joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov edx, dword [ebp + 8]
mov edi, ebx
shr edi, 1
mov esi, ebx
shr esi, 2
mov eax, edi
and eax, 1
neg eax
shr eax, 4
movzx ecx, word [edx + esi*2 + 4]
and eax, 0x7f
shr ecx, 4
neg esi
xor ecx, eax
and esi, 0x7f0
movzx eax, word [edx + 2]
xor esi, eax
mov eax, dword [ebp + 0x14]
shr esi, 4
mov edx, dword [eax + ecx*4]
add edx, dword [eax + esi*4]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
add edx, dword [ebp + 0xc]
movzx ecx, word [eax + edi*2 + 8]
mov edi, dword [ebp + 0x10]
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [esi + eax*4]
add eax, edx
mov dword [edi + ebx*4], eax
mov eax, dword [esi + ecx*4]
add eax, edx
mov dword [edi + ebx*4 + 4], eax
add ebx, 2
cmp ebx, 8
jb 0x4ac3b8
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4ac840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.004bbab2
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x4ac86b
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x4ac890
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.004bbab2
mov ecx, dword [ebp + 8]
mov esi, eax
add esp, 0x18
mov dword [ecx], esi
test esi, esi
je 0x4ac8d5
push dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4ac8d5
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
pop esi
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x4ad666
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x4ad68d
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x4ad690
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004ad642
pop esi
leave
ret 8

Function at 0x4afb4f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4afb8e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4afb8e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4afb8e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4afb8e
cmp dword [ecx + 0x74], 0xe
jbe 0x4afb8e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4c0f24
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c0d95
Function at 0x4c19b3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x533d24
push 0x533d1c
push str.FlsAlloc
push 0x1e
call fcn.004c17e0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4c19e7
push dword [ebp + 8]
mov ecx, esi
call dword [0x4ea1d0]
call esi
jmp 0x4c19ed
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4c1a31
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x533d34
push 0x533d2c
push str.FlsGetValue
push 0x20
call fcn.004c17e0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4c1a68
push dword [ebp + 8]
mov ecx, esi
call dword [0x4ea1d0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4c325e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004af430
mov eax, dword [0x5519c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004c0d6e
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4c32a0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4c33fc
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004aebf0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x555d70]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004c3fe3
mov ecx, dword [esi*4 + 0x555d70]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4c33f5
cmp eax, dword [edi + ecx + 0x24]
jne 0x4c33f5
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c33f5
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c3fe3
add esp, 0x14
test edx, edx
jl 0x4c33f5
jg 0x4c336b
test eax, eax
jb 0x4c33f5
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4c33f5
jl 0x4c3385
cmp dword [ebp - 0x1008], eax
ja 0x4c33f5
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4c33a3
test ebx, ebx
je 0x4c33dc
cmp ecx, edi
jae 0x4c33dc
mov al, byte [ecx]
cmp al, 0xd
jne 0x4c33bd
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4c33c9
cmp byte [ecx + 1], 0xa
jne 0x4c33c9
inc ecx
jmp 0x4c33c9
movzx eax, al
movsx eax, byte [eax + 0x551c80]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4c33a3
cmp edx, ebx
jne 0x4c33a3
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4c33fa
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004ae8e5
leave
ret
Function at 0x4c349b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x555d70]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4c34db
cmp byte [ebx], 0xa
jne 0x4c34db
or byte [eax + edi + 0x28], 4
jmp 0x4c34e0
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4c35de
mov al, byte [edx]
cmp al, 0x1a
je 0x4c35c0
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4c350f
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4c3534
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4c353e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4c34f1
jmp 0x4c35de
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c35bb
cmp dword [ebp - 0xc], 0
je 0x4c35bb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x555d70]
test byte [eax + edi + 0x28], 0x48
je 0x4c3595
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4c3580
mov byte [esi], dl
jmp 0x4c3591
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x555d70]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4c35de
cmp byte [ebp - 1], 0xa
jne 0x4c35a4
cmp esi, ebx
jne 0x4c35a4
mov byte [esi], 0xa
jmp 0x4c35dd
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004c4001
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4c35de
mov byte [esi], 0xd
jmp 0x4c35dd
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x555d70]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4c35da
