joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov eax, dword [0x100fd040]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
mov ecx, 0x1010a8f1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], esi
call fcn.100b18e0
movq xmm0, qword [esi + 0x70]
mov esi, dword [esi + 0x78]
mov ebp, dword [sym.imp.ucrtbased.dll__wassert]
movq qword [esp + 0x24], xmm0
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], 0xffffffff
test esi, esi
jns 0x10059af8
push 0x46c
push str.D:New_folderimguiimstb_truetype.h
push str.__o___b__size__o___0_
call ebp
add esp, 0xc
mov dword [esp + 0x28], esi
mov eax, esi
jmp 0x10059b13
xor eax, eax
mov dword [esp + 0x28], 0
test esi, esi
jle 0x10059b13
mov cl, byte [edi]
mov edx, 1
mov eax, edx
test cl, cl
jne 0x10059b52
add ebx, eax
cmp ebx, esi
jg 0x10059b1d
test ebx, ebx
jns 0x10059b31
push 0x46c
push str.D:New_folderimguiimstb_truetype.h
push str.__o___b__size__o___0_
call ebp
add esp, 0xc
cmp ebx, esi
jg 0x10059b48
test ebx, ebx
js 0x10059b48
cmp ebx, esi
jge 0x10059b48
mov al, byte [edi + ebx]
movzx eax, al
jmp 0x10059c01
xor al, al
movzx eax, al
jmp 0x10059c01
cmp cl, 3
jne 0x10059c05
cmp eax, esi
jl 0x10059b63
xor al, al
jmp 0x10059b67
mov al, byte [edi + edx]
inc edx
movzx ecx, al
cmp edx, esi
jl 0x10059b72
xor al, al
jmp 0x10059b76
mov al, byte [edi + edx]
inc edx
shl ecx, 8
movzx eax, al
or ecx, eax
mov dword [esp + 0x18], ecx
cmp edx, esi
jl 0x10059b8a
xor al, al
jmp 0x10059b8e
mov al, byte [edi + edx]
inc edx
movzx ebp, al
cmp edx, esi
jl 0x10059b99
xor al, al
jmp 0x10059b9d
mov al, byte [edi + edx]
inc edx
shl ebp, 8
xor ebx, ebx
movzx eax, al
or ebp, eax
test ecx, ecx
je 0x10059c05
nop dword [eax + eax]
cmp edx, esi
jl 0x10059bb8
xor al, al
jmp 0x10059bbc
mov al, byte [edi + edx]
inc edx
movzx eax, al
mov dword [esp + 0x1c], eax
cmp edx, esi
jl 0x10059bcb
xor al, al
jmp 0x10059bcf
mov al, byte [edi + edx]
inc edx
movzx eax, al
cmp edx, esi
jl 0x10059bda
xor cl, cl
jmp 0x10059bde
mov cl, byte [edi + edx]
inc edx
shl eax, 8
movzx ecx, cl
or eax, ecx
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
jl 0x10059bf2
cmp ecx, eax
jl 0x10059bfd
inc ebx
mov ebp, eax
cmp ebx, dword [esp + 0x18]
jl 0x10059bb0
jmp 0x10059c05
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x20]
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
mov edx, esp
movq xmm0, qword [ebx + 0x64]
mov eax, dword [ebx + 0x6c]
movq qword [edx], xmm0
mov dword [edx + 8], eax
lea eax, [esp + 0x30]
push eax
call fcn.100578e0
add esp, 4
mov ecx, esp
sub esp, 0xc
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
movq xmm0, qword [ebx + 0x34]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [ebx + 0x3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [esp + 0x48]
push eax
call fcn.10057db0
mov edx, dword [esp + 0x60]
add esp, 0x1c
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop edi
pop esi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x34]
pop ebp
pop ebx
xor ecx, esp
call fcn.100af2b0
add esp, 0x30
ret
Function at 0x10067380
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, 0x1010bb3f
call fcn.100b18e0
mov ecx, edi
call fcn.10067180
mov ecx, dword [edi + 0x40]
xor eax, eax
mov ebp, dword [sym.imp.ucrtbased.dll__wassert]
mov dword [esp + 0x14], eax
test ecx, ecx
jle 0x1006750a
xor esi, esi
mov dword [esp + 0x18], esi
cmp eax, ecx
jl 0x100673d3
push 0x4ae
push str.D:New_folderimguiimgui.h
push str.i___Size
call ebp
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ebx, dword [edi + 0x48]
add ebx, esi
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x100674f3
cmp dword [ebx], 0x10000
ja 0x100674f3
cmp dword [ecx + 0x38], edi
je 0x10067408
push 0x857
push str.D:New_folderimguiimgui_draw.cpp
push str.r.Font__ContainerAtlas__atlas
call ebp
add esp, 0xc
cmp dword [edi + 0x1c], 0
jle 0x10067414
cmp dword [edi + 0x20], 0
jg 0x10067428
push 0x6a1
push str.D:New_folderimguiimgui_draw.cpp
push str.TexWidth___0__TexHeight___0
call ebp
add esp, 0xc
mov eax, 0xffff
cmp word [ebx + 8], ax
jne 0x10067447
push 0x6a2
push str.D:New_folderimguiimgui_draw.cpp
push str.rect__IsPacked__
call ebp
add esp, 0xc
movzx eax, word [ebx + 8]
sub esp, 0x1c
movzx esi, word [ebx + 4]
movzx ecx, word [ebx + 0xa]
movzx edx, word [ebx + 6]
movss xmm0, dword [ebx + 0xc]
