joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41d004]
jne 0x40100a
repz ret
jmp fcn.00401459

Function at 0x408155
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405748
and dword [ebp - 4], 0
cmp dword [0x41f258], 0
mov ebx, eax
jne 0x408206
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4082b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4082b7
push eax
call fcn.004056d6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41f258], eax
call esi
push eax
call fcn.004056d6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41f25c], eax
call esi
push eax
call fcn.004056d6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41f260], eax
call esi
push eax
call fcn.004056d6
pop ecx
mov dword [0x41f268], eax
test eax, eax
je 0x408206
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004056d6
pop ecx
mov dword [0x41f264], eax
mov eax, dword [0x41f264]
cmp eax, ebx
je 0x40825e
cmp dword [0x41f268], ebx
je 0x40825e
push eax
call fcn.00405751
push dword [0x41f268]
mov esi, eax
call fcn.00405751
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40825e
test edi, edi
je 0x40825e
call esi
test eax, eax
je 0x408255
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408255
test byte [ebp - 0xc], 1
jne 0x40825e
or dword [ebp + 0x10], 0x200000
jmp 0x408297
mov eax, dword [0x41f25c]
cmp eax, ebx
je 0x408297
push eax
call fcn.00405751
pop ecx
test eax, eax
je 0x408297
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408297
mov eax, dword [0x41f260]
cmp eax, ebx
je 0x408297
push eax
call fcn.00405751
pop ecx
test eax, eax
je 0x408297
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41f258]
call fcn.00405751
pop ecx
test eax, eax
je 0x4082b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4082b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4196d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp esi, 0x19f
jne 0x4196f9
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push edi
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor edx, edx
cmp esi, edi
jle 0x419719
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.004196d1
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edx
xor byte [eax], cl
inc edx
cmp edx, esi
jl 0x4196ff
pop edi
cmp esi, 0x2d
jne 0x419730
or dword [0x4a8664], 0xffffffff
mov dword [0x4a8660], 0xa62e7790
leave
ret
Function at 0x4019c5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x514295
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x401a8d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x514295
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50df70
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x401b33
cmp edi, dword [esi + 0x7c]
jge 0x401b33
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004163d7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004163d7
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x514295
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x514295
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x401a85
jmp 0x401a55
call fcn.0041a5fe
int3
Function at 0x418ac5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52b395
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x418b8d

Function at 0x418c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52b395
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x525070
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x418c33
cmp edi, dword [esi + 0x7c]
jge 0x418c33
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042d4d7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042d4d7
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52b395
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
or eax, 0x560e70
call 0x52b395
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x418b85
jmp 0x418b55
call fcn.004316fe
int3
Function at 0x4267bd
Capabilities:
Check http status code

Disassembly:
push ss
aas
daa
dec ebx
jg 0x4267ff
stosb byte es:[edi], al
xor eax, 0x3fe7d976
and esi, dword [edx + 0x23907108]
mov al, 0x17
mov ah, 0xa4
pop eax
loop 0x42678a
push edi
jne 0x426821
push ecx
inc edx
std
push ds
salc
mov ecx, 0x7543ab4
adc eax, 0xec9f7dd0

Function at 0x42d6fe
Capabilities:
Encode data using xor

Disassembly:
inc esp
and eax, 0x10648e05
call 0x38207b42
fnsave dword [edi]
fnsave dword [edi]
popal
jecxz 0x42d74b
mov ebp, 0xd0c6c6a6
adc esp, dword [edi + 0x73d2c53d]
push es
jae 0x42d715
lcall 0x2ae0, 0x77a74ea
mov eax, 0xbf822a94
sub bh, byte [eax - 0x407dd56c]
xchg edx, edx
dec eax
jecxz 0x42d6f4
xor ah, byte [esp + ecx*4 - 9]
imul eax, dword [esi + 0x33], 0x68
mov dword [0x89fc8644], eax
xchg ebx, eax
pop es
jecxz 0x42d70d
and eax, 0x9b0b41bf
pop edx
adc cl, byte [edi + 0x7ab293b3]
jle 0x42d793
test byte [ebp - 0x38b718ca], al
lodsb al, byte [esi]
add bl, dh
lea ebp, [edx + 0x1231baba]
mov edx, 0x297e1231
jle 0x42d779
dec edi
fadd qword [ecx + 0x311b2bab]
insd dword es:[edi], dx
lodsd eax, dword [esi]
pop edx
in al, 0x8d
jmp 0x42d7cc
div byte [ebx - 0x6899af8]
aad 4
cmp dh, byte [edi]
adc bl, byte [ebx*2 - 0x1b7175fa]
push 0x333350e7
pop ebp
push es
mov cl, byte [esi + 0x50e768e4]
xor esi, dword [ebx]
leave
test al, 0xf5
salc
shr bh, 1
jg 0x42d74e
mov cl, 0x81
mov edx, eax
sbb cl, dh
pop ds
inc edi
adc al, 0x9a
dec edx
pop ecx
mov esp, 0x1282fe3a
cmpsb byte [esi], byte es:[edi]
jno 0x42d7f7
test dword [ebx + ebp*2 + 0x77], ebp
sbb eax, 0xe95fc49a
dec ebp
and eax, 0xeacb7a65
mov dl, 0x77
or dword [eax + 0x737156e0], esi
neg bh
std
jmp 0x42d785
and byte [ecx - 0xc610d1e], ch
stc
int3
bnd retf