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4c35de
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4c35e7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x555d70]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4c362a
cmp word [esi], dx
jne 0x4c362a
or byte [edi + eax + 0x28], 4
jmp 0x4c362f
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4c3768
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4c3748
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4c3671
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4c36a7
cmp eax, edx
jae 0x4c36b3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4c3649
jmp 0x4c3768
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c3744
cmp dword [ebp - 0x14], 0
je 0x4c3744
mov eax, dword [ebx*4 + 0x555d70]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4c371c
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x4c3762
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x555d70]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x555d70]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x555d70]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x4c3765
pop ebx
cmp word [ebp - 4], bx
jne 0x4c372d
cmp esi, dword [ebp + 0xc]
jne 0x4c372d
mov word [esi], bx
jmp 0x4c3765
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004c4001
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4c3768
push 0xd
jmp 0x4c3761
mov ecx, dword [ebx*4 + 0x555d70]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4c375f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4c3768
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4c88cf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4c896c
push ebx
push esi
call fcn.004c8898
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004c4d5f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4c8919
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4c896b
push edi
push eax
call fcn.004c0aac
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4c8939
call fcn.004c0735
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4c896a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004c4d5f
add esp, 0x20
test eax, eax
jne 0x4c8958
push edi
call fcn.004c0735
jmp 0x4c8960
push ebx
call fcn.004c0735
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4c896f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4c8980
pop esi
ret
push ebx
push edi
push esi
call fcn.004c8898
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004c0aac
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4c89a8
push ebx
push esi
push edi
call fcn.004b03c0
add esp, 0xc
push 0
call fcn.004c0735
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4c90f4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c8c1b
Function at 0x4d19c5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004d1941
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4d1b3d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4d1b3d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4d1aec
jg 0x4d1a1e
test eax, eax
je 0x4d1ae2
push 1
push 0x1000
call fcn.004c06d8
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4d1a44
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4d1ad9
push 0x8000
push ebx
call fcn.004bdfe6
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4d1a70
jg 0x4d1a6b
cmp ecx, 0x1000
jb 0x4d1a70
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004c2c6f
add esp, 0x10
cmp eax, 0xffffffff
je 0x4d1ab5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4d1a6b
jl 0x4d1a9c
test ecx, ecx
jne 0x4d1a5d
push dword [ebp - 0xc]
push ebx
call fcn.004bdfe6
push esi
call fcn.004c0735
add esp, 0xc
xor edi, edi
jmp 0x4d1b4e
cmp byte [edi + 0x24], 0
je 0x4d1acc
cmp dword [edi + 0x20], 5
jne 0x4d1acc
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4d1ad7
mov edi, dword [edi + 0x18]
jmp 0x4d1ad9
xor edi, edi
push esi
call fcn.004c0735
pop ecx
jmp 0x4d1b4e
test ecx, ecx
jg 0x4d1aae
jl 0x4d1aec
test eax, eax
jae 0x4d1aae
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c4001
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4d1b0f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4d1aae
jmp 0x4d1b46
push ebx
call fcn.004c9746
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4d1aae
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4d1b4e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4d1b4b
mov edi, dword [edi + 0x18]
jmp 0x4d1b4e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004c4001
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d1fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4d1ffd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4d1ffd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4056d2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x2c]
cmp eax, 5
je 0x405702
cmp eax, 6
je 0x405702
cmp eax, 7
je 0x405702
cmp eax, 8
je 0x405702
cmp eax, 3
je 0x4056f6
cmp eax, 4
jne 0x4056fc
pop ebp
jmp fcn.0040568a
pop ebp
jmp 0x4635a8
pop ebp
jmp 0x463489
push es
hlt
dec ebx
or al, 0x89
add ebx, ebp
pushal
push ebx
jle 0x4635d6
dec eax
push esi
mov dword [ecx], eax
mov ecx, ebx
push edi
call 0xf666486
add dword [ebx - 0x2a17a835], ecx
and byte cs:[edi], cl
mov bh, 0x7b
add al, 0x47
push edi
call fcn.00405a8e
push eax
mov dword [ebx + 8], eax
call 0x51081039
push edi
push dword [ebx]
cmp cx, bx
je 0x4635c0
jne 0x46359c
rcl dword [eax + 0x57], 0xff
xor esp, dword [esi + 0x3b]
retf
invalid
xor dh, 0xec
sub esp, 0xb740800