movd xmm6, eax
add eax, esi
movss dword [esp + 0x18], xmm0
movd xmm3, ecx
cvtdq2ps xmm3, xmm3
movd xmm2, eax
lea eax, [edx + ecx]
mulss xmm3, dword [edi + 0x28]
mov ecx, dword [ebx + 0x18]
movd xmm1, eax
movzx eax, word [ebx]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
mulss xmm2, dword [edi + 0x24]
mulss xmm1, dword [edi + 0x28]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm6, xmm6
addss xmm0, dword [ebx + 0x14]
mulss xmm6, dword [edi + 0x24]
movss dword [esp + 0x14], xmm1
movss dword [esp + 0x10], xmm2
movss xmm2, dword [ebx + 0x10]
movss dword [esp + 0xc], xmm3
movss xmm3, dword [ebx + 0x14]
movss dword [esp + 8], xmm6
movss dword [esp + 4], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebx + 0x10]
movss dword [esp], xmm0
push eax
call fcn.100681f0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, dword [edi + 0x40]
inc eax
add esi, 0x1c
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
cmp eax, ecx
jl 0x100673d3
mov ecx, dword [edi + 0x34]
xor esi, esi
test ecx, ecx
jle 0x10067565
cmp esi, ecx
jl 0x1006752e
push 0x4ae
push str.D:New_folderimguiimgui.h
push str.i___Size
call ebp
mov ecx, dword [edi + 0x34]
add esp, 0xc
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + esi*4]
cmp byte [eax + 0x54], 0
je 0x1006755d
cmp esi, ecx
jl 0x10067552
push 0x4ae
push str.D:New_folderimguiimgui.h
push str.i___Size
call ebp
add esp, 0xc
mov ecx, dword [edi + 0x3c]
mov ecx, dword [ecx + esi*4]
call fcn.10067c60
mov ecx, dword [edi + 0x34]
inc esi
cmp esi, ecx
jl 0x1006752e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1006a150
Capabilities:
Compute adler32 checksum

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ecx, 0x1010bb3f
mov esi, edx
call fcn.100b18e0
mov ebp, dword [esp + 0x24]
mov eax, 0x5e6ea9af
mul ebp
mov ebx, ebp
xor edi, edi
shr edx, 0xb
mov ecx, 1
imul eax, edx, 0x15b0
sub ebx, eax
mov dword [esp + 0x10], ebx
test ebp, ebp
je 0x1006a289
nop
xor edx, edx
mov dword [esp + 0x14], edx
cmp ebx, 7
jbe 0x1006a1f2
mov ebp, 7
sub ebp, esi
movzx eax, byte [esi]
add edx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add esi, 8
add edi, ecx
add ecx, eax
add edi, ecx
lea eax, [esi + ebp]
cmp eax, ebx
jb 0x1006a1a2
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x10]
xor ebx, ebx
xor ebp, ebp
cmp edx, eax
jae 0x1006a24e
sub eax, edx
cmp eax, 2
jb 0x1006a241
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
sub edx, eax
sub edx, 2
shr edx, 1
inc edx
lea eax, [eax + edx*2]
mov dword [esp + 0x14], eax
nop dword [eax]
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add ebp, ecx
sub edx, 1
jne 0x1006a220
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
jae 0x1006a249
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
lea eax, [ebx + ebp]
add edi, eax
mov eax, 0x80078071
mov ebx, dword [esp + 0x10]
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
add edi, eax
sub dword [esp + 0x24], ebx
mov ebx, 0x15b0
mov dword [esp + 0x10], ebx
jne 0x1006a190
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10075fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [0x100fd040]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
push ebx
push ebp
mov ebp, dword [esp + 0x78]
mov ebx, ecx
push esi
push edi
mov edi, dword [esp + 0x84]
mov ecx, 0x1010bb3f
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebp
call fcn.100b18e0
mov eax, dword [0x1010121c]
mov dword [esp + 0x18], eax
cmp dword [eax + 0x2bfc], 0
jne 0x10076020
call fcn.10039560
mov al, byte [edi]
mov esi, edi
test al, al
je 0x1007603a
cmp al, 0x25
jne 0x10076032
cmp byte [esi + 1], al
jne 0x1007603a
inc esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10076028
cmp byte [esi], 0x25
jne 0x1007607f
mov ecx, esi
call fcn.10075e30
cmp byte [eax], 0
jne 0x1007604f
mov edi, esi
jmp 0x1007607f
sub eax, esi
mov edi, 0x20
inc eax
cmp eax, edi
cmovb edi, eax
cmp edi, 1
jb 0x1007607b
jbe 0x10076076
lea eax, [edi - 1]
push eax
lea eax, [esp + 0x50]
push esi
push eax
call dword [sym.imp.ucrtbased.dll_strncpy]
add esp, 0xc
mov byte [esp + edi + 0x4b], 0
lea edi, [esp + 0x4c]
push edi
push ebp
mov ebp, dword [esp + 0x84]
lea ecx, [esp + 0x34]
push ebp
mov edx, 0x20
call fcn.10073420
add esp, 0xc
lea esi, [esp + 0x2c]
nop
mov al, byte [esi]
cmp al, 0x20
