joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001a83
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edx, 0x6dfffffc
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1000121c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100011d1
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax

Function at 0x10001af2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
cld
invalid
jmp [ebx]
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1000121c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100011d1
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
cld
invalid
inc dword [eax]
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
cld
invalid
call [edx - 0x3e47a3a]
invalid
jmp dword [ebx - 0x3e37a3a]
invalid
inc dword [ecx - 0x3e27a3a]
invalid
dec dword [edx - 0x3e17a3a]
invalid
call [ebx - 0x3e07a3a]
invalid
inc dword [edx - 0x3df7a3a]
invalid
dec dword [ebx - 0x3de7a3a]
invalid
invalid
cmpsb byte [esi], byte es:[edi]
invalid
test dword [edx], esp
Function at 0x10002174
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.1000121c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100011d1
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.1000120c
adc ebx, dword [esi]
cli
shr dword [eax + 4], 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.1000120c
or edi, dword [eax - 0x55]
push edi
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.1000121c
pop ecx
push eax
push dword [ebp + 0x18]

Function at 0x10003615
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 4]
xor esi, esi
mov ecx, dword [ecx]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x10003649
mov edi, dword [ebp - 4]
xor eax, eax
cmp eax, esi
mov ebx, eax
jne 0x1000366c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
cmp edi, esi
je 0x10003677
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0xc
Function at 0x10003803
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.100035d7
mov edi, eax
cmp edi, esi
je 0x10003843
cmp dword [ebp - 4], esi
je 0x1000383c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x100038e0
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x100038b4
lea eax, [ebp - 0x114]
lea ecx, [ebp - 4]
push eax
call fcn.10003803
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x100038a1
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 4]
jmp 0x10003866
cmp dword [ebp - 4], esi
je 0x100038af
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x100038e0
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x100038c7
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x100038de
push dword [ebp - 4]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402cb4
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x4c80e0
call fcn.004a8fde
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x18], edi
mov ebx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], edi
mov byte [esi], 0
push 0x2c
mov dword [ebp - 4], edi
pop eax
mov ecx, esi
mov dword [ebp - 0x18], 1
call fcn.00402e84
push 2
pop eax
sub eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x10]
add edi, dword [ebp + 0xc]
movzx eax, byte [edi]
shr eax, 2
movzx eax, byte [eax + ebx]
push eax
mov eax, esi
call fcn.00402e47
mov eax, dword [ebp - 0x1c]
add eax, edi
mov dword [ebp - 0x20], eax
dec eax
cmp eax, 0x20
jae 0x402d95
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
lea eax, [eax + ecx + 1]
movzx ecx, byte [edi]
mov dword [ebp - 0x14], eax
movzx eax, byte [eax]
and ecx, 3
shl ecx, 4
shr eax, 4
add ecx, ebx
movzx eax, byte [eax + ecx]
push eax
mov eax, esi
call fcn.00402e47
cmp dword [ebp - 0x20], 0x20
jae 0x402d85
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
lea edi, [ecx + eax + 2]
movzx ecx, byte [edi]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
shr ecx, 6
and eax, 0xf
add ecx, ebx
movzx eax, byte [ecx + eax*4]
push eax
mov eax, esi
call fcn.00402e47
movzx eax, byte [edi]
and eax, 0x3f
movzx eax, byte [eax + ebx]
push eax
jmp 0x402db4
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
and eax, 0xf
movzx eax, byte [ebx + eax*4]
push eax
jmp 0x402dab
movzx eax, byte [edi]
and eax, 3
add eax, eax
movzx eax, byte [ebx + eax*8]
push eax
mov eax, esi
call fcn.00402e47
push 0x3d
mov eax, esi
call fcn.00402e47
push 0x3d
mov eax, esi
call fcn.00402e47
add dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], 0x20
jb 0x402cfb
mov eax, esi
call fcn.004a907d
ret
Function at 0x403557
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x4f7f44]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x40
mov esi, ecx
pop edi
mov dword [ebp - 0xd8], eax
cmp esi, edi
jne 0x403586
mov dword [ebp - 0xd8], eax
jmp 0x4035ea
jbe 0x4035b7
push 0x20
pop edi
lea edx, [ebp - 0xd4]
call fcn.00403809
push dword [ebp - 0xd8]
mov eax, esi
mov esi, edx
call fcn.00403830
pop ecx
lea eax, [ebp - 0x28]
push eax
mov eax, esi
call fcn.004038ba
pop ecx
lea eax, [ebp - 0x28]
jmp 0x4035b9
mov edi, esi
push 0x40
pop esi
sub esi, edi
push esi
mov dword [ebp - 0xd8], eax
lea eax, [ebx + edi + 0x2a0]
push 0x36
push eax
call fcn.004a8b80
add esp, 0xc
push esi
lea eax, [ebx + edi + 0x2e0]
push 0x5c
push eax
call fcn.004a8b80
add esp, 0xc
test edi, edi
jle 0x40360e
mov esi, dword [ebp - 0xd8]
lea eax, [ebx + 0x2e0]
mov cl, byte [esi]
xor cl, 0x36
mov byte [eax - 0x40], cl
mov cl, byte [esi]
xor cl, 0x5c
inc esi
mov byte [eax], cl
inc eax
dec edi
jne 0x4035fa
mov edx, ebx
call fcn.00403809
lea eax, [ebx + 0x2a0]
push eax
push 0x40
pop eax
mov esi, ebx
call fcn.00403830
lea edx, [ebx + 0xa8]
pop ecx
mov dword [ebp - 0xd8], edx
call fcn.00403809
lea eax, [ebx + 0x2e0]
push eax
push 0x40
pop eax
mov esi, edx
call fcn.00403830
pop ecx
push 0x2a
pop ecx
push 0x2a
lea edi, [ebx + 0x150]
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd8]
pop ecx
lea edi, [ebx + 0x1f8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.004a79cb
leave
ret
Function at 0x403676
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4f7f44]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test ecx, ecx
jle 0x4037fd
add eax, 0x88
push ebx
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
push esi
add eax, 2
mov dword [ebp - 0x128], ecx
push edi
xor ecx, ecx
movzx edx, byte [eax - 2]
movzx esi, byte [eax - 1]
shl edx, 8
or edx, esi
movzx esi, byte [eax]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 1]
shl edx, 8
or edx, esi
mov dword [ebp + ecx*4 - 0x124], edx
inc ecx
add eax, 4
cmp ecx, 0x10
jl 0x4036b0
push 0x30
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0xec]
pop esi
mov edx, dword [eax]
mov ecx, dword [eax - 0x34]
mov edi, edx
rol edi, 0xf
mov ebx, edx
shr edx, 0xa
rol ebx, 0xd
xor edi, ebx
xor edi, edx
mov edx, ecx
rol edx, 0xe
mov ebx, ecx
ror ebx, 7
xor edx, ebx
shr ecx, 3
xor edx, ecx
add edi, edx
add edi, dword [eax - 0x38]
add eax, 4
add edi, dword [eax - 0x18]
dec esi
mov dword [eax + 4], edi
jne 0x4036ed
mov esi, dword [ebp - 0x12c]
push 8
pop ecx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x14]
xor edx, edx
mov edi, dword [ebp - 0x10]
mov eax, esi
ror eax, 0xb
mov ecx, esi
rol ecx, 7
xor eax, ecx
and edi, esi
mov ecx, esi
ror ecx, 6
xor eax, ecx
mov ebx, dword [ebp - 0x20]
mov ecx, esi
not ecx
and ecx, dword [ebp - 0xc]
and ebx, dword [ebp - 0x24]
xor ecx, edi
mov edi, dword [ebp - 0x24]
add eax, ecx
add eax, dword [edx + 0x4f96a8]
mov ecx, dword [ebp - 0x24]
add eax, dword [ebp + edx - 0x124]
add edx, 4
add eax, dword [ebp - 8]
ror ecx, 0xd
rol edi, 0xa
xor ecx, edi
mov edi, dword [ebp - 0x24]
ror edi, 2
xor ecx, edi
mov edi, dword [ebp - 0x20]
xor edi, dword [ebp - 0x24]
and edi, dword [ebp - 0x1c]
xor edi, ebx
add ecx, edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x24]
add ecx, eax
add esi, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ecx
cmp edx, 0x100
jl 0x403738
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x14], esi
xor ecx, ecx
mov edx, dword [ebp + ecx*4 - 0x24]
add dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jl 0x4037d9
dec dword [ebp - 0x128]
mov eax, dword [ebp - 0x130]
jne 0x4036ae
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a79cb
leave
ret

Function at 0x403809
Capabilities:
Hash data using sha256
Hash data using sha384

Disassembly:
mov ecx, 0x4f9608
lea eax, [edx + 0x88]
push esi
mov esi, dword [ecx]
mov dword [eax], esi
add ecx, 4
add eax, 4
cmp ecx, 0x4f9628
jl 0x403815
and dword [edx + 4], 0
and dword [edx], 0
pop esi
ret

Function at 0x4044af
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push 2
call fcn.004a6c18
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [ebp + 8]
push 0
call fcn.004a6c18
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
Function at 0x40bdf3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x4ec
mov eax, 0x4c988c
call fcn.004a9047
mov eax, dword [ebp + 8]
mov dword [ebp - 0x488], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
mov byte [ebp - 0x461], al
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 4], eax
call fcn.0040100e
lea ebx, [ebp - 0x484]
mov ecx, eax
call fcn.004011d4
mov esi, dword [ebp - 0x484]
cmp esi, dword [ebp - 0x480]
je 0x40be9a
mov eax, dword [ebp - 0x48c]
mov ecx, dword [ebp - 0x490]
cmp dword [esi + 8], ecx
jg 0x40be7b
cmp ecx, dword [esi + 0x10]
jg 0x40be7b
cmp dword [esi + 0xc], eax
jg 0x40be7b
cmp eax, dword [esi + 0x14]
jle 0x40be88
add esi, 0x58
cmp esi, dword [ebp - 0x480]
jne 0x40be67
jmp 0x40be9a
push 0x16
pop ecx
lea edi, [ebp - 0x4f8]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x461], 1
lea eax, [ebp - 0x460]
push eax
call fcn.004047a9
cmp byte [ebp - 0x461], 1
mov al, byte [ebp + 0xc]
mov byte [ebp - 4], 1
mov byte [ebp - 0xc8], al
jne 0x40bec4
lea esi, [ebp - 0x4f0]
jmp 0x40bed7
lea eax, [ebp - 0x4a0]
push eax
call fcn.0040100e
call fcn.0040120d
mov esi, eax
lea edi, [ebp - 0x474]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x460]
movsd dword es:[edi], dword [esi]
call fcn.004a6c18
test eax, eax
jne 0x40bf35
mov ecx, dword [ebp - 0x468]
sub ecx, dword [ebp - 0x470]
push eax
push ecx
mov ecx, dword [ebp - 0x46c]
sub ecx, dword [ebp - 0x474]
push ecx
push dword [ebp - 0x470]
mov ecx, dword [ebp - 0x488]
push dword [ebp - 0x474]
push eax
push eax
push str.UU_SCREENSHOT_FORM
call fcn.004a6c18
push eax
lea ecx, [ebp - 0x460]
call fcn.00426748
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp byte [ebp - 0x461], 1
jne 0x40bf63
sub esp, 0x58
push 0x16
pop ecx
mov edi, esp
lea esi, [ebp - 0x4f8]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x460]
call fcn.004057b5
jmp 0x40bf6e
lea ecx, [ebp - 0x460]
call fcn.004055b2
call ebx
mov eax, dword [ebp - 0x468]
sub eax, dword [ebp - 0x470]
push 0
push eax
mov eax, dword [ebp - 0x46c]
sub eax, dword [ebp - 0x474]
lea ecx, [ebp - 0x460]
push eax
push dword [ebp - 0x470]
push dword [ebp - 0x474]
push 0xffffffffffffffff
call fcn.004a6c18
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
lea ecx, [ebp - 0x460]
call fcn.004261df
call ebx
call fcn.004044e8
mov ecx, dword [eax + 0x20]
cmp ecx, dword [eax + 0x24]
je 0x40bfcc
mov eax, dword [ecx]
jmp 0x40bfce
xor eax, eax
test eax, eax
je 0x40bfdb
push 9
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x460]
push eax
mov byte [ebp - 4], 0
call fcn.004048b1
cmp dword [ebp - 0x484], 0
je 0x40c000
push dword [ebp - 0x484]
call fcn.004a79c0
pop ecx
call fcn.004a9091
ret 8
Function at 0x40ed5a
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x40
mov eax, 0x4c9068
call fcn.004a9047
mov ebx, ecx
push 0x4e82e8
mov ecx, edi
mov dword [ebp - 0x4c], ebx
call fcn.00402015
and dword [esi], 0
and dword [esi + 4], 0
lea eax, [ebx - 0x70]
cmp eax, 0xb
ja 0x40ee51
add ebx, 0xffffff91
push ebx
lea eax, [ebp - 0x2c]
push 0x4e965c
push eax
call fcn.0041c030
add esp, 0xc
and dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00401f26
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
push 0
inc ebx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004020c1
cmp dword [edi + 0x10], 0
je 0x40ef5d
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x40ee07
push edi
lea eax, [ebp - 0x2c]
push str.Alt
push eax
call fcn.0040f068
add esp, 0xc
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00401f26
or dword [ebp - 4], 0xffffffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004020c1
or dword [esi], ebx
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x40ef5d
push edi
lea eax, [ebp - 0x2c]
push str.Ctrl
push eax
call fcn.0040f068
add esp, 0xc
push eax
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.00401f26
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004020c1
or dword [esi], 2
jmp 0x40ef5d
cmp ebx, 0x30
jl 0x40ee5b
cmp ebx, 0x39
jle 0x40ee67
lea eax, [ebx - 0x41]
cmp eax, 0x19
ja 0x40ef63
movzx eax, bx
push eax
lea eax, [ebp - 0x2c]
push 0x4e967c
push eax
call fcn.0041c030
add esp, 0xc
push eax
mov ecx, edi
mov dword [ebp - 4], 3
call fcn.00401f26
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
push 0
inc ebx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004020c1
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x40eee1
push edi
lea eax, [ebp - 0x2c]
push str.Alt
push eax
call fcn.0040f068
add esp, 0xc
push eax
mov ecx, edi
mov dword [ebp - 4], 4
call fcn.00401f26
or dword [ebp - 4], 0xffffffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004020c1
or dword [esi], ebx
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x40ef26
push edi
lea eax, [ebp - 0x2c]
push str.Ctrl
push eax
call fcn.0040f068
add esp, 0xc
push eax
mov ecx, edi
mov dword [ebp - 4], 5
call fcn.00401f26
or dword [ebp - 4], 0xffffffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004020c1
or dword [esi], 2
cmp dword [esi], 0
jne 0x40ef5d
push edi
lea eax, [ebp - 0x48]
push str.AltCtrl
push eax
mov dword [esi], 3
call fcn.0040f068
add esp, 0xc
push eax
mov ecx, edi
mov dword [ebp - 4], 6
call fcn.00401f26
push 0
push ebx
lea ecx, [ebp - 0x48]
call fcn.004020c1
mov eax, dword [ebp - 0x4c]
mov dword [esi + 4], eax
cmp dword [edi + 0x10], 0
setne al
call fcn.004a9091
ret
Function at 0x40f1f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x4e9784
push 0x82
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40f284
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x40f22e
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x40f283
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x40f280
push esi
call fcn.004a6b98
pop ecx
mov dword [0x4fdfe4], eax
test eax, eax
je 0x40f280
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [0x4fdfe4]
call fcn.004a9120
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x4fdfe4]
call fcn.0042114a
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x40f282
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x40f5ac
Capabilities:
Check mutex on windows
Initialize winsock library
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5e4
mov eax, dword [0x4f7f44]
xor eax, esp
mov dword [esp + 0x5e0], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
push ebx
call fcn.0040f1f5
xor eax, eax
xor esi, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], ax
mov dword [esp], 0x4e9798
call fcn.00402015
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x40f609
lea eax, [esp + 0x14]
sub esp, 0x84
mov ecx, esp
mov dword [esp + 0x90], esp
push 0xffffffffffffffff
push eax
call fcn.00426f00
call fcn.00422d8e
add esp, 0x84
push ebx
call fcn.004210f6
pop ecx
lea eax, [esp + 0x458]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x40f786
mov ebx, str.GlobalGACC_Translate_FBE21BAC_2881_4135_BFA5_FC934D3917BB
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push ebx
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esp + 0xc], esi
je 0x40f680
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f68a
call fcn.0040f4de
jmp 0x40f786
lea eax, [esp + 0x10]
push eax
call fcn.0040fb3b
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.00401d5f
call fcn.0040f1ba
push eax
call fcn.00401a6c
call fcn.0040f287
call fcn.0040fc2f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
call fcn.00404618
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
lea eax, [esp + 0xb8]
push eax
call fcn.0040aa48
push esi
push 0x1a9
push 0x1f4
push esi
push esi
push 0x20080
push 0xcf0000
lea eax, [esp + 0x4c]
push 0x3e8
push eax
call fcn.00423bdc
pop ecx
pop ecx
mov ecx, eax
call fcn.00426af4
push eax
push esi
lea ecx, [esp + 0xdc]
call fcn.00426748
lea ecx, [esp + 0x30]
call fcn.00426ad2
lea ecx, [esp + 0xb8]
call fcn.004262bb
push esi
lea ecx, [esp + 0xbc]
call fcn.004a6c18
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00425f1e
call fcn.0040fc2f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
call fcn.00404618
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
lea eax, [esp + 0xb8]
push eax
call fcn.0040abe8
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f786
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
push 1
lea ecx, [esp + 0x1c]
call fcn.004020c1
mov ecx, dword [esp + 0x5ec]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004a79cb
mov esp, ebp
pop ebp
ret 0x10