
call fcn.00483aa8
pop edi
pop esi
pop ebx
ret
Function at 0x486060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x49fd34
test esi, esi
jne 0x48607a
xor eax, eax
jmp 0x48617c
cmp dword [ebp], 0
jne 0x486085
call fcn.00485ff0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x486155
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x486091
test edi, edi
jbe 0x486177
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x486159
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x13a6530
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x13a6553
mov eax, 1
jmp 0x13a665e
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x13a6569
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x13a6573
mov eax, 2
jmp 0x13a665e
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x13a659e
mov eax, 1
jmp 0x13a665e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x13a65c4
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x13a65c4
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x13a65ce
mov eax, 2
jmp 0x13a665e
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.013b8a10
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x13a660f
mov eax, 3
jmp 0x13a665e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x13a665c
mov eax, 1
jmp 0x13a665e
xor eax, eax
pop ebp
ret

Function at 0x13a7000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x13a7016
xor eax, eax
jmp 0x13a7056
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x13a703b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x13a703f
xor eax, eax
jmp 0x13a7056
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.013a7060
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x13b70d0
Capabilities:
Get steam token

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push 0x64000
nop
call 0x7561b100
add esp, 4
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x13c05bd
lea ecx, [ebp - 0x1c]
call fcn.013ba740
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x1fffff
call 0x480d80
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x13b7148
mov dword [ebp - 0x45c], 0x13c05be
lea ecx, [ebp - 0x1c]
call fcn.013ba800
mov eax, dword [ebp - 0x45c]
jmp 0x13b72df
mov edx, 1
test edx, edx
je 0x13b72ae
mov byte [ebp - 0x438], 0
push 0x207
push 0
lea eax, [ebp - 0x437]
push eax
call fcn.013baae0
add esp, 0xc
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0xfff
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x13c0ba8
mov edx, dword [ebp - 4]
push edx
call fcn.013b6f00
add esp, 0x20
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
add eax, 0x208
mov ecx, dword [ebp - 0x24]
adc ecx, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x24], 0
ja 0x13b71ca
jb 0x13b71c5
cmp dword [ebp - 0x28], 0
ja 0x13b71ca
jmp 0x13b72ae
cmp dword [ebp - 0x24], 0
ja 0x13b71d9
cmp dword [ebp - 0x28], 0xffff
jbe 0x13b71f5
push 0
push 0x208
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
push ecx
call 0x480e54
nop
lea edx, [ebp - 0x438]
push edx
lea ecx, [ebp - 0x1c]
call fcn.013ba820
lea ecx, [ebp - 0x1c]
call fcn.013baad0
push eax
call dword [fcn.015ea784]
cmp eax, 0x12c
jle 0x13b72a9
lea ecx, [ebp - 0x1c]
call fcn.013baad0
push eax
lea ecx, [ebp - 0x478]
call fcn.013b7320
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp - 0x454]
push ecx
call fcn.013b6b60
add esp, 8
lea ecx, [ebp - 0x478]
call fcn.013a8060
lea ecx, [ebp - 0x454]
call fcn.013b7380
movzx edx, al
test edx, edx
jne 0x13b729e
lea ecx, [ebp - 0x454]
call fcn.013b7360
cmp eax, 0xa
jbe 0x13b729e
lea ecx, [ebp - 0x1c]
call fcn.013baad0
mov dword [ebp - 0x47c], eax
lea ecx, [ebp - 0x454]
call fcn.013a8060
lea ecx, [ebp - 0x1c]
call fcn.013ba800
mov eax, dword [ebp - 0x47c]
jmp 0x13b72df
lea ecx, [ebp - 0x454]
call fcn.013a8060
jmp 0x13b7148
mov eax, dword [ebp - 8]
mov dword [ebp - 0x480], eax
mov ecx, dword [ebp - 0x480]
push ecx
nop
call 0x7561b0f3
add esp, 4
mov dword [ebp - 0x484], 0x13c05bf
lea ecx, [ebp - 0x1c]
call fcn.013ba800
mov eax, dword [ebp - 0x484]
mov esp, ebp
pop ebp
ret

Function at 0x13b9750
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x13b9780
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x13b9793
xor eax, eax
jmp 0x13b9851
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x13b97ae
xor eax, eax
jmp 0x13b9851
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x13b97cc
xor eax, eax
jmp 0x13b9851
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0x13b980e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0x13b984f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.013b8a30
add esp, 8
test eax, eax
jne 0x13b984d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x13b9851
jmp 0x13b9805
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40ea38
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40eb0d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40eb28
push ebx
push 0x40eb38
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40eab8
mov al, 0x6a
call fcn.0040e658
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040ea0c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40eac1
call fcn.0040ea0c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eb14
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ec28
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecf3
jmp 0x40ece7
cmp dword [esi + 0x10], 0x1000
jne 0x40ecd3
test byte [esi + 0x15], 1
jne 0x40ecd3
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40ec84
cmp ebp, 2
je 0x40ec84
cmp ebp, 0x10
je 0x40ec84
cmp ebp, 0x20
jne 0x40eca0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40eca0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ecb1
mov eax, dword [esi]
add eax, ebx
call fcn.0040ec20
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40eca4
cmp byte [esp + 4], 0
je 0x40ecd3
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecf3
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ec59
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5ee43b
Capabilities:
Encode data using xor

Disassembly:
pop ecx
scasb al, byte es:[edi]
std
inc esi
shr byte [esp + eax*4], 1
add ebp, ecx
clc
and al, 0xcb
invalid