je 0x100760aa
cmp al, 9
jne 0x100760ad
inc esi
jmp 0x100760a0
mov edi, esi
test al, al
je 0x100760d0
inc esi
cmp byte [esi], 0
jne 0x100760b3
cmp esi, edi
jbe 0x100760d0
nop dword [eax]
mov al, byte [esi - 1]
cmp al, 0x20
je 0x100760cb
cmp al, 9
jne 0x100760d0
dec esi
cmp esi, edi
ja 0x100760c0
lea eax, [esp + 0x2c]
cmp edi, eax
je 0x100760eb
mov eax, esi
sub eax, edi
push eax
lea eax, [esp + 0x30]
push edi
push eax
call sub.VCRUNTIME140D.dll_memmove
add esp, 0xc
sub esi, edi
mov byte [esp + esi + 0x2c], 0
cmp ebp, 4
je 0x10076101
mov eax, 0x11
cmp ebp, 5
jne 0x10076106
mov eax, 0x20010
movss xmm0, dword [ebx + 8]
lea edx, [esp + 0x2c]
subss xmm0, dword [ebx]
mov ecx, dword [esp + 0x14]
push 0
push 0
push eax
movss dword [esp + 0x30], xmm0
lea eax, [esp + 0x30]
movss xmm0, dword [ebx + 0xc]
subss xmm0, dword [ebx + 4]
push eax
push 0x20
movss dword [esp + 0x3c], xmm0
call fcn.10079780
mov esi, dword [esp + 0x2c]
add esp, 0x14
mov bl, al
cmp dword [esi + 0x2bfc], 0
jne 0x10076180
mov eax, dword [esp + 0x1c]
cmp dword [esi + 0x19bc], eax
je 0x10076174
push 0xad5
push str.D:New_folderimguiimgui_widgets.cpp
push str.g.ActiveId__id
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x19bc]
mov dword [esi + 0x2bfc], eax
test bl, bl
je 0x100761b0
mov edx, dword [esi + 0x1d60]
lea ecx, [esp + 0x2c]
push 0
push dword [esp + 0x24]
push ebp
call fcn.10073650
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100af2b0
add esp, 0x64
ret
mov ecx, dword [esp + 0x6c]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100af2b0
add esp, 0x64
ret
Function at 0x10091a10
Capabilities:
Create thread

Disassembly:
mov ecx, 0x1010bb3f
call fcn.100b18e0
mov eax, dword [esp + 8]
sub eax, 0
je 0x10091a51
sub eax, 1
jne 0x10091a49
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [esp + 0xc]
push 0x10091690
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
ret 0xc
cmp dword [esp + 0xc], 0
jne 0x10091a49
call fcn.10091820
ret 0xc
Function at 0x10097c70
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x24
mov eax, dword [0x100fd040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
mov ecx, 0x1010b0ba
call fcn.100b18e0
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10097d7e
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10097d77
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0x14], 0x10
jb 0x10097d5b
call ebx
cmp dword [esp + 0x20], eax
jne 0x10097d5b
call ebp
cmp dword [esp + 0x1c], eax
je 0x10097d5b
mov edx, dword [esi]
test edx, edx
jne 0x10097d23
push 0x200
push edx
push dword [0x10101224]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10097d77
jmp 0x10097d4e
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10097d4e
shl eax, 3
push eax
push edx
push 0
push dword [0x10101224]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10097d77
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10097ce3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10097dc8
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10097dc8
mov ebp, dword [esp + 0x38]
nop
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10097dc2
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 0x10]
mov ecx, ebx
push ebp
call fcn.100979e0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10097d90
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100af2b0
add esp, 0x24
ret

Function at 0x10097de0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0x1010b0ba
call fcn.100b18e0
cmp dword [ebx], 0
je 0x10097e3a
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x10097e29
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10097e21
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10097e02
pop edi
pop ebp
push dword [ebx]
push 0
push dword [0x10101224]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x10097e40
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov eax, dword [0x100fd040]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
mov ecx, 0x1010b0ba
call fcn.100b18e0
imul esi, esi, 0x2c
add esi, dword [0x10108d40]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10097eac
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100af2b0
add esp, 8
ret
test ebx, ebx
je 0x10097ecd
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10097eee
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10097eee
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10097ee8
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10097eee
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esi + 0x14], bl
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100af2b0
add esp, 8
ret
Function at 0x469b3c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff28
xor eax, eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x469d21
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x470e18], eax
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [0x470e24], 0x231fb617
mov eax, 3
call fcn.00402da8
add eax, 4
mov dword [0x470e30], eax
push 0xc9
lea eax, [ebp - 0xcd]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [0x470e24], 0x35d290e9
lea eax, [ebp - 4]
mov dl, byte [ebp - 0xcd]
call fcn.00404344
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, 0x19f60829
call fcn.00402da8
add eax, 0x192a
mov dword [0x470e30], eax
mov dword [0x470e24], 0x338a69ff
push dword [ebp - 4]
push 0x469d34
push dword [0x46f6d4]
push 0x469d50
lea eax, [ebp - 4]
mov edx, 4
call fcn.004044dc
mov eax, dword [ebp - 4]
call fcn.0040880c
test al, al
je 0x469cfb
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, dword [ebp - 4]
call fcn.004698b4
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, 0xea
call fcn.00402da8
add eax, 0x14953bf6
mov dword [0x470e30], eax
cmp dword [0x470e18], 0
jle 0x469cfb
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, dword [ebp - 4]
call fcn.0040441c
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.004046bc
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [0x470e24], 0x2916f875
push 0
push dword [0x46f6d0]
push 0x469d5c
push dword [0x46f6d4]
push 0x469d74
lea eax, [ebp - 0xd4]
mov edx, 4
call fcn.004044dc
mov eax, dword [ebp - 0xd4]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_WinExec
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, 0x159
call fcn.00402da8
add eax, 0x34b659
mov dword [0x470e30], eax
push 0
push dword [0x46f6d0]
push 0x469d5c
push dword [0x46f6d4]
push 0x469d88
lea eax, [ebp - 0xd8]
mov edx, 4
call fcn.004044dc
mov eax, dword [ebp - 0xd8]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_WinExec
call sub.KERNEL32.DLL_GetTickCount_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469d28
lea eax, [ebp - 0xd8]
mov edx, 2
call fcn.00404180
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46bae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bc03
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040415c
lea eax, [ebp - 8]
call fcn.0040415c
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [0x46f6bc]
call fcn.0040461c
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [0x46f6c0]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46bb73
lea eax, [ebp - 4]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 4]
call fcn.0040441c
test eax, eax
je 0x46bbd5
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
mov dl, byte [edx]
call fcn.00404344
mov dword [0x470e24], 0x10b0d92f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46bbd5
lea eax, [ebp - 8]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bc0a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret

Function at 0x46bd44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x46be14
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x470e24], 0x3448c68f
xor ebx, ebx
lea eax, [ebx]
push eax
call sub.user32.dll_GetAsyncKeyState
and ax, 1
cmp ax, 1
jne 0x46bdec
mov eax, ebx
add eax, 0xffffffd0
sub eax, 0xa
jb 0x46bd92
add eax, 0xfffffff9
sub eax, 0x1a
jb 0x46bd92
add eax, 0xfffffffa
sub eax, 0x1a
jae 0x46bdc0
push dword [0x470c1c]
push 0x46be28
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404344
push dword [ebp - 4]
push 0x46be34
mov eax, 0x470c1c
mov edx, 4
call fcn.004044dc
jmp 0x46bdec
push dword [0x470c1c]
push 0x46be40
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004082f4
push dword [ebp - 8]
push 0x46be4c
mov eax, 0x470c1c
mov edx, 4
call fcn.004044dc
inc ebx
cmp ebx, 0x100
jne 0x46bd66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46be1b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x401ac4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x401ac4
lcall 0x5de5, 0x8b10c483
jmp loc.00824010