Function at 0x45d3f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38
Function at 0x4743f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00586cc5
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4744bd
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00586cc5
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005809a0
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x474563
cmp edi, dword [esi + 0x7c]
jge 0x474563
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00488e07
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00488e07
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586cc5
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586cc5
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4744b5
jmp 0x474485
call fcn.0048d02e
int3

Function at 0x486d12
Capabilities:
Encode data using xor

Disassembly:
jmp 0x3a4828d0
mov dh, 0xc7
dec esp
frndint
xchg edi, eax
push ebp
lodsd eax, dword [esi]
jecxz 0x486cc2
jae 0x486d31
popfd
wait
psllw mm6, qword [ecx - 0x3e9f09d5]
inc ecx
xchg dword [eax + 0x5c], ecx
cwde
adc al, 0xb8
inc edx
xchg ebx, eax
invalid

Function at 0x48bc75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
and al, 0x2c
Function at 0x48bc90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x2c
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059e545
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48bd3d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059e545
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00598220
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48bde3
cmp edi, dword [esi + 0x7c]
jge 0x48bde3
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004a0687
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004a0687
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059e545
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059e545
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48bd35
jmp 0x48bd05
call fcn.004a48ae
int3
Function at 0x4a2d55
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b5625
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a2e1d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b5625
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005af300
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js fcn.004a2ec3
cmp edi, dword [esi + 0x7c]
jge fcn.004a2ec3
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b7767
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b7767
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b5625
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b5625
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a2e15
jmp 0x4a2de5

Function at 0x4ac3af
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x4c777d76], eax
invalid
hlt
enter 0xffffffffffffe84d, 0xfffffffffffffff5
cmp esi, ebp
mov ah, byte [eax + edx*4 + 0x5c]
dec ebx
stosd dword es:[edi], eax
sub byte [ebp + 0x62], dl
hlt
xor al, 0xf0
adc esp, dword [esi]
or dh, byte es:[esi]
pop ebx
pop esp
jns 0x4ac368
loopne 0x4ac341
pop ss
xor dword [ebp + 0x1c], eax
xor dword [esi - 0x1f], ecx
push eax
dec esi
loope 0x4ac3ee
in eax, 0xc
jle 0x4ac419
push dword [ebx - 0x76]
or eax, 0xe3c45376
popal
jno 0x4ac36d
std
inc esp
sbb eax, 0x436bcfdd
lodsd eax, dword [esi]
mov al, byte [0x55caf59d]
pop ecx
cmc
dec ebp
jmp 0x4ac3d3
hlt
cmp dword [edx + 0x78d3710c], 0x12
and eax, 0xbb13add3
inc esi
cmc
cmp edi, dword [edx - 0x49]
jp 0x4ac39b
jno 0x4ac389
clc
and ah, al
imul esi, dword [ebx + 0x74], 0x25
repne movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
xor eax, 0xf6b48dfb
jge 0x4ac3e2
iretd
jmp 0x4ac3c2
Function at 0x4b94ea
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf5f8
push 0x4b936c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4c6db0], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4c6dac], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c6da8], ecx
shr eax, 0x10
mov dword [0x4c6da4], eax
push 1
call fcn.004ba55b
pop ecx
test eax, eax
jne 0x4b94af
push 0x1c
call fcn.004b9571
pop ecx
call fcn.004ba318
test eax, eax
jne 0x4b94c0
push 0x10
call fcn.004b9571
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004ba15c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c7474], eax
call fcn.004ba02a
mov dword [0x4c6d94], eax
call fcn.004b9ddd
call fcn.004b9d24
call fcn.004b9a34
inc esi
add eax, 0x75890000
ror byte [ebp - 0xaf5bbb], 1
adc eax, sym.imp.KERNEL32.dll_GetStartupInfoA
call fcn.004b9ccc
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b950f
movzx eax, word [ebp - 0x2c]
jmp 0x4b9512
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b9a61
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b9b54
pop ecx
pop ecx
ret

Function at 0x4ba5f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2410
cmp edx, dword [eax]
je 0x4ba613
add eax, 8
inc ecx
cmp eax, 0x4c24a0
jl 0x4ba604
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2410]
jne 0x4ba741
mov eax, dword [0x4c6d9c]
cmp eax, 1
je 0x4ba71b
test eax, eax
jne 0x4ba644
cmp dword [0x4c2338], 1
je 0x4ba71b
cmp edx, 0xfc
je 0x4ba741
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba67b
lea eax, [ebp - 0x1a4]
push 0x4bf960
push eax
call fcn.004bafd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb460
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba6be
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf95c
push edi
call fcn.004bd330
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf940
push eax
call fcn.004bafd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bafe0
lea eax, [ebp - 0xa0]
push 0x4bf93c
push eax
call fcn.004bafe0
push dword [esi + 0x4c2414]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bafe0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf914
push eax
call fcn.004bd2a4
add esp, 0x2c
pop edi
jmp 0x4ba741
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2414]
push 0
push eax
push dword [esi]
call fcn.004bb460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
nop
nop
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x801bc3
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret