joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003bc2
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.10005d80
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.10011d0e
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.10011d0e
push 0x10021be8
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.10011d0e
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.10005d80
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003c67
sub ecx, edx
cmp ecx, 6
jbe 0x10003c8e
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.10011d0e
pop ecx
pop ecx
test eax, eax
jne 0x10003c8e
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003c95
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10020533
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.10011d0e
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.10005800
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003d0f
mov ax, word [0x10021c14]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x824
ret
Function at 0x10011d0e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10011d1d
pop dword [ebp - 0x38]
mov eax, 0x21fbb5d4
sub eax, 0x11fa98b7
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x4c077ac2
add dword [ebp - 0x48], 0x24aca89
mov dword [ebp - 0x44], 0x411a54d5
add dword [ebp - 0x44], 0xf118f770
mov dword [ebp - 0x40], 0xb64ae967
sub dword [ebp - 0x40], 0x69fea539
mov dword [ebp - 0x3c], 0x4b194883
sub dword [ebp - 0x3c], 0x4b194883
lea eax, [ebp - 0x48]
push eax
mov eax, 0x4f8eaa00
sub eax, 0x3f8cc980
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xe573037
add dword [ebp - 0x48], 0x661b391f
mov dword [ebp - 0x44], 0x8433f06b
add dword [ebp - 0x44], 0xbd38710a
mov dword [ebp - 0x40], 0x1f3d07dc
sub dword [ebp - 0x40], 0xbbcd9b70
mov dword [ebp - 0x3c], 0xb6a3553e
sub dword [ebp - 0x3c], 0xb6a3553e
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x3dc4eb24
sub eax, 0x2dc30aa0
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x4091f
push 0
call eax
mov ecx, 0x5508
xor esi, esi
add esi, eax
mov edx, 0x10035800
add edx, dword [ebp - 0x38]
mov ebx, 0x81a12e3
mov edi, dword [edx]
xor dword [ebp - 0x2c], ebx
add edi, ebx
sub dword [ebp - 0xc], 0x7745089e
mov dword [esi], edi
add dword [ebp - 0x2c], 0x213a81d4
add esi, 0xa3348edc
add esi, 0x5ccb7128
add edx, 4
loop 0x10011e2f
add eax, 0x4229c103
add eax, 0xbdd785f0
mov ebx, eax
add eax, 0x8bda206c
add eax, 0x7425df99
mov ecx, 0x23be8dfd
sub ecx, 0x13be8dfd
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x415f0d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45fdc1
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x474114]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
lea eax, [esi + 0x64]
push eax
mov dword [esp + 0x18], eax
call dword [0x461254]
mov ebx, dword [ebp + 8]
push ebx
lea eax, [esp + 0x34]
add esi, 0x14
push eax
push esi
mov dword [esp + 0x28], esi
call 0x10b46087
mov eax, dword [esi + 4]
mov dword [esp + 0x24], esi
lea edi, [esp + 0x24]
lea esi, [esp + 0x30]
mov dword [esp + 0x28], eax
call 0x7fda5f9f
test al, al
je 0x4160fb
mov eax, dword [ebx]
mov cx, word [ebx + 4]
mov ebx, dword [ebx + 8]
mov esi, dword [ebp + 0xc]
push 5
mov dword [esp + 0x40], eax
mov word [esp + 0x44], cx
pop ecx
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x20]
mov dword [esp + 0x4c], ebx
lea edi, [esp + 0x50]
lea ebx, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
call 0xc5b060db
push dword [esp + 0x14]
call dword [0x461250]
mov esi, dword [esp + 0x20]
lea eax, [esi + 0x94]
push eax
mov dword [esp + 0x20], eax
call dword [0x461254]
push dword [ebp + 0xc]
lea eax, [esp + 0x18]
lea edi, [esi + 0x20]
push eax
mov dword [esp + 0x28], edi
call 0xb2b7610e
mov esi, dword [edi + 4]
xor ebx, ebx
cmp dword [esp + 0x14], ebx
je 0x415ffe
cmp dword [esp + 0x14], edi
je 0x416003
call 0xdf286324
cmp dword [esp + 0x18], esi
jne 0x4160d5
call 0xad06133
mov dword [esp + 0x34], eax
mov byte [eax + 0x19], 1
mov eax, dword [esp + 0x34]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x34]
mov dword [eax], eax
mov eax, dword [esp + 0x34]
mov dword [eax + 8], eax
mov dword [esp + 0x38], ebx
push dword [ebp + 8]
mov dword [esp + 0x8c], ebx
lea ebx, [esp + 0x28]
lea eax, [esp + 0x34]
call 0x9ba616a
mov esi, dword [ebp + 0xc]
push 5
pop ecx
lea edi, [esp + 0x3c]
lea eax, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x34]
call 0x77b96184
push 5
pop ecx
mov byte [esp + 0x88], 1
lea esi, [esp + 0x3c]
lea edi, [esp + 0x5c]
lea eax, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x54]
call 0x77b961a7
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x5c]
push eax
lea edi, [esp + 0x28]
mov byte [esp + 0x8c], 2
call 0x77b461c1
lea esi, [esp + 0x70]
mov byte [esp + 0x88], 1
call 0xecc561d2
lea esi, [esp + 0x50]
mov byte [esp + 0x88], 0
call 0xecc561e3
or dword [esp + 0x88], 0xffffffff
lea esi, [esp + 0x30]
call 0xecc561f4
jmp 0x4160ed
lea esi, [esp + 0x14]
call 0x57b961ff
push dword [ebp + 8]
add eax, 0x14
lea ebx, [esp + 0x34]
call 0x9ba620e
push dword [esp + 0x1c]
call dword [0x461250]
mov al, 1
jmp 0x416115
push str.InsertKeyHash_already_exist___n
push 5
pop esi
call 0x31b36129
pop ecx
push dword [esp + 0x14]
call dword [0x461250]
xor al, al
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x421c56
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4601bd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x474114]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0x10]
push eax
mov dword [esp + 0x14], eax
call dword [0x461254]
and dword [esp + 0x30], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax]
add ebx, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [ebx + 4]
lea edi, [esp + 0x1c]
lea esi, [esp + 0x14]
mov dword [esp + 0x20], eax
call 0x7fdb1ce0
test al, al
jne 0x421d1d
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x421cd0
call 0xdf291ff1
mov esi, dword [esp + 0x18]
cmp esi, dword [edi + 4]
jne 0x421cde
call 0xdf291fff
mov esi, dword [esi + 0x20]
mov al, byte [esi + 0x6d]
cmp al, 4
je 0x421cff
cmp al, 3
je 0x421cff
cmp al, 2
je 0x421cf4
cmp al, 1
jne 0x421d12
mov eax, esi
call 0x4d611d1c
test al, al
je 0x421d12
call 0x44af1d25
mov edx, dword [eax]
add esi, 0x51
push esi
mov ecx, eax
call dword [edx + 0x88]
lea esi, [esp + 0x14]
call 0x3d771f3c
jmp 0x421cab
push dword [esp + 0x10]
call dword [0x461250]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x77ba4057
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, edx
push esi
test eax, eax
push edi
je 0x77ba410b
cmp dword [0x77ba4a9c], 0
jne 0x77ba4107
mov ecx, 0x40000
mov dword [0x77ba4a9c], 1
call fcn.77ba489e
test eax, eax
mov dword [0x77ba4aa0], eax
je 0x77ba4107
mov esi, 0x50ea
mov ecx, esi
call fcn.77ba489e
mov edi, eax
test edi, edi
je 0x77ba4107
push esi
push 0
push edi
call sub.MSVCRT.dll_memset
mov ecx, 0x77ba10d0
add esp, 0xc
mov eax, edi
sub ecx, edi
mov esi, 0x2875
mov dl, byte [ecx + eax]
xor dl, 0xba
mov byte [eax], dl
inc eax
dec esi
jne 0x77ba40be
mov esi, dword [0x77ba4aa0]
lea eax, [ebp - 8]
push eax
mov edx, esi
mov ecx, edi
call fcn.77ba3d9c
test eax, eax
jne 0x77ba40ea
mov ecx, esi
call fcn.77ba48af
jmp 0x77ba4107
mov ecx, edi
call fcn.77ba48af
lea edx, [ebp - 4]
mov ecx, esi
call fcn.77ba3f09
mov eax, dword [ebp - 4]
push 0
push 1
push esi
add eax, esi
call eax
xor eax, eax
jmp 0x77ba4122
mov eax, dword [0x77ba4aa0]
test eax, eax
je 0x77ba411f
mov edx, ecx
mov ecx, eax
call fcn.77ba3f96
jmp 0x77ba4122
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x77ba4285
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
push 0xf01ff
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x77ba42b7
lea eax, [esp + 4]
push edi
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x77ba489e
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret

Function at 0x109ec4b4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x109ec4be
pushal
call 0x109ec4c4
pop ebp
sub ebp, 0x10
sub ebp, 0x9ec4b4
mov al, byte [esp + 0x28]
cmp al, 1
je 0x109ec4e8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x109ec4f1
mov eax, 0x9ec4b4
add eax, ebp
add eax, 0x63
mov ecx, 0x5d2
mov edx, 0x2c122523
xor byte [eax], dl
inc eax
dec ecx
jne 0x109ec508
jmp 0x109ec51b
test al, 0xee
test al, 0xaa
stosb byte es:[edi], al
pop ds
and esp, dword [ebx]
and esp, dword [edx + 0x2323dbe2]
and esp, dword [eax]
out dx, al
wait
and al, 0x23
and esp, dword [ebx]
cdq
or esp, dword [ebx]
and esp, dword [ebx]
aam 0xc1
and bl, ch
test al, 0xa2
das
and esp, dword [ebx]
and esp, dword [eax]
out 0x73, al
scasb al, byte es:[edi]
inc edi
pop es
fild qword [edx + 0x474b0727]
add byte [edx], 0x23
dec ebx
insb byte es:[edi], dx
add byte [esi + 0x23], bl
and cl, byte [edi]
pop es
dec ebx
push ebp
insd dword es:[edi], dx
ja 0x109ec51e
retf
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.004047b5
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.004047b5
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.004047b5
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.004047b5
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.004047b5
mov dword [0x41203c], eax
call fcn.004047b5
test eax, eax
jge 0x402550
push 8
call fcn.004047b5
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.004047b5
pop ecx
push 1
call fcn.004047b5
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.004047b5
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.004047b5
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.004047b5
jmp 0x402495

Function at 0x4047b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4047c4
pop dword [ebp - 8]
mov eax, 0x525f3d3d
sub eax, 0x521ef579
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3983c
push 0
mov eax, 0x5e14c151
add eax, 0xa22c1f87
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xaa2025b
sub ecx, 0xaa1b92e
mov edi, eax
mov ebx, 0x7299d15a
sub ebx, 0x72589596
add ebx, dword [ebp - 8]
mov edx, 0xea558a8b
sub dword [ebp - 4], edx
mov esi, dword [ebx]
sub dword [ebp - 4], 0x31f2a052
xor esi, edx
xor dword [ebp - 4], 0x697cf8de
mov dword [edi], esi
add dword [ebp - 4], 0x4cd68aa7
add edi, 0xd4b827ab
sub edi, 0xd4b827a7
add ebx, 0x2763f829
sub ebx, 0x2763f825
loop 0x40481d
add eax, 0x11787
xor ebx, ebx
add ebx, eax
add eax, 0xfcd7b255
add eax, 0x3284db0
mov ecx, 0xeb4e1009
sub ecx, 0xeb0e1009
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401443
pop dword [ebp - 0x44]
mov eax, 0x8f1e0095
add eax, 0x712213ae
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xe739e344
sub dword [ebp - 0x54], 0x98e79df9
mov dword [ebp - 0x50], 0xb0a059d8
sub dword [ebp - 0x50], 0x7e6d0d93
mov dword [ebp - 0x4c], 0xf40bedd4
add dword [ebp - 0x4c], 0x5840565a
mov dword [ebp - 0x48], 0x246f6dbc
sub dword [ebp - 0x48], 0x246f6dbc
lea eax, [ebp - 0x54]
push eax
mov eax, 0xd13aa5d1
sub eax, 0xd0fa24cd
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xd7034cbb
add dword [ebp - 0x54], 0x9d6f1c9b
mov dword [ebp - 0x50], 0x1d72dba
sub dword [ebp - 0x50], 0xc06acc45
mov dword [ebp - 0x4c], 0xb6fb1f49
sub dword [ebp - 0x4c], 0x538bb2dd
mov dword [ebp - 0x48], 0xd528ea24
sub dword [ebp - 0x48], 0xd528ea24
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x33bda
push 0
call eax
mov ecx, 0x80c2b24b
add ecx, 0x7f3d8382
xor edi, edi
add edi, eax
mov esi, 0x349fc6dc
sub esi, 0x3458e2dc
add esi, dword [ebp - 0x44]
mov ebx, 0x25da3af0
sub ebx, 0xf5776c7a
mov edx, dword [esi]
xor dword [ebp - 0xc], 0x351277a2
xor edx, ebx
xor dword [ebp - 0x38], edx
mov dword [edi], edx
xor dword [ebp - 0x28], 0xfc1cd521
add edi, 0xad714421
add edi, 0x528ebbe3
add esi, 0x93df3282
add esi, 0x6c20cd82
loop 0x401562
add eax, 0xca07
mov ebx, eax
add eax, 0x6ad8c210
sub eax, 0x6ad8c20b
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x4bd180
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
mov ecx, 9
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x6e002d
call fcn.004afaed
call fcn.004bb420
mov dword [ebp - 8], eax
mov esi, esp
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp esi, esp
call fcn.004ae9bd
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x20], ecx
mov esi, esp
push 4
mov eax, dword [ebp - 8]
add eax, 0x24
push eax
push 0x20001004
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp esi, esp
call fcn.004ae9bd
test eax, eax
jne 0x4bd201
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.004ae9bd
mov esp, ebp
pop ebp
ret

Function at 0x4bedd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
lea edi, [ebp - 4]
mov ecx, 1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x6e002d
call fcn.004afaed
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.004ae9bd
movsx ecx, ax
and ecx, 0x8000
je 0x4bee1f
mov dword [ebp - 0xc4], 1
jmp 0x4bee29
mov dword [ebp - 0xc4], 0
mov al, byte [ebp - 0xc4]
pop edi
pop esi
pop ebx
add esp, 0xc4
cmp ebp, esp
call fcn.004ae9bd
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b01c]
jne 0x40100a
repz ret
jmp fcn.00401ab1

Function at 0x404c21
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44b01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004026ad
and dword [ebp - 0x14], 0
cmp dword [0x44da8c], 0
mov dword [ebp - 0x18], eax
jne 0x404cd4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404d7c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404d7c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44da8c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44da90], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44da94], eax
call edi
push eax
call esi
mov dword [0x44da9c], eax
test eax, eax
je 0x404cd4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44da98], eax
mov eax, dword [0x44da98]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404d2d
cmp dword [0x44da9c], ecx
je 0x404d2d
push eax
call esi
push dword [0x44da9c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404d2d
test ebx, ebx
je 0x404d2d
call edi
test eax, eax
je 0x404d24
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404d24
test byte [ebp - 8], 1
jne 0x404d2d
or dword [ebp + 0x10], 0x200000
jmp 0x404d60
mov eax, dword [0x44da90]
cmp eax, dword [ebp - 0x18]
je 0x404d60
push eax
call esi
test eax, eax
je 0x404d60
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404d60
mov eax, dword [0x44da94]
cmp eax, dword [ebp - 0x18]
je 0x404d60
push eax
call esi
test eax, eax
je 0x404d60
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44da8c]
call esi
test eax, eax
je 0x404d7c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404d7e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x10008245
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10008254
pop dword [ebp - 0x38]
mov eax, 0xf4d92939
sub eax, 0xe4d8a6e5
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xefa4c7c
add dword [ebp - 0x48], 0x3f57f8cf
mov dword [ebp - 0x44], 0x189be7c5
sub dword [ebp - 0x44], 0xe6689b80
mov dword [ebp - 0x40], 0xa4ba49ab
add dword [ebp - 0x40], 0xa791fa83
mov dword [ebp - 0x3c], 0xae03fcae
sub dword [ebp - 0x3c], 0xae03fcae
lea eax, [ebp - 0x48]
push eax
mov eax, 0x3d7e513
sub eax, 0xf3d6450b
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x3448d9ff
sub dword [ebp - 0x48], 0xbfd670a9
mov dword [ebp - 0x44], 0xa0a9b652
sub dword [ebp - 0x44], 0x5f3d54dd
mov dword [ebp - 0x40], 0x6a6b20e4
sub dword [ebp - 0x40], 0x6fbb478
mov dword [ebp - 0x3c], 0xcf2c82c6
add dword [ebp - 0x3c], 0x30d37d3a
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x359d5
push 0
call eax
mov ecx, 0x354a
mov edi, eax
mov ebx, 0x4b80f2be
add ebx, 0xc4815742
add ebx, dword [ebp - 0x38]
mov edx, 0x537baafc
add edx, 0x900b04fb
mov esi, dword [ebx]
add dword [ebp - 0x20], edi
sub esi, edx
xor dword [ebp - 0x1c], eax
mov dword [edi], esi
add edi, 0xd254436c
add edi, 0x2dabbc98
add ebx, 4
loop 0x1000836b
add eax, 0xe8fb5227
sub eax, 0xe8fa8a2c
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80c004]
jne 0x40100a
repz ret
jmp fcn.00401587

Function at 0x40444b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x80c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00401e3b
and dword [ebp - 0x14], 0
cmp dword [0x80e8c8], 0
mov dword [ebp - 0x18], eax
jne 0x4044fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4045a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4045a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x80e8c8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x80e8cc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x80e8d0], eax
call edi
push eax
call esi
mov dword [0x80e8d8], eax
test eax, eax
je 0x4044fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x80e8d4], eax
mov eax, dword [0x80e8d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404557
cmp dword [0x80e8d8], ecx
je 0x404557
push eax
call esi
push dword [0x80e8d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404557
test ebx, ebx
je 0x404557
call edi
test eax, eax
je 0x40454e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40454e
test byte [ebp - 8], 1
jne 0x404557
or dword [ebp + 0x10], 0x200000
jmp 0x40458a
mov eax, dword [0x80e8cc]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40458a
mov eax, dword [0x80e8d0]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x80e8c8]
call esi
test eax, eax
je 0x4045a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4045a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret