joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ed70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x633180]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45d52b
je 0x45d57e
cmp ebx, 0x20
jbe 0x45d584
cmp ebx, 0x40
jbe 0x45d5ca
jmp 0x45d66b
test ebx, ebx
je 0x45d574
add eax, 0x10
test ax, 0xff0
je 0x45d560
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x567180]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x567280]
jmp 0x45d548
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45d548
pxor xmm1, xmmword [0x633190]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x633190]
pxor xmm2, xmmword [0x6331a0]
pxor xmm3, xmmword [0x6331b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x633190]
pxor xmm2, xmmword [0x6331a0]
pxor xmm3, xmmword [0x6331b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45d6ca
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x632e50], 0
je 0x45ed8a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45d4f0
jmp fcn.00407ba0
Function at 0x45ed90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40248e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00407ba0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045daa0
jmp 0x402450
cmp byte [0x632e50], 0
je 0x45edab
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45d4f0
jmp 0x402450
Function at 0x4bdcb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bde71
sub esp, 0x34
lea eax, [0x522360]
mov dword [esp], eax
call fcn.0040b120
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x4bdcef
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ebp, ecx
jle 0x4bde18
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x4bde43
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x4bdce7
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x4bdce7
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x4bdce7
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x4bdce7
add esp, 0x34
ret
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov ebx, dword [esp + 0x2c]
cmp esi, edx
jge 0x4bddc2
cmp eax, ebp
jle 0x4bddc2
jbe 0x4bde67
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x4bde1c
mov eax, esi
mov ecx, edx
call fcn.0045eef0
mov ecx, eax
mov eax, ebp
call fcn.0045eef0
nop
call fcn.0045daa0
jmp fcn.004bdcb0
Function at 0x4bf9e0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bfa88
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4bfa3b
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x4bfa72
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.0045daa0
jmp fcn.004bf9e0
Function at 0x503200
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x503416
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x503299
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x5033f7
cmp ecx, 0xe
jne 0x503312
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x5033f7
cmp ecx, 0xf
jne 0x503388
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x5033f7
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.0045daa0
jmp fcn.00503200
Function at 0x50b0d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50b2b4
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.0045f53c
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0050ab40
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045f086
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x50b182
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x50b255
mov dword [esp + 0x10], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
mov dword [esp + 0x1c], edx
shl edx, 3
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [esp + ecx*8 + 0x58]
mov edi, dword [esi]
mov dword [esp + 0xc], edi
mov esi, dword [esi + 4]
mov ecx, ebx
shl edi, cl
and edi, edx
mov dword [esp + 8], edi
xchg edi, eax
mov byte [esp + 0x20], al
xchg edi, eax
lea ebp, [ecx - 0x20]
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
shl esi, cl
and esi, edx
mov ecx, ebp
mov edx, dword [esp + 0xc]
mov ebx, edx
shr edx, cl
and edx, edi
or edx, esi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov ebp, dword [esp + 0x14]
and ebx, ebp
or ebx, edx
mov edx, dword [esp + 8]
mov ebp, edx
shr edx, 8
mov esi, ebx
shl ebx, 0x18
or edx, ebx
mov byte [esp + 0x21], dl
mov edx, ebp
shr ebp, 0x10
mov ebx, esi
shl esi, 0x10
or esi, ebp
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov ebp, ebx
shl ebx, 8
shr edx, 0x18
or edx, ebx
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x50b286
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + ebp]
or esi, ebx
xchg esi, ebx
mov byte [eax + ebp], bl
xchg esi, ebx
inc ecx
cmp ecx, 8
jge 0x50b17b
movzx ebx, byte [esp + ecx + 0x28]
lea ebp, [edx + ecx]
cmp ebp, 0x20
jge 0x50b17b
test byte [eax], al
cmp ebp, 0x20
jb 0x50b278
mov eax, ebp
mov ecx, 0x20
call fcn.0045eef0
nop
call fcn.0045daa0
jmp fcn.0050b0d0
Function at 0x401077
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, 0x44fb40
mov ecx, edi
call fcn.004017eb
mov esi, eax
test esi, esi
js 0x401139
push 0x43d420
push dword [ebp + 0xc]
call fcn.004214ca
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x401139
push 0
push dword [ebp + 8]
mov ecx, edi
call fcn.00401840
mov dword [ebp - 8], eax
test eax, eax
jne 0x4010c9
or eax, 0xffffffff
jmp 0x40113c
push 0x8000
call fcn.0041cf8d
mov dword [ebp - 4], eax
pop ecx
test esi, esi
je 0x401117
jmp 0x4010e0
mov eax, dword [ebp - 4]
mov ecx, 0x8000
cmp esi, ecx
mov edi, ecx
mov ecx, 0x44fb40
cmovl edi, esi
push edi
push eax
push dword [ebp - 8]
call fcn.00401a05
push ebx
push edi
push 1
push dword [ebp - 4]
call fcn.00421719
add esp, 0x10
cmp eax, edi
jl 0x401112
sub esi, edi
jne 0x4010dd
mov edi, 0x44fb40
push dword [ebp - 8]
mov ecx, edi
call fcn.004017c2
push ebx
call fcn.00421389
push dword [ebp - 4]
call fcn.0041c941
pop ecx
pop ecx
test esi, esi
jne 0x401139
xor eax, eax
jmp 0x40113c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40608c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
or ecx, 0xffffffff
cmp dword [ebp + 0xc], edx
jle 0x4060b7
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [edx + esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43d4c0]
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x40609d
pop esi
not ecx
mov eax, ecx
pop ebp
ret 8

Function at 0x408d34
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00408de9
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x408d50
or eax, 0xffffffff
jmp 0x408d72
push esi
push edi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00421719
push edi
mov esi, eax
call fcn.00421389
add esp, 0x14
call fcn.00425078
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x408e2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x408e5c
cmp dword [ebp + 0xc], 0
je 0x408e5c
cmp dword [ebp + 0x10], 0
jg 0x408e47
xor eax, eax
pop ebp
ret
push dword [ebp + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004252e4
add esp, 0x10
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret
Function at 0x40e53b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0041d420
push esi
push edi
call fcn.00404c40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0041d08b
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00408d1c
push dword [ebp - 4]
lea eax, [edi + 0x368]
push eax
call fcn.0040a600
lea eax, [ebp - 4]
push eax
call fcn.00408d29
add esp, 0x18
lea eax, [ebp - 0x1004]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x20
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0041cf14
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call fcn.00408d1c
push dword [ebp - 4]
lea esi, [edi + 0x338]
push esi
call fcn.0040a600
push 0x5c
push dword [esi]
call fcn.0041ca2e
push dword [esi]
lea eax, [edi + 0x384]
push eax
call fcn.0040a600
push str.hsptv_
push dword [esi]
call fcn.00421790
lea eax, [ebp - 4]
push eax
call fcn.00408d29
push dword [esi]
lea eax, [edi + 0x388]
push eax
call fcn.0040a600
add esp, 0x40
pop edi
pop esi
leave
ret

Function at 0x40f4a2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shl eax, 2
push ebx
push esi
mov esi, dword [ebp + 0xc]
not eax
xor ebx, ebx
and eax, 8
or eax, 2
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp byte [esi], bl
je 0x40f534
push 0x3c
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.0041eaa0
lea eax, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
push eax
push esi
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x3c], ebx
call fcn.00408d1c
mov dword [ebp - 0x38], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00408d1c
add esp, 0x1c
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x28], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
lea eax, [ebp - 4]
push eax
je 0x40f5a6
call fcn.00408d29
lea eax, [ebp - 8]
push eax
call fcn.00408d29
pop ecx
pop ecx
jmp 0x40f5a2
push eax
test cl, 0x10
je 0x40f55a
mov eax, 0x43d43e
push eax
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408d1c
pop ecx
pop ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40f591
test cl, 0x20
je 0x40f57c
mov eax, 0x43d43e
push eax
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408d1c
pop ecx
pop ecx
push eax
push str.print
jmp 0x40f551
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408d1c
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.00408d29
pop ecx
cmp esi, 0x20
jl 0x40f5b6
pop esi
pop ebx
leave
ret
call fcn.00408d29
lea eax, [ebp - 8]
push eax
call fcn.00408d29
pop ecx
pop ecx
push 0x44c354
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0xe
push eax
call fcn.0041ec7c
int3
Function at 0x40f5cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0041d420
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, ecx
mov byte [ebp - 0x1004], dl
push esi
sub eax, edx
je 0x40f692
sub eax, 1
je 0x40f685
sub eax, 1
je 0x40f671
sub eax, 1
je 0x40f65d
sub eax, 1
je 0x40f64d
sub eax, 1
je 0x40f643
sub eax, 1
je 0x40f632
test ecx, 0x10000
je 0x40f6ec
push edx
movzx eax, cx
push eax
lea eax, [ebp - 0x1004]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x40f6a5
mov esi, dword [0x450a18]
add esi, 0x390
jmp 0x40f6e7
mov esi, 0x43d43e
jmp 0x40f6e7
mov eax, dword [0x450a18]
mov esi, dword [eax + 0x368]
jmp 0x40f6e7
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x40f6a5
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40f6a5
mov eax, dword [0x450a18]
mov esi, dword [eax + 0x384]
jmp 0x40f6e7
lea eax, [ebp - 0x1004]
push 0x1000
push eax
call fcn.00423824
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.00408d1c
mov eax, dword [0x450a18]
push dword [ebp + 8]
add eax, 0x338
push eax
call fcn.0040a600
lea eax, [ebp + 8]
push eax
call fcn.00408d29
mov eax, dword [0x450a18]
push 0x5c
mov esi, dword [eax + 0x338]
push esi
call fcn.0041ca2e
add esp, 0x1c
mov eax, esi
pop esi
leave
ret
push 0x44c354
lea eax, [ebp - 4]
mov dword [ebp - 4], 3
push eax
call fcn.0041ec7c
int3
Function at 0x40f702
Capabilities:
Get hostname
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0x104
push edi
push 4
pop edi
test bl, 0x10
je 0x40f729
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test bl, 0x20
je 0x40f74e
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp + 0x10]
and ebx, 0xf
mov ecx, dword [ebp + ebx*4 - 0x48]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
jmp 0x40f863
push esi
sub ebx, 0
je 0x40f7c8
sub ebx, 1
je 0x40f7b8
sub ebx, 1
je 0x40f793
sub ebx, 1
je 0x40f77e
sub ebx, 0xd
je 0x40f779
sub ebx, 1
je 0x40f774
xor eax, eax
jmp 0x40f862
mov eax, dword [ebp - 0x14]
jmp 0x40f789
mov eax, dword [ebp - 0x10]
jmp 0x40f789
mov eax, dword [0x450a18]
mov eax, dword [eax + 0x37c]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x40f85b
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp + 8]
push eax
push esi
call fcn.00408d1c
push dword [ebp + 8]
call fcn.004231c0
add esp, 0xc
jmp 0x40f836
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x40f7a1
mov esi, dword [ebp + 0x10]
push str.Windows
push esi
call fcn.00421780
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
mov ecx, 0x43db80
mov eax, 0x43db84
test ebx, ebx
cmovs ecx, eax
push ecx
push esi
call fcn.00421790
mov eax, ebx
shr eax, 8
movzx eax, al
push eax
movzx eax, bl
push eax
lea eax, [ebp - 0xc8]
push str._ver_d._d
push eax
call fcn.00401b4a
lea eax, [ebp - 0xc8]
push eax
push esi
call fcn.00421790
lea eax, [ebp + 8]
push eax
push esi
call fcn.00408d1c
push dword [ebp + 8]
call fcn.004231c0
add esp, 0x2c
mov edi, eax
cmp esi, dword [ebp + 8]
je 0x40f84e
push edi
push dword [ebp + 8]
push esi
call fcn.0041e520
add esp, 0xc
mov byte [edi + esi], 0
lea eax, [ebp + 8]
push eax
call fcn.00408d29
pop ecx
push 2
pop edi
mov ecx, dword [ebp + 0xc]
mov eax, esi
mov dword [ecx], edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x4126b8
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x43c711
call fcn.0041d3f8
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], esp
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x450acc]
test byte [eax + 0x30c], 2
je 0x41272d
cmp dword [esi + 4], 0x200
jne 0x41277c
cmp dword [0x450ae0], 0
movzx ecx, word [esi + 0xc]
movzx eax, word [esi + 0xe]
jne 0x412722
cmp dword [0x450ae4], ecx
jne 0x4127ab
cmp dword [0x450ae8], eax
jne 0x4127ab
jmp 0x41272d
mov dword [0x450ae4], ecx
mov dword [0x450ae8], eax
cmp dword [esi + 4], 0x100
jne 0x41276d
cmp dword [esi + 8], 9
jne 0x412741
call fcn.00412168
push 2
call fcn.0040560c
pop ecx
test eax, eax
je 0x41276d
push dword [esi + 0xc]
and dword [ebp - 4], 0
push dword [esi + 8]
push 2
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 2
call fcn.004057d5
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
cmp dword [esi + 4], 0x100
jne 0x41276d
cmp dword [0x450ae0], 0
jne 0x41272d
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push 0x44c354
jmp 0x4127b7
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0x44c354
push eax
call fcn.0041ec7c
int3