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
jmp 0xf663633

Function at 0x40fe40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
sub esp, 0x10
mov dword [esp + 0x28], ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x30], 3
add byte [eax], al
add byte [ebx - 0x6ffb74e9], cl
Function at 0x46a0f8
Capabilities:
Encode data using xor

Disassembly:
inc edi
add edi, esi
mov eax, 0x205c
call fcn.00431bd3
cmp byte [0x4c6280], 0x6a
adc al, byte [esi]
push 0x12
push es
push edi
mov edi, ecx
jne 0x3baca20f
add dword [edi + 0x850ff8], edi
add dword [edi], ecx
test bl, ch
sbb al, 0x48
mov ecx, dword [eax]
xor eax, 0x48f910
lea eax, [ebp + 0x138dfa8]
mov ebx, 0x39100f59
push ebx
push eax
push 0x66
push dword [0x4c6278]
push esi
salc
lea eax, [ebp + 0x138dfa8]
push eax
mov ecx, dword [ebp + 8]
cmp esi, dword [esi + ebx*8]
stc
mov ecx, dword [ebx - 0x20577a73]
cmp byte [ecx], al
push eax
pcmpeqw mm1, qword [eax]
push dword [0x4c6278]
push esi
salc
lea eax, [ebp + 0x138dfa8]
push eax
mov ecx, dword [ebp - 0x44]
call 0x8c407f84
jne 0x46a10b
hlt
Function at 0x6d56113f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x6d56114e
pop dword [ebp - 4]
mov eax, 0x62d24477
add eax, 0xa83ccd7
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xf99f9f4e
add dword [ebp - 0x14], 0x54b2a5fd
mov dword [ebp - 0x10], 0x98fc665c
add dword [ebp - 0x10], 0x9936e5e9
mov dword [ebp - 0xc], 0xd2ed05de
sub dword [ebp - 0xc], 0x86a0c1b0
mov dword [ebp - 8], 0xfd07b7f
sub dword [ebp - 8], 0xfd07b7f
lea eax, [ebp - 0x14]
push eax
mov eax, 0x7cd74051
add eax, 0xf07eeff7
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xd2b364cb
add dword [ebp - 0x14], 0xa1bf048b
mov dword [ebp - 0x10], 0x6e7c1456
add dword [ebp - 0x10], 0xd2f04d1f
mov dword [ebp - 0xc], 0x271ab614
sub dword [ebp - 0xc], 0xc3ab49a8
mov dword [ebp - 8], 0x5b7ed683
sub dword [ebp - 8], 0x5b7ed683
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3834e
push 0
call eax
mov ecx, 0xfcfb7a47
add ecx, 0x304d48a
xor esi, esi
add esi, eax
mov edx, 0x6d566200
add edx, dword [ebp - 4]
mov edi, 0xd8f9951b
add edi, 0xebd27df6
mov ebx, dword [edx]
xor ebx, edi
mov dword [esi], ebx
add esi, 0x720ac634
add esi, 0x8df539d0
add edx, 0x9d6910d0
sub edx, 0x9d6910cc
loop 0x6d561267
add eax, 0x48a5a241
add eax, 0xb75b8bd6
xor ebx, ebx
add ebx, eax
add eax, 0xe728bdb0
add eax, 0x18d74255
mov ecx, 0x92d74596
sub ecx, 0x25814596
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x6d5617f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d5617fb
repz ret
jmp fcn.6d561b91
Function at 0x4012fa
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4023c8
call fcn.00401909
push 1
call fcn.0040149a
pop ecx
test al, al
jne 0x40119d
push 7
call fcn.00401707
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00401465
mov byte [ebp - 0x24], al
mov eax, dword [0x40332c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x401196
test eax, eax
jne 0x401207
mov dword [0x40332c], ecx
push 0x4020f0
push 0x4020e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4011ea
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4012f4
push 0x4020dc
push 0x4020d4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40332c], 2
jmp 0x40120c
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004015f7
pop ecx
call fcn.004016fb
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40123c
push esi
call fcn.0040156a
pop ecx
test al, al
je 0x40123c
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00401903
call esi
call fcn.00401701
mov esi, eax
cmp dword [esi], edi
je 0x40125a
push esi
call fcn.0040156a
pop ecx
test al, al
je 0x40125a
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov edi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
push eax
push dword [edi]
push dword [esi]
call main
mov esi, eax
push 0
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
add esp, 0x14
call fcn.0040181c
test al, al
jne 0x401298
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4012a1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.00401614
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4012f4
call fcn.0040194f
ret
call fcn.0040100e
jmp 0x40117e

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100052e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002c2b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100328a0]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0
push 0x100328a4
push 0x10027fd4
push eax
call edx
test eax, eax
jns 0x1000531d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012873
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100328a4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0x10027fbc
push eax
call edx
test eax, eax
js 0x1000530d
mov eax, dword [0x100328a4]
mov edx, dword [esi]
mov ecx, dword [eax]
push 0xa
push edx
push eax
mov eax, dword [ecx + 0x34]
call eax
test eax, eax
js 0x1000530d
mov eax, dword [0x100328a4]
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], 0x14
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x3c
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x1000530d
mov eax, dword [0x100328a4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push eax
call edx
test eax, eax
js 0x1000530d
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp ax, 0xff81
je 0x100053b9
mov dword [0x100328b0], 0
cmp ax, 1
jne 0x100053c3
mov dword [0x100328b0], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.10012873
mov esp, ebp
pop ebp
ret